@cipherstash/stack 0.19.0 → 1.0.0-rc.1

package/dist/supabase/index.js

@@ -1,1217 +0,0 @@
-import {
-  EncryptedV3Column
-} from "../chunk-U66S7VIF.js";
-import {
-  bulkModelsToEncryptedPgComposites,
-  modelToEncryptedPgComposites
-} from "../chunk-BNO32ZMV.js";
-import {
-  EncryptedColumn
-} from "../chunk-MP3SSDNN.js";
-import "../chunk-IADZCZEA.js";
-import {
-  logger
-} from "../chunk-HQANMV7R.js";
-import "../chunk-PZ5AY32C.js";
-
-// src/supabase/helpers.ts
-function getEncryptedColumnNames(schema) {
-  const built = schema.build();
-  return Object.keys(built.columns);
-}
-function isEncryptedColumn(columnName, encryptedColumnNames) {
-  return encryptedColumnNames.includes(columnName);
-}
-function addJsonbCasts(columns, encryptedColumnNames) {
-  return columns.split(",").map((col) => {
-    const trimmed = col.trim();
-    if (!trimmed) return col;
-    if (trimmed.includes("::")) return col;
-    if (trimmed.includes("(") || trimmed.includes(".")) return col;
-    const parts = trimmed.split(/\s+/);
-    const colName = parts[0];
-    if (isEncryptedColumn(colName, encryptedColumnNames)) {
-      const leadingWhitespace = col.match(/^(\s*)/)?.[1] ?? "";
-      if (parts.length > 1) {
-        return `${leadingWhitespace}${colName}::jsonb ${parts.slice(1).join(" ")}`;
-      }
-      return `${leadingWhitespace}${colName}::jsonb`;
-    }
-    return col;
-  }).join(",");
-}
-function addJsonbCastsV3(columns, propToDb) {
-  const dbNames = new Set(Object.values(propToDb));
-  const keyToDb = {};
-  const select = columns.split(",").map((col) => {
-    const trimmed = col.trim();
-    if (!trimmed) return col;
-    if (trimmed.includes("::")) return col;
-    if (trimmed.includes("(") || trimmed.includes(".")) return col;
-    const leadingWhitespace = col.match(/^(\s*)/)?.[1] ?? "";
-    const aliasMatch = trimmed.match(
-      /^([A-Za-z_][A-Za-z0-9_]*):([A-Za-z_][A-Za-z0-9_]*)$/
-    );
-    if (aliasMatch) {
-      const [, alias, name] = aliasMatch;
-      const db2 = propToDb[name] ?? (dbNames.has(name) ? name : void 0);
-      if (db2 !== void 0) {
-        keyToDb[alias] = db2;
-        return `${leadingWhitespace}${alias}:${db2}::jsonb`;
-      }
-      return col;
-    }
-    const db = propToDb[trimmed];
-    if (db !== void 0) {
-      keyToDb[trimmed] = db;
-      return db === trimmed ? `${leadingWhitespace}${trimmed}::jsonb` : `${leadingWhitespace}${trimmed}:${db}::jsonb`;
-    }
-    if (dbNames.has(trimmed)) {
-      keyToDb[trimmed] = trimmed;
-      return `${leadingWhitespace}${trimmed}::jsonb`;
-    }
-    return col;
-  }).join(",");
-  return { select, keyToDb };
-}
-function mapFilterOpToQueryType(op) {
-  switch (op) {
-    case "eq":
-    case "neq":
-    case "in":
-    case "is":
-      return "equality";
-    case "like":
-    case "ilike":
-      return "freeTextSearch";
-    case "gt":
-    case "gte":
-    case "lt":
-    case "lte":
-      return "orderAndRange";
-    default:
-      return "equality";
-  }
-}
-function parseOrString(orString) {
-  const conditions = [];
-  const parts = splitOrString(orString);
-  for (const part of parts) {
-    const trimmed = part.trim();
-    if (!trimmed) continue;
-    const firstDot = trimmed.indexOf(".");
-    if (firstDot === -1) continue;
-    const column = trimmed.slice(0, firstDot);
-    const rest = trimmed.slice(firstDot + 1);
-    const secondDot = rest.indexOf(".");
-    if (secondDot === -1) continue;
-    const op = rest.slice(0, secondDot);
-    const value = rest.slice(secondDot + 1);
-    const parsedValue = parseOrValue(value);
-    conditions.push({ column, op, value: parsedValue });
-  }
-  return conditions;
-}
-function rebuildOrString(conditions) {
-  return conditions.map((c) => {
-    const value = formatOrValue(c.value);
-    return `${c.column}.${c.op}.${value}`;
-  }).join(",");
-}
-function splitOrString(input) {
-  const parts = [];
-  let current = "";
-  let depth = 0;
-  let inQuotes = false;
-  for (const char of input) {
-    if (char === '"' && depth === 0) {
-      inQuotes = !inQuotes;
-      current += char;
-    } else if (char === "(" && !inQuotes) {
-      depth++;
-      current += char;
-    } else if (char === ")" && !inQuotes) {
-      depth--;
-      current += char;
-    } else if (char === "," && depth === 0 && !inQuotes) {
-      parts.push(current);
-      current = "";
-    } else {
-      current += char;
-    }
-  }
-  if (current) {
-    parts.push(current);
-  }
-  return parts;
-}
-function parseOrValue(value) {
-  if (value.startsWith('"') && value.endsWith('"')) {
-    return value.slice(1, -1);
-  }
-  if (value.startsWith("(") && value.endsWith(")")) {
