@proteinjs/db 1.35.1 → 1.36.0

package/dist/src/Record.js

@@ -14,6 +14,29 @@ var __extends = (this && this.__extends) || (function () {
         d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
     };
 })();
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -97,13 +120,14 @@ function withRecordColumns(columns) {
 }
 exports.withRecordColumns = withRecordColumns;
 var RecordSerializer = /** @class */ (function () {
-    function RecordSerializer(table) {
+    function RecordSerializer(table, encryptionContext) {
         this.logger = new logger_1.Logger({ name: this.constructor.name });
         this.table = table;
+        this.encryptionContext = encryptionContext;
     }
     RecordSerializer.prototype.serialize = function (record) {
         return __awaiter(this, void 0, void 0, function () {
-            var serialized, fieldSerializer, omittedFields, _a, _b, _c, _i, fieldPropertyName, fieldValue, undefinedFieldValueError, _d, columnName, serializedFieldValue, MissingFieldError_1;
+            var serialized, fieldSerializer, omittedFields, _a, _b, _c, _i, fieldPropertyName, fieldValue, undefinedFieldValueError, _d, columnName, serializedFieldValue, MissingFieldError_1, EncryptionRecordHooks;
             return __generator(this, function (_e) {
                 switch (_e.label) {
                     case 0:
@@ -151,6 +175,12 @@ var RecordSerializer = /** @class */ (function () {
                             // could mean the developer is passing in an object they don't expect
                             this.logger.warn({ message: "Fields were omitted during serialization", obj: { omittedFields: omittedFields } });
                         }
+                        return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require('./encryption/EncryptionRecordHooks')); })];
+                    case 8:
+                        EncryptionRecordHooks = (_e.sent()).EncryptionRecordHooks;
+                        return [4 /*yield*/, new EncryptionRecordHooks().onSerialize(this.table, serialized, this.encryptionContext)];
+                    case 9:
+                        _e.sent();
                         return [2 /*return*/, serialized];
                 }
             });
@@ -158,41 +188,46 @@ var RecordSerializer = /** @class */ (function () {
     };
     RecordSerializer.prototype.deserialize = function (serializedRecord) {
         return __awaiter(this, void 0, void 0, function () {
-            var deserialized, fieldSerializer, omittedFields, _a, _b, _c, _i, columnName, serializedFieldValue, _d, fieldPropertyName, fieldValue, MissingFieldError_2;
+            var EncryptionRecordHooks, prepared, deserialized, fieldSerializer, omittedFields, _a, _b, _c, _i, columnName, serializedFieldValue, _d, fieldPropertyName, fieldValue, MissingFieldError_2;
             return __generator(this, function (_e) {
                 switch (_e.label) {
-                    case 0:
+                    case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require('./encryption/EncryptionRecordHooks')); })];
+                    case 1:
+                        EncryptionRecordHooks = (_e.sent()).EncryptionRecordHooks;
+                        return [4 /*yield*/, new EncryptionRecordHooks().onDeserialize(this.table, serializedRecord)];
+                    case 2:
+                        prepared = _e.sent();
                         deserialized = {};
                         fieldSerializer = new FieldSerializer(this.table);
                         omittedFields = [];
-                        _a = serializedRecord;
+                        _a = prepared;
                         _b = [];
                         for (_c in _a)
                             _b.push(_c);
                         _i = 0;
-                        _e.label = 1;
-                    case 1:
-                        if (!(_i < _b.length)) return [3 /*break*/, 6];
+                        _e.label = 3;
+                    case 3:
+                        if (!(_i < _b.length)) return [3 /*break*/, 8];
                         _c = _b[_i];
-                        if (!(_c in _a)) return [3 /*break*/, 5];
+                        if (!(_c in _a)) return [3 /*break*/, 7];
                         columnName = _c;
-                        serializedFieldValue = serializedRecord[columnName];
-                        _e.label = 2;
-                    case 2:
-                        _e.trys.push([2, 4, , 5]);
-                        return [4 /*yield*/, fieldSerializer.deserialize(columnName, serializedFieldValue, serializedRecord)];
-                    case 3:
+                        serializedFieldValue = prepared[columnName];
+                        _e.label = 4;
+                    case 4:
+                        _e.trys.push([4, 6, , 7]);
+                        return [4 /*yield*/, fieldSerializer.deserialize(columnName, serializedFieldValue, prepared)];
+                    case 5:
                         _d = _e.sent(), fieldPropertyName = _d.fieldPropertyName, fieldValue = _d.fieldValue;
                         deserialized[fieldPropertyName] = fieldValue;
-                        return [3 /*break*/, 5];
-                    case 4:
+                        return [3 /*break*/, 7];
+                    case 6:
                         MissingFieldError_2 = _e.sent();
                         omittedFields.push(columnName);
-                        return [3 /*break*/, 5];
-                    case 5:
+                        return [3 /*break*/, 7];
+                    case 7:
                         _i++;
-                        return [3 /*break*/, 1];
-                    case 6:
+                        return [3 /*break*/, 3];
+                    case 8:
                         if (omittedFields.length > 0) {
                             // expected when passing a base table into the query api
                             this.logger.debug({ message: "Fields were omitted during deserialization", obj: { omittedFields: omittedFields } });

