@cipherstash/stack 0.2.0 → 0.4.0

package/dist/{client-D-ZH8SB2.d.cts → client-CUGXheRq.d.cts}

@@ -1,4 +1,4 @@
-import { k as EncryptedQueryResult, l as Client, S as ScalarQueryTerm, B as BulkDecryptedData, m as BulkDecryptPayload, D as Decrypted, n as BulkEncryptedData, o as BulkEncryptPayload, p as EncryptOptions, P as ProtectColumn, g as ProtectValue, d as ProtectTable, f as ProtectTableColumn, i as Encrypted, q as EncryptQueryOptions, Q as QueryTypeName, r as EncryptedReturnType, s as EncryptConfig, K as KeysetIdentifier, h as EncryptedFromSchema } from './types-public-Dfg-hkuQ.cjs';
+import { l as EncryptedQueryResult, m as Client, S as ScalarQueryTerm, B as BulkDecryptedData, n as BulkDecryptPayload, D as Decrypted, o as BulkEncryptedData, p as BulkEncryptPayload, q as EncryptOptions, d as EncryptedColumn, h as EncryptedField, f as EncryptedTable, g as EncryptedTableColumn, j as Encrypted, r as EncryptQueryOptions, Q as QueryTypeName, s as EncryptedReturnType, t as EncryptConfig, K as KeysetIdentifier, i as EncryptedFromSchema } from './types-public-Wj6tB_ux.cjs';
 import { a as EncryptionError, d as LockContext } from './index-9-Ya3fDK.cjs';
 import { Result } from '@byteslice/result';
 import { JsPlaintext } from '@cipherstash/protect-ffi';
@@ -99,8 +99,8 @@ declare class BulkEncryptOperation extends EncryptionOperation<BulkEncryptedData
     getOperation(): {
         client: Client;
         plaintexts: BulkEncryptPayload;
-        column: ProtectColumn | ProtectValue;
-        table: ProtectTable<ProtectTableColumn>;
+        column: EncryptedColumn | EncryptedField;
+        table: EncryptedTable<EncryptedTableColumn>;
     };
 }
 declare class BulkEncryptOperationWithLockContext extends EncryptionOperation<BulkEncryptedData> {
@@ -114,13 +114,13 @@ declare class BulkEncryptModelsOperation<T extends Record<string, unknown>> exte
     private client;
     private models;
     private table;
-    constructor(client: Client, models: Record<string, unknown>[], table: ProtectTable<ProtectTableColumn>);
+    constructor(client: Client, models: Record<string, unknown>[], table: EncryptedTable<EncryptedTableColumn>);
     withLockContext(lockContext: LockContext): BulkEncryptModelsOperationWithLockContext<T>;
     execute(): Promise<Result<T[], EncryptionError>>;
     getOperation(): {
         client: Client;
         models: Record<string, unknown>[];
-        table: ProtectTable<ProtectTableColumn>;
+        table: EncryptedTable<EncryptedTableColumn>;
     };
 }
 declare class BulkEncryptModelsOperationWithLockContext<T extends Record<string, unknown>> extends EncryptionOperation<T[]> {
@@ -134,23 +134,23 @@ declare class BulkEncryptModelsOperationWithLockContext<T extends Record<string,
  * Decrypts an encrypted payload using the provided client.
  * This is the type returned by the {@link EncryptionClient.decrypt | decrypt} method of the {@link EncryptionClient}.
