@cipherstash/stack 1.0.0-rc.0 → 1.0.0-rc.1

package/dist/adapter-kit.d.cts

@@ -1,7 +1,7 @@
 export { b as bulkModelsToEncryptedPgComposites, m as modelToEncryptedPgComposites } from './index-fhWTOV0K.cjs';
 export { A as AuditConfig } from './base-operation-AOAIvsSB.cjs';
-import { Z as V3ColumnFactory } from './columns-D2_YzrCX.cjs';
-export { A as AnyEncryptedV3Column, D as DATE_LIKE_CASTS, Q as EncryptedV3Column } from './columns-D2_YzrCX.cjs';
+import { Z as V3ColumnFactory } from './columns-Bxv7Oo9o.cjs';
+export { A as AnyEncryptedV3Column, D as DATE_LIKE_CASTS, Q as EncryptedV3Column } from './columns-Bxv7Oo9o.cjs';
 import { M as MatchIndexOpts } from './types-public-QMjYNfQO.cjs';
 import '@byteslice/result';
 import './errors/index.cjs';
@@ -42,6 +42,44 @@ declare function stripDomainSchema(eqlType: string): string;
  */
 declare function factoryForDomain(domainName: string): V3ColumnFactory | undefined;
 
+/**
+ * Shared JSONPath-selector path handling for the first-party adapters
+ * (`@cipherstash/stack-drizzle`, `@cipherstash/stack-supabase`), exposed via
+ * `@cipherstash/stack/adapter-kit`.
+ *
+ * Both adapters express "compare the value at `$.a.b`" over an encrypted
+ * `eql_v3_json` column, and both need the same three pieces: parse + validate
+ * the dot-notation path, reconstruct the `{ a: { b: value } }` needle document
+ * whose ste_vec entry at the path carries the comparison terms, and reject
+ * non-scalar leaves up front. Originally private to the Drizzle v3 operators
+ * (#651); moved here when the Supabase adapter grew the same querying (#650) so
+ * the validation rules cannot drift between adapters.
+ */
+/**
+ * Parse a dot-notation JSONPath into its object-key segments. Rejects, each with
+ * a clear message: array-index/wildcard syntax (v1 is object-keys-only), the
+ * empty/root path, malformed paths (`..`, stray/leading/trailing dots, so we
+ * never silently query a *different* path), and prototype-pollution keys.
+ * `'$.a.b'` / `' a.b '` → `['a', 'b']`.
+ */
+declare function parseSelectorSegments(path: string): string[];
+/** `$`-rooted JSONPath for `encryptQuery`'s selector needle. */
+declare function jsonPathOf(segments: string[]): string;
+/**
+ * A selector compares a single scalar LEAF. Returns a reason string when `value`
+ * is unsupported — a non-scalar (object/array → that's `contains`), or a boolean
+ * under an ordering operator (no ordering term) — else `null`. Callers raise it
+ * as their adapter's operator error with column context, so a bad value is an
+ * actionable SDK error rather than a deferred, opaque DB failure.
+ */
+declare function unsupportedLeafReason(value: unknown, ordering: boolean): string | null;
+/**
+ * Nest `value` under the segments: `['a','b']` → `{ a: { b: value } }`. The
+ * storage-needle document whose ste_vec entry at the path supplies the
+ * ciphertext-bearing comparison entry.
+ */
+declare function reconstructSelectorDocument(segments: string[], value: unknown): Record<string, unknown>;
+
 /**
  * Why a needle cannot be answered by this match index, or `undefined` when it
  * can. Callers throw their own error type with this as the reason.
@@ -79,4 +117,4 @@ declare const logger: {
     error(...args: unknown[]): void;
 };
 
-export { DOMAIN_REGISTRY, factoryForDomain, logger, matchNeedleError, stripDomainSchema };
+export { DOMAIN_REGISTRY, factoryForDomain, jsonPathOf, logger, matchNeedleError, parseSelectorSegments, reconstructSelectorDocument, stripDomainSchema, unsupportedLeafReason };

package/dist/adapter-kit.d.ts

@@ -1,7 +1,7 @@
 export { b as bulkModelsToEncryptedPgComposites, m as modelToEncryptedPgComposites } from './index-BquA71_Y.js';
 export { A as AuditConfig } from './base-operation-FXEzUXIq.js';
-import { Z as V3ColumnFactory } from './columns-rZc7fQHI.js';
-export { A as AnyEncryptedV3Column, D as DATE_LIKE_CASTS, Q as EncryptedV3Column } from './columns-rZc7fQHI.js';
+import { Z as V3ColumnFactory } from './columns-0lbT9stl.js';
+export { A as AnyEncryptedV3Column, D as DATE_LIKE_CASTS, Q as EncryptedV3Column } from './columns-0lbT9stl.js';
 import { M as MatchIndexOpts } from './types-public-QMjYNfQO.js';
 import '@byteslice/result';
 import './errors/index.js';
@@ -42,6 +42,44 @@ declare function stripDomainSchema(eqlType: string): string;
  */
 declare function factoryForDomain(domainName: string): V3ColumnFactory | undefined;
 
+/**
+ * Shared JSONPath-selector path handling for the first-party adapters
+ * (`@cipherstash/stack-drizzle`, `@cipherstash/stack-supabase`), exposed via
+ * `@cipherstash/stack/adapter-kit`.
+ *
+ * Both adapters express "compare the value at `$.a.b`" over an encrypted
+ * `eql_v3_json` column, and both need the same three pieces: parse + validate
+ * the dot-notation path, reconstruct the `{ a: { b: value } }` needle document
+ * whose ste_vec entry at the path carries the comparison terms, and reject
+ * non-scalar leaves up front. Originally private to the Drizzle v3 operators
+ * (#651); moved here when the Supabase adapter grew the same querying (#650) so
+ * the validation rules cannot drift between adapters.
+ */
+/**
+ * Parse a dot-notation JSONPath into its object-key segments. Rejects, each with
+ * a clear message: array-index/wildcard syntax (v1 is object-keys-only), the
+ * empty/root path, malformed paths (`..`, stray/leading/trailing dots, so we
+ * never silently query a *different* path), and prototype-pollution keys.
+ * `'$.a.b'` / `' a.b '` → `['a', 'b']`.
+ */
+declare function parseSelectorSegments(path: string): string[];
+/** `$`-rooted JSONPath for `encryptQuery`'s selector needle. */
+declare function jsonPathOf(segments: string[]): string;
+/**
+ * A selector compares a single scalar LEAF. Returns a reason string when `value`
+ * is unsupported — a non-scalar (object/array → that's `contains`), or a boolean
+ * under an ordering operator (no ordering term) — else `null`. Callers raise it
+ * as their adapter's operator error with column context, so a bad value is an
+ * actionable SDK error rather than a deferred, opaque DB failure.
+ */
+declare function unsupportedLeafReason(value: unknown, ordering: boolean): string | null;
+/**
+ * Nest `value` under the segments: `['a','b']` → `{ a: { b: value } }`. The
+ * storage-needle document whose ste_vec entry at the path supplies the
+ * ciphertext-bearing comparison entry.
+ */
+declare function reconstructSelectorDocument(segments: string[], value: unknown): Record<string, unknown>;
+
 /**
  * Why a needle cannot be answered by this match index, or `undefined` when it
  * can. Callers throw their own error type with this as the reason.
@@ -79,4 +117,4 @@ declare const logger: {
     error(...args: unknown[]): void;
 };
 
-export { DOMAIN_REGISTRY, factoryForDomain, logger, matchNeedleError, stripDomainSchema };
+export { DOMAIN_REGISTRY, factoryForDomain, jsonPathOf, logger, matchNeedleError, parseSelectorSegments, reconstructSelectorDocument, stripDomainSchema, unsupportedLeafReason };

package/dist/adapter-kit.js

@@ -2,7 +2,7 @@ import {
   DATE_LIKE_CASTS,
   EncryptedV3Column,
   types
-} from "./chunk-V2Q3NYIH.js";
+} from "./chunk-6SGN52W6.js";
 import {
   bulkModelsToEncryptedPgComposites,
   modelToEncryptedPgComposites
@@ -33,15 +33,90 @@ function stripDomainSchema(eqlType) {
 function factoryForDomain(domainName) {
   return Object.hasOwn(DOMAIN_REGISTRY, domainName) ? DOMAIN_REGISTRY[domainName] : void 0;
 }
+
+// src/eql/v3/selector-path.ts
+var FORBIDDEN_SEGMENTS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "prototype",
+  "constructor"
+]);
+function parseSelectorSegments(path) {
+  const trimmed = path.trim();
+  let body = trimmed.startsWith("$") ? trimmed.slice(1) : trimmed;
+  if (body.startsWith(".")) body = body.slice(1);
+  if (body === "") {
+    throw new Error(
+      `JSON selector path "${path}" addresses no field \u2014 use e.g. "$.a" or "$.a.b".`
+    );
+  }
+  if (/[[\]*]/.test(body)) {
+    throw new Error(
+      `JSON selector path "${path}" uses array/wildcard syntax, which is not yet supported \u2014 use dot-notation object keys (e.g. "$.a.b").`
+    );
+  }
+  const segments = body.split(".");
+  for (const segment of segments) {
+    if (segment === "") {
+      throw new Error(
+        `JSON selector path "${path}" is malformed (empty segment / ".." / stray dot) \u2014 use dot-notation object keys (e.g. "$.a.b").`
+      );
+    }
+    if (segment !== segment.trim()) {
+      throw new Error(
+        `JSON selector path "${path}" has whitespace at a segment boundary ("${segment}") \u2014 it would address a different key. Remove the spacing around the dot.`
+      );
+    }
+    if (FORBIDDEN_SEGMENTS.has(segment)) {
+      throw new Error(
+        `JSON selector path "${path}" addresses the forbidden key "${segment}".`
+      );
+    }
+  }
+  return segments;
+}
+function jsonPathOf(segments) {
+  return `$.${segments.join(".")}`;
+}
+function unsupportedLeafReason(value, ordering) {
+  if (value == null) {
+    return "a selector compares a non-null scalar leaf, but got null/undefined \u2014 SQL NULL never equals anything; use is(column, null) for null checks.";
+  }
+  const isScalar = value instanceof Date || typeof value === "number" || typeof value === "bigint" || typeof value === "string" || typeof value === "boolean";
+  if (!isScalar) {
+    return `a selector compares a scalar leaf, but got ${Array.isArray(value) ? "an array" : "an object"} \u2014 use contains() for sub-object matching.`;
+  }
+  if (ordering && typeof value === "boolean") {
+    return "a boolean leaf has no ordering \u2014 use eq/ne (or contains()).";
+  }
+  return null;
+}
+function reconstructSelectorDocument(segments, value) {
+  const root = /* @__PURE__ */ Object.create(null);
+  let cursor = root;
+  segments.forEach((segment, index) => {
+    if (index === segments.length - 1) {
+      cursor[segment] = value;
+    } else {
+      const next = /* @__PURE__ */ Object.create(null);
+      cursor[segment] = next;
+      cursor = next;
+    }
+  });
+  return root;
+}
 export {
   DATE_LIKE_CASTS,
   DOMAIN_REGISTRY,
   EncryptedV3Column,
   bulkModelsToEncryptedPgComposites,
   factoryForDomain,
+  jsonPathOf,
   logger,
   matchNeedleError,
   modelToEncryptedPgComposites,
-  stripDomainSchema
+  parseSelectorSegments,
+  reconstructSelectorDocument,
+  stripDomainSchema,
+  unsupportedLeafReason
 };
 //# sourceMappingURL=adapter-kit.js.map

