@cipherstash/stack 0.19.0 → 1.0.0-rc.0

package/dist/supabase/index.d.cts

@@ -1,223 +0,0 @@
-import { A as AuditConfig, e as EncryptionClient } from '../client-DSGHBN-g.cjs';
-import { A as AnyV3Table, a as QueryTypesForColumn, W as InferPlaintext } from '../table-DihEAlxG.cjs';
-import { EncryptionError } from '../errors/index.cjs';
-import { LockContext } from '../identity/index.cjs';
-import { g as EncryptedTable, h as EncryptedTableColumn } from '../types-public-CpS5KjwX.cjs';
-import '@byteslice/result';
-import '@cipherstash/protect-ffi';
-import 'zod';
-
-type EncryptedSupabaseConfig = {
-    encryptionClient: EncryptionClient;
-    supabaseClient: SupabaseClientLike;
-};
-interface EncryptedSupabaseInstance {
-    from<T extends Record<string, unknown> = Record<string, unknown>>(tableName: string, schema: EncryptedTable<EncryptedTableColumn>): EncryptedQueryBuilder<T>;
-}
-type EncryptedSupabaseV3Config = {
-    encryptionClient: EncryptionClient;
-    supabaseClient: SupabaseClientLike;
-};
-/**
- * The column builders declared on a v3 table, recovered from the table's
- * type-level `_columnType` brand.
- */
-type V3ColumnsOfTable<Table> = Table extends {
-    readonly _columnType: infer C;
-} ? C : never;
-/**
- * JS property names of a v3 table's storage-only columns — those whose domain
- * exposes no query capability (e.g. `types.Bool`, `types.Text`). Excluded from
- * the filterable keys so a filter on one is a type error, matching the runtime
- * guard in the v3 term encryption path.
- */
-type NonQueryableV3Keys<Table extends AnyV3Table> = {
-    [K in Extract<keyof V3ColumnsOfTable<Table>, string>]: [
-        QueryTypesForColumn<V3ColumnsOfTable<Table>[K]>
-    ] extends [never] ? K : never;
-}[Extract<keyof V3ColumnsOfTable<Table>, string>];
-/**
- * Row keys a v3 builder accepts in filter methods: every row key except the
- * table's storage-only encrypted columns. Plaintext (non-schema) columns pass
- * through untouched, exactly as in v2.
- */
-type V3FilterableKeys<Table extends AnyV3Table, Row extends Record<string, unknown>> = Exclude<Extract<keyof Row, string>, NonQueryableV3Keys<Table>>;
-/**
- * The v3 builder type: the shared {@link EncryptedQueryBuilder} surface with
- * filter methods narrowed to {@link V3FilterableKeys}.
- */
-type EncryptedQueryBuilderV3<Table extends AnyV3Table, Row extends Record<string, unknown>> = EncryptedQueryBuilder<Row, V3FilterableKeys<Table, Row> & StringKeyOf<Row>>;
-interface EncryptedSupabaseV3Instance {
-    /**
-     * `Row` defaults to exactly the table's inferred plaintext shape — NOT
-     * widened with an index signature. Widening would collapse
-     * {@link V3FilterableKeys} to `string` and silently disable the
-     * storage-only-column filter guard. The trade-off: with the default `Row`,
-     * plaintext passthrough columns (`id`, `created_at`, …) are not filterable
-     * or insertable at the type level — pass an explicit `Row` that includes
-     * them (`es.from<typeof users, UserRow>(…)`).