  */
-declare class DecryptOperation extends EncryptionOperation<JsPlaintext | null> {
+declare class DecryptOperation extends EncryptionOperation<JsPlaintext> {
     private client;
     private encryptedData;
     constructor(client: Client, encryptedData: Encrypted);
     withLockContext(lockContext: LockContext): DecryptOperationWithLockContext;
-    execute(): Promise<Result<JsPlaintext | null, EncryptionError>>;
+    execute(): Promise<Result<JsPlaintext, EncryptionError>>;
     getOperation(): {
         client: Client;
         encryptedData: Encrypted;
         auditData?: Record<string, unknown>;
     };
 }
-declare class DecryptOperationWithLockContext extends EncryptionOperation<JsPlaintext | null> {
+declare class DecryptOperationWithLockContext extends EncryptionOperation<JsPlaintext> {
     private operation;
     private lockContext;
     constructor(operation: DecryptOperation, lockContext: LockContext);
-    execute(): Promise<Result<JsPlaintext | null, EncryptionError>>;
+    execute(): Promise<Result<JsPlaintext, EncryptionError>>;
 }
 
 declare class DecryptModelOperation<T extends Record<string, unknown>> extends EncryptionOperation<Decrypted<T>> {
@@ -176,14 +176,14 @@ declare class EncryptOperation extends EncryptionOperation<Encrypted> {
     private plaintext;
     private column;
     private table;
-    constructor(client: Client, plaintext: JsPlaintext | null, opts: EncryptOptions);
+    constructor(client: Client, plaintext: JsPlaintext, opts: EncryptOptions);
     withLockContext(lockContext: LockContext): EncryptOperationWithLockContext;
     execute(): Promise<Result<Encrypted, EncryptionError>>;
     getOperation(): {
         client: Client;
-        plaintext: JsPlaintext | null;
-        column: ProtectColumn | ProtectValue;
-        table: ProtectTable<ProtectTableColumn>;
+        plaintext: JsPlaintext;
+        column: EncryptedColumn | EncryptedField;
+        table: EncryptedTable<EncryptedTableColumn>;
     };
 }
 declare class EncryptOperationWithLockContext extends EncryptionOperation<Encrypted> {
@@ -197,13 +197,13 @@ declare class EncryptModelOperation<T extends Record<string, unknown>> extends E
     private client;
     private model;
     private table;
-    constructor(client: Client, model: Record<string, unknown>, table: ProtectTable<ProtectTableColumn>);
+    constructor(client: Client, model: Record<string, unknown>, table: EncryptedTable<EncryptedTableColumn>);
     withLockContext(lockContext: LockContext): EncryptModelOperationWithLockContext<T>;
     execute(): Promise<Result<T, EncryptionError>>;
     getOperation(): {
         client: Client;
         model: Record<string, unknown>;
-        table: ProtectTable<ProtectTableColumn>;
+        table: EncryptedTable<EncryptedTableColumn>;
     };
 }
 declare class EncryptModelOperationWithLockContext<T extends Record<string, unknown>> extends EncryptionOperation<T> {
@@ -220,16 +220,16 @@ declare class EncryptQueryOperation extends EncryptionOperation<EncryptedQueryRe
     private client;
     private plaintext;
     private opts;
-    constructor(client: Client, plaintext: JsPlaintext | null, opts: EncryptQueryOptions);
+    constructor(client: Client, plaintext: JsPlaintext, opts: EncryptQueryOptions);
     withLockContext(lockContext: LockContext): EncryptQueryOperationWithLockContext;
     execute(): Promise<Result<EncryptedQueryResult, EncryptionError>>;
     getOperation(): {
-        column: ProtectColumn;
-        table: ProtectTable<ProtectTableColumn>;
+        column: EncryptedColumn;
+        table: EncryptedTable<EncryptedTableColumn>;
         queryType?: QueryTypeName;
         returnType?: EncryptedReturnType;
         client: Client;
-        plaintext: JsPlaintext | null;
+        plaintext: JsPlaintext;
     };
 }
 /**
@@ -240,11 +240,11 @@ declare class EncryptQueryOperationWithLockContext extends EncryptionOperation<E
     private plaintext;
     private opts;
     private lockContext;
-    constructor(client: Client, plaintext: JsPlaintext | null, opts: EncryptQueryOptions, lockContext: LockContext, auditMetadata?: Record<string, unknown>);
+    constructor(client: Client, plaintext: JsPlaintext, opts: EncryptQueryOptions, lockContext: LockContext, auditMetadata?: Record<string, unknown>);
     execute(): Promise<Result<EncryptedQueryResult, EncryptionError>>;
 }
 
-/** The EncryptionClient is the main entry point for interacting with the CipherStash Protect.js library.
