@cipherstash/stack 0.2.0 → 0.4.0

package/dist/secrets/index.cjs

@@ -41,15 +41,9 @@ function encryptedToPgComposite(obj) {
   };
 }
 function encryptedToCompositeLiteral(obj) {
-  if (obj === null) {
-    throw new Error("encryptedToCompositeLiteral: obj cannot be null");
-  }
   return `(${JSON.stringify(JSON.stringify(obj))})`;
 }
 function encryptedToEscapedCompositeLiteral(obj) {
-  if (obj === null) {
-    throw new Error("encryptedToEscapedCompositeLiteral: obj cannot be null");
-  }
   return JSON.stringify(encryptedToCompositeLiteral(obj));
 }
 function formatEncryptedResult(encrypted, returnType) {
@@ -89,7 +83,7 @@ var EncryptionErrorTypes = {
 
 // src/schema/index.ts
 var import_zod = require("zod");
-var castAsEnum = import_zod.z.enum(["bigint", "boolean", "date", "number", "string", "json"]).default("string");
+var castAsEnum = import_zod.z.enum(["bigint", "boolean", "date", "number", "string", "json", "text"]).default("text");
 var tokenFilterSchema = import_zod.z.object({
   kind: import_zod.z.literal("downcase")
 });
@@ -132,28 +126,28 @@ var encryptConfigSchema = import_zod.z.object({
   v: import_zod.z.number(),
   tables: tablesSchema
 });
-var ProtectValue = class {
+var EncryptedField = class {
   valueName;
   castAsValue;
   constructor(valueName) {
     this.valueName = valueName;
-    this.castAsValue = "string";
+    this.castAsValue = "text";
   }
   /**
-   * Set or override the plaintext data type for this value.
+   * Set or override the plaintext data type for this field.
    *
    * By default all values are treated as `'string'`. Use this method to specify
    * a different type so the encryption layer knows how to encode the plaintext
    * before encrypting.
    *
-   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'bigint'`, or `'json'`.
-   * @returns This `ProtectValue` instance for method chaining.
+   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'text'`, `'bigint'`, or `'json'`.
+   * @returns This `EncryptedField` instance for method chaining.
    *
    * @example
    * ```typescript
-   * import { encryptedValue } from "@cipherstash/stack/schema"
+   * import { encryptedField } from "@cipherstash/stack/schema"
    *
-   * const age = encryptedValue("age").dataType("number")
+   * const age = encryptedField("age").dataType("number")
    * ```
    */
   dataType(castAs) {
@@ -162,7 +156,7 @@ var ProtectValue = class {
   }
   build() {
     return {
-      cast_as: this.castAsValue,
+      cast_as: this.castAsValue === "string" ? "text" : this.castAsValue,
       indexes: {}
     };
   }
@@ -170,7 +164,7 @@ var ProtectValue = class {
     return this.valueName;
   }
 };
-var ProtectColumn = class {
+var EncryptedColumn = class {
   columnName;
   castAsValue;
   indexesValue = {};
@@ -186,7 +180,7 @@ var ProtectColumn = class {
    * before encrypting.
    *
    * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'bigint'`, or `'json'`.
-   * @returns This `ProtectColumn` instance for method chaining.
+   * @returns This `EncryptedColumn` instance for method chaining.
    *
    * @example
    * ```typescript
@@ -205,7 +199,7 @@ var ProtectColumn = class {
    * ORE allows sorting, comparison, and range queries on encrypted data.
    * Use with `encryptQuery` and `queryType: 'orderAndRange'`.
    *
-   * @returns This `ProtectColumn` instance for method chaining.
+   * @returns This `EncryptedColumn` instance for method chaining.
    *
    * @example
    * ```typescript
@@ -228,7 +222,7 @@ var ProtectColumn = class {
    *
    * @param tokenFilters - Optional array of token filters (e.g. `[{ kind: 'downcase' }]`).
    *   When omitted, no token filters are applied.
