@cipherstash/stack 0.19.0 → 1.0.0-rc.1

package/dist/eql/v3/index.cjs

@@ -20,6 +20,10 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/eql/v3/index.ts
 var v3_exports = {};
 __export(v3_exports, {
+  EncryptedBigintColumn: () => EncryptedBigintColumn,
+  EncryptedBigintEqColumn: () => EncryptedBigintEqColumn,
+  EncryptedBigintOrdColumn: () => EncryptedBigintOrdColumn,
+  EncryptedBigintOrdOreColumn: () => EncryptedBigintOrdOreColumn,
   EncryptedBooleanColumn: () => EncryptedBooleanColumn,
   EncryptedDateColumn: () => EncryptedDateColumn,
   EncryptedDateEqColumn: () => EncryptedDateEqColumn,
@@ -33,6 +37,7 @@ __export(v3_exports, {
   EncryptedIntegerEqColumn: () => EncryptedIntegerEqColumn,
   EncryptedIntegerOrdColumn: () => EncryptedIntegerOrdColumn,
   EncryptedIntegerOrdOreColumn: () => EncryptedIntegerOrdOreColumn,
+  EncryptedJsonColumn: () => EncryptedJsonColumn,
   EncryptedNumericColumn: () => EncryptedNumericColumn,
   EncryptedNumericEqColumn: () => EncryptedNumericEqColumn,
   EncryptedNumericOrdColumn: () => EncryptedNumericOrdColumn,
@@ -73,13 +78,6 @@ function defaultMatchOpts() {
     include_original: true
   };
 }
-function cloneMatchOpts(opts) {
-  return {
-    ...opts,
-    tokenizer: { ...opts.tokenizer },
-    token_filters: opts.token_filters.map((f) => ({ ...f }))
-  };
-}
 
 // src/eql/v3/columns.ts
 var STORAGE_ONLY = {
@@ -107,192 +105,222 @@ var TEXT_SEARCH = {
   orderAndRange: true,
   freeTextSearch: true
 };
-var TEXT_SEARCH_EQL_TYPE = "eql_v3.text_search";
+var TEXT_SEARCH_EQL_TYPE = "public.eql_v3_text_search";
 var INTEGER = {
-  eqlType: "eql_v3.integer",
+  eqlType: "public.eql_v3_integer",
   castAs: "number",
   capabilities: STORAGE_ONLY
 };
 var INTEGER_EQ = {
-  eqlType: "eql_v3.integer_eq",
+  eqlType: "public.eql_v3_integer_eq",
   castAs: "number",
   capabilities: EQUALITY_ONLY
 };
 var INTEGER_ORD_ORE = {
-  eqlType: "eql_v3.integer_ord_ore",
+  eqlType: "public.eql_v3_integer_ord_ore",
   castAs: "number",
   capabilities: ORDER_AND_RANGE
 };
 var INTEGER_ORD = {
-  eqlType: "eql_v3.integer_ord",
+  eqlType: "public.eql_v3_integer_ord",
   castAs: "number",
   capabilities: ORDER_AND_RANGE
 };
 var SMALLINT = {
-  eqlType: "eql_v3.smallint",
+  eqlType: "public.eql_v3_smallint",
   castAs: "number",
   capabilities: STORAGE_ONLY
 };
 var SMALLINT_EQ = {
-  eqlType: "eql_v3.smallint_eq",
+  eqlType: "public.eql_v3_smallint_eq",
   castAs: "number",
   capabilities: EQUALITY_ONLY
 };
 var SMALLINT_ORD_ORE = {
-  eqlType: "eql_v3.smallint_ord_ore",
+  eqlType: "public.eql_v3_smallint_ord_ore",
   castAs: "number",
   capabilities: ORDER_AND_RANGE
 };
 var SMALLINT_ORD = {
-  eqlType: "eql_v3.smallint_ord",
+  eqlType: "public.eql_v3_smallint_ord",
   castAs: "number",
   capabilities: ORDER_AND_RANGE
 };
+var BIGINT = {
+  eqlType: "public.eql_v3_bigint",
+  castAs: "bigint",
+  capabilities: STORAGE_ONLY
+};
+var BIGINT_EQ = {
+  eqlType: "public.eql_v3_bigint_eq",
+  castAs: "bigint",
+  capabilities: EQUALITY_ONLY
+};
+var BIGINT_ORD_ORE = {
+  eqlType: "public.eql_v3_bigint_ord_ore",
+  castAs: "bigint",
+  capabilities: ORDER_AND_RANGE
+};
+var BIGINT_ORD = {
+  eqlType: "public.eql_v3_bigint_ord",
+  castAs: "bigint",
+  capabilities: ORDER_AND_RANGE
+};
 var DATE = {
-  eqlType: "eql_v3.date",
+  eqlType: "public.eql_v3_date",
   castAs: "date",
   capabilities: STORAGE_ONLY
 };
 var DATE_EQ = {
-  eqlType: "eql_v3.date_eq",
+  eqlType: "public.eql_v3_date_eq",
   castAs: "date",
   capabilities: EQUALITY_ONLY
 };
 var DATE_ORD_ORE = {
-  eqlType: "eql_v3.date_ord_ore",
+  eqlType: "public.eql_v3_date_ord_ore",
   castAs: "date",
   capabilities: ORDER_AND_RANGE
 };
 var DATE_ORD = {
-  eqlType: "eql_v3.date_ord",
+  eqlType: "public.eql_v3_date_ord",
   castAs: "date",
   capabilities: ORDER_AND_RANGE
 };
 var TIMESTAMP = {
-  eqlType: "eql_v3.timestamp",
