@cipherstash/stack 0.19.0 → 1.0.0-rc.1

package/dist/encryption/v3.cjs

@@ -30,6 +30,10 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/encryption/v3.ts
 var v3_exports = {};
 __export(v3_exports, {
+  EncryptedBigintColumn: () => EncryptedBigintColumn,
+  EncryptedBigintEqColumn: () => EncryptedBigintEqColumn,
+  EncryptedBigintOrdColumn: () => EncryptedBigintOrdColumn,
+  EncryptedBigintOrdOreColumn: () => EncryptedBigintOrdOreColumn,
   EncryptedBooleanColumn: () => EncryptedBooleanColumn,
   EncryptedDateColumn: () => EncryptedDateColumn,
   EncryptedDateEqColumn: () => EncryptedDateEqColumn,
@@ -43,6 +47,7 @@ __export(v3_exports, {
   EncryptedIntegerEqColumn: () => EncryptedIntegerEqColumn,
   EncryptedIntegerOrdColumn: () => EncryptedIntegerOrdColumn,
   EncryptedIntegerOrdOreColumn: () => EncryptedIntegerOrdOreColumn,
+  EncryptedJsonColumn: () => EncryptedJsonColumn,
   EncryptedNumericColumn: () => EncryptedNumericColumn,
   EncryptedNumericEqColumn: () => EncryptedNumericEqColumn,
   EncryptedNumericOrdColumn: () => EncryptedNumericOrdColumn,
@@ -75,6 +80,408 @@ __export(v3_exports, {
 });
 module.exports = __toCommonJS(v3_exports);
 
+// src/schema/match-defaults.ts
+function defaultMatchOpts() {
+  return {
+    tokenizer: { kind: "ngram", token_length: 3 },
+    token_filters: [{ kind: "downcase" }],
+    k: 6,
+    m: 2048,
+    include_original: true
+  };
+}
+
+// src/eql/v3/columns.ts
+var DATE_LIKE_CASTS = ["date", "timestamp"];
+var STORAGE_ONLY = {
+  equality: false,
+  orderAndRange: false,
+  freeTextSearch: false
+};
+var EQUALITY_ONLY = {
+  equality: true,
+  orderAndRange: false,
+  freeTextSearch: false
+};
+var ORDER_AND_RANGE = {
+  equality: true,
+  orderAndRange: true,
+  freeTextSearch: false
+};
+var MATCH_ONLY = {
+  equality: false,
+  orderAndRange: false,
+  freeTextSearch: true
+};
+var TEXT_SEARCH = {
+  equality: true,
+  orderAndRange: true,
+  freeTextSearch: true
+};
+var TEXT_SEARCH_EQL_TYPE = "public.eql_v3_text_search";
+var INTEGER = {
+  eqlType: "public.eql_v3_integer",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var INTEGER_EQ = {
+  eqlType: "public.eql_v3_integer_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var INTEGER_ORD_ORE = {
+  eqlType: "public.eql_v3_integer_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var INTEGER_ORD = {
+  eqlType: "public.eql_v3_integer_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var SMALLINT = {
+  eqlType: "public.eql_v3_smallint",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var SMALLINT_EQ = {
+  eqlType: "public.eql_v3_smallint_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var SMALLINT_ORD_ORE = {
+  eqlType: "public.eql_v3_smallint_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var SMALLINT_ORD = {
+  eqlType: "public.eql_v3_smallint_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var BIGINT = {
+  eqlType: "public.eql_v3_bigint",
+  castAs: "bigint",
+  capabilities: STORAGE_ONLY
+};
+var BIGINT_EQ = {
+  eqlType: "public.eql_v3_bigint_eq",
+  castAs: "bigint",
+  capabilities: EQUALITY_ONLY
+};
+var BIGINT_ORD_ORE = {
+  eqlType: "public.eql_v3_bigint_ord_ore",
+  castAs: "bigint",
+  capabilities: ORDER_AND_RANGE
+};
+var BIGINT_ORD = {
+  eqlType: "public.eql_v3_bigint_ord",
+  castAs: "bigint",
+  capabilities: ORDER_AND_RANGE
+};
+var DATE = {
+  eqlType: "public.eql_v3_date",
+  castAs: "date",
+  capabilities: STORAGE_ONLY
+};
+var DATE_EQ = {
+  eqlType: "public.eql_v3_date_eq",
+  castAs: "date",
+  capabilities: EQUALITY_ONLY
+};
+var DATE_ORD_ORE = {
+  eqlType: "public.eql_v3_date_ord_ore",
+  castAs: "date",
+  capabilities: ORDER_AND_RANGE
+};
+var DATE_ORD = {
+  eqlType: "public.eql_v3_date_ord",
+  castAs: "date",
+  capabilities: ORDER_AND_RANGE
+};
+var TIMESTAMP = {
+  eqlType: "public.eql_v3_timestamp",
+  castAs: "timestamp",
+  capabilities: STORAGE_ONLY
+};
+var TIMESTAMP_EQ = {
+  eqlType: "public.eql_v3_timestamp_eq",
+  castAs: "timestamp",
+  capabilities: EQUALITY_ONLY
+};
+var TIMESTAMP_ORD_ORE = {
+  eqlType: "public.eql_v3_timestamp_ord_ore",
+  castAs: "timestamp",
+  capabilities: ORDER_AND_RANGE
+};
+var TIMESTAMP_ORD = {
+  eqlType: "public.eql_v3_timestamp_ord",
+  castAs: "timestamp",
+  capabilities: ORDER_AND_RANGE
+};
+var NUMERIC = {
+  eqlType: "public.eql_v3_numeric",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var NUMERIC_EQ = {
+  eqlType: "public.eql_v3_numeric_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var NUMERIC_ORD_ORE = {
+  eqlType: "public.eql_v3_numeric_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var NUMERIC_ORD = {
+  eqlType: "public.eql_v3_numeric_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var TEXT = {
+  eqlType: "public.eql_v3_text",
+  castAs: "string",
+  capabilities: STORAGE_ONLY
+};
+var TEXT_EQ = {
+  eqlType: "public.eql_v3_text_eq",
+  castAs: "string",
+  capabilities: EQUALITY_ONLY
+};
+var TEXT_MATCH = {
+  eqlType: "public.eql_v3_text_match",
+  castAs: "string",
+  capabilities: MATCH_ONLY
+};
+var TEXT_ORD_ORE = {
+  eqlType: "public.eql_v3_text_ord_ore",
+  castAs: "string",
+  capabilities: ORDER_AND_RANGE
+};
+var TEXT_ORD = {
+  eqlType: "public.eql_v3_text_ord",
+  castAs: "string",
+  capabilities: ORDER_AND_RANGE
+};
+var BOOLEAN = {
+  eqlType: "public.eql_v3_boolean",
+  castAs: "boolean",
+  capabilities: STORAGE_ONLY
+};
+var REAL = {
+  eqlType: "public.eql_v3_real",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var REAL_EQ = {
+  eqlType: "public.eql_v3_real_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var REAL_ORD_ORE = {
+  eqlType: "public.eql_v3_real_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var REAL_ORD = {
+  eqlType: "public.eql_v3_real_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var DOUBLE = {
+  eqlType: "public.eql_v3_double",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var DOUBLE_EQ = {
+  eqlType: "public.eql_v3_double_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var DOUBLE_ORD_ORE = {
+  eqlType: "public.eql_v3_double_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var DOUBLE_ORD = {
+  eqlType: "public.eql_v3_double_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+function indexesForCapabilities(capabilities, castAs, ordering) {
+  const indexes = {};
+  if (capabilities.equality && (!capabilities.orderAndRange || castAs === "string")) {
+    indexes.unique = { token_filters: [] };
+  }
+  if (capabilities.orderAndRange) {
+    indexes[ordering] = {};
+  }
+  if (capabilities.freeTextSearch) {
+    indexes.match = { ...defaultMatchOpts(), include_original: false };
+  }
+  if (capabilities.searchableJson) {
+    indexes.ste_vec = {
+      prefix: "enabled",
+      array_index_mode: { item: true, wildcard: true, position: false },
+      mode: "compat"
+    };
+  }
+  return indexes;
+}
+function orderingForEqlType(eqlType) {
+  return eqlType.endsWith("_ord_ore") ? "ore" : "ope";
+}
+function isQueryableCapabilities(capabilities) {
+  return capabilities.equality || capabilities.orderAndRange || capabilities.freeTextSearch || (capabilities.searchableJson ?? false);
+}
+var EncryptedV3Column = class {
+  constructor(columnName, definition) {
+    this.columnName = columnName;
+    this.definition = definition;
+  }
+  columnName;
+  definition;
+  getName() {
+    return this.columnName;
+  }
+  /** The concrete EQL v3 domain name. Metadata only; not emitted by `build()`. */
+  getEqlType() {
+    return this.definition.eqlType;
+  }
+  /** The semantic query capabilities this domain exposes. Metadata only. */
+  getQueryCapabilities() {
+    return this.definition.capabilities;
+  }
+  /** `true` when this domain can produce at least one kind of query term. */
+  isQueryable() {
+    return isQueryableCapabilities(
+      this.definition.capabilities
+    );
+  }
+  /** Emit the encrypt-config column: `cast_as` plus capability-derived indexes. */
+  build() {
+    return {
+      cast_as: this.definition.castAs,
+      indexes: indexesForCapabilities(
+        this.definition.capabilities,
+        this.definition.castAs,
+        orderingForEqlType(this.definition.eqlType)
+      )
+    };
+  }
+};
+var TEXT_SEARCH_DOMAIN = {
+  eqlType: TEXT_SEARCH_EQL_TYPE,
+  castAs: "string",
+  capabilities: TEXT_SEARCH
+};
+var EncryptedTextSearchColumn = class extends EncryptedV3Column {
+  constructor(columnName) {
+    super(columnName, TEXT_SEARCH_DOMAIN);
+  }
+};
+var EncryptedIntegerColumn = class extends EncryptedV3Column {
+};
+var EncryptedIntegerEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedIntegerOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedIntegerOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedSmallintColumn = class extends EncryptedV3Column {
+};
+var EncryptedSmallintEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedSmallintOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedSmallintOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedBigintColumn = class extends EncryptedV3Column {
+};
+var EncryptedBigintEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedBigintOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedBigintOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedDateColumn = class extends EncryptedV3Column {
+};
+var EncryptedDateEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedDateOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedDateOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedTimestampColumn = class extends EncryptedV3Column {
+};
+var EncryptedTimestampEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedTimestampOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedTimestampOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedNumericColumn = class extends EncryptedV3Column {