-     */
-    from<Table extends AnyV3Table, Row extends Record<string, unknown> = InferPlaintext<Table>>(tableName: string, table: Table): EncryptedQueryBuilderV3<Table, Row>;
-}
-type EncryptedSupabaseResponse<T> = {
-    data: T | null;
-    error: EncryptedSupabaseError | null;
-    count: number | null;
-    status: number;
-    statusText: string;
-};
-type EncryptedSupabaseError = {
-    message: string;
-    details?: string;
-    hint?: string;
-    code?: string;
-    encryptionError?: EncryptionError;
-};
-type FilterOp = 'eq' | 'neq' | 'like' | 'ilike' | 'in' | 'gt' | 'gte' | 'lt' | 'lte' | 'is';
-type PendingOrCondition = {
-    column: string;
-    op: FilterOp;
-    value: unknown;
-};
-interface SupabaseClientLike {
-    from(table: string): any;
-}
-
-/** Helper to extract string keys from T */
-type StringKeyOf<T> = Extract<keyof T, string>;
-interface EncryptedQueryBuilder<T extends Record<string, unknown> = Record<string, unknown>, FK extends StringKeyOf<T> = StringKeyOf<T>> extends PromiseLike<EncryptedSupabaseResponse<T[]>> {
-    select(columns: string, options?: {
-        head?: boolean;
-        count?: 'exact' | 'planned' | 'estimated';
-    }): EncryptedQueryBuilder<T, FK>;
-    insert(data: Partial<T> | Partial<T>[], options?: {
-        count?: 'exact' | 'planned' | 'estimated';
-        defaultToNull?: boolean;
-        onConflict?: string;
-    }): EncryptedQueryBuilder<T, FK>;
-    update(data: Partial<T>, options?: {
-        count?: 'exact' | 'planned' | 'estimated';
-    }): EncryptedQueryBuilder<T, FK>;
-    upsert(data: Partial<T> | Partial<T>[], options?: {
-        count?: 'exact' | 'planned' | 'estimated';
-        onConflict?: string;
-        ignoreDuplicates?: boolean;
-        defaultToNull?: boolean;
-    }): EncryptedQueryBuilder<T, FK>;
-    delete(options?: {
-        count?: 'exact' | 'planned' | 'estimated';
-    }): EncryptedQueryBuilder<T, FK>;
-    eq<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
-    neq<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
-    gt<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
-    gte<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
-    lt<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
-    lte<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
-    like<K extends FK>(column: K, pattern: string): EncryptedQueryBuilder<T, FK>;
-    ilike<K extends FK>(column: K, pattern: string): EncryptedQueryBuilder<T, FK>;
-    is<K extends FK>(column: K, value: null | boolean): EncryptedQueryBuilder<T, FK>;
-    in<K extends FK>(column: K, values: T[K][]): EncryptedQueryBuilder<T, FK>;
-    filter<K extends FK>(column: K, operator: string, value: T[K]): EncryptedQueryBuilder<T, FK>;
-    not<K extends FK>(column: K, operator: string, value: T[K]): EncryptedQueryBuilder<T, FK>;
-    or(filters: string, options?: {
-        referencedTable?: string;
-        foreignTable?: string;
-    }): EncryptedQueryBuilder<T, FK>;
-    or(conditions: PendingOrCondition[], options?: {
-        referencedTable?: string;
-        foreignTable?: string;
-    }): EncryptedQueryBuilder<T, FK>;
-    match(query: Partial<Pick<T, FK>>): EncryptedQueryBuilder<T, FK>;
-    order<K extends StringKeyOf<T>>(column: K, options?: {
-        ascending?: boolean;
-        nullsFirst?: boolean;
-        referencedTable?: string;
-        foreignTable?: string;
-    }): EncryptedQueryBuilder<T, FK>;
-    limit(count: number, options?: {
-        referencedTable?: string;
-        foreignTable?: string;
-    }): EncryptedQueryBuilder<T, FK>;
-    range(from: number, to: number, options?: {
-        referencedTable?: string;
-        foreignTable?: string;
-    }): EncryptedQueryBuilder<T, FK>;
-    single(): EncryptedQueryBuilder<T, FK>;
-    maybeSingle(): EncryptedQueryBuilder<T, FK>;
-    csv(): EncryptedQueryBuilder<T, FK>;
-    abortSignal(signal: AbortSignal): EncryptedQueryBuilder<T, FK>;
-    throwOnError(): EncryptedQueryBuilder<T, FK>;
-    returns<U extends Record<string, unknown>>(): EncryptedQueryBuilder<U>;
-    withLockContext(lockContext: LockContext): EncryptedQueryBuilder<T, FK>;
-    audit(config: AuditConfig): EncryptedQueryBuilder<T, FK>;
-}
-
-/**
- * Create an encrypted Supabase wrapper that transparently handles encryption
- * and decryption for queries on encrypted columns.
