@cipherstash/stack 1.0.0-rc.1 → 1.0.0-rc.3

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   Encryption
-} from "./chunk-L7ISHSG7.js";
-import "./chunk-IDKP6ABU.js";
+} from "./chunk-UI7V2QCK.js";
+import "./chunk-Q4WTOYVI.js";
 import {
   encryptedToPgComposite,
   isEncryptedPayload
@@ -14,7 +14,7 @@ import {
 import "./chunk-7333ZC6L.js";
 import "./chunk-3B5ZX3IS.js";
 import "./chunk-JSG2AMDI.js";
-import "./chunk-HQANMV7R.js";
+import "./chunk-BCY6WB24.js";
 import "./chunk-NVKK7UDN.js";
 import "./chunk-PZ5AY32C.js";
 

package/dist/wasm-inline.d.ts

@@ -1,7 +1,7 @@
 import { AccessKeyStrategy, OidcFederationStrategy } from '@cipherstash/auth/wasm-inline';
 export { AccessKeyStrategy, OidcFederationStrategy } from '@cipherstash/auth/wasm-inline';
 import { z } from 'zod';
-import { EncryptedPayload } from '@cipherstash/protect-ffi';
+import { EncryptedPayload, EncryptedQuery as EncryptedQuery$1, EncryptedV3Query } from '@cipherstash/protect-ffi';
 
 /** Structural type representing encrypted data stored in the database. Always
  * carries a ciphertext. Covers BOTH wire formats: the EQL v2.3 payloads
@@ -14,6 +14,14 @@ import { EncryptedPayload } from '@cipherstash/protect-ffi';
  * and {@link EncryptedQuery} for the search-term shape returned by
  * `encryptQuery`. */
 type Encrypted = EncryptedPayload;
+/** Structural type representing an encrypted query term (search needle)
+ * returned by `encryptQuery` / `encryptQueryBulk` for scalar
+ * (`unique` / `match` / `ore`) lookups and `ste_vec_selector` JSON path
+ * queries, plus — under `eqlVersion: 3` — the `eql_v3.jsonb_query`
+ * containment needle. Carries no ciphertext — matched against stored
+ * values, never decrypted. v2 JSON containment queries (`ste_vec_term`)
+ * return a storage-shaped {@link Encrypted} payload instead. */
+type EncryptedQuery = EncryptedQuery$1 | EncryptedV3Query;
 /** Structural contract for a column builder the client can consume for STORAGE
  *  (`encrypt`). Satisfied by v2 `EncryptedColumn` / `EncryptedField` AND v3
  *  `EncryptedTextSearchColumn` — fields ARE encryptable, so this stays wide. */
@@ -21,6 +29,21 @@ interface BuildableColumn {
     getName(): string;
     build(): ColumnSchema;
 }
+/** Structural contract for a column the client can consume for QUERIES
+ *  (`encryptQuery` / search terms). Narrower than `BuildableColumn`: it must
+ *  EXCLUDE non-queryable `EncryptedField` (a field has no indexes). A v2
+ *  `EncryptedColumn` qualifies via the nominal arm; a v3 queryable concrete
+ *  type qualifies via the `getEqlType()` structural arm; `EncryptedField` (no
+ *  `getEqlType`, not an `EncryptedColumn`) is rejected. */
+interface BuildableV3QueryableColumn extends BuildableColumn {
+    getEqlType(): string;
+    getQueryCapabilities(): {
+        equality: boolean;
+        orderAndRange: boolean;
+        freeTextSearch: boolean;
+    };
+    isQueryable(): true;
+}
 /** Structural contract for a table builder the client can consume. Satisfied by
  *  v2 and v3 `EncryptedTable` alike. */
 interface BuildableTable {
@@ -51,6 +74,17 @@ type EncryptOptions = {
     column: BuildableColumn;
     table: BuildableTable;
 };
+/**
+ * User-facing query type names for encrypting query values.