+};
+var EncryptedNumericEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedNumericOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedNumericOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextMatchColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedBooleanColumn = class extends EncryptedV3Column {
+};
+var EncryptedRealColumn = class extends EncryptedV3Column {
+};
+var EncryptedRealEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedRealOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedRealOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedDoubleColumn = class extends EncryptedV3Column {
+};
+var EncryptedDoubleEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedDoubleOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedDoubleOrdColumn = class extends EncryptedV3Column {
+};
+var JSON_DOMAIN = {
+  eqlType: "public.eql_v3_json",
+  castAs: "json",
+  capabilities: {
+    equality: false,
+    orderAndRange: false,
+    freeTextSearch: false,
+    searchableJson: true
+  }
+};
+var EncryptedJsonColumn = class extends EncryptedV3Column {
+  constructor(columnName) {
+    super(columnName, JSON_DOMAIN);
+  }
+};
+
+// src/errors/index.ts
+var EncryptionErrorTypes = {
+  ClientInitError: "ClientInitError",
+  EncryptionError: "EncryptionError",
+  DecryptionError: "DecryptionError",
+  LockContextError: "LockContextError",
+  CtsTokenError: "CtsTokenError"
+};
+
 // ../../node_modules/.pnpm/@byteslice+result@0.2.0/node_modules/@byteslice/result/dist/result.mjs
 function ensureError(ex) {
   return ex instanceof Error ? ex : new Error("Something went wrong");
@@ -100,15 +507,6 @@ function validate(uuid) {
 }
 var validate_default = validate;
 
-// src/errors/index.ts
-var EncryptionErrorTypes = {
-  ClientInitError: "ClientInitError",
-  EncryptionError: "EncryptionError",
-  DecryptionError: "DecryptionError",
-  LockContextError: "LockContextError",
-  CtsTokenError: "CtsTokenError"
-};
-
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -4150,24 +4548,6 @@ var coerce = {
 };
 var NEVER = INVALID;
 
-// src/schema/match-defaults.ts
-function defaultMatchOpts() {
-  return {
-    tokenizer: { kind: "ngram", token_length: 3 },
-    token_filters: [{ kind: "downcase" }],
-    k: 6,
-    m: 2048,
-    include_original: true
-  };
-}
-function cloneMatchOpts(opts) {
-  return {
-    ...opts,
-    tokenizer: { ...opts.tokenizer },
-    token_filters: opts.token_filters.map((f) => ({ ...f }))
-  };
-}
-
 // src/schema/index.ts
 var eqlCastAsEnum = external_exports.enum([
   "text",
@@ -4204,6 +4584,7 @@ var tokenizerSchema = external_exports.union([
   })
 ]).default({ kind: "ngram", token_length: 3 }).optional();
 var oreIndexOptsSchema = external_exports.object({});
+var opeIndexOptsSchema = external_exports.object({});
 var uniqueIndexOptsSchema = external_exports.object({
   token_filters: external_exports.array(tokenFilterSchema).default([]).optional()
 });
@@ -4225,10 +4606,12 @@ var arrayIndexModeSchema = external_exports.union([
 ]);
 var steVecIndexOptsSchema = external_exports.object({
   prefix: external_exports.string(),
-  array_index_mode: arrayIndexModeSchema.optional()
+  array_index_mode: arrayIndexModeSchema.optional(),
+  mode: external_exports.enum(["compat", "standard"]).optional()
 });
 var indexesSchema = external_exports.object({
   ore: oreIndexOptsSchema.optional(),
+  ope: opeIndexOptsSchema.optional(),
   unique: uniqueIndexOptsSchema.optional(),
   match: matchIndexOptsSchema.optional(),
   ste_vec: steVecIndexOptsSchema.optional()
@@ -4840,6 +5223,8 @@ var LockContext = class {
 
 // src/types.ts
 var queryTypeToFfi = {
+  // v3 `_ord` domains carry `ope` instead — `resolveIndexType` swaps this
+  // static default for the ordering index the column actually configures.
   orderAndRange: "ore",
   freeTextSearch: "match",
   equality: "unique",
@@ -4862,6 +5247,7 @@ function inferIndexType(column) {
   if (indexes.unique) return "unique";
   if (indexes.match) return "match";
   if (indexes.ore) return "ore";
+  if (indexes.ope) return "ope";
   if (indexes.ste_vec) return "ste_vec";
   throw new Error(
     `Column "${column.getName()}" has no suitable index for queries`
@@ -4883,6 +5269,7 @@ function validateIndexType(column, indexType) {
     unique: !!indexes.unique,
     match: !!indexes.match,
     ore: !!indexes.ore,
+    ope: !!indexes.ope,
     ste_vec: !!indexes.ste_vec
   };
   if (!indexMap[indexType]) {
@@ -4891,17 +5278,25 @@ function validateIndexType(column, indexType) {
     );
   }
 }
-function resolvesEqualityViaOre(column) {
-  if (!("getQueryCapabilities" in column)) return false;
-  if (!column.getQueryCapabilities().equality) return false;
+function equalityOrderingIndex(column) {
+  if (!("getQueryCapabilities" in column)) return null;
+  if (!column.getQueryCapabilities().equality) return null;
   const indexes = column.build().indexes ?? {};
-  return !indexes.unique && !!indexes.ore;
+  if (indexes.unique) return null;
+  if (indexes.ore) return "ore";
+  if (indexes.ope) return "ope";
+  return null;
 }
 function resolveIndexType(column, queryType, plaintext) {
-  const indexType = queryType ? queryTypeToFfi[queryType] : inferIndexType(column);
+  let indexType = queryType ? queryTypeToFfi[queryType] : inferIndexType(column);
   if (queryType) {
-    if (queryType === "equality" && resolvesEqualityViaOre(column)) {
-      return { indexType: "ore" };
+    if (queryType === "equality") {
+      const ordering = equalityOrderingIndex(column);
+      if (ordering) return { indexType: ordering };
+    }
+    if (queryType === "orderAndRange" && indexType === "ore") {
+      const indexes = column.build().indexes ?? {};
+      if (!indexes.ore && indexes.ope) indexType = "ope";
     }
     validateIndexType(column, indexType);
     if (queryType === "searchableJson") {
@@ -4922,6 +5317,11 @@ function resolveIndexType(column, queryType, plaintext) {
 }
 
 // src/encryption/helpers/validation.ts
+var INT64_MIN = -9223372036854775808n;
+var INT64_MAX = 9223372036854775807n;
+function isBigintOutOfInt64Range(value) {
+  return typeof value === "bigint" && (value < INT64_MIN || value > INT64_MAX);
+}
 function validateNumericValue(value) {
   if (typeof value === "number" && Number.isNaN(value)) {
     return {
@@ -4939,6 +5339,14 @@ function validateNumericValue(value) {
       }
     };
   }
+  if (isBigintOutOfInt64Range(value)) {
+    return {
+      failure: {
+        type: EncryptionErrorTypes.EncryptionError,
+        message: "[encryption]: Cannot encrypt bigint value out of int64 range"
+      }
+    };
+  }
   return void 0;
 }
 function assertValidNumericValue(value) {
@@ -4948,9 +5356,14 @@ function assertValidNumericValue(value) {
   if (typeof value === "number" && !Number.isFinite(value)) {
     throw new Error("[encryption]: Cannot encrypt Infinity value");
   }
+  if (isBigintOutOfInt64Range(value)) {
+    throw new Error(
+      "[encryption]: Cannot encrypt bigint value out of int64 range"
+    );
+  }
 }
 function assertValueIndexCompatibility(value, indexType, columnName) {
-  if (typeof value === "number" && indexType === "match") {
+  if ((typeof value === "number" || typeof value === "bigint") && indexType === "match") {
     throw new Error(
       `[encryption]: Cannot use 'match' index with numeric value on column "${columnName}". The 'freeTextSearch' index only supports string values. Configure the column with 'orderAndRange()' or 'equality()' for numeric queries.`
     );
@@ -5383,6 +5796,7 @@ function prepareFieldsForEncryption(model, table) {
           );
         }
       } else if (columnPaths2.includes(fullKey)) {
+        assertValidNumericValue(value);
         const id = index.toString();
         keyMap[id] = fullKey;
         operationFields[fullKey] = value;
@@ -5561,6 +5975,7 @@ function prepareBulkModelsForOperation(models, table) {
             );
           }
         } else if (columnPaths.includes(fullKey)) {
+          assertValidNumericValue(value);
           const id = index.toString();
           keyMap[id] = { modelIndex, fieldKey: fullKey };
           modelOperationFields[fullKey] = value;
@@ -5872,13 +6287,16 @@ var BulkDecryptModelsOperationWithLockContext = class extends EncryptionOperatio
 // src/encryption/operations/bulk-encrypt.ts
 var import_protect_ffi5 = require("@cipherstash/protect-ffi");
 var createEncryptPayloads = (plaintexts, column, table, lockContext) => {
-  return plaintexts.filter(({ plaintext }) => plaintext !== null).map(({ id, plaintext }) => ({
-    id,
-    plaintext,
-    column: column.getName(),
-    table: table.tableName,
-    ...lockContext && { lockContext }
-  }));
+  return plaintexts.filter(({ plaintext }) => plaintext !== null).map(({ id, plaintext }) => {
+    assertValidNumericValue(plaintext);
+    return {
+      id,
+      plaintext,
+      column: column.getName(),
+      table: table.tableName,
+      ...lockContext && { lockContext }
+    };
+  });
 };
 var createNullResult2 = (plaintexts) => plaintexts.map(({ id }) => ({ id, data: null }));
 var mapEncryptedDataToResult = (plaintexts, encryptedData) => {
@@ -6602,956 +7020,600 @@ var EncryptQueryOperation = class extends EncryptionOperation {
           this.opts.queryType,
           plaintext
         );
-        assertValueIndexCompatibility(
-          plaintext,
-          indexType,
-          this.opts.column.getName()
-        );
-        const encrypted = await (0, import_protect_ffi8.encryptQuery)(this.client, {
-          // `Plaintext` widens the FFI `JsPlaintext` with `Date` (serialized via
-          // `toJSON` at the boundary); cast until the upstream input union is
-          // corrected to include it.