- *
- * @param config - Configuration containing the encryption client and Supabase client.
- * @returns An object with a `from()` method that mirrors `supabase.from()` but
- *   auto-encrypts mutations, adds `::jsonb` casts, encrypts filter values, and
- *   decrypts results.
- *
- * @example
- * ```typescript
- * import { Encryption } from '@cipherstash/stack'
- * import { encryptedSupabase } from '@cipherstash/stack/supabase'
- * import { encryptedTable, encryptedColumn } from '@cipherstash/stack/schema'
- *
- * const users = encryptedTable('users', {
- *   name: encryptedColumn('name').freeTextSearch().equality(),
- *   email: encryptedColumn('email').freeTextSearch().equality(),
- * })
- *
- * const client = await Encryption({ schemas: [users] })
- * const eSupabase = encryptedSupabase({ encryptionClient: client, supabaseClient: supabase })
- *
- * // INSERT - auto-encrypts, auto-converts to PG composite
- * await eSupabase.from('users', users)
- *   .insert({ name: 'John', email: 'john@example.com', age: 30 })
- *
- * // SELECT with filter - auto-casts ::jsonb, auto-encrypts search term, auto-decrypts
- * const { data } = await eSupabase.from('users', users)
- *   .select('id, email, name')
- *   .eq('email', 'john@example.com')
- * ```
- */
-declare function encryptedSupabase(config: EncryptedSupabaseConfig): EncryptedSupabaseInstance;
-/**
- * Create an encrypted Supabase wrapper for **EQL v3** schemas — tables
- * authored with `@cipherstash/stack/eql/v3` whose columns are native
- * `eql_v3.*` domains.
- *
- * The public surface and call shape are identical to {@link encryptedSupabase}
- * (`.eq/.neq/.in/.gt/.gte/.lt/.lte/.like/.ilike/.match/.or/.not/.filter`,
- * `withLockContext`, `audit`); only the schema type and the wire encoding
- * differ. The same Supabase caveats carry over: the `eql_v3` schema must be
- * added to the project's **Exposed schemas** and granted to the Supabase
- * roles for the operators to resolve, and encrypted `ORDER BY` is
- * unsupported (range *filtering* works).
- *
- * @example
- * ```typescript
- * import { Encryption } from '@cipherstash/stack'
- * import { encryptedTable, types } from '@cipherstash/stack/eql/v3'
- * import { encryptedSupabaseV3 } from '@cipherstash/stack/supabase'
- *
- * const users = encryptedTable('users', {
- *   email:  types.TextSearch('email'),  // eql_v3.text_search
- *   amount: types.IntegerOrd('amount'), // eql_v3.integer_ord
- * })
- *
- * const client = await Encryption({ schemas: [users] })
- * const es = encryptedSupabaseV3({ encryptionClient: client, supabaseClient: supabase })
- *
- * await es.from('users', users).insert({ email: 'a@b.com', amount: 30 })
- * await es.from('users', users).select('id, email, amount').eq('email', 'a@b.com')
- * await es.from('users', users).select('id, amount').gte('amount', 10).lte('amount', 100)
- * ```
- */
-declare function encryptedSupabaseV3(config: EncryptedSupabaseV3Config): EncryptedSupabaseV3Instance;
-
-export { type EncryptedQueryBuilder, type EncryptedQueryBuilderV3, type EncryptedSupabaseConfig, type EncryptedSupabaseError, type EncryptedSupabaseInstance, type EncryptedSupabaseResponse, type EncryptedSupabaseV3Config, type EncryptedSupabaseV3Instance, type PendingOrCondition, type SupabaseClientLike, type V3FilterableKeys, encryptedSupabase, encryptedSupabaseV3 };