package/dist/adapter-kit.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/eql/v3/domain-registry.ts"],"sourcesContent":["import type { V3ColumnFactory } from './columns'\nimport { types } from './types'\n\nexport type { V3ColumnFactory } from './columns'\n\n/**\n * Unqualified Postgres `domain_name` → the `eql/v3/types.ts` factory that\n * builds that domain's column.\n *\n * DERIVED, not hand-listed. Every factory already carries its domain in the\n * constant it passes to the column constructor, so the key is recoverable from\n * the factory itself — and `types` and this registry cannot drift. Adding a\n * domain to `types` is enough; forgetting an entry here is no longer possible.\n *\n * The keys are an external contract (they are the `information_schema` query\n * parameter in `../../supabase/introspect.ts`). Because they are derived from\n * `getEqlType()`, no test that also derives them can detect a corrupted domain\n * constant — `eql-v3-domain-registry.test.ts` pins them against a hand-written\n * literal list for exactly that reason.\n *\n * `factory('_probe')` runs at module load, so a non-factory value in `types`\n * would throw here and take the importing modules (`../../supabase/introspect.ts`,\n * `schema-builder.ts`, `verify.ts`) down with it. `types` is declared\n * `satisfies Record<string, V3ColumnFactory>` so that mistake is a compile error\n * at its source instead. Do not reintroduce a cast on `Object.values` below: it\n * would silence exactly the check that keeps this loop total.\n */\n// NULL PROTOTYPE — load-bearing. A plain object literal inherits from\n// Object.prototype, so `DOMAIN_REGISTRY['constructor']` returns a *function*\n// and passes a truthiness check. A column whose domain is named `constructor`,\n// `toString`, `valueOf` or `__proto__` would then be treated as a modelled EQL\n// domain and \"synthesized\" from Object.prototype.constructor. `factoryForDomain`\n// additionally guards with `Object.hasOwn`; both are kept — belt and braces,\n// because a future refactor that drops the null prototype must not silently\n// reopen the hole. It also makes the `Object.hasOwn` collision check below\n// exact: on a plain object `'constructor' in registry` is spuriously true.\nexport const DOMAIN_REGISTRY: Record<string, V3ColumnFactory> = (() => {\n  const registry = Object.create(null) as Record<string, V3ColumnFactory>\n  for (const factory of Object.values(types)) {\n    // Probe name only: the constructors store their arguments and nothing else,\n    // so building one column per domain at module load is free of side effects.\n    const key = stripDomainSchema(factory('_probe').getEqlType())\n    if (Object.hasOwn(registry, key)) {\n      throw new Error(`duplicate EQL v3 domain key: ${key}`)\n    }\n    registry[key] = factory\n  }\n  return registry\n})()\n\n/** Strip a leading `public.` schema qualifier from a qualified `eqlType`. */\nexport function stripDomainSchema(eqlType: string): string {\n  return eqlType.startsWith('public.')\n    ? eqlType.slice('public.'.length)\n    : eqlType\n}\n\n/**\n * Look up the factory for an unqualified domain name, or `undefined`.\n *\n * `Object.hasOwn` is required, not decorative: without it a domain named\n * `constructor` / `toString` / `valueOf` / `__proto__` resolves to an inherited\n * `Object.prototype` member and violates the \"unknown domain = plaintext\" rule.\n */\nexport function factoryForDomain(\n  domainName: string,\n): V3ColumnFactory | undefined {\n  return Object.hasOwn(DOMAIN_REGISTRY, domainName)\n    ? DOMAIN_REGISTRY[domainName]\n    : undefined\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAoCO,IAAM,mBAAoD,MAAM;AACrE,QAAM,WAAW,uBAAO,OAAO,IAAI;AACnC,aAAW,WAAW,OAAO,OAAO,KAAK,GAAG;AAG1C,UAAM,MAAM,kBAAkB,QAAQ,QAAQ,EAAE,WAAW,CAAC;AAC5D,QAAI,OAAO,OAAO,UAAU,GAAG,GAAG;AAChC,YAAM,IAAI,MAAM,gCAAgC,GAAG,EAAE;AAAA,IACvD;AACA,aAAS,GAAG,IAAI;AAAA,EAClB;AACA,SAAO;AACT,GAAG;AAGI,SAAS,kBAAkB,SAAyB;AACzD,SAAO,QAAQ,WAAW,SAAS,IAC/B,QAAQ,MAAM,UAAU,MAAM,IAC9B;AACN;AASO,SAAS,iBACd,YAC6B;AAC7B,SAAO,OAAO,OAAO,iBAAiB,UAAU,IAC5C,gBAAgB,UAAU,IAC1B;AACN;","names":[]}
+{"version":3,"sources":["../src/eql/v3/domain-registry.ts","../src/eql/v3/selector-path.ts"],"sourcesContent":["import type { V3ColumnFactory } from './columns'\nimport { types } from './types'\n\nexport type { V3ColumnFactory } from './columns'\n\n/**\n * Unqualified Postgres `domain_name` → the `eql/v3/types.ts` factory that\n * builds that domain's column.\n *\n * DERIVED, not hand-listed. Every factory already carries its domain in the\n * constant it passes to the column constructor, so the key is recoverable from\n * the factory itself — and `types` and this registry cannot drift. Adding a\n * domain to `types` is enough; forgetting an entry here is no longer possible.\n *\n * The keys are an external contract (they are the `information_schema` query\n * parameter in `../../supabase/introspect.ts`). Because they are derived from\n * `getEqlType()`, no test that also derives them can detect a corrupted domain\n * constant — `eql-v3-domain-registry.test.ts` pins them against a hand-written\n * literal list for exactly that reason.\n *\n * `factory('_probe')` runs at module load, so a non-factory value in `types`\n * would throw here and take the importing modules (`../../supabase/introspect.ts`,\n * `schema-builder.ts`, `verify.ts`) down with it. `types` is declared\n * `satisfies Record<string, V3ColumnFactory>` so that mistake is a compile error\n * at its source instead. Do not reintroduce a cast on `Object.values` below: it\n * would silence exactly the check that keeps this loop total.\n */\n// NULL PROTOTYPE — load-bearing. A plain object literal inherits from\n// Object.prototype, so `DOMAIN_REGISTRY['constructor']` returns a *function*\n// and passes a truthiness check. A column whose domain is named `constructor`,\n// `toString`, `valueOf` or `__proto__` would then be treated as a modelled EQL\n// domain and \"synthesized\" from Object.prototype.constructor. `factoryForDomain`\n// additionally guards with `Object.hasOwn`; both are kept — belt and braces,\n// because a future refactor that drops the null prototype must not silently\n// reopen the hole. It also makes the `Object.hasOwn` collision check below\n// exact: on a plain object `'constructor' in registry` is spuriously true.\nexport const DOMAIN_REGISTRY: Record<string, V3ColumnFactory> = (() => {\n  const registry = Object.create(null) as Record<string, V3ColumnFactory>\n  for (const factory of Object.values(types)) {\n    // Probe name only: the constructors store their arguments and nothing else,\n    // so building one column per domain at module load is free of side effects.\n    const key = stripDomainSchema(factory('_probe').getEqlType())\n    if (Object.hasOwn(registry, key)) {\n      throw new Error(`duplicate EQL v3 domain key: ${key}`)\n    }\n    registry[key] = factory\n  }\n  return registry\n})()\n\n/** Strip a leading `public.` schema qualifier from a qualified `eqlType`. */\nexport function stripDomainSchema(eqlType: string): string {\n  return eqlType.startsWith('public.')\n    ? eqlType.slice('public.'.length)\n    : eqlType\n}\n\n/**\n * Look up the factory for an unqualified domain name, or `undefined`.\n *\n * `Object.hasOwn` is required, not decorative: without it a domain named\n * `constructor` / `toString` / `valueOf` / `__proto__` resolves to an inherited\n * `Object.prototype` member and violates the \"unknown domain = plaintext\" rule.\n */\nexport function factoryForDomain(\n  domainName: string,\n): V3ColumnFactory | undefined {\n  return Object.hasOwn(DOMAIN_REGISTRY, domainName)\n    ? DOMAIN_REGISTRY[domainName]\n    : undefined\n}\n","/**\n * Shared JSONPath-selector path handling for the first-party adapters\n * (`@cipherstash/stack-drizzle`, `@cipherstash/stack-supabase`), exposed via\n * `@cipherstash/stack/adapter-kit`.\n *\n * Both adapters express \"compare the value at `$.a.b`\" over an encrypted\n * `eql_v3_json` column, and both need the same three pieces: parse + validate\n * the dot-notation path, reconstruct the `{ a: { b: value } }` needle document\n * whose ste_vec entry at the path carries the comparison terms, and reject\n * non-scalar leaves up front. Originally private to the Drizzle v3 operators\n * (#651); moved here when the Supabase adapter grew the same querying (#650) so\n * the validation rules cannot drift between adapters.\n */\n\n/**\n * Object keys that are prototype-pollution vectors — rejected outright (mirrors\n * core's `FORBIDDEN_KEYS`), so a selector can never address them.\n */\nconst FORBIDDEN_SEGMENTS: ReadonlySet<string> = new Set([\n  '__proto__',\n  'prototype',\n  'constructor',\n])\n\n/**\n * Parse a dot-notation JSONPath into its object-key segments. Rejects, each with\n * a clear message: array-index/wildcard syntax (v1 is object-keys-only), the\n * empty/root path, malformed paths (`..`, stray/leading/trailing dots, so we\n * never silently query a *different* path), and prototype-pollution keys.\n * `'$.a.b'` / `' a.b '` → `['a', 'b']`.\n */\nexport function parseSelectorSegments(path: string): string[] {\n  const trimmed = path.trim()\n  let body = trimmed.startsWith('$') ? trimmed.slice(1) : trimmed\n  if (body.startsWith('.')) body = body.slice(1)\n  if (body === '') {\n    throw new Error(\n      `JSON selector path \"${path}\" addresses no field — use e.g. \"$.a\" or \"$.a.b\".`,\n    )\n  }\n  if (/[[\\]*]/.test(body)) {\n    throw new Error(\n      `JSON selector path \"${path}\" uses array/wildcard syntax, which is not yet supported — use dot-notation object keys (e.g. \"$.a.b\").`,\n    )\n  }\n  const segments = body.split('.')\n  for (const segment of segments) {\n    if (segment === '') {\n      throw new Error(\n        `JSON selector path \"${path}\" is malformed (empty segment / \"..\" / stray dot) — use dot-notation object keys (e.g. \"$.a.b\").`,\n      )\n    }\n    // Leading/trailing whitespace in a segment is almost certainly spacing\n    // around a dot ('$.user .role'), which would silently address a DIFFERENT\n    // key ('user '). Interior whitespace stays legal — 'a b' is a valid JSON\n    // key a caller may genuinely have.\n    if (segment !== segment.trim()) {\n      throw new Error(\n        `JSON selector path \"${path}\" has whitespace at a segment boundary (\"${segment}\") — it would address a different key. Remove the spacing around the dot.`,\n      )\n    }\n    if (FORBIDDEN_SEGMENTS.has(segment)) {\n      throw new Error(\n        `JSON selector path \"${path}\" addresses the forbidden key \"${segment}\".`,\n      )\n    }\n  }\n  return segments\n}\n\n/** `$`-rooted JSONPath for `encryptQuery`'s selector needle. */\nexport function jsonPathOf(segments: string[]): string {\n  return `$.${segments.join('.')}`\n}\n\n/**\n * A selector compares a single scalar LEAF. Returns a reason string when `value`\n * is unsupported — a non-scalar (object/array → that's `contains`), or a boolean\n * under an ordering operator (no ordering term) — else `null`. Callers raise it\n * as their adapter's operator error with column context, so a bad value is an\n * actionable SDK error rather than a deferred, opaque DB failure.\n */\nexport function unsupportedLeafReason(\n  value: unknown,\n  ordering: boolean,\n): string | null {\n  // Explicit null arm: `typeof null === 'object'`, so without it a null leaf\n  // would get the actively-wrong \"got an object — use contains()\" steer.\n  if (value == null) {\n    return 'a selector compares a non-null scalar leaf, but got null/undefined — SQL NULL never equals anything; use is(column, null) for null checks.'\n  }\n  const isScalar =\n    value instanceof Date ||\n    typeof value === 'number' ||\n    typeof value === 'bigint' ||\n    typeof value === 'string' ||\n    typeof value === 'boolean'\n  if (!isScalar) {\n    return `a selector compares a scalar leaf, but got ${Array.isArray(value) ? 'an array' : 'an object'} — use contains() for sub-object matching.`\n  }\n  if (ordering && typeof value === 'boolean') {\n    return 'a boolean leaf has no ordering — use eq/ne (or contains()).'\n  }\n  return null\n}\n\n/**\n * Nest `value` under the segments: `['a','b']` → `{ a: { b: value } }`. The\n * storage-needle document whose ste_vec entry at the path supplies the\n * ciphertext-bearing comparison entry.\n */\nexport function reconstructSelectorDocument(\n  segments: string[],\n  value: unknown,\n): Record<string, unknown> {\n  // Null-prototype objects: a segment like `__proto__` must become an OWN key,\n  // not invoke the prototype setter (which would drop it and mis-serialize the\n  // needle). JSON.stringify ignores the [[Prototype]], so this serializes fine.\n  const root: Record<string, unknown> = Object.create(null)\n  let cursor = root\n  segments.forEach((segment, index) => {\n    if (index === segments.length - 1) {\n      cursor[segment] = value\n    } else {\n      const next: Record<string, unknown> = Object.create(null)\n      cursor[segment] = next\n      cursor = next\n    }\n  })\n  return root\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAoCO,IAAM,mBAAoD,MAAM;AACrE,QAAM,WAAW,uBAAO,OAAO,IAAI;AACnC,aAAW,WAAW,OAAO,OAAO,KAAK,GAAG;AAG1C,UAAM,MAAM,kBAAkB,QAAQ,QAAQ,EAAE,WAAW,CAAC;AAC5D,QAAI,OAAO,OAAO,UAAU,GAAG,GAAG;AAChC,YAAM,IAAI,MAAM,gCAAgC,GAAG,EAAE;AAAA,IACvD;AACA,aAAS,GAAG,IAAI;AAAA,EAClB;AACA,SAAO;AACT,GAAG;AAGI,SAAS,kBAAkB,SAAyB;AACzD,SAAO,QAAQ,WAAW,SAAS,IAC/B,QAAQ,MAAM,UAAU,MAAM,IAC9B;AACN;AASO,SAAS,iBACd,YAC6B;AAC7B,SAAO,OAAO,OAAO,iBAAiB,UAAU,IAC5C,gBAAgB,UAAU,IAC1B;AACN;;;ACpDA,IAAM,qBAA0C,oBAAI,IAAI;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AACF,CAAC;AASM,SAAS,sBAAsB,MAAwB;AAC5D,QAAM,UAAU,KAAK,KAAK;AAC1B,MAAI,OAAO,QAAQ,WAAW,GAAG,IAAI,QAAQ,MAAM,CAAC,IAAI;AACxD,MAAI,KAAK,WAAW,GAAG,EAAG,QAAO,KAAK,MAAM,CAAC;AAC7C,MAAI,SAAS,IAAI;AACf,UAAM,IAAI;AAAA,MACR,uBAAuB,IAAI;AAAA,IAC7B;AAAA,EACF;AACA,MAAI,SAAS,KAAK,IAAI,GAAG;AACvB,UAAM,IAAI;AAAA,MACR,uBAAuB,IAAI;AAAA,IAC7B;AAAA,EACF;AACA,QAAM,WAAW,KAAK,MAAM,GAAG;AAC/B,aAAW,WAAW,UAAU;AAC9B,QAAI,YAAY,IAAI;AAClB,YAAM,IAAI;AAAA,QACR,uBAAuB,IAAI;AAAA,MAC7B;AAAA,IACF;AAKA,QAAI,YAAY,QAAQ,KAAK,GAAG;AAC9B,YAAM,IAAI;AAAA,QACR,uBAAuB,IAAI,4CAA4C,OAAO;AAAA,MAChF;AAAA,IACF;AACA,QAAI,mBAAmB,IAAI,OAAO,GAAG;AACnC,YAAM,IAAI;AAAA,QACR,uBAAuB,IAAI,kCAAkC,OAAO;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,WAAW,UAA4B;AACrD,SAAO,KAAK,SAAS,KAAK,GAAG,CAAC;AAChC;AASO,SAAS,sBACd,OACA,UACe;AAGf,MAAI,SAAS,MAAM;AACjB,WAAO;AAAA,EACT;AACA,QAAM,WACJ,iBAAiB,QACjB,OAAO,UAAU,YACjB,OAAO,UAAU,YACjB,OAAO,UAAU,YACjB,OAAO,UAAU;AACnB,MAAI,CAAC,UAAU;AACb,WAAO,8CAA8C,MAAM,QAAQ,KAAK,IAAI,aAAa,WAAW;AAAA,EACtG;AACA,MAAI,YAAY,OAAO,UAAU,WAAW;AAC1C,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAOO,SAAS,4BACd,UACA,OACyB;AAIzB,QAAM,OAAgC,uBAAO,OAAO,IAAI;AACxD,MAAI,SAAS;AACb,WAAS,QAAQ,CAAC,SAAS,UAAU;AACnC,QAAI,UAAU,SAAS,SAAS,GAAG;AACjC,aAAO,OAAO,IAAI;AAAA,IACpB,OAAO;AACL,YAAM,OAAgC,uBAAO,OAAO,IAAI;AACxD,aAAO,OAAO,IAAI;AAClB,eAAS;AAAA,IACX;AAAA,EACF,CAAC;AACD,SAAO;AACT;","names":[]}

package/dist/{chunk-V2Q3NYIH.js → chunk-6SGN52W6.js}

@@ -491,4 +491,4 @@ export {
   EncryptedJsonColumn,
   types
 };
-//# sourceMappingURL=chunk-V2Q3NYIH.js.map
+//# sourceMappingURL=chunk-6SGN52W6.js.map

