@cipherstash/stack 0.19.0 → 1.0.0-rc.1

package/dist/eql/v3/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/eql/v3/index.ts","../../../src/schema/match-defaults.ts","../../../src/eql/v3/columns.ts","../../../src/eql/v3/table.ts","../../../src/eql/v3/types.ts"],"sourcesContent":["// Public barrel for the EQL v3 authoring DSL (`@cipherstash/stack/eql/v3`).\n//\n// Curated on purpose: it re-exports the `types` namespace, the concrete column\n// classes (load-bearing for the `AnyEncryptedV3Column` union and nominal\n// typing), the table API, and the inference type aliases. It deliberately does\n// NOT re-export the per-domain literal consts (`INTEGER`, `TEXT_EQ`, …) — those are\n// internal building blocks for `types` — and there are no standalone\n// `encrypted<Domain>Column` factories any more: `types.*` is the single\n// authoring API.\n\nexport type {\n  AnyEncryptedV3Column,\n  EncryptedV3TableColumn,\n  EqlTypeForColumn,\n  PlaintextForColumn,\n  QueryCapabilities,\n  QueryTypesForColumn,\n} from './columns'\n\nexport {\n  EncryptedBooleanColumn,\n  EncryptedDateColumn,\n  EncryptedDateEqColumn,\n  EncryptedDateOrdColumn,\n  EncryptedDateOrdOreColumn,\n  EncryptedRealColumn,\n  EncryptedRealEqColumn,\n  EncryptedRealOrdColumn,\n  EncryptedRealOrdOreColumn,\n  EncryptedDoubleColumn,\n  EncryptedDoubleEqColumn,\n  EncryptedDoubleOrdColumn,\n  EncryptedDoubleOrdOreColumn,\n  EncryptedSmallintColumn,\n  EncryptedSmallintEqColumn,\n  EncryptedSmallintOrdColumn,\n  EncryptedSmallintOrdOreColumn,\n  EncryptedIntegerColumn,\n  EncryptedIntegerEqColumn,\n  EncryptedIntegerOrdColumn,\n  EncryptedIntegerOrdOreColumn,\n  EncryptedNumericColumn,\n  EncryptedNumericEqColumn,\n  EncryptedNumericOrdColumn,\n  EncryptedNumericOrdOreColumn,\n  EncryptedTextColumn,\n  EncryptedTextEqColumn,\n  EncryptedTextMatchColumn,\n  EncryptedTextOrdColumn,\n  EncryptedTextOrdOreColumn,\n  EncryptedTextSearchColumn,\n  EncryptedTimestampColumn,\n  EncryptedTimestampEqColumn,\n  EncryptedTimestampOrdColumn,\n  EncryptedTimestampOrdOreColumn,\n  TEXT_SEARCH_EQL_TYPE,\n} from './columns'\nexport type {\n  AnyV3Table,\n  ColumnsOf,\n  InferEncrypted,\n  InferPlaintext,\n  QueryableColumnsOf,\n  V3DecryptedModel,\n  V3EncryptedModel,\n  V3ModelInput,\n} from './table'\n\nexport { buildEncryptConfig, EncryptedTable, encryptedTable } from './table'\nexport { types } from './types'\n","import type { MatchIndexOpts } from './index'\n\n/**\n * Fully-resolved match-index options: every field present and non-`undefined`.\n *\n * `MatchIndexOpts` (the user-facing tuning input) has all fields optional —\n * each is `.default(...).optional()` in the zod schema, so its inferred type is\n * `T | undefined`. This type pins the BUILT/resolved shape explicitly via\n * `NonNullable<...>`, which states the non-null intent directly and is robust\n * regardless of `Required<>`'s subtle, `exactOptionalPropertyTypes`-dependent\n * stripping semantics.\n */\nexport type BuiltMatchIndexOpts = {\n  tokenizer: NonNullable<MatchIndexOpts['tokenizer']>\n  token_filters: NonNullable<MatchIndexOpts['token_filters']>\n  k: NonNullable<MatchIndexOpts['k']>\n  m: NonNullable<MatchIndexOpts['m']>\n  include_original: NonNullable<MatchIndexOpts['include_original']>\n}\n\n/**\n * Default match-index parameters — the single source of truth shared by the\n * v2 `freeTextSearch()` builder and the v3 domain builders (note\n * `include_original: true`, which is the v2 builder default rather than the\n * zod-schema default of `false`).\n *\n * This is a FACTORY (not a shared `const`) so every caller gets fresh, unaliased\n * nested objects (`tokenizer`, `token_filters` and the `{ kind: 'downcase' }`\n * inside it). A shared const would be shallow-copied by `{ ...DEFAULT }`, leaving\n * those nested objects aliased across every column — a caller mutating one built\n * config could then corrupt the defaults used by later columns.\n */\nexport function defaultMatchOpts(): BuiltMatchIndexOpts {\n  return {\n    tokenizer: { kind: 'ngram', token_length: 3 },\n    token_filters: [{ kind: 'downcase' }],\n    k: 6,\n    m: 2048,\n    include_original: true,\n  }\n}\n\n/**\n * Deep-clone a built match block (`tokenizer` and `token_filters` are its only\n * nested values) so no emitted config or stored builder state ever aliases\n * another's nested objects — a caller mutating one cannot corrupt the other.\n */\nexport function cloneMatchOpts(opts: BuiltMatchIndexOpts): BuiltMatchIndexOpts {\n  return {\n    ...opts,\n    tokenizer: { ...opts.tokenizer },\n    token_filters: opts.token_filters.map((f) => ({ ...f })),\n  }\n}\n","import type { ColumnSchema, MatchIndexOpts } from '@/schema'\nimport {\n  type BuiltMatchIndexOpts,\n  cloneMatchOpts,\n  defaultMatchOpts,\n} from '@/schema/match-defaults'\n\n/**\n * The query capabilities a v3 concrete domain exposes. These are SDK-facing\n * semantic flags describing what kinds of query terms a column can produce —\n * NOT the raw EQL index keys. They are metadata only and never emitted by\n * `build()`.\n *\n * - `equality`: exact-match lookups (EQL `hm`, or comparison via `ob`).\n * - `orderAndRange`: comparison / range lookups (EQL `ob`).\n * - `freeTextSearch`: tokenised substring match (EQL `bf`).\n */\nexport type QueryCapabilities = Readonly<{\n  equality: boolean\n  orderAndRange: boolean\n  freeTextSearch: boolean\n}>\n\n/** The plaintext (TypeScript) kind a v3 domain decrypts to. A subset of the\n * SDK `CastAs` enum, restricted to the scalar kinds v3 domains actually use. */\ntype PlaintextKind = 'string' | 'number' | 'boolean' | 'date' | 'timestamp'\n\n/**\n * The full, literal definition of a v3 domain. This is the LOAD-BEARING type:\n * the base column class carries a private field of this type so that every\n * concrete (otherwise-empty) subclass is discriminated by its literal\n * `eqlType`/`castAs`/`capabilities` — TypeScript empty subclasses are NOT\n * nominal, so without this a storage-only `boolean` column would be assignable to\n * a storage-only `date` column and plaintext inference would collapse.\n */\ntype V3DomainDefinition = Readonly<{\n  eqlType: `eql_v3.${string}`\n  castAs: PlaintextKind\n  capabilities: QueryCapabilities\n}>\n\n/** Type-level mirror of {@link isQueryableCapabilities}: `false` for a\n * storage-only domain (all capability flags `false`), `true` otherwise. */\ntype QueryableFlag<D extends V3DomainDefinition> = D['capabilities'] extends {\n  equality: false\n  orderAndRange: false\n  freeTextSearch: false\n}\n  ? false\n  : true\n\nconst STORAGE_ONLY = {\n  equality: false,\n  orderAndRange: false,\n  freeTextSearch: false,\n} as const\n\nconst EQUALITY_ONLY = {\n  equality: true,\n  orderAndRange: false,\n  freeTextSearch: false,\n} as const\n\nconst ORDER_AND_RANGE = {\n  equality: true,\n  orderAndRange: true,\n  freeTextSearch: false,\n} as const\n\nconst MATCH_ONLY = {\n  equality: false,\n  orderAndRange: false,\n  freeTextSearch: true,\n} as const\n\nconst TEXT_SEARCH = {\n  equality: true,\n  orderAndRange: true,\n  freeTextSearch: true,\n} as const\n\n/**\n * The concrete EQL v3 domain name for a full-capability text column.\n * Recorded as metadata for future DDL / query-dialect increments; it is\n * intentionally absent from the emitted encrypt config.\n */\nexport const TEXT_SEARCH_EQL_TYPE = 'eql_v3.text_search'\n\n// Per-domain literal definitions. Each concrete column subclass is parameterised\n// by `typeof <CONST>`; the literal `eqlType`/`castAs`/`capabilities` on each is\n// what makes the otherwise-empty subclasses nominally distinct (see\n// V3DomainDefinition). Order mirrors eql-bindings `CATALOG` order.\n//\n// Exported for the `types` namespace factory (see ./types); they are internal\n// building blocks and are intentionally NOT re-exported from the public barrel.\nexport const INTEGER = {\n  eqlType: 'eql_v3.integer',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const INTEGER_EQ = {\n  eqlType: 'eql_v3.integer_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const INTEGER_ORD_ORE = {\n  eqlType: 'eql_v3.integer_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const INTEGER_ORD = {\n  eqlType: 'eql_v3.integer_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const SMALLINT = {\n  eqlType: 'eql_v3.smallint',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const SMALLINT_EQ = {\n  eqlType: 'eql_v3.smallint_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const SMALLINT_ORD_ORE = {\n  eqlType: 'eql_v3.smallint_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const SMALLINT_ORD = {\n  eqlType: 'eql_v3.smallint_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\n// NOTE: bigint (int8) domains are intentionally NOT defined yet. The native\n// protect-ffi build cannot round-trip a 64-bit int losslessly: a JS `bigint`\n// fails JSON serialization, and a `string` is rejected for a `big_int` column\n// (\"Cannot convert String to BigInt\"), while `number` loses precision above\n// 2^53. Re-add BIGINT/BIGINT_EQ/BIGINT_ORD_ORE/BIGINT_ORD and their builders once the\n// FFI accepts a lossless bigint on input and returns it on decrypt.\n\nexport const DATE = {\n  eqlType: 'eql_v3.date',\n  castAs: 'date',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const DATE_EQ = {\n  eqlType: 'eql_v3.date_eq',\n  castAs: 'date',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const DATE_ORD_ORE = {\n  eqlType: 'eql_v3.date_ord_ore',\n  castAs: 'date',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const DATE_ORD = {\n  eqlType: 'eql_v3.date_ord',\n  castAs: 'date',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\n// Timestamp domains cast as 'timestamp' (not 'date') so decrypt preserves the\n// time-of-day component — the FFI's 'date' variant truncates to midnight.\n// Both kinds decrypt to a JS `Date`.\nexport const TIMESTAMP = {\n  eqlType: 'eql_v3.timestamp',\n  castAs: 'timestamp',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const TIMESTAMP_EQ = {\n  eqlType: 'eql_v3.timestamp_eq',\n  castAs: 'timestamp',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const TIMESTAMP_ORD_ORE = {\n  eqlType: 'eql_v3.timestamp_ord_ore',\n  castAs: 'timestamp',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const TIMESTAMP_ORD = {\n  eqlType: 'eql_v3.timestamp_ord',\n  castAs: 'timestamp',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const NUMERIC = {\n  eqlType: 'eql_v3.numeric',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const NUMERIC_EQ = {\n  eqlType: 'eql_v3.numeric_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const NUMERIC_ORD_ORE = {\n  eqlType: 'eql_v3.numeric_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const NUMERIC_ORD = {\n  eqlType: 'eql_v3.numeric_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const TEXT = {\n  eqlType: 'eql_v3.text',\n  castAs: 'string',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const TEXT_EQ = {\n  eqlType: 'eql_v3.text_eq',\n  castAs: 'string',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const TEXT_MATCH = {\n  eqlType: 'eql_v3.text_match',\n  castAs: 'string',\n  capabilities: MATCH_ONLY,\n} as const\nexport const TEXT_ORD_ORE = {\n  eqlType: 'eql_v3.text_ord_ore',\n  castAs: 'string',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const TEXT_ORD = {\n  eqlType: 'eql_v3.text_ord',\n  castAs: 'string',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const BOOLEAN = {\n  eqlType: 'eql_v3.boolean',\n  castAs: 'boolean',\n  capabilities: STORAGE_ONLY,\n} as const\n\nexport const REAL = {\n  eqlType: 'eql_v3.real',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const REAL_EQ = {\n  eqlType: 'eql_v3.real_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const REAL_ORD_ORE = {\n  eqlType: 'eql_v3.real_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const REAL_ORD = {\n  eqlType: 'eql_v3.real_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const DOUBLE = {\n  eqlType: 'eql_v3.double',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const DOUBLE_EQ = {\n  eqlType: 'eql_v3.double_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const DOUBLE_ORD_ORE = {\n  eqlType: 'eql_v3.double_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const DOUBLE_ORD = {\n  eqlType: 'eql_v3.double_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\n/**\n * Translate a domain's semantic {@link QueryCapabilities} (plus its plaintext\n * `castAs`, which decides how equality is answered) into the concrete EQL index\n * block emitted by `build()`.\n *\n * - `unique` (the `hm` HMAC index) whenever equality is answered via HMAC:\n *   equality-only domains of ANY type, AND text order domains. Text equality is\n *   HMAC-based — the `eql_v3.text_ord` / `eql_v3.text_ord_ore` SQL domains\n *   REQUIRE `hm` in the stored ciphertext (their `eql_v3.eq_term` extracts it).\n * - `ore` for any order/range domain (the `ob` term). For numeric/date order\n *   domains `ob` also answers equality (via the SQL `=` operator), so those emit\n *   `ore` ONLY — no `hm`. Text order domains emit BOTH `unique` and `ore`.\n * - `match` (the `bf` bloom-filter index) for free-text search, deep-cloned from\n *   the per-call defaults so no nested object is ever shared across columns.\n */\nfunction indexesForCapabilities(\n  capabilities: QueryCapabilities,\n  castAs: PlaintextKind,\n): ColumnSchema['indexes'] {\n  const indexes: ColumnSchema['indexes'] = {}\n\n  // Text equality is always HMAC-based, so a text order domain (`string` +\n  // order/range) still needs `unique`; numeric/date order domains answer\n  // equality via `ob` and must NOT emit `unique`.\n  if (\n    capabilities.equality &&\n    (!capabilities.orderAndRange || castAs === 'string')\n  ) {\n    indexes.unique = { token_filters: [] }\n  }\n\n  if (capabilities.orderAndRange) {\n    indexes.ore = {}\n  }\n\n  if (capabilities.freeTextSearch) {\n    // The factory returns fresh, unaliased nested objects per call, so no\n    // column's emitted match block ever shares state with another's.\n    indexes.match = defaultMatchOpts()\n  }\n\n  return indexes\n}\n\n/** Whether a domain's capabilities make it queryable at all (any flag set). */\nfunction isQueryableCapabilities(capabilities: QueryCapabilities): boolean {\n  return (\n    capabilities.equality ||\n    capabilities.orderAndRange ||\n    capabilities.freeTextSearch\n  )\n}\n\n/**\n * Shared base for every v3 concrete domain column. Parameterised by the FULL\n * literal {@link V3DomainDefinition} (not by capabilities alone): the private\n * `definition` field carries the literal `eqlType`/`castAs`/`capabilities`, so\n * two otherwise-empty subclasses (e.g. `EncryptedBooleanColumn` and\n * `EncryptedDateColumn`, both storage-only) are NOT mutually assignable. This\n * nominality is what keeps plaintext inference precise.\n */\nexport class EncryptedV3Column<D extends V3DomainDefinition> {\n  constructor(\n    private readonly columnName: string,\n    private readonly definition: D,\n  ) {}\n\n  getName(): string {\n    return this.columnName\n  }\n\n  /** The concrete EQL v3 domain name. Metadata only; not emitted by `build()`. */\n  getEqlType(): D['eqlType'] {\n    return this.definition.eqlType\n  }\n\n  /** The semantic query capabilities this domain exposes. Metadata only. */\n  getQueryCapabilities(): D['capabilities'] {\n    return this.definition.capabilities\n  }\n\n  /** `true` when this domain can produce at least one kind of query term. */\n  isQueryable(): QueryableFlag<D> {\n    return isQueryableCapabilities(\n      this.definition.capabilities,\n    ) as QueryableFlag<D>\n  }\n\n  /** Emit the encrypt-config column: `cast_as` plus capability-derived indexes. */\n  build(): ColumnSchema {\n    return {\n      cast_as: this.definition.castAs,\n      indexes: indexesForCapabilities(\n        this.definition.capabilities,\n        this.definition.castAs,\n      ),\n    }\n  }\n}\n\nconst TEXT_SEARCH_DOMAIN = {\n  eqlType: TEXT_SEARCH_EQL_TYPE,\n  castAs: 'string',\n  capabilities: TEXT_SEARCH,\n} as const\n\n/**\n * Builder for an `eql_v3.text_search` column.\n *\n * The concrete type inherently enables equality + order/range + free-text\n * match — there are no capability-enabling methods. `.freeTextSearch(opts?)`\n * tunes the match index only.\n *\n * NOTE — querying: a `text_search` column emits all three indexes (`unique`,\n * `ore`, `match`), and the shared index-inference picks them by fixed priority\n * `unique > match > ore`. So `encryptQuery(value, { column, table })` with NO\n * explicit `queryType` builds an EQUALITY term (via `unique`), NOT a free-text\n * match — a substring like `'joh'` then matches nothing. To run a free-text\n * match query you MUST pass `queryType: 'freeTextSearch'`:\n *\n * ```typescript\n * // equality (default): exact value only\n * client.encryptQuery('john@example.com', { column: users.email, table: users })\n * // free-text match: substring/token search\n * client.encryptQuery('joh', { column: users.email, table: users, queryType: 'freeTextSearch' })\n * ```\n */\nexport class EncryptedTextSearchColumn extends EncryptedV3Column<\n  typeof TEXT_SEARCH_DOMAIN\n> {\n  private matchOpts: BuiltMatchIndexOpts\n\n  constructor(columnName: string) {\n    super(columnName, TEXT_SEARCH_DOMAIN)\n    this.matchOpts = defaultMatchOpts()\n  }\n\n  /**\n   * Tune the match index. Each provided key replaces its default; omitted\n   * keys keep the default. This NEVER enables a capability — match is always\n   * on for this type. Merge semantics mirror v2's `opts?.x ?? default`.