-          plaintext,
-          column: this.opts.column.getName(),
-          table: this.opts.table.tableName,
-          indexType,
-          queryOp,
-          unverifiedContext: metadata
-        });
-        return formatEncryptedResult(encrypted, this.opts.returnType);
-      },
-      (error) => {
-        log.set({ errorCode: getErrorCode(error) ?? "unknown" });
-        return {
-          type: EncryptionErrorTypes.EncryptionError,
-          message: error.message,
-          code: getErrorCode(error)
-        };
-      }
-    );
-    log.emit();
-    return result;
-  }
-  getOperation() {
-    return { client: this.client, plaintext: this.plaintext, ...this.opts };
-  }
-};
-var EncryptQueryOperationWithLockContext = class extends EncryptionOperation {
-  constructor(client, plaintext, opts, lockContext, auditMetadata) {
-    super();
-    this.client = client;
-    this.plaintext = plaintext;
-    this.opts = opts;
-    this.lockContext = lockContext;
-    this.auditMetadata = auditMetadata;
-  }
-  client;
-  plaintext;
-  opts;
-  lockContext;
-  async execute() {
-    const log = createRequestLogger();
-    log.set({
-      op: "encryptQuery",
-      table: this.opts.table.tableName,
-      column: this.opts.column.getName(),
-      queryType: this.opts.queryType,
-      lockContext: true
-    });
-    if (this.plaintext === null || this.plaintext === void 0) {
-      log.emit();
-      return { data: null };
-    }
-    const plaintext = this.plaintext;
-    const validationError = validateNumericValue(plaintext);
-    if (validationError?.failure) {
-      log.emit();
-      return { failure: validationError.failure };
-    }
-    const result = await withResult(
-      async () => {
-        if (!this.client) throw noClientError();
-        const context = resolveLockContext(this.lockContext);
-        const { metadata } = this.getAuditData();
-        const { indexType, queryOp } = resolveIndexType(
-          this.opts.column,
-          this.opts.queryType,
-          plaintext
-        );
-        assertValueIndexCompatibility(
-          plaintext,
-          indexType,
-          this.opts.column.getName()
-        );
-        const encrypted = await (0, import_protect_ffi8.encryptQuery)(this.client, {
-          // `Plaintext` widens the FFI `JsPlaintext` with `Date` (serialized via
-          // `toJSON` at the boundary); cast until the upstream input union is
-          // corrected to include it.
-          plaintext,
-          column: this.opts.column.getName(),
-          table: this.opts.table.tableName,
-          indexType,
-          queryOp,
-          lockContext: context,
-          unverifiedContext: metadata
-        });
-        return formatEncryptedResult(encrypted, this.opts.returnType);
-      },
-      (error) => {
-        log.set({ errorCode: getErrorCode(error) ?? "unknown" });
-        return {
-          type: EncryptionErrorTypes.EncryptionError,
-          message: error.message,
-          code: getErrorCode(error)
-        };
-      }
-    );
-    log.emit();
-    return result;
-  }
-};
-
-// src/encryption/index.ts
-var noClientError = () => new Error(
-  "The Encryption client has not been initialized. Please call init() before using the client."
-);
-function resolveEqlVersion(schemas, explicit) {
-  const v3Count = schemas.filter(
-    (schema) => typeof schema.buildColumnKeyMap === "function"
-  ).length;
-  if (v3Count > 0 && v3Count < schemas.length) {
-    throw new Error(
-      "[encryption]: cannot mix EQL v2 and EQL v3 tables in one client \u2014 one client emits exactly one wire format. Create separate clients for the v2 and v3 schemas."
-    );
-  }
-  if (explicit !== void 0) {
-    return explicit;
-  }
-  return v3Count === 0 ? void 0 : 3;
-}
-var EncryptionClient = class {
-  client;
-  encryptConfig;
-  /**
-   * Initializes the EncryptionClient with the provided configuration.
-   * @internal
-   * @param config - The configuration object for initializing the client.
-   * @returns A promise that resolves to a {@link Result} containing the initialized EncryptionClient or an {@link EncryptionError}.
-   **/
-  async init(config) {
-    return await withResult(
-      async () => {
-        const validated = encryptConfigSchema.parse(
-          config.encryptConfig
-        );
-        logger.debug(
-          "Initializing the Encryption client with the following config:",
-          {
-            encryptConfig: validated
-          }
+        assertValueIndexCompatibility(
+          plaintext,
+          indexType,
+          this.opts.column.getName()
         );
-        this.client = await (0, import_protect_ffi9.newClient)({
-          encryptConfig: validated,
-          clientOpts: {
-            workspaceCrn: config.workspaceCrn,
-            accessKey: config.accessKey,
-            clientId: config.clientId,
-            clientKey: config.clientKey,
-            keyset: toFfiKeysetIdentifier(config.keyset)
-          },
-          strategy: config.authStrategy,
-          eqlVersion: config.eqlVersion
+        const encrypted = await (0, import_protect_ffi8.encryptQuery)(this.client, {
+          // `Plaintext` widens the FFI `JsPlaintext` with `Date` (serialized via
+          // `toJSON` at the boundary); cast until the upstream input union is
+          // corrected to include it.
+          plaintext,
+          column: this.opts.column.getName(),
+          table: this.opts.table.tableName,
+          indexType,
+          queryOp,
+          unverifiedContext: metadata
         });
-        this.encryptConfig = validated;
-        logger.debug("Successfully initialized the Encryption client.");
-        return this;
+        return formatEncryptedResult(encrypted, this.opts.returnType);
       },
-      (error) => ({
-        type: EncryptionErrorTypes.ClientInitError,
-        message: error.message
-      })
+      (error) => {
+        log.set({ errorCode: getErrorCode(error) ?? "unknown" });
+        return {
+          type: EncryptionErrorTypes.EncryptionError,
+          message: error.message,
+          code: getErrorCode(error)
+        };
+      }
     );
+    log.emit();
+    return result;
   }
-  /**
-   * Encrypt a value - returns a promise which resolves to an encrypted value.
-   *
-   * @param plaintext - The plaintext value to be encrypted.
-   * @param opts - Options specifying the column (or nested field) and table for encryption. See {@link EncryptOptions}.
-   * @returns An EncryptOperation that can be awaited or chained with additional methods.
-   *
-   * @example
-   * The following example demonstrates how to encrypt a value using the Encryption client.
-   * It includes defining an encryption schema with {@link encryptedTable} and {@link encryptedColumn},
-   * initializing the client with {@link Encryption}, and performing the encryption.
-   *
-   * `encrypt` returns an {@link EncryptOperation} which can be awaited to get a {@link Result}
-   * which can either be the encrypted value or an {@link EncryptionError}.
-   *
-   * ```typescript
-   * // Define encryption schema
-   * import { Encryption } from "@cipherstash/stack"
-   * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
-   * const userSchema = encryptedTable("users", {
-   *  email: encryptedColumn("email"),
-   * });
-   *
-   * // Initialize Encryption client
-   * const client = await Encryption({ schemas: [userSchema] })
-   *
-   * // Encrypt a value
-   * const encryptedResult = await client.encrypt(
-   *  "person@example.com",
-   *  { column: userSchema.email, table: userSchema }
-   * )
-   *
-   * // Handle encryption result
-   * if (encryptedResult.failure) {
-   *   throw new Error(`Encryption failed: ${encryptedResult.failure.message}`);
-   * }
-   *
-   * console.log("Encrypted data:", encryptedResult.data);
-   * ```
-   *
-   * @example
-   * When encrypting data, a {@link LockContext} can be provided to tie the encryption to a specific user or session.
-   * This ensures that the same lock context is required for decryption.
-   *
-   * The following example demonstrates how to create a lock context using a user's JWT token
-   * and use it during encryption.
-   *
-   * ```typescript
-   * // Define encryption schema and initialize client as above
-   *
-   * // Create a lock for the user's `sub` claim from their JWT
-   * const lc = new LockContext();
-   * const lockContext = await lc.identify(userJwt);
-   *
-   * if (lockContext.failure) {
-   *   // Handle the failure
-   * }
-   *
-   * // Encrypt a value with the lock context
-   * // Decryption will then require the same lock context
-   * const encryptedResult = await client.encrypt(
-   *  "person@example.com",
-   *  { column: userSchema.email, table: userSchema }
-   * )
-   *  .withLockContext(lockContext)
-   * ```
-   *
-   * @see {@link EncryptOptions}
-   * @see {@link Result}
-   * @see {@link encryptedTable}
-   * @see {@link encryptedColumn}
-   * @see {@link encryptedField}
-   * @see {@link LockContext}
-   * @see {@link EncryptOperation}
-   */
-  encrypt(plaintext, opts) {
-    return new EncryptOperation(this.client, plaintext, opts);
-  }
-  encryptQuery(plaintextOrTerms, opts) {
-    if (!opts && isScalarQueryTermArray(plaintextOrTerms)) {
-      return new BatchEncryptQueryOperation(this.client, plaintextOrTerms);
-    }
-    if (Array.isArray(plaintextOrTerms) && plaintextOrTerms.length === 0 && !opts) {
-      return new BatchEncryptQueryOperation(
-        this.client,
-        []
-      );
-    }
-    if (!opts) {
-      throw new Error("EncryptQueryOptions are required");
-    }
-    return new EncryptQueryOperation(
-      this.client,
-      plaintextOrTerms,
-      opts
-    );
+  getOperation() {
+    return { client: this.client, plaintext: this.plaintext, ...this.opts };
   }
-  /**
-   * Decryption - returns a promise which resolves to a decrypted value.
-   *
-   * @param encryptedData - The encrypted data to be decrypted.
-   * @returns A DecryptOperation that can be awaited or chained with additional methods.
-   *
-   * @example
-   * The following example demonstrates how to decrypt a value that was previously encrypted using the {@link encrypt} method.
-   * It includes encrypting a value first, then decrypting it, and handling the result.
