@cipherstash/stack 0.19.0 → 1.0.0-rc.1

package/dist/adapter-kit.cjs

@@ -0,0 +1,1002 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/adapter-kit.ts
+var adapter_kit_exports = {};
+__export(adapter_kit_exports, {
+  DATE_LIKE_CASTS: () => DATE_LIKE_CASTS,
+  DOMAIN_REGISTRY: () => DOMAIN_REGISTRY,
+  EncryptedV3Column: () => EncryptedV3Column,
+  bulkModelsToEncryptedPgComposites: () => bulkModelsToEncryptedPgComposites,
+  factoryForDomain: () => factoryForDomain,
+  jsonPathOf: () => jsonPathOf,
+  logger: () => logger,
+  matchNeedleError: () => matchNeedleError,
+  modelToEncryptedPgComposites: () => modelToEncryptedPgComposites,
+  parseSelectorSegments: () => parseSelectorSegments,
+  reconstructSelectorDocument: () => reconstructSelectorDocument,
+  stripDomainSchema: () => stripDomainSchema,
+  unsupportedLeafReason: () => unsupportedLeafReason
+});
+module.exports = __toCommonJS(adapter_kit_exports);
+
+// src/encryption/helpers/index.ts
+function encryptedToPgComposite(obj) {
+  return {
+    data: obj
+  };
+}
+function modelToEncryptedPgComposites(model) {
+  const result = {};
+  for (const [key, value] of Object.entries(model)) {
+    if (isEncryptedPayload(value)) {
+      result[key] = encryptedToPgComposite(value);
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+function bulkModelsToEncryptedPgComposites(models) {
+  return models.map((model) => modelToEncryptedPgComposites(model));
+}
+function isEncryptedPayload(value) {
+  if (value === null) return false;
+  if (typeof value !== "object") return false;
+  const obj = value;
+  if (!("v" in obj) || typeof obj.v !== "number") return false;
+  if (!("i" in obj) || typeof obj.i !== "object") return false;
+  if (!("c" in obj) && !("sv" in obj)) return false;
+  return true;
+}
+
+// src/schema/match-defaults.ts
+function defaultMatchOpts() {
+  return {
+    tokenizer: { kind: "ngram", token_length: 3 },
+    token_filters: [{ kind: "downcase" }],
+    k: 6,
+    m: 2048,
+    include_original: true
+  };
+}
+function matchNeedleMinLength(opts) {
+  const tokenizer = opts.tokenizer ?? defaultMatchOpts().tokenizer;
+  return tokenizer.kind === "ngram" ? tokenizer.token_length : void 0;
+}
+function matchNeedleError(needle, opts) {
+  if (typeof needle !== "string") return void 0;
+  const length = [...needle].length;
+  const min = matchNeedleMinLength(opts);
+  if (length === 0) {
+    return `free-text search needs a non-empty search term; an empty term produces no tokens and would match every row.`;
+  }
+  if (min === void 0 || length >= min) return void 0;
+  return `free-text search needs at least ${min} characters (the index tokenizer's token_length), but the search term ${JSON.stringify(needle)} has ${length}. A shorter term produces no tokens and would match every row.`;
+}
+
+// src/eql/v3/columns.ts
+var DATE_LIKE_CASTS = ["date", "timestamp"];
+var STORAGE_ONLY = {
+  equality: false,
+  orderAndRange: false,
+  freeTextSearch: false
+};
+var EQUALITY_ONLY = {
+  equality: true,
+  orderAndRange: false,
+  freeTextSearch: false
+};
+var ORDER_AND_RANGE = {
+  equality: true,
+  orderAndRange: true,
+  freeTextSearch: false
+};
+var MATCH_ONLY = {
+  equality: false,
+  orderAndRange: false,
+  freeTextSearch: true
+};
+var TEXT_SEARCH = {
+  equality: true,
+  orderAndRange: true,
+  freeTextSearch: true
+};
+var TEXT_SEARCH_EQL_TYPE = "public.eql_v3_text_search";
+var INTEGER = {
+  eqlType: "public.eql_v3_integer",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var INTEGER_EQ = {
+  eqlType: "public.eql_v3_integer_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var INTEGER_ORD_ORE = {
+  eqlType: "public.eql_v3_integer_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var INTEGER_ORD = {
+  eqlType: "public.eql_v3_integer_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var SMALLINT = {
+  eqlType: "public.eql_v3_smallint",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var SMALLINT_EQ = {