+ *
+ * - `'equality'`: Exact match. [Exact Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)
+ * - `'freeTextSearch'`: Text search. [Match Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)
+ * - `'orderAndRange'`: Comparison and range. [Range Queries](https://cipherstash.com/docs/stack/cipherstash/encryption/searchable-encryption)
+ * - `'steVecSelector'`: JSONPath selector (e.g. `'$.user.email'`)
+ * - `'steVecTerm'`: Containment (e.g. `{ role: 'admin' }`)
+ * - `'searchableJson'`: Auto-infers selector or term from plaintext type (recommended)
+ */
+type QueryTypeName = 'orderAndRange' | 'freeTextSearch' | 'equality' | 'steVecSelector' | 'steVecTerm' | 'searchableJson';
 
 declare const columnSchema: z.ZodDefault<z.ZodObject<{
     cast_as: z.ZodDefault<z.ZodEnum<["bigint", "boolean", "date", "timestamp", "number", "string", "json", "text"]>>;
@@ -164,11 +198,6 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         ore?: {} | undefined;
         ope?: {} | undefined;
-        unique?: {
-            token_filters?: {
-                kind: "downcase";
-            }[] | undefined;
-        } | undefined;
         match?: {
             token_filters?: {
                 kind: "downcase";
@@ -183,6 +212,11 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             m?: number | undefined;
             include_original?: boolean | undefined;
         } | undefined;
+        unique?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        } | undefined;
         ste_vec?: {
             prefix: string;
             array_index_mode?: "all" | "none" | {
@@ -195,11 +229,6 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
     }, {
         ore?: {} | undefined;
         ope?: {} | undefined;
-        unique?: {
-            token_filters?: {
-                kind: "downcase";
-            }[] | undefined;
-        } | undefined;
         match?: {
             token_filters?: {
                 kind: "downcase";
@@ -214,6 +243,11 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             m?: number | undefined;
             include_original?: boolean | undefined;
         } | undefined;
+        unique?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        } | undefined;
         ste_vec?: {
             prefix: string;
             array_index_mode?: "all" | "none" | {
@@ -229,11 +263,6 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
     indexes: {
         ore?: {} | undefined;
         ope?: {} | undefined;
-        unique?: {
-            token_filters?: {
-                kind: "downcase";
-            }[] | undefined;
-        } | undefined;
         match?: {
             token_filters?: {
                 kind: "downcase";
@@ -248,6 +277,11 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             m?: number | undefined;
             include_original?: boolean | undefined;
         } | undefined;
+        unique?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        } | undefined;
         ste_vec?: {
             prefix: string;
             array_index_mode?: "all" | "none" | {
@@ -263,11 +297,6 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
     indexes?: {
         ore?: {} | undefined;
         ope?: {} | undefined;
-        unique?: {
-            token_filters?: {
-                kind: "downcase";
-            }[] | undefined;
-        } | undefined;
         match?: {
             token_filters?: {
                 kind: "downcase";
@@ -282,6 +311,11 @@ declare const columnSchema: z.ZodDefault<z.ZodObject<{
             m?: number | undefined;
             include_original?: boolean | undefined;
         } | undefined;
+        unique?: {
+            token_filters?: {
+                kind: "downcase";
+            }[] | undefined;
+        } | undefined;
         ste_vec?: {
             prefix: string;
             array_index_mode?: "all" | "none" | {
@@ -408,11 +442,6 @@ declare const encryptConfigSchema: z.ZodObject<{
         }, "strip", z.ZodTypeAny, {
             ore?: {} | undefined;
             ope?: {} | undefined;
-            unique?: {
-                token_filters?: {
-                    kind: "downcase";
-                }[] | undefined;
-            } | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -427,6 +456,11 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
             ste_vec?: {
                 prefix: string;
                 array_index_mode?: "all" | "none" | {
@@ -439,11 +473,6 @@ declare const encryptConfigSchema: z.ZodObject<{
         }, {
             ore?: {} | undefined;
             ope?: {} | undefined;
-            unique?: {
-                token_filters?: {
-                    kind: "downcase";
-                }[] | undefined;
-            } | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -458,6 +487,11 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
