@cipherstash/stack 0.6.0 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @cipherstash/stack
 
+## 0.8.0
+
+### Minor Changes
+
+- 3414761: Fixed Supabase or wrapper to escape EQL payloads correctly.
+
+## 0.7.0
+
+### Minor Changes
+
+- 1be8f81: Exposed a public method on the Encryption client to expose the build Encryption schema.
+
 ## 0.6.0
 
 ### Minor Changes

package/README.md

@@ -287,6 +287,14 @@ await supabase.from("users").select().eq("email", term.data)
 
 Each term in a batch can have its own `returnType`.
 
+### Ordering Encrypted Data
+
+**`ORDER BY` on encrypted columns requires operator family support in the database.**
+
+On databases without operator families (e.g. Supabase, or when EQL is installed with `--exclude-operator-family`), sorting on encrypted columns is not currently supported — regardless of the client or ORM used. Sort application-side after decrypting the results as a workaround.
+
+Operator family support for Supabase is being developed in collaboration with the Supabase and CipherStash teams and will be available in a future release.
+
 ### PostgreSQL / Drizzle Integration Pattern
 
 Encrypted data is stored as an [EQL](https://github.com/cipherstash/encrypt-query-language) JSON payload. Install the EQL extension in PostgreSQL to enable searchable queries, then store encrypted data in `eql_v2_encrypted` columns.

package/dist/bin/stash.js

@@ -1511,6 +1511,17 @@ function isEncryptedPayload(value) {
 
 // src/schema/index.ts
 import { z as z2 } from "zod";
+var eqlCastAsEnum = z2.enum([
+  "text",
+  "int",
+  "small_int",
+  "big_int",
+  "real",
+  "double",
+  "boolean",
+  "date",
+  "jsonb"
+]).default("text");
 var castAsEnum = z2.enum(["bigint", "boolean", "date", "number", "string", "json", "text"]).default("text");
 var tokenFilterSchema = z2.object({
   kind: z2.literal("downcase")
@@ -1559,7 +1570,7 @@ var EncryptedField = class {
   castAsValue;
   constructor(valueName) {
     this.valueName = valueName;
-    this.castAsValue = "text";
+    this.castAsValue = "string";
   }
   /**
    * Set or override the plaintext data type for this field.
@@ -1584,7 +1595,7 @@ var EncryptedField = class {
   }
   build() {
     return {
-      cast_as: this.castAsValue === "string" ? "text" : this.castAsValue,
+      cast_as: this.castAsValue,
       indexes: {}
     };
   }
@@ -1738,7 +1749,7 @@ var EncryptedColumn = class {
   }
   build() {
     return {
-      cast_as: this.castAsValue === "string" ? "text" : this.castAsValue,
+      cast_as: this.castAsValue,
       indexes: this.indexesValue
     };
   }
@@ -4261,6 +4272,14 @@ var EncryptionClient = class {
       workspaceId: this.workspaceId
     };
   }
+  /**
+   * Get the encrypt config object.
+   *
+   * @returns The encrypt config object.
+   */
+  getEncryptConfig() {
+    return this.encryptConfig;
+  }
 };
 var Encryption = async (config3) => {
   const { schemas, config: clientConfig } = config3;