+  eqlType: "public.eql_v3_smallint_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var SMALLINT_ORD_ORE = {
+  eqlType: "public.eql_v3_smallint_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var SMALLINT_ORD = {
+  eqlType: "public.eql_v3_smallint_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var BIGINT = {
+  eqlType: "public.eql_v3_bigint",
+  castAs: "bigint",
+  capabilities: STORAGE_ONLY
+};
+var BIGINT_EQ = {
+  eqlType: "public.eql_v3_bigint_eq",
+  castAs: "bigint",
+  capabilities: EQUALITY_ONLY
+};
+var BIGINT_ORD_ORE = {
+  eqlType: "public.eql_v3_bigint_ord_ore",
+  castAs: "bigint",
+  capabilities: ORDER_AND_RANGE
+};
+var BIGINT_ORD = {
+  eqlType: "public.eql_v3_bigint_ord",
+  castAs: "bigint",
+  capabilities: ORDER_AND_RANGE
+};
+var DATE = {
+  eqlType: "public.eql_v3_date",
+  castAs: "date",
+  capabilities: STORAGE_ONLY
+};
+var DATE_EQ = {
+  eqlType: "public.eql_v3_date_eq",
+  castAs: "date",
+  capabilities: EQUALITY_ONLY
+};
+var DATE_ORD_ORE = {
+  eqlType: "public.eql_v3_date_ord_ore",
+  castAs: "date",
+  capabilities: ORDER_AND_RANGE
+};
+var DATE_ORD = {
+  eqlType: "public.eql_v3_date_ord",
+  castAs: "date",
+  capabilities: ORDER_AND_RANGE
+};
+var TIMESTAMP = {
+  eqlType: "public.eql_v3_timestamp",
+  castAs: "timestamp",
+  capabilities: STORAGE_ONLY
+};
+var TIMESTAMP_EQ = {
+  eqlType: "public.eql_v3_timestamp_eq",
+  castAs: "timestamp",
+  capabilities: EQUALITY_ONLY
+};
+var TIMESTAMP_ORD_ORE = {
+  eqlType: "public.eql_v3_timestamp_ord_ore",
+  castAs: "timestamp",
+  capabilities: ORDER_AND_RANGE
+};
+var TIMESTAMP_ORD = {
+  eqlType: "public.eql_v3_timestamp_ord",
+  castAs: "timestamp",
+  capabilities: ORDER_AND_RANGE
+};
+var NUMERIC = {
+  eqlType: "public.eql_v3_numeric",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var NUMERIC_EQ = {
+  eqlType: "public.eql_v3_numeric_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var NUMERIC_ORD_ORE = {
+  eqlType: "public.eql_v3_numeric_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var NUMERIC_ORD = {
+  eqlType: "public.eql_v3_numeric_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var TEXT = {
+  eqlType: "public.eql_v3_text",
+  castAs: "string",
+  capabilities: STORAGE_ONLY
+};
+var TEXT_EQ = {
+  eqlType: "public.eql_v3_text_eq",
+  castAs: "string",
+  capabilities: EQUALITY_ONLY
+};
+var TEXT_MATCH = {
+  eqlType: "public.eql_v3_text_match",
+  castAs: "string",
+  capabilities: MATCH_ONLY
+};
+var TEXT_ORD_ORE = {
+  eqlType: "public.eql_v3_text_ord_ore",
+  castAs: "string",
+  capabilities: ORDER_AND_RANGE
+};
+var TEXT_ORD = {
+  eqlType: "public.eql_v3_text_ord",
+  castAs: "string",
+  capabilities: ORDER_AND_RANGE
+};
+var BOOLEAN = {
+  eqlType: "public.eql_v3_boolean",
+  castAs: "boolean",
+  capabilities: STORAGE_ONLY
+};
+var REAL = {
+  eqlType: "public.eql_v3_real",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var REAL_EQ = {
+  eqlType: "public.eql_v3_real_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var REAL_ORD_ORE = {
+  eqlType: "public.eql_v3_real_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var REAL_ORD = {
+  eqlType: "public.eql_v3_real_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var DOUBLE = {
+  eqlType: "public.eql_v3_double",
+  castAs: "number",
+  capabilities: STORAGE_ONLY
+};
+var DOUBLE_EQ = {
+  eqlType: "public.eql_v3_double_eq",
+  castAs: "number",
+  capabilities: EQUALITY_ONLY
+};
+var DOUBLE_ORD_ORE = {
+  eqlType: "public.eql_v3_double_ord_ore",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+var DOUBLE_ORD = {
+  eqlType: "public.eql_v3_double_ord",
+  castAs: "number",
+  capabilities: ORDER_AND_RANGE
+};
+function indexesForCapabilities(capabilities, castAs, ordering) {
+  const indexes = {};
+  if (capabilities.equality && (!capabilities.orderAndRange || castAs === "string")) {
+    indexes.unique = { token_filters: [] };
+  }
+  if (capabilities.orderAndRange) {
+    indexes[ordering] = {};
+  }
+  if (capabilities.freeTextSearch) {