-    return value.slice(1, -1).split(",").map((v) => v.trim());
-  }
-  if (value === "true") return true;
-  if (value === "false") return false;
-  if (value === "null") return null;
-  return value;
-}
-var POSTGREST_RESERVED = /[,().]/;
-function formatOrValue(value) {
-  if (Array.isArray(value)) {
-    return `(${value.join(",")})`;
-  }
-  if (value === null) return "null";
-  if (value === true) return "true";
-  if (value === false) return "false";
-  const str = String(value);
-  if (POSTGREST_RESERVED.test(str)) {
-    return `"${str}"`;
-  }
-  return str;
-}
-
-// src/supabase/query-builder.ts
-var EncryptedQueryBuilderImpl = class {
-  tableName;
-  schema;
-  encryptionClient;
-  supabaseClient;
-  encryptedColumnNames;
-  // Recorded operations
-  mutation = null;
-  selectColumns = null;
-  selectOptions = void 0;
-  filters = [];
-  orFilters = [];
-  matchFilters = [];
-  notFilters = [];
-  rawFilters = [];
-  transforms = [];
-  resultMode = "array";
-  shouldThrowOnError = false;
-  // Encryption-specific state
-  lockContext = null;
-  auditConfig = null;
-  constructor(tableName, schema, encryptionClient, supabaseClient) {
-    this.tableName = tableName;
-    this.schema = schema;
-    this.encryptionClient = encryptionClient;
-    this.supabaseClient = supabaseClient;
-    this.encryptedColumnNames = getEncryptedColumnNames(schema);
-  }
-  // ---------------------------------------------------------------------------
-  // Mutation methods
-  // ---------------------------------------------------------------------------
-  select(columns, options) {
-    if (columns === "*") {
-      throw new Error(
-        "encryptedSupabase does not support select('*'). Please list columns explicitly so that encrypted columns can be cast with ::jsonb."
-      );
-    }
-    this.selectColumns = columns;
-    this.selectOptions = options;
-    return this;
-  }
-  insert(data, options) {
-    this.mutation = {
-      kind: "insert",
-      data,
-      options
-    };
-    return this;
-  }
-  update(data, options) {
-    this.mutation = {
-      kind: "update",
-      data,
-      options
-    };
-    return this;
-  }
-  upsert(data, options) {
-    this.mutation = {
-      kind: "upsert",
-      data,
-      options
-    };
-    return this;
-  }
-  delete(options) {
-    this.mutation = { kind: "delete", options };
-    return this;
-  }
-  // ---------------------------------------------------------------------------
-  // Filter methods
-  // ---------------------------------------------------------------------------
-  eq(column, value) {
-    this.filters.push({ op: "eq", column, value });
-    return this;
-  }
-  neq(column, value) {
-    this.filters.push({ op: "neq", column, value });
-    return this;
-  }
-  gt(column, value) {
-    this.filters.push({ op: "gt", column, value });
-    return this;
-  }
-  gte(column, value) {
-    this.filters.push({ op: "gte", column, value });
-    return this;
-  }
-  lt(column, value) {
-    this.filters.push({ op: "lt", column, value });
-    return this;
-  }
-  lte(column, value) {
-    this.filters.push({ op: "lte", column, value });
-    return this;
-  }
-  like(column, pattern) {
-    this.filters.push({ op: "like", column, value: pattern });
-    return this;
-  }
-  ilike(column, pattern) {
-    this.filters.push({ op: "ilike", column, value: pattern });
-    return this;
-  }
-  is(column, value) {
-    this.filters.push({ op: "is", column, value });
-    return this;
-  }
-  in(column, values) {
-    this.filters.push({ op: "in", column, value: values });
-    return this;
-  }
-  filter(column, operator, value) {
-    this.rawFilters.push({ column, operator, value });
-    return this;
-  }
-  not(column, operator, value) {
-    this.notFilters.push({ column, op: operator, value });
-    return this;
-  }
-  or(filtersOrConditions, options) {
-    if (typeof filtersOrConditions === "string") {
-      this.orFilters.push({
-        kind: "string",
-        value: filtersOrConditions,
-        referencedTable: options?.referencedTable ?? options?.foreignTable
-      });
-    } else {
-      this.orFilters.push({
-        kind: "structured",
-        conditions: filtersOrConditions
-      });
-    }
-    return this;
-  }
-  match(query) {
-    this.matchFilters.push({ query });
-    return this;
-  }
-  // ---------------------------------------------------------------------------
-  // Transform methods (passthrough)
-  // ---------------------------------------------------------------------------
-  order(column, options) {
-    this.transforms.push({ kind: "order", column, options });