-   *
-   * ```typescript
-   * const encryptedData = await client.encrypt(
-   *  "person@example.com",
-   *  { column: "email", table: "users" }
-   * )
-   * const decryptResult = await client.decrypt(encryptedData)
-   * if (decryptResult.failure) {
-   *   throw new Error(`Decryption failed: ${decryptResult.failure.message}`);
-   * }
-   * console.log("Decrypted data:", decryptResult.data);
-   * ```
-   *
-   * @example
-   * Provide a lock context when decrypting:
-   * ```typescript
-   *    await client.decrypt(encryptedData)
-   *      .withLockContext(lockContext)
-   * ```
-   *
-   * @remarks
-   * The public input type rejects null, but at runtime `decrypt` will
-   * short-circuit and return null when given a null ciphertext
-   * (defense in depth for legacy / manually-NULLed DB rows reached via
-   * casts or dynamic field walking). The narrow return type holds for
-   * any caller that respects the input contract.
-   *
-   * @see {@link LockContext}
-   * @see {@link DecryptOperation}
-   */
-  decrypt(encryptedData) {
-    return new DecryptOperation(this.client, encryptedData);
+};
+var EncryptQueryOperationWithLockContext = class extends EncryptionOperation {
+  constructor(client, plaintext, opts, lockContext, auditMetadata) {
+    super();
+    this.client = client;
+    this.plaintext = plaintext;
+    this.opts = opts;
+    this.lockContext = lockContext;
+    this.auditMetadata = auditMetadata;
   }
-  /**
-   * Encrypt a model (object) based on the table schema.
-   *
-   * Only fields whose keys match columns defined in the table schema are encrypted.
-   * All other fields are passed through unchanged. Returns a thenable operation
-   * that supports `.withLockContext()` for identity-aware encryption.
-   *
-   * The return type is **schema-aware**: fields matching the table schema are
-   * typed as `Encrypted`, while other fields retain their original types. For
-   * best results, let TypeScript infer the type parameters from the arguments
-   * rather than providing an explicit type argument.
-   *
-   * @param input - The model object with plaintext values to encrypt.
-   * @param table - The table schema defining which fields to encrypt.
-   * @returns An `EncryptModelOperation` that can be awaited to get a `Result`
-   *   containing the model with schema-defined fields typed as `Encrypted`,
-   *   or an `EncryptionError`.
-   *
-   * @example
-   * ```typescript
-   * import { Encryption } from "@cipherstash/stack"
-   * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
-   *
-   * type User = { id: string; email: string; createdAt: Date }
-   *
-   * const usersSchema = encryptedTable("users", {
-   *   email: encryptedColumn("email").equality(),
-   * })
-   *
-   * const client = await Encryption({ schemas: [usersSchema] })
-   *
-   * // Let TypeScript infer the return type from the schema.
-   * // result.data.email is typed as `Encrypted`, result.data.id stays `string`.
-   * const result = await client.encryptModel(
-   *   { id: "user_123", email: "alice@example.com", createdAt: new Date() },
-   *   usersSchema,
-   * )
-   *
-   * if (result.failure) {
-   *   console.error(result.failure.message)
-   * } else {
-   *   console.log(result.data.id)    // string
-   *   console.log(result.data.email) // Encrypted
-   * }
-   * ```
-   */
-  encryptModel(input, table) {
-    return new EncryptModelOperation(
-      this.client,
-      input,
-      table
+  client;
+  plaintext;
+  opts;
+  lockContext;
+  async execute() {
+    const log = createRequestLogger();
+    log.set({
+      op: "encryptQuery",
+      table: this.opts.table.tableName,
+      column: this.opts.column.getName(),
+      queryType: this.opts.queryType,
+      lockContext: true
+    });
+    if (this.plaintext === null || this.plaintext === void 0) {
+      log.emit();
+      return { data: null };
+    }
+    const plaintext = this.plaintext;
+    const validationError = validateNumericValue(plaintext);
+    if (validationError?.failure) {
+      log.emit();
+      return { failure: validationError.failure };
+    }
+    const result = await withResult(
+      async () => {
+        if (!this.client) throw noClientError();
+        const context = resolveLockContext(this.lockContext);
+        const { metadata } = this.getAuditData();
+        const { indexType, queryOp } = resolveIndexType(
+          this.opts.column,
+          this.opts.queryType,
+          plaintext
+        );
+        assertValueIndexCompatibility(
+          plaintext,
+          indexType,
+          this.opts.column.getName()
+        );
+        const encrypted = await (0, import_protect_ffi8.encryptQuery)(this.client, {
+          // `Plaintext` widens the FFI `JsPlaintext` with `Date` (serialized via
+          // `toJSON` at the boundary); cast until the upstream input union is
+          // corrected to include it.
+          plaintext,
+          column: this.opts.column.getName(),
+          table: this.opts.table.tableName,
+          indexType,
+          queryOp,
+          lockContext: context,
+          unverifiedContext: metadata
+        });
+        return formatEncryptedResult(encrypted, this.opts.returnType);
+      },
+      (error) => {
+        log.set({ errorCode: getErrorCode(error) ?? "unknown" });
+        return {
+          type: EncryptionErrorTypes.EncryptionError,
+          message: error.message,
+          code: getErrorCode(error)
+        };
+      }
     );
+    log.emit();
+    return result;
   }
-  /**
-   * Decrypt a model (object) whose fields contain encrypted values.
-   *
-   * Identifies encrypted fields automatically and decrypts them, returning the
-   * model with plaintext values. Returns a thenable operation that supports
-   * `.withLockContext()` for identity-aware decryption.
-   *
-   * @param input - The model object with encrypted field values.
-   * @returns A `DecryptModelOperation<T>` that can be awaited to get a `Result`
-   *   containing the model with decrypted plaintext fields, or an `EncryptionError`.
-   *
-   * @example
-   * ```typescript
-   * // Decrypt a previously encrypted model
-   * const decrypted = await client.decryptModel<User>(encryptedUser)
-   *
-   * if (decrypted.failure) {
-   *   console.error(decrypted.failure.message)
-   * } else {
-   *   console.log(decrypted.data.email) // "alice@example.com"
-   * }
-   *
-   * // With a lock context
-   * const decrypted = await client
-   *   .decryptModel<User>(encryptedUser)
-   *   .withLockContext(lockContext)
-   * ```
-   */
-  decryptModel(input) {
-    return new DecryptModelOperation(this.client, input);
-  }
-  /**
-   * Encrypt multiple models (objects) in a single bulk operation.
-   *
-   * Performs a single call to ZeroKMS regardless of the number of models,
-   * while still using a unique key for each encrypted value. Only fields
-   * matching the table schema are encrypted; other fields pass through unchanged.
-   *
-   * The return type is **schema-aware**: fields matching the table schema are
-   * typed as `Encrypted`, while other fields retain their original types. For
-   * best results, let TypeScript infer the type parameters from the arguments.
-   *
-   * @param input - An array of model objects with plaintext values to encrypt.
-   * @param table - The table schema defining which fields to encrypt.
-   * @returns A `BulkEncryptModelsOperation` that can be awaited to get a `Result`
-   *   containing an array of models with schema-defined fields typed as `Encrypted`,
-   *   or an `EncryptionError`.
-   *
-   * @example
-   * ```typescript
-   * import { Encryption } from "@cipherstash/stack"
-   * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
-   *
-   * type User = { id: string; email: string }
-   *
-   * const usersSchema = encryptedTable("users", {
-   *   email: encryptedColumn("email"),
-   * })
-   *
-   * const client = await Encryption({ schemas: [usersSchema] })
-   *
-   * // Let TypeScript infer the return type from the schema.
-   * // Each item's email is typed as `Encrypted`, id stays `string`.
-   * const result = await client.bulkEncryptModels(
-   *   [
-   *     { id: "1", email: "alice@example.com" },
-   *     { id: "2", email: "bob@example.com" },
-   *   ],
-   *   usersSchema,
-   * )
-   *
-   * if (!result.failure) {
-   *   console.log(result.data) // array of models with encrypted email fields
-   * }
-   * ```
-   */
-  bulkEncryptModels(input, table) {
-    return new BulkEncryptModelsOperation(
-      this.client,
-      input,
-      table
+};
+
+// src/encryption/index.ts
+var noClientError = () => new Error(
+  "The Encryption client has not been initialized. Please call init() before using the client."
+);
+function resolveEqlVersion(schemas, explicit) {
+  const v3Count = schemas.filter(
+    (schema) => typeof schema.buildColumnKeyMap === "function"
+  ).length;
+  if (v3Count > 0 && v3Count < schemas.length) {
+    throw new Error(
+      "[encryption]: cannot mix EQL v2 and EQL v3 tables in one client \u2014 one client emits exactly one wire format. Create separate clients for the v2 and v3 schemas."
     );
   }
-  /**
-   * Decrypt multiple models (objects) in a single bulk operation.
-   *
-   * Performs a single call to ZeroKMS regardless of the number of models,
-   * restoring all encrypted fields to their original plaintext values.
-   *
-   * @param input - An array of model objects with encrypted field values.
-   * @returns A `BulkDecryptModelsOperation<T>` that can be awaited to get a `Result`
-   *   containing an array of models with decrypted plaintext fields, or an `EncryptionError`.
-   *
-   * @example
-   * ```typescript
-   * const encryptedUsers = encryptedResult.data // from bulkEncryptModels
-   *
-   * const result = await client.bulkDecryptModels<User>(encryptedUsers)
-   *
-   * if (!result.failure) {
-   *   for (const user of result.data) {
-   *     console.log(user.email) // plaintext email
-   *   }
-   * }
-   *
-   * // With a lock context
-   * const result = await client
-   *   .bulkDecryptModels<User>(encryptedUsers)
-   *   .withLockContext(lockContext)
-   * ```
-   */
-  bulkDecryptModels(input) {
-    return new BulkDecryptModelsOperation(this.client, input);
+  if (explicit !== void 0) {
+    return explicit;
   }
+  return v3Count === 0 ? void 0 : 3;
+}
+var EncryptionClient = class {
+  client;
+  encryptConfig;
   /**
-   * Encrypt multiple plaintext values in a single bulk operation.
-   *
-   * Each value is encrypted with its own unique key via a single call to ZeroKMS.
-   * Values can include optional `id` fields for correlating results back to
-   * your application data.