+    indexes.match = { ...defaultMatchOpts(), include_original: false };
+  }
+  if (capabilities.searchableJson) {
+    indexes.ste_vec = {
+      prefix: "enabled",
+      array_index_mode: { item: true, wildcard: true, position: false },
+      mode: "compat"
+    };
+  }
+  return indexes;
+}
+function orderingForEqlType(eqlType) {
+  return eqlType.endsWith("_ord_ore") ? "ore" : "ope";
+}
+function isQueryableCapabilities(capabilities) {
+  return capabilities.equality || capabilities.orderAndRange || capabilities.freeTextSearch || (capabilities.searchableJson ?? false);
+}
+var EncryptedV3Column = class {
+  constructor(columnName, definition) {
+    this.columnName = columnName;
+    this.definition = definition;
+  }
+  columnName;
+  definition;
+  getName() {
+    return this.columnName;
+  }
+  /** The concrete EQL v3 domain name. Metadata only; not emitted by `build()`. */
+  getEqlType() {
+    return this.definition.eqlType;
+  }
+  /** The semantic query capabilities this domain exposes. Metadata only. */
+  getQueryCapabilities() {
+    return this.definition.capabilities;
+  }
+  /** `true` when this domain can produce at least one kind of query term. */
+  isQueryable() {
+    return isQueryableCapabilities(
+      this.definition.capabilities
+    );
+  }
+  /** Emit the encrypt-config column: `cast_as` plus capability-derived indexes. */
+  build() {
+    return {
+      cast_as: this.definition.castAs,
+      indexes: indexesForCapabilities(
+        this.definition.capabilities,
+        this.definition.castAs,
+        orderingForEqlType(this.definition.eqlType)
+      )
+    };
+  }
+};
+var TEXT_SEARCH_DOMAIN = {
+  eqlType: TEXT_SEARCH_EQL_TYPE,
+  castAs: "string",
+  capabilities: TEXT_SEARCH
+};
+var EncryptedTextSearchColumn = class extends EncryptedV3Column {
+  constructor(columnName) {
+    super(columnName, TEXT_SEARCH_DOMAIN);
+  }
+};
+var EncryptedIntegerColumn = class extends EncryptedV3Column {
+};
+var EncryptedIntegerEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedIntegerOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedIntegerOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedSmallintColumn = class extends EncryptedV3Column {
+};
+var EncryptedSmallintEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedSmallintOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedSmallintOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedBigintColumn = class extends EncryptedV3Column {
+};
+var EncryptedBigintEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedBigintOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedBigintOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedDateColumn = class extends EncryptedV3Column {
+};
+var EncryptedDateEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedDateOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedDateOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedTimestampColumn = class extends EncryptedV3Column {
+};
+var EncryptedTimestampEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedTimestampOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedTimestampOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedNumericColumn = class extends EncryptedV3Column {
+};
+var EncryptedNumericEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedNumericOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedNumericOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextMatchColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedTextOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedBooleanColumn = class extends EncryptedV3Column {
+};
+var EncryptedRealColumn = class extends EncryptedV3Column {
+};
+var EncryptedRealEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedRealOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedRealOrdColumn = class extends EncryptedV3Column {
+};
+var EncryptedDoubleColumn = class extends EncryptedV3Column {
+};
+var EncryptedDoubleEqColumn = class extends EncryptedV3Column {
