@cipherstash/stack 0.3.0 → 0.4.0

package/dist/{chunk-SUYMGQBY.js → chunk-4RNBI3UH.js}

@@ -5,15 +5,9 @@ function encryptedToPgComposite(obj) {
   };
 }
 function encryptedToCompositeLiteral(obj) {
-  if (obj === null) {
-    throw new Error("encryptedToCompositeLiteral: obj cannot be null");
-  }
   return `(${JSON.stringify(JSON.stringify(obj))})`;
 }
 function encryptedToEscapedCompositeLiteral(obj) {
-  if (obj === null) {
-    throw new Error("encryptedToEscapedCompositeLiteral: obj cannot be null");
-  }
   return JSON.stringify(encryptedToCompositeLiteral(obj));
 }
 function formatEncryptedResult(encrypted, returnType) {
@@ -64,4 +58,4 @@ export {
   toFfiKeysetIdentifier,
   isEncryptedPayload
 };
-//# sourceMappingURL=chunk-SUYMGQBY.js.map
+//# sourceMappingURL=chunk-4RNBI3UH.js.map

package/dist/chunk-4RNBI3UH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/encryption/helpers/index.ts"],"sourcesContent":["import type { Encrypted, EncryptedQueryResult, KeysetIdentifier } from '@/types'\nimport type {\n  Encrypted as CipherStashEncrypted,\n  KeysetIdentifier as KeysetIdentifierFfi,\n} from '@cipherstash/protect-ffi'\n\nexport type EncryptedPgComposite = {\n  data: Encrypted\n}\n\n/**\n * Helper function to transform an encrypted payload into a PostgreSQL composite type.\n * Use this when inserting data via Supabase or similar clients.\n */\nexport function encryptedToPgComposite(obj: Encrypted): EncryptedPgComposite {\n  return {\n    data: obj,\n  }\n}\n\n/**\n * Helper function to transform an encrypted payload into a PostgreSQL composite literal string.\n * Use this when querying with `.eq()` or similar equality operations in Supabase.\n *\n * @example\n * ```typescript\n * const literal = encryptedToCompositeLiteral(encrypted)\n * await supabase.from('table').select().eq('column', literal)\n * ```\n */\nexport function encryptedToCompositeLiteral(obj: CipherStashEncrypted): string {\n  return `(${JSON.stringify(JSON.stringify(obj))})`\n}\n\n/**\n * Helper function to transform an encrypted payload into an escaped PostgreSQL composite literal string.\n * Use this when you need the composite literal format to be escaped as a string value.\n *\n * @example\n * ```typescript\n * const escapedLiteral = encryptedToEscapedCompositeLiteral(encrypted)\n * ```\n */\nexport function encryptedToEscapedCompositeLiteral(\n  obj: CipherStashEncrypted,\n): string {\n  return JSON.stringify(encryptedToCompositeLiteral(obj))\n}\n\n/**\n * Format an encrypted result based on the requested return type.\n *\n * - `'composite-literal'` → PostgreSQL composite literal string `(\"json\")`\n * - `'escaped-composite-literal'` → escaped variant `\"(\\\"json\\\")\"`\n * - default (`'eql'` or omitted) → raw encrypted object\n */\nexport function formatEncryptedResult(\n  encrypted: CipherStashEncrypted,\n  returnType?: string,\n): EncryptedQueryResult {\n  if (returnType === 'composite-literal') {\n    return encryptedToCompositeLiteral(encrypted)\n  }\n  if (returnType === 'escaped-composite-literal') {\n    return encryptedToEscapedCompositeLiteral(encrypted)\n  }\n  return encrypted\n}\n\n/**\n * Helper function to transform a model's encrypted fields into PostgreSQL composite types\n */\nexport function modelToEncryptedPgComposites<T extends Record<string, unknown>>(\n  model: T,\n): T {\n  const result: Record<string, unknown> = {}\n\n  for (const [key, value] of Object.entries(model)) {\n    if (isEncryptedPayload(value)) {\n      result[key] = encryptedToPgComposite(value)\n    } else {\n      result[key] = value\n    }\n  }\n\n  return result as T\n}\n\n/**\n * Helper function to transform multiple models' encrypted fields into PostgreSQL composite types\n */\nexport function bulkModelsToEncryptedPgComposites<\n  T extends Record<string, unknown>,\n>(models: T[]): T[] {\n  return models.map((model) => modelToEncryptedPgComposites(model))\n}\n\nexport function toFfiKeysetIdentifier(\n  keyset: KeysetIdentifier | undefined,\n): KeysetIdentifierFfi | undefined {\n  if (!keyset) return undefined\n\n  if ('name' in keyset) {\n    return { Name: keyset.name }\n  }\n\n  return { Uuid: keyset.id }\n}\n\n/**\n * Helper function to check if a value is an encrypted payload\n */\nexport function isEncryptedPayload(value: unknown): value is Encrypted {\n  if (value === null) return false\n  if (typeof value !