package/dist/src/Record.js.map

@@ -1 +1 @@
-{"version":3,"file":"Record.js","sourceRoot":"","sources":["../../src/Record.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,4CAA2C;AAC3C,qCAAuD;AAEvD,uCAAsC;AAQtC,SAAgB,cAAc,CAAC,MAAc;IAC3C,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,CAAC;AACzE,CAAC;AAFD,wCAEC;AAED,IAAM,aAAa,GAAoB;IACrC,EAAE,EAAE,IAAI,oBAAU,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;IAClD,OAAO,EAAE,IAAI,wBAAc,CAAC,SAAS,EAAE;QACrC,YAAY,EAAE;YAAY,sBAAA,IAAA,eAAM,GAAE,EAAA;iBAAA;KACnC,CAAC;IACF,OAAO,EAAE,IAAI,wBAAc,CAAC,SAAS,EAAE;QACrC,YAAY,EAAE;YAAY,sBAAA,IAAA,eAAM,GAAE,EAAA;iBAAA;QAClC,WAAW,EAAE;YAAY,sBAAA,IAAA,eAAM,GAAE,EAAA;iBAAA;KAClC,CAAC;CACH,CAAC;AAEF;IAAgC,qCAAK;IACnC,2BAAY,SAAiB,EAAE,SAAiB;QAAhD,YACE,kBAAM,gBAAS,SAAS,gCAAsB,SAAS,CAAE,CAAC,SAE3D;QADC,KAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;;IAClC,CAAC;IACH,wBAAC;AAAD,CAAC,AALD,CAAgC,KAAK,GAKpC;AAED;;;;;;;GAOG;AACH,SAAgB,iBAAiB,CAC/B,OAAuC;IAEvC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC;AAClE,CAAC;AAJD,8CAIC;AAID;IAIE,0BAAY,KAAe;QAHnB,WAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QAI3D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAEK,oCAAS,GAAf,UAAgB,MAAW;;;;;;wBACnB,UAAU,GAAQ,EAAE,CAAC;wBACrB,eAAe,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBAClD,aAAa,GAAa,EAAE,CAAC;6BACH,MAAM;;;;;;;;;;;wBACpC,IAAI,OAAO,MAAM,CAAC,iBAAiB,CAAC,KAAK,UAAU,EAAE;4BACnD,wBAAS;yBACV;wBAEkB,qBAAM,MAAM,CAAC,iBAAiB,CAAC,EAAA;;wBAA5C,UAAU,GAAG,SAA+B;wBAClD,IAAI,UAAU,KAAK,SAAS,EAAE;4BACtB,wBAAwB,GAAG,qEAA8D,IAAI,CAAC,KAAK,CAAC,IAAI,cAAI,iBAAiB,CAAE,CAAC;4BACtI,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;yBAC3C;;;;wBAE8C,qBAAM,eAAe,CAAC,SAAS,CAAC,iBAAiB,EAAE,UAAU,CAAC,EAAA;;wBAArG,KAAuC,SAA8D,EAAnG,UAAU,gBAAA,EAAE,oBAAoB,0BAAA;wBACxC,UAAU,CAAC,UAAU,CAAC,GAAG,oBAAoB,CAAC;;;;wBAE9C,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;;;;;;wBAI1C,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE;4BAC5B,qEAAqE;4BACrE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,GAAG,EAAE,EAAE,aAAa,eAAA,EAAE,EAAE,CAAC,CAAC;yBACnG;wBAED,sBAAO,UAAU,EAAC;;;;KACnB;IAEK,sCAAW,GAAjB,UAAkB,gBAAkC;;;;;;wBAC5C,YAAY,GAAQ,EAAE,CAAC;wBACvB,eAAe,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBAClD,aAAa,GAAa,EAAE,CAAC;6BACV,gBAAgB;;;;;;;;;;;wBACjC,oBAAoB,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;;;;wBAEd,qBAAM,eAAe,CAAC,WAAW,CACzE,UAAU,EACV,oBAAoB,EACpB,gBAAgB,CACjB,EAAA;;wBAJK,KAAoC,SAIzC,EAJO,iBAAiB,uBAAA,EAAE,UAAU,gBAAA;wBAKrC,YAAY,CAAC,iBAAiB,CAAC,GAAG,UAAU,CAAC;;;;wBAE7C,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;;;;;;wBAInC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE;4BAC5B,wDAAwD;4BACxD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,GAAG,EAAE,EAAE,aAAa,eAAA,EAAE,EAAE,CAAC,CAAC;yBACtG;wBAED,sBAAO,YAAY,EAAC;;;;KACrB;IACH,uBAAC;AAAD,CAAC,AA/DD,IA+DC;AA/DY,4CAAgB;AAiE7B;IACE,yBAAoB,KAAe;QAAf,UAAK,GAAL,KAAK,CAAU;IAAG,CAAC;IAEjC,mCAAS,GAAf,UAAgB,iBAAyB,EAAE,UAAe;;;;;;wBAClD,OAAO,GAAyC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;wBACnE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;wBAC1C,IAAI,CAAC,MAAM,EAAE;4BACX,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;yBACjE;wBAEG,oBAAoB,GAAG,UAAU,CAAC;6BAClC,MAAM,CAAC,SAAS,EAAhB,wBAAgB;wBACK,qBAAM,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,EAAA;;wBAAzD,oBAAoB,GAAG,SAAkC,CAAC;;4BAG5D,sBAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,oBAAoB,sBAAA,EAAE,EAAC;;;;KAC1D;IAEK,qCAAW,GAAjB,UAAkB,UAAkB,EAAE,oBAAyB,EAAE,gBAAkC;;;;;;wBAC3F,OAAO,GAAyC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;wBACrE,iBAAiB,GAAG,UAAU,CAAC;wBAC/B,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;wBACjC,IAAI,CAAC,MAAM,EAAE;4BACX,KAAW,kBAAkB,IAAI,OAAO,EAAE;gCAClC,WAAW,GAAI,IAAI,CAAC,KAAK,CAAC,OAAe,CAAC,kBAAkB,CAAC,CAAC;gCACpE,IAAI,WAAW,IAAI,UAAU,IAAI,WAAW,CAAC,IAAI,EAAE;oCACjD,iBAAiB,GAAG,kBAAkB,CAAC;oCACvC,MAAM,GAAG,WAAW,CAAC;oCACrB,MAAM;iCACP;6BACF;yBACF;wBAED,IAAI,CAAC,MAAM,EAAE;4BACX,8FAA8F;4BAC9F,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;yBACjE;wBAEG,UAAU,GAAG,oBAAoB,CAAC;6BAClC,MAAM,CAAC,WAAW,EAAlB,wBAAkB;wBACP,qBAAM,MAAM,CAAC,WAAW,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,EAAA;;wBAA7E,UAAU,GAAG,SAAgE,CAAC;;4BAGhF,sBAAO,EAAE,iBAAiB,mBAAA,EAAE,UAAU,YAAA,EAAE,EAAC;;;;KAC1C;IACH,sBAAC;AAAD,CAAC,AA7CD,IA6CC;AA7CY,0CAAe"}
+{"version":3,"file":"Record.js","sourceRoot":"","sources":["../../src/Record.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,4CAA2C;AAC3C,qCAAuD;AAEvD,uCAAsC;AAQtC,SAAgB,cAAc,CAAC,MAAc;IAC3C,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,CAAC;AACzE,CAAC;AAFD,wCAEC;AAED,IAAM,aAAa,GAAoB;IACrC,EAAE,EAAE,IAAI,oBAAU,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;IAClD,OAAO,EAAE,IAAI,wBAAc,CAAC,SAAS,EAAE;QACrC,YAAY,EAAE;YAAY,sBAAA,IAAA,eAAM,GAAE,EAAA;iBAAA;KACnC,CAAC;IACF,OAAO,EAAE,IAAI,wBAAc,CAAC,SAAS,EAAE;QACrC,YAAY,EAAE;YAAY,sBAAA,IAAA,eAAM,GAAE,EAAA;iBAAA;QAClC,WAAW,EAAE;YAAY,sBAAA,IAAA,eAAM,GAAE,EAAA;iBAAA;KAClC,CAAC;CACH,CAAC;AAEF;IAAgC,qCAAK;IACnC,2BAAY,SAAiB,EAAE,SAAiB;QAAhD,YACE,kBAAM,gBAAS,SAAS,gCAAsB,SAAS,CAAE,CAAC,SAE3D;QADC,KAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;;IAClC,CAAC;IACH,wBAAC;AAAD,CAAC,AALD,CAAgC,KAAK,GAKpC;AAED;;;;;;;GAOG;AACH,SAAgB,iBAAiB,CAC/B,OAAuC;IAEvC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC;AAClE,CAAC;AAJD,8CAIC;AAQD;IAKE,0BAAY,KAAe,EAAE,iBAA2C;QAJhE,WAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QAK3D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;IAEK,oCAAS,GAAf,UAAgB,MAAW;;;;;;wBACnB,UAAU,GAAQ,EAAE,CAAC;wBACrB,eAAe,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBAClD,aAAa,GAAa,EAAE,CAAC;6BACH,MAAM;;;;;;;;;;;wBACpC,IAAI,OAAO,MAAM,CAAC,iBAAiB,CAAC,KAAK,UAAU,EAAE;4BACnD,wBAAS;yBACV;wBAEkB,qBAAM,MAAM,CAAC,iBAAiB,CAAC,EAAA;;wBAA5C,UAAU,GAAG,SAA+B;wBAClD,IAAI,UAAU,KAAK,SAAS,EAAE;4BACtB,wBAAwB,GAAG,qEAA8D,IAAI,CAAC,KAAK,CAAC,IAAI,cAAI,iBAAiB,CAAE,CAAC;4BACtI,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;yBAC3C;;;;wBAE8C,qBAAM,eAAe,CAAC,SAAS,CAAC,iBAAiB,EAAE,UAAU,CAAC,EAAA;;wBAArG,KAAuC,SAA8D,EAAnG,UAAU,gBAAA,EAAE,oBAAoB,0BAAA;wBACxC,UAAU,CAAC,UAAU,CAAC,GAAG,oBAAoB,CAAC;;;;wBAE9C,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;;;;;;wBAI1C,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE;4BAC5B,qEAAqE;4BACrE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,GAAG,EAAE,EAAE,aAAa,eAAA,EAAE,EAAE,CAAC,CAAC;yBACnG;wBAMiC,sFAAa,oCAAoC,QAAC;;wBAA5E,qBAAqB,GAAK,CAAA,SAAkD,CAAA,sBAAvD;wBAC7B,qBAAM,IAAI,qBAAqB,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAAA;;wBAA7F,SAA6F,CAAC;wBAC9F,sBAAO,UAAU,EAAC;;;;KACnB;IAEK,sCAAW,GAAjB,UAAkB,gBAAkC;;;;;4BAGhB,sFAAa,oCAAoC,QAAC;;wBAA5E,qBAAqB,GAAK,CAAA,SAAkD,CAAA,sBAAvD;wBACZ,qBAAM,IAAI,qBAAqB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAA;;wBAAxF,QAAQ,GAAG,SAA6E;wBAExF,YAAY,GAAQ,EAAE,CAAC;wBACvB,eAAe,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBAClD,aAAa,GAAa,EAAE,CAAC;6BACV,QAAQ;;;;;;;;;;;wBACzB,oBAAoB,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;;;;wBAEN,qBAAM,eAAe,CAAC,WAAW,CACzE,UAAU,EACV,oBAAoB,EACpB,QAAQ,CACT,EAAA;;wBAJK,KAAoC,SAIzC,EAJO,iBAAiB,uBAAA,EAAE,UAAU,gBAAA;wBAKrC,YAAY,CAAC,iBAAiB,CAAC,GAAG,UAAU,CAAC;;;;wBAE7C,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;;;;;;wBAInC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE;4BAC5B,wDAAwD;4BACxD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,GAAG,EAAE,EAAE,aAAa,eAAA,EAAE,EAAE,CAAC,CAAC;yBACtG;wBAED,sBAAO,YAAY,EAAC;;;;KACrB;IACH,uBAAC;AAAD,CAAC,AA5ED,IA4EC;AA5EY,4CAAgB;AA8E7B;IACE,yBAAoB,KAAe;QAAf,UAAK,GAAL,KAAK,CAAU;IAAG,CAAC;IAEjC,mCAAS,GAAf,UAAgB,iBAAyB,EAAE,UAAe;;;;;;wBAClD,OAAO,GAAyC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;wBACnE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;wBAC1C,IAAI,CAAC,MAAM,EAAE;4BACX,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;yBACjE;wBAEG,oBAAoB,GAAG,UAAU,CAAC;6BAClC,MAAM,CAAC,SAAS,EAAhB,wBAAgB;wBACK,qBAAM,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,EAAA;;wBAAzD,oBAAoB,GAAG,SAAkC,CAAC;;4BAG5D,sBAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,oBAAoB,sBAAA,EAAE,EAAC;;;;KAC1D;IAEK,qCAAW,GAAjB,UAAkB,UAAkB,EAAE,oBAAyB,EAAE,gBAAkC;;;;;;wBAC3F,OAAO,GAAyC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;wBACrE,iBAAiB,GAAG,UAAU,CAAC;wBAC/B,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;wBACjC,IAAI,CAAC,MAAM,EAAE;4BACX,KAAW,kBAAkB,IAAI,OAAO,EAAE;gCAClC,WAAW,GAAI,IAAI,CAAC,KAAK,CAAC,OAAe,CAAC,kBAAkB,CAAC,CAAC;gCACpE,IAAI,WAAW,IAAI,UAAU,IAAI,WAAW,CAAC,IAAI,EAAE;oCACjD,iBAAiB,GAAG,kBAAkB,CAAC;oCACvC,MAAM,GAAG,WAAW,CAAC;oCACrB,MAAM;iCACP;6BACF;yBACF;wBAED,IAAI,CAAC,MAAM,EAAE;4BACX,8FAA8F;4BAC9F,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;yBACjE;wBAEG,UAAU,GAAG,oBAAoB,CAAC;6BAClC,MAAM,CAAC,WAAW,EAAlB,wBAAkB;wBACP,qBAAM,MAAM,CAAC,WAAW,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,EAAA;;wBAA7E,UAAU,GAAG,SAAgE,CAAC;;4BAGhF,sBAAO,EAAE,iBAAiB,mBAAA,EAAE,UAAU,YAAA,EAAE,EAAC;;;;KAC1C;IACH,sBAAC;AAAD,CAAC,AA7CD,IA6CC;AA7CY,0CAAe"}