+};
+var EncryptedDoubleOrdOreColumn = class extends EncryptedV3Column {
+};
+var EncryptedDoubleOrdColumn = class extends EncryptedV3Column {
+};
+var JSON_DOMAIN = {
+  eqlType: "public.eql_v3_json",
+  castAs: "json",
+  capabilities: {
+    equality: false,
+    orderAndRange: false,
+    freeTextSearch: false,
+    searchableJson: true
+  }
+};
+var EncryptedJsonColumn = class extends EncryptedV3Column {
+  constructor(columnName) {
+    super(columnName, JSON_DOMAIN);
+  }
+};
+
+// src/eql/v3/types.ts
+var types = {
+  // integer
+  Integer: (name) => new EncryptedIntegerColumn(name, INTEGER),
+  IntegerEq: (name) => new EncryptedIntegerEqColumn(name, INTEGER_EQ),
+  IntegerOrdOre: (name) => new EncryptedIntegerOrdOreColumn(name, INTEGER_ORD_ORE),
+  IntegerOrd: (name) => new EncryptedIntegerOrdColumn(name, INTEGER_ORD),
+  // smallint
+  Smallint: (name) => new EncryptedSmallintColumn(name, SMALLINT),
+  SmallintEq: (name) => new EncryptedSmallintEqColumn(name, SMALLINT_EQ),
+  SmallintOrdOre: (name) => new EncryptedSmallintOrdOreColumn(name, SMALLINT_ORD_ORE),
+  SmallintOrd: (name) => new EncryptedSmallintOrdColumn(name, SMALLINT_ORD),
+  // bigint (int8) — plaintext is a JS `bigint`, round-tripped losslessly by
+  // the native protect-ffi boundary (see ./columns)
+  Bigint: (name) => new EncryptedBigintColumn(name, BIGINT),
+  BigintEq: (name) => new EncryptedBigintEqColumn(name, BIGINT_EQ),
+  BigintOrdOre: (name) => new EncryptedBigintOrdOreColumn(name, BIGINT_ORD_ORE),
+  BigintOrd: (name) => new EncryptedBigintOrdColumn(name, BIGINT_ORD),
+  // date
+  Date: (name) => new EncryptedDateColumn(name, DATE),
+  DateEq: (name) => new EncryptedDateEqColumn(name, DATE_EQ),
+  DateOrdOre: (name) => new EncryptedDateOrdOreColumn(name, DATE_ORD_ORE),
+  DateOrd: (name) => new EncryptedDateOrdColumn(name, DATE_ORD),
+  // timestamp
+  Timestamp: (name) => new EncryptedTimestampColumn(name, TIMESTAMP),
+  TimestampEq: (name) => new EncryptedTimestampEqColumn(name, TIMESTAMP_EQ),
+  TimestampOrdOre: (name) => new EncryptedTimestampOrdOreColumn(name, TIMESTAMP_ORD_ORE),
+  TimestampOrd: (name) => new EncryptedTimestampOrdColumn(name, TIMESTAMP_ORD),
+  // numeric
+  Numeric: (name) => new EncryptedNumericColumn(name, NUMERIC),
+  NumericEq: (name) => new EncryptedNumericEqColumn(name, NUMERIC_EQ),
+  NumericOrdOre: (name) => new EncryptedNumericOrdOreColumn(name, NUMERIC_ORD_ORE),
+  NumericOrd: (name) => new EncryptedNumericOrdColumn(name, NUMERIC_ORD),
+  // text
+  Text: (name) => new EncryptedTextColumn(name, TEXT),
+  TextEq: (name) => new EncryptedTextEqColumn(name, TEXT_EQ),
+  TextMatch: (name) => new EncryptedTextMatchColumn(name, TEXT_MATCH),
+  TextOrdOre: (name) => new EncryptedTextOrdOreColumn(name, TEXT_ORD_ORE),
+  TextOrd: (name) => new EncryptedTextOrdColumn(name, TEXT_ORD),
+  TextSearch: (name) => new EncryptedTextSearchColumn(name),
+  // boolean
+  Boolean: (name) => new EncryptedBooleanColumn(name, BOOLEAN),
+  // real
+  Real: (name) => new EncryptedRealColumn(name, REAL),
+  RealEq: (name) => new EncryptedRealEqColumn(name, REAL_EQ),
+  RealOrdOre: (name) => new EncryptedRealOrdOreColumn(name, REAL_ORD_ORE),
+  RealOrd: (name) => new EncryptedRealOrdColumn(name, REAL_ORD),
+  // double
+  Double: (name) => new EncryptedDoubleColumn(name, DOUBLE),
+  DoubleEq: (name) => new EncryptedDoubleEqColumn(name, DOUBLE_EQ),
+  DoubleOrdOre: (name) => new EncryptedDoubleOrdOreColumn(name, DOUBLE_ORD_ORE),
+  DoubleOrd: (name) => new EncryptedDoubleOrdColumn(name, DOUBLE_ORD),
+  // json (encrypted JSONB document, ste_vec containment)
+  Json: (name) => new EncryptedJsonColumn(name)
+  // `satisfies` is load-bearing, not decoration: `DOMAIN_REGISTRY` derives itself
+  // by calling every value here at module load. A non-factory export would throw
+  // during module evaluation and take the supabase introspect/schema-build/verify
+  // path down with it. This turns that into a compile error at the offending line.