+/** The EncryptionClient is the main entry point for interacting with the CipherStash Encryption library.
  * It provides methods for encrypting and decrypting individual values, as well as models (objects) and bulk operations.
  *
  * The client must be initialized using the {@link Encryption} function before it can be used.
@@ -271,8 +271,8 @@ declare class EncryptionClient {
     /**
      * Encrypt a value - returns a promise which resolves to an encrypted value.
      *
-     * @param plaintext - The plaintext value to be encrypted. Can be null.
-     * @param opts - Options specifying the column and table for encryption.
+     * @param plaintext - The plaintext value to be encrypted.
+     * @param opts - Options specifying the column (or nested field) and table for encryption. See {@link EncryptOptions}.
      * @returns An EncryptOperation that can be awaited or chained with additional methods.
      *
      * @example
@@ -335,16 +335,19 @@ declare class EncryptionClient {
      *  .withLockContext(lockContext)
      * ```
      *
+     * @see {@link EncryptOptions}
      * @see {@link Result}
      * @see {@link encryptedTable}
+     * @see {@link encryptedColumn}
+     * @see {@link encryptedField}
      * @see {@link LockContext}
      * @see {@link EncryptOperation}
      */
-    encrypt(plaintext: JsPlaintext | null, opts: EncryptOptions): EncryptOperation;
+    encrypt(plaintext: JsPlaintext, opts: EncryptOptions): EncryptOperation;
     /**
      * Encrypt a query value - returns a promise which resolves to an encrypted query value.
      *
-     * @param plaintext - The plaintext value to be encrypted for querying. Can be null.
+     * @param plaintext - The plaintext value to be encrypted for querying.
      * @param opts - Options specifying the column, table, and optional queryType for encryption.
      * @returns An EncryptQueryOperation that can be awaited or chained with additional methods.
      *
@@ -394,7 +397,7 @@ declare class EncryptionClient {
      * - String plaintext → `steVecSelector` (JSONPath queries like `'$.user.email'`)
      * - Object/Array plaintext → `steVecTerm` (containment queries like `{ role: 'admin' }`)
      */
-    encryptQuery(plaintext: JsPlaintext | null, opts: EncryptQueryOptions): EncryptQueryOperation;
+    encryptQuery(plaintext: JsPlaintext, opts: EncryptQueryOptions): EncryptQueryOperation;
     /**
      * Encrypt multiple values for use in queries (batch operation).
      * @param terms - Array of query terms to encrypt
@@ -479,7 +482,7 @@ declare class EncryptionClient {
      * }
      * ```
      */
-    encryptModel<T extends Record<string, unknown>, S extends ProtectTableColumn = ProtectTableColumn>(input: T, table: ProtectTable<S>): EncryptModelOperation<EncryptedFromSchema<T, S>>;
+    encryptModel<T extends Record<string, unknown>, S extends EncryptedTableColumn = EncryptedTableColumn>(input: T, table: EncryptedTable<S>): EncryptModelOperation<EncryptedFromSchema<T, S>>;
     /**
      * Decrypt a model (object) whose fields contain encrypted values.
      *
@@ -554,7 +557,7 @@ declare class EncryptionClient {
      * }
      * ```
      */
-    bulkEncryptModels<T extends Record<string, unknown>, S extends ProtectTableColumn = ProtectTableColumn>(input: Array<T>, table: ProtectTable<S>): BulkEncryptModelsOperation<EncryptedFromSchema<T, S>>;
+    bulkEncryptModels<T extends Record<string, unknown>, S extends EncryptedTableColumn = EncryptedTableColumn>(input: Array<T>, table: EncryptedTable<S>): BulkEncryptModelsOperation<EncryptedFromSchema<T, S>>;
     /**
      * Decrypt multiple models (objects) in a single bulk operation.
      *
@@ -589,10 +592,10 @@ declare class EncryptionClient {
      *
      * Each value is encrypted with its own unique key via a single call to ZeroKMS.
      * Values can include optional `id` fields for correlating results back to
-     * your application data. Null plaintext values are preserved as null.
+     * your application data.
      *
      * @param plaintexts - An array of objects with `plaintext` (and optional `id`) fields.