-   * @returns This `ProtectColumn` instance for method chaining.
+   * @returns This `EncryptedColumn` instance for method chaining.
    *
    * @example
    * ```typescript
@@ -253,7 +247,7 @@ var ProtectColumn = class {
    *
    * @param opts - Optional match index configuration. Defaults to 3-character ngram
    *   tokenization with a downcase filter, `k=6`, `m=2048`, and `include_original=true`.
-   * @returns This `ProtectColumn` instance for method chaining.
+   * @returns This `EncryptedColumn` instance for method chaining.
    *
    * @example
    * ```typescript
@@ -298,7 +292,7 @@ var ProtectColumn = class {
    * the plaintext type: strings become selector queries, objects/arrays become
    * containment queries.
    *
-   * @returns This `ProtectColumn` instance for method chaining.
+   * @returns This `EncryptedColumn` instance for method chaining.
    *
    * @example
    * ```typescript
@@ -316,7 +310,7 @@ var ProtectColumn = class {
   }
   build() {
     return {
-      cast_as: this.castAsValue,
+      cast_as: this.castAsValue === "string" ? "text" : this.castAsValue,
       indexes: this.indexesValue
     };
   }
@@ -324,7 +318,7 @@ var ProtectColumn = class {
     return this.columnName;
   }
 };
-var ProtectTable = class {
+var EncryptedTable = class {
   constructor(tableName, columnBuilders) {
     this.tableName = tableName;
     this.columnBuilders = columnBuilders;
@@ -351,7 +345,7 @@ var ProtectTable = class {
   build() {
     const builtColumns = {};
     const processColumn = (builder, colName) => {
-      if (builder instanceof ProtectColumn) {
+      if (builder instanceof EncryptedColumn) {
         const builtColumn = builder.build();
         if (builtColumn.cast_as === "json" && builtColumn.indexes.ste_vec?.prefix === "enabled") {
           builtColumns[colName] = {
@@ -368,7 +362,7 @@ var ProtectTable = class {
         }
       } else {
         for (const [key, value] of Object.entries(builder)) {
-          if (value instanceof ProtectValue) {
+          if (value instanceof EncryptedField) {
             builtColumns[value.getName()] = value.build();
           } else {
             processColumn(value, key);
@@ -386,7 +380,10 @@ var ProtectTable = class {
   }
 };
 function encryptedTable(tableName, columns) {
-  const tableBuilder = new ProtectTable(tableName, columns);
+  const tableBuilder = new EncryptedTable(
+    tableName,
+    columns
+  );
   for (const [colName, colBuilder] of Object.entries(columns)) {
     ;
     tableBuilder[colName] = colBuilder;
@@ -394,7 +391,7 @@ function encryptedTable(tableName, columns) {
   return tableBuilder;
 }
 function encryptedColumn(columnName) {
-  return new ProtectColumn(columnName);
+  return new EncryptedColumn(columnName);
 }
 function buildEncryptConfig(...protectTables) {
   const config = {
@@ -488,7 +485,7 @@ function initStackLogger(config) {
   const rates = samplingFromEnv();
   (0, import_evlog.initLogger)({
     env: { service: "@cipherstash/stack" },
-    enabled: config?.enabled ?? true,
+    enabled: config?.enabled ?? !!rates,
     pretty: config?.pretty,
     ...rates && { sampling: { rates } },
     ...config?.drain && { drain: config.drain }
@@ -501,7 +498,11 @@ function safeMessage(args) {
 var logger = {
   debug(...args) {
     const log = (0, import_evlog.createRequestLogger)();
-    log.set({ level: "debug", source: "@cipherstash/stack", message: safeMessage(args) });
+    log.set({
+      level: "debug",
+      source: "@cipherstash/stack",
+      message: safeMessage(args)
+    });
     log.emit();
   },
   info(...args) {
@@ -522,22 +523,22 @@ var logger = {
   }
 };
 