-   *
-   * @param plaintexts - An array of objects with `plaintext` (and optional `id`) fields.
-   * @param opts - Options specifying the target column (or nested {@link encryptedField}) and table. See {@link EncryptOptions}.
-   * @returns A `BulkEncryptOperation` that can be awaited to get a `Result`
-   *   containing an array of `{ id?, data: Encrypted }` objects, or an `EncryptionError`.
-   *
-   * @example
-   * ```typescript
-   * import { Encryption } from "@cipherstash/stack"
-   * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
-   *
-   * const users = encryptedTable("users", {
-   *   email: encryptedColumn("email"),
-   * })
-   * const client = await Encryption({ schemas: [users] })
-   *
-   * const result = await client.bulkEncrypt(
-   *   [
-   *     { id: "u1", plaintext: "alice@example.com" },
-   *     { id: "u2", plaintext: "bob@example.com" },
-   *   ],
-   *   { column: users.email, table: users },
-   * )
-   *
-   * if (!result.failure) {
-   *   // result.data = [{ id: "u1", data: Encrypted }, { id: "u2", data: Encrypted }, ...]
-   *   console.log(result.data)
-   * }
-   * ```
-   */
-  bulkEncrypt(plaintexts, opts) {
-    return new BulkEncryptOperation(this.client, plaintexts, opts);
+   * Initializes the EncryptionClient with the provided configuration.
+   * @internal
+   * @param config - The configuration object for initializing the client.
+   * @returns A promise that resolves to a {@link Result} containing the initialized EncryptionClient or an {@link EncryptionError}.
+   **/
+  async init(config) {
+    return await withResult(
+      async () => {
+        const validated = encryptConfigSchema.parse(
+          config.encryptConfig
+        );
+        logger.debug(
+          "Initializing the Encryption client with the following config:",
+          {
+            encryptConfig: validated
+          }
+        );
+        this.client = await (0, import_protect_ffi9.newClient)({
+          encryptConfig: validated,
+          clientOpts: {
+            workspaceCrn: config.workspaceCrn,
+            accessKey: config.accessKey,
+            clientId: config.clientId,
+            clientKey: config.clientKey,
+            keyset: toFfiKeysetIdentifier(config.keyset)
+          },
+          strategy: config.authStrategy,
+          eqlVersion: config.eqlVersion
+        });
+        this.encryptConfig = validated;
+        logger.debug("Successfully initialized the Encryption client.");
+        return this;
+      },
+      (error) => ({
+        type: EncryptionErrorTypes.ClientInitError,
+        message: error.message
+      })
+    );
   }
   /**
-   * Decrypt multiple encrypted values in a single bulk operation.
-   *
-   * Performs a single call to ZeroKMS to decrypt all values. The result uses
-   * a multi-status pattern: each item in the returned array has either a `data`
-   * field (success) or an `error` field (failure), allowing graceful handling
-   * of partial failures.
+   * Encrypt a value - returns a promise which resolves to an encrypted value.
    *
-   * @param encryptedPayloads - An array of objects with `data` (encrypted payload) and optional `id` fields.
-   * @returns A `BulkDecryptOperation` that can be awaited to get a `Result`
-   *   containing an array of `{ id?, data: plaintext }` or `{ id?, error: string }` objects,
-   *   or an `EncryptionError` if the entire operation fails.
+   * @param plaintext - The plaintext value to be encrypted.
+   * @param opts - Options specifying the column (or nested field) and table for encryption. See {@link EncryptOptions}.
+   * @returns An EncryptOperation that can be awaited or chained with additional methods.
    *
    * @example
-   * ```typescript
-   * const encrypted = await client.bulkEncrypt(plaintexts, { column: users.email, table: users })
-   *
-   * const result = await client.bulkDecrypt(encrypted.data)
+   * The following example demonstrates how to encrypt a value using the Encryption client.
+   * It includes defining an encryption schema with {@link encryptedTable} and {@link encryptedColumn},
+   * initializing the client with {@link Encryption}, and performing the encryption.
    *
-   * if (!result.failure) {
-   *   for (const item of result.data) {
-   *     if ("data" in item) {
-   *       console.log(`${item.id}: ${item.data}`)
-   *     } else {
-   *       console.error(`${item.id} failed: ${item.error}`)
-   *     }
-   *   }
-   * }
-   * ```
-   */
-  bulkDecrypt(encryptedPayloads) {
-    return new BulkDecryptOperation(this.client, encryptedPayloads);
-  }
-  /**
-   * Get the encrypt config object.
+   * `encrypt` returns an {@link EncryptOperation} which can be awaited to get a {@link Result}
+   * which can either be the encrypted value or an {@link EncryptionError}.
    *
-   * @returns The encrypt config object.
-   */
-  getEncryptConfig() {
-    return this.encryptConfig;
-  }
-};
-var warnedStrategyDeprecated = false;
-function warnStrategyDeprecated() {
-  if (warnedStrategyDeprecated) return;
-  warnedStrategyDeprecated = true;
-  console.warn(
-    "[encryption]: `config.strategy` is deprecated and will be removed in a future release \u2014 use `config.authStrategy` instead."
-  );
-}
-var Encryption = async (config) => {
-  const { schemas, config: clientConfig } = config;
-  if (!schemas.length) {
-    throw new Error(
-      "[encryption]: At least one encryptedTable must be provided to initialize the encryption client"
-    );
-  }
-  if (clientConfig?.keyset && "id" in clientConfig.keyset && !validate_default(clientConfig.keyset.id)) {
-    throw new Error(
-      "[encryption]: Invalid UUID provided for keyset id. Must be a valid UUID."
-    );
-  }
-  if (clientConfig?.strategy) {
-    warnStrategyDeprecated();
-  }
-  const authStrategy = clientConfig?.authStrategy ?? clientConfig?.strategy;
-  const client = new EncryptionClient();
-  const encryptConfig = buildEncryptConfig(...schemas);
-  const eqlVersion = resolveEqlVersion(schemas, clientConfig?.eqlVersion);
-  const result = await client.init({
-    encryptConfig,
-    ...clientConfig,
-    authStrategy,
-    eqlVersion
-  });
-  if (result.failure) {
-    throw new Error(`[encryption]: ${result.failure.message}`);
-  }
-  return result.data;
-};
-
-// src/eql/v3/columns.ts
-var STORAGE_ONLY = {
-  equality: false,
-  orderAndRange: false,
-  freeTextSearch: false
-};
-var EQUALITY_ONLY = {
-  equality: true,
-  orderAndRange: false,
-  freeTextSearch: false
-};
-var ORDER_AND_RANGE = {
-  equality: true,
-  orderAndRange: true,
-  freeTextSearch: false
-};
-var MATCH_ONLY = {
-  equality: false,
-  orderAndRange: false,
-  freeTextSearch: true
-};
-var TEXT_SEARCH = {
-  equality: true,
-  orderAndRange: true,
-  freeTextSearch: true
-};
-var TEXT_SEARCH_EQL_TYPE = "eql_v3.text_search";
-var INTEGER = {
-  eqlType: "eql_v3.integer",
-  castAs: "number",
-  capabilities: STORAGE_ONLY
-};
-var INTEGER_EQ = {
-  eqlType: "eql_v3.integer_eq",
-  castAs: "number",
-  capabilities: EQUALITY_ONLY
-};
-var INTEGER_ORD_ORE = {
-  eqlType: "eql_v3.integer_ord_ore",
-  castAs: "number",
-  capabilities: ORDER_AND_RANGE
-};
-var INTEGER_ORD = {
-  eqlType: "eql_v3.integer_ord",
-  castAs: "number",
-  capabilities: ORDER_AND_RANGE
-};
-var SMALLINT = {
-  eqlType: "eql_v3.smallint",
-  castAs: "number",
-  capabilities: STORAGE_ONLY
-};
-var SMALLINT_EQ = {
-  eqlType: "eql_v3.smallint_eq",
-  castAs: "number",
-  capabilities: EQUALITY_ONLY
-};
-var SMALLINT_ORD_ORE = {
-  eqlType: "eql_v3.smallint_ord_ore",
-  castAs: "number",
-  capabilities: ORDER_AND_RANGE
-};
-var SMALLINT_ORD = {
-  eqlType: "eql_v3.smallint_ord",
-  castAs: "number",
-  capabilities: ORDER_AND_RANGE
-};
-var DATE = {
-  eqlType: "eql_v3.date",
-  castAs: "date",
-  capabilities: STORAGE_ONLY
-};
-var DATE_EQ = {
-  eqlType: "eql_v3.date_eq",
-  castAs: "date",
-  capabilities: EQUALITY_ONLY
-};
-var DATE_ORD_ORE = {
-  eqlType: "eql_v3.date_ord_ore",
-  castAs: "date",
-  capabilities: ORDER_AND_RANGE
-};
-var DATE_ORD = {
-  eqlType: "eql_v3.date_ord",
-  castAs: "date",
-  capabilities: ORDER_AND_RANGE
-};
-var TIMESTAMP = {
-  eqlType: "eql_v3.timestamp",
-  castAs: "timestamp",
-  capabilities: STORAGE_ONLY
-};
-var TIMESTAMP_EQ = {
-  eqlType: "eql_v3.timestamp_eq",
-  castAs: "timestamp",
-  capabilities: EQUALITY_ONLY
-};
-var TIMESTAMP_ORD_ORE = {
-  eqlType: "eql_v3.timestamp_ord_ore",
-  castAs: "timestamp",
-  capabilities: ORDER_AND_RANGE
-};
-var TIMESTAMP_ORD = {
-  eqlType: "eql_v3.timestamp_ord",
-  castAs: "timestamp",
-  capabilities: ORDER_AND_RANGE
-};
-var NUMERIC = {
-  eqlType: "eql_v3.numeric",
-  castAs: "number",
-  capabilities: STORAGE_ONLY
-};
-var NUMERIC_EQ = {
-  eqlType: "eql_v3.numeric_eq",
-  castAs: "number",
-  capabilities: EQUALITY_ONLY
-};
-var NUMERIC_ORD_ORE = {
-  eqlType: "eql_v3.numeric_ord_ore",
-  castAs: "number",
-  capabilities: ORDER_AND_RANGE
-};
-var NUMERIC_ORD = {
-  eqlType: "eql_v3.numeric_ord",
-  castAs: "number",
-  capabilities: ORDER_AND_RANGE
-};
-var TEXT = {
-  eqlType: "eql_v3.text",
-  castAs: "string",
-  capabilities: STORAGE_ONLY
-};
-var TEXT_EQ = {
-  eqlType: "eql_v3.text_eq",
-  castAs: "string",