\n   */\n  freeTextSearch(opts?: MatchIndexOpts): this {\n    // A fresh defaults object per call supplies the `?? ` fallbacks, so no\n    // nested default object is ever shared into `this.matchOpts` by reference.\n    const defaults = defaultMatchOpts()\n    // Clone-on-write: deep-copy the nested tokenizer / token_filters when\n    // storing them so a caller mutating their own opts object between\n    // freeTextSearch(opts) and build() cannot leak into the emitted config.\n    this.matchOpts = cloneMatchOpts({\n      tokenizer: opts?.tokenizer ?? defaults.tokenizer,\n      token_filters: opts?.token_filters ?? defaults.token_filters,\n      k: opts?.k ?? defaults.k,\n      m: opts?.m ?? defaults.m,\n      include_original: opts?.include_original ?? defaults.include_original,\n    })\n    return this\n  }\n\n  /** Emit the encrypt-config column. Byte-identical to a v2 equality+order+match column. */\n  override build(): ColumnSchema {\n    // Deep-clone the match block so the returned config NEVER aliases this\n    // builder's internal `matchOpts` (or any caller-supplied opts merged into\n    // it). A caller mutating the returned object cannot corrupt this builder's\n    // state or another column's defaults.\n    return {\n      cast_as: 'string',\n      indexes: {\n        unique: { token_filters: [] },\n        ore: {},\n        match: cloneMatchOpts(this.matchOpts),\n      },\n    }\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Concrete domain columns\n//\n// Every concrete class is an empty subclass parameterised by its literal domain\n// definition (see EncryptedV3Column). The `types` namespace (see ./types)\n// constructs these with the SAME literal constant so the instance's private\n// `definition` field carries full literal type data — that is what keeps\n// distinct domains nominally incompatible.\n// ---------------------------------------------------------------------------\n\n// integer\nexport class EncryptedIntegerColumn extends EncryptedV3Column<typeof INTEGER> {}\nexport class EncryptedIntegerEqColumn extends EncryptedV3Column<\n  typeof INTEGER_EQ\n> {}\nexport class EncryptedIntegerOrdOreColumn extends EncryptedV3Column<\n  typeof INTEGER_ORD_ORE\n> {}\nexport class EncryptedIntegerOrdColumn extends EncryptedV3Column<\n  typeof INTEGER_ORD\n> {}\n\n// smallint\nexport class EncryptedSmallintColumn extends EncryptedV3Column<\n  typeof SMALLINT\n> {}\nexport class EncryptedSmallintEqColumn extends EncryptedV3Column<\n  typeof SMALLINT_EQ\n> {}\nexport class EncryptedSmallintOrdOreColumn extends EncryptedV3Column<\n  typeof SMALLINT_ORD_ORE\n> {}\nexport class EncryptedSmallintOrdColumn extends EncryptedV3Column<\n  typeof SMALLINT_ORD\n> {}\n\n// bigint (int8) domain builders are intentionally omitted pending FFI support\n// for lossless bigint round-tripping — see the note by the INTEGER/DATE domain\n// definitions above.\n\n// date\nexport class EncryptedDateColumn extends EncryptedV3Column<typeof DATE> {}\nexport class EncryptedDateEqColumn extends EncryptedV3Column<typeof DATE_EQ> {}\nexport class EncryptedDateOrdOreColumn extends EncryptedV3Column<\n  typeof DATE_ORD_ORE\n> {}\nexport class EncryptedDateOrdColumn extends EncryptedV3Column<\n  typeof DATE_ORD\n> {}\n\n// timestamp\nexport class EncryptedTimestampColumn extends EncryptedV3Column<\n  typeof TIMESTAMP\n> {}\nexport class EncryptedTimestampEqColumn extends EncryptedV3Column<\n  typeof TIMESTAMP_EQ\n> {}\nexport class EncryptedTimestampOrdOreColumn extends EncryptedV3Column<\n  typeof TIMESTAMP_ORD_ORE\n> {}\nexport class EncryptedTimestampOrdColumn extends EncryptedV3Column<\n  typeof TIMESTAMP_ORD\n> {}\n\n// numeric\nexport class EncryptedNumericColumn extends EncryptedV3Column<typeof NUMERIC> {}\nexport class EncryptedNumericEqColumn extends EncryptedV3Column<\n  typeof NUMERIC_EQ\n> {}\nexport class EncryptedNumericOrdOreColumn extends EncryptedV3Column<\n  typeof NUMERIC_ORD_ORE\n> {}\nexport class EncryptedNumericOrdColumn extends EncryptedV3Column<\n  typeof NUMERIC_ORD\n> {}\n\n// text (text_search is defined above with its match-tuning override)\nexport class EncryptedTextColumn extends EncryptedV3Column<typeof TEXT> {}\nexport class EncryptedTextEqColumn extends EncryptedV3Column<typeof TEXT_EQ> {}\nexport class EncryptedTextMatchColumn extends EncryptedV3Column<\n  typeof TEXT_MATCH\n> {}\nexport class EncryptedTextOrdOreColumn extends EncryptedV3Column<\n  typeof TEXT_ORD_ORE\n> {}\nexport class EncryptedTextOrdColumn extends EncryptedV3Column<\n  typeof TEXT_ORD\n> {}\n\n// boolean\nexport class EncryptedBooleanColumn extends EncryptedV3Column<typeof BOOLEAN> {}\n\n// real\nexport class EncryptedRealColumn extends EncryptedV3Column<typeof REAL> {}\nexport class EncryptedRealEqColumn extends EncryptedV3Column<typeof REAL_EQ> {}\nexport class EncryptedRealOrdOreColumn extends EncryptedV3Column<\n  typeof REAL_ORD_ORE\n> {}\nexport class EncryptedRealOrdColumn extends EncryptedV3Column<\n  typeof REAL_ORD\n> {}\n\n// double\nexport class EncryptedDoubleColumn extends EncryptedV3Column<typeof DOUBLE> {}\nexport class EncryptedDoubleEqColumn extends EncryptedV3Column<\n  typeof DOUBLE_EQ\n> {}\nexport class EncryptedDoubleOrdOreColumn extends EncryptedV3Column<\n  typeof DOUBLE_ORD_ORE\n> {}\nexport class EncryptedDoubleOrdColumn extends EncryptedV3Column<\n  typeof DOUBLE_ORD\n> {}\n\n/**\n * Union of every v3 concrete column type. Used as the value type for v3 table\n * columns so a table may mix any generated domains.\n */\nexport type AnyEncryptedV3Column =\n  | EncryptedIntegerColumn\n  | EncryptedIntegerEqColumn\n  | EncryptedIntegerOrdOreColumn\n  | EncryptedIntegerOrdColumn\n  | EncryptedSmallintColumn\n  | EncryptedSmallintEqColumn\n  | EncryptedSmallintOrdOreColumn\n  | EncryptedSmallintOrdColumn\n  | EncryptedDateColumn\n  | EncryptedDateEqColumn\n  | EncryptedDateOrdOreColumn\n  | EncryptedDateOrdColumn\n  | EncryptedTimestampColumn\n  | EncryptedTimestampEqColumn\n  | EncryptedTimestampOrdOreColumn\n  | EncryptedTimestampOrdColumn\n  | EncryptedNumericColumn\n  | EncryptedNumericEqColumn\n  | EncryptedNumericOrdOreColumn\n  | EncryptedNumericOrdColumn\n  | EncryptedTextColumn\n  | EncryptedTextEqColumn\n  | EncryptedTextMatchColumn\n  | EncryptedTextOrdOreColumn\n  | EncryptedTextOrdColumn\n  | EncryptedTextSearchColumn\n  | EncryptedBooleanColumn\n  | EncryptedRealColumn\n  | EncryptedRealEqColumn\n  | EncryptedRealOrdOreColumn\n  | EncryptedRealOrdColumn\n  | EncryptedDoubleColumn\n  | EncryptedDoubleEqColumn\n  | EncryptedDoubleOrdOreColumn\n  | EncryptedDoubleOrdColumn\n\n/**\n * Shape of v3 table columns: every value is a v3 concrete column builder.\n * (Nested fields are deferred to later increments.)\n */\nexport type EncryptedV3TableColumn = {\n  [key: string]: AnyEncryptedV3Column\n}\n\n/** Map a domain's {@link PlaintextKind} to its TypeScript plaintext type. */\ntype PlaintextFromKind<K extends PlaintextKind> = K extends 'string'\n  ? string\n  : K extends 'number'\n    ? number\n    : K extends 'boolean'\n      ? boolean\n      : K extends 'date' | 'timestamp'\n        ? Date\n        : never\n\n/**\n * The plaintext type for a single v3 column, read from the literal domain\n * definition carried on the base class's private field. This is stable across\n * empty subclasses that share the same base generic — a subclass-name\n * conditional would collapse because those subclasses are structurally\n * assignable to one another.\n */\nexport type PlaintextForColumn<C> =\n  C extends EncryptedV3Column<infer D> ? PlaintextFromKind<D['castAs']> : never\n\n/**\n * The user-facing `queryType` names a v3 column supports, derived 1:1 from its\n * capability flags. Resolves to `never` for a storage-only column (all flags\n * `false`) and for any non-v3 value. The names mirror the {@link QueryCapabilities}\n * keys and the first three {@link import('@/types').QueryTypeName} members.\n */\nexport type QueryTypesForColumn<C> =\n  C extends EncryptedV3Column<infer D>\n    ?\n        | (D['capabilities']['equality'] extends true ? 'equality' : never)\n        | (D['capabilities']['orderAndRange'] extends true\n            ? 'orderAndRange'\n            : never)\n        | (D['capabilities']['freeTextSearch'] extends true\n            ? 'freeTextSearch'\n            : never)\n    : never\n\n/**\n * The concrete EQL v3 type string for a single column, read from the literal\n * domain definition carried on the base class's private field (mirrors\n * {@link PlaintextForColumn}). Distributes over a union of columns, so\n * `EqlTypeForColumn<AnyEncryptedV3Column>` yields the union of every domain's\n * `eqlType` — the canonical, source-of-truth key set for a type-driven test\n * matrix keyed by domain.\n */\nexport type EqlTypeForColumn<C> =\n  C extends EncryptedV3Column<infer D> ? D['eqlType'] : never\n","import type { ColumnSchema, EncryptConfig } from '@/schema'\nimport type { Encrypted } from '@/types'\nimport type {\n  EncryptedV3TableColumn,\n  PlaintextForColumn,\n  QueryTypesForColumn,\n} from './columns'\n\ninterface TableDefinition {\n  tableName: string\n  columns: Record<string, ColumnSchema>\n}\n\n/**\n * A v3 encrypted table. Mirrors the v2 `EncryptedTable` but only accepts v3\n * column builders. Emits the same `{ tableName, columns }` definition shape.\n */\nexport class EncryptedTable<T extends EncryptedV3TableColumn> {\n  /** @internal Type-level brand so TypeScript can infer `T` from `EncryptedTable<T>`. */\n  declare readonly _columnType: T\n\n  constructor(\n    public readonly tableName: string,\n    public readonly columnBuilders: T,\n  ) {}\n\n  build(): TableDefinition {\n    const builtColumns: Record<string, ColumnSchema> = {}\n    for (const builder of Object.values(this.columnBuilders)) {\n      // Key by the column's DB name (`getName()`), NOT the JS property name.\n      // `encrypt`/`decrypt` look columns up in the config by `column.getName()`,\n      // so a camelCase JS key mapping to a snake_case DB column (e.g.\n      // `createdOn: types.Date('created_on')`) must register under\n      // `created_on` or the FFI reports \"column not found in Encrypt config\".\n      const name = builder.getName()\n      // Two JS properties resolving to the same DB name would silently overwrite\n      // here (later wins), dropping the first column's config. Fail loudly —\n      // matching the duplicate-tableName guard in buildEncryptConfig and the\n      // reserved-key guard in encryptedTable.\n      if (Object.hasOwn(builtColumns, name)) {\n        throw new Error(\n          `[eql/v3]: duplicate column name \"${name}\" in table \"${this.tableName}\" — two columns resolve to the same DB name`,\n        )\n      }\n      builtColumns[name] = builder.build()\n    }\n    return {\n      tableName: this.tableName,\n      columns: builtColumns,\n    }\n  }\n\n  /**\n   * Map each column's JS property name to its DB column name (`getName()`).\n   * The model path matches user models by property name but must address the\n   * encrypt config and FFI by DB name — `build()` keys columns by DB name, so\n   * the two only agree when property == name. This recovers the mapping that\n   * `build()` discards.\n   */\n  buildColumnKeyMap(): Record<string, string> {\n    const map: Record<string, string> = {}\n    for (const [property, builder] of Object.entries(this.columnBuilders)) {\n      map[property] = builder.getName()\n    }\n    return map\n  }\n}\n\n/**\n * Own instance members of {@link EncryptedTable} that a column name must not\n * shadow. Because {@link encryptedTable} copies column builders onto the\n * instance for accessor access (`users.email`), a column named e.g. `build`\n * would otherwise overwrite the method that {@link buildEncryptConfig} relies\n * on. `_columnType` is a type-only `declare` (no runtime property) so it is\n * listed explicitly here rather than caught by the `in` check below.\n */\nconst RESERVED_TABLE_KEYS = new Set([\n  'tableName',\n  'columnBuilders',\n  '_columnType',\n  'build',\n  'buildColumnKeyMap',\n])\n\n/**\n * Whether a column name would collide with a reserved property on the table\n * object — either an own member ({@link RESERVED_TABLE_KEYS}) or any inherited\n * `Object.prototype` member (`constructor`, `toString`, `valueOf`,\n * `hasOwnProperty`, …). The `in` check covers the prototype chain so assigning\n * the column as an own property can never shadow a prototype method/accessor.\n */\nfunction isReservedTableKey(tableBuilder: object, colName: string): boolean {\n  return RESERVED_TABLE_KEYS.has(colName) || colName in tableBuilder\n}\n\n/**\n * Define a v3 encrypted table. Intentionally shadows the v2 `encryptedTable`\n * name but lives on the `/eql/v3` subpath — the importer picks the model by\n * import path. The returned object is also a column accessor (`users.email`).\n */\nexport function encryptedTable<T extends EncryptedV3TableColumn>(\n  tableName: string,\n  columns: T,\n): EncryptedTable<T> & T {\n  const tableBuilder = new EncryptedTable(\n    tableName,\n    columns,\n  ) as EncryptedTable<T> & T\n\n  for (const [colName, colBuilder] of Object.entries(columns)) {\n    if (isReservedTableKey(tableBuilder, colName)) {\n      throw new Error(\n        `Column name \"${colName}\" collides with a reserved EncryptedTable property`,\n      )\n    }\n    ;(tableBuilder as EncryptedV3TableColumn)[colName] = colBuilder\n  }\n\n  return tableBuilder\n}\n\n/**\n * Build an `EncryptConfig` (`v: 1`) from one or more v3 tables. Emits the same\n * shape as v2's `buildEncryptConfig`.\n */\nexport function buildEncryptConfig(\n  ...tables: Array<EncryptedTable<EncryptedV3TableColumn>>\n): EncryptConfig {\n  const config: EncryptConfig = {\n    v: 1,\n    tables: {},\n  }\n\n  for (const tb of tables) {\n    const tableDef = tb.build()\n    // Config tables are keyed by name, so a duplicate would silently overwrite\n    // the earlier table. Fail loudly instead. (v3-only additive guard; v2's\n    // buildEncryptConfig keeps its existing silent-overwrite behavior.)\n    if (Object.hasOwn(config.tables, tableDef.tableName)) {\n      throw new Error(\n        `[eql/v3]: duplicate table name \"${tableDef.tableName}\" passed to buildEncryptConfig — each table must have a unique name`,\n      )\n    }\n    config.tables[tableDef.tableName] = tableDef.columns\n  }\n\n  return config\n}\n\n/**\n * Infer the plaintext (decrypted) shape from a v3 table schema. Each column maps\n * to the TypeScript type of its domain's `castAs` kind.\n */\nexport type InferPlaintext<T extends EncryptedTable<EncryptedV3TableColumn>> =\n  T extends EncryptedTable<infer C>\n    ? { [K in keyof C]: PlaintextForColumn<C[K]> }\n    : never\n\n/**\n * Infer the encrypted shape from a v3 table schema. See {@link InferPlaintext}\n * for why no key-remap filter is needed in the flat single-type model.\n */\nexport type InferEncrypted<T extends EncryptedTable<EncryptedV3TableColumn>> =\n  T extends EncryptedTable<infer C> ? { [K in keyof C]: Encrypted } : never\n\n// ---------------------------------------------------------------------------\n// Typed-client surface helpers (@cipherstash/stack/v3)\n// ---------------------------------------------------------------------------\n\n/** Any v3 table, regardless of its column map. */\nexport type AnyV3Table = EncryptedTable<EncryptedV3TableColumn>\n\n/** Union of the concrete column builders declared on a v3 table. */\nexport type ColumnsOf<T extends AnyV3Table> =\n  T extends EncryptedTable<infer C> ? C[keyof C] : never\n\n/**\n * Union of the *queryable* column builders on a v3 table. Storage-only columns\n * (whose {@link QueryTypesForColumn} is `never`) are filtered out, so they can't\n * be passed to a query method.\n */\nexport type QueryableColumnsOf<T extends AnyV3Table> =\n  T extends EncryptedTable<infer C>\n    ? {\n        [K in keyof C]: [QueryTypesForColumn<C[K]>] extends [never]\n          ? never\n          : C[K]\n      }[keyof C]\n    : never\n\n/**\n * The accepted input model for {@link import('@/encryption/v3').TypedEncryptionClient.encryptModel}.\n * `T` is inferred from the argument: keys that name a schema column are pinned to\n * the column's plaintext type (nullable if the field is nullable), so a wrong-typed\n * field fails assignability; all other keys pass through unchanged.