package/dist/src/Table.d.ts

@@ -1,7 +1,7 @@
 import { Loadable } from '@proteinjs/reflection';
 import { CustomSerializableObject } from '@proteinjs/serializer';
 import { Record } from './Record';
-import { QueryBuilder } from '@proteinjs/db-query';
+import { ColumnQueryTransform, QueryBuilder } from '@proteinjs/db-query';
 import { Identity, TableOperationsAuth } from './auth/TableAuth';
 import { Db } from './Db';
 export declare const isTable: (obj: any) => boolean;
@@ -67,6 +67,19 @@ export type Columns<T> = {
 } & {
     [P in OptionalProps<T>]?: Column<T[P] | undefined, any>;
 };
+/**
+ * What a column's query transform runs WITH: the current operation's authority and its
+ * driver/transaction-riding query runners. Supplied by `Db` per operation
+ * (`Db.addColumnQueries`), so a transform's own reads behave like part of the query that
+ * carried them.
+ */
+export interface ColumnQueryRuntime {
+    runAsSystem: boolean;
+    /** Query with the CALLER's authority (auth + column queries apply). */
+    query: (table: Table<any>, qb: QueryBuilder<any>) => Promise<any[]>;
+    /** System-authority query — for framework-derived tables that are default-deny to callers. */
+    systemQuery: (table: Table<any>, qb: QueryBuilder<any>) => Promise<any[]>;
+}
 export type Column<T, Serialized> = {
     name: string;
     /**
@@ -78,13 +91,81 @@ export type Column<T, Serialized> = {
     options?: ColumnOptions;
     serialize?: (fieldValue: T | null | undefined) => Promise<Serialized | null | undefined>;
     deserialize?: (serializedFieldValue: Serialized | null, serializedRecord: any) => Promise<T | null | void>;
+    /**
+     * The column's QUERY-side contract, paralleling `serialize`/`deserialize` on the storage
+     * side: how uses of this column in a query (conditions, ORDER BY, aggregation, GROUP BY)
+     * translate into uses of what the database actually stores and indexes for it — see
+     * `ColumnQueryTransform` (@proteinjs/db-query). Applied by
+     * `QueryBuilder.applyColumnTransforms` on every query, through
+     * `TableQueryTransformProvider`.
+     *
+     * A factory rather than a bare transform: translation may consult derived index state
+     * (e.g. an encrypted column's token table), so a transform is built per operation with
+     * the operation's `ColumnQueryRuntime` — its driver-riding query runners and authority.
+     * Derived by the framework for encrypted columns (`EncryptedColumns.ensureSchema`);
+     * any column may supply one.
+     */
+    queryTransform?: (runtime: ColumnQueryRuntime) => ColumnQueryTransform;
     beforeDelete?: (table: Table<any>, columnPropertyName: string, records: any[], getTable?: (tableName: string) => Table<any>, db?: Db) => Promise<void>;
 };
+/**
+ * Capabilities of an encrypted column. Nested INSIDE the `encrypted` declaration on purpose:
+ * `searchable` and `sortKey` only mean anything on an encrypted column (a plaintext column
+ * is inherently searchable and sortable through normal SQL), so the invalid state — a
+ * search/sort capability declared without encryption — is unrepresentable.
+ */
+export type EncryptedColumnConfig = {
+    /**
+     * Index the value for native querying over ciphertext (derived automatically at the
+     * database layer — see `EncryptedColumns`):
+     * - `'contains'` — word + trigram search tokens, keyed-fingerprinted per owner, serving
+     *   the LIKE contains/prefix family with exact results (candidate cover + decrypt-verify).
+     * - `'equality'` — one whole-value fingerprint companion column serving `=` / `IN` /
+     *   get-by-value as a single indexed lookup (and value uniqueness, per owner).
+     * Encrypted columns that are never queried by value declare neither and carry no
+     * derivatives — the default.
+     */
+    searchable?: 'contains' | 'equality';
+    /**
+     * Native ORDER BY at any scale through a DECLARED bounded reveal: an ordered
+     * representation of the value's first `revealPrefix` characters (normalized) is stored
+     * beside the ciphertext and the database sorts on it. The leak, stated plainly: raw
+     * database access can see each value's first `revealPrefix` characters — nothing else.
+     * A conscious, schema-author-declared tradeoff; never the default. Rows sharing a prefix
+     * tie-break app-side within the returned page.
+     */
+    sortKey?: {
+        revealPrefix: number;
+    };
+};
 export type ColumnOptions = {
     unique?: {
         unique: boolean;
         indexName?: string;
     };
+    /**
+     * Whether this column's values are stored encrypted (AES-256-GCM under per-owner data
+     * keys wrapped by the deployment's master key — see `DbEncryptionConfig`). The value is
+     * either `false` (plaintext — said out loud) or a config object:
+     *
+     * ```ts
+     * encrypted: false                             // plaintext (explicit)
+     * encrypted: {}                                // encrypted, never queried by value
+     * encrypted: { searchable: 'contains' }        // + indexed contains/prefix search
+     * encrypted: { searchable: 'equality' }        // + indexed exact-match lookup
+     * encrypted: { sortKey: { revealPrefix: 3 } }  // + native ORDER BY via a declared bounded reveal
+     * ```
+     *
+     * Everything downstream — the transparent encrypt/decrypt seam, companion index
+     * derivation, query translation, loud contract rejections, lifecycle backfills — is
+     * derived automatically at the database layer; callers never write an encrypt or decrypt
+     * call. Query shapes outside the contract are rejected at query-build time
+     * (`EncryptionQueryTranslator`).
+     *
+     * When `DbEncryptionConfig.requireEncryptedDeclarations` is on, every text-holding
+     * column MUST carry this declaration — registration fails loudly otherwise.
+     */
+    encrypted?: false | EncryptedColumnConfig;
     /**
      * The column in the reference table `table` is the primary key of the table (`id` unless otherwise specified in the Table definition)
      *