-  capabilities: EQUALITY_ONLY
-};
-var TEXT_MATCH = {
-  eqlType: "eql_v3.text_match",
-  castAs: "string",
-  capabilities: MATCH_ONLY
-};
-var TEXT_ORD_ORE = {
-  eqlType: "eql_v3.text_ord_ore",
-  castAs: "string",
-  capabilities: ORDER_AND_RANGE
-};
-var TEXT_ORD = {
-  eqlType: "eql_v3.text_ord",
-  castAs: "string",
-  capabilities: ORDER_AND_RANGE
-};
-var BOOLEAN = {
-  eqlType: "eql_v3.boolean",
-  castAs: "boolean",
-  capabilities: STORAGE_ONLY
-};
-var REAL = {
-  eqlType: "eql_v3.real",
-  castAs: "number",
-  capabilities: STORAGE_ONLY
-};
-var REAL_EQ = {
-  eqlType: "eql_v3.real_eq",
-  castAs: "number",
-  capabilities: EQUALITY_ONLY
-};
-var REAL_ORD_ORE = {
-  eqlType: "eql_v3.real_ord_ore",
-  castAs: "number",
-  capabilities: ORDER_AND_RANGE
-};
-var REAL_ORD = {
-  eqlType: "eql_v3.real_ord",
-  castAs: "number",
-  capabilities: ORDER_AND_RANGE
-};
-var DOUBLE = {
-  eqlType: "eql_v3.double",
-  castAs: "number",
-  capabilities: STORAGE_ONLY
-};
-var DOUBLE_EQ = {
-  eqlType: "eql_v3.double_eq",
-  castAs: "number",
-  capabilities: EQUALITY_ONLY
-};
-var DOUBLE_ORD_ORE = {
-  eqlType: "eql_v3.double_ord_ore",
-  castAs: "number",
-  capabilities: ORDER_AND_RANGE
-};
-var DOUBLE_ORD = {
-  eqlType: "eql_v3.double_ord",
-  castAs: "number",
-  capabilities: ORDER_AND_RANGE
-};
-function indexesForCapabilities(capabilities, castAs) {
-  const indexes = {};
-  if (capabilities.equality && (!capabilities.orderAndRange || castAs === "string")) {
-    indexes.unique = { token_filters: [] };
-  }
-  if (capabilities.orderAndRange) {
-    indexes.ore = {};
-  }
-  if (capabilities.freeTextSearch) {
-    indexes.match = defaultMatchOpts();
+   * ```typescript
+   * // Define encryption schema
+   * import { Encryption } from "@cipherstash/stack"
+   * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
+   * const userSchema = encryptedTable("users", {
+   *  email: encryptedColumn("email"),
+   * });
+   *
+   * // Initialize Encryption client
+   * const client = await Encryption({ schemas: [userSchema] })
+   *
+   * // Encrypt a value
+   * const encryptedResult = await client.encrypt(
+   *  "person@example.com",
+   *  { column: userSchema.email, table: userSchema }
+   * )
+   *
+   * // Handle encryption result
+   * if (encryptedResult.failure) {
+   *   throw new Error(`Encryption failed: ${encryptedResult.failure.message}`);
+   * }
+   *
+   * console.log("Encrypted data:", encryptedResult.data);
+   * ```
+   *
+   * @example
+   * When encrypting data, a {@link LockContext} can be provided to tie the encryption to a specific user or session.
+   * This ensures that the same lock context is required for decryption.
+   *
+   * The following example demonstrates how to create a lock context using a user's JWT token
+   * and use it during encryption.
+   *
+   * ```typescript
+   * // Define encryption schema and initialize client as above
+   *
+   * // Create a lock for the user's `sub` claim from their JWT
+   * const lc = new LockContext();
+   * const lockContext = await lc.identify(userJwt);
+   *
+   * if (lockContext.failure) {
+   *   // Handle the failure
+   * }
+   *
+   * // Encrypt a value with the lock context
+   * // Decryption will then require the same lock context
+   * const encryptedResult = await client.encrypt(
+   *  "person@example.com",
+   *  { column: userSchema.email, table: userSchema }
+   * )
+   *  .withLockContext(lockContext)
+   * ```
+   *
+   * @see {@link EncryptOptions}
+   * @see {@link Result}
+   * @see {@link encryptedTable}
+   * @see {@link encryptedColumn}
+   * @see {@link encryptedField}
+   * @see {@link LockContext}
+   * @see {@link EncryptOperation}
+   */
+  encrypt(plaintext, opts) {
+    return new EncryptOperation(this.client, plaintext, opts);
   }
-  return indexes;
-}
-function isQueryableCapabilities(capabilities) {
-  return capabilities.equality || capabilities.orderAndRange || capabilities.freeTextSearch;
-}
-var EncryptedV3Column = class {
-  constructor(columnName, definition) {
-    this.columnName = columnName;
-    this.definition = definition;
+  encryptQuery(plaintextOrTerms, opts) {
+    if (!opts && isScalarQueryTermArray(plaintextOrTerms)) {
+      return new BatchEncryptQueryOperation(this.client, plaintextOrTerms);
+    }
+    if (Array.isArray(plaintextOrTerms) && plaintextOrTerms.length === 0 && !opts) {
+      return new BatchEncryptQueryOperation(
+        this.client,
+        []
+      );
+    }
+    if (!opts) {
+      throw new Error("EncryptQueryOptions are required");
+    }
+    return new EncryptQueryOperation(
+      this.client,
+      plaintextOrTerms,
+      opts
+    );
   }
-  columnName;
-  definition;
-  getName() {
-    return this.columnName;
+  /**
+   * Decryption - returns a promise which resolves to a decrypted value.
+   *
+   * @param encryptedData - The encrypted data to be decrypted.
+   * @returns A DecryptOperation that can be awaited or chained with additional methods.
+   *
+   * @example
+   * The following example demonstrates how to decrypt a value that was previously encrypted using the {@link encrypt} method.
+   * It includes encrypting a value first, then decrypting it, and handling the result.
+   *
+   * ```typescript
+   * const encryptedData = await client.encrypt(
+   *  "person@example.com",
+   *  { column: "email", table: "users" }
+   * )
+   * const decryptResult = await client.decrypt(encryptedData)
+   * if (decryptResult.failure) {
+   *   throw new Error(`Decryption failed: ${decryptResult.failure.message}`);
+   * }
+   * console.log("Decrypted data:", decryptResult.data);
+   * ```
+   *
+   * @example
+   * Provide a lock context when decrypting:
+   * ```typescript
+   *    await client.decrypt(encryptedData)
+   *      .withLockContext(lockContext)
+   * ```
+   *
+   * @remarks
+   * The public input type rejects null, but at runtime `decrypt` will
+   * short-circuit and return null when given a null ciphertext
+   * (defense in depth for legacy / manually-NULLed DB rows reached via
+   * casts or dynamic field walking). The narrow return type holds for
+   * any caller that respects the input contract.
+   *
+   * @see {@link LockContext}
+   * @see {@link DecryptOperation}
+   */
+  decrypt(encryptedData) {
+    return new DecryptOperation(this.client, encryptedData);
   }
-  /** The concrete EQL v3 domain name. Metadata only; not emitted by `build()`. */
-  getEqlType() {
-    return this.definition.eqlType;
+  /**
+   * Encrypt a model (object) based on the table schema.
+   *
+   * Only fields whose keys match columns defined in the table schema are encrypted.
+   * All other fields are passed through unchanged. Returns a thenable operation
+   * that supports `.withLockContext()` for identity-aware encryption.
+   *
+   * The return type is **schema-aware**: fields matching the table schema are
+   * typed as `Encrypted`, while other fields retain their original types. For
+   * best results, let TypeScript infer the type parameters from the arguments
+   * rather than providing an explicit type argument.
+   *
+   * @param input - The model object with plaintext values to encrypt.
+   * @param table - The table schema defining which fields to encrypt.
+   * @returns An `EncryptModelOperation` that can be awaited to get a `Result`
+   *   containing the model with schema-defined fields typed as `Encrypted`,
+   *   or an `EncryptionError`.
+   *
+   * @example
+   * ```typescript
+   * import { Encryption } from "@cipherstash/stack"
+   * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
+   *
+   * type User = { id: string; email: string; createdAt: Date }
+   *
+   * const usersSchema = encryptedTable("users", {
+   *   email: encryptedColumn("email").equality(),
+   * })
+   *
+   * const client = await Encryption({ schemas: [usersSchema] })
+   *
+   * // Let TypeScript infer the return type from the schema.
+   * // result.data.email is typed as `Encrypted`, result.data.id stays `string`.
+   * const result = await client.encryptModel(
+   *   { id: "user_123", email: "alice@example.com", createdAt: new Date() },
+   *   usersSchema,
+   * )
+   *
+   * if (result.failure) {
+   *   console.error(result.failure.message)
+   * } else {
+   *   console.log(result.data.id)    // string
+   *   console.log(result.data.email) // Encrypted
+   * }
+   * ```
+   */
+  encryptModel(input, table) {
+    return new EncryptModelOperation(
+      this.client,
+      input,
+      table
+    );
   }
-  /** The semantic query capabilities this domain exposes. Metadata only. */
-  getQueryCapabilities() {
-    return this.definition.capabilities;
+  /**
+   * Decrypt a model (object) whose fields contain encrypted values.
+   *
+   * Identifies encrypted fields automatically and decrypts them, returning the
+   * model with plaintext values. Returns a thenable operation that supports
+   * `.withLockContext()` for identity-aware decryption.
+   *
+   * @param input - The model object with encrypted field values.
+   * @returns A `DecryptModelOperation<T>` that can be awaited to get a `Result`
+   *   containing the model with decrypted plaintext fields, or an `EncryptionError`.
