IntegrationsPrisma ORMAPI reference

runtime

runtime is a module in @cipherstash/stack-prisma. TypeScript API reference with its signature, parameters, and usage.

@cipherstash/stack-prisma

runtime

Classes

EncryptedBigInt

Defined in: ../execution/envelope-bigint.ts:27

Extends

EncryptedEnvelopeBase<bigint>

Methods

applyDecryptedSdkResult()

static applyDecryptedSdkResult&lt;U&gt;(envelope, sdkResult): U;

Defined in: ../execution/envelope-base.ts:153

Apply an SDK bulk-decrypt result to an envelope: narrow the polymorphic SDK return through the subclass's EncryptedEnvelopeBase.parseDecryptedValue hook and cache the narrowed plaintext on the handle. Returns the narrowed plaintext for callers that want to observe it.

Lives as a static member rather than a free function in this module so it stays inside the class's lexical scope — TS's class-bounded-friend convention permits a static method to call a protected instance method on the same class, which is what lets parseDecryptedValue stay protected while still being reachable from ../decrypt-all.ts decryptAll.

Mirrors the conventional setHandle* mutator shape used elsewhere in this module — call sites stay symmetric across the encrypt path (setHandleCiphertext) and the decrypt path (EncryptedEnvelopeBase.applyDecryptedSdkResult).

Type Parameters

U

U

Parameters

envelope

EncryptedEnvelopeBase<U>

sdkResult

unknown

Returns

U

Inherited from

EncryptedEnvelopeBase.applyDecryptedSdkResult

expose()

expose(): EncryptedEnvelopeHandle&lt;bigint&gt;;

Defined in: ../execution/envelope-base.ts:174

Explicitly retrieve the wrapped handle. Modelled on Rust secrecy's SecretBox<T>::expose_secret: the handle is reachable, but you have to ask for it by name. Callers reach for expose() when they need to inspect or transport the ciphertext envelope, debug lifecycle state, or wire ad-hoc tooling around the SDK reference.

Mutating the returned handle is supported but unusual — the package's lifecycle mutators (setHandleCiphertext, setHandleRoutingKey, etc.) are the conventional path during encrypt / decrypt flow.

Returns

EncryptedEnvelopeHandle<bigint>

Inherited from

EncryptedEnvelopeBase.expose

decrypt()

decrypt(opts?): Promise&lt;bigint&gt;;

Defined in: ../execution/envelope-base.ts:195

Decrypt and return the plaintext.

If the handle's plaintext slot is already populated (write-side envelopes from from(plaintext), or read-side envelopes already materialized by decryptAll(...) or a prior decrypt()), returns the cached plaintext synchronously without consulting the SDK.
Otherwise (read-side handle without a cached plaintext), invokes the SDK's single-cell decrypt with the handle's routing context. The caller-supplied signal is forwarded to the SDK by identity per the umbrella cancellation contract; the SDK promise is also raced against the signal so an abort surfaces a RUNTIME.ABORTED { phase: 'decrypt' } envelope promptly even if the SDK body ignores the signal. The cached-plaintext fast path returns synchronously without consulting the signal — no IO, no abort observation point.

Parameters

opts?

signal?

AbortSignal

Returns

Promise<bigint>

Inherited from

EncryptedEnvelopeBase.decrypt

toJSON()

toJSON(): EncryptedEnvelopePlaceholder;

Defined in: ../execution/envelope-base.ts:225

Returns

EncryptedEnvelopePlaceholder

Inherited from

EncryptedEnvelopeBase.toJSON

toString()

toString(): string;

Defined in: ../execution/envelope-base.ts:229

Returns

string

Inherited from

EncryptedEnvelopeBase.toString

valueOf()

valueOf(): string;

Defined in: ../execution/envelope-base.ts:233

Returns

string

Inherited from

EncryptedEnvelopeBase.valueOf

[toPrimitive]()

toPrimitive: string;

Defined in: ../execution/envelope-base.ts:237

Returns

string

Inherited from

EncryptedEnvelopeBase.[toPrimitive]

from()

static from(plaintext): EncryptedBigInt;

Defined in: ../execution/envelope-bigint.ts:79

Construct a write-side envelope from a plaintext bigint. Bulk-encrypt middleware populates the handle's ciphertext slot before the codec encodes the envelope to wire format.