package/dist/supabase/index.d.ts

@@ -1,223 +0,0 @@
-import { A as AuditConfig, e as EncryptionClient } from '../client-DfCrlHXh.js';
-import { A as AnyV3Table, a as QueryTypesForColumn, W as InferPlaintext } from '../table-CIH7jZ2h.js';
-import { EncryptionError } from '../errors/index.js';
-import { LockContext } from '../identity/index.js';
-import { g as EncryptedTable, h as EncryptedTableColumn } from '../types-public-CpS5KjwX.js';
-import '@byteslice/result';
-import '@cipherstash/protect-ffi';
-import 'zod';
-
-type EncryptedSupabaseConfig = {
-    encryptionClient: EncryptionClient;
-    supabaseClient: SupabaseClientLike;
-};
-interface EncryptedSupabaseInstance {
-    from<T extends Record<string, unknown> = Record<string, unknown>>(tableName: string, schema: EncryptedTable<EncryptedTableColumn>): EncryptedQueryBuilder<T>;
-}
-type EncryptedSupabaseV3Config = {
-    encryptionClient: EncryptionClient;
-    supabaseClient: SupabaseClientLike;
-};
-/**
- * The column builders declared on a v3 table, recovered from the table's
- * type-level `_columnType` brand.
- */
-type V3ColumnsOfTable<Table> = Table extends {
-    readonly _columnType: infer C;
-} ? C : never;
-/**
- * JS property names of a v3 table's storage-only columns — those whose domain
- * exposes no query capability (e.g. `types.Bool`, `types.Text`). Excluded from
- * the filterable keys so a filter on one is a type error, matching the runtime
- * guard in the v3 term encryption path.
- */
-type NonQueryableV3Keys<Table extends AnyV3Table> = {
-    [K in Extract<keyof V3ColumnsOfTable<Table>, string>]: [
-        QueryTypesForColumn<V3ColumnsOfTable<Table>[K]>
-    ] extends [never] ? K : never;
-}[Extract<keyof V3ColumnsOfTable<Table>, string>];
-/**
- * Row keys a v3 builder accepts in filter methods: every row key except the
- * table's storage-only encrypted columns. Plaintext (non-schema) columns pass
- * through untouched, exactly as in v2.
- */
-type V3FilterableKeys<Table extends AnyV3Table, Row extends Record<string, unknown>> = Exclude<Extract<keyof Row, string>, NonQueryableV3Keys<Table>>;
-/**
- * The v3 builder type: the shared {@link EncryptedQueryBuilder} surface with
- * filter methods narrowed to {@link V3FilterableKeys}.
- */
-type EncryptedQueryBuilderV3<Table extends AnyV3Table, Row extends Record<string, unknown>> = EncryptedQueryBuilder<Row, V3FilterableKeys<Table, Row> & StringKeyOf<Row>>;
-interface EncryptedSupabaseV3Instance {
-    /**
-     * `Row` defaults to exactly the table's inferred plaintext shape — NOT
-     * widened with an index signature. Widening would collapse
-     * {@link V3FilterableKeys} to `string` and silently disable the
-     * storage-only-column filter guard. The trade-off: with the default `Row`,
-     * plaintext passthrough columns (`id`, `created_at`, …) are not filterable
-     * or insertable at the type level — pass an explicit `Row` that includes
-     * them (`es.from<typeof users, UserRow>(…)`).