+   *
+   * @example
+   * ```typescript
+   * // Decrypt a previously encrypted model
+   * const decrypted = await client.decryptModel<User>(encryptedUser)
+   *
+   * if (decrypted.failure) {
+   *   console.error(decrypted.failure.message)
+   * } else {
+   *   console.log(decrypted.data.email) // "alice@example.com"
+   * }
+   *
+   * // With a lock context
+   * const decrypted = await client
+   *   .decryptModel<User>(encryptedUser)
+   *   .withLockContext(lockContext)
+   * ```
+   */
+  decryptModel(input) {
+    return new DecryptModelOperation(this.client, input);
   }
-  /** `true` when this domain can produce at least one kind of query term. */
-  isQueryable() {
-    return isQueryableCapabilities(
-      this.definition.capabilities
+  /**
+   * Encrypt multiple models (objects) in a single bulk operation.
+   *
+   * Performs a single call to ZeroKMS regardless of the number of models,
+   * while still using a unique key for each encrypted value. Only fields
+   * matching the table schema are encrypted; other fields pass through unchanged.
+   *
+   * The return type is **schema-aware**: fields matching the table schema are
+   * typed as `Encrypted`, while other fields retain their original types. For
+   * best results, let TypeScript infer the type parameters from the arguments.
+   *
+   * @param input - An array of model objects with plaintext values to encrypt.
+   * @param table - The table schema defining which fields to encrypt.
+   * @returns A `BulkEncryptModelsOperation` that can be awaited to get a `Result`
+   *   containing an array of models with schema-defined fields typed as `Encrypted`,
+   *   or an `EncryptionError`.
+   *
+   * @example
+   * ```typescript
+   * import { Encryption } from "@cipherstash/stack"
+   * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
+   *
+   * type User = { id: string; email: string }
+   *
+   * const usersSchema = encryptedTable("users", {
+   *   email: encryptedColumn("email"),
+   * })
+   *
+   * const client = await Encryption({ schemas: [usersSchema] })
+   *
+   * // Let TypeScript infer the return type from the schema.
+   * // Each item's email is typed as `Encrypted`, id stays `string`.
+   * const result = await client.bulkEncryptModels(
+   *   [
+   *     { id: "1", email: "alice@example.com" },
+   *     { id: "2", email: "bob@example.com" },
+   *   ],
+   *   usersSchema,
+   * )
+   *
+   * if (!result.failure) {
+   *   console.log(result.data) // array of models with encrypted email fields
+   * }
+   * ```
+   */
+  bulkEncryptModels(input, table) {
+    return new BulkEncryptModelsOperation(
+      this.client,
+      input,
+      table
     );
   }
-  /** Emit the encrypt-config column: `cast_as` plus capability-derived indexes. */
-  build() {
-    return {
-      cast_as: this.definition.castAs,
-      indexes: indexesForCapabilities(
-        this.definition.capabilities,
-        this.definition.castAs
-      )
-    };
+  /**
+   * Decrypt multiple models (objects) in a single bulk operation.
+   *
+   * Performs a single call to ZeroKMS regardless of the number of models,
+   * restoring all encrypted fields to their original plaintext values.
+   *
+   * @param input - An array of model objects with encrypted field values.
+   * @returns A `BulkDecryptModelsOperation<T>` that can be awaited to get a `Result`
+   *   containing an array of models with decrypted plaintext fields, or an `EncryptionError`.
+   *
+   * @example
+   * ```typescript
+   * const encryptedUsers = encryptedResult.data // from bulkEncryptModels
+   *
+   * const result = await client.bulkDecryptModels<User>(encryptedUsers)
+   *
+   * if (!result.failure) {
+   *   for (const user of result.data) {
+   *     console.log(user.email) // plaintext email
+   *   }
+   * }
+   *
+   * // With a lock context
+   * const result = await client
+   *   .bulkDecryptModels<User>(encryptedUsers)
+   *   .withLockContext(lockContext)
+   * ```
+   */
+  bulkDecryptModels(input) {
+    return new BulkDecryptModelsOperation(this.client, input);
   }
-};
-var TEXT_SEARCH_DOMAIN = {
-  eqlType: TEXT_SEARCH_EQL_TYPE,
-  castAs: "string",
-  capabilities: TEXT_SEARCH
-};
-var EncryptedTextSearchColumn = class extends EncryptedV3Column {
-  matchOpts;
-  constructor(columnName) {
-    super(columnName, TEXT_SEARCH_DOMAIN);
-    this.matchOpts = defaultMatchOpts();
+  /**
+   * Encrypt multiple plaintext values in a single bulk operation.
+   *
+   * Each value is encrypted with its own unique key via a single call to ZeroKMS.
+   * Values can include optional `id` fields for correlating results back to
+   * your application data.
+   *
+   * @param plaintexts - An array of objects with `plaintext` (and optional `id`) fields.
+   * @param opts - Options specifying the target column (or nested {@link encryptedField}) and table. See {@link EncryptOptions}.
+   * @returns A `BulkEncryptOperation` that can be awaited to get a `Result`
+   *   containing an array of `{ id?, data: Encrypted }` objects, or an `EncryptionError`.
+   *
+   * @example
+   * ```typescript
+   * import { Encryption } from "@cipherstash/stack"
+   * import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
+   *
+   * const users = encryptedTable("users", {
+   *   email: encryptedColumn("email"),
+   * })
+   * const client = await Encryption({ schemas: [users] })
+   *
+   * const result = await client.bulkEncrypt(
+   *   [
+   *     { id: "u1", plaintext: "alice@example.com" },
+   *     { id: "u2", plaintext: "bob@example.com" },
+   *   ],
+   *   { column: users.email, table: users },
+   * )
+   *
+   * if (!result.failure) {
+   *   // result.data = [{ id: "u1", data: Encrypted }, { id: "u2", data: Encrypted }, ...]
+   *   console.log(result.data)
+   * }
+   * ```
+   */
+  bulkEncrypt(plaintexts, opts) {
+    return new BulkEncryptOperation(this.client, plaintexts, opts);
   }
   /**
-   * Tune the match index. Each provided key replaces its default; omitted
-   * keys keep the default. This NEVER enables a capability — match is always
-   * on for this type. Merge semantics mirror v2's `opts?.x ?? default`.
+   * Decrypt multiple encrypted values in a single bulk operation.
+   *
+   * Performs a single call to ZeroKMS to decrypt all values. The result uses
+   * a multi-status pattern: each item in the returned array has either a `data`
+   * field (success) or an `error` field (failure), allowing graceful handling
+   * of partial failures.
+   *
+   * @param encryptedPayloads - An array of objects with `data` (encrypted payload) and optional `id` fields.
+   * @returns A `BulkDecryptOperation` that can be awaited to get a `Result`
+   *   containing an array of `{ id?, data: plaintext }` or `{ id?, error: string }` objects,
+   *   or an `EncryptionError` if the entire operation fails.
+   *
+   * @example
+   * ```typescript
+   * const encrypted = await client.bulkEncrypt(plaintexts, { column: users.email, table: users })
+   *
+   * const result = await client.bulkDecrypt(encrypted.data)
+   *
+   * if (!result.failure) {
+   *   for (const item of result.data) {
+   *     if ("data" in item) {
+   *       console.log(`${item.id}: ${item.data}`)
+   *     } else {
+   *       console.error(`${item.id} failed: ${item.error}`)
+   *     }
+   *   }
+   * }
+   * ```
    */
-  freeTextSearch(opts) {
-    const defaults = defaultMatchOpts();
-    this.matchOpts = cloneMatchOpts({
-      tokenizer: opts?.tokenizer ?? defaults.tokenizer,
-      token_filters: opts?.token_filters ?? defaults.token_filters,
-      k: opts?.k ?? defaults.k,
-      m: opts?.m ?? defaults.m,
-      include_original: opts?.include_original ?? defaults.include_original
-    });
-    return this;
+  bulkDecrypt(encryptedPayloads) {
+    return new BulkDecryptOperation(this.client, encryptedPayloads);
   }
-  /** Emit the encrypt-config column. Byte-identical to a v2 equality+order+match column. */
-  build() {
-    return {
-      cast_as: "string",
-      indexes: {
-        unique: { token_filters: [] },
-        ore: {},
-        match: cloneMatchOpts(this.matchOpts)
-      }
-    };
+  /**
+   * Get the encrypt config object.
+   *
+   * @returns The encrypt config object.
+   */
+  getEncryptConfig() {
+    return this.encryptConfig;
   }
 };
-var EncryptedIntegerColumn = class extends EncryptedV3Column {
-};
-var EncryptedIntegerEqColumn = class extends EncryptedV3Column {
-};
-var EncryptedIntegerOrdOreColumn = class extends EncryptedV3Column {
-};
-var EncryptedIntegerOrdColumn = class extends EncryptedV3Column {
-};
-var EncryptedSmallintColumn = class extends EncryptedV3Column {
-};
-var EncryptedSmallintEqColumn = class extends EncryptedV3Column {
-};
-var EncryptedSmallintOrdOreColumn = class extends EncryptedV3Column {
-};
-var EncryptedSmallintOrdColumn = class extends EncryptedV3Column {
-};
-var EncryptedDateColumn = class extends EncryptedV3Column {
-};
-var EncryptedDateEqColumn = class extends EncryptedV3Column {
-};
-var EncryptedDateOrdOreColumn = class extends EncryptedV3Column {
-};
-var EncryptedDateOrdColumn = class extends EncryptedV3Column {
-};
-var EncryptedTimestampColumn = class extends EncryptedV3Column {
-};
-var EncryptedTimestampEqColumn = class extends EncryptedV3Column {
-};
-var EncryptedTimestampOrdOreColumn = class extends EncryptedV3Column {
-};
-var EncryptedTimestampOrdColumn = class extends EncryptedV3Column {
-};
-var EncryptedNumericColumn = class extends EncryptedV3Column {
-};
-var EncryptedNumericEqColumn = class extends EncryptedV3Column {
-};
-var EncryptedNumericOrdOreColumn = class extends EncryptedV3Column {
-};
-var EncryptedNumericOrdColumn = class extends EncryptedV3Column {
-};
-var EncryptedTextColumn = class extends EncryptedV3Column {
-};
-var EncryptedTextEqColumn = class extends EncryptedV3Column {
-};
-var EncryptedTextMatchColumn = class extends EncryptedV3Column {
-};
-var EncryptedTextOrdOreColumn = class extends EncryptedV3Column {
-};
-var EncryptedTextOrdColumn = class extends EncryptedV3Column {
-};
-var EncryptedBooleanColumn = class extends EncryptedV3Column {
-};
-var EncryptedRealColumn = class extends EncryptedV3Column {
-};
-var EncryptedRealEqColumn = class extends EncryptedV3Column {
-};
-var EncryptedRealOrdOreColumn = class extends EncryptedV3Column {
-};
-var EncryptedRealOrdColumn = class extends EncryptedV3Column {
-};
-var EncryptedDoubleColumn = class extends EncryptedV3Column {
-};
-var EncryptedDoubleEqColumn = class extends EncryptedV3Column {
-};
-var EncryptedDoubleOrdOreColumn = class extends EncryptedV3Column {
-};
-var EncryptedDoubleOrdColumn = class extends EncryptedV3Column {
+var warnedStrategyDeprecated = false;
+function warnStrategyDeprecated() {
+  if (warnedStrategyDeprecated) return;
+  warnedStrategyDeprecated = true;
+  console.warn(
+    "[encryption]: `config.strategy` is deprecated and will be removed in a future release \u2014 use `config.authStrategy` instead."