+  // `as const` applies first, so literal key inference is preserved.
+};
+
+// src/eql/v3/domain-registry.ts
+var DOMAIN_REGISTRY = (() => {
+  const registry = /* @__PURE__ */ Object.create(null);
+  for (const factory of Object.values(types)) {
+    const key = stripDomainSchema(factory("_probe").getEqlType());
+    if (Object.hasOwn(registry, key)) {
+      throw new Error(`duplicate EQL v3 domain key: ${key}`);
+    }
+    registry[key] = factory;
+  }
+  return registry;
+})();
+function stripDomainSchema(eqlType) {
+  return eqlType.startsWith("public.") ? eqlType.slice("public.".length) : eqlType;
+}
+function factoryForDomain(domainName) {
+  return Object.hasOwn(DOMAIN_REGISTRY, domainName) ? DOMAIN_REGISTRY[domainName] : void 0;
+}
+
+// src/eql/v3/selector-path.ts
+var FORBIDDEN_SEGMENTS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "prototype",
+  "constructor"
+]);
+function parseSelectorSegments(path) {
+  const trimmed = path.trim();
+  let body = trimmed.startsWith("$") ? trimmed.slice(1) : trimmed;
+  if (body.startsWith(".")) body = body.slice(1);
+  if (body === "") {
+    throw new Error(
+      `JSON selector path "${path}" addresses no field \u2014 use e.g. "$.a" or "$.a.b".`
+    );
+  }
+  if (/[[\]*]/.test(body)) {
+    throw new Error(
+      `JSON selector path "${path}" uses array/wildcard syntax, which is not yet supported \u2014 use dot-notation object keys (e.g. "$.a.b").`
+    );
+  }
+  const segments = body.split(".");
+  for (const segment of segments) {
+    if (segment === "") {
+      throw new Error(
+        `JSON selector path "${path}" is malformed (empty segment / ".." / stray dot) \u2014 use dot-notation object keys (e.g. "$.a.b").`
+      );
+    }
+    if (segment !== segment.trim()) {
+      throw new Error(
+        `JSON selector path "${path}" has whitespace at a segment boundary ("${segment}") \u2014 it would address a different key. Remove the spacing around the dot.`
+      );
+    }
+    if (FORBIDDEN_SEGMENTS.has(segment)) {
+      throw new Error(
+        `JSON selector path "${path}" addresses the forbidden key "${segment}".`
+      );
+    }
+  }
+  return segments;
+}
+function jsonPathOf(segments) {
+  return `$.${segments.join(".")}`;
+}
+function unsupportedLeafReason(value, ordering) {
+  if (value == null) {
+    return "a selector compares a non-null scalar leaf, but got null/undefined \u2014 SQL NULL never equals anything; use is(column, null) for null checks.";
+  }
+  const isScalar = value instanceof Date || typeof value === "number" || typeof value === "bigint" || typeof value === "string" || typeof value === "boolean";
+  if (!isScalar) {
+    return `a selector compares a scalar leaf, but got ${Array.isArray(value) ? "an array" : "an object"} \u2014 use contains() for sub-object matching.`;
+  }
+  if (ordering && typeof value === "boolean") {
+    return "a boolean leaf has no ordering \u2014 use eq/ne (or contains()).";
+  }
+  return null;
+}
+function reconstructSelectorDocument(segments, value) {
+  const root = /* @__PURE__ */ Object.create(null);
+  let cursor = root;
+  segments.forEach((segment, index) => {
+    if (index === segments.length - 1) {
+      cursor[segment] = value;
+    } else {
+      const next = /* @__PURE__ */ Object.create(null);
+      cursor[segment] = next;
+      cursor = next;
+    }
+  });
+  return root;
+}
+
+// ../../node_modules/.pnpm/evlog@1.11.0_next@15.5.18_react-dom@19.2.3_react@19.2.3__react@19.2.3__react@19.2.3/node_modules/evlog/dist/utils.mjs
+function formatDuration(ms) {
+  if (ms < 1e3) return `${Math.round(ms)}ms`;
+  return `${(ms / 1e3).toFixed(2)}s`;
+}
+function isDev() {
+  if (typeof process !== "undefined") return process.env.NODE_ENV !== "production";
+  if (typeof window !== "undefined") return true;
+  return false;
+}
+function detectEnvironment() {