             ste_vec?: {
                 prefix: string;
                 array_index_mode?: "all" | "none" | {
@@ -473,11 +507,6 @@ declare const encryptConfigSchema: z.ZodObject<{
         indexes: {
             ore?: {} | undefined;
             ope?: {} | undefined;
-            unique?: {
-                token_filters?: {
-                    kind: "downcase";
-                }[] | undefined;
-            } | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -492,6 +521,11 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
             ste_vec?: {
                 prefix: string;
                 array_index_mode?: "all" | "none" | {
@@ -507,11 +541,6 @@ declare const encryptConfigSchema: z.ZodObject<{
         indexes?: {
             ore?: {} | undefined;
             ope?: {} | undefined;
-            unique?: {
-                token_filters?: {
-                    kind: "downcase";
-                }[] | undefined;
-            } | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -526,6 +555,11 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
             ste_vec?: {
                 prefix: string;
                 array_index_mode?: "all" | "none" | {
@@ -544,11 +578,6 @@ declare const encryptConfigSchema: z.ZodObject<{
         indexes: {
             ore?: {} | undefined;
             ope?: {} | undefined;
-            unique?: {
-                token_filters?: {
-                    kind: "downcase";
-                }[] | undefined;
-            } | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -563,6 +592,11 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
             ste_vec?: {
                 prefix: string;
                 array_index_mode?: "all" | "none" | {
@@ -581,11 +615,6 @@ declare const encryptConfigSchema: z.ZodObject<{
         indexes?: {
             ore?: {} | undefined;
             ope?: {} | undefined;
-            unique?: {
-                token_filters?: {
-                    kind: "downcase";
-                }[] | undefined;
-            } | undefined;
             match?: {
                 token_filters?: {
                     kind: "downcase";
@@ -600,6 +629,11 @@ declare const encryptConfigSchema: z.ZodObject<{
                 m?: number | undefined;
                 include_original?: boolean | undefined;
             } | undefined;
+            unique?: {
+                token_filters?: {
+                    kind: "downcase";
+                }[] | undefined;
+            } | undefined;
             ste_vec?: {
                 prefix: string;
                 array_index_mode?: "all" | "none" | {
@@ -1430,6 +1464,17 @@ declare const types: {
  *   table: users,
  * })
  * const dec = await client.decrypt(enc)
+ *
+ * // Searchable encryption: mint a ciphertext-free QUERY TERM and cast it
+ * // to the column's `eql_v3.query_<domain>` type in SQL to hit the index.
+ * const term = await client.encryptQuery("alice@example.com", {
+ *   column: users.email,
+ *   table: users,
+ *   queryType: "freeTextSearch",
+ * })
+ * // e.g. postgres-js:
+ * //   sql`SELECT * FROM users
+ * //       WHERE eql_v3.contains(email, ${term}::jsonb::eql_v3.query_text_search)`
  * ```
  *
  * For per-user, identity-bound encryption on the edge, build an
@@ -1552,13 +1597,55 @@ type WasmEncryptionConfig = {
     schemas: [AnyV3Table, ...AnyV3Table[]];
     config: WasmClientConfig;
 };
+/**
+ * Options for {@link WasmEncryptionClient.encryptQuery}.
+ *
+ * The column must be a QUERYABLE v3 column (authored via the `types.*`
+ * factories re-exported from this entry) — storage-only columns like
+ * `types.Text` with no indexes have nothing to query.
+ */
+type WasmEncryptQueryOptions = {
+    /** The `encryptedTable(...)` the column belongs to. */
+    table: EncryptOptions['table'];
+    /** The queryable v3 column the term targets, e.g. `users.email`. */
+    column: BuildableV3QueryableColumn;
+    /**
+     * Which of the column's indexes the term targets:
+     *
+     * - `'equality'` — exact match (`unique` index; `=` / `IN`)
+     * - `'freeTextSearch'` — fuzzy token match (`match` index; one-sided —
+     *   a match may be a false positive, a non-match never is)
+     * - `'orderAndRange'` — comparisons and ranges (`ore` index; `<` `>`
+     *   `BETWEEN` / `ORDER BY`)
+     * - `'searchableJson'` — encrypted JSON (`ste_vec` index): a **string**
+     *   value is treated as a JSONPath selector (`'$.user.email'`), any other
+     *   value as a containment needle (`{ role: 'admin' }`)
+     *
+     * Omit to infer from the column's configured indexes (priority:
+     * `unique > match > ore > ste_vec`, matching the native client) —
+     * unambiguous for single-index columns like `types.TextEq`, but be
+     * explicit for multi-index domains like `types.TextSearch` (which
+     * carries all three scalar indexes).