\n */\nexport type V3ModelInput<Table extends AnyV3Table, T> = {\n  [K in keyof T]: K extends keyof InferPlaintext<Table>\n    ? null extends T[K]\n      ? InferPlaintext<Table>[K] | null\n      : InferPlaintext<Table>[K]\n    : T[K]\n}\n\n/** The encrypted result model: schema columns become `Encrypted`, others pass through. */\nexport type V3EncryptedModel<Table extends AnyV3Table, T> = {\n  [K in keyof T]: K extends keyof InferPlaintext<Table>\n    ? null extends T[K]\n      ? Encrypted | null\n      : Encrypted\n    : T[K]\n}\n\n/** The decrypted result model: schema columns become their plaintext type, others pass through. */\nexport type V3DecryptedModel<Table extends AnyV3Table, T> = {\n  [K in keyof T]: K extends keyof InferPlaintext<Table>\n    ? null extends T[K]\n      ? InferPlaintext<Table>[K] | null\n      : InferPlaintext<Table>[K]\n    : T[K]\n}\n","import {\n  BOOLEAN,\n  DATE,\n  DATE_EQ,\n  DATE_ORD,\n  DATE_ORD_ORE,\n  EncryptedBooleanColumn,\n  EncryptedDateColumn,\n  EncryptedDateEqColumn,\n  EncryptedDateOrdColumn,\n  EncryptedDateOrdOreColumn,\n  EncryptedRealColumn,\n  EncryptedRealEqColumn,\n  EncryptedRealOrdColumn,\n  EncryptedRealOrdOreColumn,\n  EncryptedDoubleColumn,\n  EncryptedDoubleEqColumn,\n  EncryptedDoubleOrdColumn,\n  EncryptedDoubleOrdOreColumn,\n  EncryptedSmallintColumn,\n  EncryptedSmallintEqColumn,\n  EncryptedSmallintOrdColumn,\n  EncryptedSmallintOrdOreColumn,\n  EncryptedIntegerColumn,\n  EncryptedIntegerEqColumn,\n  EncryptedIntegerOrdColumn,\n  EncryptedIntegerOrdOreColumn,\n  EncryptedNumericColumn,\n  EncryptedNumericEqColumn,\n  EncryptedNumericOrdColumn,\n  EncryptedNumericOrdOreColumn,\n  EncryptedTextColumn,\n  EncryptedTextEqColumn,\n  EncryptedTextMatchColumn,\n  EncryptedTextOrdColumn,\n  EncryptedTextOrdOreColumn,\n  EncryptedTextSearchColumn,\n  EncryptedTimestampColumn,\n  EncryptedTimestampEqColumn,\n  EncryptedTimestampOrdColumn,\n  EncryptedTimestampOrdOreColumn,\n  REAL,\n  REAL_EQ,\n  REAL_ORD,\n  REAL_ORD_ORE,\n  DOUBLE,\n  DOUBLE_EQ,\n  DOUBLE_ORD,\n  DOUBLE_ORD_ORE,\n  SMALLINT,\n  SMALLINT_EQ,\n  SMALLINT_ORD,\n  SMALLINT_ORD_ORE,\n  INTEGER,\n  INTEGER_EQ,\n  INTEGER_ORD,\n  INTEGER_ORD_ORE,\n  NUMERIC,\n  NUMERIC_EQ,\n  NUMERIC_ORD,\n  NUMERIC_ORD_ORE,\n  TEXT,\n  TEXT_EQ,\n  TEXT_MATCH,\n  TEXT_ORD,\n  TEXT_ORD_ORE,\n  TIMESTAMP,\n  TIMESTAMP_EQ,\n  TIMESTAMP_ORD,\n  TIMESTAMP_ORD_ORE,\n} from './columns'\n\n/**\n * The v3 column-type namespace. Each member is a factory that builds a concrete\n * EQL v3 column; the member name mirrors the underlying `eql_v3.<name>` domain\n * (strip the `eql_v3.` prefix, PascalCase each `_`-separated segment). So\n * `types.TextEq('actor')` builds an `eql_v3.text_eq` column, `types.IntegerOrd`\n * an `eql_v3.integer_ord`, `types.Timestamp` an `eql_v3.timestamp`, and so on.\n *\n * Each factory returns the CONCRETE column class instance (never the widened\n * `AnyEncryptedV3Column`) so per-column plaintext / query-capability inference\n * stays precise.\n *\n * ```ts\n * import { encryptedTable, types } from '@cipherstash/stack/eql/v3'\n *\n * const events = encryptedTable('events', {\n *   actor:     types.TextEq('actor'),           // equality\n *   weight:    types.IntegerOrd('weight'),         // order + range\n *   createdAt: types.Timestamp('created_at'), // storage only\n * })\n * ```\n *\n * `types.TextSearch` keeps the chainable `.freeTextSearch(opts)` tuner (the\n * only capability-bearing chain — every other domain is fully described by its\n * type). bigint domains are intentionally absent pending lossless FFI\n * round-tripping (see ./columns).\n */\nexport const types = {\n  // integer\n  Integer: (name: string) => new EncryptedIntegerColumn(name, INTEGER),\n  IntegerEq: (name: string) => new EncryptedIntegerEqColumn(name, INTEGER_EQ),\n  IntegerOrdOre: (name: string) =>\n    new EncryptedIntegerOrdOreColumn(name, INTEGER_ORD_ORE),\n  IntegerOrd: (name: string) =>\n    new EncryptedIntegerOrdColumn(name, INTEGER_ORD),\n\n  // smallint\n  Smallint: (name: string) => new EncryptedSmallintColumn(name, SMALLINT),\n  SmallintEq: (name: string) =>\n    new EncryptedSmallintEqColumn(name, SMALLINT_EQ),\n  SmallintOrdOre: (name: string) =>\n    new EncryptedSmallintOrdOreColumn(name, SMALLINT_ORD_ORE),\n  SmallintOrd: (name: string) =>\n    new EncryptedSmallintOrdColumn(name, SMALLINT_ORD),\n\n  // date\n  Date: (name: string) => new EncryptedDateColumn(name, DATE),\n  DateEq: (name: string) => new EncryptedDateEqColumn(name, DATE_EQ),\n  DateOrdOre: (name: string) =>\n    new EncryptedDateOrdOreColumn(name, DATE_ORD_ORE),\n  DateOrd: (name: string) => new EncryptedDateOrdColumn(name, DATE_ORD),\n\n  // timestamp\n  Timestamp: (name: string) => new EncryptedTimestampColumn(name, TIMESTAMP),\n  TimestampEq: (name: string) =>\n    new EncryptedTimestampEqColumn(name, TIMESTAMP_EQ),\n  TimestampOrdOre: (name: string) =>\n    new EncryptedTimestampOrdOreColumn(name, TIMESTAMP_ORD_ORE),\n  TimestampOrd: (name: string) =>\n    new EncryptedTimestampOrdColumn(name, TIMESTAMP_ORD),\n\n  // numeric\n  Numeric: (name: string) => new EncryptedNumericColumn(name, NUMERIC),\n  NumericEq: (name: string) => new EncryptedNumericEqColumn(name, NUMERIC_EQ),\n  NumericOrdOre: (name: string) =>\n    new EncryptedNumericOrdOreColumn(name, NUMERIC_ORD_ORE),\n  NumericOrd: (name: string) =>\n    new EncryptedNumericOrdColumn(name, NUMERIC_ORD),\n\n  // text\n  Text: (name: string) => new EncryptedTextColumn(name, TEXT),\n  TextEq: (name: string) => new EncryptedTextEqColumn(name, TEXT_EQ),\n  TextMatch: (name: string) => new EncryptedTextMatchColumn(name, TEXT_MATCH),\n  TextOrdOre: (name: string) =>\n    new EncryptedTextOrdOreColumn(name, TEXT_ORD_ORE),\n  TextOrd: (name: string) => new EncryptedTextOrdColumn(name, TEXT_ORD),\n  TextSearch: (name: string) => new EncryptedTextSearchColumn(name),\n\n  // boolean\n  Boolean: (name: string) => new EncryptedBooleanColumn(name, BOOLEAN),\n\n  // real\n  Real: (name: string) => new EncryptedRealColumn(name, REAL),\n  RealEq: (name: string) => new EncryptedRealEqColumn(name, REAL_EQ),\n  RealOrdOre: (name: string) =>\n    new EncryptedRealOrdOreColumn(name, REAL_ORD_ORE),\n  RealOrd: (name: string) => new EncryptedRealOrdColumn(name, REAL_ORD),\n\n  // double\n  Double: (name: string) => new EncryptedDoubleColumn(name, DOUBLE),\n  DoubleEq: (name: string) => new EncryptedDoubleEqColumn(name, DOUBLE_EQ),\n  DoubleOrdOre: (name: string) =>\n    new EncryptedDoubleOrdOreColumn(name, DOUBLE_ORD_ORE),\n  DoubleOrd: (name: string) => new EncryptedDoubleOrdColumn(name, DOUBLE_ORD),\n} as const\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACgCO,SAAS,mBAAwC;AACtD,SAAO;AAAA,IACL,WAAW,EAAE,MAAM,SAAS,cAAc,EAAE;AAAA,IAC5C,eAAe,CAAC,EAAE,MAAM,WAAW,CAAC;AAAA,IACpC,GAAG;AAAA,IACH,GAAG;AAAA,IACH,kBAAkB;AAAA,EACpB;AACF;AAOO,SAAS,eAAe,MAAgD;AAC7E,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW,EAAE,GAAG,KAAK,UAAU;AAAA,IAC/B,eAAe,KAAK,cAAc,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;AAAA,EACzD;AACF;;;ACFA,IAAM,eAAe;AAAA,EACnB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,gBAAgB;AAAA,EACpB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,kBAAkB;AAAA,EACtB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,aAAa;AAAA,EACjB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,cAAc;AAAA,EAClB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAOO,IAAM,uBAAuB;AAS7B,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,kBAAkB;AAAA,EAC7B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,mBAAmB;AAAA,EAC9B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AASO,IAAM,OAAO;AAAA,EAClB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAKO,IAAM,YAAY;AAAA,EACvB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,oBAAoB;AAAA,EAC/B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,gBAAgB;AAAA,EAC3B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,kBAAkB;AAAA,EAC7B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,OAAO;AAAA,EAClB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,OAAO;AAAA,EAClB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,SAAS;AAAA,EACpB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,YAAY;AAAA,EACvB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,iBAAiB;AAAA,EAC5B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAiBA,SAAS,uBACP,cACA,QACyB;AACzB,QAAM,UAAmC,CAAC;AAK1C,MACE,aAAa,aACZ,CAAC,aAAa,iBAAiB,WAAW,WAC3C;AACA,YAAQ,SAAS,EAAE,eAAe,CAAC,EAAE;AAAA,EACvC;AAEA,MAAI,aAAa,eAAe;AAC9B,YAAQ,MAAM,CAAC;AAAA,EACjB;AAEA,MAAI,aAAa,gBAAgB;AAG/B,YAAQ,QAAQ,iBAAiB;AAAA,EACnC;AAEA,SAAO;AACT;AAGA,SAAS,wBAAwB,cAA0C;AACzE,SACE,aAAa,YACb,aAAa,iBACb,aAAa;AAEjB;AAUO,IAAM,oBAAN,MAAsD;AAAA,EAC3D,YACmB,YACA,YACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAFgB;AAAA,EACA;AAAA,EAGnB,UAAkB;AAChB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,aAA2B;AACzB,WAAO,KAAK,WAAW;AAAA,EACzB;AAAA;AAAA,EAGA,uBAA0C;AACxC,WAAO,KAAK,WAAW;AAAA,EACzB;AAAA;AAAA,EAGA,cAAgC;AAC9B,WAAO;AAAA,MACL,KAAK,WAAW;AAAA,IAClB;AAAA,EACF;AAAA;AAAA,EAGA,QAAsB;AACpB,WAAO;AAAA,MACL,SAAS,KAAK,WAAW;AAAA,MACzB,SAAS;AAAA,QACP,KAAK,WAAW;AAAA,QAChB,KAAK,WAAW;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAM,qBAAqB;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAuBO,IAAM,4BAAN,cAAwC,kBAE7C;AAAA,EACQ;AAAA,EAER,YAAY,YAAoB;AAC9B,UAAM,YAAY,kBAAkB;AACpC,SAAK,YAAY,iBAAiB;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAe,MAA6B;AAG1C,UAAM,WAAW,iBAAiB;AAIlC,SAAK,YAAY,eAAe;AAAA,MAC9B,WAAW,MAAM,aAAa,SAAS;AAAA,MACvC,eAAe,MAAM,iBAAiB,SAAS;AAAA,MAC/C,GAAG,MAAM,KAAK,SAAS;AAAA,MACvB,GAAG,MAAM,KAAK,SAAS;AAAA,MACvB,kBAAkB,MAAM,oBAAoB,SAAS;AAAA,IACvD,CAAC;AACD,WAAO;AAAA,EACT;AAAA;AAAA,EAGS,QAAsB;AAK7B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS;AAAA,QACP,QAAQ,EAAE,eAAe,CAAC,EAAE;AAAA,QAC5B,KAAK,CAAC;AAAA,QACN,OAAO,eAAe,KAAK,SAAS;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACF;AAaO,IAAM,yBAAN,cAAqC,kBAAkC;AAAC;AACxE,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,+BAAN,cAA2C,kBAEhD;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AAGI,IAAM,0BAAN,cAAsC,kBAE3C;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,gCAAN,cAA4C,kBAEjD;AAAC;AACI,IAAM,6BAAN,cAAyC,kBAE9C;AAAC;AAOI,IAAM,sBAAN,cAAkC,kBAA+B;AAAC;AAClE,IAAM,wBAAN,cAAoC,kBAAkC;AAAC;AACvE,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,yBAAN,cAAqC,kBAE1C;AAAC;AAGI,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,6BAAN,cAAyC,kBAE9C;AAAC;AACI,IAAM,iCAAN,cAA6C,kBAElD;AAAC;AACI,IAAM,8BAAN,cAA0C,kBAE/C;AAAC;AAGI,IAAM,yBAAN,cAAqC,kBAAkC;AAAC;AACxE,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,+BAAN,cAA2C,kBAEhD;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AAGI,IAAM,sBAAN,cAAkC,kBAA+B;AAAC;AAClE,IAAM,wBAAN,cAAoC,kBAAkC;AAAC;AACvE,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,yBAAN,cAAqC,kBAE1C;AAAC;AAGI,IAAM,yBAAN,cAAqC,kBAAkC;AAAC;AAGxE,IAAM,sBAAN,cAAkC,kBAA+B;AAAC;AAClE,IAAM,wBAAN,cAAoC,kBAAkC;AAAC;AACvE,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,yBAAN,cAAqC,kBAE1C;AAAC;AAGI,IAAM,wBAAN,cAAoC,kBAAiC;AAAC;AACtE,IAAM,0BAAN,cAAsC,kBAE3C;AAAC;AACI,IAAM,8BAAN,cAA0C,kBAE/C;AAAC;AACI,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;;;AC3iBI,IAAM,iBAAN,MAAuD;AAAA,EAI5D,YACkB,WACA,gBAChB;AAFgB;AACA;AAAA,EACf;AAAA,EAFe;AAAA,EACA;AAAA,EAGlB,QAAyB;AACvB,UAAM,eAA6C,CAAC;AACpD,eAAW,WAAW,OAAO,OAAO,KAAK,cAAc,GAAG;AAMxD,YAAM,OAAO,QAAQ,QAAQ;AAK7B,UAAI,OAAO,OAAO,cAAc,IAAI,GAAG;AACrC,cAAM,IAAI;AAAA,UACR,oCAAoC,IAAI,eAAe,KAAK,SAAS;AAAA,QACvE;AAAA,MACF;AACA,mBAAa,IAAI,IAAI,QAAQ,MAAM;AAAA,IACrC;AACA,WAAO;AAAA,MACL,WAAW,KAAK;AAAA,MAChB,SAAS;AAAA,IACX;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,oBAA4C;AAC1C,UAAM,MAA8B,CAAC;AACrC,eAAW,CAAC,UAAU,OAAO,KAAK,OAAO,QAAQ,KAAK,cAAc,GAAG;AACrE,UAAI,QAAQ,IAAI,QAAQ,QAAQ;AAAA,IAClC;AACA,WAAO;AAAA,EACT;AACF;AAUA,IAAM,sBAAsB,oBAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AASD,SAAS,mBAAmB,cAAsB,SAA0B;AAC1E,SAAO,oBAAoB,IAAI,OAAO,KAAK,WAAW;AACxD;AAOO,SAAS,eACd,WACA,SACuB;AACvB,QAAM,eAAe,IAAI;AAAA,IACvB;AAAA,IACA;AAAA,EACF;AAEA,aAAW,CAAC,SAAS,UAAU,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC3D,QAAI,mBAAmB,cAAc,OAAO,GAAG;AAC7C,YAAM,IAAI;AAAA,QACR,gBAAgB,OAAO;AAAA,MACzB;AAAA,IACF;AACA;AAAC,IAAC,aAAwC,OAAO,IAAI;AAAA,EACvD;AAEA,SAAO;AACT;AAMO,SAAS,sBACX,QACY;AACf,QAAM,SAAwB;AAAA,IAC5B,GAAG;AAAA,IACH,QAAQ,CAAC;AAAA,EACX;AAEA,aAAW,MAAM,QAAQ;AACvB,UAAM,WAAW,GAAG,MAAM;AAI1B,QAAI,OAAO,OAAO,OAAO,QAAQ,SAAS,SAAS,GAAG;AACpD,YAAM,IAAI;AAAA,QACR,mCAAmC,SAAS,SAAS;AAAA,MACvD;AAAA,IACF;AACA,WAAO,OAAO,SAAS,SAAS,IAAI,SAAS;AAAA,EAC/C;AAEA,SAAO;AACT;;;ACjDO,IAAM,QAAQ;AAAA;AAAA,EAEnB,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,OAAO;AAAA,EACnE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA,EAC1E,eAAe,CAAC,SACd,IAAI,6BAA6B,MAAM,eAAe;AAAA,EACxD,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,WAAW;AAAA;AAAA,EAGjD,UAAU,CAAC,SAAiB,IAAI,wBAAwB,MAAM,QAAQ;AAAA,EACtE,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,WAAW;AAAA,EACjD,gBAAgB,CAAC,SACf,IAAI,8BAA8B,MAAM,gBAAgB;AAAA,EAC1D,aAAa,CAAC,SACZ,IAAI,2BAA2B,MAAM,YAAY;AAAA;AAAA,EAGnD,MAAM,CAAC,SAAiB,IAAI,oBAAoB,MAAM,IAAI;AAAA,EAC1D,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,OAAO;AAAA,EACjE,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,YAAY;AAAA,EAClD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,QAAQ;AAAA;AAAA,EAGpE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,SAAS;AAAA,EACzE,aAAa,CAAC,SACZ,IAAI,2BAA2B,MAAM,YAAY;AAAA,EACnD,iBAAiB,CAAC,SAChB,IAAI,+BAA+B,MAAM,iBAAiB;AAAA,EAC5D,cAAc,CAAC,SACb,IAAI,4BAA4B,MAAM,aAAa;AAAA;AAAA,EAGrD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,OAAO;AAAA,EACnE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA,EAC1E,eAAe,CAAC,SACd,IAAI,6BAA6B,MAAM,eAAe;AAAA,EACxD,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,WAAW;AAAA;AAAA,EAGjD,MAAM,CAAC,SAAiB,IAAI,oBAAoB,MAAM,IAAI;AAAA,EAC1D,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,OAAO;AAAA,EACjE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA,EAC1E,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,YAAY;AAAA,EAClD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,QAAQ;AAAA,EACpE,YAAY,CAAC,SAAiB,IAAI,0BAA0B,IAAI;AAAA;AAAA,EAGhE,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,OAAO;AAAA;AAAA,EAGnE,MAAM,CAAC,SAAiB,IAAI,oBAAoB,MAAM,IAAI;AAAA,EAC1D,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,OAAO;AAAA,EACjE,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,YAAY;AAAA,EAClD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,QAAQ;AAAA;AAAA,EAGpE,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,MAAM;AAAA,EAChE,UAAU,CAAC,SAAiB,IAAI,wBAAwB,MAAM,SAAS;AAAA,EACvE,cAAc,CAAC,SACb,IAAI,4BAA4B,MAAM,cAAc;AAAA,EACtD,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAC5E;","names":[]}
+{"version":3,"sources":["../../../src/eql/v3/index.ts","../../../src/schema/match-defaults.ts","../../../src/eql/v3/columns.ts","../../../src/eql/v3/table.ts","../../../src/eql/v3/types.ts"],"sourcesContent":["// Public barrel for the EQL v3 authoring DSL (`@cipherstash/stack/eql/v3`).\n//\n// Curated on purpose: it re-exports the `types` namespace, the concrete column\n// classes (load-bearing for the `AnyEncryptedV3Column` union and nominal\n// typing), the table API, and the inference type aliases. It deliberately does\n// NOT re-export the per-domain literal consts (`INTEGER`, `TEXT_EQ`, …) — those are\n// internal building blocks for `types` — and there are no standalone\n// `encrypted<Domain>Column` factories any more: `types.*` is the single\n// authoring API.\n\nexport type {\n  AnyEncryptedV3Column,\n  EncryptedV3TableColumn,\n  EqlTypeForColumn,\n  JsonDocument,\n  JsonValue,\n  PlaintextForColumn,\n  QueryCapabilities,\n  QueryTypesForColumn,\n} from './columns'\n\nexport {\n  EncryptedBigintColumn,\n  EncryptedBigintEqColumn,\n  EncryptedBigintOrdColumn,\n  EncryptedBigintOrdOreColumn,\n  EncryptedBooleanColumn,\n  EncryptedDateColumn,\n  EncryptedDateEqColumn,\n  EncryptedDateOrdColumn,\n  EncryptedDateOrdOreColumn,\n  EncryptedDoubleColumn,\n  EncryptedDoubleEqColumn,\n  EncryptedDoubleOrdColumn,\n  EncryptedDoubleOrdOreColumn,\n  EncryptedIntegerColumn,\n  EncryptedIntegerEqColumn,\n  EncryptedIntegerOrdColumn,\n  EncryptedIntegerOrdOreColumn,\n  EncryptedJsonColumn,\n  EncryptedNumericColumn,\n  EncryptedNumericEqColumn,\n  EncryptedNumericOrdColumn,\n  EncryptedNumericOrdOreColumn,\n  EncryptedRealColumn,\n  EncryptedRealEqColumn,\n  EncryptedRealOrdColumn,\n  EncryptedRealOrdOreColumn,\n  EncryptedSmallintColumn,\n  EncryptedSmallintEqColumn,\n  EncryptedSmallintOrdColumn,\n  EncryptedSmallintOrdOreColumn,\n  EncryptedTextColumn,\n  EncryptedTextEqColumn,\n  EncryptedTextMatchColumn,\n  EncryptedTextOrdColumn,\n  EncryptedTextOrdOreColumn,\n  EncryptedTextSearchColumn,\n  EncryptedTimestampColumn,\n  EncryptedTimestampEqColumn,\n  EncryptedTimestampOrdColumn,\n  EncryptedTimestampOrdOreColumn,\n  TEXT_SEARCH_EQL_TYPE,\n} from './columns'\nexport type {\n  AnyV3Table,\n  ColumnsOf,\n  InferEncrypted,\n  InferPlaintext,\n  QueryableColumnsOf,\n  V3DecryptedModel,\n  V3EncryptedModel,\n  V3ModelInput,\n} from './table'\n\nexport { buildEncryptConfig, EncryptedTable, encryptedTable } from './table'\nexport { types } from './types'\n","import type { MatchIndexOpts } from './index'\n\n/**\n * Fully-resolved match-index options: every field present and non-`undefined`.\n *\n * `MatchIndexOpts` (the user-facing tuning input) has all fields optional —\n * each is `.default(...).optional()` in the zod schema, so its inferred type is\n * `T | undefined`. This type pins the BUILT/resolved shape explicitly via\n * `NonNullable<...>`, which states the non-null intent directly and is robust\n * regardless of `Required<>`'s subtle, `exactOptionalPropertyTypes`-dependent\n * stripping semantics.\n */\nexport type BuiltMatchIndexOpts = {\n  tokenizer: NonNullable<MatchIndexOpts['tokenizer']>\n  token_filters: NonNullable<MatchIndexOpts['token_filters']>\n  k: NonNullable<MatchIndexOpts['k']>\n  m: NonNullable<MatchIndexOpts['m']>\n  include_original: NonNullable<MatchIndexOpts['include_original']>\n}\n\n/**\n * Default match-index parameters — the single source of truth shared by the\n * v2 `freeTextSearch()` builder and the v3 domain builders.