-// src/encryption/ffi/index.ts
+// src/encryption/index.ts
 var import_result11 = require("@byteslice/result");
 var import_protect_ffi9 = require("@cipherstash/protect-ffi");
 
-// src/encryption/ffi/helpers/type-guards.ts
+// src/encryption/helpers/type-guards.ts
 function isScalarQueryTermArray(value) {
   return Array.isArray(value) && value.length > 0 && typeof value[0] === "object" && value[0] !== null && "column" in value[0] && "table" in value[0];
 }
 
-// src/encryption/ffi/helpers/error-code.ts
+// src/encryption/helpers/error-code.ts
 var import_protect_ffi = require("@cipherstash/protect-ffi");
 function getErrorCode(error) {
   return error instanceof import_protect_ffi.ProtectError ? error.code : void 0;
 }
 
-// src/encryption/ffi/operations/batch-encrypt-query.ts
+// src/encryption/operations/batch-encrypt-query.ts
 var import_result = require("@byteslice/result");
 var import_protect_ffi2 = require("@cipherstash/protect-ffi");
 
@@ -555,7 +556,7 @@ var queryTypeToQueryOp = {
   steVecTerm: "ste_vec_term"
 };
 
-// src/encryption/ffi/helpers/infer-index-type.ts
+// src/encryption/helpers/infer-index-type.ts
 function inferIndexType(column) {
   const config = column.build();
   const indexes = config.indexes;
@@ -615,7 +616,7 @@ function resolveIndexType(column, queryType, plaintext) {
   return { indexType };
 }
 
-// src/encryption/ffi/helpers/validation.ts
+// src/encryption/helpers/validation.ts
 function validateNumericValue(value) {
   if (typeof value === "number" && Number.isNaN(value)) {
     return {
@@ -651,7 +652,7 @@ function assertValueIndexCompatibility(value, indexType, columnName) {
   }
 }
 
-// src/encryption/ffi/operations/base-operation.ts
+// src/encryption/operations/base-operation.ts
 var EncryptionOperation = class {
   auditMetadata;
   /**
@@ -679,19 +680,7 @@ var EncryptionOperation = class {
   }
 };
 
-// src/encryption/ffi/operations/batch-encrypt-query.ts
-function filterNullTerms(terms) {
-  const nullIndices = /* @__PURE__ */ new Set();
-  const nonNullTerms = [];
-  terms.forEach((term, index) => {
-    if (term.value === null || term.value === void 0) {
-      nullIndices.add(index);
-    } else {
-      nonNullTerms.push({ term, originalIndex: index });
-    }
-  });
-  return { nullIndices, nonNullTerms };
-}
+// src/encryption/operations/batch-encrypt-query.ts
 function buildQueryPayload(term, lockContext) {
   assertValidNumericValue(term.value);
   const { indexType, queryOp } = resolveIndexType(
@@ -712,13 +701,10 @@ function buildQueryPayload(term, lockContext) {
   }
   return payload;
 }
-function assembleResults(totalLength, encryptedValues, nonNullTerms) {
-  const results = new Array(totalLength).fill(null);
-  nonNullTerms.forEach(({ term, originalIndex }, i) => {
-    const encrypted = encryptedValues[i];
-    results[originalIndex] = formatEncryptedResult(encrypted, term.returnType);
-  });
-  return results;
+function assembleResults(terms, encryptedValues) {
+  return terms.map(
+    (term, i) => formatEncryptedResult(encryptedValues[i], term.returnType)
+  );
 }
 var BatchEncryptQueryOperation = class extends EncryptionOperation {
   constructor(client, terms) {
@@ -745,23 +731,18 @@ var BatchEncryptQueryOperation = class extends EncryptionOperation {
       log.emit();
       return { data: [] };
     }
-    const { nullIndices, nonNullTerms } = filterNullTerms(this.terms);
-    if (nonNullTerms.length === 0) {
-      log.emit();
-      return { data: this.terms.map(() => null) };
-    }
     const result = await (0, import_result.withResult)(
       async () => {
         if (!this.client) throw noClientError();
         const { metadata } = this.getAuditData();
-        const queries = nonNullTerms.map(
-          ({ term }) => buildQueryPayload(term)
+        const queries = this.terms.map(
+          (term) => buildQueryPayload(term)
         );
         const encrypted = await (0, import_protect_ffi2.encryptQueryBulk)(this.client, {
           queries,
           unverifiedContext: metadata
         });
-        return assembleResults(this.terms.length, encrypted, nonNullTerms);
+        return assembleResults(this.terms, encrypted);
       },
       (error) => {
         log.set({ errorCode: getErrorCode(error) ?? "unknown" });
@@ -795,11 +776,6 @@ var BatchEncryptQueryOperationWithLockContext = class extends EncryptionOperatio
       log.emit();
       return { data: [] };
     }
-    const { nullIndices, nonNullTerms } = filterNullTerms(this.terms);
-    if (nonNullTerms.length === 0) {
-      log.emit();
-      return { data: this.terms.map(() => null) };
-    }
     const lockContextResult = await this.lockContext.getLockContext();
     if (lockContextResult.failure) {
       log.emit();
@@ -810,15 +786,15 @@ var BatchEncryptQueryOperationWithLockContext = class extends EncryptionOperatio
       async () => {
         if (!this.client) throw noClientError();
         const { metadata } = this.getAuditData();
-        const queries = nonNullTerms.map(
-          ({ term }) => buildQueryPayload(term, context)
+        const queries = this.terms.map(
+          (term) => buildQueryPayload(term, context)
         );
         const encrypted = await (0, import_protect_ffi2.encryptQueryBulk)(this.client, {
           queries,
           serviceToken: ctsToken,
           unverifiedContext: metadata
         });
-        return assembleResults(this.terms.length, encrypted, nonNullTerms);
+        return assembleResults(this.terms, encrypted);
       },
       (error) => {
         log.set({ errorCode: getErrorCode(error) ?? "unknown" });
@@ -834,46 +810,29 @@ var BatchEncryptQueryOperationWithLockContext = class extends EncryptionOperatio
   }
 };
 