package/dist/{chunk-V2Q3NYIH.js.map → chunk-6SGN52W6.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/eql/v3/columns.ts","../src/eql/v3/types.ts"],"sourcesContent":["import type { ColumnSchema } from '@/schema'\nimport { defaultMatchOpts } from '@/schema/match-defaults'\n\n/**\n * The query capabilities a v3 concrete domain exposes. These are SDK-facing\n * semantic flags describing what kinds of query terms a column can produce —\n * NOT the raw EQL index keys. They are metadata only and never emitted by\n * `build()`.\n *\n * - `equality`: exact-match lookups (EQL `hm`, or comparison via `ob`).\n * - `orderAndRange`: comparison / range lookups (EQL `op`, or `ob` on `_ord_ore` domains).\n * - `freeTextSearch`: tokenised substring match (EQL `bf`).\n * - `searchableJson`: encrypted-JSONB containment / selector lookups (EQL\n *   `ste_vec`). Optional and mutually exclusive with the scalar flags — a\n *   `public.eql_v3_json` document is queried by structure, not by scalar term.\n */\nexport type QueryCapabilities = Readonly<{\n  equality: boolean\n  orderAndRange: boolean\n  freeTextSearch: boolean\n  searchableJson?: boolean\n}>\n\n/**\n * The `cast_as` kinds whose decrypted plaintext reconstructs to a JS `Date`.\n *\n * SINGLE SOURCE OF TRUTH for the date-like set. Both the type-level\n * {@link PlaintextFromKind} and the runtime `rowReconstructor` (encryption/v3.ts)\n * derive their \"reconstructs to `Date`\" decision from this array, so the next\n * `Date`-backed cast is added in exactly one place — never hand-synced across a\n * type and a runtime guard that could silently drift.\n *\n * (`timestamp` reconstructs to `Date` just like `date`, but its `cast_as` tells\n * the FFI not to truncate the time-of-day.)\n */\nexport const DATE_LIKE_CASTS = ['date', 'timestamp'] as const\n/** A `cast_as` kind that reconstructs to `Date` — see {@link DATE_LIKE_CASTS}. */\nexport type DateLikeCast = (typeof DATE_LIKE_CASTS)[number]\n\n/** The plaintext (TypeScript) kind a v3 domain decrypts to. A subset of the\n * SDK `CastAs` enum, restricted to the scalar kinds v3 domains actually use. */\ntype PlaintextKind =\n  | 'string'\n  | 'number'\n  | 'bigint'\n  | 'boolean'\n  | 'json'\n  | DateLikeCast\n\n/**\n * The full, literal definition of a v3 domain. This is the LOAD-BEARING type:\n * the base column class carries a private field of this type so that every\n * concrete (otherwise-empty) subclass is discriminated by its literal\n * `eqlType`/`castAs`/`capabilities` — TypeScript empty subclasses are NOT\n * nominal, so without this a storage-only `boolean` column would be assignable to\n * a storage-only `date` column and plaintext inference would collapse.\n */\ntype V3DomainDefinition = Readonly<{\n  eqlType: `public.${string}`\n  castAs: PlaintextKind\n  capabilities: QueryCapabilities\n}>\n\n/** Type-level mirror of {@link isQueryableCapabilities}: `false` for a\n * storage-only domain (all capability flags `false`), `true` otherwise. */\ntype QueryableFlag<D extends V3DomainDefinition> = D['capabilities'] extends {\n  equality: false\n  orderAndRange: false\n  freeTextSearch: false\n  searchableJson?: false | undefined\n}\n  ? false\n  : true\n\nconst STORAGE_ONLY = {\n  equality: false,\n  orderAndRange: false,\n  freeTextSearch: false,\n} as const\n\nconst EQUALITY_ONLY = {\n  equality: true,\n  orderAndRange: false,\n  freeTextSearch: false,\n} as const\n\nconst ORDER_AND_RANGE = {\n  equality: true,\n  orderAndRange: true,\n  freeTextSearch: false,\n} as const\n\nconst MATCH_ONLY = {\n  equality: false,\n  orderAndRange: false,\n  freeTextSearch: true,\n} as const\n\nconst TEXT_SEARCH = {\n  equality: true,\n  orderAndRange: true,\n  freeTextSearch: true,\n} as const\n\n/**\n * The concrete EQL v3 domain name for a full-capability text column.\n * Recorded as metadata for future DDL / query-dialect increments; it is\n * intentionally absent from the emitted encrypt config.\n */\nexport const TEXT_SEARCH_EQL_TYPE = 'public.eql_v3_text_search'\n\n// Per-domain literal definitions. Each concrete column subclass is parameterised\n// by `typeof <CONST>`; the literal `eqlType`/`castAs`/`capabilities` on each is\n// what makes the otherwise-empty subclasses nominally distinct (see\n// V3DomainDefinition). Order mirrors eql-bindings `CATALOG` order.\n//\n// Exported for the `types` namespace factory (see ./types); they are internal\n// building blocks and are intentionally NOT re-exported from the public barrel.\nexport const INTEGER = {\n  eqlType: 'public.eql_v3_integer',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const INTEGER_EQ = {\n  eqlType: 'public.eql_v3_integer_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const INTEGER_ORD_ORE = {\n  eqlType: 'public.eql_v3_integer_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const INTEGER_ORD = {\n  eqlType: 'public.eql_v3_integer_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const SMALLINT = {\n  eqlType: 'public.eql_v3_smallint',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const SMALLINT_EQ = {\n  eqlType: 'public.eql_v3_smallint_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const SMALLINT_ORD_ORE = {\n  eqlType: 'public.eql_v3_smallint_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const SMALLINT_ORD = {\n  eqlType: 'public.eql_v3_smallint_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\n// bigint (int8) domains. Plaintext is a JS `bigint` (always decrypts to\n// `bigint`); bounds are the full i64 range. protect-ffi round-trips an in-range\n// native bigint losslessly, and values outside the signed 64-bit range are\n// rejected client-side by `assertValidNumericValue` before they reach the FFI\n// (`*_ord_ope` variants are out of scope — CIP-3403.)\nexport const BIGINT = {\n  eqlType: 'public.eql_v3_bigint',\n  castAs: 'bigint',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const BIGINT_EQ = {\n  eqlType: 'public.eql_v3_bigint_eq',\n  castAs: 'bigint',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const BIGINT_ORD_ORE = {\n  eqlType: 'public.eql_v3_bigint_ord_ore',\n  castAs: 'bigint',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const BIGINT_ORD = {\n  eqlType: 'public.eql_v3_bigint_ord',\n  castAs: 'bigint',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const DATE = {\n  eqlType: 'public.eql_v3_date',\n  castAs: 'date',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const DATE_EQ = {\n  eqlType: 'public.eql_v3_date_eq',\n  castAs: 'date',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const DATE_ORD_ORE = {\n  eqlType: 'public.eql_v3_date_ord_ore',\n  castAs: 'date',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const DATE_ORD = {\n  eqlType: 'public.eql_v3_date_ord',\n  castAs: 'date',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const TIMESTAMP = {\n  eqlType: 'public.eql_v3_timestamp',\n  castAs: 'timestamp',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const TIMESTAMP_EQ = {\n  eqlType: 'public.eql_v3_timestamp_eq',\n  castAs: 'timestamp',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const TIMESTAMP_ORD_ORE = {\n  eqlType: 'public.eql_v3_timestamp_ord_ore',\n  castAs: 'timestamp',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const TIMESTAMP_ORD = {\n  eqlType: 'public.eql_v3_timestamp_ord',\n  castAs: 'timestamp',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const NUMERIC = {\n  eqlType: 'public.eql_v3_numeric',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const NUMERIC_EQ = {\n  eqlType: 'public.eql_v3_numeric_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const NUMERIC_ORD_ORE = {\n  eqlType: 'public.eql_v3_numeric_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const NUMERIC_ORD = {\n  eqlType: 'public.eql_v3_numeric_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const TEXT = {\n  eqlType: 'public.eql_v3_text',\n  castAs: 'string',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const TEXT_EQ = {\n  eqlType: 'public.eql_v3_text_eq',\n  castAs: 'string',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const TEXT_MATCH = {\n  eqlType: 'public.eql_v3_text_match',\n  castAs: 'string',\n  capabilities: MATCH_ONLY,\n} as const\nexport const TEXT_ORD_ORE = {\n  eqlType: 'public.eql_v3_text_ord_ore',\n  castAs: 'string',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const TEXT_ORD = {\n  eqlType: 'public.eql_v3_text_ord',\n  castAs: 'string',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const BOOLEAN = {\n  eqlType: 'public.eql_v3_boolean',\n  castAs: 'boolean',\n  capabilities: STORAGE_ONLY,\n} as const\n\nexport const REAL = {\n  eqlType: 'public.eql_v3_real',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const REAL_EQ = {\n  eqlType: 'public.eql_v3_real_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const REAL_ORD_ORE = {\n  eqlType: 'public.eql_v3_real_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const REAL_ORD = {\n  eqlType: 'public.eql_v3_real_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const DOUBLE = {\n  eqlType: 'public.eql_v3_double',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const DOUBLE_EQ = {\n  eqlType: 'public.eql_v3_double_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const DOUBLE_ORD_ORE = {\n  eqlType: 'public.eql_v3_double_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const DOUBLE_ORD = {\n  eqlType: 'public.eql_v3_double_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\n/**\n * Translate a domain's semantic {@link QueryCapabilities} (plus its plaintext\n * `castAs`, which decides how equality is answered, and its ordering flavour)\n * into the concrete EQL index block emitted by `build()`.\n *\n * - `unique` (the `hm` HMAC index) whenever equality is answered via HMAC:\n *   equality-only domains of ANY type, AND text order domains. Text equality is\n *   HMAC-based — the `public.eql_v3_text_ord` / `public.eql_v3_text_ord_ore` SQL domains\n *   REQUIRE `hm` in the stored ciphertext (their `eql_v3.eq_term` extracts it).\n * - ONE ordering index for any order/range domain, selected by the domain's\n *   name (eql-3.0.0): plain `_ord` domains (and `text_search`) are OPE-backed —\n *   `ope`, the `op` CLLW-OPE term — while `_ord_ore` domains keep block-ORE —\n *   `ore`, the `ob` term. The two terms are not cross-comparable, and each\n *   domain's SQL CHECK requires exactly its own. For numeric/date order\n *   domains the ordering term also answers equality (via the SQL `=`\n *   operator), so those emit no `hm`. Text order domains emit BOTH `unique`\n *   and the ordering index.\n * - `match` (the `bf` bloom-filter index) for free-text search, deep-cloned from\n *   the per-call defaults so no nested object is ever shared across columns, and\n *   emitted with `include_original: false` (see below).\n */\nfunction indexesForCapabilities(\n  capabilities: QueryCapabilities,\n  castAs: PlaintextKind,\n  ordering: 'ope' | 'ore',\n): ColumnSchema['indexes'] {\n  const indexes: ColumnSchema['indexes'] = {}\n\n  // Text equality is always HMAC-based, so a text order domain (`string` +\n  // order/range) still needs `unique`; numeric/date order domains answer\n  // equality via their ordering term and must NOT emit `unique`.\n  if (\n    capabilities.equality &&\n    (!capabilities.orderAndRange || castAs === 'string')\n  ) {\n    indexes.unique = { token_filters: [] }\n  }\n\n  if (capabilities.orderAndRange) {\n    indexes[ordering] = {}\n  }\n\n  if (capabilities.freeTextSearch) {\n    // The factory returns fresh, unaliased nested objects per call, so no\n    // column's emitted match block ever shares state with another's.\n    //\n    // `include_original` is overridden off the v2 builder's `true`. protect-ffi\n    // ignores the flag entirely (measured across 0.24 and 0.29, EQL v2 and v3:\n    // the emitted bloom is trigram-only either way, and a value shorter than\n    // `token_length` blooms to nothing regardless), so this is inert today. It\n    // is set to the value a substring-search domain actually wants — matching\n    // the zod schema's own default — so that a protect-ffi release which starts\n    // honouring the flag cannot silently break `contains`.\n    indexes.match = { ...defaultMatchOpts(), include_original: false }\n  }\n\n  if (capabilities.searchableJson) {\n    // Encrypted-JSONB index (the protect-ffi config kind is named `ste_vec`).\n    // `prefix: 'enabled'` is a sentinel the table's `build()` rewrites to\n    // `${tableName}/${columnName}` — the same scheme v2 `searchableJson` uses —\n    // so each document's selectors are scoped to their column.\n    //\n    // `array_index_mode` indexes array elements by identity (`item`) and enables\n    // `$[*]` wildcard selectors, but deliberately drops `position`: `@>`\n    // containment must be a subset test (jsonb `@>` semantics), so `{roles:['x']}`\n    // matches any document whose `roles` array contains `x` REGARDLESS of index.\n    // With positional terms emitted (v2 `searchableJson`'s `'all'`), the needle\n    // for `x`-at-index-0 would miss a document holding `x` at index 1.\n    //\n    // `mode: 'compat'` is REQUIRED for eql-3.0.0: `public.eql_v3_json` orders the\n    // document's entries by the CLLW-OPE `op` term, so the index must emit `op`\n    // (compat) terms. `'standard'` emits v2's CLLW-ORE `oc` terms, which the v3\n    // domain rejects at encrypt time.\n    indexes.ste_vec = {\n      prefix: 'enabled',\n      array_index_mode: { item: true, wildcard: true, position: false },\n      mode: 'compat',\n    }\n  }\n\n  return indexes\n}\n\n/**\n * The ordering flavour a domain's name pins (eql-3.0.0): `_ord_ore` domains\n * are block-ORE (`ore` index, `ob` term); every other ordering domain —\n * `_ord` and `text_search` — is CLLW-OPE (`ope` index, `op` term).\n */\nfunction orderingForEqlType(eqlType: string): 'ope' | 'ore' {\n  return eqlType.endsWith('_ord_ore') ? 'ore' : 'ope'\n}\n\n/** Whether a domain's capabilities make it queryable at all (any flag set). */\nfunction isQueryableCapabilities(capabilities: QueryCapabilities): boolean {\n  return (\n    capabilities.equality ||\n    capabilities.orderAndRange ||\n    capabilities.freeTextSearch ||\n    (capabilities.searchableJson ?? false)\n  )\n}\n\n/**\n * Shared base for every v3 concrete domain column. Parameterised by the FULL\n * literal {@link V3DomainDefinition} (not by capabilities alone): the private\n * `definition` field carries the literal `eqlType`/`castAs`/`capabilities`, so\n * two otherwise-empty subclasses (e.g. `EncryptedBooleanColumn` and\n * `EncryptedDateColumn`, both storage-only) are NOT mutually assignable. This\n * nominality is what keeps plaintext inference precise.\n */\nexport class EncryptedV3Column<D extends V3DomainDefinition> {\n  constructor(\n    private readonly columnName: string,\n    private readonly definition: D,\n  ) {}\n\n  getName(): string {\n    return this.columnName\n  }\n\n  /** The concrete EQL v3 domain name. Metadata only; not emitted by `build()`. */\n  getEqlType(): D['eqlType'] {\n    return this.definition.eqlType\n  }\n\n  /** The semantic query capabilities this domain exposes. Metadata only. */\n  getQueryCapabilities(): D['capabilities'] {\n    return this.definition.capabilities\n  }\n\n  /** `true` when this domain can produce at least one kind of query term. */\n  isQueryable(): QueryableFlag<D> {\n    return isQueryableCapabilities(\n      this.definition.capabilities,\n    ) as QueryableFlag<D>\n  }\n\n  /** Emit the encrypt-config column: `cast_as` plus capability-derived indexes. */\n  build(): ColumnSchema {\n    return {\n      cast_as: this.definition.castAs,\n      indexes: indexesForCapabilities(\n        this.definition.capabilities,\n        this.definition.castAs,\n        orderingForEqlType(this.definition.eqlType),\n      ),\n    }\n  }\n}\n\nconst TEXT_SEARCH_DOMAIN = {\n  eqlType: TEXT_SEARCH_EQL_TYPE,\n  castAs: 'string',\n  capabilities: TEXT_SEARCH,\n} as const\n\n/**\n * Builder for a `public.eql_v3_text_search` column.\n *\n * The concrete type inherently enables equality + order/range + free-text\n * match — there are no capability-enabling or tuning methods. The match index\n * is always emitted with the default configuration.