-    return this;
-  }
-  limit(count, options) {
-    this.transforms.push({ kind: "limit", count, options });
-    return this;
-  }
-  range(from, to, options) {
-    this.transforms.push({ kind: "range", from, to, options });
-    return this;
-  }
-  single() {
-    this.resultMode = "single";
-    this.transforms.push({ kind: "single" });
-    return this;
-  }
-  maybeSingle() {
-    this.resultMode = "maybeSingle";
-    this.transforms.push({ kind: "maybeSingle" });
-    return this;
-  }
-  csv() {
-    this.transforms.push({ kind: "csv" });
-    return this;
-  }
-  abortSignal(signal) {
-    this.transforms.push({ kind: "abortSignal", signal });
-    return this;
-  }
-  throwOnError() {
-    this.shouldThrowOnError = true;
-    this.transforms.push({ kind: "throwOnError" });
-    return this;
-  }
-  returns() {
-    return this;
-  }
-  // ---------------------------------------------------------------------------
-  // Encryption-specific methods
-  // ---------------------------------------------------------------------------
-  withLockContext(lockContext) {
-    this.lockContext = lockContext;
-    return this;
-  }
-  audit(config) {
-    this.auditConfig = config;
-    return this;
-  }
-  // ---------------------------------------------------------------------------
-  // PromiseLike implementation (deferred execution)
-  // ---------------------------------------------------------------------------
-  then(onfulfilled, onrejected) {
-    return this.execute().then(onfulfilled, onrejected);
-  }
-  // ---------------------------------------------------------------------------
-  // Core execution
-  // ---------------------------------------------------------------------------
-  async execute() {
-    try {
-      logger.debug(`Supabase encrypted query on table "${this.tableName}".`);
-      const encryptedMutation = await this.encryptMutationData();
-      const selectString = this.buildSelectString();
-      const encryptedFilters = await this.encryptFilterValues();
-      const result = await this.buildAndExecuteQuery(
-        encryptedMutation,
-        selectString,
-        encryptedFilters
-      );
-      return await this.decryptResults(result);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      logger.error(
-        `Supabase encrypted query failed on table "${this.tableName}": ${message}`
-      );
-      const error = {
-        message,
-        encryptionError: void 0
-      };
-      if (this.shouldThrowOnError) {
-        throw err;
-      }
-      return {
-        data: null,
-        error,
-        count: null,
-        status: 500,
-        statusText: "Encryption Error"
-      };
-    }
-  }
-  // ---------------------------------------------------------------------------
-  // Step 1: Encrypt mutation data
-  // ---------------------------------------------------------------------------
-  async encryptMutationData() {
-    if (!this.mutation) return null;
-    if (this.mutation.kind === "delete") return null;
-    const data = this.mutation.data;
-    if (Array.isArray(data)) {
-      const baseOp2 = this.encryptionClient.bulkEncryptModels(data, this.schema);
-      const op2 = this.lockContext ? baseOp2.withLockContext(this.lockContext) : baseOp2;
-      if (this.auditConfig) op2.audit(this.auditConfig);
-      const result2 = await op2;
-      if (result2.failure) {
-        logger.error(
-          `Supabase: failed to encrypt models for table "${this.tableName}"`
-        );
-        throw new EncryptionFailedError(
-          `Failed to encrypt models: ${result2.failure.message}`,
-          result2.failure
-        );
-      }
-      return this.transformEncryptedMutationModels(result2.data);
-    }
-    const baseOp = this.encryptionClient.encryptModel(data, this.schema);
-    const op = this.lockContext ? baseOp.withLockContext(this.lockContext) : baseOp;
-    if (this.auditConfig) op.audit(this.auditConfig);
-    const result = await op;
-    if (result.failure) {
-      logger.error(
-        `Supabase: failed to encrypt model for table "${this.tableName}"`
-      );
-      throw new EncryptionFailedError(
-        `Failed to encrypt model: ${result.failure.message}`,
-        result.failure
-      );
-    }
-    return this.transformEncryptedMutationModel(result.data);
-  }
-  /**
-   * Encode an encrypted model for the Supabase request body. v2 wraps each
-   * encrypted value in the `{ data: ... }` object expected by the
-   * `eql_v2_encrypted` composite type. The v3 dialect overrides this — native
-   * `eql_v3.*` domains are plain jsonb, so the raw payload is sent instead
-   * (keyed by DB column name).