-// src/encryption/ffi/operations/bulk-decrypt.ts
+// src/encryption/operations/bulk-decrypt.ts
 var import_result2 = require("@byteslice/result");
 var import_protect_ffi3 = require("@cipherstash/protect-ffi");
 var createDecryptPayloads = (encryptedPayloads, lockContext) => {
-  return encryptedPayloads.map((item, index) => ({ ...item, originalIndex: index })).filter(({ data }) => data !== null).map(({ id, data, originalIndex }) => ({
+  return encryptedPayloads.map(({ id, data }) => ({
     id,
     ciphertext: data,
-    originalIndex,
     ...lockContext && { lockContext }
   }));
 };
-var createNullResult = (encryptedPayloads) => {
-  return encryptedPayloads.map(({ id }) => ({
-    id,
-    data: null
-  }));
-};
 var mapDecryptedDataToResult = (encryptedPayloads, decryptedData) => {
-  const result = new Array(encryptedPayloads.length);
-  let decryptedIndex = 0;
-  for (let i = 0; i < encryptedPayloads.length; i++) {
-    if (encryptedPayloads[i].data === null) {
-      result[i] = { id: encryptedPayloads[i].id, data: null };
-    } else {
-      const decryptResult = decryptedData[decryptedIndex];
-      if ("error" in decryptResult) {
-        result[i] = {
-          id: encryptedPayloads[i].id,
-          error: decryptResult.error
-        };
-      } else {
-        result[i] = {
-          id: encryptedPayloads[i].id,
-          data: decryptResult.data
-        };
-      }
-      decryptedIndex++;
+  return decryptedData.map((decryptResult, i) => {
+    if ("error" in decryptResult) {
+      return {
+        id: encryptedPayloads[i].id,
+        error: decryptResult.error
+      };
     }
-  }
-  return result;
+    return {
+      id: encryptedPayloads[i].id,
+      data: decryptResult.data
+    };
+  });
 };
 var BulkDecryptOperation = class extends EncryptionOperation {
   client;
@@ -898,13 +857,10 @@ var BulkDecryptOperation = class extends EncryptionOperation {
         if (!this.client) throw noClientError();
         if (!this.encryptedPayloads || this.encryptedPayloads.length === 0)
           return [];
-        const nonNullPayloads = createDecryptPayloads(this.encryptedPayloads);
-        if (nonNullPayloads.length === 0) {
-          return createNullResult(this.encryptedPayloads);
-        }
+        const payloads = createDecryptPayloads(this.encryptedPayloads);
         const { metadata } = this.getAuditData();
         const decryptedData = await (0, import_protect_ffi3.decryptBulkFallible)(this.client, {
-          ciphertexts: nonNullPayloads,
+          ciphertexts: payloads,
           unverifiedContext: metadata
         });
         return mapDecryptedDataToResult(this.encryptedPayloads, decryptedData);
@@ -956,16 +912,13 @@ var BulkDecryptOperationWithLockContext = class extends EncryptionOperation {
         if (context.failure) {
           throw new Error(`[encryption]: ${context.failure.message}`);
         }
-        const nonNullPayloads = createDecryptPayloads(
+        const payloads = createDecryptPayloads(
           encryptedPayloads,
           context.data.context
         );
-        if (nonNullPayloads.length === 0) {
-          return createNullResult(encryptedPayloads);
-        }
         const { metadata } = this.getAuditData();
         const decryptedData = await (0, import_protect_ffi3.decryptBulkFallible)(client, {
-          ciphertexts: nonNullPayloads,
+          ciphertexts: payloads,
           serviceToken: context.data.ctsToken,
           unverifiedContext: metadata
         });
@@ -985,10 +938,10 @@ var BulkDecryptOperationWithLockContext = class extends EncryptionOperation {
   }
 };
 