\n *\n * NOTE — querying: a `text_search` column emits all three indexes (`unique`,\n * `ope`, `match`), and the shared index-inference picks them by fixed priority\n * `unique > match > ordering`. So `encryptQuery(value, { column, table })` with NO\n * explicit `queryType` builds an EQUALITY term (via `unique`), NOT a free-text\n * match — a substring like `'joh'` then matches nothing. To run a free-text\n * match query you MUST pass `queryType: 'freeTextSearch'`:\n *\n * ```typescript\n * // equality (default): exact value only\n * client.encryptQuery('john@example.com', { column: users.email, table: users })\n * // free-text match: substring/token search\n * client.encryptQuery('joh', { column: users.email, table: users, queryType: 'freeTextSearch' })\n * ```\n */\nexport class EncryptedTextSearchColumn extends EncryptedV3Column<\n  typeof TEXT_SEARCH_DOMAIN\n> {\n  constructor(columnName: string) {\n    super(columnName, TEXT_SEARCH_DOMAIN)\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Concrete domain columns\n//\n// Every concrete class is an empty subclass parameterised by its literal domain\n// definition (see EncryptedV3Column). The `types` namespace (see ./types)\n// constructs these with the SAME literal constant so the instance's private\n// `definition` field carries full literal type data — that is what keeps\n// distinct domains nominally incompatible.\n// ---------------------------------------------------------------------------\n\n// integer\nexport class EncryptedIntegerColumn extends EncryptedV3Column<typeof INTEGER> {}\nexport class EncryptedIntegerEqColumn extends EncryptedV3Column<\n  typeof INTEGER_EQ\n> {}\nexport class EncryptedIntegerOrdOreColumn extends EncryptedV3Column<\n  typeof INTEGER_ORD_ORE\n> {}\nexport class EncryptedIntegerOrdColumn extends EncryptedV3Column<\n  typeof INTEGER_ORD\n> {}\n\n// smallint\nexport class EncryptedSmallintColumn extends EncryptedV3Column<\n  typeof SMALLINT\n> {}\nexport class EncryptedSmallintEqColumn extends EncryptedV3Column<\n  typeof SMALLINT_EQ\n> {}\nexport class EncryptedSmallintOrdOreColumn extends EncryptedV3Column<\n  typeof SMALLINT_ORD_ORE\n> {}\nexport class EncryptedSmallintOrdColumn extends EncryptedV3Column<\n  typeof SMALLINT_ORD\n> {}\n\n// bigint (int8) — plaintext is a JS `bigint`, round-tripped losslessly by the\n// native protect-ffi boundary (see the BIGINT domain definitions above).\nexport class EncryptedBigintColumn extends EncryptedV3Column<typeof BIGINT> {}\nexport class EncryptedBigintEqColumn extends EncryptedV3Column<\n  typeof BIGINT_EQ\n> {}\nexport class EncryptedBigintOrdOreColumn extends EncryptedV3Column<\n  typeof BIGINT_ORD_ORE\n> {}\nexport class EncryptedBigintOrdColumn extends EncryptedV3Column<\n  typeof BIGINT_ORD\n> {}\n\n// date\nexport class EncryptedDateColumn extends EncryptedV3Column<typeof DATE> {}\nexport class EncryptedDateEqColumn extends EncryptedV3Column<typeof DATE_EQ> {}\nexport class EncryptedDateOrdOreColumn extends EncryptedV3Column<\n  typeof DATE_ORD_ORE\n> {}\nexport class EncryptedDateOrdColumn extends EncryptedV3Column<\n  typeof DATE_ORD\n> {}\n\n// timestamp\nexport class EncryptedTimestampColumn extends EncryptedV3Column<\n  typeof TIMESTAMP\n> {}\nexport class EncryptedTimestampEqColumn extends EncryptedV3Column<\n  typeof TIMESTAMP_EQ\n> {}\nexport class EncryptedTimestampOrdOreColumn extends EncryptedV3Column<\n  typeof TIMESTAMP_ORD_ORE\n> {}\nexport class EncryptedTimestampOrdColumn extends EncryptedV3Column<\n  typeof TIMESTAMP_ORD\n> {}\n\n// numeric\nexport class EncryptedNumericColumn extends EncryptedV3Column<typeof NUMERIC> {}\nexport class EncryptedNumericEqColumn extends EncryptedV3Column<\n  typeof NUMERIC_EQ\n> {}\nexport class EncryptedNumericOrdOreColumn extends EncryptedV3Column<\n  typeof NUMERIC_ORD_ORE\n> {}\nexport class EncryptedNumericOrdColumn extends EncryptedV3Column<\n  typeof NUMERIC_ORD\n> {}\n\n// text (text_search is defined above with its match-tuning override)\nexport class EncryptedTextColumn extends EncryptedV3Column<typeof TEXT> {}\nexport class EncryptedTextEqColumn extends EncryptedV3Column<typeof TEXT_EQ> {}\nexport class EncryptedTextMatchColumn extends EncryptedV3Column<\n  typeof TEXT_MATCH\n> {}\nexport class EncryptedTextOrdOreColumn extends EncryptedV3Column<\n  typeof TEXT_ORD_ORE\n> {}\nexport class EncryptedTextOrdColumn extends EncryptedV3Column<\n  typeof TEXT_ORD\n> {}\n\n// boolean\nexport class EncryptedBooleanColumn extends EncryptedV3Column<typeof BOOLEAN> {}\n\n// real\nexport class EncryptedRealColumn extends EncryptedV3Column<typeof REAL> {}\nexport class EncryptedRealEqColumn extends EncryptedV3Column<typeof REAL_EQ> {}\nexport class EncryptedRealOrdOreColumn extends EncryptedV3Column<\n  typeof REAL_ORD_ORE\n> {}\nexport class EncryptedRealOrdColumn extends EncryptedV3Column<\n  typeof REAL_ORD\n> {}\n\n// double\nexport class EncryptedDoubleColumn extends EncryptedV3Column<typeof DOUBLE> {}\nexport class EncryptedDoubleEqColumn extends EncryptedV3Column<\n  typeof DOUBLE_EQ\n> {}\nexport class EncryptedDoubleOrdOreColumn extends EncryptedV3Column<\n  typeof DOUBLE_ORD_ORE\n> {}\nexport class EncryptedDoubleOrdColumn extends EncryptedV3Column<\n  typeof DOUBLE_ORD\n> {}\n\n// json\nconst JSON_DOMAIN = {\n  eqlType: 'public.eql_v3_json',\n  castAs: 'json',\n  capabilities: {\n    equality: false,\n    orderAndRange: false,\n    freeTextSearch: false,\n    searchableJson: true,\n  },\n} as const\n\n/**\n * Builder for a `public.eql_v3_json` column — an encrypted JSONB document\n * (a {@link JsonDocument}: object, array, or null). It round-trips through\n * `encrypt`/`decrypt`, and containment queries use the encrypted-JSONB index\n * emitted by `build()`. (The stored payload is protect-ffi's `SteVecDocument`,\n * and the config index kind is `ste_vec` — both protect-ffi names.)\n */\nexport class EncryptedJsonColumn extends EncryptedV3Column<typeof JSON_DOMAIN> {\n  constructor(columnName: string) {\n    super(columnName, JSON_DOMAIN)\n  }\n}\n\n/**\n * Union of every v3 concrete column type. Used as the value type for v3 table\n * columns so a table may mix any generated domains.\n */\nexport type AnyEncryptedV3Column =\n  | EncryptedIntegerColumn\n  | EncryptedIntegerEqColumn\n  | EncryptedIntegerOrdOreColumn\n  | EncryptedIntegerOrdColumn\n  | EncryptedSmallintColumn\n  | EncryptedSmallintEqColumn\n  | EncryptedSmallintOrdOreColumn\n  | EncryptedSmallintOrdColumn\n  | EncryptedBigintColumn\n  | EncryptedBigintEqColumn\n  | EncryptedBigintOrdOreColumn\n  | EncryptedBigintOrdColumn\n  | EncryptedDateColumn\n  | EncryptedDateEqColumn\n  | EncryptedDateOrdOreColumn\n  | EncryptedDateOrdColumn\n  | EncryptedTimestampColumn\n  | EncryptedTimestampEqColumn\n  | EncryptedTimestampOrdOreColumn\n  | EncryptedTimestampOrdColumn\n  | EncryptedNumericColumn\n  | EncryptedNumericEqColumn\n  | EncryptedNumericOrdOreColumn\n  | EncryptedNumericOrdColumn\n  | EncryptedTextColumn\n  | EncryptedTextEqColumn\n  | EncryptedTextMatchColumn\n  | EncryptedTextOrdOreColumn\n  | EncryptedTextOrdColumn\n  | EncryptedTextSearchColumn\n  | EncryptedBooleanColumn\n  | EncryptedRealColumn\n  | EncryptedRealEqColumn\n  | EncryptedRealOrdOreColumn\n  | EncryptedRealOrdColumn\n  | EncryptedDoubleColumn\n  | EncryptedDoubleEqColumn\n  | EncryptedDoubleOrdOreColumn\n  | EncryptedDoubleOrdColumn\n  | EncryptedJsonColumn\n\n/**\n * A factory that builds a concrete v3 column for a given DB column name.\n *\n * Declared here rather than beside `DOMAIN_REGISTRY` so that `./types` can\n * constrain its own export against it without importing from `./domain-registry`,\n * which imports `./types` back as a value.\n */\nexport type V3ColumnFactory = (name: string) => AnyEncryptedV3Column\n\n/**\n * Shape of v3 table columns: every value is a v3 concrete column builder.\n * (Nested fields are deferred to later increments.)\n */\nexport type EncryptedV3TableColumn = {\n  [key: string]: AnyEncryptedV3Column\n}\n\n/** A JSON value at any depth. Used for the values NESTED inside a document. */\nexport type JsonValue =\n  | string\n  | number\n  | boolean\n  | null\n  | JsonValue[]\n  | { [key: string]: JsonValue }\n\n/**\n * The plaintext a `public.eql_v3_json` column encrypts and reconstructs: a JSON\n * DOCUMENT — an object, an array, or `null`. NOT a bare top-level scalar:\n * protect-ffi's `json` cast rejects a top-level string/number/boolean\n * (\"Cannot convert … to Json\"), because a scalar belongs in a scalar domain\n * (`types.TextEq`, `types.IntegerEq`, …). Nested scalars are ordinary\n * {@link JsonValue}s and are fully supported.\n */\nexport type JsonDocument = null | JsonValue[] | { [key: string]: JsonValue }\n\n/** Map a domain's {@link PlaintextKind} to its TypeScript plaintext type. */\ntype PlaintextFromKind<K extends PlaintextKind> = K extends 'string'\n  ? string\n  : K extends 'number'\n    ? number\n    : K extends 'bigint'\n      ? bigint\n      : K extends 'boolean'\n        ? boolean\n        : K extends DateLikeCast\n          ? Date\n          : K extends 'json'\n            ? JsonDocument\n            : never\n\n/**\n * The plaintext type for a single v3 column, read from the literal domain\n * definition carried on the base class's private field. This is stable across\n * empty subclasses that share the same base generic — a subclass-name\n * conditional would collapse because those subclasses are structurally\n * assignable to one another.\n */\nexport type PlaintextForColumn<C> =\n  C extends EncryptedV3Column<infer D> ? PlaintextFromKind<D['castAs']> : never\n\n/**\n * The user-facing `queryType` names a v3 column supports, derived 1:1 from its\n * capability flags. Resolves to `never` for a storage-only column (all flags\n * `false`) and for any non-v3 value. The names mirror the {@link QueryCapabilities}\n * keys and the first three {@link import('@/types').QueryTypeName} members.\n */\nexport type QueryTypesForColumn<C> =\n  C extends EncryptedV3Column<infer D>\n    ?\n        | (D['capabilities']['equality'] extends true ? 'equality' : never)\n        | (D['capabilities']['orderAndRange'] extends true\n            ? 'orderAndRange'\n            : never)\n        | (D['capabilities']['freeTextSearch'] extends true\n            ? 'freeTextSearch'\n            : never)\n    : never\n\n/**\n * The concrete EQL v3 type string for a single column, read from the literal\n * domain definition carried on the base class's private field (mirrors\n * {@link PlaintextForColumn}). Distributes over a union of columns, so\n * `EqlTypeForColumn<AnyEncryptedV3Column>` yields the union of every domain's\n * `eqlType` — the canonical, source-of-truth key set for a type-driven test\n * matrix keyed by domain.\n */\nexport type EqlTypeForColumn<C> =\n  C extends EncryptedV3Column<infer D> ? D['eqlType'] : never\n","import {\n  BIGINT,\n  BIGINT_EQ,\n  BIGINT_ORD,\n  BIGINT_ORD_ORE,\n  BOOLEAN,\n  DATE,\n  DATE_EQ,\n  DATE_ORD,\n  DATE_ORD_ORE,\n  DOUBLE,\n  DOUBLE_EQ,\n  DOUBLE_ORD,\n  DOUBLE_ORD_ORE,\n  EncryptedBigintColumn,\n  EncryptedBigintEqColumn,\n  EncryptedBigintOrdColumn,\n  EncryptedBigintOrdOreColumn,\n  EncryptedBooleanColumn,\n  EncryptedDateColumn,\n  EncryptedDateEqColumn,\n  EncryptedDateOrdColumn,\n  EncryptedDateOrdOreColumn,\n  EncryptedDoubleColumn,\n  EncryptedDoubleEqColumn,\n  EncryptedDoubleOrdColumn,\n  EncryptedDoubleOrdOreColumn,\n  EncryptedIntegerColumn,\n  EncryptedIntegerEqColumn,\n  EncryptedIntegerOrdColumn,\n  EncryptedIntegerOrdOreColumn,\n  EncryptedJsonColumn,\n  EncryptedNumericColumn,\n  EncryptedNumericEqColumn,\n  EncryptedNumericOrdColumn,\n  EncryptedNumericOrdOreColumn,\n  EncryptedRealColumn,\n  EncryptedRealEqColumn,\n  EncryptedRealOrdColumn,\n  EncryptedRealOrdOreColumn,\n  EncryptedSmallintColumn,\n  EncryptedSmallintEqColumn,\n  EncryptedSmallintOrdColumn,\n  EncryptedSmallintOrdOreColumn,\n  EncryptedTextColumn,\n  EncryptedTextEqColumn,\n  EncryptedTextMatchColumn,\n  EncryptedTextOrdColumn,\n  EncryptedTextOrdOreColumn,\n  EncryptedTextSearchColumn,\n  EncryptedTimestampColumn,\n  EncryptedTimestampEqColumn,\n  EncryptedTimestampOrdColumn,\n  EncryptedTimestampOrdOreColumn,\n  INTEGER,\n  INTEGER_EQ,\n  INTEGER_ORD,\n  INTEGER_ORD_ORE,\n  NUMERIC,\n  NUMERIC_EQ,\n  NUMERIC_ORD,\n  NUMERIC_ORD_ORE,\n  REAL,\n  REAL_EQ,\n  REAL_ORD,\n  REAL_ORD_ORE,\n  SMALLINT,\n  SMALLINT_EQ,\n  SMALLINT_ORD,\n  SMALLINT_ORD_ORE,\n  TEXT,\n  TEXT_EQ,\n  TEXT_MATCH,\n  TEXT_ORD,\n  TEXT_ORD_ORE,\n  TIMESTAMP,\n  TIMESTAMP_EQ,\n  TIMESTAMP_ORD,\n  TIMESTAMP_ORD_ORE,\n  type V3ColumnFactory,\n} from './columns'\n\n/**\n * The v3 column-type namespace. Each member is a public, semantic factory name\n * for a concrete EQL v3 column. Most members mirror the underlying domain name;\n * JS-friendly scalar names map to Postgres concrete domains, e.g.\n * `types.IntegerOrd` builds a `public.eql_v3_integer_ord` column and `types.Boolean`\n * builds a `public.eql_v3_boolean` column.\n *\n * If these factory names stop matching the emitted capability/domain surface,\n * the stack package is out of sync with the underlying EQL build. That is a\n * version mismatch, not a harmless naming drift.\n *\n * Each factory returns the CONCRETE column class instance (never the widened\n * `AnyEncryptedV3Column`) so per-column plaintext / query-capability inference\n * stays precise.\n *\n * ```ts\n * import { encryptedTable, types } from '@cipherstash/stack/eql/v3'\n *\n * const events = encryptedTable('events', {\n *   actor:     types.TextEq('actor'),           // equality\n *   weight:    types.IntegerOrd('weight'),         // order + range\n *   createdAt: types.Timestamp('created_at'), // storage only\n * })\n * ```\n *\n * `types.TextSearch` is fully described by its type — like every other domain,\n * it has no capability-bearing or tuning chain. Its match index is always\n * emitted with the default configuration; run a free-text query by passing\n * `queryType: 'freeTextSearch'` to `encryptQuery`.\n */\nexport const types = {\n  // integer\n  Integer: (name: string) => new EncryptedIntegerColumn(name, INTEGER),\n  IntegerEq: (name: string) => new EncryptedIntegerEqColumn(name, INTEGER_EQ),\n  IntegerOrdOre: (name: string) =>\n    new EncryptedIntegerOrdOreColumn(name, INTEGER_ORD_ORE),\n  IntegerOrd: (name: string) =>\n    new EncryptedIntegerOrdColumn(name, INTEGER_ORD),\n\n  // smallint\n  Smallint: (name: string) => new EncryptedSmallintColumn(name, SMALLINT),\n  SmallintEq: (name: string) =>\n    new EncryptedSmallintEqColumn(name, SMALLINT_EQ),\n  SmallintOrdOre: (name: string) =>\n    new EncryptedSmallintOrdOreColumn(name, SMALLINT_ORD_ORE),\n  SmallintOrd: (name: string) =>\n    new EncryptedSmallintOrdColumn(name, SMALLINT_ORD),\n\n  // bigint (int8) — plaintext is a JS `bigint`, round-tripped losslessly by\n  // the native protect-ffi boundary (see ./columns)\n  Bigint: (name: string) => new EncryptedBigintColumn(name, BIGINT),\n  BigintEq: (name: string) => new EncryptedBigintEqColumn(name, BIGINT_EQ),\n  BigintOrdOre: (name: string) =>\n    new EncryptedBigintOrdOreColumn(name, BIGINT_ORD_ORE),\n  BigintOrd: (name: string) => new EncryptedBigintOrdColumn(name, BIGINT_ORD),\n\n  // date\n  Date: (name: string) => new EncryptedDateColumn(name, DATE),\n  DateEq: (name: string) => new EncryptedDateEqColumn(name, DATE_EQ),\n  DateOrdOre: (name: string) =>\n    new EncryptedDateOrdOreColumn(name, DATE_ORD_ORE),\n  DateOrd: (name: string) => new EncryptedDateOrdColumn(name, DATE_ORD),\n\n  // timestamp\n  Timestamp: (name: string) => new EncryptedTimestampColumn(name, TIMESTAMP),\n  TimestampEq: (name: string) =>\n    new EncryptedTimestampEqColumn(name, TIMESTAMP_EQ),\n  TimestampOrdOre: (name: string) =>\n    new EncryptedTimestampOrdOreColumn(name, TIMESTAMP_ORD_ORE),\n  TimestampOrd: (name: string) =>\n    new EncryptedTimestampOrdColumn(name, TIMESTAMP_ORD),\n\n  // numeric\n  Numeric: (name: string) => new EncryptedNumericColumn(name, NUMERIC),\n  NumericEq: (name: string) => new EncryptedNumericEqColumn(name, NUMERIC_EQ),\n  NumericOrdOre: (name: string) =>\n    new EncryptedNumericOrdOreColumn(name, NUMERIC_ORD_ORE),\n  NumericOrd: (name: string) =>\n    new EncryptedNumericOrdColumn(name, NUMERIC_ORD),\n\n  // text\n  Text: (name: string) => new EncryptedTextColumn(name, TEXT),\n  TextEq: (name: string) => new EncryptedTextEqColumn(name, TEXT_EQ),\n  TextMatch: (name: string) => new EncryptedTextMatchColumn(name, TEXT_MATCH),\n  TextOrdOre: (name: string) =>\n    new EncryptedTextOrdOreColumn(name, TEXT_ORD_ORE),\n  TextOrd: (name: string) => new EncryptedTextOrdColumn(name, TEXT_ORD),\n  TextSearch: (name: string) => new EncryptedTextSearchColumn(name),\n\n  // boolean\n  Boolean: (name: string) => new EncryptedBooleanColumn(name, BOOLEAN),\n\n  // real\n  Real: (name: string) => new EncryptedRealColumn(name, REAL),\n  RealEq: (name: string) => new EncryptedRealEqColumn(name, REAL_EQ),\n  RealOrdOre: (name: string) =>\n    new EncryptedRealOrdOreColumn(name, REAL_ORD_ORE),\n  RealOrd: (name: string) => new EncryptedRealOrdColumn(name, REAL_ORD),\n\n  // double\n  Double: (name: string) => new EncryptedDoubleColumn(name, DOUBLE),\n  DoubleEq: (name: string) => new EncryptedDoubleEqColumn(name, DOUBLE_EQ),\n  DoubleOrdOre: (name: string) =>\n    new EncryptedDoubleOrdOreColumn(name, DOUBLE_ORD_ORE),\n  DoubleOrd: (name: string) => new EncryptedDoubleOrdColumn(name, DOUBLE_ORD),\n\n  // json (encrypted JSONB document, ste_vec containment)\n  Json: (name: string) => new EncryptedJsonColumn(name),\n  // `satisfies` is load-bearing, not decoration: `DOMAIN_REGISTRY` derives itself\n  // by calling every value here at module load. A non-factory export would throw\n  // during module evaluation and take the supabase introspect/schema-build/verify\n  // path down with it. This turns that into a compile error at the offending line.