\n *\n * `include_original: true` is the v2 builder's historical default rather than\n * the zod-schema default of `false`. It is INERT: protect-ffi accepts the flag\n * and ignores it (measured across 0.24 and 0.29, EQL v2 and v3 — the emitted\n * bloom is trigram-only either way). It is kept here only so the v2 emitted\n * config does not move. The v3 domain builders override it to `false`, the\n * value a substring-search domain wants if ffi ever starts honouring it.\n *\n * In particular it does NOT let a value shorter than the tokenizer's\n * `token_length` be matched: such a value blooms to nothing under either\n * setting, which is exactly the fail-open {@link matchNeedleError} guards.\n *\n * This is a FACTORY (not a shared `const`) so every caller gets fresh, unaliased\n * nested objects (`tokenizer`, `token_filters` and the `{ kind: 'downcase' }`\n * inside it). A shared const would be shallow-copied by `{ ...DEFAULT }`, leaving\n * those nested objects aliased across every column — a caller mutating one built\n * config could then corrupt the defaults used by later columns.\n */\nexport function defaultMatchOpts(): BuiltMatchIndexOpts {\n  return {\n    tokenizer: { kind: 'ngram', token_length: 3 },\n    token_filters: [{ kind: 'downcase' }],\n    k: 6,\n    m: 2048,\n    include_original: true,\n  }\n}\n\n/**\n * Deep-clone a built match block (`tokenizer` and `token_filters` are its only\n * nested values) so no emitted config or stored builder state ever aliases\n * another's nested objects — a caller mutating one cannot corrupt the other.\n */\nexport function cloneMatchOpts(opts: BuiltMatchIndexOpts): BuiltMatchIndexOpts {\n  return {\n    ...opts,\n    tokenizer: { ...opts.tokenizer },\n    token_filters: opts.token_filters.map((f) => ({ ...f })),\n  }\n}\n\n/**\n * Resolve user-supplied `freeTextSearch(opts)` input into a fully-built match\n * block: each provided key replaces its default, omitted keys keep the default\n * (`opts?.x ?? default.x`). The single source of truth for that five-field merge\n * shared by the v2 `freeTextSearch()` builder and the v3 domain builders.\n *\n * The result is deep-cloned ({@link cloneMatchOpts}) so a caller mutating their\n * own `opts` object (or its nested `tokenizer`/`token_filters`) after this call\n * can never leak into the stored builder state or the emitted config — clone-on-\n * write for both builders, not just v3.\n */\nexport function resolveMatchOpts(opts?: MatchIndexOpts): BuiltMatchIndexOpts {\n  const defaults = defaultMatchOpts()\n  return cloneMatchOpts({\n    tokenizer: opts?.tokenizer ?? defaults.tokenizer,\n    token_filters: opts?.token_filters ?? defaults.token_filters,\n    k: opts?.k ?? defaults.k,\n    m: opts?.m ?? defaults.m,\n    include_original: opts?.include_original ?? defaults.include_original,\n  })\n}\n\n/**\n * The shortest needle a match index can answer, or `undefined` when its\n * tokenizer imposes no floor (`standard` splits on word boundaries, so any\n * non-empty needle yields at least one token).\n *\n * Accepts the loose {@link MatchIndexOpts} because a `ColumnSchema`'s built\n * `indexes.match` is typed from the zod schema, where `tokenizer` is optional.\n * An absent tokenizer resolves to the same default the schema itself applies\n * (`ngram`, `token_length: 3`) rather than skipping the floor — skipping would\n * reintroduce the fail-open this guard exists to close.\n */\nexport function matchNeedleMinLength(opts: MatchIndexOpts): number | undefined {\n  const tokenizer = opts.tokenizer ?? defaultMatchOpts().tokenizer\n  return tokenizer.kind === 'ngram' ? tokenizer.token_length : undefined\n}\n\n/**\n * Why a needle cannot be answered by this match index, or `undefined` when it\n * can. Callers throw their own error type with this as the reason.\n *\n * A needle that tokenizes to NOTHING has an empty bloom filter, and\n * `stored_bf @> '{}'` is true for every row (\"contains nothing, contained by\n * everything\"). Such a query is unanswerable rather than merely unmatched, so\n * it must fail loudly instead of silently returning the whole table. Two ways\n * to tokenize to nothing:\n *\n *  - the empty needle, under ANY tokenizer;\n *  - a needle shorter than the ngram tokenizer's `token_length`.\n *\n * The ngram floor counts Unicode CODEPOINTS, because that is what the tokenizer\n * counts. `needle.length` would count UTF-16 code units and wave through an\n * astral-plane needle: `'👍👍'` is 4 code units but only 2 codepoints, yields no\n * trigram, and (measured live) matched every row. Graphemes are the wrong unit\n * in the other direction — NFD `'éé'` is 4 codepoints but 2 grapheme clusters,\n * and does yield trigrams.\n *\n * Currently wired ONLY into the v3 Drizzle adapter (`eql/v3/drizzle/operators`).\n * It lives here, beside the shared match defaults, because v2 builds the same\n * bloom filters and needs the same floor — but v2's `like`/`ilike` path remains\n * unguarded and still fails open. Do not reuse this for v2 without first\n * measuring what its tokenizer actually receives: v2 needles carry SQL wildcards\n * (`'%ada%'`), so the floor may have to apply to the unwrapped term rather than\n * to the string the caller passed.\n */\nexport function matchNeedleError(\n  needle: unknown,\n  opts: MatchIndexOpts,\n): string | undefined {\n  if (typeof needle !== 'string') return undefined\n\n  // Codepoints, not UTF-16 code units — see above.\n  const length = [...needle].length\n  const min = matchNeedleMinLength(opts)\n\n  if (length === 0) {\n    return `free-text search needs a non-empty search term; an empty term produces no tokens and would match every row.`\n  }\n  if (min === undefined || length >= min) return undefined\n  return `free-text search needs at least ${min} characters (the index tokenizer's token_length), but the search term ${JSON.stringify(needle)} has ${length}. A shorter term produces no tokens and would match every row.`\n}\n","import type { ColumnSchema } from '@/schema'\nimport { defaultMatchOpts } from '@/schema/match-defaults'\n\n/**\n * The query capabilities a v3 concrete domain exposes. These are SDK-facing\n * semantic flags describing what kinds of query terms a column can produce —\n * NOT the raw EQL index keys. They are metadata only and never emitted by\n * `build()`.\n *\n * - `equality`: exact-match lookups (EQL `hm`, or comparison via `ob`).\n * - `orderAndRange`: comparison / range lookups (EQL `op`, or `ob` on `_ord_ore` domains).\n * - `freeTextSearch`: tokenised substring match (EQL `bf`).\n * - `searchableJson`: encrypted-JSONB containment / selector lookups (EQL\n *   `ste_vec`). Optional and mutually exclusive with the scalar flags — a\n *   `public.eql_v3_json` document is queried by structure, not by scalar term.\n */\nexport type QueryCapabilities = Readonly<{\n  equality: boolean\n  orderAndRange: boolean\n  freeTextSearch: boolean\n  searchableJson?: boolean\n}>\n\n/**\n * The `cast_as` kinds whose decrypted plaintext reconstructs to a JS `Date`.\n *\n * SINGLE SOURCE OF TRUTH for the date-like set. Both the type-level\n * {@link PlaintextFromKind} and the runtime `rowReconstructor` (encryption/v3.ts)\n * derive their \"reconstructs to `Date`\" decision from this array, so the next\n * `Date`-backed cast is added in exactly one place — never hand-synced across a\n * type and a runtime guard that could silently drift.\n *\n * (`timestamp` reconstructs to `Date` just like `date`, but its `cast_as` tells\n * the FFI not to truncate the time-of-day.)\n */\nexport const DATE_LIKE_CASTS = ['date', 'timestamp'] as const\n/** A `cast_as` kind that reconstructs to `Date` — see {@link DATE_LIKE_CASTS}. */\nexport type DateLikeCast = (typeof DATE_LIKE_CASTS)[number]\n\n/** The plaintext (TypeScript) kind a v3 domain decrypts to. A subset of the\n * SDK `CastAs` enum, restricted to the scalar kinds v3 domains actually use. */\ntype PlaintextKind =\n  | 'string'\n  | 'number'\n  | 'bigint'\n  | 'boolean'\n  | 'json'\n  | DateLikeCast\n\n/**\n * The full, literal definition of a v3 domain. This is the LOAD-BEARING type:\n * the base column class carries a private field of this type so that every\n * concrete (otherwise-empty) subclass is discriminated by its literal\n * `eqlType`/`castAs`/`capabilities` — TypeScript empty subclasses are NOT\n * nominal, so without this a storage-only `boolean` column would be assignable to\n * a storage-only `date` column and plaintext inference would collapse.\n */\ntype V3DomainDefinition = Readonly<{\n  eqlType: `public.${string}`\n  castAs: PlaintextKind\n  capabilities: QueryCapabilities\n}>\n\n/** Type-level mirror of {@link isQueryableCapabilities}: `false` for a\n * storage-only domain (all capability flags `false`), `true` otherwise. */\ntype QueryableFlag<D extends V3DomainDefinition> = D['capabilities'] extends {\n  equality: false\n  orderAndRange: false\n  freeTextSearch: false\n  searchableJson?: false | undefined\n}\n  ? false\n  : true\n\nconst STORAGE_ONLY = {\n  equality: false,\n  orderAndRange: false,\n  freeTextSearch: false,\n} as const\n\nconst EQUALITY_ONLY = {\n  equality: true,\n  orderAndRange: false,\n  freeTextSearch: false,\n} as const\n\nconst ORDER_AND_RANGE = {\n  equality: true,\n  orderAndRange: true,\n  freeTextSearch: false,\n} as const\n\nconst MATCH_ONLY = {\n  equality: false,\n  orderAndRange: false,\n  freeTextSearch: true,\n} as const\n\nconst TEXT_SEARCH = {\n  equality: true,\n  orderAndRange: true,\n  freeTextSearch: true,\n} as const\n\n/**\n * The concrete EQL v3 domain name for a full-capability text column.\n * Recorded as metadata for future DDL / query-dialect increments; it is\n * intentionally absent from the emitted encrypt config.\n */\nexport const TEXT_SEARCH_EQL_TYPE = 'public.eql_v3_text_search'\n\n// Per-domain literal definitions. Each concrete column subclass is parameterised\n// by `typeof <CONST>`; the literal `eqlType`/`castAs`/`capabilities` on each is\n// what makes the otherwise-empty subclasses nominally distinct (see\n// V3DomainDefinition). Order mirrors eql-bindings `CATALOG` order.\n//\n// Exported for the `types` namespace factory (see ./types); they are internal\n// building blocks and are intentionally NOT re-exported from the public barrel.\nexport const INTEGER = {\n  eqlType: 'public.eql_v3_integer',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const INTEGER_EQ = {\n  eqlType: 'public.eql_v3_integer_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const INTEGER_ORD_ORE = {\n  eqlType: 'public.eql_v3_integer_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const INTEGER_ORD = {\n  eqlType: 'public.eql_v3_integer_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const SMALLINT = {\n  eqlType: 'public.eql_v3_smallint',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const SMALLINT_EQ = {\n  eqlType: 'public.eql_v3_smallint_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const SMALLINT_ORD_ORE = {\n  eqlType: 'public.eql_v3_smallint_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const SMALLINT_ORD = {\n  eqlType: 'public.eql_v3_smallint_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\n// bigint (int8) domains. Plaintext is a JS `bigint` (always decrypts to\n// `bigint`); bounds are the full i64 range. protect-ffi round-trips an in-range\n// native bigint losslessly, and values outside the signed 64-bit range are\n// rejected client-side by `assertValidNumericValue` before they reach the FFI\n// (`*_ord_ope` variants are out of scope — CIP-3403.)\nexport const BIGINT = {\n  eqlType: 'public.eql_v3_bigint',\n  castAs: 'bigint',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const BIGINT_EQ = {\n  eqlType: 'public.eql_v3_bigint_eq',\n  castAs: 'bigint',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const BIGINT_ORD_ORE = {\n  eqlType: 'public.eql_v3_bigint_ord_ore',\n  castAs: 'bigint',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const BIGINT_ORD = {\n  eqlType: 'public.eql_v3_bigint_ord',\n  castAs: 'bigint',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const DATE = {\n  eqlType: 'public.eql_v3_date',\n  castAs: 'date',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const DATE_EQ = {\n  eqlType: 'public.eql_v3_date_eq',\n  castAs: 'date',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const DATE_ORD_ORE = {\n  eqlType: 'public.eql_v3_date_ord_ore',\n  castAs: 'date',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const DATE_ORD = {\n  eqlType: 'public.eql_v3_date_ord',\n  castAs: 'date',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const TIMESTAMP = {\n  eqlType: 'public.eql_v3_timestamp',\n  castAs: 'timestamp',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const TIMESTAMP_EQ = {\n  eqlType: 'public.eql_v3_timestamp_eq',\n  castAs: 'timestamp',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const TIMESTAMP_ORD_ORE = {\n  eqlType: 'public.eql_v3_timestamp_ord_ore',\n  castAs: 'timestamp',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const TIMESTAMP_ORD = {\n  eqlType: 'public.eql_v3_timestamp_ord',\n  castAs: 'timestamp',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const NUMERIC = {\n  eqlType: 'public.eql_v3_numeric',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const NUMERIC_EQ = {\n  eqlType: 'public.eql_v3_numeric_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const NUMERIC_ORD_ORE = {\n  eqlType: 'public.eql_v3_numeric_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const NUMERIC_ORD = {\n  eqlType: 'public.eql_v3_numeric_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const TEXT = {\n  eqlType: 'public.eql_v3_text',\n  castAs: 'string',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const TEXT_EQ = {\n  eqlType: 'public.eql_v3_text_eq',\n  castAs: 'string',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const TEXT_MATCH = {\n  eqlType: 'public.eql_v3_text_match',\n  castAs: 'string',\n  capabilities: MATCH_ONLY,\n} as const\nexport const TEXT_ORD_ORE = {\n  eqlType: 'public.eql_v3_text_ord_ore',\n  castAs: 'string',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const TEXT_ORD = {\n  eqlType: 'public.eql_v3_text_ord',\n  castAs: 'string',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const BOOLEAN = {\n  eqlType: 'public.eql_v3_boolean',\n  castAs: 'boolean',\n  capabilities: STORAGE_ONLY,\n} as const\n\nexport const REAL = {\n  eqlType: 'public.eql_v3_real',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const REAL_EQ = {\n  eqlType: 'public.eql_v3_real_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const REAL_ORD_ORE = {\n  eqlType: 'public.eql_v3_real_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const REAL_ORD = {\n  eqlType: 'public.eql_v3_real_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const DOUBLE = {\n  eqlType: 'public.eql_v3_double',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const DOUBLE_EQ = {\n  eqlType: 'public.eql_v3_double_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const DOUBLE_ORD_ORE = {\n  eqlType: 'public.eql_v3_double_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const DOUBLE_ORD = {\n  eqlType: 'public.eql_v3_double_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\n/**\n * Translate a domain's semantic {@link QueryCapabilities} (plus its plaintext\n * `castAs`, which decides how equality is answered, and its ordering flavour)\n * into the concrete EQL index block emitted by `build()`.\n *\n * - `unique` (the `hm` HMAC index) whenever equality is answered via HMAC:\n *   equality-only domains of ANY type, AND text order domains. Text equality is\n *   HMAC-based — the `public.eql_v3_text_ord` / `public.eql_v3_text_ord_ore` SQL domains\n *   REQUIRE `hm` in the stored ciphertext (their `eql_v3.eq_term` extracts it).\n * - ONE ordering index for any order/range domain, selected by the domain's\n *   name (eql-3.0.0): plain `_ord` domains (and `text_search`) are OPE-backed —\n *   `ope`, the `op` CLLW-OPE term — while `_ord_ore` domains keep block-ORE —\n *   `ore`, the `ob` term. The two terms are not cross-comparable, and each\n *   domain's SQL CHECK requires exactly its own. For numeric/date order\n *   domains the ordering term also answers equality (via the SQL `=`\n *   operator), so those emit no `hm`. Text order domains emit BOTH `unique`\n *   and the ordering index.\n * - `match` (the `bf` bloom-filter index) for free-text search, deep-cloned from\n *   the per-call defaults so no nested object is ever shared across columns, and\n *   emitted with `include_original: false` (see below).\n */\nfunction indexesForCapabilities(\n  capabilities: QueryCapabilities,\n  castAs: PlaintextKind,\n  ordering: 'ope' | 'ore',\n): ColumnSchema['indexes'] {\n  const indexes: ColumnSchema['indexes'] = {}\n\n  // Text equality is always HMAC-based, so a text order domain (`string` +\n  // order/range) still needs `unique`; numeric/date order domains answer\n  // equality via their ordering term and must NOT emit `unique`.