== 'object') return false\n\n  const obj = value as Record<string, unknown>\n\n  // Must have version field (number)\n  if (!('v' in obj) || typeof obj.v !== 'number') return false\n\n  // Must have index field (object)\n  if (!('i' in obj) || typeof obj.i !== 'object') return false\n\n  // Must have either ciphertext (c) or searchable vector (sv)\n  if (!('c' in obj) && !('sv' in obj)) return false\n\n  return true\n}\n\nexport {\n  toJsonPath,\n  buildNestedObject,\n  parseJsonbPath,\n} from './jsonb'\n"],"mappings":";AAcO,SAAS,uBAAuB,KAAsC;AAC3E,SAAO;AAAA,IACL,MAAM;AAAA,EACR;AACF;AAYO,SAAS,4BAA4B,KAAmC;AAC7E,SAAO,IAAI,KAAK,UAAU,KAAK,UAAU,GAAG,CAAC,CAAC;AAChD;AAWO,SAAS,mCACd,KACQ;AACR,SAAO,KAAK,UAAU,4BAA4B,GAAG,CAAC;AACxD;AASO,SAAS,sBACd,WACA,YACsB;AACtB,MAAI,eAAe,qBAAqB;AACtC,WAAO,4BAA4B,SAAS;AAAA,EAC9C;AACA,MAAI,eAAe,6BAA6B;AAC9C,WAAO,mCAAmC,SAAS;AAAA,EACrD;AACA,SAAO;AACT;AAKO,SAAS,6BACd,OACG;AACH,QAAM,SAAkC,CAAC;AAEzC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,mBAAmB,KAAK,GAAG;AAC7B,aAAO,GAAG,IAAI,uBAAuB,KAAK;AAAA,IAC5C,OAAO;AACL,aAAO,GAAG,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,SAAO;AACT;AAKO,SAAS,kCAEd,QAAkB;AAClB,SAAO,OAAO,IAAI,CAAC,UAAU,6BAA6B,KAAK,CAAC;AAClE;AAEO,SAAS,sBACd,QACiC;AACjC,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI,UAAU,QAAQ;AACpB,WAAO,EAAE,MAAM,OAAO,KAAK;AAAA,EAC7B;AAEA,SAAO,EAAE,MAAM,OAAO,GAAG;AAC3B;AAKO,SAAS,mBAAmB,OAAoC;AACrE,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,SAAU,QAAO;AAEtC,QAAM,MAAM;AAGZ,MAAI,EAAE,OAAO,QAAQ,OAAO,IAAI,MAAM,SAAU,QAAO;AAGvD,MAAI,EAAE,OAAO,QAAQ,OAAO,IAAI,MAAM,SAAU,QAAO;AAGvD,MAAI,EAAE,OAAO,QAAQ,EAAE,QAAQ,KAAM,QAAO;AAE5C,SAAO;AACT;","names":[]}

package/dist/{chunk-JLI27P46.js → chunk-KOU2MHXJ.js}

@@ -25,4 +25,4 @@ export {
   queryTypeToFfi,
   queryTypeToQueryOp
 };
-//# sourceMappingURL=chunk-JLI27P46.js.map
+//# sourceMappingURL=chunk-KOU2MHXJ.js.map

package/dist/chunk-KOU2MHXJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type {\n  EncryptedColumn,\n  EncryptedTable,\n  EncryptedTableColumn,\n  EncryptedField,\n} from '@/schema'\nimport type { LoggingConfig } from '@/utils/logger'\nimport type {\n  Encrypted as CipherStashEncrypted,\n  JsPlaintext,\n  QueryOpName,\n  newClient,\n} from '@cipherstash/protect-ffi'\n\n// ---------------------------------------------------------------------------\n// Branded type utilities\n// ---------------------------------------------------------------------------\n\n/** Brand symbol for nominal typing */\ndeclare const __brand: unique symbol\n\n/** Creates a branded type that is structurally incompatible with the base type */\ntype Brand<T, B extends string> = T & { readonly [__brand]: B }\n\n// ---------------------------------------------------------------------------\n// Core types\n// ---------------------------------------------------------------------------\n\nexport type Client = Awaited<ReturnType<typeof newClient>> | undefined\n\n/** A branded type representing encrypted data. Cannot be accidentally used as plaintext. */\nexport type EncryptedValue = Brand<CipherStashEncrypted, 'encrypted'>\n\n/** Structural type representing encrypted data. See also `EncryptedValue` for branded nominal typing. */\nexport type Encrypted = CipherStashEncrypted\n\n// ---------------------------------------------------------------------------\n// Client configuration\n// ---------------------------------------------------------------------------\n\nexport type KeysetIdentifier = { name: string } | { id: string }\n\nexport type ClientConfig = {\n  /**\n   * The CipherStash workspace CRN (Cloud Resource Name).