-     * @param opts - Options specifying the target column and table for encryption.
+     * @param opts - Options specifying the target column (or nested {@link encryptedField}) and table. See {@link EncryptOptions}.
      * @returns A `BulkEncryptOperation` that can be awaited to get a `Result`
      *   containing an array of `{ id?, data: Encrypted }` objects, or an `EncryptionError`.
      *
@@ -610,7 +613,6 @@ declare class EncryptionClient {
      *   [
      *     { id: "u1", plaintext: "alice@example.com" },
      *     { id: "u2", plaintext: "bob@example.com" },
-     *     { id: "u3", plaintext: null },
      *   ],
      *   { column: users.email, table: users },
      * )

package/dist/{client-BV9pXC-d.d.ts → client-CrGQnSlk.d.ts}

@@ -1,4 +1,4 @@
-import { k as EncryptedQueryResult, l as Client, S as ScalarQueryTerm, B as BulkDecryptedData, m as BulkDecryptPayload, D as Decrypted, n as BulkEncryptedData, o as BulkEncryptPayload, p as EncryptOptions, P as ProtectColumn, g as ProtectValue, d as ProtectTable, f as ProtectTableColumn, i as Encrypted, q as EncryptQueryOptions, Q as QueryTypeName, r as EncryptedReturnType, s as EncryptConfig, K as KeysetIdentifier, h as EncryptedFromSchema } from './types-public-Dfg-hkuQ.js';
+import { l as EncryptedQueryResult, m as Client, S as ScalarQueryTerm, B as BulkDecryptedData, n as BulkDecryptPayload, D as Decrypted, o as BulkEncryptedData, p as BulkEncryptPayload, q as EncryptOptions, d as EncryptedColumn, h as EncryptedField, f as EncryptedTable, g as EncryptedTableColumn, j as Encrypted, r as EncryptQueryOptions, Q as QueryTypeName, s as EncryptedReturnType, t as EncryptConfig, K as KeysetIdentifier, i as EncryptedFromSchema } from './types-public-Wj6tB_ux.js';
 import { a as EncryptionError, d as LockContext } from './index-9-Ya3fDK.js';
 import { Result } from '@byteslice/result';
 import { JsPlaintext } from '@cipherstash/protect-ffi';
@@ -99,8 +99,8 @@ declare class BulkEncryptOperation extends EncryptionOperation<BulkEncryptedData
     getOperation(): {
         client: Client;
         plaintexts: BulkEncryptPayload;
-        column: ProtectColumn | ProtectValue;
-        table: ProtectTable<ProtectTableColumn>;
+        column: EncryptedColumn | EncryptedField;
+        table: EncryptedTable<EncryptedTableColumn>;
     };
 }
 declare class BulkEncryptOperationWithLockContext extends EncryptionOperation<BulkEncryptedData> {
@@ -114,13 +114,13 @@ declare class BulkEncryptModelsOperation<T extends Record<string, unknown>> exte
     private client;
     private models;
     private table;
-    constructor(client: Client, models: Record<string, unknown>[], table: ProtectTable<ProtectTableColumn>);
+    constructor(client: Client, models: Record<string, unknown>[], table: EncryptedTable<EncryptedTableColumn>);
     withLockContext(lockContext: LockContext): BulkEncryptModelsOperationWithLockContext<T>;
     execute(): Promise<Result<T[], EncryptionError>>;
     getOperation(): {
         client: Client;
         models: Record<string, unknown>[];
-        table: ProtectTable<ProtectTableColumn>;
+        table: EncryptedTable<EncryptedTableColumn>;
     };
 }
 declare class BulkEncryptModelsOperationWithLockContext<T extends Record<string, unknown>> extends EncryptionOperation<T[]> {
@@ -134,23 +134,23 @@ declare class BulkEncryptModelsOperationWithLockContext<T extends Record<string,
  * Decrypts an encrypted payload using the provided client.
  * This is the type returned by the {@link EncryptionClient.decrypt | decrypt} method of the {@link EncryptionClient}.