+     */
+    queryType?: QueryTypeName;
+};
+/**
+ * One term for {@link WasmEncryptionClient.encryptQueryBulk} — the
+ * {@link WasmEncryptQueryOptions} plus the plaintext needle. A `null`
+ * value yields `null` at the same position in the result (nothing to
+ * search for).
+ */
+type WasmQueryTerm = WasmEncryptQueryOptions & {
+    value: WasmPlaintext;
+};
 /**
  * WASM encryption client. Returned by {@link Encryption}.
  *
- * Wraps an opaque `wasmNewClient` handle and exposes a minimal
- * `encrypt` / `decrypt` surface. Larger surface (bulk, query, model
- * helpers) lives on the Node entry — port lazily as Deno / edge
- * consumers demand it.
+ * Wraps an opaque `wasmNewClient` handle and exposes `encrypt`, `decrypt`,
+ * `isEncrypted`, and — since #662 made searchable encryption reachable on
+ * the edge — `encryptQuery` / `encryptQueryBulk` for minting v3 query
+ * terms. Remaining surface (bulk encrypt/decrypt, model helpers) lives on
+ * the Node entry — port lazily as Deno / edge consumers demand it.
  *
  * Construct via {@link Encryption} — the constructor is private to
  * prevent callers from wrapping arbitrary objects in this type.
@@ -1576,6 +1663,104 @@ declare class WasmEncryptionClient {
     encrypt(plaintext: WasmPlaintext, opts: EncryptOptions): Promise<Encrypted>;
     decrypt(encrypted: Encrypted): Promise<WasmPlaintext>;
     isEncrypted(value: unknown): boolean;
+    /**
+     * Encrypt a QUERY TERM (search needle) for a queryable v3 column —
+     * equality, free-text match, ORE range, or JSON containment/selector.
+     *
+     * The returned term is **ciphertext-free**: it is matched against stored
+     * envelopes, never decrypted, so it is safe to log-scrub less aggressively
+     * than storage payloads (though it still derives from the plaintext).
+     * Interpolate it as a parameter and cast to the column's
+     * `eql_v3.query_<domain>` type to reach the indexed operators — the domain
+     * suffix mirrors the storage domain (`eql_v3_text_eq` →
+     * `eql_v3.query_text_eq`; irregular: `eql_v3_json` → `eql_v3.query_jsonb`).