+  eqlType: "public.eql_v3_timestamp",
   castAs: "timestamp",
   capabilities: STORAGE_ONLY
 };
 var TIMESTAMP_EQ = {
-  eqlType: "eql_v3.timestamp_eq",
+  eqlType: "public.eql_v3_timestamp_eq",
   castAs: "timestamp",
   capabilities: EQUALITY_ONLY
 };
 var TIMESTAMP_ORD_ORE = {
-  eqlType: "eql_v3.timestamp_ord_ore",
+  eqlType: "public.eql_v3_timestamp_ord_ore",
   castAs: "timestamp",
   capabilities: ORDER_AND_RANGE
 };
 var TIMESTAMP_ORD = {
-  eqlType: "eql_v3.timestamp_ord",
+  eqlType: "public.eql_v3_timestamp_ord",
   castAs: "timestamp",
   capabilities: ORDER_AND_RANGE
 };
 var NUMERIC = {
-  eqlType: "eql_v3.numeric",
+  eqlType: "public.eql_v3_numeric",
   castAs: "number",
   capabilities: STORAGE_ONLY
 };
 var NUMERIC_EQ = {
-  eqlType: "eql_v3.numeric_eq",
+  eqlType: "public.eql_v3_numeric_eq",
   castAs: "number",
   capabilities: EQUALITY_ONLY
 };
 var NUMERIC_ORD_ORE = {
-  eqlType: "eql_v3.numeric_ord_ore",
+  eqlType: "public.eql_v3_numeric_ord_ore",
   castAs: "number",
   capabilities: ORDER_AND_RANGE
 };
 var NUMERIC_ORD = {
-  eqlType: "eql_v3.numeric_ord",
+  eqlType: "public.eql_v3_numeric_ord",
   castAs: "number",
   capabilities: ORDER_AND_RANGE
 };
 var TEXT = {
-  eqlType: "eql_v3.text",
+  eqlType: "public.eql_v3_text",
   castAs: "string",
   capabilities: STORAGE_ONLY
 };
 var TEXT_EQ = {
-  eqlType: "eql_v3.text_eq",
+  eqlType: "public.eql_v3_text_eq",
   castAs: "string",
   capabilities: EQUALITY_ONLY
 };
 var TEXT_MATCH = {
-  eqlType: "eql_v3.text_match",
+  eqlType: "public.eql_v3_text_match",
   castAs: "string",
   capabilities: MATCH_ONLY
 };
 var TEXT_ORD_ORE = {
-  eqlType: "eql_v3.text_ord_ore",
+  eqlType: "public.eql_v3_text_ord_ore",
   castAs: "string",
   capabilities: ORDER_AND_RANGE
 };
 var TEXT_ORD = {
-  eqlType: "eql_v3.text_ord",
+  eqlType: "public.eql_v3_text_ord",
   castAs: "string",
   capabilities: ORDER_AND_RANGE
 };
 var BOOLEAN = {
-  eqlType: "eql_v3.boolean",
+  eqlType: "public.eql_v3_boolean",
   castAs: "boolean",
   capabilities: STORAGE_ONLY
 };
 var REAL = {
-  eqlType: "eql_v3.real",
+  eqlType: "public.eql_v3_real",
   castAs: "number",
   capabilities: STORAGE_ONLY
 };
 var REAL_EQ = {
-  eqlType: "eql_v3.real_eq",
+  eqlType: "public.eql_v3_real_eq",
   castAs: "number",
   capabilities: EQUALITY_ONLY
 };
 var REAL_ORD_ORE = {
-  eqlType: "eql_v3.real_ord_ore",
+  eqlType: "public.eql_v3_real_ord_ore",
   castAs: "number",
   capabilities: ORDER_AND_RANGE
 };
 var REAL_ORD = {
-  eqlType: "eql_v3.real_ord",
+  eqlType: "public.eql_v3_real_ord",
   castAs: "number",
   capabilities: ORDER_AND_RANGE
 };
 var DOUBLE = {
-  eqlType: "eql_v3.double",
+  eqlType: "public.eql_v3_double",
   castAs: "number",
   capabilities: STORAGE_ONLY
 };
 var DOUBLE_EQ = {
-  eqlType: "eql_v3.double_eq",
+  eqlType: "public.eql_v3_double_eq",
   castAs: "number",
   capabilities: EQUALITY_ONLY
 };
 var DOUBLE_ORD_ORE = {
-  eqlType: "eql_v3.double_ord_ore",
+  eqlType: "public.eql_v3_double_ord_ore",
   castAs: "number",
   capabilities: ORDER_AND_RANGE
 };
 var DOUBLE_ORD = {
-  eqlType: "eql_v3.double_ord",
+  eqlType: "public.eql_v3_double_ord",
   castAs: "number",
   capabilities: ORDER_AND_RANGE
 };
-function indexesForCapabilities(capabilities, castAs) {
+function indexesForCapabilities(capabilities, castAs, ordering) {
   const indexes = {};
   if (capabilities.equality && (!capabilities.orderAndRange || castAs === "string")) {
     indexes.unique = { token_filters: [] };
   }
   if (capabilities.orderAndRange) {
-    indexes.ore = {};
+    indexes[ordering] = {};
   }
   if (capabilities.freeTextSearch) {
-    indexes.match = defaultMatchOpts();
+    indexes.match = { ...defaultMatchOpts(), include_original: false };
+  }
+  if (capabilities.searchableJson) {
+    indexes.ste_vec = {
+      prefix: "enabled",