+  const env = typeof process !== "undefined" ? process.env : {};
+  const defaultEnvironment = isDev() ? "development" : "production";
+  return {
+    environment: env.NODE_ENV || defaultEnvironment,
+    service: env.SERVICE_NAME || "app",
+    version: env.APP_VERSION,
+    commitHash: env.COMMIT_SHA || env.GITHUB_SHA || env.VERCEL_GIT_COMMIT_SHA || env.CF_PAGES_COMMIT_SHA,
+    region: env.VERCEL_REGION || env.AWS_REGION || env.FLY_REGION || env.CF_REGION
+  };
+}
+function getConsoleMethod(level) {
+  return level;
+}
+var colors = {
+  reset: "\x1B[0m",
+  bold: "\x1B[1m",
+  dim: "\x1B[2m",
+  red: "\x1B[31m",
+  green: "\x1B[32m",
+  yellow: "\x1B[33m",
+  blue: "\x1B[34m",
+  magenta: "\x1B[35m",
+  cyan: "\x1B[36m",
+  white: "\x1B[37m",
+  gray: "\x1B[90m"
+};
+function getLevelColor(level) {
+  switch (level) {
+    case "error":
+      return colors.red;
+    case "warn":
+      return colors.yellow;
+    case "info":
+      return colors.cyan;
+    case "debug":
+      return colors.gray;
+    default:
+      return colors.white;
+  }
+}
+function matchesPattern(path, pattern) {
+  const regexPattern = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "{{GLOBSTAR}}").replace(/\*/g, "[^/]*").replace(/{{GLOBSTAR}}/g, ".*").replace(/\?/g, "[^/]");
+  return new RegExp(`^${regexPattern}$`).test(path);
+}
+
+// ../../node_modules/.pnpm/evlog@1.11.0_next@15.5.18_react-dom@19.2.3_react@19.2.3__react@19.2.3__react@19.2.3/node_modules/evlog/dist/logger.mjs
+function isPlainObject(val) {
+  return val !== null && typeof val === "object" && !Array.isArray(val);
+}
+function deepDefaults(base, defaults) {
+  const result = { ...base };
+  for (const key in defaults) {
+    const baseVal = result[key];
+    const defaultVal = defaults[key];
+    if (baseVal === void 0 || baseVal === null) result[key] = defaultVal;
+    else if (isPlainObject(baseVal) && isPlainObject(defaultVal)) result[key] = deepDefaults(baseVal, defaultVal);
+  }
+  return result;
+}
+var globalEnv = {
+  service: "app",
+  environment: "development"
+};
+var globalPretty = isDev();
+var globalSampling = {};
+var globalStringify = true;
+var globalDrain;
+var globalEnabled = true;
+function initLogger(config = {}) {
+  globalEnabled = config.enabled ?? true;
+  const detected = detectEnvironment();
+  globalEnv = {
+    service: config.env?.service ?? detected.service ?? "app",
+    environment: config.env?.environment ?? detected.environment ?? "development",
+    version: config.env?.version ?? detected.version,
+    commitHash: config.env?.commitHash ?? detected.commitHash,
+    region: config.env?.region ?? detected.region
+  };
+  globalPretty = config.pretty ?? isDev();
+  globalSampling = config.sampling ?? {};
+  globalStringify = config.stringify ?? true;
+  globalDrain = config.drain;
+}
+function shouldSample(level) {
+  const { rates } = globalSampling;
+  if (!rates) return true;
+  const percentage = level === "error" && rates.error === void 0 ? 100 : rates[level] ?? 100;
+  if (percentage <= 0) return false;
+  if (percentage >= 100) return true;
+  return Math.random() * 100 < percentage;
+}
+function shouldKeep(ctx) {
+  const { keep } = globalSampling;
+  if (!keep?.length) return false;
+  return keep.some((condition) => {
+    if (condition.status !== void 0 && ctx.status !== void 0 && ctx.status >= condition.status) return true;
+    if (condition.duration !== void 0 && ctx.duration !== void 0 && ctx.duration >= condition.duration) return true;
+    if (condition.path && ctx.path && matchesPattern(ctx.path, condition.path)) return true;
+    return false;
+  });
+}
+function emitWideEvent(level, event, skipSamplingCheck = false) {
+  if (!globalEnabled) return null;
+  if (!skipSamplingCheck && !shouldSample(level)) return null;
+  const formatted = {
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    level,
+    ...globalEnv,