\n  // `as const` applies first, so literal key inference is preserved.\n} as const satisfies Record<string, V3ColumnFactory>\n"],"mappings":";;;;;AAmCO,IAAM,kBAAkB,CAAC,QAAQ,WAAW;AAuCnD,IAAM,eAAe;AAAA,EACnB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,gBAAgB;AAAA,EACpB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,kBAAkB;AAAA,EACtB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,aAAa;AAAA,EACjB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,cAAc;AAAA,EAClB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAOO,IAAM,uBAAuB;AAS7B,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,kBAAkB;AAAA,EAC7B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,mBAAmB;AAAA,EAC9B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAOO,IAAM,SAAS;AAAA,EACpB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,YAAY;AAAA,EACvB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,iBAAiB;AAAA,EAC5B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,OAAO;AAAA,EAClB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,YAAY;AAAA,EACvB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,oBAAoB;AAAA,EAC/B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,gBAAgB;AAAA,EAC3B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,kBAAkB;AAAA,EAC7B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,OAAO;AAAA,EAClB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,OAAO;AAAA,EAClB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,SAAS;AAAA,EACpB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,YAAY;AAAA,EACvB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,iBAAiB;AAAA,EAC5B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAuBA,SAAS,uBACP,cACA,QACA,UACyB;AACzB,QAAM,UAAmC,CAAC;AAK1C,MACE,aAAa,aACZ,CAAC,aAAa,iBAAiB,WAAW,WAC3C;AACA,YAAQ,SAAS,EAAE,eAAe,CAAC,EAAE;AAAA,EACvC;AAEA,MAAI,aAAa,eAAe;AAC9B,YAAQ,QAAQ,IAAI,CAAC;AAAA,EACvB;AAEA,MAAI,aAAa,gBAAgB;AAW/B,YAAQ,QAAQ,EAAE,GAAG,iBAAiB,GAAG,kBAAkB,MAAM;AAAA,EACnE;AAEA,MAAI,aAAa,gBAAgB;AAiB/B,YAAQ,UAAU;AAAA,MAChB,QAAQ;AAAA,MACR,kBAAkB,EAAE,MAAM,MAAM,UAAU,MAAM,UAAU,MAAM;AAAA,MAChE,MAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO;AACT;AAOA,SAAS,mBAAmB,SAAgC;AAC1D,SAAO,QAAQ,SAAS,UAAU,IAAI,QAAQ;AAChD;AAGA,SAAS,wBAAwB,cAA0C;AACzE,SACE,aAAa,YACb,aAAa,iBACb,aAAa,mBACZ,aAAa,kBAAkB;AAEpC;AAUO,IAAM,oBAAN,MAAsD;AAAA,EAC3D,YACmB,YACA,YACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAFgB;AAAA,EACA;AAAA,EAGnB,UAAkB;AAChB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,aAA2B;AACzB,WAAO,KAAK,WAAW;AAAA,EACzB;AAAA;AAAA,EAGA,uBAA0C;AACxC,WAAO,KAAK,WAAW;AAAA,EACzB;AAAA;AAAA,EAGA,cAAgC;AAC9B,WAAO;AAAA,MACL,KAAK,WAAW;AAAA,IAClB;AAAA,EACF;AAAA;AAAA,EAGA,QAAsB;AACpB,WAAO;AAAA,MACL,SAAS,KAAK,WAAW;AAAA,MACzB,SAAS;AAAA,QACP,KAAK,WAAW;AAAA,QAChB,KAAK,WAAW;AAAA,QAChB,mBAAmB,KAAK,WAAW,OAAO;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAM,qBAAqB;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAuBO,IAAM,4BAAN,cAAwC,kBAE7C;AAAA,EACA,YAAY,YAAoB;AAC9B,UAAM,YAAY,kBAAkB;AAAA,EACtC;AACF;AAaO,IAAM,yBAAN,cAAqC,kBAAkC;AAAC;AACxE,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,+BAAN,cAA2C,kBAEhD;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AAGI,IAAM,0BAAN,cAAsC,kBAE3C;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,gCAAN,cAA4C,kBAEjD;AAAC;AACI,IAAM,6BAAN,cAAyC,kBAE9C;AAAC;AAII,IAAM,wBAAN,cAAoC,kBAAiC;AAAC;AACtE,IAAM,0BAAN,cAAsC,kBAE3C;AAAC;AACI,IAAM,8BAAN,cAA0C,kBAE/C;AAAC;AACI,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AAGI,IAAM,sBAAN,cAAkC,kBAA+B;AAAC;AAClE,IAAM,wBAAN,cAAoC,kBAAkC;AAAC;AACvE,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,yBAAN,cAAqC,kBAE1C;AAAC;AAGI,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,6BAAN,cAAyC,kBAE9C;AAAC;AACI,IAAM,iCAAN,cAA6C,kBAElD;AAAC;AACI,IAAM,8BAAN,cAA0C,kBAE/C;AAAC;AAGI,IAAM,yBAAN,cAAqC,kBAAkC;AAAC;AACxE,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,+BAAN,cAA2C,kBAEhD;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AAGI,IAAM,sBAAN,cAAkC,kBAA+B;AAAC;AAClE,IAAM,wBAAN,cAAoC,kBAAkC;AAAC;AACvE,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,yBAAN,cAAqC,kBAE1C;AAAC;AAGI,IAAM,yBAAN,cAAqC,kBAAkC;AAAC;AAGxE,IAAM,sBAAN,cAAkC,kBAA+B;AAAC;AAClE,IAAM,wBAAN,cAAoC,kBAAkC;AAAC;AACvE,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,yBAAN,cAAqC,kBAE1C;AAAC;AAGI,IAAM,wBAAN,cAAoC,kBAAiC;AAAC;AACtE,IAAM,0BAAN,cAAsC,kBAE3C;AAAC;AACI,IAAM,8BAAN,cAA0C,kBAE/C;AAAC;AACI,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AAGH,IAAM,cAAc;AAAA,EAClB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAAA,IACZ,UAAU;AAAA,IACV,eAAe;AAAA,IACf,gBAAgB;AAAA,IAChB,gBAAgB;AAAA,EAClB;AACF;AASO,IAAM,sBAAN,cAAkC,kBAAsC;AAAA,EAC7E,YAAY,YAAoB;AAC9B,UAAM,YAAY,WAAW;AAAA,EAC/B;AACF;;;AC9hBO,IAAM,QAAQ;AAAA;AAAA,EAEnB,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,OAAO;AAAA,EACnE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA,EAC1E,eAAe,CAAC,SACd,IAAI,6BAA6B,MAAM,eAAe;AAAA,EACxD,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,WAAW;AAAA;AAAA,EAGjD,UAAU,CAAC,SAAiB,IAAI,wBAAwB,MAAM,QAAQ;AAAA,EACtE,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,WAAW;AAAA,EACjD,gBAAgB,CAAC,SACf,IAAI,8BAA8B,MAAM,gBAAgB;AAAA,EAC1D,aAAa,CAAC,SACZ,IAAI,2BAA2B,MAAM,YAAY;AAAA;AAAA;AAAA,EAInD,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,MAAM;AAAA,EAChE,UAAU,CAAC,SAAiB,IAAI,wBAAwB,MAAM,SAAS;AAAA,EACvE,cAAc,CAAC,SACb,IAAI,4BAA4B,MAAM,cAAc;AAAA,EACtD,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA;AAAA,EAG1E,MAAM,CAAC,SAAiB,IAAI,oBAAoB,MAAM,IAAI;AAAA,EAC1D,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,OAAO;AAAA,EACjE,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,YAAY;AAAA,EAClD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,QAAQ;AAAA;AAAA,EAGpE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,SAAS;AAAA,EACzE,aAAa,CAAC,SACZ,IAAI,2BAA2B,MAAM,YAAY;AAAA,EACnD,iBAAiB,CAAC,SAChB,IAAI,+BAA+B,MAAM,iBAAiB;AAAA,EAC5D,cAAc,CAAC,SACb,IAAI,4BAA4B,MAAM,aAAa;AAAA;AAAA,EAGrD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,OAAO;AAAA,EACnE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA,EAC1E,eAAe,CAAC,SACd,IAAI,6BAA6B,MAAM,eAAe;AAAA,EACxD,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,WAAW;AAAA;AAAA,EAGjD,MAAM,CAAC,SAAiB,IAAI,oBAAoB,MAAM,IAAI;AAAA,EAC1D,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,OAAO;AAAA,EACjE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA,EAC1E,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,YAAY;AAAA,EAClD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,QAAQ;AAAA,EACpE,YAAY,CAAC,SAAiB,IAAI,0BAA0B,IAAI;AAAA;AAAA,EAGhE,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,OAAO;AAAA;AAAA,EAGnE,MAAM,CAAC,SAAiB,IAAI,oBAAoB,MAAM,IAAI;AAAA,EAC1D,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,OAAO;AAAA,EACjE,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,YAAY;AAAA,EAClD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,QAAQ;AAAA;AAAA,EAGpE,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,MAAM;AAAA,EAChE,UAAU,CAAC,SAAiB,IAAI,wBAAwB,MAAM,SAAS;AAAA,EACvE,cAAc,CAAC,SACb,IAAI,4BAA4B,MAAM,cAAc;AAAA,EACtD,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA;AAAA,EAG1E,MAAM,CAAC,SAAiB,IAAI,oBAAoB,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAMtD;","names":[]}
+{"version":3,"sources":["../src/eql/v3/columns.ts","../src/eql/v3/types.ts"],"sourcesContent":["import type { ColumnSchema } from '@/schema'\nimport { defaultMatchOpts } from '@/schema/match-defaults'\n\n/**\n * The query capabilities a v3 concrete domain exposes. These are SDK-facing\n * semantic flags describing what kinds of query terms a column can produce —\n * NOT the raw EQL index keys. They are metadata only and never emitted by\n * `build()`.\n *\n * - `equality`: exact-match lookups (EQL `hm`, or comparison via `ob`).\n * - `orderAndRange`: comparison / range lookups (EQL `op`, or `ob` on `_ord_ore` domains).\n * - `freeTextSearch`: tokenised substring match (EQL `bf`).\n * - `searchableJson`: encrypted-JSONB containment / selector lookups (EQL\n *   `ste_vec`). Optional and mutually exclusive with the scalar flags — a\n *   `public.eql_v3_json` document is queried by structure, not by scalar term.\n */\nexport type QueryCapabilities = Readonly<{\n  equality: boolean\n  orderAndRange: boolean\n  freeTextSearch: boolean\n  searchableJson?: boolean\n}>\n\n/**\n * The `cast_as` kinds whose decrypted plaintext reconstructs to a JS `Date`.\n *\n * SINGLE SOURCE OF TRUTH for the date-like set. Both the type-level\n * {@link PlaintextFromKind} and the runtime `rowReconstructor` (encryption/v3.ts)\n * derive their \"reconstructs to `Date`\" decision from this array, so the next\n * `Date`-backed cast is added in exactly one place — never hand-synced across a\n * type and a runtime guard that could silently drift.\n *\n * (`timestamp` reconstructs to `Date` just like `date`, but its `cast_as` tells\n * the FFI not to truncate the time-of-day.)\n */\nexport const DATE_LIKE_CASTS = ['date', 'timestamp'] as const\n/** A `cast_as` kind that reconstructs to `Date` — see {@link DATE_LIKE_CASTS}. */\nexport type DateLikeCast = (typeof DATE_LIKE_CASTS)[number]\n\n/** The plaintext (TypeScript) kind a v3 domain decrypts to. A subset of the\n * SDK `CastAs` enum, restricted to the scalar kinds v3 domains actually use. */\ntype PlaintextKind =\n  | 'string'\n  | 'number'\n  | 'bigint'\n  | 'boolean'\n  | 'json'\n  | DateLikeCast\n\n/**\n * The full, literal definition of a v3 domain. This is the LOAD-BEARING type:\n * the base column class carries a private field of this type so that every\n * concrete (otherwise-empty) subclass is discriminated by its literal\n * `eqlType`/`castAs`/`capabilities` — TypeScript empty subclasses are NOT\n * nominal, so without this a storage-only `boolean` column would be assignable to\n * a storage-only `date` column and plaintext inference would collapse.\n */\ntype V3DomainDefinition = Readonly<{\n  eqlType: `public.${string}`\n  castAs: PlaintextKind\n  capabilities: QueryCapabilities\n}>\n\n/** Type-level mirror of {@link isQueryableCapabilities}: `false` for a\n * storage-only domain (all capability flags `false`), `true` otherwise. */\ntype QueryableFlag<D extends V3DomainDefinition> = D['capabilities'] extends {\n  equality: false\n  orderAndRange: false\n  freeTextSearch: false\n  searchableJson?: false | undefined\n}\n  ? false\n  : true\n\nconst STORAGE_ONLY = {\n  equality: false,\n  orderAndRange: false,\n  freeTextSearch: false,\n} as const\n\nconst EQUALITY_ONLY = {\n  equality: true,\n  orderAndRange: false,\n  freeTextSearch: false,\n} as const\n\nconst ORDER_AND_RANGE = {\n  equality: true,\n  orderAndRange: true,\n  freeTextSearch: false,\n} as const\n\nconst MATCH_ONLY = {\n  equality: false,\n  orderAndRange: false,\n  freeTextSearch: true,\n} as const\n\nconst TEXT_SEARCH = {\n  equality: true,\n  orderAndRange: true,\n  freeTextSearch: true,\n} as const\n\n/**\n * The concrete EQL v3 domain name for a full-capability text column.\n * Recorded as metadata for future DDL / query-dialect increments; it is\n * intentionally absent from the emitted encrypt config.\n */\nexport const TEXT_SEARCH_EQL_TYPE = 'public.eql_v3_text_search'\n\n// Per-domain literal definitions. Each concrete column subclass is parameterised\n// by `typeof <CONST>`; the literal `eqlType`/`castAs`/`capabilities` on each is\n// what makes the otherwise-empty subclasses nominally distinct (see\n// V3DomainDefinition). Order mirrors eql-bindings `CATALOG` order.\n//\n// Exported for the `types` namespace factory (see ./types); they are internal\n// building blocks and are intentionally NOT re-exported from the public barrel.\nexport const INTEGER = {\n  eqlType: 'public.eql_v3_integer',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const INTEGER_EQ = {\n  eqlType: 'public.eql_v3_integer_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const INTEGER_ORD_ORE = {\n  eqlType: 'public.eql_v3_integer_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const INTEGER_ORD = {\n  eqlType: 'public.eql_v3_integer_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const SMALLINT = {\n  eqlType: 'public.eql_v3_smallint',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const SMALLINT_EQ = {\n  eqlType: 'public.eql_v3_smallint_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const SMALLINT_ORD_ORE = {\n  eqlType: 'public.eql_v3_smallint_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const SMALLINT_ORD = {\n  eqlType: 'public.eql_v3_smallint_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\n// bigint (int8) domains. Plaintext is a JS `bigint` (always decrypts to\n// `bigint`); bounds are the full i64 range. protect-ffi round-trips an in-range\n// native bigint losslessly, and values outside the signed 64-bit range are\n// rejected client-side by `assertValidNumericValue` before they reach the FFI\n// (`*_ord_ope` variants are out of scope — CIP-3403.)\nexport const BIGINT = {\n  eqlType: 'public.eql_v3_bigint',\n  castAs: 'bigint',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const BIGINT_EQ = {\n  eqlType: 'public.eql_v3_bigint_eq',\n  castAs: 'bigint',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const BIGINT_ORD_ORE = {\n  eqlType: 'public.eql_v3_bigint_ord_ore',\n  castAs: 'bigint',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const BIGINT_ORD = {\n  eqlType: 'public.eql_v3_bigint_ord',\n  castAs: 'bigint',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const DATE = {\n  eqlType: 'public.eql_v3_date',\n  castAs: 'date',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const DATE_EQ = {\n  eqlType: 'public.eql_v3_date_eq',\n  castAs: 'date',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const DATE_ORD_ORE = {\n  eqlType: 'public.eql_v3_date_ord_ore',\n  castAs: 'date',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const DATE_ORD = {\n  eqlType: 'public.eql_v3_date_ord',\n  castAs: 'date',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const TIMESTAMP = {\n  eqlType: 'public.eql_v3_timestamp',\n  castAs: 'timestamp',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const TIMESTAMP_EQ = {\n  eqlType: 'public.eql_v3_timestamp_eq',\n  castAs: 'timestamp',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const TIMESTAMP_ORD_ORE = {\n  eqlType: 'public.eql_v3_timestamp_ord_ore',\n  castAs: 'timestamp',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const TIMESTAMP_ORD = {\n  eqlType: 'public.eql_v3_timestamp_ord',\n  castAs: 'timestamp',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const NUMERIC = {\n  eqlType: 'public.eql_v3_numeric',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const NUMERIC_EQ = {\n  eqlType: 'public.eql_v3_numeric_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const NUMERIC_ORD_ORE = {\n  eqlType: 'public.eql_v3_numeric_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const NUMERIC_ORD = {\n  eqlType: 'public.eql_v3_numeric_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const TEXT = {\n  eqlType: 'public.eql_v3_text',\n  castAs: 'string',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const TEXT_EQ = {\n  eqlType: 'public.eql_v3_text_eq',\n  castAs: 'string',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const TEXT_MATCH = {\n  eqlType: 'public.eql_v3_text_match',\n  castAs: 'string',\n  capabilities: MATCH_ONLY,\n} as const\nexport const TEXT_ORD_ORE = {\n  eqlType: 'public.eql_v3_text_ord_ore',\n  castAs: 'string',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const TEXT_ORD = {\n  eqlType: 'public.eql_v3_text_ord',\n  castAs: 'string',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const BOOLEAN = {\n  eqlType: 'public.eql_v3_boolean',\n  castAs: 'boolean',\n  capabilities: STORAGE_ONLY,\n} as const\n\nexport const REAL = {\n  eqlType: 'public.eql_v3_real',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const REAL_EQ = {\n  eqlType: 'public.eql_v3_real_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const REAL_ORD_ORE = {\n  eqlType: 'public.eql_v3_real_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const REAL_ORD = {\n  eqlType: 'public.eql_v3_real_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\nexport const DOUBLE = {\n  eqlType: 'public.eql_v3_double',\n  castAs: 'number',\n  capabilities: STORAGE_ONLY,\n} as const\nexport const DOUBLE_EQ = {\n  eqlType: 'public.eql_v3_double_eq',\n  castAs: 'number',\n  capabilities: EQUALITY_ONLY,\n} as const\nexport const DOUBLE_ORD_ORE = {\n  eqlType: 'public.eql_v3_double_ord_ore',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\nexport const DOUBLE_ORD = {\n  eqlType: 'public.eql_v3_double_ord',\n  castAs: 'number',\n  capabilities: ORDER_AND_RANGE,\n} as const\n\n/**\n * Translate a domain's semantic {@link QueryCapabilities} (plus its plaintext\n * `castAs`, which decides how equality is answered, and its ordering flavour)\n * into the concrete EQL index block emitted by `build()`.