\n   * Format: `crn:<region>.aws:<workspace-id>`.\n   * Can also be set via the `CS_WORKSPACE_CRN` environment variable.\n   * If omitted, the SDK reads from the environment or TOML config files.\n   */\n  workspaceCrn?: string\n\n  /**\n   * The API access key used for authenticating with the CipherStash API.\n   * Can also be set via the `CS_CLIENT_ACCESS_KEY` environment variable.\n   * Obtain this from the CipherStash dashboard after creating a workspace.\n   */\n  accessKey?: string\n\n  /**\n   * The client identifier used to authenticate with CipherStash services.\n   * Can also be set via the `CS_CLIENT_ID` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientId?: string\n\n  /**\n   * The client key material used in combination with ZeroKMS for encryption operations.\n   * Can also be set via the `CS_CLIENT_KEY` environment variable.\n   * Generated during workspace onboarding in the CipherStash dashboard.\n   */\n  clientKey?: string\n\n  /**\n   * An optional keyset identifier for multi-tenant encryption.\n   * Each keyset provides cryptographic isolation, giving each tenant its own keyspace.\n   * Specify by name (`{ name: \"tenant-a\" }`) or UUID (`{ id: \"...\" }`).\n   * Keysets are created and managed in the CipherStash dashboard.\n   */\n  keyset?: KeysetIdentifier\n}\n\ntype AtLeastOneCsTable<T> = [T, ...T[]]\n\nexport type EncryptionClientConfig = {\n  schemas: AtLeastOneCsTable<EncryptedTable<EncryptedTableColumn>>\n  config?: ClientConfig\n  logging?: LoggingConfig\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt operation options and results\n// ---------------------------------------------------------------------------\n\n/**\n * Options for single-value encrypt operations.\n * Use a column from your table schema (from {@link encryptedColumn}) or a nested\n * field (from {@link encryptedField}) as the target for encryption.\n */\nexport type EncryptOptions = {\n  /** The column or nested field to encrypt into. From {@link EncryptedColumn} or {@link EncryptedField}. */\n  column: EncryptedColumn | EncryptedField\n  table: EncryptedTable<EncryptedTableColumn>\n}\n\n/** Format for encrypted query/search term return values */\nexport type EncryptedReturnType =\n  | 'eql'\n  | 'composite-literal'\n  | 'escaped-composite-literal'\n\nexport type SearchTerm = {\n  value: JsPlaintext\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  returnType?: EncryptedReturnType\n}\n\n/** Encrypted search term result: EQL object or composite literal string */\nexport type EncryptedSearchTerm = Encrypted | string\n\n/** Result of encryptQuery (single or batch): EQL or composite literal string */\nexport type EncryptedQueryResult = Encrypted | string\n\n// ---------------------------------------------------------------------------\n// Model field types (encrypted vs decrypted views)\n// ---------------------------------------------------------------------------\n\nexport type EncryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? K : never]: T[K]\n}\n\nexport type OtherFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? never : K]: T[K]\n}\n\nexport type DecryptedFields<T> = {\n  [K in keyof T as NonNullable<T[K]> extends Encrypted ? K : never]:\n    null extends T[K] ? string | null : string\n}\n\n/** Model with encrypted fields replaced by plaintext (decrypted) values */\nexport type Decrypted<T> = OtherFields<T> & DecryptedFields<T>\n\n/**\n * Maps a plaintext model type to its encrypted form using the table schema.