-// src/encryption/ffi/operations/bulk-decrypt-models.ts
+// src/encryption/operations/bulk-decrypt-models.ts
 var import_result3 = require("@byteslice/result");
 
-// src/encryption/ffi/model-helpers.ts
+// src/encryption/helpers/model-helpers.ts
 var import_protect_ffi4 = require("@cipherstash/protect-ffi");
 function setNestedValue(obj, path2, value) {
   const FORBIDDEN_KEYS = ["__proto__", "prototype", "constructor"];
@@ -1503,7 +1456,7 @@ async function bulkEncryptModelsWithLockContext(models, table, client, lockConte
   });
 }
 
-// src/encryption/ffi/operations/bulk-decrypt-models.ts
+// src/encryption/operations/bulk-decrypt-models.ts
 var BulkDecryptModelsOperation = class extends EncryptionOperation {
   client;
   models;
@@ -1600,38 +1553,18 @@ var BulkDecryptModelsOperationWithLockContext = class extends EncryptionOperatio
   }
 };
 
-// src/encryption/ffi/operations/bulk-encrypt.ts
+// src/encryption/operations/bulk-encrypt.ts
 var import_result4 = require("@byteslice/result");
 var import_protect_ffi5 = require("@cipherstash/protect-ffi");
 var createEncryptPayloads = (plaintexts, column, table, lockContext) => {
-  return plaintexts.map((item, index) => ({ ...item, originalIndex: index })).filter(({ plaintext }) => plaintext !== null).map(({ id, plaintext, originalIndex }) => ({
+  return plaintexts.map(({ id, plaintext }) => ({
     id,
     plaintext,
     column: column.getName(),
     table: table.tableName,
-    originalIndex,
     ...lockContext && { lockContext }
   }));
 };
-var createNullResult2 = (plaintexts) => {
-  return plaintexts.map(({ id }) => ({ id, data: null }));
-};
-var mapEncryptedDataToResult = (plaintexts, encryptedData) => {
-  const result = new Array(plaintexts.length);
-  let encryptedIndex = 0;
-  for (let i = 0; i < plaintexts.length; i++) {
-    if (plaintexts[i].plaintext === null) {
-      result[i] = { id: plaintexts[i].id, data: null };
-    } else {
-      result[i] = {
-        id: plaintexts[i].id,
-        data: encryptedData[encryptedIndex]
-      };
-      encryptedIndex++;
-    }
-  }
-  return result;
-};
 var BulkEncryptOperation = class extends EncryptionOperation {
   client;
   plaintexts;
@@ -1664,20 +1597,20 @@ var BulkEncryptOperation = class extends EncryptionOperation {
         if (!this.plaintexts || this.plaintexts.length === 0) {
           return [];
         }
-        const nonNullPayloads = createEncryptPayloads(
+        const payloads = createEncryptPayloads(
           this.plaintexts,
           this.column,
           this.table
         );
-        if (nonNullPayloads.length === 0) {
-          return createNullResult2(this.plaintexts);
-        }
         const { metadata } = this.getAuditData();
         const encryptedData = await (0, import_protect_ffi5.encryptBulk)(this.client, {
-          plaintexts: nonNullPayloads,
+          plaintexts: payloads,
           unverifiedContext: metadata
         });
-        return mapEncryptedDataToResult(this.plaintexts, encryptedData);
+        return encryptedData.map((data, i) => ({
+          id: this.plaintexts[i].id,
+          data
+        }));
       },
       (error) => {
         log.set({ errorCode: getErrorCode(error) ?? "unknown" });
@@ -1734,22 +1667,22 @@ var BulkEncryptOperationWithLockContext = class extends EncryptionOperation {
         if (context.failure) {
           throw new Error(`[encryption]: ${context.failure.message}`);
         }
-        const nonNullPayloads = createEncryptPayloads(
+        const payloads = createEncryptPayloads(
           plaintexts,
           column,
           table,
           context.data.context
         );
-        if (nonNullPayloads.length === 0) {
-          return createNullResult2(plaintexts);
-        }
         const { metadata } = this.getAuditData();
         const encryptedData = await (0, import_protect_ffi5.encryptBulk)(client, {
-          plaintexts: nonNullPayloads,
+          plaintexts: payloads,
           serviceToken: context.data.ctsToken,
           unverifiedContext: metadata
         });
-        return mapEncryptedDataToResult(plaintexts, encryptedData);
+        return encryptedData.map((data, i) => ({
+          id: plaintexts[i].id,
+          data
+        }));
       },
       (error) => {
         log.set({ errorCode: getErrorCode(error) ?? "unknown" });
@@ -1765,7 +1698,7 @@ var BulkEncryptOperationWithLockContext = class extends EncryptionOperation {
   }
 };
 