Parameters

plaintext

bigint

Returns

EncryptedBigInt

fromInternal()

static fromInternal(args): EncryptedBigInt;

Defined in: ../execution/envelope-bigint.ts:94

Construct a read-side envelope from a wire ciphertext + the column identity + the SDK used to decrypt the cell. Called from the codec decode body.

Parameters

args

EncryptedEnvelopeFromInternalArgs

Returns

EncryptedBigInt

EncryptedBoolean

Defined in: ../execution/envelope-boolean.ts:21

Extends

EncryptedEnvelopeBase<boolean>

Methods

applyDecryptedSdkResult()

static applyDecryptedSdkResult&lt;U&gt;(envelope, sdkResult): U;

Defined in: ../execution/envelope-base.ts:153

Apply an SDK bulk-decrypt result to an envelope: narrow the polymorphic SDK return through the subclass's EncryptedEnvelopeBase.parseDecryptedValue hook and cache the narrowed plaintext on the handle. Returns the narrowed plaintext for callers that want to observe it.

Lives as a static member rather than a free function in this module so it stays inside the class's lexical scope — TS's class-bounded-friend convention permits a static method to call a protected instance method on the same class, which is what lets parseDecryptedValue stay protected while still being reachable from ../decrypt-all.ts decryptAll.

Mirrors the conventional setHandle* mutator shape used elsewhere in this module — call sites stay symmetric across the encrypt path (setHandleCiphertext) and the decrypt path (EncryptedEnvelopeBase.applyDecryptedSdkResult).

Type Parameters

U

U

Parameters

envelope

EncryptedEnvelopeBase<U>

sdkResult

unknown

Returns

U

Inherited from

EncryptedEnvelopeBase.applyDecryptedSdkResult

expose()

expose(): EncryptedEnvelopeHandle&lt;boolean&gt;;

Defined in: ../execution/envelope-base.ts:174

Explicitly retrieve the wrapped handle. Modelled on Rust secrecy's SecretBox<T>::expose_secret: the handle is reachable, but you have to ask for it by name. Callers reach for expose() when they need to inspect or transport the ciphertext envelope, debug lifecycle state, or wire ad-hoc tooling around the SDK reference.

Mutating the returned handle is supported but unusual — the package's lifecycle mutators (setHandleCiphertext, setHandleRoutingKey, etc.) are the conventional path during encrypt / decrypt flow.

Returns

EncryptedEnvelopeHandle<boolean>

Inherited from

EncryptedEnvelopeBase.expose

decrypt()

decrypt(opts?): Promise&lt;boolean&gt;;

Defined in: ../execution/envelope-base.ts:195

Decrypt and return the plaintext.

If the handle's plaintext slot is already populated (write-side envelopes from from(plaintext), or read-side envelopes already materialized by decryptAll(...) or a prior decrypt()), returns the cached plaintext synchronously without consulting the SDK.
Otherwise (read-side handle without a cached plaintext), invokes the SDK's single-cell decrypt with the handle's routing context. The caller-supplied signal is forwarded to the SDK by identity per the umbrella cancellation contract; the SDK promise is also raced against the signal so an abort surfaces a RUNTIME.ABORTED { phase: 'decrypt' } envelope promptly even if the SDK body ignores the signal. The cached-plaintext fast path returns synchronously without consulting the signal — no IO, no abort observation point.

Parameters

opts?

signal?