-   */
-  transformEncryptedMutationModel(model) {
-    return modelToEncryptedPgComposites(model);
-  }
-  transformEncryptedMutationModels(models) {
-    return bulkModelsToEncryptedPgComposites(models);
-  }
-  // ---------------------------------------------------------------------------
-  // Step 2: Build select string with casts
-  // ---------------------------------------------------------------------------
-  buildSelectString() {
-    if (this.selectColumns === null) return null;
-    return addJsonbCasts(this.selectColumns, this.encryptedColumnNames);
-  }
-  // ---------------------------------------------------------------------------
-  // Step 3: Encrypt filter values
-  // ---------------------------------------------------------------------------
-  async encryptFilterValues() {
-    const terms = [];
-    const termMap = [];
-    const tableColumns = this.getColumnMap();
-    for (let i = 0; i < this.filters.length; i++) {
-      const f = this.filters[i];
-      if (!isEncryptedColumn(f.column, this.encryptedColumnNames)) continue;
-      const column = tableColumns[f.column];
-      if (!column) continue;
-      if (f.op === "in" && Array.isArray(f.value)) {
-        for (let j = 0; j < f.value.length; j++) {
-          terms.push({
-            value: f.value[j],
-            column,
-            table: this.schema,
-            queryType: mapFilterOpToQueryType(f.op),
-            returnType: "composite-literal"
-          });
-          termMap.push({ source: "filter", filterIndex: i, inIndex: j });
-        }
-      } else if (f.op === "is") {
-      } else {
-        terms.push({
-          value: f.value,
-          column,
-          table: this.schema,
-          queryType: mapFilterOpToQueryType(f.op),
-          returnType: "composite-literal"
-        });
-        termMap.push({ source: "filter", filterIndex: i });
-      }
-    }
-    for (let i = 0; i < this.matchFilters.length; i++) {
-      const mf = this.matchFilters[i];
-      for (const [colName, value] of Object.entries(mf.query)) {
-        if (!isEncryptedColumn(colName, this.encryptedColumnNames)) continue;
-        const column = tableColumns[colName];
-        if (!column) continue;
-        terms.push({
-          value,
-          column,
-          table: this.schema,
-          queryType: "equality",
-          returnType: "composite-literal"
-        });
-        termMap.push({ source: "match", matchIndex: i, column: colName });
-      }
-    }
-    for (let i = 0; i < this.notFilters.length; i++) {
-      const nf = this.notFilters[i];
-      if (!isEncryptedColumn(nf.column, this.encryptedColumnNames)) continue;
-      const column = tableColumns[nf.column];
-      if (!column) continue;
-      terms.push({
-        value: nf.value,
-        column,
-        table: this.schema,
-        queryType: mapFilterOpToQueryType(nf.op),
-        returnType: "composite-literal"
-      });
-      termMap.push({ source: "not", notIndex: i });
-    }
-    for (let i = 0; i < this.orFilters.length; i++) {
-      const of_ = this.orFilters[i];
-      if (of_.kind === "string") {
-        const parsed = parseOrString(of_.value);
-        for (let j = 0; j < parsed.length; j++) {
-          const cond = parsed[j];
-          if (!isEncryptedColumn(cond.column, this.encryptedColumnNames))
-            continue;
-          const column = tableColumns[cond.column];
-          if (!column) continue;
-          terms.push({
-            value: cond.value,
-            column,
-            table: this.schema,
-            queryType: mapFilterOpToQueryType(cond.op),
-            returnType: "composite-literal"
-          });
-          termMap.push({ source: "or-string", orIndex: i, conditionIndex: j });
-        }
-      } else {
-        for (let j = 0; j < of_.conditions.length; j++) {
-          const cond = of_.conditions[j];
-          if (!isEncryptedColumn(cond.column, this.encryptedColumnNames))
-            continue;
-          const column = tableColumns[cond.column];
-          if (!column) continue;
-          terms.push({
-            value: cond.value,
-            column,
-            table: this.schema,
-            queryType: mapFilterOpToQueryType(cond.op),
-            returnType: "composite-literal"
-          });
-          termMap.push({
-            source: "or-structured",
-            orIndex: i,
-            conditionIndex: j
-          });
-        }
-      }
-    }
-    for (let i = 0; i < this.rawFilters.length; i++) {
-      const rf = this.rawFilters[i];
-      if (!isEncryptedColumn(rf.column, this.encryptedColumnNames)) continue;
-      const column = tableColumns[rf.column];
-      if (!column) continue;
-      terms.push({
-        value: rf.value,
-        column,
-        table: this.schema,
-        queryType: "equality",
-        returnType: "composite-literal"
-      });
-      termMap.push({ source: "raw", rawIndex: i });
-    }
-    if (terms.length === 0) {
-      return { encryptedValues: [], termMap: [] };
-    }
-    const encryptedValues = await this.encryptCollectedTerms(terms);
-    return { encryptedValues, termMap };
-  }
-  /**
-   * Encrypt the collected filter terms, returning one encoded value per term
-   * (in order). v2 batch-encrypts via `encryptQuery` with the
-   * `composite-literal` return type — the `("json")` string the
-   * `eql_v2_encrypted` composite operators compare. The v3 dialect overrides
-   * this to produce full-envelope jsonb operands instead.