-     */
-    from<Table extends AnyV3Table, Row extends Record<string, unknown> = InferPlaintext<Table>>(tableName: string, table: Table): EncryptedQueryBuilderV3<Table, Row>;
-}
-type EncryptedSupabaseResponse<T> = {
-    data: T | null;
-    error: EncryptedSupabaseError | null;
-    count: number | null;
-    status: number;
-    statusText: string;
-};
-type EncryptedSupabaseError = {
-    message: string;
-    details?: string;
-    hint?: string;
-    code?: string;
-    encryptionError?: EncryptionError;
-};
-type FilterOp = 'eq' | 'neq' | 'like' | 'ilike' | 'in' | 'gt' | 'gte' | 'lt' | 'lte' | 'is';
-type PendingOrCondition = {
-    column: string;
-    op: FilterOp;
-    value: unknown;
-};
-interface SupabaseClientLike {
-    from(table: string): any;
-}
-
-/** Helper to extract string keys from T */
-type StringKeyOf<T> = Extract<keyof T, string>;
-interface EncryptedQueryBuilder<T extends Record<string, unknown> = Record<string, unknown>, FK extends StringKeyOf<T> = StringKeyOf<T>> extends PromiseLike<EncryptedSupabaseResponse<T[]>> {
-    select(columns: string, options?: {
-        head?: boolean;
-        count?: 'exact' | 'planned' | 'estimated';
-    }): EncryptedQueryBuilder<T, FK>;
-    insert(data: Partial<T> | Partial<T>[], options?: {
-        count?: 'exact' | 'planned' | 'estimated';
-        defaultToNull?: boolean;
-        onConflict?: string;
-    }): EncryptedQueryBuilder<T, FK>;
-    update(data: Partial<T>, options?: {
-        count?: 'exact' | 'planned' | 'estimated';
-    }): EncryptedQueryBuilder<T, FK>;
-    upsert(data: Partial<T> | Partial<T>[], options?: {
-        count?: 'exact' | 'planned' | 'estimated';
-        onConflict?: string;
-        ignoreDuplicates?: boolean;
-        defaultToNull?: boolean;
-    }): EncryptedQueryBuilder<T, FK>;
-    delete(options?: {
-        count?: 'exact' | 'planned' | 'estimated';
-    }): EncryptedQueryBuilder<T, FK>;
-    eq<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
-    neq<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
-    gt<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
-    gte<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
-    lt<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
-    lte<K extends FK>(column: K, value: T[K]): EncryptedQueryBuilder<T, FK>;
-    like<K extends FK>(column: K, pattern: string): EncryptedQueryBuilder<T, FK>;
-    ilike<K extends FK>(column: K, pattern: string): EncryptedQueryBuilder<T, FK>;
-    is<K extends FK>(column: K, value: null | boolean): EncryptedQueryBuilder<T, FK>;
-    in<K extends FK>(column: K, values: T[K][]): EncryptedQueryBuilder<T, FK>;
-    filter<K extends FK>(column: K, operator: string, value: T[K]): EncryptedQueryBuilder<T, FK>;
-    not<K extends FK>(column: K, operator: string, value: T[K]): EncryptedQueryBuilder<T, FK>;
-    or(filters: string, options?: {
-        referencedTable?: string;
-        foreignTable?: string;
-    }): EncryptedQueryBuilder<T, FK>;
-    or(conditions: PendingOrCondition[], options?: {
-        referencedTable?: string;
-        foreignTable?: string;
-    }): EncryptedQueryBuilder<T, FK>;
-    match(query: Partial<Pick<T, FK>>): EncryptedQueryBuilder<T, FK>;
-    order<K extends StringKeyOf<T>>(column: K, options?: {
-        ascending?: boolean;
-        nullsFirst?: boolean;
-        referencedTable?: string;
-        foreignTable?: string;
-    }): EncryptedQueryBuilder<T, FK>;
-    limit(count: number, options?: {
-        referencedTable?: string;
-        foreignTable?: string;
-    }): EncryptedQueryBuilder<T, FK>;
-    range(from: number, to: number, options?: {
-        referencedTable?: string;
-        foreignTable?: string;
-    }): EncryptedQueryBuilder<T, FK>;
-    single(): EncryptedQueryBuilder<T, FK>;
-    maybeSingle(): EncryptedQueryBuilder<T, FK>;
-    csv(): EncryptedQueryBuilder<T, FK>;
-    abortSignal(signal: AbortSignal): EncryptedQueryBuilder<T, FK>;
-    throwOnError(): EncryptedQueryBuilder<T, FK>;
-    returns<U extends Record<string, unknown>>(): EncryptedQueryBuilder<U>;
-    withLockContext(lockContext: LockContext): EncryptedQueryBuilder<T, FK>;
-    audit(config: AuditConfig): EncryptedQueryBuilder<T, FK>;
-}
-
-/**
- * Create an encrypted Supabase wrapper that transparently handles encryption
- * and decryption for queries on encrypted columns.