\n *\n * - `unique` (the `hm` HMAC index) whenever equality is answered via HMAC:\n *   equality-only domains of ANY type, AND text order domains. Text equality is\n *   HMAC-based — the `public.eql_v3_text_ord` / `public.eql_v3_text_ord_ore` SQL domains\n *   REQUIRE `hm` in the stored ciphertext (their `eql_v3.eq_term` extracts it).\n * - ONE ordering index for any order/range domain, selected by the domain's\n *   name (eql-3.0.0): plain `_ord` domains (and `text_search`) are OPE-backed —\n *   `ope`, the `op` CLLW-OPE term — while `_ord_ore` domains keep block-ORE —\n *   `ore`, the `ob` term. The two terms are not cross-comparable, and each\n *   domain's SQL CHECK requires exactly its own. For numeric/date order\n *   domains the ordering term also answers equality (via the SQL `=`\n *   operator), so those emit no `hm`. Text order domains emit BOTH `unique`\n *   and the ordering index.\n * - `match` (the `bf` bloom-filter index) for free-text search, deep-cloned from\n *   the per-call defaults so no nested object is ever shared across columns, and\n *   emitted with `include_original: false` (see below).\n */\nfunction indexesForCapabilities(\n  capabilities: QueryCapabilities,\n  castAs: PlaintextKind,\n  ordering: 'ope' | 'ore',\n): ColumnSchema['indexes'] {\n  const indexes: ColumnSchema['indexes'] = {}\n\n  // Text equality is always HMAC-based, so a text order domain (`string` +\n  // order/range) still needs `unique`; numeric/date order domains answer\n  // equality via their ordering term and must NOT emit `unique`.\n  if (\n    capabilities.equality &&\n    (!capabilities.orderAndRange || castAs === 'string')\n  ) {\n    indexes.unique = { token_filters: [] }\n  }\n\n  if (capabilities.orderAndRange) {\n    indexes[ordering] = {}\n  }\n\n  if (capabilities.freeTextSearch) {\n    // The factory returns fresh, unaliased nested objects per call, so no\n    // column's emitted match block ever shares state with another's.\n    //\n    // `include_original` is overridden off the v2 builder's `true`. protect-ffi\n    // ignores the flag entirely (measured across 0.24 and 0.29, EQL v2 and v3:\n    // the emitted bloom is trigram-only either way, and a value shorter than\n    // `token_length` blooms to nothing regardless), so this is inert today. It\n    // is set to the value a substring-search domain actually wants — matching\n    // the zod schema's own default — so that a protect-ffi release which starts\n    // honouring the flag cannot silently break `contains`.\n    indexes.match = { ...defaultMatchOpts(), include_original: false }\n  }\n\n  if (capabilities.searchableJson) {\n    // Encrypted-JSONB index (the protect-ffi config kind is named `ste_vec`).\n    // `prefix: 'enabled'` is a sentinel the table's `build()` rewrites to\n    // `${tableName}/${columnName}` — the same scheme v2 `searchableJson` uses —\n    // so each document's selectors are scoped to their column.\n    //\n    // `array_index_mode` indexes array elements by identity (`item`) and enables\n    // `$[*]` wildcard selectors, but deliberately drops `position`: `@>`\n    // containment must be a subset test (jsonb `@>` semantics), so `{roles:['x']}`\n    // matches any document whose `roles` array contains `x` REGARDLESS of index.\n    // With positional terms emitted (v2 `searchableJson`'s `'all'`), the needle\n    // for `x`-at-index-0 would miss a document holding `x` at index 1.\n    //\n    // `mode: 'compat'` is REQUIRED for eql-3.0.0: `public.eql_v3_json` orders the\n    // document's entries by the CLLW-OPE `op` term, so the index must emit `op`\n    // (compat) terms. `'standard'` emits v2's CLLW-ORE `oc` terms, which the v3\n    // domain rejects at encrypt time.\n    indexes.ste_vec = {\n      prefix: 'enabled',\n      array_index_mode: { item: true, wildcard: true, position: false },\n      mode: 'compat',\n    }\n  }\n\n  return indexes\n}\n\n/**\n * The ordering flavour a domain's name pins (eql-3.0.0): `_ord_ore` domains\n * are block-ORE (`ore` index, `ob` term); every other ordering domain —\n * `_ord` and `text_search` — is CLLW-OPE (`ope` index, `op` term).\n */\nfunction orderingForEqlType(eqlType: string): 'ope' | 'ore' {\n  return eqlType.endsWith('_ord_ore') ? 'ore' : 'ope'\n}\n\n/** Whether a domain's capabilities make it queryable at all (any flag set). */\nfunction isQueryableCapabilities(capabilities: QueryCapabilities): boolean {\n  return (\n    capabilities.equality ||\n    capabilities.orderAndRange ||\n    capabilities.freeTextSearch ||\n    (capabilities.searchableJson ?? false)\n  )\n}\n\n/**\n * Shared base for every v3 concrete domain column. Parameterised by the FULL\n * literal {@link V3DomainDefinition} (not by capabilities alone): the private\n * `definition` field carries the literal `eqlType`/`castAs`/`capabilities`, so\n * two otherwise-empty subclasses (e.g. `EncryptedBooleanColumn` and\n * `EncryptedDateColumn`, both storage-only) are NOT mutually assignable. This\n * nominality is what keeps plaintext inference precise.\n */\nexport class EncryptedV3Column<D extends V3DomainDefinition> {\n  constructor(\n    private readonly columnName: string,\n    private readonly definition: D,\n  ) {}\n\n  getName(): string {\n    return this.columnName\n  }\n\n  /** The concrete EQL v3 domain name. Metadata only; not emitted by `build()`. */\n  getEqlType(): D['eqlType'] {\n    return this.definition.eqlType\n  }\n\n  /** The semantic query capabilities this domain exposes. Metadata only. */\n  getQueryCapabilities(): D['capabilities'] {\n    return this.definition.capabilities\n  }\n\n  /** `true` when this domain can produce at least one kind of query term. */\n  isQueryable(): QueryableFlag<D> {\n    return isQueryableCapabilities(\n      this.definition.capabilities,\n    ) as QueryableFlag<D>\n  }\n\n  /** Emit the encrypt-config column: `cast_as` plus capability-derived indexes. */\n  build(): ColumnSchema {\n    return {\n      cast_as: this.definition.castAs,\n      indexes: indexesForCapabilities(\n        this.definition.capabilities,\n        this.definition.castAs,\n        orderingForEqlType(this.definition.eqlType),\n      ),\n    }\n  }\n}\n\nconst TEXT_SEARCH_DOMAIN = {\n  eqlType: TEXT_SEARCH_EQL_TYPE,\n  castAs: 'string',\n  capabilities: TEXT_SEARCH,\n} as const\n\n/**\n * Builder for a `public.eql_v3_text_search` column.\n *\n * The concrete type inherently enables equality + order/range + free-text\n * match — there are no capability-enabling or tuning methods. The match index\n * is always emitted with the default configuration.\n *\n * NOTE — querying: a `text_search` column emits all three indexes (`unique`,\n * `ope`, `match`), and the shared index-inference picks them by fixed priority\n * `unique > match > ordering`. So `encryptQuery(value, { column, table })` with NO\n * explicit `queryType` builds an EQUALITY term (via `unique`), NOT a free-text\n * match — a substring like `'joh'` then matches nothing. To run a free-text\n * match query you MUST pass `queryType: 'freeTextSearch'`:\n *\n * ```typescript\n * // equality (default): exact value only\n * client.encryptQuery('john@example.com', { column: users.email, table: users })\n * // free-text match: substring/token search\n * client.encryptQuery('joh', { column: users.email, table: users, queryType: 'freeTextSearch' })\n * ```\n */\nexport class EncryptedTextSearchColumn extends EncryptedV3Column<\n  typeof TEXT_SEARCH_DOMAIN\n> {\n  constructor(columnName: string) {\n    super(columnName, TEXT_SEARCH_DOMAIN)\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Concrete domain columns\n//\n// Every concrete class is an empty subclass parameterised by its literal domain\n// definition (see EncryptedV3Column). The `types` namespace (see ./types)\n// constructs these with the SAME literal constant so the instance's private\n// `definition` field carries full literal type data — that is what keeps\n// distinct domains nominally incompatible.\n// ---------------------------------------------------------------------------\n\n// integer\nexport class EncryptedIntegerColumn extends EncryptedV3Column<typeof INTEGER> {}\nexport class EncryptedIntegerEqColumn extends EncryptedV3Column<\n  typeof INTEGER_EQ\n> {}\nexport class EncryptedIntegerOrdOreColumn extends EncryptedV3Column<\n  typeof INTEGER_ORD_ORE\n> {}\nexport class EncryptedIntegerOrdColumn extends EncryptedV3Column<\n  typeof INTEGER_ORD\n> {}\n\n// smallint\nexport class EncryptedSmallintColumn extends EncryptedV3Column<\n  typeof SMALLINT\n> {}\nexport class EncryptedSmallintEqColumn extends EncryptedV3Column<\n  typeof SMALLINT_EQ\n> {}\nexport class EncryptedSmallintOrdOreColumn extends EncryptedV3Column<\n  typeof SMALLINT_ORD_ORE\n> {}\nexport class EncryptedSmallintOrdColumn extends EncryptedV3Column<\n  typeof SMALLINT_ORD\n> {}\n\n// bigint (int8) — plaintext is a JS `bigint`, round-tripped losslessly by the\n// native protect-ffi boundary (see the BIGINT domain definitions above).\nexport class EncryptedBigintColumn extends EncryptedV3Column<typeof BIGINT> {}\nexport class EncryptedBigintEqColumn extends EncryptedV3Column<\n  typeof BIGINT_EQ\n> {}\nexport class EncryptedBigintOrdOreColumn extends EncryptedV3Column<\n  typeof BIGINT_ORD_ORE\n> {}\nexport class EncryptedBigintOrdColumn extends EncryptedV3Column<\n  typeof BIGINT_ORD\n> {}\n\n// date\nexport class EncryptedDateColumn extends EncryptedV3Column<typeof DATE> {}\nexport class EncryptedDateEqColumn extends EncryptedV3Column<typeof DATE_EQ> {}\nexport class EncryptedDateOrdOreColumn extends EncryptedV3Column<\n  typeof DATE_ORD_ORE\n> {}\nexport class EncryptedDateOrdColumn extends EncryptedV3Column<\n  typeof DATE_ORD\n> {}\n\n// timestamp\nexport class EncryptedTimestampColumn extends EncryptedV3Column<\n  typeof TIMESTAMP\n> {}\nexport class EncryptedTimestampEqColumn extends EncryptedV3Column<\n  typeof TIMESTAMP_EQ\n> {}\nexport class EncryptedTimestampOrdOreColumn extends EncryptedV3Column<\n  typeof TIMESTAMP_ORD_ORE\n> {}\nexport class EncryptedTimestampOrdColumn extends EncryptedV3Column<\n  typeof TIMESTAMP_ORD\n> {}\n\n// numeric\nexport class EncryptedNumericColumn extends EncryptedV3Column<typeof NUMERIC> {}\nexport class EncryptedNumericEqColumn extends EncryptedV3Column<\n  typeof NUMERIC_EQ\n> {}\nexport class EncryptedNumericOrdOreColumn extends EncryptedV3Column<\n  typeof NUMERIC_ORD_ORE\n> {}\nexport class EncryptedNumericOrdColumn extends EncryptedV3Column<\n  typeof NUMERIC_ORD\n> {}\n\n// text (text_search is defined above with its match-tuning override)\nexport class EncryptedTextColumn extends EncryptedV3Column<typeof TEXT> {}\nexport class EncryptedTextEqColumn extends EncryptedV3Column<typeof TEXT_EQ> {}\nexport class EncryptedTextMatchColumn extends EncryptedV3Column<\n  typeof TEXT_MATCH\n> {}\nexport class EncryptedTextOrdOreColumn extends EncryptedV3Column<\n  typeof TEXT_ORD_ORE\n> {}\nexport class EncryptedTextOrdColumn extends EncryptedV3Column<\n  typeof TEXT_ORD\n> {}\n\n// boolean\nexport class EncryptedBooleanColumn extends EncryptedV3Column<typeof BOOLEAN> {}\n\n// real\nexport class EncryptedRealColumn extends EncryptedV3Column<typeof REAL> {}\nexport class EncryptedRealEqColumn extends EncryptedV3Column<typeof REAL_EQ> {}\nexport class EncryptedRealOrdOreColumn extends EncryptedV3Column<\n  typeof REAL_ORD_ORE\n> {}\nexport class EncryptedRealOrdColumn extends EncryptedV3Column<\n  typeof REAL_ORD\n> {}\n\n// double\nexport class EncryptedDoubleColumn extends EncryptedV3Column<typeof DOUBLE> {}\nexport class EncryptedDoubleEqColumn extends EncryptedV3Column<\n  typeof DOUBLE_EQ\n> {}\nexport class EncryptedDoubleOrdOreColumn extends EncryptedV3Column<\n  typeof DOUBLE_ORD_ORE\n> {}\nexport class EncryptedDoubleOrdColumn extends EncryptedV3Column<\n  typeof DOUBLE_ORD\n> {}\n\n// json\nconst JSON_DOMAIN = {\n  eqlType: 'public.eql_v3_json',\n  castAs: 'json',\n  capabilities: {\n    equality: false,\n    orderAndRange: false,\n    freeTextSearch: false,\n    searchableJson: true,\n  },\n} as const\n\n/**\n * Builder for a `public.eql_v3_json` column — an encrypted JSONB document\n * (a {@link JsonDocument}: object, array, or null). It round-trips through\n * `encrypt`/`decrypt`, and containment queries use the encrypted-JSONB index\n * emitted by `build()`. (The stored payload is protect-ffi's `SteVecDocument`,\n * and the config index kind is `ste_vec` — both protect-ffi names.)\n */\nexport class EncryptedJsonColumn extends EncryptedV3Column<typeof JSON_DOMAIN> {\n  constructor(columnName: string) {\n    super(columnName, JSON_DOMAIN)\n  }\n}\n\n/**\n * Union of every v3 concrete column type. Used as the value type for v3 table\n * columns so a table may mix any generated domains.\n */\nexport type AnyEncryptedV3Column =\n  | EncryptedIntegerColumn\n  | EncryptedIntegerEqColumn\n  | EncryptedIntegerOrdOreColumn\n  | EncryptedIntegerOrdColumn\n  | EncryptedSmallintColumn\n  | EncryptedSmallintEqColumn\n  | EncryptedSmallintOrdOreColumn\n  | EncryptedSmallintOrdColumn\n  | EncryptedBigintColumn\n  | EncryptedBigintEqColumn\n  | EncryptedBigintOrdOreColumn\n  | EncryptedBigintOrdColumn\n  | EncryptedDateColumn\n  | EncryptedDateEqColumn\n  | EncryptedDateOrdOreColumn\n  | EncryptedDateOrdColumn\n  | EncryptedTimestampColumn\n  | EncryptedTimestampEqColumn\n  | EncryptedTimestampOrdOreColumn\n  | EncryptedTimestampOrdColumn\n  | EncryptedNumericColumn\n  | EncryptedNumericEqColumn\n  | EncryptedNumericOrdOreColumn\n  | EncryptedNumericOrdColumn\n  | EncryptedTextColumn\n  | EncryptedTextEqColumn\n  | EncryptedTextMatchColumn\n  | EncryptedTextOrdOreColumn\n  | EncryptedTextOrdColumn\n  | EncryptedTextSearchColumn\n  | EncryptedBooleanColumn\n  | EncryptedRealColumn\n  | EncryptedRealEqColumn\n  | EncryptedRealOrdOreColumn\n  | EncryptedRealOrdColumn\n  | EncryptedDoubleColumn\n  | EncryptedDoubleEqColumn\n  | EncryptedDoubleOrdOreColumn\n  | EncryptedDoubleOrdColumn\n  | EncryptedJsonColumn\n\n/**\n * A factory that builds a concrete v3 column for a given DB column name.\n *\n * Declared here rather than beside `DOMAIN_REGISTRY` so that `./types` can\n * constrain its own export against it without importing from `./domain-registry`,\n * which imports `./types` back as a value.\n */\nexport type V3ColumnFactory = (name: string) => AnyEncryptedV3Column\n\n/**\n * Shape of v3 table columns: every value is a v3 concrete column builder.\n * (Nested fields are deferred to later increments.)\n */\nexport type EncryptedV3TableColumn = {\n  [key: string]: AnyEncryptedV3Column\n}\n\n/** A JSON value at any depth. Used for the values NESTED inside a document. */\nexport type JsonValue =\n  | string\n  | number\n  | boolean\n  | null\n  | JsonValue[]\n  | { [key: string]: JsonValue }\n\n/**\n * The plaintext a `public.eql_v3_json` column encrypts and reconstructs: a JSON\n * DOCUMENT — an object, an array, or `null`. NOT a bare top-level scalar:\n * protect-ffi's `json` cast rejects a top-level string/number/boolean\n * (\"Cannot convert … to Json\"), because a scalar belongs in a scalar domain\n * (`types.TextEq`, `types.IntegerEq`, …). Nested scalars are ordinary\n * {@link JsonValue}s and are fully supported.