\n  if (\n    capabilities.equality &&\n    (!capabilities.orderAndRange || castAs === 'string')\n  ) {\n    indexes.unique = { token_filters: [] }\n  }\n\n  if (capabilities.orderAndRange) {\n    indexes[ordering] = {}\n  }\n\n  if (capabilities.freeTextSearch) {\n    // The factory returns fresh, unaliased nested objects per call, so no\n    // column's emitted match block ever shares state with another's.\n    //\n    // `include_original` is overridden off the v2 builder's `true`. protect-ffi\n    // ignores the flag entirely (measured across 0.24 and 0.29, EQL v2 and v3:\n    // the emitted bloom is trigram-only either way, and a value shorter than\n    // `token_length` blooms to nothing regardless), so this is inert today. It\n    // is set to the value a substring-search domain actually wants — matching\n    // the zod schema's own default — so that a protect-ffi release which starts\n    // honouring the flag cannot silently break `contains`.\n    indexes.match = { ...defaultMatchOpts(), include_original: false }\n  }\n\n  if (capabilities.searchableJson) {\n    // Encrypted-JSONB index (the protect-ffi config kind is named `ste_vec`).\n    // `prefix: 'enabled'` is a sentinel the table's `build()` rewrites to\n    // `${tableName}/${columnName}` — the same scheme v2 `searchableJson` uses —\n    // so each document's selectors are scoped to their column.\n    //\n    // `array_index_mode` indexes array elements by identity (`item`) and enables\n    // `$[*]` wildcard selectors, but deliberately drops `position`: `@>`\n    // containment must be a subset test (jsonb `@>` semantics), so `{roles:['x']}`\n    // matches any document whose `roles` array contains `x` REGARDLESS of index.\n    // With positional terms emitted (v2 `searchableJson`'s `'all'`), the needle\n    // for `x`-at-index-0 would miss a document holding `x` at index 1.\n    //\n    // `mode: 'compat'` is REQUIRED for eql-3.0.0: `public.eql_v3_json` orders the\n    // document's entries by the CLLW-OPE `op` term, so the index must emit `op`\n    // (compat) terms. `'standard'` emits v2's CLLW-ORE `oc` terms, which the v3\n    // domain rejects at encrypt time.\n    indexes.ste_vec = {\n      prefix: 'enabled',\n      array_index_mode: { item: true, wildcard: true, position: false },\n      mode: 'compat',\n    }\n  }\n\n  return indexes\n}\n\n/**\n * The ordering flavour a domain's name pins (eql-3.0.0): `_ord_ore` domains\n * are block-ORE (`ore` index, `ob` term); every other ordering domain —\n * `_ord` and `text_search` — is CLLW-OPE (`ope` index, `op` term).\n */\nfunction orderingForEqlType(eqlType: string): 'ope' | 'ore' {\n  return eqlType.endsWith('_ord_ore') ? 'ore' : 'ope'\n}\n\n/** Whether a domain's capabilities make it queryable at all (any flag set). */\nfunction isQueryableCapabilities(capabilities: QueryCapabilities): boolean {\n  return (\n    capabilities.equality ||\n    capabilities.orderAndRange ||\n    capabilities.freeTextSearch ||\n    (capabilities.searchableJson ?? false)\n  )\n}\n\n/**\n * Shared base for every v3 concrete domain column. Parameterised by the FULL\n * literal {@link V3DomainDefinition} (not by capabilities alone): the private\n * `definition` field carries the literal `eqlType`/`castAs`/`capabilities`, so\n * two otherwise-empty subclasses (e.g. `EncryptedBooleanColumn` and\n * `EncryptedDateColumn`, both storage-only) are NOT mutually assignable. This\n * nominality is what keeps plaintext inference precise.\n */\nexport class EncryptedV3Column<D extends V3DomainDefinition> {\n  constructor(\n    private readonly columnName: string,\n    private readonly definition: D,\n  ) {}\n\n  getName(): string {\n    return this.columnName\n  }\n\n  /** The concrete EQL v3 domain name. Metadata only; not emitted by `build()`. */\n  getEqlType(): D['eqlType'] {\n    return this.definition.eqlType\n  }\n\n  /** The semantic query capabilities this domain exposes. Metadata only. */\n  getQueryCapabilities(): D['capabilities'] {\n    return this.definition.capabilities\n  }\n\n  /** `true` when this domain can produce at least one kind of query term. */\n  isQueryable(): QueryableFlag<D> {\n    return isQueryableCapabilities(\n      this.definition.capabilities,\n    ) as QueryableFlag<D>\n  }\n\n  /** Emit the encrypt-config column: `cast_as` plus capability-derived indexes. */\n  build(): ColumnSchema {\n    return {\n      cast_as: this.definition.castAs,\n      indexes: indexesForCapabilities(\n        this.definition.capabilities,\n        this.definition.castAs,\n        orderingForEqlType(this.definition.eqlType),\n      ),\n    }\n  }\n}\n\nconst TEXT_SEARCH_DOMAIN = {\n  eqlType: TEXT_SEARCH_EQL_TYPE,\n  castAs: 'string',\n  capabilities: TEXT_SEARCH,\n} as const\n\n/**\n * Builder for a `public.eql_v3_text_search` column.\n *\n * The concrete type inherently enables equality + order/range + free-text\n * match — there are no capability-enabling or tuning methods. The match index\n * is always emitted with the default configuration.\n *\n * NOTE — querying: a `text_search` column emits all three indexes (`unique`,\n * `ope`, `match`), and the shared index-inference picks them by fixed priority\n * `unique > match > ordering`. So `encryptQuery(value, { column, table })` with NO\n * explicit `queryType` builds an EQUALITY term (via `unique`), NOT a free-text\n * match — a substring like `'joh'` then matches nothing. To run a free-text\n * match query you MUST pass `queryType: 'freeTextSearch'`:\n *\n * ```typescript\n * // equality (default): exact value only\n * client.encryptQuery('john@example.com', { column: users.email, table: users })\n * // free-text match: substring/token search\n * client.encryptQuery('joh', { column: users.email, table: users, queryType: 'freeTextSearch' })\n * ```\n */\nexport class EncryptedTextSearchColumn extends EncryptedV3Column<\n  typeof TEXT_SEARCH_DOMAIN\n> {\n  constructor(columnName: string) {\n    super(columnName, TEXT_SEARCH_DOMAIN)\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Concrete domain columns\n//\n// Every concrete class is an empty subclass parameterised by its literal domain\n// definition (see EncryptedV3Column). The `types` namespace (see ./types)\n// constructs these with the SAME literal constant so the instance's private\n// `definition` field carries full literal type data — that is what keeps\n// distinct domains nominally incompatible.\n// ---------------------------------------------------------------------------\n\n// integer\nexport class EncryptedIntegerColumn extends EncryptedV3Column<typeof INTEGER> {}\nexport class EncryptedIntegerEqColumn extends EncryptedV3Column<\n  typeof INTEGER_EQ\n> {}\nexport class EncryptedIntegerOrdOreColumn extends EncryptedV3Column<\n  typeof INTEGER_ORD_ORE\n> {}\nexport class EncryptedIntegerOrdColumn extends EncryptedV3Column<\n  typeof INTEGER_ORD\n> {}\n\n// smallint\nexport class EncryptedSmallintColumn extends EncryptedV3Column<\n  typeof SMALLINT\n> {}\nexport class EncryptedSmallintEqColumn extends EncryptedV3Column<\n  typeof SMALLINT_EQ\n> {}\nexport class EncryptedSmallintOrdOreColumn extends EncryptedV3Column<\n  typeof SMALLINT_ORD_ORE\n> {}\nexport class EncryptedSmallintOrdColumn extends EncryptedV3Column<\n  typeof SMALLINT_ORD\n> {}\n\n// bigint (int8) — plaintext is a JS `bigint`, round-tripped losslessly by the\n// native protect-ffi boundary (see the BIGINT domain definitions above).\nexport class EncryptedBigintColumn extends EncryptedV3Column<typeof BIGINT> {}\nexport class EncryptedBigintEqColumn extends EncryptedV3Column<\n  typeof BIGINT_EQ\n> {}\nexport class EncryptedBigintOrdOreColumn extends EncryptedV3Column<\n  typeof BIGINT_ORD_ORE\n> {}\nexport class EncryptedBigintOrdColumn extends EncryptedV3Column<\n  typeof BIGINT_ORD\n> {}\n\n// date\nexport class EncryptedDateColumn extends EncryptedV3Column<typeof DATE> {}\nexport class EncryptedDateEqColumn extends EncryptedV3Column<typeof DATE_EQ> {}\nexport class EncryptedDateOrdOreColumn extends EncryptedV3Column<\n  typeof DATE_ORD_ORE\n> {}\nexport class EncryptedDateOrdColumn extends EncryptedV3Column<\n  typeof DATE_ORD\n> {}\n\n// timestamp\nexport class EncryptedTimestampColumn extends EncryptedV3Column<\n  typeof TIMESTAMP\n> {}\nexport class EncryptedTimestampEqColumn extends EncryptedV3Column<\n  typeof TIMESTAMP_EQ\n> {}\nexport class EncryptedTimestampOrdOreColumn extends EncryptedV3Column<\n  typeof TIMESTAMP_ORD_ORE\n> {}\nexport class EncryptedTimestampOrdColumn extends EncryptedV3Column<\n  typeof TIMESTAMP_ORD\n> {}\n\n// numeric\nexport class EncryptedNumericColumn extends EncryptedV3Column<typeof NUMERIC> {}\nexport class EncryptedNumericEqColumn extends EncryptedV3Column<\n  typeof NUMERIC_EQ\n> {}\nexport class EncryptedNumericOrdOreColumn extends EncryptedV3Column<\n  typeof NUMERIC_ORD_ORE\n> {}\nexport class EncryptedNumericOrdColumn extends EncryptedV3Column<\n  typeof NUMERIC_ORD\n> {}\n\n// text (text_search is defined above with its match-tuning override)\nexport class EncryptedTextColumn extends EncryptedV3Column<typeof TEXT> {}\nexport class EncryptedTextEqColumn extends EncryptedV3Column<typeof TEXT_EQ> {}\nexport class EncryptedTextMatchColumn extends EncryptedV3Column<\n  typeof TEXT_MATCH\n> {}\nexport class EncryptedTextOrdOreColumn extends EncryptedV3Column<\n  typeof TEXT_ORD_ORE\n> {}\nexport class EncryptedTextOrdColumn extends EncryptedV3Column<\n  typeof TEXT_ORD\n> {}\n\n// boolean\nexport class EncryptedBooleanColumn extends EncryptedV3Column<typeof BOOLEAN> {}\n\n// real\nexport class EncryptedRealColumn extends EncryptedV3Column<typeof REAL> {}\nexport class EncryptedRealEqColumn extends EncryptedV3Column<typeof REAL_EQ> {}\nexport class EncryptedRealOrdOreColumn extends EncryptedV3Column<\n  typeof REAL_ORD_ORE\n> {}\nexport class EncryptedRealOrdColumn extends EncryptedV3Column<\n  typeof REAL_ORD\n> {}\n\n// double\nexport class EncryptedDoubleColumn extends EncryptedV3Column<typeof DOUBLE> {}\nexport class EncryptedDoubleEqColumn extends EncryptedV3Column<\n  typeof DOUBLE_EQ\n> {}\nexport class EncryptedDoubleOrdOreColumn extends EncryptedV3Column<\n  typeof DOUBLE_ORD_ORE\n> {}\nexport class EncryptedDoubleOrdColumn extends EncryptedV3Column<\n  typeof DOUBLE_ORD\n> {}\n\n// json\nconst JSON_DOMAIN = {\n  eqlType: 'public.eql_v3_json',\n  castAs: 'json',\n  capabilities: {\n    equality: false,\n    orderAndRange: false,\n    freeTextSearch: false,\n    searchableJson: true,\n  },\n} as const\n\n/**\n * Builder for a `public.eql_v3_json` column — an encrypted JSONB document\n * (a {@link JsonDocument}: object, array, or null). It round-trips through\n * `encrypt`/`decrypt`, and containment queries use the encrypted-JSONB index\n * emitted by `build()`. (The stored payload is protect-ffi's `SteVecDocument`,\n * and the config index kind is `ste_vec` — both protect-ffi names.)\n */\nexport class EncryptedJsonColumn extends EncryptedV3Column<typeof JSON_DOMAIN> {\n  constructor(columnName: string) {\n    super(columnName, JSON_DOMAIN)\n  }\n}\n\n/**\n * Union of every v3 concrete column type. Used as the value type for v3 table\n * columns so a table may mix any generated domains.\n */\nexport type AnyEncryptedV3Column =\n  | EncryptedIntegerColumn\n  | EncryptedIntegerEqColumn\n  | EncryptedIntegerOrdOreColumn\n  | EncryptedIntegerOrdColumn\n  | EncryptedSmallintColumn\n  | EncryptedSmallintEqColumn\n  | EncryptedSmallintOrdOreColumn\n  | EncryptedSmallintOrdColumn\n  | EncryptedBigintColumn\n  | EncryptedBigintEqColumn\n  | EncryptedBigintOrdOreColumn\n  | EncryptedBigintOrdColumn\n  | EncryptedDateColumn\n  | EncryptedDateEqColumn\n  | EncryptedDateOrdOreColumn\n  | EncryptedDateOrdColumn\n  | EncryptedTimestampColumn\n  | EncryptedTimestampEqColumn\n  | EncryptedTimestampOrdOreColumn\n  | EncryptedTimestampOrdColumn\n  | EncryptedNumericColumn\n  | EncryptedNumericEqColumn\n  | EncryptedNumericOrdOreColumn\n  | EncryptedNumericOrdColumn\n  | EncryptedTextColumn\n  | EncryptedTextEqColumn\n  | EncryptedTextMatchColumn\n  | EncryptedTextOrdOreColumn\n  | EncryptedTextOrdColumn\n  | EncryptedTextSearchColumn\n  | EncryptedBooleanColumn\n  | EncryptedRealColumn\n  | EncryptedRealEqColumn\n  | EncryptedRealOrdOreColumn\n  | EncryptedRealOrdColumn\n  | EncryptedDoubleColumn\n  | EncryptedDoubleEqColumn\n  | EncryptedDoubleOrdOreColumn\n  | EncryptedDoubleOrdColumn\n  | EncryptedJsonColumn\n\n/**\n * A factory that builds a concrete v3 column for a given DB column name.\n *\n * Declared here rather than beside `DOMAIN_REGISTRY` so that `./types` can\n * constrain its own export against it without importing from `./domain-registry`,\n * which imports `./types` back as a value.\n */\nexport type V3ColumnFactory = (name: string) => AnyEncryptedV3Column\n\n/**\n * Shape of v3 table columns: every value is a v3 concrete column builder.\n * (Nested fields are deferred to later increments.)\n */\nexport type EncryptedV3TableColumn = {\n  [key: string]: AnyEncryptedV3Column\n}\n\n/** A JSON value at any depth. Used for the values NESTED inside a document. */\nexport type JsonValue =\n  | string\n  | number\n  | boolean\n  | null\n  | JsonValue[]\n  | { [key: string]: JsonValue }\n\n/**\n * The plaintext a `public.eql_v3_json` column encrypts and reconstructs: a JSON\n * DOCUMENT — an object, an array, or `null`. NOT a bare top-level scalar:\n * protect-ffi's `json` cast rejects a top-level string/number/boolean\n * (\"Cannot convert … to Json\"), because a scalar belongs in a scalar domain\n * (`types.TextEq`, `types.IntegerEq`, …). Nested scalars are ordinary\n * {@link JsonValue}s and are fully supported.\n */\nexport type JsonDocument = null | JsonValue[] | { [key: string]: JsonValue }\n\n/** Map a domain's {@link PlaintextKind} to its TypeScript plaintext type. */\ntype PlaintextFromKind<K extends PlaintextKind> = K extends 'string'\n  ? string\n  : K extends 'number'\n    ? number\n    : K extends 'bigint'\n      ? bigint\n      : K extends 'boolean'\n        ? boolean\n        : K extends DateLikeCast\n          ? Date\n          : K extends 'json'\n            ? JsonDocument\n            : never\n\n/**\n * The plaintext type for a single v3 column, read from the literal domain\n * definition carried on the base class's private field. This is stable across\n * empty subclasses that share the same base generic — a subclass-name\n * conditional would collapse because those subclasses are structurally\n * assignable to one another.\n */\nexport type PlaintextForColumn<C> =\n  C extends EncryptedV3Column<infer D> ? PlaintextFromKind<D['castAs']> : never\n\n/**\n * The user-facing `queryType` names a v3 column supports, derived 1:1 from its\n * capability flags. Resolves to `never` for a storage-only column (all flags\n * `false`) and for any non-v3 value. The names mirror the {@link QueryCapabilities}\n * keys, each of which is also a {@link import('@/types').QueryTypeName} member.\n */\nexport type QueryTypesForColumn<C> =\n  C extends EncryptedV3Column<infer D>\n    ?\n        | (D['capabilities']['equality'] extends true ? 'equality' : never)\n        | (D['capabilities']['orderAndRange'] extends true\n            ? 'orderAndRange'\n            : never)\n        | (D['capabilities']['freeTextSearch'] extends true\n            ? 'freeTextSearch'\n            : never)\n        // The flag is optional (absent means \"not a JSON document column\"), so\n        // only a literal `true` contributes. Without this arm a `types.Json`\n        // column resolved to `never`, and every typed adapter key set derived\n        // from this type excluded encrypted-JSON columns entirely (#650).\n        | (D['capabilities']['searchableJson'] extends true\n            ? 'searchableJson'\n            : never)\n    : never\n\n/**\n * The concrete EQL v3 type string for a single column, read from the literal\n * domain definition carried on the base class's private field (mirrors\n * {@link PlaintextForColumn}). Distributes over a union of columns, so\n * `EqlTypeForColumn<AnyEncryptedV3Column>` yields the union of every domain's\n * `eqlType` — the canonical, source-of-truth key set for a type-driven test\n * matrix keyed by domain.\n */\nexport type EqlTypeForColumn<C> =\n  C extends EncryptedV3Column<infer D> ? D['eqlType'] : never\n","import type { ColumnSchema, EncryptConfig } from '@/schema'\nimport type { Encrypted } from '@/types'\nimport type {\n  EncryptedV3TableColumn,\n  PlaintextForColumn,\n  QueryTypesForColumn,\n} from './columns'\n\ninterface TableDefinition {\n  tableName: string\n  columns: Record<string, ColumnSchema>\n}\n\n/**\n * A v3 encrypted table. Mirrors the v2 `EncryptedTable` but only accepts v3\n * column builders. Emits the same `{ tableName, columns }` definition shape.\n */\nexport class EncryptedTable<T extends EncryptedV3TableColumn> {\n  /** @internal Type-level brand so TypeScript can infer `T` from `EncryptedTable<T>`. */\n  declare readonly _columnType: T\n\n  constructor(\n    public readonly tableName: string,\n    public readonly columnBuilders: T,\n  ) {}\n\n  build(): TableDefinition {\n    // NULL PROTOTYPE — load-bearing, for the same reason as\n    // {@link buildColumnKeyMap}. Keys are DB column names, which the database\n    // supplies. On a plain object literal, `builtColumns['__proto__'] = schema`\n    // REPARENTS the object rather than adding an own key, so the column never\n    // reaches the encrypt config — `decryptModel` then skips it and its\n    // ciphertext is returned undecrypted. `encryptedTable()` rejects such names\n    // as JS properties, but nothing constrains a table's DB column names.