+    ...event
+  };
+  if (globalPretty) prettyPrintWideEvent(formatted);
+  else if (globalStringify) console[getConsoleMethod(level)](JSON.stringify(formatted));
+  else console[getConsoleMethod(level)](formatted);
+  if (globalDrain) Promise.resolve(globalDrain({ event: formatted })).catch((err) => {
+    console.error("[evlog] drain failed:", err);
+  });
+  return formatted;
+}
+function emitTaggedLog(level, tag, message) {
+  if (!globalEnabled) return;
+  if (globalPretty) {
+    if (!shouldSample(level)) return;
+    const color = getLevelColor(level);
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString().slice(11, 23);
+    console.log(`${colors.dim}${timestamp}${colors.reset} ${color}[${tag}]${colors.reset} ${message}`);
+    return;
+  }
+  emitWideEvent(level, {
+    tag,
+    message
+  });
+}
+function formatValue(value) {
+  if (value === null || value === void 0) return String(value);
+  if (typeof value === "object") {
+    const pairs = [];
+    for (const [k, v] of Object.entries(value)) if (v !== void 0 && v !== null) if (typeof v === "object") pairs.push(`${k}=${JSON.stringify(v)}`);
+    else pairs.push(`${k}=${v}`);
+    return pairs.join(" ");
+  }
+  return String(value);
+}
+function prettyPrintWideEvent(event) {
+  const { timestamp, level, service, environment, version, ...rest } = event;
+  const levelColor = getLevelColor(level);
+  const ts = timestamp.slice(11, 23);
+  let header = `${colors.dim}${ts}${colors.reset} ${levelColor}${level.toUpperCase()}${colors.reset}`;
+  header += ` ${colors.cyan}[${service}]${colors.reset}`;
+  if (rest.method && rest.path) {
+    header += ` ${rest.method} ${rest.path}`;
+    delete rest.method;
+    delete rest.path;
+  }
+  if (rest.status) {
+    const statusColor = rest.status >= 400 ? colors.red : colors.green;
+    header += ` ${statusColor}${rest.status}${colors.reset}`;
+    delete rest.status;
+  }
+  if (rest.duration) {
+    header += ` ${colors.dim}in ${rest.duration}${colors.reset}`;
+    delete rest.duration;
+  }
+  console.log(header);
+  const entries = Object.entries(rest).filter(([_, v]) => v !== void 0);
+  const lastIndex = entries.length - 1;
+  entries.forEach(([key, value], index) => {
+    const prefix = index === lastIndex ? "\u2514\u2500" : "\u251C\u2500";
+    const formatted = formatValue(value);
+    console.log(`  ${colors.dim}${prefix}${colors.reset} ${colors.cyan}${key}:${colors.reset} ${formatted}`);
+  });
+}
+function createLogMethod(level) {
+  return function logMethod(tagOrEvent, message) {
+    if (typeof tagOrEvent === "string" && message !== void 0) emitTaggedLog(level, tagOrEvent, message);
+    else if (typeof tagOrEvent === "object") emitWideEvent(level, tagOrEvent);
+    else emitTaggedLog(level, "log", String(tagOrEvent));
+  };
+}
+var _log = {
+  info: createLogMethod("info"),
+  error: createLogMethod("error"),
+  warn: createLogMethod("warn"),
+  debug: createLogMethod("debug")
+};
+var noopLogger = {
+  set() {
+  },
+  error() {
+  },
+  info() {
+  },
+  warn() {
+  },
+  emit() {
+    return null;
+  },
+  getContext() {
+    return {};
+  }
+};
+function createRequestLogger(options = {}) {
+  if (!globalEnabled) return noopLogger;
+  const startTime = Date.now();
+  let context = {
+    method: options.method,
+    path: options.path,
+    requestId: options.requestId
+  };
+  let hasError = false;
+  let hasWarn = false;
+  function addRequestLog(level, message) {
+    const entry = {
+      level,
+      message,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    const requestLogs = Array.isArray(context.requestLogs) ? [...context.requestLogs, entry] : [entry];
+    context = {
+      ...context,
+      requestLogs
+    };
+  }
+  return {
+    set(data) {
+      context = deepDefaults(data, context);
+    },
+    error(error, errorContext) {
+      hasError = true;