-   */
-  async encryptCollectedTerms(terms) {
-    const baseOp = this.encryptionClient.encryptQuery(terms);
-    const op = this.lockContext ? baseOp.withLockContext(this.lockContext) : baseOp;
-    if (this.auditConfig) op.audit(this.auditConfig);
-    const result = await op;
-    if (result.failure) {
-      logger.error(
-        `Supabase: failed to encrypt query terms for table "${this.tableName}"`
-      );
-      throw new EncryptionFailedError(
-        `Failed to encrypt query terms: ${result.failure.message}`,
-        result.failure
-      );
-    }
-    return result.data;
-  }
-  // ---------------------------------------------------------------------------
-  // Step 4: Build and execute real Supabase query
-  // ---------------------------------------------------------------------------
-  async buildAndExecuteQuery(encryptedMutation, selectString, encryptedFilters) {
-    let query = this.supabaseClient.from(this.tableName);
-    if (this.mutation) {
-      switch (this.mutation.kind) {
-        case "insert":
-          query = query.insert(encryptedMutation, this.mutation.options);
-          break;
-        case "update":
-          query = query.update(encryptedMutation, this.mutation.options);
-          break;
-        case "upsert":
-          query = query.upsert(encryptedMutation, this.mutation.options);
-          break;
-        case "delete":
-          query = query.delete(this.mutation.options);
-          break;
-      }
-    }
-    if (selectString !== null) {
-      query = query.select(selectString, this.selectOptions);
-    } else if (!this.mutation) {
-      query = query.select("*", this.selectOptions);
-    }
-    query = this.applyFilters(query, encryptedFilters);
-    for (const t of this.transforms) {
-      switch (t.kind) {
-        case "order":
-          query = query.order(t.column, t.options);
-          break;
-        case "limit":
-          query = query.limit(t.count, t.options);
-          break;
-        case "range":
-          query = query.range(t.from, t.to, t.options);
-          break;
-        case "single":
-          query = query.single();
-          break;
-        case "maybeSingle":
-          query = query.maybeSingle();
-          break;
-        case "csv":
-          query = query.csv();
-          break;
-        case "abortSignal":
-          query = query.abortSignal(t.signal);
-          break;
-        case "throwOnError":
-          query = query.throwOnError();
-          break;
-      }
-    }
-    const result = await query;
-    return result;
-  }
-  // ---------------------------------------------------------------------------
-  // Apply filters with encrypted values substituted
-  // ---------------------------------------------------------------------------
-  applyFilters(query, encryptedFilters) {
-    let q = query;
-    const filterValueMap = /* @__PURE__ */ new Map();
-    const filterInMap = /* @__PURE__ */ new Map();
-    const matchValueMap = /* @__PURE__ */ new Map();
-    const notValueMap = /* @__PURE__ */ new Map();
-    const rawValueMap = /* @__PURE__ */ new Map();
-    const orStringConditionMap = /* @__PURE__ */ new Map();
-    const orStructuredConditionMap = /* @__PURE__ */ new Map();
-    for (let i = 0; i < encryptedFilters.termMap.length; i++) {
-      const mapping = encryptedFilters.termMap[i];
-      const encValue = encryptedFilters.encryptedValues[i];
-      switch (mapping.source) {
-        case "filter":
-          if (mapping.inIndex !== void 0) {
-            filterInMap.set(
-              `${mapping.filterIndex}:${mapping.inIndex}`,
-              encValue
-            );
-          } else {
-            filterValueMap.set(mapping.filterIndex, encValue);
-          }
-          break;
-        case "match":
-          matchValueMap.set(`${mapping.matchIndex}:${mapping.column}`, encValue);
-          break;
-        case "not":
-          notValueMap.set(mapping.notIndex, encValue);
-          break;
-        case "raw":
-          rawValueMap.set(mapping.rawIndex, encValue);
-          break;
-        case "or-string":
-          orStringConditionMap.set(
-            `${mapping.orIndex}:${mapping.conditionIndex}`,
-            encValue
-          );
-          break;
-        case "or-structured":
-          orStructuredConditionMap.set(
-            `${mapping.orIndex}:${mapping.conditionIndex}`,
-            encValue
-          );
-          break;
-      }
-    }
-    for (let i = 0; i < this.filters.length; i++) {
-      const f = this.filters[i];
-      let value = f.value;
-      if (filterValueMap.has(i)) {
-        value = filterValueMap.get(i);
-      } else if (f.op === "in" && Array.isArray(f.value)) {
-        value = f.value.map((v, j) => {
-          const key = `${i}:${j}`;
-          return filterInMap.has(key) ? filterInMap.get(key) : v;
-        });
-      }
-      const column = this.filterColumnName(f.column);
-      const wasEncrypted = filterValueMap.has(i);
-      switch (f.op) {
-        case "eq":
-          q = q.eq(column, value);
-          break;
-        case "neq":
-          q = q.neq(column, value);
-          break;
-        case "gt":
-          q = q.gt(column, value);
-          break;
-        case "gte":
-          q = q.gte(column, value);
-          break;
-        case "lt":
-          q = q.lt(column, value);
-          break;
-        case "lte":
-          q = q.lte(column, value);
-          break;
-        case "like":
-        case "ilike":
-          q = this.applyPatternFilter(q, column, f.op, value, wasEncrypted);
-          break;
-        case "is":
-          q = q.is(column, value);