\n    const builtColumns: Record<string, ColumnSchema> = Object.create(null)\n    for (const builder of Object.values(this.columnBuilders)) {\n      // Key by the column's DB name (`getName()`), NOT the JS property name.\n      // `encrypt`/`decrypt` look columns up in the config by `column.getName()`,\n      // so a camelCase JS key mapping to a snake_case DB column (e.g.\n      // `createdOn: types.Date('created_on')`) must register under\n      // `created_on` or the FFI reports \"column not found in Encrypt config\".\n      const name = builder.getName()\n      // Two JS properties resolving to the same DB name would silently overwrite\n      // here (later wins), dropping the first column's config. Fail loudly —\n      // matching the duplicate-tableName guard in buildEncryptConfig and the\n      // reserved-key guard in encryptedTable.\n      if (Object.hasOwn(builtColumns, name)) {\n        throw new Error(\n          `[eql/v3]: duplicate column name \"${name}\" in table \"${this.tableName}\" — two columns resolve to the same DB name`,\n        )\n      }\n      builtColumns[name] = builder.build()\n    }\n    return {\n      tableName: this.tableName,\n      columns: builtColumns,\n    }\n  }\n\n  /**\n   * Map each column's JS property name to its DB column name (`getName()`).\n   * The model path matches user models by property name but must address the\n   * encrypt config and FFI by DB name — `build()` keys columns by DB name, so\n   * the two only agree when property == name. This recovers the mapping that\n   * `build()` discards.\n   *\n   * NULL PROTOTYPE — load-bearing. Callers index this map by a column name that\n   * ultimately comes from the database (`addJsonbCastsV3`, `filterColumnName`,\n   * the mutation transform). On a plain object literal, a column named\n   * `constructor` / `toString` / `valueOf` / `__proto__` resolves to an\n   * inherited `Object.prototype` member, which is truthy — so a *plaintext*\n   * column with such a name would be mistaken for a mapped encrypted column and\n   * its `Object.prototype` value interpolated into the emitted select string.\n   * `encryptedTable()` rejects such names as JS *properties*, but nothing\n   * constrains the DB column names a table may contain.\n   */\n  buildColumnKeyMap(): Record<string, string> {\n    const map = Object.create(null) as Record<string, string>\n    for (const [property, builder] of Object.entries(this.columnBuilders)) {\n      map[property] = builder.getName()\n    }\n    return map\n  }\n}\n\n/**\n * Own instance members of {@link EncryptedTable} that a column name must not\n * shadow. Because {@link encryptedTable} copies column builders onto the\n * instance for accessor access (`users.email`), a column named e.g. `build`\n * would otherwise overwrite the method that {@link buildEncryptConfig} relies\n * on. `_columnType` is a type-only `declare` (no runtime property) so it is\n * listed explicitly here rather than caught by the `in` check below.\n */\nconst RESERVED_TABLE_KEYS = new Set([\n  'tableName',\n  'columnBuilders',\n  '_columnType',\n  'build',\n  'buildColumnKeyMap',\n])\n\n/**\n * Whether a column name would collide with a reserved property on the table\n * object — either an own member ({@link RESERVED_TABLE_KEYS}) or any inherited\n * `Object.prototype` member (`constructor`, `toString`, `valueOf`,\n * `hasOwnProperty`, …). The `in` check covers the prototype chain so assigning\n * the column as an own property can never shadow a prototype method/accessor.\n */\nfunction isReservedTableKey(tableBuilder: object, colName: string): boolean {\n  return RESERVED_TABLE_KEYS.has(colName) || colName in tableBuilder\n}\n\n/**\n * Define a v3 encrypted table. Intentionally shadows the v2 `encryptedTable`\n * name but lives on the `/eql/v3` subpath — the importer picks the model by\n * import path. The returned object is also a column accessor (`users.email`).\n */\nexport function encryptedTable<T extends EncryptedV3TableColumn>(\n  tableName: string,\n  columns: T,\n): EncryptedTable<T> & T {\n  const tableBuilder = new EncryptedTable(\n    tableName,\n    columns,\n  ) as EncryptedTable<T> & T\n\n  for (const [colName, colBuilder] of Object.entries(columns)) {\n    if (isReservedTableKey(tableBuilder, colName)) {\n      throw new Error(\n        `Column name \"${colName}\" collides with a reserved EncryptedTable property`,\n      )\n    }\n    ;(tableBuilder as EncryptedV3TableColumn)[colName] = colBuilder\n  }\n\n  return tableBuilder\n}\n\n/**\n * Build an `EncryptConfig` (`v: 1`) from one or more v3 tables. Emits the same\n * shape as v2's `buildEncryptConfig`.\n */\nexport function buildEncryptConfig(\n  ...tables: Array<EncryptedTable<EncryptedV3TableColumn>>\n): EncryptConfig {\n  const config: EncryptConfig = {\n    v: 1,\n    tables: {},\n  }\n\n  for (const tb of tables) {\n    const tableDef = tb.build()\n    // Config tables are keyed by name, so a duplicate would silently overwrite\n    // the earlier table. Fail loudly instead. (v3-only additive guard; v2's\n    // buildEncryptConfig keeps its existing silent-overwrite behavior.)\n    if (Object.hasOwn(config.tables, tableDef.tableName)) {\n      throw new Error(\n        `[eql/v3]: duplicate table name \"${tableDef.tableName}\" passed to buildEncryptConfig — each table must have a unique name`,\n      )\n    }\n    config.tables[tableDef.tableName] = tableDef.columns\n  }\n\n  return config\n}\n\n/**\n * Infer the plaintext (decrypted) shape from a v3 table schema. Each column maps\n * to the TypeScript type of its domain's `castAs` kind.\n */\nexport type InferPlaintext<T extends EncryptedTable<EncryptedV3TableColumn>> =\n  T extends EncryptedTable<infer C>\n    ? { [K in keyof C]: PlaintextForColumn<C[K]> }\n    : never\n\n/**\n * Infer the encrypted shape from a v3 table schema. See {@link InferPlaintext}\n * for why no key-remap filter is needed in the flat single-type model.\n */\nexport type InferEncrypted<T extends EncryptedTable<EncryptedV3TableColumn>> =\n  T extends EncryptedTable<infer C> ? { [K in keyof C]: Encrypted } : never\n\n// ---------------------------------------------------------------------------\n// Typed-client surface helpers (@cipherstash/stack/v3)\n// ---------------------------------------------------------------------------\n\n/** Any v3 table, regardless of its column map. */\nexport type AnyV3Table = EncryptedTable<EncryptedV3TableColumn>\n\n/** Union of the concrete column builders declared on a v3 table. */\nexport type ColumnsOf<T extends AnyV3Table> =\n  T extends EncryptedTable<infer C> ? C[keyof C] : never\n\n/**\n * Union of the *queryable* column builders on a v3 table. Storage-only columns\n * (whose {@link QueryTypesForColumn} is `never`) are filtered out, so they can't\n * be passed to a query method.\n */\nexport type QueryableColumnsOf<T extends AnyV3Table> =\n  T extends EncryptedTable<infer C>\n    ? {\n        [K in keyof C]: [QueryTypesForColumn<C[K]>] extends [never]\n          ? never\n          : C[K]\n      }[keyof C]\n    : never\n\n/**\n * The accepted input model for {@link import('@/encryption/v3').TypedEncryptionClient.encryptModel}.\n * `T` is inferred from the argument: keys that name a schema column are pinned to\n * the column's plaintext type (nullable if the field is nullable), so a wrong-typed\n * field fails assignability; all other keys pass through unchanged.\n */\nexport type V3ModelInput<Table extends AnyV3Table, T> = {\n  [K in keyof T]: K extends keyof InferPlaintext<Table>\n    ? null extends T[K]\n      ? InferPlaintext<Table>[K] | null\n      : InferPlaintext<Table>[K]\n    : T[K]\n}\n\n/** The encrypted result model: schema columns become `Encrypted`, others pass through. */\nexport type V3EncryptedModel<Table extends AnyV3Table, T> = {\n  [K in keyof T]: K extends keyof InferPlaintext<Table>\n    ? null extends T[K]\n      ? Encrypted | null\n      : Encrypted\n    : T[K]\n}\n\n/**\n * The decrypted result model: schema columns become their plaintext type, others\n * pass through. Structurally identical to {@link V3ModelInput} — decrypt yields\n * the same plaintext shape encrypt accepts — so it is aliased rather than\n * re-declared to keep the input and output shapes from silently drifting when\n * one copy is edited. The distinct name is kept for call-site readability.\n */\nexport type V3DecryptedModel<Table extends AnyV3Table, T> = V3ModelInput<\n  Table,\n  T\n>\n","import {\n  BIGINT,\n  BIGINT_EQ,\n  BIGINT_ORD,\n  BIGINT_ORD_ORE,\n  BOOLEAN,\n  DATE,\n  DATE_EQ,\n  DATE_ORD,\n  DATE_ORD_ORE,\n  DOUBLE,\n  DOUBLE_EQ,\n  DOUBLE_ORD,\n  DOUBLE_ORD_ORE,\n  EncryptedBigintColumn,\n  EncryptedBigintEqColumn,\n  EncryptedBigintOrdColumn,\n  EncryptedBigintOrdOreColumn,\n  EncryptedBooleanColumn,\n  EncryptedDateColumn,\n  EncryptedDateEqColumn,\n  EncryptedDateOrdColumn,\n  EncryptedDateOrdOreColumn,\n  EncryptedDoubleColumn,\n  EncryptedDoubleEqColumn,\n  EncryptedDoubleOrdColumn,\n  EncryptedDoubleOrdOreColumn,\n  EncryptedIntegerColumn,\n  EncryptedIntegerEqColumn,\n  EncryptedIntegerOrdColumn,\n  EncryptedIntegerOrdOreColumn,\n  EncryptedJsonColumn,\n  EncryptedNumericColumn,\n  EncryptedNumericEqColumn,\n  EncryptedNumericOrdColumn,\n  EncryptedNumericOrdOreColumn,\n  EncryptedRealColumn,\n  EncryptedRealEqColumn,\n  EncryptedRealOrdColumn,\n  EncryptedRealOrdOreColumn,\n  EncryptedSmallintColumn,\n  EncryptedSmallintEqColumn,\n  EncryptedSmallintOrdColumn,\n  EncryptedSmallintOrdOreColumn,\n  EncryptedTextColumn,\n  EncryptedTextEqColumn,\n  EncryptedTextMatchColumn,\n  EncryptedTextOrdColumn,\n  EncryptedTextOrdOreColumn,\n  EncryptedTextSearchColumn,\n  EncryptedTimestampColumn,\n  EncryptedTimestampEqColumn,\n  EncryptedTimestampOrdColumn,\n  EncryptedTimestampOrdOreColumn,\n  INTEGER,\n  INTEGER_EQ,\n  INTEGER_ORD,\n  INTEGER_ORD_ORE,\n  NUMERIC,\n  NUMERIC_EQ,\n  NUMERIC_ORD,\n  NUMERIC_ORD_ORE,\n  REAL,\n  REAL_EQ,\n  REAL_ORD,\n  REAL_ORD_ORE,\n  SMALLINT,\n  SMALLINT_EQ,\n  SMALLINT_ORD,\n  SMALLINT_ORD_ORE,\n  TEXT,\n  TEXT_EQ,\n  TEXT_MATCH,\n  TEXT_ORD,\n  TEXT_ORD_ORE,\n  TIMESTAMP,\n  TIMESTAMP_EQ,\n  TIMESTAMP_ORD,\n  TIMESTAMP_ORD_ORE,\n  type V3ColumnFactory,\n} from './columns'\n\n/**\n * The v3 column-type namespace. Each member is a public, semantic factory name\n * for a concrete EQL v3 column. Most members mirror the underlying domain name;\n * JS-friendly scalar names map to Postgres concrete domains, e.g.\n * `types.IntegerOrd` builds a `public.eql_v3_integer_ord` column and `types.Boolean`\n * builds a `public.eql_v3_boolean` column.\n *\n * If these factory names stop matching the emitted capability/domain surface,\n * the stack package is out of sync with the underlying EQL build. That is a\n * version mismatch, not a harmless naming drift.\n *\n * Each factory returns the CONCRETE column class instance (never the widened\n * `AnyEncryptedV3Column`) so per-column plaintext / query-capability inference\n * stays precise.\n *\n * ```ts\n * import { encryptedTable, types } from '@cipherstash/stack/eql/v3'\n *\n * const events = encryptedTable('events', {\n *   actor:     types.TextEq('actor'),           // equality\n *   weight:    types.IntegerOrd('weight'),         // order + range\n *   createdAt: types.Timestamp('created_at'), // storage only\n * })\n * ```\n *\n * `types.TextSearch` is fully described by its type — like every other domain,\n * it has no capability-bearing or tuning chain. Its match index is always\n * emitted with the default configuration; run a free-text query by passing\n * `queryType: 'freeTextSearch'` to `encryptQuery`.\n */\nexport const types = {\n  // integer\n  Integer: (name: string) => new EncryptedIntegerColumn(name, INTEGER),\n  IntegerEq: (name: string) => new EncryptedIntegerEqColumn(name, INTEGER_EQ),\n  IntegerOrdOre: (name: string) =>\n    new EncryptedIntegerOrdOreColumn(name, INTEGER_ORD_ORE),\n  IntegerOrd: (name: string) =>\n    new EncryptedIntegerOrdColumn(name, INTEGER_ORD),\n\n  // smallint\n  Smallint: (name: string) => new EncryptedSmallintColumn(name, SMALLINT),\n  SmallintEq: (name: string) =>\n    new EncryptedSmallintEqColumn(name, SMALLINT_EQ),\n  SmallintOrdOre: (name: string) =>\n    new EncryptedSmallintOrdOreColumn(name, SMALLINT_ORD_ORE),\n  SmallintOrd: (name: string) =>\n    new EncryptedSmallintOrdColumn(name, SMALLINT_ORD),\n\n  // bigint (int8) — plaintext is a JS `bigint`, round-tripped losslessly by\n  // the native protect-ffi boundary (see ./columns)\n  Bigint: (name: string) => new EncryptedBigintColumn(name, BIGINT),\n  BigintEq: (name: string) => new EncryptedBigintEqColumn(name, BIGINT_EQ),\n  BigintOrdOre: (name: string) =>\n    new EncryptedBigintOrdOreColumn(name, BIGINT_ORD_ORE),\n  BigintOrd: (name: string) => new EncryptedBigintOrdColumn(name, BIGINT_ORD),\n\n  // date\n  Date: (name: string) => new EncryptedDateColumn(name, DATE),\n  DateEq: (name: string) => new EncryptedDateEqColumn(name, DATE_EQ),\n  DateOrdOre: (name: string) =>\n    new EncryptedDateOrdOreColumn(name, DATE_ORD_ORE),\n  DateOrd: (name: string) => new EncryptedDateOrdColumn(name, DATE_ORD),\n\n  // timestamp\n  Timestamp: (name: string) => new EncryptedTimestampColumn(name, TIMESTAMP),\n  TimestampEq: (name: string) =>\n    new EncryptedTimestampEqColumn(name, TIMESTAMP_EQ),\n  TimestampOrdOre: (name: string) =>\n    new EncryptedTimestampOrdOreColumn(name, TIMESTAMP_ORD_ORE),\n  TimestampOrd: (name: string) =>\n    new EncryptedTimestampOrdColumn(name, TIMESTAMP_ORD),\n\n  // numeric\n  Numeric: (name: string) => new EncryptedNumericColumn(name, NUMERIC),\n  NumericEq: (name: string) => new EncryptedNumericEqColumn(name, NUMERIC_EQ),\n  NumericOrdOre: (name: string) =>\n    new EncryptedNumericOrdOreColumn(name, NUMERIC_ORD_ORE),\n  NumericOrd: (name: string) =>\n    new EncryptedNumericOrdColumn(name, NUMERIC_ORD),\n\n  // text\n  Text: (name: string) => new EncryptedTextColumn(name, TEXT),\n  TextEq: (name: string) => new EncryptedTextEqColumn(name, TEXT_EQ),\n  TextMatch: (name: string) => new EncryptedTextMatchColumn(name, TEXT_MATCH),\n  TextOrdOre: (name: string) =>\n    new EncryptedTextOrdOreColumn(name, TEXT_ORD_ORE),\n  TextOrd: (name: string) => new EncryptedTextOrdColumn(name, TEXT_ORD),\n  TextSearch: (name: string) => new EncryptedTextSearchColumn(name),\n\n  // boolean\n  Boolean: (name: string) => new EncryptedBooleanColumn(name, BOOLEAN),\n\n  // real\n  Real: (name: string) => new EncryptedRealColumn(name, REAL),\n  RealEq: (name: string) => new EncryptedRealEqColumn(name, REAL_EQ),\n  RealOrdOre: (name: string) =>\n    new EncryptedRealOrdOreColumn(name, REAL_ORD_ORE),\n  RealOrd: (name: string) => new EncryptedRealOrdColumn(name, REAL_ORD),\n\n  // double\n  Double: (name: string) => new EncryptedDoubleColumn(name, DOUBLE),\n  DoubleEq: (name: string) => new EncryptedDoubleEqColumn(name, DOUBLE_EQ),\n  DoubleOrdOre: (name: string) =>\n    new EncryptedDoubleOrdOreColumn(name, DOUBLE_ORD_ORE),\n  DoubleOrd: (name: string) => new EncryptedDoubleOrdColumn(name, DOUBLE_ORD),\n\n  // json (encrypted JSONB document, ste_vec containment)\n  Json: (name: string) => new EncryptedJsonColumn(name),\n  // `satisfies` is load-bearing, not decoration: `DOMAIN_REGISTRY` derives itself\n  // by calling every value here at module load. A non-factory export would throw\n  // during module evaluation and take the supabase introspect/schema-build/verify\n  // path down with it. This turns that into a compile error at the offending line.\n  // `as const` applies first, so literal key inference is preserved.