\n *\n * Fields whose keys match columns defined in `S` become `Encrypted`;\n * all other fields retain their original types from `T`.\n *\n * When `S` is the widened `EncryptedTableColumn` (e.g. when a user passes an\n * explicit `<User>` type argument without specifying `S`), the type degrades\n * gracefully to `T` — preserving backward compatibility.\n *\n * @typeParam T - The plaintext model type (e.g. `{ id: string; email: string }`)\n * @typeParam S - The table schema column definition, inferred from the `table` argument\n *\n * @example\n * ```typescript\n * type User = { id: string; email: string }\n * // With a schema that defines `email`:\n * type Encrypted = EncryptedFromSchema<User, { email: EncryptedColumn }>\n * // => { id: string; email: Encrypted }\n * ```\n */\nexport type EncryptedFromSchema<T, S extends EncryptedTableColumn> = {\n  [K in keyof T]: [K] extends [keyof S]\n    ? [S[K & keyof S]] extends [EncryptedColumn | EncryptedField]\n      ? null extends T[K] ? Encrypted | null : Encrypted\n      : T[K]\n    : T[K]\n}\n\n// ---------------------------------------------------------------------------\n// Bulk operations\n// ---------------------------------------------------------------------------\n\nexport type BulkEncryptPayload = Array<{\n  id?: string\n  plaintext: JsPlaintext\n}>\n\nexport type BulkEncryptedData = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptPayload = Array<{ id?: string; data: Encrypted }>\nexport type BulkDecryptedData = Array<DecryptionResult<JsPlaintext>>\n\ntype DecryptionSuccess<T> = { error?: never; data: T; id?: string }\ntype DecryptionError<T> = { error: T; id?: string; data?: never }\n\n/**\n * Result type for individual items in bulk decrypt operations.\n * Uses `error`/`data` fields (not `failure`/`data`) since bulk operations\n * can have per-item failures.\n */\nexport type DecryptionResult<T> = DecryptionSuccess<T> | DecryptionError<T>\n\n// ---------------------------------------------------------------------------\n// Query types (for searchable encryption / encryptQuery)\n// ---------------------------------------------------------------------------\n\n/**\n * User-facing query type names for encrypting query values.\n *\n * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/exact)\n * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/match)\n * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/platform/searchable-encryption/supported-queries/range)\n * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)\n * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)\n * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)\n */\nexport type QueryTypeName =\n  | 'orderAndRange'\n  | 'freeTextSearch'\n  | 'equality'\n  | 'steVecSelector'\n  | 'steVecTerm'\n  | 'searchableJson'\n\n/** @internal */\nexport type FfiIndexTypeName = 'ore' | 'match' | 'unique' | 'ste_vec'\n\nexport const queryTypes = {\n  orderAndRange: 'orderAndRange',\n  freeTextSearch: 'freeTextSearch',\n  equality: 'equality',\n  steVecSelector: 'steVecSelector',\n  steVecTerm: 'steVecTerm',\n  searchableJson: 'searchableJson',\n} as const satisfies Record<string, QueryTypeName>\n\n/** @internal */\nexport const queryTypeToFfi: Record<QueryTypeName, FfiIndexTypeName> = {\n  orderAndRange: 'ore',\n  freeTextSearch: 'match',\n  equality: 'unique',\n  steVecSelector: 'ste_vec',\n  steVecTerm: 'ste_vec',\n  searchableJson: 'ste_vec',\n}\n\n/** @internal */\nexport const queryTypeToQueryOp: Partial<Record<QueryTypeName, QueryOpName>> = {\n  steVecSelector: 'ste_vec_selector',\n  steVecTerm: 'ste_vec_term',\n}\n\n/** @internal */\nexport type QueryTermBase = {\n  column: EncryptedColumn\n  table: EncryptedTable<EncryptedTableColumn>\n  queryType?: QueryTypeName\n  returnType?: EncryptedReturnType\n}\n\nexport type EncryptQueryOptions = QueryTermBase\n\nexport type ScalarQueryTerm = QueryTermBase & {\n  value: JsPlaintext\n}\n"],"mappings":";AA4NO,IAAM,aAAa;AAAA,EACxB,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;AAGO,IAAM,iBAA0D;AAAA,EACrE,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,gBAAgB;AAClB;AAGO,IAAM,qBAAkE;AAAA,EAC7E,gBAAgB;AAAA,EAChB,YAAY;AACd;","names":[]}