  */
-declare class DecryptOperation extends EncryptionOperation<JsPlaintext | null> {
+declare class DecryptOperation extends EncryptionOperation<JsPlaintext> {
     private client;
     private encryptedData;
     constructor(client: Client, encryptedData: Encrypted);
     withLockContext(lockContext: LockContext): DecryptOperationWithLockContext;
-    execute(): Promise<Result<JsPlaintext | null, EncryptionError>>;
+    execute(): Promise<Result<JsPlaintext, EncryptionError>>;
     getOperation(): {
         client: Client;
         encryptedData: Encrypted;
         auditData?: Record<string, unknown>;
     };
 }
-declare class DecryptOperationWithLockContext extends EncryptionOperation<JsPlaintext | null> {
+declare class DecryptOperationWithLockContext extends EncryptionOperation<JsPlaintext> {
     private operation;
     private lockContext;
     constructor(operation: DecryptOperation, lockContext: LockContext);
-    execute(): Promise<Result<JsPlaintext | null, EncryptionError>>;
+    execute(): Promise<Result<JsPlaintext, EncryptionError>>;
 }
 
 declare class DecryptModelOperation<T extends Record<string, unknown>> extends EncryptionOperation<Decrypted<T>> {
@@ -176,14 +176,14 @@ declare class EncryptOperation extends EncryptionOperation<Encrypted> {
     private plaintext;
     private column;
     private table;
-    constructor(client: Client, plaintext: JsPlaintext | null, opts: EncryptOptions);
+    constructor(client: Client, plaintext: JsPlaintext, opts: EncryptOptions);
     withLockContext(lockContext: LockContext): EncryptOperationWithLockContext;
     execute(): Promise<Result<Encrypted, EncryptionError>>;
     getOperation(): {
         client: Client;
-        plaintext: JsPlaintext | null;
-        column: ProtectColumn | ProtectValue;
-        table: ProtectTable<ProtectTableColumn>;
+        plaintext: JsPlaintext;
+        column: EncryptedColumn | EncryptedField;
+        table: EncryptedTable<EncryptedTableColumn>;
     };
 }
 declare class EncryptOperationWithLockContext extends EncryptionOperation<Encrypted> {
@@ -197,13 +197,13 @@ declare class EncryptModelOperation<T extends Record<string, unknown>> extends E
     private client;
     private model;
     private table;
-    constructor(client: Client, model: Record<string, unknown>, table: ProtectTable<ProtectTableColumn>);
+    constructor(client: Client, model: Record<string, unknown>, table: EncryptedTable<EncryptedTableColumn>);
     withLockContext(lockContext: LockContext): EncryptModelOperationWithLockContext<T>;
     execute(): Promise<Result<T, EncryptionError>>;
     getOperation(): {
         client: Client;
         model: Record<string, unknown>;
-        table: ProtectTable<ProtectTableColumn>;
+        table: EncryptedTable<EncryptedTableColumn>;
     };
 }
 declare class EncryptModelOperationWithLockContext<T extends Record<string, unknown>> extends EncryptionOperation<T> {
@@ -220,16 +220,16 @@ declare class EncryptQueryOperation extends EncryptionOperation<EncryptedQueryRe
     private client;
     private plaintext;
     private opts;
-    constructor(client: Client, plaintext: JsPlaintext | null, opts: EncryptQueryOptions);
+    constructor(client: Client, plaintext: JsPlaintext, opts: EncryptQueryOptions);
     withLockContext(lockContext: LockContext): EncryptQueryOperationWithLockContext;
     execute(): Promise<Result<EncryptedQueryResult, EncryptionError>>;
     getOperation(): {
-        column: ProtectColumn;
-        table: ProtectTable<ProtectTableColumn>;
+        column: EncryptedColumn;
+        table: EncryptedTable<EncryptedTableColumn>;
         queryType?: QueryTypeName;
         returnType?: EncryptedReturnType;
         client: Client;
-        plaintext: JsPlaintext | null;
+        plaintext: JsPlaintext;
     };
 }
 /**
@@ -240,11 +240,11 @@ declare class EncryptQueryOperationWithLockContext extends EncryptionOperation<E
     private plaintext;
     private opts;
     private lockContext;
-    constructor(client: Client, plaintext: JsPlaintext | null, opts: EncryptQueryOptions, lockContext: LockContext, auditMetadata?: Record<string, unknown>);
+    constructor(client: Client, plaintext: JsPlaintext, opts: EncryptQueryOptions, lockContext: LockContext, auditMetadata?: Record<string, unknown>);
     execute(): Promise<Result<EncryptedQueryResult, EncryptionError>>;
 }
 
-/** The EncryptionClient is the main entry point for interacting with the CipherStash Protect.js library.