+  );
+}
+var Encryption = async (config) => {
+  const { schemas, config: clientConfig } = config;
+  if (!schemas.length) {
+    throw new Error(
+      "[encryption]: At least one encryptedTable must be provided to initialize the encryption client"
+    );
+  }
+  if (clientConfig?.keyset && "id" in clientConfig.keyset && !validate_default(clientConfig.keyset.id)) {
+    throw new Error(
+      "[encryption]: Invalid UUID provided for keyset id. Must be a valid UUID."
+    );
+  }
+  if (clientConfig?.strategy) {
+    warnStrategyDeprecated();
+  }
+  const authStrategy = clientConfig?.authStrategy ?? clientConfig?.strategy;
+  const client = new EncryptionClient();
+  const encryptConfig = buildEncryptConfig(...schemas);
+  const eqlVersion = resolveEqlVersion(schemas, clientConfig?.eqlVersion);
+  const result = await client.init({
+    encryptConfig,
+    ...clientConfig,
+    authStrategy,
+    eqlVersion
+  });
+  if (result.failure) {
+    throw new Error(`[encryption]: ${result.failure.message}`);
+  }
+  return result.data;
 };
 
 // src/eql/v3/table.ts
@@ -7563,7 +7625,7 @@ var EncryptedTable = class {
   tableName;
   columnBuilders;
   build() {
-    const builtColumns = {};
+    const builtColumns = /* @__PURE__ */ Object.create(null);
     for (const builder of Object.values(this.columnBuilders)) {
       const name = builder.getName();
       if (Object.hasOwn(builtColumns, name)) {
@@ -7584,9 +7646,19 @@ var EncryptedTable = class {
    * encrypt config and FFI by DB name — `build()` keys columns by DB name, so
    * the two only agree when property == name. This recovers the mapping that
    * `build()` discards.
+   *
+   * NULL PROTOTYPE — load-bearing. Callers index this map by a column name that
+   * ultimately comes from the database (`addJsonbCastsV3`, `filterColumnName`,
+   * the mutation transform). On a plain object literal, a column named
+   * `constructor` / `toString` / `valueOf` / `__proto__` resolves to an
+   * inherited `Object.prototype` member, which is truthy — so a *plaintext*
+   * column with such a name would be mistaken for a mapped encrypted column and
+   * its `Object.prototype` value interpolated into the emitted select string.
+   * `encryptedTable()` rejects such names as JS *properties*, but nothing
+   * constrains the DB column names a table may contain.
    */
   buildColumnKeyMap() {
-    const map = {};
+    const map = /* @__PURE__ */ Object.create(null);
     for (const [property, builder] of Object.entries(this.columnBuilders)) {
       map[property] = builder.getName();
     }
@@ -7648,6 +7720,12 @@ var types = {
   SmallintEq: (name) => new EncryptedSmallintEqColumn(name, SMALLINT_EQ),
   SmallintOrdOre: (name) => new EncryptedSmallintOrdOreColumn(name, SMALLINT_ORD_ORE),
   SmallintOrd: (name) => new EncryptedSmallintOrdColumn(name, SMALLINT_ORD),
+  // bigint (int8) — plaintext is a JS `bigint`, round-tripped losslessly by
+  // the native protect-ffi boundary (see ./columns)
+  Bigint: (name) => new EncryptedBigintColumn(name, BIGINT),
+  BigintEq: (name) => new EncryptedBigintEqColumn(name, BIGINT_EQ),
+  BigintOrdOre: (name) => new EncryptedBigintOrdOreColumn(name, BIGINT_ORD_ORE),
+  BigintOrd: (name) => new EncryptedBigintOrdColumn(name, BIGINT_ORD),
   // date
   Date: (name) => new EncryptedDateColumn(name, DATE),
   DateEq: (name) => new EncryptedDateEqColumn(name, DATE_EQ),
@@ -7681,7 +7759,14 @@ var types = {
   Double: (name) => new EncryptedDoubleColumn(name, DOUBLE),
   DoubleEq: (name) => new EncryptedDoubleEqColumn(name, DOUBLE_EQ),
   DoubleOrdOre: (name) => new EncryptedDoubleOrdOreColumn(name, DOUBLE_ORD_ORE),
-  DoubleOrd: (name) => new EncryptedDoubleOrdColumn(name, DOUBLE_ORD)
+  DoubleOrd: (name) => new EncryptedDoubleOrdColumn(name, DOUBLE_ORD),
+  // json (encrypted JSONB document, ste_vec containment)
+  Json: (name) => new EncryptedJsonColumn(name)
+  // `satisfies` is load-bearing, not decoration: `DOMAIN_REGISTRY` derives itself
+  // by calling every value here at module load. A non-factory export would throw
+  // during module evaluation and take the supabase introspect/schema-build/verify
+  // path down with it. This turns that into a compile error at the offending line.
+  // `as const` applies first, so literal key inference is preserved.
 };
 
 // src/encryption/v3.ts
@@ -7690,7 +7775,7 @@ function rowReconstructor(table) {
   const propToDb = table.buildColumnKeyMap();
   const dateProperties = Object.entries(propToDb).filter(([, dbName]) => {
     const castAs = columns[dbName]?.cast_as;
-    return castAs === "date" || castAs === "timestamp";
+    return DATE_LIKE_CASTS.includes(castAs);
   }).map(([property]) => property);
   return (row) => {
     const out = { ...row };
@@ -7702,24 +7787,40 @@ function rowReconstructor(table) {
     return out;
   };
 }
-function typedClient(client, ..._schemas) {
+function typedClient(client, ...schemas) {
+  const reconstructors = /* @__PURE__ */ new Map();
+  for (const table of schemas) {
+    reconstructors.set(table.tableName, rowReconstructor(table));
+  }
+  const unknownTableFailure = {
+    failure: {
+      type: EncryptionErrorTypes.DecryptionError,
+      message: "[eql/v3]: decryptModel received a table this client was not initialized with \u2014 pass a table given to EncryptionV3/typedClient"
+    }
+  };
+  function encryptQuery(plaintextOrTerms, opts) {
+    return client.encryptQuery(plaintextOrTerms, opts);
+  }
   return {
     encrypt: (plaintext, opts) => client.encrypt(plaintext, opts),
-    encryptQuery: (plaintext, opts) => client.encryptQuery(plaintext, opts),
+    encryptQuery,
     encryptModel: (input, table) => client.encryptModel(input, table),
     bulkEncryptModels: (input, table) => client.bulkEncryptModels(input, table),
     decrypt: (encrypted) => client.decrypt(encrypted),
     decryptModel: async (input, table, lockContext) => {
+      const reconstruct = reconstructors.get(table.tableName);
+      if (!reconstruct) return unknownTableFailure;
       const op = client.decryptModel(input);
       const result = await (lockContext ? op.withLockContext(lockContext) : op);
       if (result.failure) return result;
-      return { data: rowReconstructor(table)(result.data) };
+      return { data: reconstruct(result.data) };
     },
     bulkDecryptModels: async (input, table, lockContext) => {
+      const reconstruct = reconstructors.get(table.tableName);
+      if (!reconstruct) return unknownTableFailure;
       const op = client.bulkDecryptModels(input);
       const result = await (lockContext ? op.withLockContext(lockContext) : op);
       if (result.failure) return result;
-      const reconstruct = rowReconstructor(table);
       return {
         data: result.data.map(
           (row) => reconstruct(row)
@@ -7734,17 +7835,20 @@ function typedClient(client, ..._schemas) {
 async function EncryptionV3(config) {
   const client = await Encryption({
     schemas: config.schemas,
-    // v3 schemas emit the EQL v3 wire format. Auto-detection in
-    // `Encryption` would resolve the same way (every v3 table carries the
-    // `buildColumnKeyMap` marker), but the version is set explicitly here
-    // so the contract doesn't hinge on duck-typing — while still honouring
-    // a caller's explicit override.
-    config: { ...config.config, eqlVersion: config.config?.eqlVersion ?? 3 }
+    // Force the v3 EQL wire format. protect-ffi's newClient defaults to
+    // eqlVersion 2; a v2-mode client cannot resolve v3 concrete-type columns
+    // and fails every encrypt with "Cannot convert undefined or null to
+    // object". This is a v3-only invariant, so it overrides any user value.
+    config: { ...config.config, eqlVersion: 3 }
   });
   return typedClient(client, ...config.schemas);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  EncryptedBigintColumn,
+  EncryptedBigintEqColumn,
+  EncryptedBigintOrdColumn,
+  EncryptedBigintOrdOreColumn,
   EncryptedBooleanColumn,
   EncryptedDateColumn,
   EncryptedDateEqColumn,
@@ -7758,6 +7862,7 @@ async function EncryptionV3(config) {
   EncryptedIntegerEqColumn,
   EncryptedIntegerOrdColumn,
   EncryptedIntegerOrdOreColumn,
+  EncryptedJsonColumn,
   EncryptedNumericColumn,
   EncryptedNumericEqColumn,
   EncryptedNumericOrdColumn,