package/dist/src/Table.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Table.d.ts","sourceRoot":"","sources":["../../src/Table.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAoB,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAkB,MAAM,EAAE,MAAM,UAAU,CAAC;AAElD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,EAAE,EAAE,MAAM,MAAM,CAAC;AAE1B,eAAO,MAAM,OAAO,QAAS,GAAG,YAA6C,CAAC;AAE9E,eAAO,MAAM,SAAS,0CAAgG,CAAC;AAEvH,eAAO,MAAM,WAAW,SAAU,MAAM,eASvC,CAAC;AAEF,eAAO,MAAM,qBAAqB,UAAW,MAAM,GAAG,CAAC,cAAc,MAAM,kBAS1E,CAAC;AAEF,eAAO,MAAM,eAAe,UAAW,MAAM,GAAG,CAAC,cAAc,MAAM,4BASpE,CAAC;AAEF,eAAO,MAAM,qBAAqB,UAAiB,MAAM,GAAG,CAAC,UAAU,GAAG,eAAe,OAAO,kBAe/F,CAAC;AAEF,eAAO,MAAM,oBAAoB,UAAiB,MAAM,GAAG,CAAC,UAAU,GAAG,kBAUxE,CAAC;AAEF;;GAEG;AACH,8BAAsB,KAAK,CAAC,CAAC,SAAS,MAAM,CAAE,YAAW,QAAQ,EAAE,wBAAwB;IAClF,cAAc,SAAqB;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7B;;;;OAIG;IACI,OAAO,EAAE;QAAE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAAM;IACjF,6FAA6F;IACtF,uBAAuB,EAAE,MAAM;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,EAAE,CAAY;IAC9F,8EAA8E;IACvE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAM;IACjD,IAAI,CAAC,EAAE;QACZ,EAAE,CAAC,EAAE,mBAAmB,CAAC;QACzB,OAAO,CAAC,EAAE,mBAAmB,CAAC;QAC9B;;;;;;;WAOG;QACH,uBAAuB,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC;QAC/C,EAAE,CAAC,EAAE;YACH,WAAW,CAAC,EAAE,QAAQ,CAAC;YACvB,UAAU,CAAC,EAAE,QAAQ,CAAC;SACvB,CAAC;KACH,CAAC;CACH;AAED,KAAK,gBAAgB,CAAC,CAAC,IAAI;KACxB,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,QAAQ,GAAG,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAC1D,CAAC;AAEF,KAAK,aAAa,CAAC,CAAC,IAAI;KACrB,CAAC,IAAI,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,SAAS,GAAG,KAAK,GAAG,CAAC;CACvF,CAAC,MAAM,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7B,KAAK,aAAa,CAAC,CAAC,IAAI;KACrB,CAAC,IAAI,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,SAAS,GAAG,CAAC,GAAG,KAAK;CACvF,CAAC,MAAM,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7B,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI;KACtB,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;CAC3C,GAAG;KACD,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,CAAC;CACxD,CAAC;AAEF,MAAM,MAAM,MAAM,CAAC,CAAC,EAAE,UAAU,IAAI;IAClC,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,SAAS,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACzF,WAAW,CAAC,EAAE,CAAC,oBAAoB,EAAE,UAAU,GAAG,IAAI,EAAE,gBAAgB,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IAC3G,YAAY,CAAC,EAAE,CACb,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,kBAAkB,EAAE,MAAM,EAC1B,OAAO,EAAE,GAAG,EAAE,EACd,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,KAAK,CAAC,GAAG,CAAC,EAC5C,EAAE,CAAC,EAAE,EAAE,KACJ,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD;;;;OAIG;IACH,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,6BAA6B;IAC7B,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5E,yGAAyG;IACzG,iBAAiB,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC;IAClE,6BAA6B;IAC7B,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IAClE;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC;IAC1D,mEAAmE;IACnE,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/G;;;;;OAKG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,MAAM,EAAE,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrG;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,MAAM,EAAE,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpG;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,EAAE,CACvB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,OAAO,GAAG,QAAQ,EAC7B,WAAW,EAAE,OAAO,KACjB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,EAAE,CAAC,EAAE;QACH,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,CAAC,GAAG,GAAG,IAAI;IACzC;;;;;;;;;;;;;;OAcG;IACH,eAAe,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;KAAE,CAAC;IAC7D;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;IAC9B,EAAE,CAAC,EAAE;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;CACH,CAAC"}
+{"version":3,"file":"Table.d.ts","sourceRoot":"","sources":["../../src/Table.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAoB,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAkB,MAAM,EAAE,MAAM,UAAU,CAAC;AAElD,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,EAAE,EAAE,MAAM,MAAM,CAAC;AAG1B,eAAO,MAAM,OAAO,QAAS,GAAG,YAA6C,CAAC;AAE9E,eAAO,MAAM,SAAS,0CAAgG,CAAC;AAEvH,eAAO,MAAM,WAAW,SAAU,MAAM,eAiBvC,CAAC;AAmBF,eAAO,MAAM,qBAAqB,UAAW,MAAM,GAAG,CAAC,cAAc,MAAM,kBAS1E,CAAC;AAEF,eAAO,MAAM,eAAe,UAAW,MAAM,GAAG,CAAC,cAAc,MAAM,4BASpE,CAAC;AAEF,eAAO,MAAM,qBAAqB,UAAiB,MAAM,GAAG,CAAC,UAAU,GAAG,eAAe,OAAO,kBAe/F,CAAC;AAEF,eAAO,MAAM,oBAAoB,UAAiB,MAAM,GAAG,CAAC,UAAU,GAAG,kBAUxE,CAAC;AAEF;;GAEG;AACH,8BAAsB,KAAK,CAAC,CAAC,SAAS,MAAM,CAAE,YAAW,QAAQ,EAAE,wBAAwB;IAClF,cAAc,SAAqB;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7B;;;;OAIG;IACI,OAAO,EAAE;QAAE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAAM;IACjF,6FAA6F;IACtF,uBAAuB,EAAE,MAAM;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,EAAE,CAAY;IAC9F,8EAA8E;IACvE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAM;IACjD,IAAI,CAAC,EAAE;QACZ,EAAE,CAAC,EAAE,mBAAmB,CAAC;QACzB,OAAO,CAAC,EAAE,mBAAmB,CAAC;QAC9B;;;;;;;WAOG;QACH,uBAAuB,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC;QAC/C,EAAE,CAAC,EAAE;YACH,WAAW,CAAC,EAAE,QAAQ,CAAC;YACvB,UAAU,CAAC,EAAE,QAAQ,CAAC;SACvB,CAAC;KACH,CAAC;CACH;AAED,KAAK,gBAAgB,CAAC,CAAC,IAAI;KACxB,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,QAAQ,GAAG,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAC1D,CAAC;AAEF,KAAK,aAAa,CAAC,CAAC,IAAI;KACrB,CAAC,IAAI,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,SAAS,GAAG,KAAK,GAAG,CAAC;CACvF,CAAC,MAAM,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7B,KAAK,aAAa,CAAC,CAAC,IAAI;KACrB,CAAC,IAAI,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,SAAS,GAAG,CAAC,GAAG,KAAK;CACvF,CAAC,MAAM,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7B,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI;KACtB,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;CAC3C,GAAG;KACD,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,CAAC;CACxD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,OAAO,CAAC;IACrB,uEAAuE;IACvE,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,8FAA8F;IAC9F,WAAW,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;CAC3E;AAED,MAAM,MAAM,MAAM,CAAC,CAAC,EAAE,UAAU,IAAI;IAClC,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,SAAS,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACzF,WAAW,CAAC,EAAE,CAAC,oBAAoB,EAAE,UAAU,GAAG,IAAI,EAAE,gBAAgB,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IAC3G;;;;;;;;;;;;;OAaG;IACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,oBAAoB,CAAC;IACvE,YAAY,CAAC,EAAE,CACb,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,kBAAkB,EAAE,MAAM,EAC1B,OAAO,EAAE,GAAG,EAAE,EACd,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,KAAK,CAAC,GAAG,CAAC,EAC5C,EAAE,CAAC,EAAE,EAAE,KACJ,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IACrC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,EAAE,KAAK,GAAG,qBAAqB,CAAC;IAC1C;;;;OAIG;IACH,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,6BAA6B;IAC7B,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5E,yGAAyG;IACzG,iBAAiB,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC;IAClE,6BAA6B;IAC7B,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IAClE;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC;IAC1D,mEAAmE;IACnE,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/G;;;;;OAKG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,MAAM,EAAE,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrG;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,MAAM,EAAE,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpG;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,EAAE,CACvB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,OAAO,GAAG,QAAQ,EAC7B,WAAW,EAAE,OAAO,KACjB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,EAAE,CAAC,EAAE;QACH,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,CAAC,GAAG,GAAG,IAAI;IACzC;;;;;;;;;;;;;;OAcG;IACH,eAAe,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;KAAE,CAAC;IAC7D;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;IAC9B,EAAE,CAAC,EAAE;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;CACH,CAAC"}