+      array_index_mode: { item: true, wildcard: true, position: false },
+      mode: "compat"
+    };
   }
   return indexes;
 }
+function orderingForEqlType(eqlType) {
+  return eqlType.endsWith("_ord_ore") ? "ore" : "ope";
+}
 function isQueryableCapabilities(capabilities) {
-  return capabilities.equality || capabilities.orderAndRange || capabilities.freeTextSearch;
+  return capabilities.equality || capabilities.orderAndRange || capabilities.freeTextSearch || (capabilities.searchableJson ?? false);
 }
 var EncryptedV3Column = class {
   constructor(columnName, definition) {
@@ -324,7 +352,8 @@ var EncryptedV3Column = class {
       cast_as: this.definition.castAs,
       indexes: indexesForCapabilities(
         this.definition.capabilities,
-        this.definition.castAs
+        this.definition.castAs,
+        orderingForEqlType(this.definition.eqlType)
       )
     };
   }
@@ -335,37 +364,8 @@ var TEXT_SEARCH_DOMAIN = {
   capabilities: TEXT_SEARCH
 };
 var EncryptedTextSearchColumn = class extends EncryptedV3Column {
-  matchOpts;
   constructor(columnName) {
     super(columnName, TEXT_SEARCH_DOMAIN);
-    this.matchOpts = defaultMatchOpts();
-  }
-  /**
-   * Tune the match index. Each provided key replaces its default; omitted
-   * keys keep the default. This NEVER enables a capability — match is always
-   * on for this type. Merge semantics mirror v2's `opts?.x ?? default`.
-   */
-  freeTextSearch(opts) {
-    const defaults = defaultMatchOpts();
-    this.matchOpts = cloneMatchOpts({
-      tokenizer: opts?.tokenizer ?? defaults.tokenizer,
-      token_filters: opts?.token_filters ?? defaults.token_filters,
-      k: opts?.k ?? defaults.k,
-      m: opts?.m ?? defaults.m,
-      include_original: opts?.include_original ?? defaults.include_original
-    });
-    return this;
-  }
-  /** Emit the encrypt-config column. Byte-identical to a v2 equality+order+match column. */
-  build() {
-    return {
-      cast_as: "string",
-      indexes: {
-        unique: { token_filters: [] },
-        ore: {},
-        match: cloneMatchOpts(this.matchOpts)
-      }
-    };
   }
 };
 var EncryptedIntegerColumn = class extends EncryptedV3Column {
@@ -384,6 +384,14 @@ var EncryptedSmallintOrdOreColumn = class extends EncryptedV3Column {
 };
 var EncryptedSmallintOrdColumn = class extends EncryptedV3Column {
 };
+var EncryptedBigintColumn = class extends EncryptedV3Column {
+};
+var EncryptedBigintEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedBigintOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedBigintOrdColumn = class extends EncryptedV3Column {
+};
 var EncryptedDateColumn = class extends EncryptedV3Column {
 };
 var EncryptedDateEqColumn = class extends EncryptedV3Column {
@@ -436,6 +444,21 @@ var EncryptedDoubleOrdOreColumn = class extends EncryptedV3Column {
 };
 var EncryptedDoubleOrdColumn = class extends EncryptedV3Column {
 };
+var JSON_DOMAIN = {
+  eqlType: "public.eql_v3_json",
+  castAs: "json",
+  capabilities: {
+    equality: false,
+    orderAndRange: false,
+    freeTextSearch: false,
+    searchableJson: true
+  }
+};
+var EncryptedJsonColumn = class extends EncryptedV3Column {
+  constructor(columnName) {
+    super(columnName, JSON_DOMAIN);
+  }
+};
 
 // src/eql/v3/table.ts
 var EncryptedTable = class {
@@ -446,7 +469,7 @@ var EncryptedTable = class {
   tableName;
   columnBuilders;
   build() {
-    const builtColumns = {};
+    const builtColumns = /* @__PURE__ */ Object.create(null);
     for (const builder of Object.values(this.columnBuilders)) {
       const name = builder.getName();
       if (Object.hasOwn(builtColumns, name)) {
@@ -467,9 +490,19 @@ var EncryptedTable = class {
    * encrypt config and FFI by DB name — `build()` keys columns by DB name, so
    * the two only agree when property == name. This recovers the mapping that
    * `build()` discards.