+     *
+     * @example Equality (unique index)
+     * ```ts
+     * const term = await client.encryptQuery("alice@example.com", {
+     *   table: users, column: users.email, queryType: "equality",
+     * })
+     * // postgres-js:
+     * sql`SELECT * FROM users
+     *     WHERE email = ${term}::jsonb::eql_v3.query_text_eq`
+     * ```
+     *
+     * @example Free-text match (bloom index — one-sided, fuzzy)
+     * ```ts
+     * const term = await client.encryptQuery("needle", {
+     *   table: users, column: users.bio, queryType: "freeTextSearch",
+     * })
+     * sql`SELECT * FROM users
+     *     WHERE eql_v3.contains(bio, ${term}::jsonb::eql_v3.query_text_search)`
+     * ```
+     *
+     * @example Range / ORDER BY (ORE index)
+     * ```ts
+     * const term = await client.encryptQuery(42, {
+     *   table: users, column: users.age, queryType: "orderAndRange",
+     * })
+     * sql`SELECT * FROM users
+     *     WHERE eql_v3.gte(age, ${term}::jsonb::eql_v3.query_integer_ord)`
+     * ```
+     *
+     * @example Encrypted JSON — containment and JSONPath selector
+     * ```ts
+     * // Object value → containment needle (a v3 envelope):
+     * const contains = await client.encryptQuery({ role: "admin" }, {
+     *   table: users, column: users.prefs, queryType: "searchableJson",
+     * })
+     * sql`SELECT * FROM users
+     *     WHERE prefs @> ${contains}::jsonb::eql_v3.query_jsonb`
+     *
+     * // String value → JSONPath selector. NOTE: v3 has no encrypted-selector
+     * // envelope — this returns the BARE selector-hash string, bound as the
+     * // text argument of -> / ->>:
+     * const selector = await client.encryptQuery("$.role", {
+     *   table: users, column: users.prefs, queryType: "searchableJson",
+     * })
+     * sql`SELECT prefs -> ${selector} FROM users`
+     * ```
+     *
+     * @param plaintext - The search needle. `null`/`undefined` returns `null`
+     *   without contacting ZeroKMS (nothing to search for), mirroring the
+     *   native client.
+     * @param opts - Table, column, and (optionally) which index to target —
+     *   see {@link WasmEncryptQueryOptions.queryType} for the inference rules.
+     * @returns The v3 query term, or `null` for null plaintext.
+     * @throws When the requested `queryType` isn't configured on the column,
+     *   the column has no indexes at all, the value fails the same pre-flight
+     *   validation the native client runs (NaN / Infinity / out-of-int64
+     *   bigint, or a numeric value against a `freeTextSearch` index), or
+     *   encryption fails. Errors THROW, consistent with this surface's
+     *   `encrypt`/`decrypt` (the native entry's `{ data } | { failure }`
+     *   envelope lives on the Node client only).
+     */
+    encryptQuery(plaintext: WasmPlaintext, opts: WasmEncryptQueryOptions): Promise<EncryptedQuery | null>;
+    /**
+     * Batch form of {@link encryptQuery} — one ZeroKMS round trip for many
+     * terms, which is the shape query builders want (encrypt every needle in
+     * a WHERE clause together).
+     *
+     * Position-stable: the result array is index-aligned with `terms`, and a
+     * `null`/`undefined` value yields `null` at the same index (an all-null
+     * batch short-circuits without calling ZeroKMS). Terms may mix query
+     * types and columns freely.
+     *
+     * @example
+     * ```ts
+     * const [emailEq, bioMatch] = await client.encryptQueryBulk([
+     *   { value: "alice@example.com", table: users, column: users.email,
+     *     queryType: "equality" },
+     *   { value: "needle", table: users, column: users.bio,
+     *     queryType: "freeTextSearch" },
+     * ])
+     * ```
+     *
+     * @param terms - The needles to encrypt; see {@link WasmQueryTerm}.
+     * @returns Index-aligned array of v3 query terms (or `null` per null value).
+     * @throws As {@link encryptQuery} — the first invalid term aborts the batch.
+     */
+    encryptQueryBulk(terms: readonly WasmQueryTerm[]): Promise<Array<EncryptedQuery | null>>;
 }
 /**
  * Initialize a WASM-backed encryption client.