package/dist/src/Table.js

@@ -40,6 +40,7 @@ exports.Table = exports.addUpdateFieldValues = exports.addDefaultFieldValues = e
 var reflection_1 = require("@proteinjs/reflection");
 var Record_1 = require("./Record");
 var TableSerializer_1 = require("./serializers/TableSerializer");
+var EncryptionDerivedTableRegistry_1 = require("./encryption/EncryptionDerivedTableRegistry");
 var isTable = function (obj) { return obj.__serializerId === TableSerializer_1.TableSerializerId; };
 exports.isTable = isTable;
 var getTables = function () { return reflection_1.SourceRepository.get().objects('@proteinjs/db/Table'); };
@@ -49,12 +50,34 @@ var tableByName = function (name) {
     for (var _i = 0, tables_1 = tables; _i < tables_1.length; _i++) {
         var table = tables_1[_i];
         if (table.name == name) {
-            return table;
+            return ensureEncryptionSchema(table);
         }
     }
+    // Framework-DERIVED tables (search-token tables beside encrypted columns) are synthesized
+    // from column config rather than declared in source, so the reflection registry never
+    // sees them (see EncryptionDerivedTableRegistry — a runtime-cycle-free, type-only import).
+    var derivedTable = EncryptionDerivedTableRegistry_1.EncryptionDerivedTableRegistry.get(name);
+    if (derivedTable) {
+        return derivedTable;
+    }
     throw new Error("Unable to find table: ".concat(name));
 };
 exports.tableByName = tableByName;
+/**
+ * Table instances are constructed ad hoc all over consumer code, and the encryption-derived
+ * physical schema (companion columns — see `EncryptedColumns.ensureSchema`) is injected
+ * per-instance at the seams that use an instance. Name-based resolution is one of those
+ * seams: statement generation and driver column-type lookups resolve the REGISTRY's
+ * instance through here, which must carry the same derived columns as the instance the
+ * caller handed the Db. Idempotent (marker-checked); a call-time require keeps the module
+ * graph acyclic at load time.
+ */
+var ensureEncryptionSchema = function (table) {
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    var EncryptedColumns = require('./encryption/EncryptedColumns').EncryptedColumns;
+    new EncryptedColumns().ensureSchema(table);
+    return table;
+};
 var getColumnPropertyName = function (table, columnName) {
     for (var columnPropertyName in table.columns) {
         var column = table.columns[columnPropertyName];