+/** The EncryptionClient is the main entry point for interacting with the CipherStash Encryption library.
  * It provides methods for encrypting and decrypting individual values, as well as models (objects) and bulk operations.
  *
  * The client must be initialized using the {@link Encryption} function before it can be used.
@@ -271,8 +271,8 @@ declare class EncryptionClient {
     /**
      * Encrypt a value - returns a promise which resolves to an encrypted value.
      *
-     * @param plaintext - The plaintext value to be encrypted. Can be null.
-     * @param opts - Options specifying the column and table for encryption.
+     * @param plaintext - The plaintext value to be encrypted.
+     * @param opts - Options specifying the column (or nested field) and table for encryption. See {@link EncryptOptions}.
      * @returns An EncryptOperation that can be awaited or chained with additional methods.
      *
      * @example
@@ -335,16 +335,19 @@ declare class EncryptionClient {
      *  .withLockContext(lockContext)
      * ```
      *
+     * @see {@link EncryptOptions}
      * @see {@link Result}
      * @see {@link encryptedTable}
+     * @see {@link encryptedColumn}
+     * @see {@link encryptedField}
      * @see {@link LockContext}
      * @see {@link EncryptOperation}
      */
-    encrypt(plaintext: JsPlaintext | null, opts: EncryptOptions): EncryptOperation;
+    encrypt(plaintext: JsPlaintext, opts: EncryptOptions): EncryptOperation;
     /**
      * Encrypt a query value - returns a promise which resolves to an encrypted query value.
      *
-     * @param plaintext - The plaintext value to be encrypted for querying. Can be null.
+     * @param plaintext - The plaintext value to be encrypted for querying.
      * @param opts - Options specifying the column, table, and optional queryType for encryption.
      * @returns An EncryptQueryOperation that can be awaited or chained with additional methods.
      *
@@ -394,7 +397,7 @@ declare class EncryptionClient {
      * - String plaintext → `steVecSelector` (JSONPath queries like `'$.user.email'`)
      * - Object/Array plaintext → `steVecTerm` (containment queries like `{ role: 'admin' }`)
      */
-    encryptQuery(plaintext: JsPlaintext | null, opts: EncryptQueryOptions): EncryptQueryOperation;
+    encryptQuery(plaintext: JsPlaintext, opts: EncryptQueryOptions): EncryptQueryOperation;
     /**
      * Encrypt multiple values for use in queries (batch operation).
      * @param terms - Array of query terms to encrypt
@@ -479,7 +482,7 @@ declare class EncryptionClient {
      * }
      * ```
      */
-    encryptModel<T extends Record<string, unknown>, S extends ProtectTableColumn = ProtectTableColumn>(input: T, table: ProtectTable<S>): EncryptModelOperation<EncryptedFromSchema<T, S>>;
+    encryptModel<T extends Record<string, unknown>, S extends EncryptedTableColumn = EncryptedTableColumn>(input: T, table: EncryptedTable<S>): EncryptModelOperation<EncryptedFromSchema<T, S>>;
     /**
      * Decrypt a model (object) whose fields contain encrypted values.
      *
@@ -554,7 +557,7 @@ declare class EncryptionClient {
      * }
      * ```
      */
-    bulkEncryptModels<T extends Record<string, unknown>, S extends ProtectTableColumn = ProtectTableColumn>(input: Array<T>, table: ProtectTable<S>): BulkEncryptModelsOperation<EncryptedFromSchema<T, S>>;
+    bulkEncryptModels<T extends Record<string, unknown>, S extends EncryptedTableColumn = EncryptedTableColumn>(input: Array<T>, table: EncryptedTable<S>): BulkEncryptModelsOperation<EncryptedFromSchema<T, S>>;
     /**
      * Decrypt multiple models (objects) in a single bulk operation.