\n} as const satisfies Record<string, V3ColumnFactory>\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACyCO,SAAS,mBAAwC;AACtD,SAAO;AAAA,IACL,WAAW,EAAE,MAAM,SAAS,cAAc,EAAE;AAAA,IAC5C,eAAe,CAAC,EAAE,MAAM,WAAW,CAAC;AAAA,IACpC,GAAG;AAAA,IACH,GAAG;AAAA,IACH,kBAAkB;AAAA,EACpB;AACF;;;ACyBA,IAAM,eAAe;AAAA,EACnB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,gBAAgB;AAAA,EACpB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,kBAAkB;AAAA,EACtB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,aAAa;AAAA,EACjB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,cAAc;AAAA,EAClB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAOO,IAAM,uBAAuB;AAS7B,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,kBAAkB;AAAA,EAC7B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,mBAAmB;AAAA,EAC9B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAOO,IAAM,SAAS;AAAA,EACpB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,YAAY;AAAA,EACvB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,iBAAiB;AAAA,EAC5B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,OAAO;AAAA,EAClB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,YAAY;AAAA,EACvB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,oBAAoB;AAAA,EAC/B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,gBAAgB;AAAA,EAC3B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,kBAAkB;AAAA,EAC7B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,OAAO;AAAA,EAClB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,OAAO;AAAA,EAClB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,SAAS;AAAA,EACpB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,YAAY;AAAA,EACvB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,iBAAiB;AAAA,EAC5B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAuBA,SAAS,uBACP,cACA,QACA,UACyB;AACzB,QAAM,UAAmC,CAAC;AAK1C,MACE,aAAa,aACZ,CAAC,aAAa,iBAAiB,WAAW,WAC3C;AACA,YAAQ,SAAS,EAAE,eAAe,CAAC,EAAE;AAAA,EACvC;AAEA,MAAI,aAAa,eAAe;AAC9B,YAAQ,QAAQ,IAAI,CAAC;AAAA,EACvB;AAEA,MAAI,aAAa,gBAAgB;AAW/B,YAAQ,QAAQ,EAAE,GAAG,iBAAiB,GAAG,kBAAkB,MAAM;AAAA,EACnE;AAEA,MAAI,aAAa,gBAAgB;AAiB/B,YAAQ,UAAU;AAAA,MAChB,QAAQ;AAAA,MACR,kBAAkB,EAAE,MAAM,MAAM,UAAU,MAAM,UAAU,MAAM;AAAA,MAChE,MAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO;AACT;AAOA,SAAS,mBAAmB,SAAgC;AAC1D,SAAO,QAAQ,SAAS,UAAU,IAAI,QAAQ;AAChD;AAGA,SAAS,wBAAwB,cAA0C;AACzE,SACE,aAAa,YACb,aAAa,iBACb,aAAa,mBACZ,aAAa,kBAAkB;AAEpC;AAUO,IAAM,oBAAN,MAAsD;AAAA,EAC3D,YACmB,YACA,YACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAFgB;AAAA,EACA;AAAA,EAGnB,UAAkB;AAChB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,aAA2B;AACzB,WAAO,KAAK,WAAW;AAAA,EACzB;AAAA;AAAA,EAGA,uBAA0C;AACxC,WAAO,KAAK,WAAW;AAAA,EACzB;AAAA;AAAA,EAGA,cAAgC;AAC9B,WAAO;AAAA,MACL,KAAK,WAAW;AAAA,IAClB;AAAA,EACF;AAAA;AAAA,EAGA,QAAsB;AACpB,WAAO;AAAA,MACL,SAAS,KAAK,WAAW;AAAA,MACzB,SAAS;AAAA,QACP,KAAK,WAAW;AAAA,QAChB,KAAK,WAAW;AAAA,QAChB,mBAAmB,KAAK,WAAW,OAAO;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAM,qBAAqB;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAuBO,IAAM,4BAAN,cAAwC,kBAE7C;AAAA,EACA,YAAY,YAAoB;AAC9B,UAAM,YAAY,kBAAkB;AAAA,EACtC;AACF;AAaO,IAAM,yBAAN,cAAqC,kBAAkC;AAAC;AACxE,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,+BAAN,cAA2C,kBAEhD;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AAGI,IAAM,0BAAN,cAAsC,kBAE3C;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,gCAAN,cAA4C,kBAEjD;AAAC;AACI,IAAM,6BAAN,cAAyC,kBAE9C;AAAC;AAII,IAAM,wBAAN,cAAoC,kBAAiC;AAAC;AACtE,IAAM,0BAAN,cAAsC,kBAE3C;AAAC;AACI,IAAM,8BAAN,cAA0C,kBAE/C;AAAC;AACI,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AAGI,IAAM,sBAAN,cAAkC,kBAA+B;AAAC;AAClE,IAAM,wBAAN,cAAoC,kBAAkC;AAAC;AACvE,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,yBAAN,cAAqC,kBAE1C;AAAC;AAGI,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,6BAAN,cAAyC,kBAE9C;AAAC;AACI,IAAM,iCAAN,cAA6C,kBAElD;AAAC;AACI,IAAM,8BAAN,cAA0C,kBAE/C;AAAC;AAGI,IAAM,yBAAN,cAAqC,kBAAkC;AAAC;AACxE,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,+BAAN,cAA2C,kBAEhD;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AAGI,IAAM,sBAAN,cAAkC,kBAA+B;AAAC;AAClE,IAAM,wBAAN,cAAoC,kBAAkC;AAAC;AACvE,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,yBAAN,cAAqC,kBAE1C;AAAC;AAGI,IAAM,yBAAN,cAAqC,kBAAkC;AAAC;AAGxE,IAAM,sBAAN,cAAkC,kBAA+B;AAAC;AAClE,IAAM,wBAAN,cAAoC,kBAAkC;AAAC;AACvE,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,yBAAN,cAAqC,kBAE1C;AAAC;AAGI,IAAM,wBAAN,cAAoC,kBAAiC;AAAC;AACtE,IAAM,0BAAN,cAAsC,kBAE3C;AAAC;AACI,IAAM,8BAAN,cAA0C,kBAE/C;AAAC;AACI,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AAGH,IAAM,cAAc;AAAA,EAClB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAAA,IACZ,UAAU;AAAA,IACV,eAAe;AAAA,IACf,gBAAgB;AAAA,IAChB,gBAAgB;AAAA,EAClB;AACF;AASO,IAAM,sBAAN,cAAkC,kBAAsC;AAAA,EAC7E,YAAY,YAAoB;AAC9B,UAAM,YAAY,WAAW;AAAA,EAC/B;AACF;;;AC7nBO,IAAM,iBAAN,MAAuD;AAAA,EAI5D,YACkB,WACA,gBAChB;AAFgB;AACA;AAAA,EACf;AAAA,EAFe;AAAA,EACA;AAAA,EAGlB,QAAyB;AAQvB,UAAM,eAA6C,uBAAO,OAAO,IAAI;AACrE,eAAW,WAAW,OAAO,OAAO,KAAK,cAAc,GAAG;AAMxD,YAAM,OAAO,QAAQ,QAAQ;AAK7B,UAAI,OAAO,OAAO,cAAc,IAAI,GAAG;AACrC,cAAM,IAAI;AAAA,UACR,oCAAoC,IAAI,eAAe,KAAK,SAAS;AAAA,QACvE;AAAA,MACF;AACA,mBAAa,IAAI,IAAI,QAAQ,MAAM;AAAA,IACrC;AACA,WAAO;AAAA,MACL,WAAW,KAAK;AAAA,MAChB,SAAS;AAAA,IACX;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,oBAA4C;AAC1C,UAAM,MAAM,uBAAO,OAAO,IAAI;AAC9B,eAAW,CAAC,UAAU,OAAO,KAAK,OAAO,QAAQ,KAAK,cAAc,GAAG;AACrE,UAAI,QAAQ,IAAI,QAAQ,QAAQ;AAAA,IAClC;AACA,WAAO;AAAA,EACT;AACF;AAUA,IAAM,sBAAsB,oBAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AASD,SAAS,mBAAmB,cAAsB,SAA0B;AAC1E,SAAO,oBAAoB,IAAI,OAAO,KAAK,WAAW;AACxD;AAOO,SAAS,eACd,WACA,SACuB;AACvB,QAAM,eAAe,IAAI;AAAA,IACvB;AAAA,IACA;AAAA,EACF;AAEA,aAAW,CAAC,SAAS,UAAU,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC3D,QAAI,mBAAmB,cAAc,OAAO,GAAG;AAC7C,YAAM,IAAI;AAAA,QACR,gBAAgB,OAAO;AAAA,MACzB;AAAA,IACF;AACA;AAAC,IAAC,aAAwC,OAAO,IAAI;AAAA,EACvD;AAEA,SAAO;AACT;AAMO,SAAS,sBACX,QACY;AACf,QAAM,SAAwB;AAAA,IAC5B,GAAG;AAAA,IACH,QAAQ,CAAC;AAAA,EACX;AAEA,aAAW,MAAM,QAAQ;AACvB,UAAM,WAAW,GAAG,MAAM;AAI1B,QAAI,OAAO,OAAO,OAAO,QAAQ,SAAS,SAAS,GAAG;AACpD,YAAM,IAAI;AAAA,QACR,mCAAmC,SAAS,SAAS;AAAA,MACvD;AAAA,IACF;AACA,WAAO,OAAO,SAAS,SAAS,IAAI,SAAS;AAAA,EAC/C;AAEA,SAAO;AACT;;;ACpDO,IAAM,QAAQ;AAAA;AAAA,EAEnB,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,OAAO;AAAA,EACnE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA,EAC1E,eAAe,CAAC,SACd,IAAI,6BAA6B,MAAM,eAAe;AAAA,EACxD,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,WAAW;AAAA;AAAA,EAGjD,UAAU,CAAC,SAAiB,IAAI,wBAAwB,MAAM,QAAQ;AAAA,EACtE,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,WAAW;AAAA,EACjD,gBAAgB,CAAC,SACf,IAAI,8BAA8B,MAAM,gBAAgB;AAAA,EAC1D,aAAa,CAAC,SACZ,IAAI,2BAA2B,MAAM,YAAY;AAAA;AAAA;AAAA,EAInD,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,MAAM;AAAA,EAChE,UAAU,CAAC,SAAiB,IAAI,wBAAwB,MAAM,SAAS;AAAA,EACvE,cAAc,CAAC,SACb,IAAI,4BAA4B,MAAM,cAAc;AAAA,EACtD,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA;AAAA,EAG1E,MAAM,CAAC,SAAiB,IAAI,oBAAoB,MAAM,IAAI;AAAA,EAC1D,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,OAAO;AAAA,EACjE,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,YAAY;AAAA,EAClD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,QAAQ;AAAA;AAAA,EAGpE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,SAAS;AAAA,EACzE,aAAa,CAAC,SACZ,IAAI,2BAA2B,MAAM,YAAY;AAAA,EACnD,iBAAiB,CAAC,SAChB,IAAI,+BAA+B,MAAM,iBAAiB;AAAA,EAC5D,cAAc,CAAC,SACb,IAAI,4BAA4B,MAAM,aAAa;AAAA;AAAA,EAGrD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,OAAO;AAAA,EACnE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA,EAC1E,eAAe,CAAC,SACd,IAAI,6BAA6B,MAAM,eAAe;AAAA,EACxD,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,WAAW;AAAA;AAAA,EAGjD,MAAM,CAAC,SAAiB,IAAI,oBAAoB,MAAM,IAAI;AAAA,EAC1D,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,OAAO;AAAA,EACjE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA,EAC1E,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,YAAY;AAAA,EAClD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,QAAQ;AAAA,EACpE,YAAY,CAAC,SAAiB,IAAI,0BAA0B,IAAI;AAAA;AAAA,EAGhE,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,OAAO;AAAA;AAAA,EAGnE,MAAM,CAAC,SAAiB,IAAI,oBAAoB,MAAM,IAAI;AAAA,EAC1D,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,OAAO;AAAA,EACjE,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,YAAY;AAAA,EAClD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,QAAQ;AAAA;AAAA,EAGpE,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,MAAM;AAAA,EAChE,UAAU,CAAC,SAAiB,IAAI,wBAAwB,MAAM,SAAS;AAAA,EACvE,cAAc,CAAC,SACb,IAAI,4BAA4B,MAAM,cAAc;AAAA,EACtD,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA;AAAA,EAG1E,MAAM,CAAC,SAAiB,IAAI,oBAAoB,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAMtD;","names":[]}

package/dist/eql/v3/index.d.cts

@@ -1,15 +1,112 @@
-import { m as EncryptedIntegerColumn, n as EncryptedIntegerEqColumn, p as EncryptedIntegerOrdOreColumn, o as EncryptedIntegerOrdColumn, y as EncryptedSmallintColumn, z as EncryptedSmallintEqColumn, D as EncryptedSmallintOrdOreColumn, B as EncryptedSmallintOrdColumn, e as EncryptedDateColumn, f as EncryptedDateEqColumn, h as EncryptedDateOrdOreColumn, g as EncryptedDateOrdColumn, M as EncryptedTimestampColumn, N as EncryptedTimestampEqColumn, R as EncryptedTimestampOrdOreColumn, O as EncryptedTimestampOrdColumn, q as EncryptedNumericColumn, r as EncryptedNumericEqColumn, t as EncryptedNumericOrdOreColumn, s as EncryptedNumericOrdColumn, G as EncryptedTextColumn, H as EncryptedTextEqColumn, I as EncryptedTextMatchColumn, K as EncryptedTextOrdOreColumn, J as EncryptedTextOrdColumn, L as EncryptedTextSearchColumn, E as EncryptedBooleanColumn, u as EncryptedRealColumn, v as EncryptedRealEqColumn, x as EncryptedRealOrdOreColumn, w as EncryptedRealOrdColumn, i as EncryptedDoubleColumn, j as EncryptedDoubleEqColumn, l as EncryptedDoubleOrdOreColumn, k as EncryptedDoubleOrdColumn } from '../../table-DihEAlxG.cjs';
-export { d as AnyEncryptedV3Column, A as AnyV3Table, C as ColumnsOf, F as EncryptedTable, S as EncryptedV3TableColumn, T as EqlTypeForColumn, U as InferEncrypted, W as InferPlaintext, P as PlaintextForColumn, X as QueryCapabilities, a as QueryTypesForColumn, Q as QueryableColumnsOf, Y as TEXT_SEARCH_EQL_TYPE, c as V3DecryptedModel, b as V3EncryptedModel, V as V3ModelInput, Z as buildEncryptConfig, _ as encryptedTable } from '../../table-DihEAlxG.cjs';
-import '../../types-public-CpS5KjwX.cjs';
+import { R as EncryptedV3TableColumn, X as QueryTypesForColumn, V as PlaintextForColumn, m as EncryptedIntegerColumn, n as EncryptedIntegerEqColumn, p as EncryptedIntegerOrdOreColumn, o as EncryptedIntegerOrdColumn, z as EncryptedSmallintColumn, B as EncryptedSmallintEqColumn, F as EncryptedSmallintOrdOreColumn, C as EncryptedSmallintOrdColumn, E as EncryptedBigintColumn, a as EncryptedBigintEqColumn, c as EncryptedBigintOrdOreColumn, b as EncryptedBigintOrdColumn, e as EncryptedDateColumn, f as EncryptedDateEqColumn, h as EncryptedDateOrdOreColumn, g as EncryptedDateOrdColumn, M as EncryptedTimestampColumn, N as EncryptedTimestampEqColumn, P as EncryptedTimestampOrdOreColumn, O as EncryptedTimestampOrdColumn, r as EncryptedNumericColumn, s as EncryptedNumericEqColumn, u as EncryptedNumericOrdOreColumn, t as EncryptedNumericOrdColumn, G as EncryptedTextColumn, H as EncryptedTextEqColumn, I as EncryptedTextMatchColumn, K as EncryptedTextOrdOreColumn, J as EncryptedTextOrdColumn, L as EncryptedTextSearchColumn, d as EncryptedBooleanColumn, v as EncryptedRealColumn, w as EncryptedRealEqColumn, y as EncryptedRealOrdOreColumn, x as EncryptedRealOrdColumn, i as EncryptedDoubleColumn, j as EncryptedDoubleEqColumn, l as EncryptedDoubleOrdOreColumn, k as EncryptedDoubleOrdColumn, q as EncryptedJsonColumn } from '../../columns-Bxv7Oo9o.cjs';
+export { A as AnyEncryptedV3Column, S as EqlTypeForColumn, T as JsonDocument, U as JsonValue, W as QueryCapabilities, Y as TEXT_SEARCH_EQL_TYPE } from '../../columns-Bxv7Oo9o.cjs';
+import { k as ColumnSchema, p as Encrypted, E as EncryptConfig } from '../../types-public-QMjYNfQO.cjs';
 import '@cipherstash/protect-ffi';
 import 'zod';
 
+interface TableDefinition {
+    tableName: string;
+    columns: Record<string, ColumnSchema>;
+}
 /**
- * The v3 column-type namespace. Each member is a factory that builds a concrete
- * EQL v3 column; the member name mirrors the underlying `eql_v3.<name>` domain
- * (strip the `eql_v3.` prefix, PascalCase each `_`-separated segment). So
- * `types.TextEq('actor')` builds an `eql_v3.text_eq` column, `types.IntegerOrd`
- * an `eql_v3.integer_ord`, `types.Timestamp` an `eql_v3.timestamp`, and so on.
+ * A v3 encrypted table. Mirrors the v2 `EncryptedTable` but only accepts v3
+ * column builders. Emits the same `{ tableName, columns }` definition shape.
+ */
+declare class EncryptedTable<T extends EncryptedV3TableColumn> {
+    readonly tableName: string;
+    readonly columnBuilders: T;
+    /** @internal Type-level brand so TypeScript can infer `T` from `EncryptedTable<T>`. */
+    readonly _columnType: T;
+    constructor(tableName: string, columnBuilders: T);
+    build(): TableDefinition;
+    /**
+     * Map each column's JS property name to its DB column name (`getName()`).
+     * The model path matches user models by property name but must address the
+     * encrypt config and FFI by DB name — `build()` keys columns by DB name, so
+     * the two only agree when property == name. This recovers the mapping that
+     * `build()` discards.
+     *
+     * NULL PROTOTYPE — load-bearing. Callers index this map by a column name that
+     * ultimately comes from the database (`addJsonbCastsV3`, `filterColumnName`,
+     * the mutation transform). On a plain object literal, a column named
+     * `constructor` / `toString` / `valueOf` / `__proto__` resolves to an
+     * inherited `Object.prototype` member, which is truthy — so a *plaintext*
+     * column with such a name would be mistaken for a mapped encrypted column and
+     * its `Object.prototype` value interpolated into the emitted select string.
+     * `encryptedTable()` rejects such names as JS *properties*, but nothing
+     * constrains the DB column names a table may contain.
+     */
+    buildColumnKeyMap(): Record<string, string>;
+}
+/**
+ * Define a v3 encrypted table. Intentionally shadows the v2 `encryptedTable`
+ * name but lives on the `/eql/v3` subpath — the importer picks the model by
+ * import path. The returned object is also a column accessor (`users.email`).
+ */
+declare function encryptedTable<T extends EncryptedV3TableColumn>(tableName: string, columns: T): EncryptedTable<T> & T;
+/**
+ * Build an `EncryptConfig` (`v: 1`) from one or more v3 tables. Emits the same
+ * shape as v2's `buildEncryptConfig`.
+ */
+declare function buildEncryptConfig(...tables: Array<EncryptedTable<EncryptedV3TableColumn>>): EncryptConfig;
+/**
+ * Infer the plaintext (decrypted) shape from a v3 table schema. Each column maps
+ * to the TypeScript type of its domain's `castAs` kind.
+ */
+type InferPlaintext<T extends EncryptedTable<EncryptedV3TableColumn>> = T extends EncryptedTable<infer C> ? {
+    [K in keyof C]: PlaintextForColumn<C[K]>;
+} : never;
+/**
+ * Infer the encrypted shape from a v3 table schema. See {@link InferPlaintext}
+ * for why no key-remap filter is needed in the flat single-type model.
+ */
+type InferEncrypted<T extends EncryptedTable<EncryptedV3TableColumn>> = T extends EncryptedTable<infer C> ? {
+    [K in keyof C]: Encrypted;
+} : never;
+/** Any v3 table, regardless of its column map. */
+type AnyV3Table = EncryptedTable<EncryptedV3TableColumn>;
+/** Union of the concrete column builders declared on a v3 table. */
+type ColumnsOf<T extends AnyV3Table> = T extends EncryptedTable<infer C> ? C[keyof C] : never;
+/**
+ * Union of the *queryable* column builders on a v3 table. Storage-only columns
+ * (whose {@link QueryTypesForColumn} is `never`) are filtered out, so they can't
+ * be passed to a query method.
+ */
+type QueryableColumnsOf<T extends AnyV3Table> = T extends EncryptedTable<infer C> ? {
+    [K in keyof C]: [QueryTypesForColumn<C[K]>] extends [never] ? never : C[K];
+}[keyof C] : never;
+/**
+ * The accepted input model for {@link import('@/encryption/v3').TypedEncryptionClient.encryptModel}.
+ * `T` is inferred from the argument: keys that name a schema column are pinned to
+ * the column's plaintext type (nullable if the field is nullable), so a wrong-typed
+ * field fails assignability; all other keys pass through unchanged.
+ */
+type V3ModelInput<Table extends AnyV3Table, T> = {
+    [K in keyof T]: K extends keyof InferPlaintext<Table> ? null extends T[K] ? InferPlaintext<Table>[K] | null : InferPlaintext<Table>[K] : T[K];
+};
+/** The encrypted result model: schema columns become `Encrypted`, others pass through. */
+type V3EncryptedModel<Table extends AnyV3Table, T> = {
+    [K in keyof T]: K extends keyof InferPlaintext<Table> ? null extends T[K] ? Encrypted | null : Encrypted : T[K];
+};
+/**
+ * The decrypted result model: schema columns become their plaintext type, others
+ * pass through. Structurally identical to {@link V3ModelInput} — decrypt yields
+ * the same plaintext shape encrypt accepts — so it is aliased rather than
+ * re-declared to keep the input and output shapes from silently drifting when
+ * one copy is edited. The distinct name is kept for call-site readability.
+ */
+type V3DecryptedModel<Table extends AnyV3Table, T> = V3ModelInput<Table, T>;
+
+/**
+ * The v3 column-type namespace. Each member is a public, semantic factory name
+ * for a concrete EQL v3 column. Most members mirror the underlying domain name;
+ * JS-friendly scalar names map to Postgres concrete domains, e.g.
+ * `types.IntegerOrd` builds a `public.eql_v3_integer_ord` column and `types.Boolean`
+ * builds a `public.eql_v3_boolean` column.
+ *
+ * If these factory names stop matching the emitted capability/domain surface,
+ * the stack package is out of sync with the underlying EQL build. That is a
+ * version mismatch, not a harmless naming drift.
  *
  * Each factory returns the CONCRETE column class instance (never the widened
  * `AnyEncryptedV3Column`) so per-column plaintext / query-capability inference
@@ -25,10 +122,10 @@ import 'zod';
  * })
  * ```
  *
- * `types.TextSearch` keeps the chainable `.freeTextSearch(opts)` tuner (the
- * only capability-bearing chain — every other domain is fully described by its
- * type). bigint domains are intentionally absent pending lossless FFI
- * round-tripping (see ./columns).
+ * `types.TextSearch` is fully described by its type — like every other domain,
+ * it has no capability-bearing or tuning chain. Its match index is always
+ * emitted with the default configuration; run a free-text query by passing
+ * `queryType: 'freeTextSearch'` to `encryptQuery`.