+      const err = typeof error === "string" ? new Error(error) : error;
+      context = deepDefaults({
+        ...errorContext,
+        error: {
+          name: err.name,
+          message: err.message,
+          stack: err.stack,
+          ..."status" in err && { status: err.status },
+          ..."statusText" in err && { statusText: err.statusText },
+          ..."statusCode" in err && { statusCode: err.statusCode },
+          ..."statusMessage" in err && { statusMessage: err.statusMessage },
+          ..."data" in err && { data: err.data },
+          ..."cause" in err && { cause: err.cause }
+        }
+      }, context);
+    },
+    info(message, infoContext) {
+      addRequestLog("info", message);
+      if (infoContext) {
+        const { requestLogs: _, ...rest } = infoContext;
+        context = deepDefaults(rest, context);
+      }
+    },
+    warn(message, warnContext) {
+      hasWarn = true;
+      addRequestLog("warn", message);
+      if (warnContext) {
+        const { requestLogs: _, ...rest } = warnContext;
+        context = deepDefaults(rest, context);
+      }
+    },
+    emit(overrides) {
+      const durationMs = Date.now() - startTime;
+      const duration = formatDuration(durationMs);
+      const level = hasError ? "error" : hasWarn ? "warn" : "info";
+      const { _forceKeep, ...restOverrides } = overrides ?? {};
+      const tailCtx = {
+        status: context.status ?? restOverrides.status,
+        duration: durationMs,
+        path: context.path,
+        method: context.method,
+        context: {
+          ...context,
+          ...restOverrides
+        }
+      };
+      if (!(_forceKeep || shouldKeep(tailCtx)) && !shouldSample(level)) return null;
+      return emitWideEvent(level, {
+        ...context,
+        ...restOverrides,
+        duration
+      }, true);
+    },
+    getContext() {
+      return { ...context };
+    }
+  };
+}
+
+// src/utils/logger/index.ts
+var validLevels = ["debug", "info", "error"];
+function levelFromEnv() {
+  const env = process.env.STASH_STACK_LOG;
+  if (env && validLevels.includes(env)) return env;
+  return "error";
+}
+function samplingRatesForLevel(level) {
+  switch (level) {
+    case "debug":
+      return { debug: 100, info: 100, warn: 100, error: 100 };
+    case "info":
+      return { debug: 0, info: 100, warn: 100, error: 100 };
+    case "error":
+    default:
+      return { debug: 0, info: 0, warn: 0, error: 100 };
+  }
+}
+var initialized = false;
+function initStackLogger() {
+  if (initialized) return;
+  initialized = true;
+  const level = levelFromEnv();
+  const rates = samplingRatesForLevel(level);
+  initLogger({
+    env: { service: "@cipherstash/stack" },
+    enabled: true,
+    sampling: { rates }
+  });
+}
+initStackLogger();
+function safeMessage(args) {
+  return typeof args[0] === "string" ? args[0] : "";
+}
+var logger = {
+  debug(...args) {
+    const log = createRequestLogger();
+    log.set({
+      level: "debug",
+      source: "@cipherstash/stack",
+      message: safeMessage(args)
+    });
+    log.emit();
+  },
+  info(...args) {
+    const log = createRequestLogger();
+    log.set({ source: "@cipherstash/stack" });
+    log.info(safeMessage(args));
+    log.emit();
+  },
+  warn(...args) {
+    const log = createRequestLogger();
+    log.warn(safeMessage(args));
+    log.emit();
+  },
+  error(...args) {
+    const log = createRequestLogger();
+    log.error(safeMessage(args));
+    log.emit();
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DATE_LIKE_CASTS,
+  DOMAIN_REGISTRY,
+  EncryptedV3Column,
+  bulkModelsToEncryptedPgComposites,
+  factoryForDomain,
+  jsonPathOf,
+  logger,
+  matchNeedleError,
+  modelToEncryptedPgComposites,
+  parseSelectorSegments,
+  reconstructSelectorDocument,
+  stripDomainSchema,
+  unsupportedLeafReason
+});
+//# sourceMappingURL=adapter-kit.cjs.map