-          break;
-        case "in":
-          q = q.in(column, value);
-          break;
-      }
-    }
-    for (let i = 0; i < this.matchFilters.length; i++) {
-      const mf = this.matchFilters[i];
-      const resolvedQuery = {};
-      for (const [colName, originalValue] of Object.entries(mf.query)) {
-        const key = `${i}:${colName}`;
-        resolvedQuery[this.filterColumnName(colName)] = matchValueMap.has(key) ? matchValueMap.get(key) : originalValue;
-      }
-      q = q.match(resolvedQuery);
-    }
-    for (let i = 0; i < this.notFilters.length; i++) {
-      const nf = this.notFilters[i];
-      const wasEncrypted = notValueMap.has(i);
-      const value = wasEncrypted ? notValueMap.get(i) : nf.value;
-      q = q.not(
-        this.filterColumnName(nf.column),
-        this.notFilterOperator(nf.op, wasEncrypted),
-        value
-      );
-    }
-    for (let i = 0; i < this.orFilters.length; i++) {
-      const of_ = this.orFilters[i];
-      if (of_.kind === "string") {
-        const parsed = parseOrString(of_.value);
-        const encryptedIndexes = /* @__PURE__ */ new Set();
-        for (let j = 0; j < parsed.length; j++) {
-          const key = `${i}:${j}`;
-          if (orStringConditionMap.has(key)) {
-            parsed[j] = { ...parsed[j], value: orStringConditionMap.get(key) };
-            encryptedIndexes.add(j);
-          }
-        }
-        if (encryptedIndexes.size > 0) {
-          q = q.or(
-            rebuildOrString(
-              this.transformOrConditions(parsed, encryptedIndexes)
-            ),
-            {
-              referencedTable: of_.referencedTable
-            }
-          );
-        } else {
-          q = q.or(of_.value, { referencedTable: of_.referencedTable });
-        }
-      } else {
-        const encryptedIndexes = /* @__PURE__ */ new Set();
-        const conditions = of_.conditions.map((cond, j) => {
-          const key = `${i}:${j}`;
-          if (orStructuredConditionMap.has(key)) {
-            encryptedIndexes.add(j);
-            return { ...cond, value: orStructuredConditionMap.get(key) };
-          }
-          return cond;
-        });
-        q = q.or(
-          rebuildOrString(
-            this.transformOrConditions(conditions, encryptedIndexes)
-          )
-        );
-      }
-    }
-    for (let i = 0; i < this.rawFilters.length; i++) {
-      const rf = this.rawFilters[i];
-      const value = rawValueMap.has(i) ? rawValueMap.get(i) : rf.value;
-      q = q.filter(this.filterColumnName(rf.column), rf.operator, value);
-    }
-    return q;
-  }
-  // ---------------------------------------------------------------------------
-  // Dialect seams — every default preserves the v2 behaviour byte-for-byte.
-  // The v3 builder (see ./query-builder-v3) overrides these for native
-  // `eql_v3.*` domain columns.
-  // ---------------------------------------------------------------------------
-  /**
-   * Map a filter's column name to the DB column name PostgREST must see.
-   * v2 schemas key columns by their DB name already, so this is the identity;
-   * the v3 dialect resolves a JS property name to its DB name.
-   */
-  filterColumnName(column) {
-    return column;
-  }
-  /**
-   * Apply a `like`/`ilike` filter. v2 relies on the `~~` operator defined on
-   * `eql_v2_encrypted`; the v3 dialect overrides this for encrypted columns
-   * because the `eql_v3.*` domains expose free-text match via `@>`
-   * (PostgREST `cs`) rather than a LIKE operator.
-   */
-  applyPatternFilter(q, column, op, value, _wasEncrypted) {
-    return op === "like" ? q.like(column, value) : q.ilike(column, value);
-  }
-  /**
-   * The PostgREST operator to use for a `.not()` filter. The v3 dialect maps
-   * `like`/`ilike` on encrypted columns to `cs` (see applyPatternFilter).
-   */
-  notFilterOperator(op, _wasEncrypted) {
-    return op;
-  }
-  /**
-   * Transform `.or()` conditions before the or-string is rebuilt. The v3
-   * dialect maps property names to DB names and `like`/`ilike` on encrypted
-   * conditions to `cs`.
-   */
-  transformOrConditions(conditions, _encryptedIndexes) {
-    return conditions;
-  }
-  /**
-   * Post-process a decrypted result row. The v3 dialect reconstructs `Date`
-   * values from the encrypt-config `cast_as`; v2 returns rows unchanged.
-   */
-  postprocessDecryptedRow(row) {
-    return row;
-  }
-  // ---------------------------------------------------------------------------
-  // Step 5: Decrypt results
-  // ---------------------------------------------------------------------------
-  async decryptResults(result) {
-    if (result.error) {
-      return {
-        data: null,
-        error: {
-          message: result.error.message,
-          details: result.error.details,
-          hint: result.error.hint,
-          code: result.error.code
-        },
-        count: result.count ?? null,
-        status: result.status,
-        statusText: result.statusText
-      };
-    }
-    if (result.data === null || result.data === void 0) {
-      return {
-        data: null,
-        error: null,
-        count: result.count ?? null,
-        status: result.status,
-        statusText: result.statusText
-      };
-    }
-    const hasSelect = this.selectColumns !== null;
-    const hasMutationWithReturning = this.mutation !== null && hasSelect;
-    if (!hasSelect && !hasMutationWithReturning) {
-      return {
-        data: result.data,
-        error: null,
-        count: result.count ?? null,
-        status: result.status,
-        statusText: result.statusText
-      };
-    }
-    if (this.resultMode === "single" || this.resultMode === "maybeSingle") {