+   *
+   * NULL PROTOTYPE — load-bearing. Callers index this map by a column name that
+   * ultimately comes from the database (`addJsonbCastsV3`, `filterColumnName`,
+   * the mutation transform). On a plain object literal, a column named
+   * `constructor` / `toString` / `valueOf` / `__proto__` resolves to an
+   * inherited `Object.prototype` member, which is truthy — so a *plaintext*
+   * column with such a name would be mistaken for a mapped encrypted column and
+   * its `Object.prototype` value interpolated into the emitted select string.
+   * `encryptedTable()` rejects such names as JS *properties*, but nothing
+   * constrains the DB column names a table may contain.
    */
   buildColumnKeyMap() {
-    const map = {};
+    const map = /* @__PURE__ */ Object.create(null);
     for (const [property, builder] of Object.entries(this.columnBuilders)) {
       map[property] = builder.getName();
     }
@@ -531,6 +564,12 @@ var types = {
   SmallintEq: (name) => new EncryptedSmallintEqColumn(name, SMALLINT_EQ),
   SmallintOrdOre: (name) => new EncryptedSmallintOrdOreColumn(name, SMALLINT_ORD_ORE),
   SmallintOrd: (name) => new EncryptedSmallintOrdColumn(name, SMALLINT_ORD),
+  // bigint (int8) — plaintext is a JS `bigint`, round-tripped losslessly by
+  // the native protect-ffi boundary (see ./columns)
+  Bigint: (name) => new EncryptedBigintColumn(name, BIGINT),
+  BigintEq: (name) => new EncryptedBigintEqColumn(name, BIGINT_EQ),
+  BigintOrdOre: (name) => new EncryptedBigintOrdOreColumn(name, BIGINT_ORD_ORE),
+  BigintOrd: (name) => new EncryptedBigintOrdColumn(name, BIGINT_ORD),
   // date
   Date: (name) => new EncryptedDateColumn(name, DATE),
   DateEq: (name) => new EncryptedDateEqColumn(name, DATE_EQ),
@@ -564,10 +603,21 @@ var types = {
   Double: (name) => new EncryptedDoubleColumn(name, DOUBLE),
   DoubleEq: (name) => new EncryptedDoubleEqColumn(name, DOUBLE_EQ),
   DoubleOrdOre: (name) => new EncryptedDoubleOrdOreColumn(name, DOUBLE_ORD_ORE),
-  DoubleOrd: (name) => new EncryptedDoubleOrdColumn(name, DOUBLE_ORD)
+  DoubleOrd: (name) => new EncryptedDoubleOrdColumn(name, DOUBLE_ORD),
+  // json (encrypted JSONB document, ste_vec containment)
+  Json: (name) => new EncryptedJsonColumn(name)
+  // `satisfies` is load-bearing, not decoration: `DOMAIN_REGISTRY` derives itself
+  // by calling every value here at module load. A non-factory export would throw
+  // during module evaluation and take the supabase introspect/schema-build/verify
+  // path down with it. This turns that into a compile error at the offending line.
+  // `as const` applies first, so literal key inference is preserved.
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  EncryptedBigintColumn,
+  EncryptedBigintEqColumn,
+  EncryptedBigintOrdColumn,
+  EncryptedBigintOrdOreColumn,
   EncryptedBooleanColumn,
   EncryptedDateColumn,
   EncryptedDateEqColumn,
@@ -581,6 +631,7 @@ var types = {
   EncryptedIntegerEqColumn,
   EncryptedIntegerOrdColumn,
   EncryptedIntegerOrdOreColumn,
+  EncryptedJsonColumn,
   EncryptedNumericColumn,
   EncryptedNumericEqColumn,
   EncryptedNumericOrdColumn,