-// src/encryption/ffi/operations/bulk-encrypt-models.ts
+// src/encryption/operations/bulk-encrypt-models.ts
 var import_result5 = require("@byteslice/result");
 var BulkEncryptModelsOperation = class extends EncryptionOperation {
   client;
@@ -1874,7 +1807,7 @@ var BulkEncryptModelsOperationWithLockContext = class extends EncryptionOperatio
   }
 };
 
-// src/encryption/ffi/operations/decrypt.ts
+// src/encryption/operations/decrypt.ts
 var import_result6 = require("@byteslice/result");
 var import_protect_ffi6 = require("@cipherstash/protect-ffi");
 var DecryptOperation = class extends EncryptionOperation {
@@ -1899,9 +1832,6 @@ var DecryptOperation = class extends EncryptionOperation {
         if (!this.client) {
           throw noClientError();
         }
-        if (this.encryptedData === null) {
-          return null;
-        }
         const { metadata } = this.getAuditData();
         return await (0, import_protect_ffi6.decrypt)(this.client, {
           ciphertext: this.encryptedData,
@@ -1952,9 +1882,6 @@ var DecryptOperationWithLockContext = class extends EncryptionOperation {
         if (!client) {
           throw noClientError();
         }
-        if (encryptedData === null) {
-          return null;
-        }
         const { metadata } = this.getAuditData();
         const context = await this.lockContext.getLockContext();
         if (context.failure) {
@@ -1981,7 +1908,7 @@ var DecryptOperationWithLockContext = class extends EncryptionOperation {
   }
 };
 
-// src/encryption/ffi/operations/decrypt-model.ts
+// src/encryption/operations/decrypt-model.ts
 var import_result7 = require("@byteslice/result");
 var DecryptModelOperation = class extends EncryptionOperation {
   client;
@@ -2077,7 +2004,7 @@ var DecryptModelOperationWithLockContext = class extends EncryptionOperation {
   }
 };
 
-// src/encryption/ffi/operations/encrypt.ts
+// src/encryption/operations/encrypt.ts
 var import_result8 = require("@byteslice/result");
 var import_protect_ffi7 = require("@cipherstash/protect-ffi");
 var EncryptOperation = class extends EncryptionOperation {
@@ -2108,9 +2035,6 @@ var EncryptOperation = class extends EncryptionOperation {
         if (!this.client) {
           throw noClientError();
         }
-        if (this.plaintext === null) {
-          return null;
-        }
         if (typeof this.plaintext === "number" && Number.isNaN(this.plaintext)) {
           throw new Error("[encryption]: Cannot encrypt NaN value");
         }
@@ -2172,9 +2096,6 @@ var EncryptOperationWithLockContext = class extends EncryptionOperation {
         if (!client) {
           throw noClientError();
         }
-        if (plaintext === null) {
-          return null;
-        }
         const { metadata } = this.getAuditData();
         const context = await this.lockContext.getLockContext();
         if (context.failure) {
@@ -2203,7 +2124,7 @@ var EncryptOperationWithLockContext = class extends EncryptionOperation {
   }
 };
 
-// src/encryption/ffi/operations/encrypt-model.ts
+// src/encryption/operations/encrypt-model.ts
 var import_result9 = require("@byteslice/result");
 var EncryptModelOperation = class extends EncryptionOperation {
   client;
@@ -2310,7 +2231,7 @@ var EncryptModelOperationWithLockContext = class extends EncryptionOperation {
   }
 };
 