-      if (result.data === null) {
-        return {
-          data: null,
-          error: null,
-          count: result.count ?? null,
-          status: result.status,
-          statusText: result.statusText
-        };
-      }
-      const baseDecryptOp = this.encryptionClient.decryptModel(
-        result.data
-      );
-      const decryptOp = this.lockContext ? baseDecryptOp.withLockContext(this.lockContext) : baseDecryptOp;
-      if (this.auditConfig) decryptOp.audit(this.auditConfig);
-      const decrypted2 = await decryptOp;
-      if (decrypted2.failure) {
-        logger.error(
-          `Supabase: failed to decrypt model for table "${this.tableName}"`
-        );
-        throw new EncryptionFailedError(
-          `Failed to decrypt model: ${decrypted2.failure.message}`,
-          decrypted2.failure
-        );
-      }
-      return {
-        data: this.postprocessDecryptedRow(
-          decrypted2.data
-        ),
-        error: null,
-        count: result.count ?? null,
-        status: result.status,
-        statusText: result.statusText
-      };
-    }
-    const dataArray = result.data;
-    if (dataArray.length === 0) {
-      return {
-        data: [],
-        error: null,
-        count: result.count ?? null,
-        status: result.status,
-        statusText: result.statusText
-      };
-    }
-    const baseBulkDecryptOp = this.encryptionClient.bulkDecryptModels(dataArray);
-    const bulkDecryptOp = this.lockContext ? baseBulkDecryptOp.withLockContext(this.lockContext) : baseBulkDecryptOp;
-    if (this.auditConfig) bulkDecryptOp.audit(this.auditConfig);
-    const decrypted = await bulkDecryptOp;
-    if (decrypted.failure) {
-      logger.error(
-        `Supabase: failed to decrypt models for table "${this.tableName}"`
-      );
-      throw new EncryptionFailedError(
-        `Failed to decrypt models: ${decrypted.failure.message}`,
-        decrypted.failure
-      );
-    }
-    return {
-      data: decrypted.data.map(
-        (row) => this.postprocessDecryptedRow(row)
-      ),
-      error: null,
-      count: result.count ?? null,
-      status: result.status,
-      statusText: result.statusText
-    };
-  }
-  // ---------------------------------------------------------------------------
-  // Helpers
-  // ---------------------------------------------------------------------------
-  getColumnMap() {
-    const map = {};
-    const schema = this.schema;
-    for (const colName of this.encryptedColumnNames) {
-      const col = schema[colName];
-      if (col instanceof EncryptedColumn) {
-        map[colName] = col;
-      }
-    }
-    return map;
-  }
-};
-var EncryptionFailedError = class extends Error {
-  encryptionError;
-  constructor(message, encryptionError) {
-    super(message);
-    this.name = "EncryptionFailedError";
-    this.encryptionError = encryptionError;
-  }
-};
-
-// src/supabase/query-builder-v3.ts
-var EncryptedQueryBuilderV3Impl = class extends EncryptedQueryBuilderImpl {
-  v3Table;
-  /** JS property name → DB column name, for every encrypted column. */
-  propToDb;
-  /** Built column schemas keyed by DB column name (for `cast_as`). */
-  columnSchemas;
-  /** Column builders keyed by BOTH property name and DB name. */
-  v3Columns;
-  /**
-   * Result-row key → DB column name for the columns the current select
-   * produces, including user-chosen PostgREST aliases (`ts:created_at` keys
-   * rows by `ts`). Populated by {@link buildSelectString}; consumed by
-   * {@link postprocessDecryptedRow} so aliased date columns still get `Date`
-   * reconstruction.
-   */
-  selectKeyToDb = {};
-  constructor(tableName, table, encryptionClient, supabaseClient) {
-    super(
-      tableName,
-      // The base class only ever calls BuildableTable members on the schema
-      // (build / encryptModel plumbing); every v2-specific behaviour is
-      // overridden below.
-      table,
-      encryptionClient,
-      supabaseClient
-    );
-    this.v3Table = table;
-    this.propToDb = table.buildColumnKeyMap();
-    this.columnSchemas = table.build().columns;
-    this.v3Columns = {};
-    for (const [property, builder] of Object.entries(table.columnBuilders)) {
-      if (builder instanceof EncryptedV3Column) {
-        const col = builder;
-        this.v3Columns[property] = col;
-        this.v3Columns[col.getName()] = col;
-      }
-    }
-    this.encryptedColumnNames = Object.keys(this.v3Columns);
-  }
-  // ---------------------------------------------------------------------------
-  // Dialect overrides
-  // ---------------------------------------------------------------------------
-  getColumnMap() {
-    return this.v3Columns;
-  }
-  filterColumnName(column) {
-    return this.propToDb[column] ?? column;
-  }
-  buildSelectString() {
-    if (this.selectColumns === null) return null;
-    const { select, keyToDb } = addJsonbCastsV3(
-      this.selectColumns,
-      this.propToDb
-    );
-    this.selectKeyToDb = keyToDb;
-    return select;
-  }
-  /** v3 domains are plain jsonb — send the raw payload, keyed by DB name. */
-  transformEncryptedMutationModel(model) {
-    const out = {};
-    for (const [key, value] of Object.entries(model)) {
-      out[this.propToDb[key] ?? key] = value;
-    }
-    return out;
-  }
-  transformEncryptedMutationModels(models) {
-    return models.map((model) => this.transformEncryptedMutationModel(model));
-  }
-  /**
-   * Encrypt every filter operand as a full storage envelope (see the class
-   * doc for why `encryptQuery` terms cannot be used), serialized to jsonb
-   * text for the PostgREST filter value.