package/dist/{chunk-MW6D52V2.js → chunk-WUZGKTMG.js}

@@ -2,11 +2,11 @@ import {
   formatEncryptedResult,
   isEncryptedPayload,
   toFfiKeysetIdentifier
-} from "./chunk-SUYMGQBY.js";
+} from "./chunk-4RNBI3UH.js";
 import {
   queryTypeToFfi,
   queryTypeToQueryOp
-} from "./chunk-JLI27P46.js";
+} from "./chunk-KOU2MHXJ.js";
 import {
   EncryptionErrorTypes,
   createRequestLogger,
@@ -17,7 +17,7 @@ import {
 import {
   buildEncryptConfig,
   encryptConfigSchema
-} from "./chunk-TBAIVO6T.js";
+} from "./chunk-Y35W4WFN.js";
 
 // src/encryption/index.ts
 import { withResult as withResult11 } from "@byteslice/result";
@@ -167,18 +167,6 @@ var EncryptionOperation = class {
 };
 
 // src/encryption/operations/batch-encrypt-query.ts
-function filterNullTerms(terms) {
-  const nullIndices = /* @__PURE__ */ new Set();
-  const nonNullTerms = [];
-  terms.forEach((term, index) => {
-    if (term.value === null || term.value === void 0) {
-      nullIndices.add(index);
-    } else {
-      nonNullTerms.push({ term, originalIndex: index });
-    }
-  });
-  return { nullIndices, nonNullTerms };
-}
 function buildQueryPayload(term, lockContext) {
   assertValidNumericValue(term.value);
   const { indexType, queryOp } = resolveIndexType(
@@ -199,13 +187,10 @@ function buildQueryPayload(term, lockContext) {
   }
   return payload;
 }
-function assembleResults(totalLength, encryptedValues, nonNullTerms) {
-  const results = new Array(totalLength).fill(null);
-  nonNullTerms.forEach(({ term, originalIndex }, i) => {
-    const encrypted = encryptedValues[i];
-    results[originalIndex] = formatEncryptedResult(encrypted, term.returnType);
-  });
-  return results;
+function assembleResults(terms, encryptedValues) {
+  return terms.map(
+    (term, i) => formatEncryptedResult(encryptedValues[i], term.returnType)
+  );
 }
 var BatchEncryptQueryOperation = class extends EncryptionOperation {
   constructor(client, terms) {
@@ -232,23 +217,18 @@ var BatchEncryptQueryOperation = class extends EncryptionOperation {
       log.emit();
       return { data: [] };
     }
-    const { nullIndices, nonNullTerms } = filterNullTerms(this.terms);
-    if (nonNullTerms.length === 0) {
-      log.emit();
-      return { data: this.terms.map(() => null) };
-    }
     const result = await withResult(
       async () => {
         if (!this.client) throw noClientError();
         const { metadata } = this.getAuditData();
-        const queries = nonNullTerms.map(
-          ({ term }) => buildQueryPayload(term)
+        const queries = this.terms.map(
+          (term) => buildQueryPayload(term)
         );
         const encrypted = await ffiEncryptQueryBulk(this.client, {
           queries,
           unverifiedContext: metadata
         });
-        return assembleResults(this.terms.length, encrypted, nonNullTerms);
+        return assembleResults(this.terms, encrypted);
       },
       (error) => {
         log.set({ errorCode: getErrorCode(error) ?? "unknown" });
@@ -282,11 +262,6 @@ var BatchEncryptQueryOperationWithLockContext = class extends EncryptionOperatio
       log.emit();
       return { data: [] };
     }
-    const { nullIndices, nonNullTerms } = filterNullTerms(this.terms);
-    if (nonNullTerms.length === 0) {
-      log.emit();
-      return { data: this.terms.map(() => null) };
-    }
     const lockContextResult = await this.lockContext.getLockContext();
     if (lockContextResult.failure) {
       log.emit();
