@cipherstash/stack 0.19.0 → 1.0.0-rc.1

package/dist/encryption/index.cjs

@@ -4159,6 +4159,7 @@ var tokenizerSchema = external_exports.union([
   })
 ]).default({ kind: "ngram", token_length: 3 }).optional();
 var oreIndexOptsSchema = external_exports.object({});
+var opeIndexOptsSchema = external_exports.object({});
 var uniqueIndexOptsSchema = external_exports.object({
   token_filters: external_exports.array(tokenFilterSchema).default([]).optional()
 });
@@ -4180,10 +4181,12 @@ var arrayIndexModeSchema = external_exports.union([
 ]);
 var steVecIndexOptsSchema = external_exports.object({
   prefix: external_exports.string(),
-  array_index_mode: arrayIndexModeSchema.optional()
+  array_index_mode: arrayIndexModeSchema.optional(),
+  mode: external_exports.enum(["compat", "standard"]).optional()
 });
 var indexesSchema = external_exports.object({
   ore: oreIndexOptsSchema.optional(),
+  ope: opeIndexOptsSchema.optional(),
   unique: uniqueIndexOptsSchema.optional(),
   match: matchIndexOptsSchema.optional(),
   ste_vec: steVecIndexOptsSchema.optional()
@@ -4795,6 +4798,8 @@ var LockContext = class {
 
 // src/types.ts
 var queryTypeToFfi = {
+  // v3 `_ord` domains carry `ope` instead — `resolveIndexType` swaps this
+  // static default for the ordering index the column actually configures.
   orderAndRange: "ore",
   freeTextSearch: "match",
   equality: "unique",
@@ -4817,6 +4822,7 @@ function inferIndexType(column) {
   if (indexes.unique) return "unique";
   if (indexes.match) return "match";
   if (indexes.ore) return "ore";
+  if (indexes.ope) return "ope";
   if (indexes.ste_vec) return "ste_vec";
   throw new Error(
     `Column "${column.getName()}" has no suitable index for queries`
@@ -4838,6 +4844,7 @@ function validateIndexType(column, indexType) {
     unique: !!indexes.unique,
     match: !!indexes.match,
     ore: !!indexes.ore,
+    ope: !!indexes.ope,
     ste_vec: !!indexes.ste_vec
   };
   if (!indexMap[indexType]) {
@@ -4846,17 +4853,25 @@ function validateIndexType(column, indexType) {
     );
   }
 }
-function resolvesEqualityViaOre(column) {
-  if (!("getQueryCapabilities" in column)) return false;
-  if (!column.getQueryCapabilities().equality) return false;
+function equalityOrderingIndex(column) {
+  if (!("getQueryCapabilities" in column)) return null;
+  if (!column.getQueryCapabilities().equality) return null;
   const indexes = column.build().indexes ?? {};
-  return !indexes.unique && !!indexes.ore;
+  if (indexes.unique) return null;
+  if (indexes.ore) return "ore";
+  if (indexes.ope) return "ope";
+  return null;
 }
 function resolveIndexType(column, queryType, plaintext) {
-  const indexType = queryType ? queryTypeToFfi[queryType] : inferIndexType(column);
+  let indexType = queryType ? queryTypeToFfi[queryType] : inferIndexType(column);
   if (queryType) {
-    if (queryType === "equality" && resolvesEqualityViaOre(column)) {
-      return { indexType: "ore" };
+    if (queryType === "equality") {
+      const ordering = equalityOrderingIndex(column);
+      if (ordering) return { indexType: ordering };
+    }
+    if (queryType === "orderAndRange" && indexType === "ore") {
+      const indexes = column.build().indexes ?? {};
+      if (!indexes.ore && indexes.ope) indexType = "ope";
     }
     validateIndexType(column, indexType);
     if (queryType === "searchableJson") {
@@ -4877,6 +4892,11 @@ function resolveIndexType(column, queryType, plaintext) {
 }
 
 // src/encryption/helpers/validation.ts
+var INT64_MIN = -9223372036854775808n;
+var INT64_MAX = 9223372036854775807n;
+function isBigintOutOfInt64Range(value) {
+  return typeof value === "bigint" && (value < INT64_MIN || value > INT64_MAX);
+}
 function validateNumericValue(value) {
   if (typeof value === "number" && Number.isNaN(value)) {
     return {
@@ -4894,6 +4914,14 @@ function validateNumericValue(value) {
       }
     };
   }
+  if (isBigintOutOfInt64Range(value)) {
+    return {
+      failure: {
+        type: EncryptionErrorTypes.EncryptionError,
+        message: "[encryption]: Cannot encrypt bigint value out of int64 range"
+      }
+    };
+  }
   return void 0;
 }
 function assertValidNumericValue(value) {
@@ -4903,9 +4931,14 @@ function assertValidNumericValue(value) {
   if (typeof value === "number" && !Number.isFinite(value)) {
     throw new Error("[encryption]: Cannot encrypt Infinity value");
   }
+  if (isBigintOutOfInt64Range(value)) {
+    throw new Error(
+      "[encryption]: Cannot encrypt bigint value out of int64 range"
+    );
+  }
 }
 function assertValueIndexCompatibility(value, indexType, columnName) {
-  if (typeof value === "number" && indexType === "match") {
+  if ((typeof value === "number" || typeof value === "bigint") && indexType === "match") {
     throw new Error(
       `[encryption]: Cannot use 'match' index with numeric value on column "${columnName}". The 'freeTextSearch' index only supports string values. Configure the column with 'orderAndRange()' or 'equality()' for numeric queries.`
     );
@@ -5338,6 +5371,7 @@ function prepareFieldsForEncryption(model, table) {
           );
         }
       } else if (columnPaths2.includes(fullKey)) {
+        assertValidNumericValue(value);
         const id = index.toString();
         keyMap[id] = fullKey;
         operationFields[fullKey] = value;
@@ -5516,6 +5550,7 @@ function prepareBulkModelsForOperation(models, table) {
             );
           }
         } else if (columnPaths.includes(fullKey)) {
+          assertValidNumericValue(value);
           const id = index.toString();
           keyMap[id] = { modelIndex, fieldKey: fullKey };
           modelOperationFields[fullKey] = value;
@@ -5827,13 +5862,16 @@ var BulkDecryptModelsOperationWithLockContext = class extends EncryptionOperatio
 // src/encryption/operations/bulk-encrypt.ts
 var import_protect_ffi5 = require("@cipherstash/protect-ffi");
 var createEncryptPayloads = (plaintexts, column, table, lockContext) => {
-  return plaintexts.filter(({ plaintext }) => plaintext !== null).map(({ id, plaintext }) => ({
-    id,
-    plaintext,
-    column: column.getName(),
-    table: table.tableName,
-    ...lockContext && { lockContext }
-  }));
+  return plaintexts.filter(({ plaintext }) => plaintext !== null).map(({ id, plaintext }) => {
+    assertValidNumericValue(plaintext);
+    return {
+      id,
+      plaintext,
+      column: column.getName(),
+      table: table.tableName,
+      ...lockContext && { lockContext }
+    };
+  });
 };
 var createNullResult2 = (plaintexts) => plaintexts.map(({ id }) => ({ id, data: null }));
 var mapEncryptedDataToResult = (plaintexts, encryptedData) => {