      *
@@ -589,10 +592,10 @@ declare class EncryptionClient {
      *
      * Each value is encrypted with its own unique key via a single call to ZeroKMS.
      * Values can include optional `id` fields for correlating results back to
-     * your application data. Null plaintext values are preserved as null.
+     * your application data.
      *
      * @param plaintexts - An array of objects with `plaintext` (and optional `id`) fields.
-     * @param opts - Options specifying the target column and table for encryption.
+     * @param opts - Options specifying the target column (or nested {@link encryptedField}) and table. See {@link EncryptOptions}.
      * @returns A `BulkEncryptOperation` that can be awaited to get a `Result`
      *   containing an array of `{ id?, data: Encrypted }` objects, or an `EncryptionError`.
      *
@@ -610,7 +613,6 @@ declare class EncryptionClient {
      *   [
      *     { id: "u1", plaintext: "alice@example.com" },
      *     { id: "u2", plaintext: "bob@example.com" },
-     *     { id: "u3", plaintext: null },
      *   ],
      *   { column: users.email, table: users },
      * )

package/dist/client.cjs

@@ -21,14 +21,14 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var client_exports = {};
 __export(client_exports, {
   encryptedColumn: () => encryptedColumn,
-  encryptedTable: () => encryptedTable,
-  encryptedValue: () => encryptedValue
+  encryptedField: () => encryptedField,
+  encryptedTable: () => encryptedTable
 });
 module.exports = __toCommonJS(client_exports);
 
 // src/schema/index.ts
 var import_zod = require("zod");
-var castAsEnum = import_zod.z.enum(["bigint", "boolean", "date", "number", "string", "json"]).default("string");
+var castAsEnum = import_zod.z.enum(["bigint", "boolean", "date", "number", "string", "json", "text"]).default("text");
 var tokenFilterSchema = import_zod.z.object({
   kind: import_zod.z.literal("downcase")
 });
@@ -71,28 +71,28 @@ var encryptConfigSchema = import_zod.z.object({
   v: import_zod.z.number(),
   tables: tablesSchema
 });
-var ProtectValue = class {
+var EncryptedField = class {
   valueName;
   castAsValue;
   constructor(valueName) {
     this.valueName = valueName;
-    this.castAsValue = "string";
+    this.castAsValue = "text";
   }
   /**
-   * Set or override the plaintext data type for this value.
+   * Set or override the plaintext data type for this field.
    *
    * By default all values are treated as `'string'`. Use this method to specify
    * a different type so the encryption layer knows how to encode the plaintext
    * before encrypting.
    *
-   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'bigint'`, or `'json'`.
-   * @returns This `ProtectValue` instance for method chaining.
+   * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'text'`, `'bigint'`, or `'json'`.
+   * @returns This `EncryptedField` instance for method chaining.
    *
    * @example
    * ```typescript
-   * import { encryptedValue } from "@cipherstash/stack/schema"
+   * import { encryptedField } from "@cipherstash/stack/schema"
    *
-   * const age = encryptedValue("age").dataType("number")
+   * const age = encryptedField("age").dataType("number")
    * ```
    */
   dataType(castAs) {
@@ -101,7 +101,7 @@ var ProtectValue = class {
   }
   build() {
     return {
-      cast_as: this.castAsValue,
+      cast_as: this.castAsValue === "string" ? "text" : this.castAsValue,
       indexes: {}
     };
   }
@@ -109,7 +109,7 @@ var ProtectValue = class {
     return this.valueName;
   }
 };
-var ProtectColumn = class {
+var EncryptedColumn = class {
   columnName;
   castAsValue;
   indexesValue = {};
@@ -125,7 +125,7 @@ var ProtectColumn = class {
    * before encrypting.
    *
    * @param castAs - The plaintext data type: `'string'`, `'number'`, `'boolean'`, `'date'`, `'bigint'`, or `'json'`.