- *
- * @param config - Configuration containing the encryption client and Supabase client.
- * @returns An object with a `from()` method that mirrors `supabase.from()` but
- *   auto-encrypts mutations, adds `::jsonb` casts, encrypts filter values, and
- *   decrypts results.
- *
- * @example
- * ```typescript
- * import { Encryption } from '@cipherstash/stack'
- * import { encryptedSupabase } from '@cipherstash/stack/supabase'
- * import { encryptedTable, encryptedColumn } from '@cipherstash/stack/schema'
- *
- * const users = encryptedTable('users', {
- *   name: encryptedColumn('name').freeTextSearch().equality(),
- *   email: encryptedColumn('email').freeTextSearch().equality(),
- * })
- *
- * const client = await Encryption({ schemas: [users] })
- * const eSupabase = encryptedSupabase({ encryptionClient: client, supabaseClient: supabase })
- *
- * // INSERT - auto-encrypts, auto-converts to PG composite
- * await eSupabase.from('users', users)
- *   .insert({ name: 'John', email: 'john@example.com', age: 30 })
- *
- * // SELECT with filter - auto-casts ::jsonb, auto-encrypts search term, auto-decrypts
- * const { data } = await eSupabase.from('users', users)
- *   .select('id, email, name')
- *   .eq('email', 'john@example.com')
- * ```
- */
-declare function encryptedSupabase(config: EncryptedSupabaseConfig): EncryptedSupabaseInstance;
-/**
- * Create an encrypted Supabase wrapper for **EQL v3** schemas — tables
- * authored with `@cipherstash/stack/eql/v3` whose columns are native
- * `eql_v3.*` domains.
- *
- * The public surface and call shape are identical to {@link encryptedSupabase}
- * (`.eq/.neq/.in/.gt/.gte/.lt/.lte/.like/.ilike/.match/.or/.not/.filter`,
- * `withLockContext`, `audit`); only the schema type and the wire encoding
- * differ. The same Supabase caveats carry over: the `eql_v3` schema must be
- * added to the project's **Exposed schemas** and granted to the Supabase
- * roles for the operators to resolve, and encrypted `ORDER BY` is
- * unsupported (range *filtering* works).
- *
- * @example
- * ```typescript
- * import { Encryption } from '@cipherstash/stack'
- * import { encryptedTable, types } from '@cipherstash/stack/eql/v3'
- * import { encryptedSupabaseV3 } from '@cipherstash/stack/supabase'
- *
- * const users = encryptedTable('users', {
- *   email:  types.TextSearch('email'),  // eql_v3.text_search
- *   amount: types.IntegerOrd('amount'), // eql_v3.integer_ord
- * })
- *
- * const client = await Encryption({ schemas: [users] })
- * const es = encryptedSupabaseV3({ encryptionClient: client, supabaseClient: supabase })
- *
- * await es.from('users', users).insert({ email: 'a@b.com', amount: 30 })
- * await es.from('users', users).select('id, email, amount').eq('email', 'a@b.com')
- * await es.from('users', users).select('id, amount').gte('amount', 10).lte('amount', 100)
- * ```
- */
-declare function encryptedSupabaseV3(config: EncryptedSupabaseV3Config): EncryptedSupabaseV3Instance;
-
-export { type EncryptedQueryBuilder, type EncryptedQueryBuilderV3, type EncryptedSupabaseConfig, type EncryptedSupabaseError, type EncryptedSupabaseInstance, type EncryptedSupabaseResponse, type EncryptedSupabaseV3Config, type EncryptedSupabaseV3Instance, type PendingOrCondition, type SupabaseClientLike, type V3FilterableKeys, encryptedSupabase, encryptedSupabaseV3 };