-// src/encryption/ffi/operations/encrypt-query.ts
+// src/encryption/operations/encrypt-query.ts
 var import_result10 = require("@byteslice/result");
 var import_protect_ffi8 = require("@cipherstash/protect-ffi");
 var EncryptQueryOperation = class extends EncryptionOperation {
@@ -2338,10 +2259,6 @@ var EncryptQueryOperation = class extends EncryptionOperation {
       queryType: this.opts.queryType,
       lockContext: false
     });
-    if (this.plaintext === null || this.plaintext === void 0) {
-      log.emit();
-      return { data: null };
-    }
     const validationError = validateNumericValue(this.plaintext);
     if (validationError?.failure) {
       log.emit();
@@ -2405,10 +2322,6 @@ var EncryptQueryOperationWithLockContext = class extends EncryptionOperation {
       queryType: this.opts.queryType,
       lockContext: true
     });
-    if (this.plaintext === null || this.plaintext === void 0) {
-      log.emit();
-      return { data: null };
-    }
     const validationError = validateNumericValue(this.plaintext);
     if (validationError?.failure) {
       log.emit();
@@ -2460,9 +2373,9 @@ var EncryptQueryOperationWithLockContext = class extends EncryptionOperation {
   }
 };
 
-// src/encryption/ffi/index.ts
+// src/encryption/index.ts
 var noClientError = () => new Error(
-  "The EQL client has not been initialized. Please call init() before using the client."
+  "The Encryption client has not been initialized. Please call init() before using the client."
 );
 var EncryptionClient = class {
   client;
@@ -2485,7 +2398,7 @@ var EncryptionClient = class {
           config.encryptConfig
         );
         logger.debug(
-          "Initializing the Protect.js client with the following encrypt config:",
+          "Initializing the Encryption client with the following config:",
           {
             encryptConfig: validated
           }
@@ -2501,7 +2414,7 @@ var EncryptionClient = class {
           }
         });
         this.encryptConfig = validated;
-        logger.debug("Successfully initialized the Protect.js client.");
+        logger.debug("Successfully initialized the Encryption client.");
         return this;
       },
       (error) => ({
@@ -2513,8 +2426,8 @@ var EncryptionClient = class {
   /**
    * Encrypt a value - returns a promise which resolves to an encrypted value.
    *
-   * @param plaintext - The plaintext value to be encrypted. Can be null.
-   * @param opts - Options specifying the column and table for encryption.
+   * @param plaintext - The plaintext value to be encrypted.
+   * @param opts - Options specifying the column (or nested field) and table for encryption. See {@link EncryptOptions}.
    * @returns An EncryptOperation that can be awaited or chained with additional methods.
    *
    * @example
@@ -2577,8 +2490,11 @@ var EncryptionClient = class {
    *  .withLockContext(lockContext)
    * ```
    *
+   * @see {@link EncryptOptions}
    * @see {@link Result}
    * @see {@link encryptedTable}
+   * @see {@link encryptedColumn}
+   * @see {@link encryptedField}
    * @see {@link LockContext}
    * @see {@link EncryptOperation}
    */
@@ -2686,7 +2602,11 @@ var EncryptionClient = class {
    * ```
    */
   encryptModel(input, table) {
-    return new EncryptModelOperation(this.client, input, table);
+    return new EncryptModelOperation(
+      this.client,
+      input,
+      table
+    );
   }
   /**
    * Decrypt a model (object) whose fields contain encrypted values.
@@ -2765,7 +2685,11 @@ var EncryptionClient = class {
    * ```
    */
   bulkEncryptModels(input, table) {
-    return new BulkEncryptModelsOperation(this.client, input, table);
+    return new BulkEncryptModelsOperation(
+      this.client,
+      input,
+      table
+    );
   }
   /**
    * Decrypt multiple models (objects) in a single bulk operation.
@@ -2803,10 +2727,10 @@ var EncryptionClient = class {
    *
    * Each value is encrypted with its own unique key via a single call to ZeroKMS.
    * Values can include optional `id` fields for correlating results back to
-   * your application data. Null plaintext values are preserved as null.
+   * your application data.
    *
    * @param plaintexts - An array of objects with `plaintext` (and optional `id`) fields.
-   * @param opts - Options specifying the target column and table for encryption.
+   * @param opts - Options specifying the target column (or nested {@link encryptedField}) and table. See {@link EncryptOptions}.
    * @returns A `BulkEncryptOperation` that can be awaited to get a `Result`
    *   containing an array of `{ id?, data: Encrypted }` objects, or an `EncryptionError`.
    *
@@ -2824,7 +2748,6 @@ var EncryptionClient = class {
    *   [
    *     { id: "u1", plaintext: "alice@example.com" },
    *     { id: "u2", plaintext: "bob@example.com" },
-   *     { id: "u3", plaintext: null },
    *   ],
    *   { column: users.email, table: users },
    * )