-   *
-   * INTERIM + single swap point. The full-envelope operand is a tracked
-   * workaround (Linear CIP-3402), not the design: it carries a real
-   * decryptable ciphertext `c` plus ALL of the column's index terms, and
-   * PostgREST filters travel in GET query strings — so operands can land in
-   * URL logs, proxies, and Supabase request logs (query terms are meant to
-   * be index-terms-only). When the EQL term-only scalar query envelope (the
-   * scalar analog of `eql_v3.jsonb_query`) ships, swapping the encryption
-   * call inside THIS method — and its `JSON.stringify` wire encoding — must
-   * be the ONLY change needed: every consuming seam (filter application,
-   * `or`/`not` transforms, the wire-operator remap) treats the returned
-   * operand as an opaque, already-encoded string and is encoding-agnostic.
-   * Do not let operand-encoding knowledge leak out of this method.
-   */
-  async encryptCollectedTerms(terms) {
-    return Promise.all(
-      terms.map(async (term) => {
-        const column = term.column;
-        const queryType = term.queryType ?? "equality";
-        const capabilities = column.getQueryCapabilities();
-        if (term.value == null) {
-          throw new Error(
-            `[supabase v3]: cannot encrypt a null filter value for column "${column.getName()}" \u2014 use .is('${column.getName()}', null) for NULL checks`
-          );
-        }
-        if (queryType !== "equality" && queryType !== "orderAndRange" && queryType !== "freeTextSearch") {
-          throw new Error(
-            `[supabase v3]: query type "${queryType}" is not supported on scalar eql_v3 columns`
-          );
-        }
-        if (!capabilities[queryType]) {
-          throw new Error(
-            `[supabase v3]: column "${column.getName()}" (${column.getEqlType()}) does not support ${queryType} queries \u2014 declare the column with a domain that carries that capability`
-          );
-        }
-        const baseOp = this.encryptionClient.encrypt(term.value, {
-          column,
-          table: this.v3Table
-        });
-        const op = this.lockContext ? baseOp.withLockContext(this.lockContext) : baseOp;
-        if (this.auditConfig) op.audit(this.auditConfig);
-        const result = await op;
-        if (result.failure) {
-          logger.error(
-            `Supabase: failed to encrypt query terms for table "${this.tableName}"`
-          );
-          throw new EncryptionFailedError(
-            `Failed to encrypt query terms: ${result.failure.message}`,
-            result.failure
-          );
-        }
-        return JSON.stringify(result.data);
-      })
-    );
-  }
-  /**
-   * The single source of the encrypted wire-operator remap: `like`/`ilike`
-   * on an encrypted column become PostgREST `cs` (bloom-filter `@>`) — the
-   * `eql_v3.*` domains define no LIKE operator. Every pattern-bearing seam
-   * (`applyPatternFilter`, `notFilterOperator`, `transformOrConditions`)
-   * derives its operator here so they cannot drift apart.
-   */
-  encryptedFilterOp(op, wasEncrypted) {
-    return wasEncrypted && (op === "like" || op === "ilike") ? "cs" : op;
-  }
-  /** Encrypted pattern filters go through the bloom-filter `@>` (`cs`). */
-  applyPatternFilter(q, column, op, value, wasEncrypted) {
-    const wireOp = this.encryptedFilterOp(op, wasEncrypted);
-    if (wireOp !== op) {
-      return q.filter(column, wireOp, value);
-    }
-    return super.applyPatternFilter(q, column, op, value, wasEncrypted);
-  }
-  notFilterOperator(op, wasEncrypted) {
-    return this.encryptedFilterOp(op, wasEncrypted);
-  }
-  transformOrConditions(conditions, encryptedIndexes) {
-    return conditions.map((cond, j) => ({
-      ...cond,
-      column: this.filterColumnName(cond.column),
-      op: this.encryptedFilterOp(cond.op, encryptedIndexes.has(j))
-    }));
-  }
-  /** Rebuild `Date` values from the encrypt-config `cast_as`, mirroring the
-   * typed v3 client's decrypt-model path. */
-  postprocessDecryptedRow(row) {
-    const keyToDb = { ...this.selectKeyToDb };
-    for (const [property, dbName] of Object.entries(this.propToDb)) {
-      keyToDb[property] ??= dbName;
-      keyToDb[dbName] ??= dbName;
-    }
-    const out = { ...row };
-    for (const [key, dbName] of Object.entries(keyToDb)) {
-      const castAs = this.columnSchemas[dbName]?.cast_as;
-      if (castAs !== "date" && castAs !== "timestamp") continue;
-      const value = out[key];
-      if (value == null || value instanceof Date) continue;
-      if (typeof value === "string" || typeof value === "number") {
-        out[key] = new Date(value);
-      }
-    }
-    return out;
-  }
-};
-
-// src/supabase/index.ts
-function encryptedSupabase(config) {
-  const { encryptionClient, supabaseClient } = config;
-  return {
-    from(tableName, schema) {
-      return new EncryptedQueryBuilderImpl(
-        tableName,
-        schema,
-        encryptionClient,
-        supabaseClient
-      );
-    }
-  };
-}
-function encryptedSupabaseV3(config) {
-  const { encryptionClient, supabaseClient } = config;
-  return {
-    from(tableName, table) {
-      return new EncryptedQueryBuilderV3Impl(
-        tableName,
-        table,
-        encryptionClient,
-        supabaseClient
-      );
-    }
-  };
-}
-export {
-  encryptedSupabase,
-  encryptedSupabaseV3
-};
-//# sourceMappingURL=index.js.map