@@ -297,15 +272,15 @@ var BatchEncryptQueryOperationWithLockContext = class extends EncryptionOperatio
       async () => {
         if (!this.client) throw noClientError();
         const { metadata } = this.getAuditData();
-        const queries = nonNullTerms.map(
-          ({ term }) => buildQueryPayload(term, context)
+        const queries = this.terms.map(
+          (term) => buildQueryPayload(term, context)
         );
         const encrypted = await ffiEncryptQueryBulk(this.client, {
           queries,
           serviceToken: ctsToken,
           unverifiedContext: metadata
         });
-        return assembleResults(this.terms.length, encrypted, nonNullTerms);
+        return assembleResults(this.terms, encrypted);
       },
       (error) => {
         log.set({ errorCode: getErrorCode(error) ?? "unknown" });
@@ -327,42 +302,25 @@ import {
   decryptBulkFallible
 } from "@cipherstash/protect-ffi";
 var createDecryptPayloads = (encryptedPayloads, lockContext) => {
-  return encryptedPayloads.map((item, index) => ({ ...item, originalIndex: index })).filter(({ data }) => data !== null).map(({ id, data, originalIndex }) => ({
+  return encryptedPayloads.map(({ id, data }) => ({
     id,
     ciphertext: data,
-    originalIndex,
     ...lockContext && { lockContext }
   }));
 };
-var createNullResult = (encryptedPayloads) => {
-  return encryptedPayloads.map(({ id }) => ({
-    id,
-    data: null
-  }));
-};
 var mapDecryptedDataToResult = (encryptedPayloads, decryptedData) => {
-  const result = new Array(encryptedPayloads.length);
-  let decryptedIndex = 0;
-  for (let i = 0; i < encryptedPayloads.length; i++) {
-    if (encryptedPayloads[i].data === null) {
-      result[i] = { id: encryptedPayloads[i].id, data: null };
-    } else {
-      const decryptResult = decryptedData[decryptedIndex];
-      if ("error" in decryptResult) {
-        result[i] = {
-          id: encryptedPayloads[i].id,
-          error: decryptResult.error
-        };
-      } else {
-        result[i] = {
-          id: encryptedPayloads[i].id,
-          data: decryptResult.data
-        };
-      }
-      decryptedIndex++;
+  return decryptedData.map((decryptResult, i) => {
+    if ("error" in decryptResult) {
+      return {
+        id: encryptedPayloads[i].id,
+        error: decryptResult.error
+      };
     }
-  }
-  return result;
+    return {
+      id: encryptedPayloads[i].id,
+      data: decryptResult.data
+    };
+  });
 };
 var BulkDecryptOperation = class extends EncryptionOperation {
   client;
@@ -387,13 +345,10 @@ var BulkDecryptOperation = class extends EncryptionOperation {
         if (!this.client) throw noClientError();
         if (!this.encryptedPayloads || this.encryptedPayloads.length === 0)
           return [];
-        const nonNullPayloads = createDecryptPayloads(this.encryptedPayloads);
-        if (nonNullPayloads.length === 0) {
-          return createNullResult(this.encryptedPayloads);
-        }
+        const payloads = createDecryptPayloads(this.encryptedPayloads);
         const { metadata } = this.getAuditData();
         const decryptedData = await decryptBulkFallible(this.client, {
-          ciphertexts: nonNullPayloads,
+          ciphertexts: payloads,
           unverifiedContext: metadata
         });
         return mapDecryptedDataToResult(this.encryptedPayloads, decryptedData);
@@ -445,16 +400,13 @@ var BulkDecryptOperationWithLockContext = class extends EncryptionOperation {
         if (context.failure) {
           throw new Error(`[encryption]: ${context.failure.message}`);
         }
-        const nonNullPayloads = createDecryptPayloads(
+        const payloads = createDecryptPayloads(
           encryptedPayloads,
           context.data.context
         );
-        if (nonNullPayloads.length === 0) {
-          return createNullResult(encryptedPayloads);