-   * @returns This `ProtectColumn` instance for method chaining.
+   * @returns This `EncryptedColumn` instance for method chaining.
    *
    * @example
    * ```typescript
@@ -144,7 +144,7 @@ var ProtectColumn = class {
    * ORE allows sorting, comparison, and range queries on encrypted data.
    * Use with `encryptQuery` and `queryType: 'orderAndRange'`.
    *
-   * @returns This `ProtectColumn` instance for method chaining.
+   * @returns This `EncryptedColumn` instance for method chaining.
    *
    * @example
    * ```typescript
@@ -167,7 +167,7 @@ var ProtectColumn = class {
    *
    * @param tokenFilters - Optional array of token filters (e.g. `[{ kind: 'downcase' }]`).
    *   When omitted, no token filters are applied.
-   * @returns This `ProtectColumn` instance for method chaining.
+   * @returns This `EncryptedColumn` instance for method chaining.
    *
    * @example
    * ```typescript
@@ -192,7 +192,7 @@ var ProtectColumn = class {
    *
    * @param opts - Optional match index configuration. Defaults to 3-character ngram
    *   tokenization with a downcase filter, `k=6`, `m=2048`, and `include_original=true`.
-   * @returns This `ProtectColumn` instance for method chaining.
+   * @returns This `EncryptedColumn` instance for method chaining.
    *
    * @example
    * ```typescript
@@ -237,7 +237,7 @@ var ProtectColumn = class {
    * the plaintext type: strings become selector queries, objects/arrays become
    * containment queries.
    *
-   * @returns This `ProtectColumn` instance for method chaining.
+   * @returns This `EncryptedColumn` instance for method chaining.
    *
    * @example
    * ```typescript
@@ -255,7 +255,7 @@ var ProtectColumn = class {
   }
   build() {
     return {
-      cast_as: this.castAsValue,
+      cast_as: this.castAsValue === "string" ? "text" : this.castAsValue,
       indexes: this.indexesValue
     };
   }
@@ -263,7 +263,7 @@ var ProtectColumn = class {
     return this.columnName;
   }
 };
-var ProtectTable = class {
+var EncryptedTable = class {
   constructor(tableName, columnBuilders) {
     this.tableName = tableName;
     this.columnBuilders = columnBuilders;
@@ -290,7 +290,7 @@ var ProtectTable = class {
   build() {
     const builtColumns = {};
     const processColumn = (builder, colName) => {
-      if (builder instanceof ProtectColumn) {
+      if (builder instanceof EncryptedColumn) {
         const builtColumn = builder.build();
         if (builtColumn.cast_as === "json" && builtColumn.indexes.ste_vec?.prefix === "enabled") {
           builtColumns[colName] = {
@@ -307,7 +307,7 @@ var ProtectTable = class {
         }
       } else {
         for (const [key, value] of Object.entries(builder)) {
-          if (value instanceof ProtectValue) {
+          if (value instanceof EncryptedField) {
             builtColumns[value.getName()] = value.build();
           } else {
             processColumn(value, key);
@@ -325,7 +325,10 @@ var ProtectTable = class {
   }
 };
 function encryptedTable(tableName, columns) {
-  const tableBuilder = new ProtectTable(tableName, columns);
+  const tableBuilder = new EncryptedTable(
+    tableName,
+    columns
+  );
   for (const [colName, colBuilder] of Object.entries(columns)) {
     ;
     tableBuilder[colName] = colBuilder;
@@ -333,15 +336,15 @@ function encryptedTable(tableName, columns) {
   return tableBuilder;
 }
 function encryptedColumn(columnName) {
-  return new ProtectColumn(columnName);
+  return new EncryptedColumn(columnName);
 }
-function encryptedValue(valueName) {
-  return new ProtectValue(valueName);
+function encryptedField(valueName) {
+  return new EncryptedField(valueName);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   encryptedColumn,
-  encryptedTable,
-  encryptedValue
+  encryptedField,
+  encryptedTable
 });
 //# sourceMappingURL=client.cjs.map