\n */\nexport type JsonDocument = null | JsonValue[] | { [key: string]: JsonValue }\n\n/** Map a domain's {@link PlaintextKind} to its TypeScript plaintext type. */\ntype PlaintextFromKind<K extends PlaintextKind> = K extends 'string'\n  ? string\n  : K extends 'number'\n    ? number\n    : K extends 'bigint'\n      ? bigint\n      : K extends 'boolean'\n        ? boolean\n        : K extends DateLikeCast\n          ? Date\n          : K extends 'json'\n            ? JsonDocument\n            : never\n\n/**\n * The plaintext type for a single v3 column, read from the literal domain\n * definition carried on the base class's private field. This is stable across\n * empty subclasses that share the same base generic — a subclass-name\n * conditional would collapse because those subclasses are structurally\n * assignable to one another.\n */\nexport type PlaintextForColumn<C> =\n  C extends EncryptedV3Column<infer D> ? PlaintextFromKind<D['castAs']> : never\n\n/**\n * The user-facing `queryType` names a v3 column supports, derived 1:1 from its\n * capability flags. Resolves to `never` for a storage-only column (all flags\n * `false`) and for any non-v3 value. The names mirror the {@link QueryCapabilities}\n * keys, each of which is also a {@link import('@/types').QueryTypeName} member.\n */\nexport type QueryTypesForColumn<C> =\n  C extends EncryptedV3Column<infer D>\n    ?\n        | (D['capabilities']['equality'] extends true ? 'equality' : never)\n        | (D['capabilities']['orderAndRange'] extends true\n            ? 'orderAndRange'\n            : never)\n        | (D['capabilities']['freeTextSearch'] extends true\n            ? 'freeTextSearch'\n            : never)\n        // The flag is optional (absent means \"not a JSON document column\"), so\n        // only a literal `true` contributes. Without this arm a `types.Json`\n        // column resolved to `never`, and every typed adapter key set derived\n        // from this type excluded encrypted-JSON columns entirely (#650).\n        | (D['capabilities']['searchableJson'] extends true\n            ? 'searchableJson'\n            : never)\n    : never\n\n/**\n * The concrete EQL v3 type string for a single column, read from the literal\n * domain definition carried on the base class's private field (mirrors\n * {@link PlaintextForColumn}). Distributes over a union of columns, so\n * `EqlTypeForColumn<AnyEncryptedV3Column>` yields the union of every domain's\n * `eqlType` — the canonical, source-of-truth key set for a type-driven test\n * matrix keyed by domain.\n */\nexport type EqlTypeForColumn<C> =\n  C extends EncryptedV3Column<infer D> ? D['eqlType'] : never\n","import {\n  BIGINT,\n  BIGINT_EQ,\n  BIGINT_ORD,\n  BIGINT_ORD_ORE,\n  BOOLEAN,\n  DATE,\n  DATE_EQ,\n  DATE_ORD,\n  DATE_ORD_ORE,\n  DOUBLE,\n  DOUBLE_EQ,\n  DOUBLE_ORD,\n  DOUBLE_ORD_ORE,\n  EncryptedBigintColumn,\n  EncryptedBigintEqColumn,\n  EncryptedBigintOrdColumn,\n  EncryptedBigintOrdOreColumn,\n  EncryptedBooleanColumn,\n  EncryptedDateColumn,\n  EncryptedDateEqColumn,\n  EncryptedDateOrdColumn,\n  EncryptedDateOrdOreColumn,\n  EncryptedDoubleColumn,\n  EncryptedDoubleEqColumn,\n  EncryptedDoubleOrdColumn,\n  EncryptedDoubleOrdOreColumn,\n  EncryptedIntegerColumn,\n  EncryptedIntegerEqColumn,\n  EncryptedIntegerOrdColumn,\n  EncryptedIntegerOrdOreColumn,\n  EncryptedJsonColumn,\n  EncryptedNumericColumn,\n  EncryptedNumericEqColumn,\n  EncryptedNumericOrdColumn,\n  EncryptedNumericOrdOreColumn,\n  EncryptedRealColumn,\n  EncryptedRealEqColumn,\n  EncryptedRealOrdColumn,\n  EncryptedRealOrdOreColumn,\n  EncryptedSmallintColumn,\n  EncryptedSmallintEqColumn,\n  EncryptedSmallintOrdColumn,\n  EncryptedSmallintOrdOreColumn,\n  EncryptedTextColumn,\n  EncryptedTextEqColumn,\n  EncryptedTextMatchColumn,\n  EncryptedTextOrdColumn,\n  EncryptedTextOrdOreColumn,\n  EncryptedTextSearchColumn,\n  EncryptedTimestampColumn,\n  EncryptedTimestampEqColumn,\n  EncryptedTimestampOrdColumn,\n  EncryptedTimestampOrdOreColumn,\n  INTEGER,\n  INTEGER_EQ,\n  INTEGER_ORD,\n  INTEGER_ORD_ORE,\n  NUMERIC,\n  NUMERIC_EQ,\n  NUMERIC_ORD,\n  NUMERIC_ORD_ORE,\n  REAL,\n  REAL_EQ,\n  REAL_ORD,\n  REAL_ORD_ORE,\n  SMALLINT,\n  SMALLINT_EQ,\n  SMALLINT_ORD,\n  SMALLINT_ORD_ORE,\n  TEXT,\n  TEXT_EQ,\n  TEXT_MATCH,\n  TEXT_ORD,\n  TEXT_ORD_ORE,\n  TIMESTAMP,\n  TIMESTAMP_EQ,\n  TIMESTAMP_ORD,\n  TIMESTAMP_ORD_ORE,\n  type V3ColumnFactory,\n} from './columns'\n\n/**\n * The v3 column-type namespace. Each member is a public, semantic factory name\n * for a concrete EQL v3 column. Most members mirror the underlying domain name;\n * JS-friendly scalar names map to Postgres concrete domains, e.g.\n * `types.IntegerOrd` builds a `public.eql_v3_integer_ord` column and `types.Boolean`\n * builds a `public.eql_v3_boolean` column.\n *\n * If these factory names stop matching the emitted capability/domain surface,\n * the stack package is out of sync with the underlying EQL build. That is a\n * version mismatch, not a harmless naming drift.\n *\n * Each factory returns the CONCRETE column class instance (never the widened\n * `AnyEncryptedV3Column`) so per-column plaintext / query-capability inference\n * stays precise.\n *\n * ```ts\n * import { encryptedTable, types } from '@cipherstash/stack/eql/v3'\n *\n * const events = encryptedTable('events', {\n *   actor:     types.TextEq('actor'),           // equality\n *   weight:    types.IntegerOrd('weight'),         // order + range\n *   createdAt: types.Timestamp('created_at'), // storage only\n * })\n * ```\n *\n * `types.TextSearch` is fully described by its type — like every other domain,\n * it has no capability-bearing or tuning chain. Its match index is always\n * emitted with the default configuration; run a free-text query by passing\n * `queryType: 'freeTextSearch'` to `encryptQuery`.\n */\nexport const types = {\n  // integer\n  Integer: (name: string) => new EncryptedIntegerColumn(name, INTEGER),\n  IntegerEq: (name: string) => new EncryptedIntegerEqColumn(name, INTEGER_EQ),\n  IntegerOrdOre: (name: string) =>\n    new EncryptedIntegerOrdOreColumn(name, INTEGER_ORD_ORE),\n  IntegerOrd: (name: string) =>\n    new EncryptedIntegerOrdColumn(name, INTEGER_ORD),\n\n  // smallint\n  Smallint: (name: string) => new EncryptedSmallintColumn(name, SMALLINT),\n  SmallintEq: (name: string) =>\n    new EncryptedSmallintEqColumn(name, SMALLINT_EQ),\n  SmallintOrdOre: (name: string) =>\n    new EncryptedSmallintOrdOreColumn(name, SMALLINT_ORD_ORE),\n  SmallintOrd: (name: string) =>\n    new EncryptedSmallintOrdColumn(name, SMALLINT_ORD),\n\n  // bigint (int8) — plaintext is a JS `bigint`, round-tripped losslessly by\n  // the native protect-ffi boundary (see ./columns)\n  Bigint: (name: string) => new EncryptedBigintColumn(name, BIGINT),\n  BigintEq: (name: string) => new EncryptedBigintEqColumn(name, BIGINT_EQ),\n  BigintOrdOre: (name: string) =>\n    new EncryptedBigintOrdOreColumn(name, BIGINT_ORD_ORE),\n  BigintOrd: (name: string) => new EncryptedBigintOrdColumn(name, BIGINT_ORD),\n\n  // date\n  Date: (name: string) => new EncryptedDateColumn(name, DATE),\n  DateEq: (name: string) => new EncryptedDateEqColumn(name, DATE_EQ),\n  DateOrdOre: (name: string) =>\n    new EncryptedDateOrdOreColumn(name, DATE_ORD_ORE),\n  DateOrd: (name: string) => new EncryptedDateOrdColumn(name, DATE_ORD),\n\n  // timestamp\n  Timestamp: (name: string) => new EncryptedTimestampColumn(name, TIMESTAMP),\n  TimestampEq: (name: string) =>\n    new EncryptedTimestampEqColumn(name, TIMESTAMP_EQ),\n  TimestampOrdOre: (name: string) =>\n    new EncryptedTimestampOrdOreColumn(name, TIMESTAMP_ORD_ORE),\n  TimestampOrd: (name: string) =>\n    new EncryptedTimestampOrdColumn(name, TIMESTAMP_ORD),\n\n  // numeric\n  Numeric: (name: string) => new EncryptedNumericColumn(name, NUMERIC),\n  NumericEq: (name: string) => new EncryptedNumericEqColumn(name, NUMERIC_EQ),\n  NumericOrdOre: (name: string) =>\n    new EncryptedNumericOrdOreColumn(name, NUMERIC_ORD_ORE),\n  NumericOrd: (name: string) =>\n    new EncryptedNumericOrdColumn(name, NUMERIC_ORD),\n\n  // text\n  Text: (name: string) => new EncryptedTextColumn(name, TEXT),\n  TextEq: (name: string) => new EncryptedTextEqColumn(name, TEXT_EQ),\n  TextMatch: (name: string) => new EncryptedTextMatchColumn(name, TEXT_MATCH),\n  TextOrdOre: (name: string) =>\n    new EncryptedTextOrdOreColumn(name, TEXT_ORD_ORE),\n  TextOrd: (name: string) => new EncryptedTextOrdColumn(name, TEXT_ORD),\n  TextSearch: (name: string) => new EncryptedTextSearchColumn(name),\n\n  // boolean\n  Boolean: (name: string) => new EncryptedBooleanColumn(name, BOOLEAN),\n\n  // real\n  Real: (name: string) => new EncryptedRealColumn(name, REAL),\n  RealEq: (name: string) => new EncryptedRealEqColumn(name, REAL_EQ),\n  RealOrdOre: (name: string) =>\n    new EncryptedRealOrdOreColumn(name, REAL_ORD_ORE),\n  RealOrd: (name: string) => new EncryptedRealOrdColumn(name, REAL_ORD),\n\n  // double\n  Double: (name: string) => new EncryptedDoubleColumn(name, DOUBLE),\n  DoubleEq: (name: string) => new EncryptedDoubleEqColumn(name, DOUBLE_EQ),\n  DoubleOrdOre: (name: string) =>\n    new EncryptedDoubleOrdOreColumn(name, DOUBLE_ORD_ORE),\n  DoubleOrd: (name: string) => new EncryptedDoubleOrdColumn(name, DOUBLE_ORD),\n\n  // json (encrypted JSONB document, ste_vec containment)\n  Json: (name: string) => new EncryptedJsonColumn(name),\n  // `satisfies` is load-bearing, not decoration: `DOMAIN_REGISTRY` derives itself\n  // by calling every value here at module load. A non-factory export would throw\n  // during module evaluation and take the supabase introspect/schema-build/verify\n  // path down with it. This turns that into a compile error at the offending line.\n  // `as const` applies first, so literal key inference is preserved.\n} as const satisfies Record<string, V3ColumnFactory>\n"],"mappings":";;;;;AAmCO,IAAM,kBAAkB,CAAC,QAAQ,WAAW;AAuCnD,IAAM,eAAe;AAAA,EACnB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,gBAAgB;AAAA,EACpB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,kBAAkB;AAAA,EACtB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,aAAa;AAAA,EACjB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEA,IAAM,cAAc;AAAA,EAClB,UAAU;AAAA,EACV,eAAe;AAAA,EACf,gBAAgB;AAClB;AAOO,IAAM,uBAAuB;AAS7B,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,kBAAkB;AAAA,EAC7B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,mBAAmB;AAAA,EAC9B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAOO,IAAM,SAAS;AAAA,EACpB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,YAAY;AAAA,EACvB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,iBAAiB;AAAA,EAC5B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,OAAO;AAAA,EAClB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,YAAY;AAAA,EACvB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,oBAAoB;AAAA,EAC/B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,gBAAgB;AAAA,EAC3B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,kBAAkB;AAAA,EAC7B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,OAAO;AAAA,EAClB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,OAAO;AAAA,EAClB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,WAAW;AAAA,EACtB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAEO,IAAM,SAAS;AAAA,EACpB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,YAAY;AAAA,EACvB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,iBAAiB;AAAA,EAC5B,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AACO,IAAM,aAAa;AAAA,EACxB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAuBA,SAAS,uBACP,cACA,QACA,UACyB;AACzB,QAAM,UAAmC,CAAC;AAK1C,MACE,aAAa,aACZ,CAAC,aAAa,iBAAiB,WAAW,WAC3C;AACA,YAAQ,SAAS,EAAE,eAAe,CAAC,EAAE;AAAA,EACvC;AAEA,MAAI,aAAa,eAAe;AAC9B,YAAQ,QAAQ,IAAI,CAAC;AAAA,EACvB;AAEA,MAAI,aAAa,gBAAgB;AAW/B,YAAQ,QAAQ,EAAE,GAAG,iBAAiB,GAAG,kBAAkB,MAAM;AAAA,EACnE;AAEA,MAAI,aAAa,gBAAgB;AAiB/B,YAAQ,UAAU;AAAA,MAChB,QAAQ;AAAA,MACR,kBAAkB,EAAE,MAAM,MAAM,UAAU,MAAM,UAAU,MAAM;AAAA,MAChE,MAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO;AACT;AAOA,SAAS,mBAAmB,SAAgC;AAC1D,SAAO,QAAQ,SAAS,UAAU,IAAI,QAAQ;AAChD;AAGA,SAAS,wBAAwB,cAA0C;AACzE,SACE,aAAa,YACb,aAAa,iBACb,aAAa,mBACZ,aAAa,kBAAkB;AAEpC;AAUO,IAAM,oBAAN,MAAsD;AAAA,EAC3D,YACmB,YACA,YACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAFgB;AAAA,EACA;AAAA,EAGnB,UAAkB;AAChB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,aAA2B;AACzB,WAAO,KAAK,WAAW;AAAA,EACzB;AAAA;AAAA,EAGA,uBAA0C;AACxC,WAAO,KAAK,WAAW;AAAA,EACzB;AAAA;AAAA,EAGA,cAAgC;AAC9B,WAAO;AAAA,MACL,KAAK,WAAW;AAAA,IAClB;AAAA,EACF;AAAA;AAAA,EAGA,QAAsB;AACpB,WAAO;AAAA,MACL,SAAS,KAAK,WAAW;AAAA,MACzB,SAAS;AAAA,QACP,KAAK,WAAW;AAAA,QAChB,KAAK,WAAW;AAAA,QAChB,mBAAmB,KAAK,WAAW,OAAO;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAM,qBAAqB;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAChB;AAuBO,IAAM,4BAAN,cAAwC,kBAE7C;AAAA,EACA,YAAY,YAAoB;AAC9B,UAAM,YAAY,kBAAkB;AAAA,EACtC;AACF;AAaO,IAAM,yBAAN,cAAqC,kBAAkC;AAAC;AACxE,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,+BAAN,cAA2C,kBAEhD;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AAGI,IAAM,0BAAN,cAAsC,kBAE3C;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,gCAAN,cAA4C,kBAEjD;AAAC;AACI,IAAM,6BAAN,cAAyC,kBAE9C;AAAC;AAII,IAAM,wBAAN,cAAoC,kBAAiC;AAAC;AACtE,IAAM,0BAAN,cAAsC,kBAE3C;AAAC;AACI,IAAM,8BAAN,cAA0C,kBAE/C;AAAC;AACI,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AAGI,IAAM,sBAAN,cAAkC,kBAA+B;AAAC;AAClE,IAAM,wBAAN,cAAoC,kBAAkC;AAAC;AACvE,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,yBAAN,cAAqC,kBAE1C;AAAC;AAGI,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,6BAAN,cAAyC,kBAE9C;AAAC;AACI,IAAM,iCAAN,cAA6C,kBAElD;AAAC;AACI,IAAM,8BAAN,cAA0C,kBAE/C;AAAC;AAGI,IAAM,yBAAN,cAAqC,kBAAkC;AAAC;AACxE,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,+BAAN,cAA2C,kBAEhD;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AAGI,IAAM,sBAAN,cAAkC,kBAA+B;AAAC;AAClE,IAAM,wBAAN,cAAoC,kBAAkC;AAAC;AACvE,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AACI,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,yBAAN,cAAqC,kBAE1C;AAAC;AAGI,IAAM,yBAAN,cAAqC,kBAAkC;AAAC;AAGxE,IAAM,sBAAN,cAAkC,kBAA+B;AAAC;AAClE,IAAM,wBAAN,cAAoC,kBAAkC;AAAC;AACvE,IAAM,4BAAN,cAAwC,kBAE7C;AAAC;AACI,IAAM,yBAAN,cAAqC,kBAE1C;AAAC;AAGI,IAAM,wBAAN,cAAoC,kBAAiC;AAAC;AACtE,IAAM,0BAAN,cAAsC,kBAE3C;AAAC;AACI,IAAM,8BAAN,cAA0C,kBAE/C;AAAC;AACI,IAAM,2BAAN,cAAuC,kBAE5C;AAAC;AAGH,IAAM,cAAc;AAAA,EAClB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAAA,IACZ,UAAU;AAAA,IACV,eAAe;AAAA,IACf,gBAAgB;AAAA,IAChB,gBAAgB;AAAA,EAClB;AACF;AASO,IAAM,sBAAN,cAAkC,kBAAsC;AAAA,EAC7E,YAAY,YAAoB;AAC9B,UAAM,YAAY,WAAW;AAAA,EAC/B;AACF;;;AC9hBO,IAAM,QAAQ;AAAA;AAAA,EAEnB,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,OAAO;AAAA,EACnE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA,EAC1E,eAAe,CAAC,SACd,IAAI,6BAA6B,MAAM,eAAe;AAAA,EACxD,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,WAAW;AAAA;AAAA,EAGjD,UAAU,CAAC,SAAiB,IAAI,wBAAwB,MAAM,QAAQ;AAAA,EACtE,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,WAAW;AAAA,EACjD,gBAAgB,CAAC,SACf,IAAI,8BAA8B,MAAM,gBAAgB;AAAA,EAC1D,aAAa,CAAC,SACZ,IAAI,2BAA2B,MAAM,YAAY;AAAA;AAAA;AAAA,EAInD,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,MAAM;AAAA,EAChE,UAAU,CAAC,SAAiB,IAAI,wBAAwB,MAAM,SAAS;AAAA,EACvE,cAAc,CAAC,SACb,IAAI,4BAA4B,MAAM,cAAc;AAAA,EACtD,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA;AAAA,EAG1E,MAAM,CAAC,SAAiB,IAAI,oBAAoB,MAAM,IAAI;AAAA,EAC1D,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,OAAO;AAAA,EACjE,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,YAAY;AAAA,EAClD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,QAAQ;AAAA;AAAA,EAGpE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,SAAS;AAAA,EACzE,aAAa,CAAC,SACZ,IAAI,2BAA2B,MAAM,YAAY;AAAA,EACnD,iBAAiB,CAAC,SAChB,IAAI,+BAA+B,MAAM,iBAAiB;AAAA,EAC5D,cAAc,CAAC,SACb,IAAI,4BAA4B,MAAM,aAAa;AAAA;AAAA,EAGrD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,OAAO;AAAA,EACnE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA,EAC1E,eAAe,CAAC,SACd,IAAI,6BAA6B,MAAM,eAAe;AAAA,EACxD,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,WAAW;AAAA;AAAA,EAGjD,MAAM,CAAC,SAAiB,IAAI,oBAAoB,MAAM,IAAI;AAAA,EAC1D,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,OAAO;AAAA,EACjE,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA,EAC1E,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,YAAY;AAAA,EAClD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,QAAQ;AAAA,EACpE,YAAY,CAAC,SAAiB,IAAI,0BAA0B,IAAI;AAAA;AAAA,EAGhE,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,OAAO;AAAA;AAAA,EAGnE,MAAM,CAAC,SAAiB,IAAI,oBAAoB,MAAM,IAAI;AAAA,EAC1D,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,OAAO;AAAA,EACjE,YAAY,CAAC,SACX,IAAI,0BAA0B,MAAM,YAAY;AAAA,EAClD,SAAS,CAAC,SAAiB,IAAI,uBAAuB,MAAM,QAAQ;AAAA;AAAA,EAGpE,QAAQ,CAAC,SAAiB,IAAI,sBAAsB,MAAM,MAAM;AAAA,EAChE,UAAU,CAAC,SAAiB,IAAI,wBAAwB,MAAM,SAAS;AAAA,EACvE,cAAc,CAAC,SACb,IAAI,4BAA4B,MAAM,cAAc;AAAA,EACtD,WAAW,CAAC,SAAiB,IAAI,yBAAyB,MAAM,UAAU;AAAA;AAAA,EAG1E,MAAM,CAAC,SAAiB,IAAI,oBAAoB,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAMtD;","names":[]}