-        }
         const { metadata } = this.getAuditData();
         const decryptedData = await decryptBulkFallible(client, {
-          ciphertexts: nonNullPayloads,
+          ciphertexts: payloads,
           serviceToken: context.data.ctsToken,
           unverifiedContext: metadata
         });
@@ -1096,34 +1048,14 @@ var BulkDecryptModelsOperationWithLockContext = class extends EncryptionOperatio
 import { withResult as withResult4 } from "@byteslice/result";
 import { encryptBulk as encryptBulk2 } from "@cipherstash/protect-ffi";
 var createEncryptPayloads = (plaintexts, column, table, lockContext) => {
-  return plaintexts.map((item, index) => ({ ...item, originalIndex: index })).filter(({ plaintext }) => plaintext !== null).map(({ id, plaintext, originalIndex }) => ({
+  return plaintexts.map(({ id, plaintext }) => ({
     id,
     plaintext,
     column: column.getName(),
     table: table.tableName,
-    originalIndex,
     ...lockContext && { lockContext }
   }));
 };
-var createNullResult2 = (plaintexts) => {
-  return plaintexts.map(({ id }) => ({ id, data: null }));
-};
-var mapEncryptedDataToResult = (plaintexts, encryptedData) => {
-  const result = new Array(plaintexts.length);
-  let encryptedIndex = 0;
-  for (let i = 0; i < plaintexts.length; i++) {
-    if (plaintexts[i].plaintext === null) {
-      result[i] = { id: plaintexts[i].id, data: null };
-    } else {
-      result[i] = {
-        id: plaintexts[i].id,
-        data: encryptedData[encryptedIndex]
-      };
-      encryptedIndex++;
-    }
-  }
-  return result;
-};
 var BulkEncryptOperation = class extends EncryptionOperation {
   client;
   plaintexts;
@@ -1156,20 +1088,20 @@ var BulkEncryptOperation = class extends EncryptionOperation {
         if (!this.plaintexts || this.plaintexts.length === 0) {
           return [];
         }
-        const nonNullPayloads = createEncryptPayloads(
+        const payloads = createEncryptPayloads(
           this.plaintexts,
           this.column,
           this.table
         );
-        if (nonNullPayloads.length === 0) {
-          return createNullResult2(this.plaintexts);
-        }
         const { metadata } = this.getAuditData();
         const encryptedData = await encryptBulk2(this.client, {
-          plaintexts: nonNullPayloads,
+          plaintexts: payloads,
           unverifiedContext: metadata
         });
-        return mapEncryptedDataToResult(this.plaintexts, encryptedData);
+        return encryptedData.map((data, i) => ({
+          id: this.plaintexts[i].id,
+          data
+        }));
       },
       (error) => {
         log.set({ errorCode: getErrorCode(error) ?? "unknown" });
@@ -1226,22 +1158,22 @@ var BulkEncryptOperationWithLockContext = class extends EncryptionOperation {
         if (context.failure) {
           throw new Error(`[encryption]: ${context.failure.message}`);
         }
-        const nonNullPayloads = createEncryptPayloads(
+        const payloads = createEncryptPayloads(
           plaintexts,
           column,
           table,
           context.data.context
         );
-        if (nonNullPayloads.length === 0) {
-          return createNullResult2(plaintexts);
-        }
         const { metadata } = this.getAuditData();
         const encryptedData = await encryptBulk2(client, {
-          plaintexts: nonNullPayloads,
+          plaintexts: payloads,
           serviceToken: context.data.ctsToken,
           unverifiedContext: metadata
         });
-        return mapEncryptedDataToResult(plaintexts, encryptedData);
+        return encryptedData.map((data, i) => ({
+          id: plaintexts[i].id,
+          data
+        }));
       },
       (error) => {
         log.set({ errorCode: getErrorCode(error) ?? "unknown" });
@@ -1393,9 +1325,6 @@ var DecryptOperation = class extends EncryptionOperation {