  */
 declare const types: {
     readonly Integer: (name: string) => EncryptedIntegerColumn;
@@ -39,6 +136,10 @@ declare const types: {
     readonly SmallintEq: (name: string) => EncryptedSmallintEqColumn;
     readonly SmallintOrdOre: (name: string) => EncryptedSmallintOrdOreColumn;
     readonly SmallintOrd: (name: string) => EncryptedSmallintOrdColumn;
+    readonly Bigint: (name: string) => EncryptedBigintColumn;
+    readonly BigintEq: (name: string) => EncryptedBigintEqColumn;
+    readonly BigintOrdOre: (name: string) => EncryptedBigintOrdOreColumn;
+    readonly BigintOrd: (name: string) => EncryptedBigintOrdColumn;
     readonly Date: (name: string) => EncryptedDateColumn;
     readonly DateEq: (name: string) => EncryptedDateEqColumn;
     readonly DateOrdOre: (name: string) => EncryptedDateOrdOreColumn;
@@ -66,6 +167,7 @@ declare const types: {
     readonly DoubleEq: (name: string) => EncryptedDoubleEqColumn;
     readonly DoubleOrdOre: (name: string) => EncryptedDoubleOrdOreColumn;
     readonly DoubleOrd: (name: string) => EncryptedDoubleOrdColumn;
+    readonly Json: (name: string) => EncryptedJsonColumn;
 };
 
-export { EncryptedBooleanColumn, EncryptedDateColumn, EncryptedDateEqColumn, EncryptedDateOrdColumn, EncryptedDateOrdOreColumn, EncryptedDoubleColumn, EncryptedDoubleEqColumn, EncryptedDoubleOrdColumn, EncryptedDoubleOrdOreColumn, EncryptedIntegerColumn, EncryptedIntegerEqColumn, EncryptedIntegerOrdColumn, EncryptedIntegerOrdOreColumn, EncryptedNumericColumn, EncryptedNumericEqColumn, EncryptedNumericOrdColumn, EncryptedNumericOrdOreColumn, EncryptedRealColumn, EncryptedRealEqColumn, EncryptedRealOrdColumn, EncryptedRealOrdOreColumn, EncryptedSmallintColumn, EncryptedSmallintEqColumn, EncryptedSmallintOrdColumn, EncryptedSmallintOrdOreColumn, EncryptedTextColumn, EncryptedTextEqColumn, EncryptedTextMatchColumn, EncryptedTextOrdColumn, EncryptedTextOrdOreColumn, EncryptedTextSearchColumn, EncryptedTimestampColumn, EncryptedTimestampEqColumn, EncryptedTimestampOrdColumn, EncryptedTimestampOrdOreColumn, types };
+export { type AnyV3Table, type ColumnsOf, EncryptedBigintColumn, EncryptedBigintEqColumn, EncryptedBigintOrdColumn, EncryptedBigintOrdOreColumn, EncryptedBooleanColumn, EncryptedDateColumn, EncryptedDateEqColumn, EncryptedDateOrdColumn, EncryptedDateOrdOreColumn, EncryptedDoubleColumn, EncryptedDoubleEqColumn, EncryptedDoubleOrdColumn, EncryptedDoubleOrdOreColumn, EncryptedIntegerColumn, EncryptedIntegerEqColumn, EncryptedIntegerOrdColumn, EncryptedIntegerOrdOreColumn, EncryptedJsonColumn, EncryptedNumericColumn, EncryptedNumericEqColumn, EncryptedNumericOrdColumn, EncryptedNumericOrdOreColumn, EncryptedRealColumn, EncryptedRealEqColumn, EncryptedRealOrdColumn, EncryptedRealOrdOreColumn, EncryptedSmallintColumn, EncryptedSmallintEqColumn, EncryptedSmallintOrdColumn, EncryptedSmallintOrdOreColumn, EncryptedTable, EncryptedTextColumn, EncryptedTextEqColumn, EncryptedTextMatchColumn, EncryptedTextOrdColumn, EncryptedTextOrdOreColumn, EncryptedTextSearchColumn, EncryptedTimestampColumn, EncryptedTimestampEqColumn, EncryptedTimestampOrdColumn, EncryptedTimestampOrdOreColumn, EncryptedV3TableColumn, type InferEncrypted, type InferPlaintext, PlaintextForColumn, QueryTypesForColumn, type QueryableColumnsOf, type V3DecryptedModel, type V3EncryptedModel, type V3ModelInput, buildEncryptConfig, encryptedTable, types };

package/dist/eql/v3/index.d.ts

@@ -1,15 +1,112 @@
-import { m as EncryptedIntegerColumn, n as EncryptedIntegerEqColumn, p as EncryptedIntegerOrdOreColumn, o as EncryptedIntegerOrdColumn, y as EncryptedSmallintColumn, z as EncryptedSmallintEqColumn, D as EncryptedSmallintOrdOreColumn, B as EncryptedSmallintOrdColumn, e as EncryptedDateColumn, f as EncryptedDateEqColumn, h as EncryptedDateOrdOreColumn, g as EncryptedDateOrdColumn, M as EncryptedTimestampColumn, N as EncryptedTimestampEqColumn, R as EncryptedTimestampOrdOreColumn, O as EncryptedTimestampOrdColumn, q as EncryptedNumericColumn, r as EncryptedNumericEqColumn, t as EncryptedNumericOrdOreColumn, s as EncryptedNumericOrdColumn, G as EncryptedTextColumn, H as EncryptedTextEqColumn, I as EncryptedTextMatchColumn, K as EncryptedTextOrdOreColumn, J as EncryptedTextOrdColumn, L as EncryptedTextSearchColumn, E as EncryptedBooleanColumn, u as EncryptedRealColumn, v as EncryptedRealEqColumn, x as EncryptedRealOrdOreColumn, w as EncryptedRealOrdColumn, i as EncryptedDoubleColumn, j as EncryptedDoubleEqColumn, l as EncryptedDoubleOrdOreColumn, k as EncryptedDoubleOrdColumn } from '../../table-CIH7jZ2h.js';
-export { d as AnyEncryptedV3Column, A as AnyV3Table, C as ColumnsOf, F as EncryptedTable, S as EncryptedV3TableColumn, T as EqlTypeForColumn, U as InferEncrypted, W as InferPlaintext, P as PlaintextForColumn, X as QueryCapabilities, a as QueryTypesForColumn, Q as QueryableColumnsOf, Y as TEXT_SEARCH_EQL_TYPE, c as V3DecryptedModel, b as V3EncryptedModel, V as V3ModelInput, Z as buildEncryptConfig, _ as encryptedTable } from '../../table-CIH7jZ2h.js';
-import '../../types-public-CpS5KjwX.js';
+import { R as EncryptedV3TableColumn, X as QueryTypesForColumn, V as PlaintextForColumn, m as EncryptedIntegerColumn, n as EncryptedIntegerEqColumn, p as EncryptedIntegerOrdOreColumn, o as EncryptedIntegerOrdColumn, z as EncryptedSmallintColumn, B as EncryptedSmallintEqColumn, F as EncryptedSmallintOrdOreColumn, C as EncryptedSmallintOrdColumn, E as EncryptedBigintColumn, a as EncryptedBigintEqColumn, c as EncryptedBigintOrdOreColumn, b as EncryptedBigintOrdColumn, e as EncryptedDateColumn, f as EncryptedDateEqColumn, h as EncryptedDateOrdOreColumn, g as EncryptedDateOrdColumn, M as EncryptedTimestampColumn, N as EncryptedTimestampEqColumn, P as EncryptedTimestampOrdOreColumn, O as EncryptedTimestampOrdColumn, r as EncryptedNumericColumn, s as EncryptedNumericEqColumn, u as EncryptedNumericOrdOreColumn, t as EncryptedNumericOrdColumn, G as EncryptedTextColumn, H as EncryptedTextEqColumn, I as EncryptedTextMatchColumn, K as EncryptedTextOrdOreColumn, J as EncryptedTextOrdColumn, L as EncryptedTextSearchColumn, d as EncryptedBooleanColumn, v as EncryptedRealColumn, w as EncryptedRealEqColumn, y as EncryptedRealOrdOreColumn, x as EncryptedRealOrdColumn, i as EncryptedDoubleColumn, j as EncryptedDoubleEqColumn, l as EncryptedDoubleOrdOreColumn, k as EncryptedDoubleOrdColumn, q as EncryptedJsonColumn } from '../../columns-0lbT9stl.js';
+export { A as AnyEncryptedV3Column, S as EqlTypeForColumn, T as JsonDocument, U as JsonValue, W as QueryCapabilities, Y as TEXT_SEARCH_EQL_TYPE } from '../../columns-0lbT9stl.js';
+import { k as ColumnSchema, p as Encrypted, E as EncryptConfig } from '../../types-public-QMjYNfQO.js';
 import '@cipherstash/protect-ffi';
 import 'zod';
 
+interface TableDefinition {
+    tableName: string;
+    columns: Record<string, ColumnSchema>;
+}
 /**
- * The v3 column-type namespace. Each member is a factory that builds a concrete
- * EQL v3 column; the member name mirrors the underlying `eql_v3.<name>` domain
- * (strip the `eql_v3.` prefix, PascalCase each `_`-separated segment). So
- * `types.TextEq('actor')` builds an `eql_v3.text_eq` column, `types.IntegerOrd`
- * an `eql_v3.integer_ord`, `types.Timestamp` an `eql_v3.timestamp`, and so on.
+ * A v3 encrypted table. Mirrors the v2 `EncryptedTable` but only accepts v3
+ * column builders. Emits the same `{ tableName, columns }` definition shape.
+ */
+declare class EncryptedTable<T extends EncryptedV3TableColumn> {
+    readonly tableName: string;
+    readonly columnBuilders: T;
+    /** @internal Type-level brand so TypeScript can infer `T` from `EncryptedTable<T>`. */
+    readonly _columnType: T;
+    constructor(tableName: string, columnBuilders: T);
+    build(): TableDefinition;
+    /**
+     * Map each column's JS property name to its DB column name (`getName()`).
+     * The model path matches user models by property name but must address the
+     * encrypt config and FFI by DB name — `build()` keys columns by DB name, so
+     * the two only agree when property == name. This recovers the mapping that
+     * `build()` discards.
+     *
+     * NULL PROTOTYPE — load-bearing. Callers index this map by a column name that
+     * ultimately comes from the database (`addJsonbCastsV3`, `filterColumnName`,
+     * the mutation transform). On a plain object literal, a column named
+     * `constructor` / `toString` / `valueOf` / `__proto__` resolves to an
+     * inherited `Object.prototype` member, which is truthy — so a *plaintext*
+     * column with such a name would be mistaken for a mapped encrypted column and
+     * its `Object.prototype` value interpolated into the emitted select string.
+     * `encryptedTable()` rejects such names as JS *properties*, but nothing
+     * constrains the DB column names a table may contain.
+     */
+    buildColumnKeyMap(): Record<string, string>;
+}
+/**
+ * Define a v3 encrypted table. Intentionally shadows the v2 `encryptedTable`
+ * name but lives on the `/eql/v3` subpath — the importer picks the model by
+ * import path. The returned object is also a column accessor (`users.email`).
+ */
+declare function encryptedTable<T extends EncryptedV3TableColumn>(tableName: string, columns: T): EncryptedTable<T> & T;
+/**
+ * Build an `EncryptConfig` (`v: 1`) from one or more v3 tables. Emits the same
+ * shape as v2's `buildEncryptConfig`.
+ */
+declare function buildEncryptConfig(...tables: Array<EncryptedTable<EncryptedV3TableColumn>>): EncryptConfig;
+/**
+ * Infer the plaintext (decrypted) shape from a v3 table schema. Each column maps
+ * to the TypeScript type of its domain's `castAs` kind.
+ */
+type InferPlaintext<T extends EncryptedTable<EncryptedV3TableColumn>> = T extends EncryptedTable<infer C> ? {
+    [K in keyof C]: PlaintextForColumn<C[K]>;
+} : never;
+/**
+ * Infer the encrypted shape from a v3 table schema. See {@link InferPlaintext}
+ * for why no key-remap filter is needed in the flat single-type model.
+ */
+type InferEncrypted<T extends EncryptedTable<EncryptedV3TableColumn>> = T extends EncryptedTable<infer C> ? {
+    [K in keyof C]: Encrypted;
+} : never;
+/** Any v3 table, regardless of its column map. */
+type AnyV3Table = EncryptedTable<EncryptedV3TableColumn>;
+/** Union of the concrete column builders declared on a v3 table. */
+type ColumnsOf<T extends AnyV3Table> = T extends EncryptedTable<infer C> ? C[keyof C] : never;
+/**
+ * Union of the *queryable* column builders on a v3 table. Storage-only columns
+ * (whose {@link QueryTypesForColumn} is `never`) are filtered out, so they can't
+ * be passed to a query method.
+ */
+type QueryableColumnsOf<T extends AnyV3Table> = T extends EncryptedTable<infer C> ? {
+    [K in keyof C]: [QueryTypesForColumn<C[K]>] extends [never] ? never : C[K];
+}[keyof C] : never;
+/**
+ * The accepted input model for {@link import('@/encryption/v3').TypedEncryptionClient.encryptModel}.
+ * `T` is inferred from the argument: keys that name a schema column are pinned to
+ * the column's plaintext type (nullable if the field is nullable), so a wrong-typed
+ * field fails assignability; all other keys pass through unchanged.
+ */
+type V3ModelInput<Table extends AnyV3Table, T> = {
+    [K in keyof T]: K extends keyof InferPlaintext<Table> ? null extends T[K] ? InferPlaintext<Table>[K] | null : InferPlaintext<Table>[K] : T[K];
+};
+/** The encrypted result model: schema columns become `Encrypted`, others pass through. */
+type V3EncryptedModel<Table extends AnyV3Table, T> = {
+    [K in keyof T]: K extends keyof InferPlaintext<Table> ? null extends T[K] ? Encrypted | null : Encrypted : T[K];
+};
+/**
+ * The decrypted result model: schema columns become their plaintext type, others
+ * pass through. Structurally identical to {@link V3ModelInput} — decrypt yields
+ * the same plaintext shape encrypt accepts — so it is aliased rather than
+ * re-declared to keep the input and output shapes from silently drifting when
+ * one copy is edited. The distinct name is kept for call-site readability.
+ */
+type V3DecryptedModel<Table extends AnyV3Table, T> = V3ModelInput<Table, T>;
+
+/**
+ * The v3 column-type namespace. Each member is a public, semantic factory name
+ * for a concrete EQL v3 column. Most members mirror the underlying domain name;
+ * JS-friendly scalar names map to Postgres concrete domains, e.g.
+ * `types.IntegerOrd` builds a `public.eql_v3_integer_ord` column and `types.Boolean`
+ * builds a `public.eql_v3_boolean` column.
+ *
+ * If these factory names stop matching the emitted capability/domain surface,
+ * the stack package is out of sync with the underlying EQL build. That is a
+ * version mismatch, not a harmless naming drift.
  *
  * Each factory returns the CONCRETE column class instance (never the widened
  * `AnyEncryptedV3Column`) so per-column plaintext / query-capability inference
@@ -25,10 +122,10 @@ import 'zod';
  * })
  * ```
  *
- * `types.TextSearch` keeps the chainable `.freeTextSearch(opts)` tuner (the
- * only capability-bearing chain — every other domain is fully described by its
- * type). bigint domains are intentionally absent pending lossless FFI
- * round-tripping (see ./columns).
+ * `types.TextSearch` is fully described by its type — like every other domain,
+ * it has no capability-bearing or tuning chain. Its match index is always
+ * emitted with the default configuration; run a free-text query by passing
+ * `queryType: 'freeTextSearch'` to `encryptQuery`.
  */
 declare const types: {
     readonly Integer: (name: string) => EncryptedIntegerColumn;
@@ -39,6 +136,10 @@ declare const types: {
     readonly SmallintEq: (name: string) => EncryptedSmallintEqColumn;
     readonly SmallintOrdOre: (name: string) => EncryptedSmallintOrdOreColumn;
     readonly SmallintOrd: (name: string) => EncryptedSmallintOrdColumn;
+    readonly Bigint: (name: string) => EncryptedBigintColumn;
+    readonly BigintEq: (name: string) => EncryptedBigintEqColumn;
+    readonly BigintOrdOre: (name: string) => EncryptedBigintOrdOreColumn;
+    readonly BigintOrd: (name: string) => EncryptedBigintOrdColumn;
     readonly Date: (name: string) => EncryptedDateColumn;
     readonly DateEq: (name: string) => EncryptedDateEqColumn;
     readonly DateOrdOre: (name: string) => EncryptedDateOrdOreColumn;
@@ -66,6 +167,7 @@ declare const types: {
     readonly DoubleEq: (name: string) => EncryptedDoubleEqColumn;
     readonly DoubleOrdOre: (name: string) => EncryptedDoubleOrdOreColumn;
     readonly DoubleOrd: (name: string) => EncryptedDoubleOrdColumn;
+    readonly Json: (name: string) => EncryptedJsonColumn;
 };
 
-export { EncryptedBooleanColumn, EncryptedDateColumn, EncryptedDateEqColumn, EncryptedDateOrdColumn, EncryptedDateOrdOreColumn, EncryptedDoubleColumn, EncryptedDoubleEqColumn, EncryptedDoubleOrdColumn, EncryptedDoubleOrdOreColumn, EncryptedIntegerColumn, EncryptedIntegerEqColumn, EncryptedIntegerOrdColumn, EncryptedIntegerOrdOreColumn, EncryptedNumericColumn, EncryptedNumericEqColumn, EncryptedNumericOrdColumn, EncryptedNumericOrdOreColumn, EncryptedRealColumn, EncryptedRealEqColumn, EncryptedRealOrdColumn, EncryptedRealOrdOreColumn, EncryptedSmallintColumn, EncryptedSmallintEqColumn, EncryptedSmallintOrdColumn, EncryptedSmallintOrdOreColumn, EncryptedTextColumn, EncryptedTextEqColumn, EncryptedTextMatchColumn, EncryptedTextOrdColumn, EncryptedTextOrdOreColumn, EncryptedTextSearchColumn, EncryptedTimestampColumn, EncryptedTimestampEqColumn, EncryptedTimestampOrdColumn, EncryptedTimestampOrdOreColumn, types };
+export { type AnyV3Table, type ColumnsOf, EncryptedBigintColumn, EncryptedBigintEqColumn, EncryptedBigintOrdColumn, EncryptedBigintOrdOreColumn, EncryptedBooleanColumn, EncryptedDateColumn, EncryptedDateEqColumn, EncryptedDateOrdColumn, EncryptedDateOrdOreColumn, EncryptedDoubleColumn, EncryptedDoubleEqColumn, EncryptedDoubleOrdColumn, EncryptedDoubleOrdOreColumn, EncryptedIntegerColumn, EncryptedIntegerEqColumn, EncryptedIntegerOrdColumn, EncryptedIntegerOrdOreColumn, EncryptedJsonColumn, EncryptedNumericColumn, EncryptedNumericEqColumn, EncryptedNumericOrdColumn, EncryptedNumericOrdOreColumn, EncryptedRealColumn, EncryptedRealEqColumn, EncryptedRealOrdColumn, EncryptedRealOrdOreColumn, EncryptedSmallintColumn, EncryptedSmallintEqColumn, EncryptedSmallintOrdColumn, EncryptedSmallintOrdOreColumn, EncryptedTable, EncryptedTextColumn, EncryptedTextEqColumn, EncryptedTextMatchColumn, EncryptedTextOrdColumn, EncryptedTextOrdOreColumn, EncryptedTextSearchColumn, EncryptedTimestampColumn, EncryptedTimestampEqColumn, EncryptedTimestampOrdColumn, EncryptedTimestampOrdOreColumn, EncryptedV3TableColumn, type InferEncrypted, type InferPlaintext, PlaintextForColumn, QueryTypesForColumn, type QueryableColumnsOf, type V3DecryptedModel, type V3EncryptedModel, type V3ModelInput, buildEncryptConfig, encryptedTable, types };