package/dist/src/Table.js.map

@@ -1 +1 @@
-{"version":3,"file":"Table.js","sourceRoot":"","sources":["../../src/Table.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAmE;AAEnE,mCAAkD;AAClD,iEAAkE;AAK3D,IAAM,OAAO,GAAG,UAAC,GAAQ,IAAK,OAAA,GAAG,CAAC,cAAc,KAAK,mCAAiB,EAAxC,CAAwC,CAAC;AAAjE,QAAA,OAAO,WAA0D;AAEvE,IAAM,SAAS,GAAG,cAA8B,OAAA,6BAAgB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAW,qBAAqB,CAAC,EAA/D,CAA+D,CAAC;AAA1G,QAAA,SAAS,aAAiG;AAEhH,IAAM,WAAW,GAAG,UAAC,IAAY;IACtC,IAAM,MAAM,GAAG,IAAA,iBAAS,GAAE,CAAC;IAC3B,KAAoB,UAAM,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM,EAAE;QAAvB,IAAM,KAAK,eAAA;QACd,IAAI,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE;YACtB,OAAO,KAAK,CAAC;SACd;KACF;IAED,MAAM,IAAI,KAAK,CAAC,gCAAyB,IAAI,CAAE,CAAC,CAAC;AACnD,CAAC,CAAC;AATW,QAAA,WAAW,eAStB;AAEK,IAAM,qBAAqB,GAAG,UAAC,KAAiB,EAAE,UAAkB;IACzE,KAAK,IAAM,kBAAkB,IAAI,KAAK,CAAC,OAAO,EAAE;QAC9C,IAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,IAAI,IAAI,UAAU,EAAE;YAC7B,OAAO,kBAAkB,CAAC;SAC3B;KACF;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AATW,QAAA,qBAAqB,yBAShC;AAEK,IAAM,eAAe,GAAG,UAAC,KAAiB,EAAE,UAAkB;IACnE,KAAK,IAAM,kBAAkB,IAAI,KAAK,CAAC,OAAO,EAAE;QAC9C,IAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,IAAI,IAAI,UAAU,EAAE;YAC7B,OAAO,MAAM,CAAC;SACf;KACF;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AATW,QAAA,eAAe,mBAS1B;AAEK,IAAM,qBAAqB,GAAG,UAAO,KAAiB,EAAE,MAAW,EAAE,WAAoB;;;;;;gBAExF,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAC,CAAC,EAAE,CAAC,IAAK,OAAA,CAAC,CAAC,IAAA,uBAAc,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAA,uBAAc,EAAC,CAAC,CAAC,EAAzC,CAAyC,CAAC,CAAC;sBAE7D,EAAP,mBAAO;;;qBAAP,CAAA,qBAAO,CAAA;gBAA7B,kBAAkB;gBACrB,MAAM,GAAI,KAAK,CAAC,OAAe,CAAC,kBAAkB,CAAqB,CAAC;qBAE5E,CAAA,CAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,YAAY;oBAC5B,CAAC,OAAO,MAAM,CAAC,kBAAkB,CAAC,KAAK,WAAW;wBAChD,CAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,iBAAiB,MAAK,IAAI;wBAC1C,CAAC,OAAO,CAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,iBAAiB,CAAA,KAAK,UAAU,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA,EAH7G,wBAG6G;gBAE7G,KAAA,MAAM,CAAA;gBAAC,KAAA,kBAAkB,CAAA;gBAAI,qBAAM,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,EAAA;;gBAA7E,MAA0B,GAAG,SAAgD,CAAC;;;gBARjD,IAAO,CAAA;;;;;KAWzC,CAAC;AAfW,QAAA,qBAAqB,yBAehC;AAEK,IAAM,oBAAoB,GAAG,UAAO,KAAiB,EAAE,MAAW;;;;;;qBACtC,KAAK,CAAC,OAAO;;;;;;;;;;;gBACtC,MAAM,GAAI,KAAK,CAAC,OAAe,CAAC,kBAAkB,CAAqB,CAAC;qBAC1E,CAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,WAAW,CAAA,EAA3B,wBAA2B;gBACf,qBAAM,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,EAAA;;gBAAvD,KAAK,GAAG,SAA+C;gBAC7D,IAAI,KAAK,KAAK,SAAS,EAAE;oBACvB,MAAM,CAAC,kBAAkB,CAAC,GAAG,KAAK,CAAC;iBACpC;;;;;;;;KAGN,CAAC;AAVW,QAAA,oBAAoB,wBAU/B;AAEF;;GAEG;AACH;IAAA;QACS,mBAAc,GAAG,mCAAiB,CAAC;QAG1C;;;;WAIG;QACI,YAAO,GAAgE,EAAE,CAAC;QACjF,6FAA6F;QACtF,4BAAuB,GAAuD,cAAM,OAAA,EAAE,EAAF,CAAE,CAAC;QAC9F,8EAA8E;QACvE,wBAAmB,GAA2B,EAAE,CAAC;IAkB1D,CAAC;IAAD,YAAC;AAAD,CAAC,AA/BD,IA+BC;AA/BqB,sBAAK"}
+{"version":3,"file":"Table.js","sourceRoot":"","sources":["../../src/Table.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAmE;AAEnE,mCAAkD;AAClD,iEAAkE;AAIlE,8FAA6F;AAEtF,IAAM,OAAO,GAAG,UAAC,GAAQ,IAAK,OAAA,GAAG,CAAC,cAAc,KAAK,mCAAiB,EAAxC,CAAwC,CAAC;AAAjE,QAAA,OAAO,WAA0D;AAEvE,IAAM,SAAS,GAAG,cAA8B,OAAA,6BAAgB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAW,qBAAqB,CAAC,EAA/D,CAA+D,CAAC;AAA1G,QAAA,SAAS,aAAiG;AAEhH,IAAM,WAAW,GAAG,UAAC,IAAY;IACtC,IAAM,MAAM,GAAG,IAAA,iBAAS,GAAE,CAAC;IAC3B,KAAoB,UAAM,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM,EAAE;QAAvB,IAAM,KAAK,eAAA;QACd,IAAI,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE;YACtB,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;SACtC;KACF;IAED,0FAA0F;IAC1F,sFAAsF;IACtF,2FAA2F;IAC3F,IAAM,YAAY,GAAG,+DAA8B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,YAAY,EAAE;QAChB,OAAO,YAAY,CAAC;KACrB;IAED,MAAM,IAAI,KAAK,CAAC,gCAAyB,IAAI,CAAE,CAAC,CAAC;AACnD,CAAC,CAAC;AAjBW,QAAA,WAAW,eAiBtB;AAEF;;;;;;;;GAQG;AACH,IAAM,sBAAsB,GAAG,UAAC,KAAiB;IAC/C,8DAA8D;IACtD,IAAA,gBAAgB,GACtB,OAAO,CAAC,+BAA+B,CAAmD,iBADpE,CACqE;IAC7F,IAAI,gBAAgB,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEK,IAAM,qBAAqB,GAAG,UAAC,KAAiB,EAAE,UAAkB;IACzE,KAAK,IAAM,kBAAkB,IAAI,KAAK,CAAC,OAAO,EAAE;QAC9C,IAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,IAAI,IAAI,UAAU,EAAE;YAC7B,OAAO,kBAAkB,CAAC;SAC3B;KACF;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AATW,QAAA,qBAAqB,yBAShC;AAEK,IAAM,eAAe,GAAG,UAAC,KAAiB,EAAE,UAAkB;IACnE,KAAK,IAAM,kBAAkB,IAAI,KAAK,CAAC,OAAO,EAAE;QAC9C,IAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,IAAI,IAAI,UAAU,EAAE;YAC7B,OAAO,MAAM,CAAC;SACf;KACF;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AATW,QAAA,eAAe,mBAS1B;AAEK,IAAM,qBAAqB,GAAG,UAAO,KAAiB,EAAE,MAAW,EAAE,WAAoB;;;;;;gBAExF,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAC,CAAC,EAAE,CAAC,IAAK,OAAA,CAAC,CAAC,IAAA,uBAAc,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAA,uBAAc,EAAC,CAAC,CAAC,EAAzC,CAAyC,CAAC,CAAC;sBAE7D,EAAP,mBAAO;;;qBAAP,CAAA,qBAAO,CAAA;gBAA7B,kBAAkB;gBACrB,MAAM,GAAI,KAAK,CAAC,OAAe,CAAC,kBAAkB,CAAqB,CAAC;qBAE5E,CAAA,CAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,YAAY;oBAC5B,CAAC,OAAO,MAAM,CAAC,kBAAkB,CAAC,KAAK,WAAW;wBAChD,CAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,iBAAiB,MAAK,IAAI;wBAC1C,CAAC,OAAO,CAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,iBAAiB,CAAA,KAAK,UAAU,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA,EAH7G,wBAG6G;gBAE7G,KAAA,MAAM,CAAA;gBAAC,KAAA,kBAAkB,CAAA;gBAAI,qBAAM,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,EAAA;;gBAA7E,MAA0B,GAAG,SAAgD,CAAC;;;gBARjD,IAAO,CAAA;;;;;KAWzC,CAAC;AAfW,QAAA,qBAAqB,yBAehC;AAEK,IAAM,oBAAoB,GAAG,UAAO,KAAiB,EAAE,MAAW;;;;;;qBACtC,KAAK,CAAC,OAAO;;;;;;;;;;;gBACtC,MAAM,GAAI,KAAK,CAAC,OAAe,CAAC,kBAAkB,CAAqB,CAAC;qBAC1E,CAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,WAAW,CAAA,EAA3B,wBAA2B;gBACf,qBAAM,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,EAAA;;gBAAvD,KAAK,GAAG,SAA+C;gBAC7D,IAAI,KAAK,KAAK,SAAS,EAAE;oBACvB,MAAM,CAAC,kBAAkB,CAAC,GAAG,KAAK,CAAC;iBACpC;;;;;;;;KAGN,CAAC;AAVW,QAAA,oBAAoB,wBAU/B;AAEF;;GAEG;AACH;IAAA;QACS,mBAAc,GAAG,mCAAiB,CAAC;QAG1C;;;;WAIG;QACI,YAAO,GAAgE,EAAE,CAAC;QACjF,6FAA6F;QACtF,4BAAuB,GAAuD,cAAM,OAAA,EAAE,EAAF,CAAE,CAAC;QAC9F,8EAA8E;QACvE,wBAAmB,GAA2B,EAAE,CAAC;IAkB1D,CAAC;IAAD,YAAC;AAAD,CAAC,AA/BD,IA+BC;AA/BqB,sBAAK"}

package/dist/src/TableQueryTransformProvider.d.ts

@@ -0,0 +1,17 @@
+import { ColumnQueryTransform, ColumnQueryTransformProvider } from '@proteinjs/db-query';
+import { ColumnQueryRuntime, Table } from './Table';
+/**
+ * The Table-model side of db-query's column query-transform seam: resolves a
+ * (tableName, columnProperty) pair to the column's own `Column.queryTransform`, built with
+ * the current operation's `ColumnQueryRuntime`. `Db.addColumnQueries` hands one of these
+ * to `QueryBuilder.applyColumnTransforms` on every query, so a column's query contract is
+ * consulted wherever the column is used — including inside subquery values on other
+ * tables, resolved through the same table registry the statement layer uses.
+ */
+export declare class TableQueryTransformProvider implements ColumnQueryTransformProvider {
+    private getTable;
+    private runtime;
+    constructor(getTable: (tableName: string) => Table<any>, runtime: ColumnQueryRuntime);
+    getTransform(tableName: string, columnPropertyName: string): ColumnQueryTransform | undefined;
+}
+//# sourceMappingURL=TableQueryTransformProvider.d.ts.map