package/dist/{chunk-OFQ555AX.js → chunk-IDKP6ABU.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-HQANMV7R.js";
 import {
   EncryptionErrorTypes
-} from "./chunk-LBMC4D6D.js";
+} from "./chunk-NVKK7UDN.js";
 
 // src/utils/config/index.ts
 import fs from "fs";
@@ -188,4 +188,4 @@ export {
   resolveLockContext,
   LockContext
 };
-//# sourceMappingURL=chunk-OFQ555AX.js.map
+//# sourceMappingURL=chunk-IDKP6ABU.js.map

package/dist/{chunk-ZTP5QJ27.js → chunk-L7ISHSG7.js}

@@ -1,6 +1,6 @@
 import {
   resolveLockContext
-} from "./chunk-OFQ555AX.js";
+} from "./chunk-IDKP6ABU.js";
 import {
   formatEncryptedResult,
   isEncryptedPayload,
@@ -23,7 +23,7 @@ import {
 } from "./chunk-HQANMV7R.js";
 import {
   EncryptionErrorTypes
-} from "./chunk-LBMC4D6D.js";
+} from "./chunk-NVKK7UDN.js";
 
 // src/encryption/index.ts
 import { newClient } from "@cipherstash/protect-ffi";
@@ -2465,4 +2465,4 @@ export {
   __resetStrategyDeprecationWarningForTests,
   Encryption
 };
-//# sourceMappingURL=chunk-ZTP5QJ27.js.map
+//# sourceMappingURL=chunk-L7ISHSG7.js.map

package/dist/{chunk-LBMC4D6D.js → chunk-NVKK7UDN.js}

@@ -16,4 +16,4 @@ export {
   EncryptionErrorTypes,
   getErrorMessage
 };
-//# sourceMappingURL=chunk-LBMC4D6D.js.map
+//# sourceMappingURL=chunk-NVKK7UDN.js.map

package/dist/chunk-NVKK7UDN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors/index.ts"],"sourcesContent":["import type { ProtectErrorCode } from '@cipherstash/protect-ffi'\n\n// `as const` is load-bearing: without it every member's type widens to `string`,\n// so the `type` fields on the StackError union members below all become `string`\n// and the union stops discriminating — `switch (error.type)` cannot narrow, and\n// the documented exhaustive error-handling pattern fails to compile.\nexport const EncryptionErrorTypes = {\n  ClientInitError: 'ClientInitError',\n  EncryptionError: 'EncryptionError',\n  DecryptionError: 'DecryptionError',\n  LockContextError: 'LockContextError',\n  CtsTokenError: 'CtsTokenError',\n} as const\n\n/**\n * Base error interface returned by all encryption operations.\n *\n * Every operation that can fail returns `Result<T, EncryptionError>`.\n * Use the `type` field to narrow to a specific error kind, or use\n * {@link StackError} for an exhaustive discriminated union.\n *\n * @example\n * ```typescript\n * const result = await client.encrypt(value, opts)\n * if (result.failure) {\n *   switch (result.failure.type) {\n *     case EncryptionErrorTypes.EncryptionError:\n *       console.error('Encryption failed:', result.failure.message)\n *       break\n *     case EncryptionErrorTypes.LockContextError:\n *       console.error('Lock context issue:', result.failure.message)\n *       break\n *   }\n * }\n * ```\n */\nexport interface EncryptionError {\n  type: (typeof EncryptionErrorTypes)[keyof typeof EncryptionErrorTypes]\n  message: string\n  code?: ProtectErrorCode\n}\n\n// ---------------------------------------------------------------------------\n// Specific error types (discriminated union members)\n// ---------------------------------------------------------------------------\n\nexport interface ClientInitError {\n  type: typeof EncryptionErrorTypes.ClientInitError\n  message: string\n}\n\nexport interface EncryptionOperationError {\n  type: typeof EncryptionErrorTypes.EncryptionError\n  message: string\n  code?: ProtectErrorCode\n}\n\nexport interface DecryptionOperationError {\n  type: typeof EncryptionErrorTypes.DecryptionError\n  message: string\n  code?: ProtectErrorCode\n}\n\nexport interface LockContextError {\n  type: typeof EncryptionErrorTypes.LockContextError\n  message: string\n}\n\nexport interface CtsTokenError {\n  type: typeof EncryptionErrorTypes.CtsTokenError\n  message: string\n}\n\n/**\n * Discriminated union of all specific error types.\n *\n * Use `StackError` when you need exhaustive error handling via `switch` on the `type` field.\n *\n * @example\n * ```typescript\n * function handleError(error: StackError) {\n *   switch (error.type) {\n *     case 'ClientInitError':\n *       // re-initialize client\n *       break\n *     case 'EncryptionError':\n *     case 'DecryptionError':\n *       // log and retry\n *       break\n *     case 'LockContextError':\n *       // re-authenticate\n *       break\n *     case 'CtsTokenError':\n *       // refresh token\n *       break\n *     default:\n *       error satisfies never\n *   }\n * }\n * ```\n */\nexport type StackError =\n  | ClientInitError\n  | EncryptionOperationError\n  | DecryptionOperationError\n  | LockContextError\n  | CtsTokenError\n\n// ---------------------------------------------------------------------------\n// Error utilities\n// ---------------------------------------------------------------------------\n\n/**\n * Safely extract an error message from an unknown thrown value.\n * Unlike `(error as Error).message`, this handles non-Error values gracefully.\n */\nexport function getErrorMessage(error: unknown): string {\n  if (error instanceof Error) return error.message\n  if (typeof error === 'string') return error\n  return String(error)\n}\n"],"mappings":";AAMO,IAAM,uBAAuB;AAAA,EAClC,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,eAAe;AACjB;AAwGO,SAAS,gBAAgB,OAAwB;AACtD,MAAI,iBAAiB,MAAO,QAAO,MAAM;AACzC,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,SAAO,OAAO,KAAK;AACrB;","names":[]}

package/dist/{columns-rZc7fQHI.d.ts → columns-0lbT9stl.d.ts}

@@ -606,9 +606,9 @@ type PlaintextForColumn<C> = C extends EncryptedV3Column<infer D> ? PlaintextFro
  * The user-facing `queryType` names a v3 column supports, derived 1:1 from its
  * capability flags. Resolves to `never` for a storage-only column (all flags
  * `false`) and for any non-v3 value. The names mirror the {@link QueryCapabilities}
- * keys and the first three {@link import('@/types').QueryTypeName} members.
+ * keys, each of which is also a {@link import('@/types').QueryTypeName} member.
  */
-type QueryTypesForColumn<C> = C extends EncryptedV3Column<infer D> ? (D['capabilities']['equality'] extends true ? 'equality' : never) | (D['capabilities']['orderAndRange'] extends true ? 'orderAndRange' : never) | (D['capabilities']['freeTextSearch'] extends true ? 'freeTextSearch' : never) : never;
+type QueryTypesForColumn<C> = C extends EncryptedV3Column<infer D> ? (D['capabilities']['equality'] extends true ? 'equality' : never) | (D['capabilities']['orderAndRange'] extends true ? 'orderAndRange' : never) | (D['capabilities']['freeTextSearch'] extends true ? 'freeTextSearch' : never) | (D['capabilities']['searchableJson'] extends true ? 'searchableJson' : never) : never;
 /**
  * The concrete EQL v3 type string for a single column, read from the literal
  * domain definition carried on the base class's private field (mirrors

package/dist/{columns-D2_YzrCX.d.cts → columns-Bxv7Oo9o.d.cts}

@@ -606,9 +606,9 @@ type PlaintextForColumn<C> = C extends EncryptedV3Column<infer D> ? PlaintextFro
  * The user-facing `queryType` names a v3 column supports, derived 1:1 from its
  * capability flags. Resolves to `never` for a storage-only column (all flags
  * `false`) and for any non-v3 value. The names mirror the {@link QueryCapabilities}
- * keys and the first three {@link import('@/types').QueryTypeName} members.
+ * keys, each of which is also a {@link import('@/types').QueryTypeName} member.
  */
-type QueryTypesForColumn<C> = C extends EncryptedV3Column<infer D> ? (D['capabilities']['equality'] extends true ? 'equality' : never) | (D['capabilities']['orderAndRange'] extends true ? 'orderAndRange' : never) | (D['capabilities']['freeTextSearch'] extends true ? 'freeTextSearch' : never) : never;
+type QueryTypesForColumn<C> = C extends EncryptedV3Column<infer D> ? (D['capabilities']['equality'] extends true ? 'equality' : never) | (D['capabilities']['orderAndRange'] extends true ? 'orderAndRange' : never) | (D['capabilities']['freeTextSearch'] extends true ? 'freeTextSearch' : never) | (D['capabilities']['searchableJson'] extends true ? 'searchableJson' : never) : never;
 /**
  * The concrete EQL v3 type string for a single column, read from the literal
  * domain definition carried on the base class's private field (mirrors