         if (!this.client) {
           throw noClientError();
         }
-        if (this.encryptedData === null) {
-          return null;
-        }
         const { metadata } = this.getAuditData();
         return await ffiDecrypt(this.client, {
           ciphertext: this.encryptedData,
@@ -1446,9 +1375,6 @@ var DecryptOperationWithLockContext = class extends EncryptionOperation {
         if (!client) {
           throw noClientError();
         }
-        if (encryptedData === null) {
-          return null;
-        }
         const { metadata } = this.getAuditData();
         const context = await this.lockContext.getLockContext();
         if (context.failure) {
@@ -1604,9 +1530,6 @@ var EncryptOperation = class extends EncryptionOperation {
         if (!this.client) {
           throw noClientError();
         }
-        if (this.plaintext === null) {
-          return null;
-        }
         if (typeof this.plaintext === "number" && Number.isNaN(this.plaintext)) {
           throw new Error("[encryption]: Cannot encrypt NaN value");
         }
@@ -1668,9 +1591,6 @@ var EncryptOperationWithLockContext = class extends EncryptionOperation {
         if (!client) {
           throw noClientError();
         }
-        if (plaintext === null) {
-          return null;
-        }
         const { metadata } = this.getAuditData();
         const context = await this.lockContext.getLockContext();
         if (context.failure) {
@@ -1836,10 +1756,6 @@ var EncryptQueryOperation = class extends EncryptionOperation {
       queryType: this.opts.queryType,
       lockContext: false
     });
-    if (this.plaintext === null || this.plaintext === void 0) {
-      log.emit();
-      return { data: null };
-    }
     const validationError = validateNumericValue(this.plaintext);
     if (validationError?.failure) {
       log.emit();
@@ -1903,10 +1819,6 @@ var EncryptQueryOperationWithLockContext = class extends EncryptionOperation {
       queryType: this.opts.queryType,
       lockContext: true
     });
-    if (this.plaintext === null || this.plaintext === void 0) {
-      log.emit();
-      return { data: null };
-    }
     const validationError = validateNumericValue(this.plaintext);
     if (validationError?.failure) {
       log.emit();
@@ -2011,7 +1923,7 @@ var EncryptionClient = class {
   /**
    * Encrypt a value - returns a promise which resolves to an encrypted value.
    *
-   * @param plaintext - The plaintext value to be encrypted. Can be null.
+   * @param plaintext - The plaintext value to be encrypted.
    * @param opts - Options specifying the column (or nested field) and table for encryption. See {@link EncryptOptions}.
    * @returns An EncryptOperation that can be awaited or chained with additional methods.
    *
@@ -2312,7 +2224,7 @@ var EncryptionClient = class {
    *
    * Each value is encrypted with its own unique key via a single call to ZeroKMS.
    * Values can include optional `id` fields for correlating results back to
-   * your application data. Null plaintext values are preserved as null.
+   * your application data.
    *
    * @param plaintexts - An array of objects with `plaintext` (and optional `id`) fields.
    * @param opts - Options specifying the target column (or nested {@link encryptedField}) and table. See {@link EncryptOptions}.
@@ -2333,7 +2245,6 @@ var EncryptionClient = class {
    *   [
    *     { id: "u1", plaintext: "alice@example.com" },
    *     { id: "u2", plaintext: "bob@example.com" },
-   *     { id: "u3", plaintext: null },
    *   ],
    *   { column: users.email, table: users },
    * )
@@ -2423,4 +2334,4 @@ var Encryption = async (config) => {
 export {
   Encryption
 };
-//# sourceMappingURL=chunk-MW6D52V2.js.map
+//# sourceMappingURL=chunk-WUZGKTMG.js.map