package/dist/src/TableQueryTransformProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TableQueryTransformProvider.d.ts","sourceRoot":"","sources":["../../src/TableQueryTransformProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACzF,OAAO,EAAU,kBAAkB,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAE5D;;;;;;;GAOG;AACH,qBAAa,2BAA4B,YAAW,4BAA4B;IAE5E,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,OAAO;gBADP,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,KAAK,CAAC,GAAG,CAAC,EAC3C,OAAO,EAAE,kBAAkB;IAGrC,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS;CAa9F"}

package/dist/src/TableQueryTransformProvider.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TableQueryTransformProvider = void 0;
+/**
+ * The Table-model side of db-query's column query-transform seam: resolves a
+ * (tableName, columnProperty) pair to the column's own `Column.queryTransform`, built with
+ * the current operation's `ColumnQueryRuntime`. `Db.addColumnQueries` hands one of these
+ * to `QueryBuilder.applyColumnTransforms` on every query, so a column's query contract is
+ * consulted wherever the column is used — including inside subquery values on other
+ * tables, resolved through the same table registry the statement layer uses.
+ */
+var TableQueryTransformProvider = /** @class */ (function () {
+    function TableQueryTransformProvider(getTable, runtime) {
+        this.getTable = getTable;
+        this.runtime = runtime;
+    }
+    TableQueryTransformProvider.prototype.getTransform = function (tableName, columnPropertyName) {
+        var _a;
+        var table;
+        try {
+            table = this.getTable(tableName);
+        }
+        catch (_b) {
+            // Not a registered table (e.g. an aggregate '*' field, or a name outside the model) —
+            // nothing to consult.
+            return undefined;
+        }
+        var column = table.columns[columnPropertyName];
+        return (_a = column === null || column === void 0 ? void 0 : column.queryTransform) === null || _a === void 0 ? void 0 : _a.call(column, this.runtime);
+    };
+    return TableQueryTransformProvider;
+}());
+exports.TableQueryTransformProvider = TableQueryTransformProvider;
+//# sourceMappingURL=TableQueryTransformProvider.js.map

package/dist/src/TableQueryTransformProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TableQueryTransformProvider.js","sourceRoot":"","sources":["../../src/TableQueryTransformProvider.ts"],"names":[],"mappings":";;;AAGA;;;;;;;GAOG;AACH;IACE,qCACU,QAA2C,EAC3C,OAA2B;QAD3B,aAAQ,GAAR,QAAQ,CAAmC;QAC3C,YAAO,GAAP,OAAO,CAAoB;IAClC,CAAC;IAEJ,kDAAY,GAAZ,UAAa,SAAiB,EAAE,kBAA0B;;QACxD,IAAI,KAAiB,CAAC;QACtB,IAAI;YACF,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;SAClC;QAAC,WAAM;YACN,sFAAsF;YACtF,sBAAsB;YACtB,OAAO,SAAS,CAAC;SAClB;QAED,IAAM,MAAM,GAAI,KAAK,CAAC,OAAe,CAAC,kBAAkB,CAAiC,CAAC;QAC1F,OAAO,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,cAAc,uDAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;IACH,kCAAC;AAAD,CAAC,AAnBD,IAmBC;AAnBY,kEAA2B"}

package/dist/src/encryption/Base64Url.d.ts

@@ -0,0 +1,12 @@
+/// <reference types="node" />
+/// <reference types="node" />
+/**
+ * Base64url (RFC 4648 §5) over Buffers, hand-rolled because the package's @types/node
+ * predates the 'base64url' BufferEncoding. URL/filename-safe alphabet, no padding — safe
+ * inside the colon-delimited ciphertext envelope and as index-column values.
+ */
+export declare class Base64Url {
+    static encode(bytes: Buffer): string;
+    static decode(encoded: string): Buffer;
+}
+//# sourceMappingURL=Base64Url.d.ts.map

package/dist/src/encryption/Base64Url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Base64Url.d.ts","sourceRoot":"","sources":["../../../src/encryption/Base64Url.ts"],"names":[],"mappings":";;AAAA;;;;GAIG;AACH,qBAAa,SAAS;IACpB,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAIpC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;CAGvC"}

package/dist/src/encryption/Base64Url.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Base64Url = void 0;
+/**
+ * Base64url (RFC 4648 §5) over Buffers, hand-rolled because the package's @types/node
+ * predates the 'base64url' BufferEncoding. URL/filename-safe alphabet, no padding — safe
+ * inside the colon-delimited ciphertext envelope and as index-column values.
+ */
+var Base64Url = /** @class */ (function () {
+    function Base64Url() {
+    }
+    Base64Url.encode = function (bytes) {
+        return bytes.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+    };
+    Base64Url.decode = function (encoded) {
+        return Buffer.from(encoded.replace(/-/g, '+').replace(/_/g, '/'), 'base64');
+    };
+    return Base64Url;
+}());
+exports.Base64Url = Base64Url;
+//# sourceMappingURL=Base64Url.js.map

package/dist/src/encryption/Base64Url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Base64Url.js","sourceRoot":"","sources":["../../../src/encryption/Base64Url.ts"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH;IAAA;IAQA,CAAC;IAPQ,gBAAM,GAAb,UAAc,KAAa;QACzB,OAAO,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9F,CAAC;IAEM,gBAAM,GAAb,UAAc,OAAe;QAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC9E,CAAC;IACH,gBAAC;AAAD,CAAC,AARD,IAQC;AARY,8BAAS"}

package/dist/src/encryption/DataEncryptionKeyTable.d.ts

@@ -0,0 +1,33 @@
+import { Table } from '../Table';
+import { Record } from '../Record';
+/**
+ * One wrapped per-owner data key version (see `DataKeyStore`).
+ *
+ * - `active` — encrypts new writes (the highest active version) and fingerprints queries.
+ * - `retired` — decrypt-only: envelopes referencing it still unwrap, but no new writes or
+ *   query fingerprints use it. A rotation walk moves every row off a version, then retires it.
+ *
+ * Crypto-shred = deleting an owner's rows here: every envelope naming that owner becomes
+ * permanently unreadable, including inside backups.
+ */
+export interface DataEncryptionKey extends Record {
+    /** The key owner (a user id — the row's permission-source scope owner). */
+    owner: string;
+    /** Monotonic per-owner version; envelopes name (owner, version). */
+    version: number;
+    /** The data-key material, wrapped by the master key (`MasterKeyProvider`). */
+    wrappedKey: string;
+    status: 'active' | 'retired';
+}
+export declare class DataEncryptionKeyTable extends Table<DataEncryptionKey> {
+    name: string;
+    columns: Table<DataEncryptionKey>['columns'];
+    /** (owner, version) is the identity an envelope names — the race loser on concurrent
+     *  first-write key creation fails here and re-reads the winner's key. */
+    indexes: {
+        columns: (keyof DataEncryptionKey)[];
+        name?: string;
+        unique?: boolean;
+    }[];
+}
+//# sourceMappingURL=DataEncryptionKeyTable.d.ts.map

package/dist/src/encryption/DataEncryptionKeyTable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DataEncryptionKeyTable.d.ts","sourceRoot":"","sources":["../../../src/encryption/DataEncryptionKeyTable.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AACjC,OAAO,EAAE,MAAM,EAAqB,MAAM,WAAW,CAAC;AAGtD;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAkB,SAAQ,MAAM;IAC/C,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9B;AAED,qBAAa,sBAAuB,SAAQ,KAAK,CAAC,iBAAiB,CAAC;IAC3D,IAAI,SAAyB;IAC7B,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC,SAAS,CAAC,CAKhD;IACH;6EACyE;IAClE,OAAO,EAAE;QAAE,OAAO,EAAE,CAAC,MAAM,iBAAiB,CAAC,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAEzF;CAGH"}