@@ -1640,4 +1825,4 @@ declare function __resetStrategyDeprecationWarningForTests(): void;
  */
 declare function resolveStrategy(cfg: WasmClientConfig): WasmAuthStrategy;
 
-export { type AnyEncryptedV3Column, type AnyV3Table, type ColumnsOf, type Encrypted, EncryptedBigintColumn, EncryptedBigintEqColumn, EncryptedBigintOrdColumn, EncryptedBigintOrdOreColumn, EncryptedBooleanColumn, EncryptedDateColumn, EncryptedDateEqColumn, EncryptedDateOrdColumn, EncryptedDateOrdOreColumn, EncryptedDoubleColumn, EncryptedDoubleEqColumn, EncryptedDoubleOrdColumn, EncryptedDoubleOrdOreColumn, EncryptedIntegerColumn, EncryptedIntegerEqColumn, EncryptedIntegerOrdColumn, EncryptedIntegerOrdOreColumn, EncryptedJsonColumn, EncryptedNumericColumn, EncryptedNumericEqColumn, EncryptedNumericOrdColumn, EncryptedNumericOrdOreColumn, EncryptedRealColumn, EncryptedRealEqColumn, EncryptedRealOrdColumn, EncryptedRealOrdOreColumn, EncryptedSmallintColumn, EncryptedSmallintEqColumn, EncryptedSmallintOrdColumn, EncryptedSmallintOrdOreColumn, EncryptedTable, EncryptedTextColumn, EncryptedTextEqColumn, EncryptedTextMatchColumn, EncryptedTextOrdColumn, EncryptedTextOrdOreColumn, EncryptedTextSearchColumn, EncryptedTimestampColumn, EncryptedTimestampEqColumn, EncryptedTimestampOrdColumn, EncryptedTimestampOrdOreColumn, type EncryptedV3TableColumn, Encryption, type EqlTypeForColumn, type InferEncrypted, type InferPlaintext, type JsonDocument, type JsonValue, type PlaintextForColumn, type QueryCapabilities, type QueryTypesForColumn, type QueryableColumnsOf, TEXT_SEARCH_EQL_TYPE, type V3DecryptedModel, type V3EncryptedModel, type V3ModelInput, type WasmAuthStrategy, type WasmClientConfig, WasmEncryptionClient, type WasmEncryptionConfig, type WasmPlaintext, __resetStrategyDeprecationWarningForTests, buildEncryptConfig, encryptedTable, getColumnName, isEncrypted, normalizeCastAs, resolveStrategy, types };
+export { type AnyEncryptedV3Column, type AnyV3Table, type ColumnsOf, type Encrypted, EncryptedBigintColumn, EncryptedBigintEqColumn, EncryptedBigintOrdColumn, EncryptedBigintOrdOreColumn, EncryptedBooleanColumn, EncryptedDateColumn, EncryptedDateEqColumn, EncryptedDateOrdColumn, EncryptedDateOrdOreColumn, EncryptedDoubleColumn, EncryptedDoubleEqColumn, EncryptedDoubleOrdColumn, EncryptedDoubleOrdOreColumn, EncryptedIntegerColumn, EncryptedIntegerEqColumn, EncryptedIntegerOrdColumn, EncryptedIntegerOrdOreColumn, EncryptedJsonColumn, EncryptedNumericColumn, EncryptedNumericEqColumn, EncryptedNumericOrdColumn, EncryptedNumericOrdOreColumn, EncryptedRealColumn, EncryptedRealEqColumn, EncryptedRealOrdColumn, EncryptedRealOrdOreColumn, EncryptedSmallintColumn, EncryptedSmallintEqColumn, EncryptedSmallintOrdColumn, EncryptedSmallintOrdOreColumn, EncryptedTable, EncryptedTextColumn, EncryptedTextEqColumn, EncryptedTextMatchColumn, EncryptedTextOrdColumn, EncryptedTextOrdOreColumn, EncryptedTextSearchColumn, EncryptedTimestampColumn, EncryptedTimestampEqColumn, EncryptedTimestampOrdColumn, EncryptedTimestampOrdOreColumn, type EncryptedV3TableColumn, Encryption, type EqlTypeForColumn, type InferEncrypted, type InferPlaintext, type JsonDocument, type JsonValue, type PlaintextForColumn, type QueryCapabilities, type QueryTypesForColumn, type QueryableColumnsOf, TEXT_SEARCH_EQL_TYPE, type V3DecryptedModel, type V3EncryptedModel, type V3ModelInput, type WasmAuthStrategy, type WasmClientConfig, type WasmEncryptQueryOptions, WasmEncryptionClient, type WasmEncryptionConfig, type WasmPlaintext, type WasmQueryTerm, __resetStrategyDeprecationWarningForTests, buildEncryptConfig, encryptedTable, getColumnName, isEncrypted, normalizeCastAs, resolveStrategy, types };