package/dist/src/encryption/DataEncryptionKeyTable.js

@@ -0,0 +1,45 @@
+"use strict";
+var __extends = (this && this.__extends) || (function () {
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (Object.prototype.hasOwnProperty.call(b, p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
+    return function (d, b) {
+        if (typeof b !== "function" && b !== null)
+            throw new TypeError("Class extends value " + String(b) + " is not a constructor or null");
+        extendStatics(d, b);
+        function __() { this.constructor = d; }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DataEncryptionKeyTable = void 0;
+var Table_1 = require("../Table");
+var Record_1 = require("../Record");
+var Columns_1 = require("../Columns");
+var DataEncryptionKeyTable = /** @class */ (function (_super) {
+    __extends(DataEncryptionKeyTable, _super);
+    function DataEncryptionKeyTable() {
+        var _this = _super !== null && _super.apply(this, arguments) || this;
+        _this.name = 'data_encryption_key';
+        _this.columns = (0, Record_1.withRecordColumns)({
+            owner: new Columns_1.StringColumn('owner', { nullable: false }, 36),
+            version: new Columns_1.IntegerColumn('version', { nullable: false }),
+            wrappedKey: new Columns_1.StringColumn('wrapped_key', { nullable: false }, 'MAX'),
+            status: new Columns_1.StringColumn('status', { nullable: false }, 16),
+        });
+        /** (owner, version) is the identity an envelope names — the race loser on concurrent
+         *  first-write key creation fails here and re-reads the winner's key. */
+        _this.indexes = [
+            { columns: ['owner', 'version'], name: 'data_encryption_key_owner_version_unique', unique: true },
+        ];
+        return _this;
+        // No auth block: default-deny for every non-system caller. Key rows are framework
+        // machinery, only ever touched through system paths (DataKeyStore).
+    }
+    return DataEncryptionKeyTable;
+}(Table_1.Table));
+exports.DataEncryptionKeyTable = DataEncryptionKeyTable;
+//# sourceMappingURL=DataEncryptionKeyTable.js.map

package/dist/src/encryption/DataEncryptionKeyTable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DataEncryptionKeyTable.js","sourceRoot":"","sources":["../../../src/encryption/DataEncryptionKeyTable.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,kCAAiC;AACjC,oCAAsD;AACtD,sCAAyD;AAsBzD;IAA4C,0CAAwB;IAApE;QAAA,qEAeC;QAdQ,UAAI,GAAG,qBAAqB,CAAC;QAC7B,aAAO,GAAwC,IAAA,0BAAiB,EAAoB;YACzF,KAAK,EAAE,IAAI,sBAAY,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YACzD,OAAO,EAAE,IAAI,uBAAa,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YAC1D,UAAU,EAAE,IAAI,sBAAY,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,CAAC;YACvE,MAAM,EAAE,IAAI,sBAAY,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;SAC5D,CAAC,CAAC;QACH;iFACyE;QAClE,aAAO,GAAgF;YAC5F,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,0CAA0C,EAAE,MAAM,EAAE,IAAI,EAAE;SAClG,CAAC;;QACF,kFAAkF;QAClF,oEAAoE;IACtE,CAAC;IAAD,6BAAC;AAAD,CAAC,AAfD,CAA4C,aAAK,GAehD;AAfY,wDAAsB"}

package/dist/src/encryption/DataKeyStore.d.ts

@@ -0,0 +1,84 @@
+/// <reference types="node" />
+/// <reference types="node" />
+/**
+ * Decrypt was asked for a key that does not exist — most often because the owner's keys were
+ * crypto-shredded (account deletion): the ciphertext is permanently unreadable, by design.
+ */
+export declare class EncryptionKeyUnavailableError extends Error {
+    constructor(owner: string, version: number);
+}
+/** Unwrapped material of one data-key version. */
+export interface DataKeyMaterial {
+    owner: string;
+    version: number;
+    /** AES-256 key for row values (first half of the 64-byte material). */
+    cipherKey: Buffer;
+    /** HMAC key for search-token fingerprints (second half). */
+    indexKey: Buffer;
+}
+/**
+ * Per-owner data keys for column encryption: creation, unwrap-once caching, rotation,
+ * retirement, and crypto-shred. Key rows live in `DataEncryptionKeyTable`, wrapped by the
+ * deployment's `MasterKeyProvider`; the vault is called once per key (then cached), never
+ * per row.
+ *
+ * All database access runs as system, OUTSIDE any ambient transaction: a key row must be
+ * durable independent of the caller's transaction outcome, because unwrapped material is
+ * cached in-process the moment it exists — a key created inside a transaction that later
+ * rolls back would leave the cache claiming a key the database lost. An orphaned key row
+ * from a rolled-back first write is harmless (a key no envelope names).
+ *
+ * The caches live on the global object (the per-package-install duplicate-module pattern —
+ * see `Db.getDefaultDbDriver`), so every live copy of this package shares one cache.
+ */
+export declare class DataKeyStore {
+    /** Unwrapped material cache TTL — bounds how long a shredded key can linger in a warm process. */
+    private static readonly MATERIAL_TTL_MS;
+    /** Owner key-row list TTL — bounds cross-process staleness of the active-version set. */
+    private static readonly OWNER_ROWS_TTL_MS;
+    private static readonly CACHES_GLOBAL_KEY;
+    private static readonly KEY_MATERIAL_BYTES;
+    private logger;
+    private table;
+    /**
+     * The key that encrypts new writes for `owner`: the highest active version, created on
+     * first use (each owner gets a randomly generated data key, wrapped by the master key).
+     */
+    getWriteKey(owner: string): Promise<DataKeyMaterial>;
+    /** The key an envelope names — any status; decrypt must work until the key is shredded. */
+    getKeyByVersion(owner: string, version: number): Promise<DataKeyMaterial>;
+    /**
+     * The index keys a query fingerprints with: every ACTIVE version of every accessible
+     * owner (normally one per owner; two during a rotation window). Owners with no keys yet
+     * contribute nothing — they cannot have encrypted rows.
+     */
+    getQueryIndexKeys(owners: string[]): Promise<DataKeyMaterial[]>;
+    /**
+     * Mint the next key version for `owner` (new writes use it immediately; the old version
+     * stays active — still fingerprinting queries — until a rotation walk
+     * (`EncryptionLifecycleWalker` mode 'rotate-keys') has rewritten every row, after which
+     * the caller retires it via `retireKeyVersion`).
+     * @returns the new version number
+     */
+    rotateKey(owner: string): Promise<number>;
+    /** Retire a version: envelopes naming it still decrypt; queries and writes stop using it. */
+    retireKeyVersion(owner: string, version: number): Promise<void>;
+    /**
+     * Crypto-shred: delete every key version of `owner` and evict the caches. Every envelope
+     * naming the owner — in live rows and in every backup — becomes permanently unreadable.
+     */
+    shredOwnerKeys(owner: string): Promise<number>;
+    private createKeyVersion;
+    private getOwnerRows;
+    private unwrap;
+    private highestActive;
+    private requireOwner;
+    /**
+     * A system Db pinned OUTSIDE any ambient transaction (see class doc). Imported lazily —
+     * this module is reachable from the serializer layer, below `Db` in the module graph.
+     */
+    private systemDb;
+    private caches;
+    private evictOwner;
+}
+//# sourceMappingURL=DataKeyStore.d.ts.map

package/dist/src/encryption/DataKeyStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DataKeyStore.d.ts","sourceRoot":"","sources":["../../../src/encryption/DataKeyStore.ts"],"names":[],"mappings":";;AAKA;;;GAGG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAQ3C;AAED,kDAAkD;AAClD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAiBD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,YAAY;IACvB,kGAAkG;IAClG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAkB;IACzD,yFAAyF;IACzF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAa;IACtD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAkC;IAC3E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAM;IAChD,OAAO,CAAC,MAAM,CAA+C;IAC7D,OAAO,CAAC,KAAK,CAAgC;IAE7C;;;OAGG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAiB1D,2FAA2F;IACrF,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAkB/E;;;;OAIG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAcrE;;;;;;OAMG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAU/C,6FAA6F;IACvF,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAarE;;;OAGG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAetC,gBAAgB;YAsBhB,YAAY;YAsBZ,MAAM;IA2BpB,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,YAAY;IAMpB;;;OAGG;YACW,QAAQ;IAuBtB,OAAO,CAAC,MAAM;IAYd,OAAO,CAAC,UAAU;CAGnB"}