AbortSignal

Returns

Promise<boolean>

Inherited from

EncryptedEnvelopeBase.decrypt

toJSON()

toJSON(): EncryptedEnvelopePlaceholder;

Defined in: ../execution/envelope-base.ts:225

Returns

EncryptedEnvelopePlaceholder

Inherited from

EncryptedEnvelopeBase.toJSON

toString()

toString(): string;

Defined in: ../execution/envelope-base.ts:229

Returns

string

Inherited from

EncryptedEnvelopeBase.toString

valueOf()

valueOf(): string;

Defined in: ../execution/envelope-base.ts:233

Returns

string

Inherited from

EncryptedEnvelopeBase.valueOf

[toPrimitive]()

toPrimitive: string;

Defined in: ../execution/envelope-base.ts:237

Returns

string

Inherited from

EncryptedEnvelopeBase.[toPrimitive]

from()

static from(plaintext): EncryptedBoolean;

Defined in: ../execution/envelope-boolean.ts:26

Parameters

plaintext

boolean

Returns

EncryptedBoolean

fromInternal()

static fromInternal(args): EncryptedBoolean;

Defined in: ../execution/envelope-boolean.ts:36

Parameters

args

EncryptedEnvelopeFromInternalArgs

Returns

EncryptedBoolean

EncryptedDate

Defined in: ../execution/envelope-date.ts:33

Extends

EncryptedEnvelopeBase<Date>

Methods

applyDecryptedSdkResult()

static applyDecryptedSdkResult&lt;U&gt;(envelope, sdkResult): U;

Defined in: ../execution/envelope-base.ts:153

Apply an SDK bulk-decrypt result to an envelope: narrow the polymorphic SDK return through the subclass's EncryptedEnvelopeBase.parseDecryptedValue hook and cache the narrowed plaintext on the handle. Returns the narrowed plaintext for callers that want to observe it.

Lives as a static member rather than a free function in this module so it stays inside the class's lexical scope — TS's class-bounded-friend convention permits a static method to call a protected instance method on the same class, which is what lets parseDecryptedValue stay protected while still being reachable from ../decrypt-all.ts decryptAll.

Mirrors the conventional setHandle* mutator shape used elsewhere in this module — call sites stay symmetric across the encrypt path (setHandleCiphertext) and the decrypt path (EncryptedEnvelopeBase.applyDecryptedSdkResult).

Type Parameters

U

U

Parameters

envelope

EncryptedEnvelopeBase<U>

sdkResult

unknown

Returns

U

Inherited from

EncryptedEnvelopeBase.applyDecryptedSdkResult

expose()

expose(): EncryptedEnvelopeHandle&lt;Date&gt;;

Defined in: ../execution/envelope-base.ts:174

Explicitly retrieve the wrapped handle. Modelled on Rust secrecy's SecretBox<T>::expose_secret: the handle is reachable, but you have to ask for it by name. Callers reach for expose() when they need to inspect or transport the ciphertext envelope, debug lifecycle state, or wire ad-hoc tooling around the SDK reference.

Mutating the returned handle is supported but unusual — the package's lifecycle mutators (setHandleCiphertext, setHandleRoutingKey, etc.) are the conventional path during encrypt / decrypt flow.

Returns

EncryptedEnvelopeHandle<Date>

Inherited from

EncryptedEnvelopeBase.expose

decrypt()

decrypt(opts?): Promise&lt;Date&gt;;

Defined in: ../execution/envelope-base.ts:195

Decrypt and return the plaintext.

If the handle's plaintext slot is already populated (write-side envelopes from from(plaintext), or read-side envelopes already materialized by decryptAll(...) or a prior decrypt()), returns the cached plaintext synchronously without consulting the SDK.
Otherwise (read-side handle without a cached plaintext), invokes the SDK's single-cell decrypt with the handle's routing context. The caller-supplied signal is forwarded to the SDK by identity per the umbrella cancellation contract; the SDK promise is also raced against the signal so an abort surfaces a RUNTIME.ABORTED { phase: 'decrypt' } envelope promptly even if the SDK body ignores the signal. The cached-plaintext fast path returns synchronously without consulting the signal — no IO, no abort observation point.

Parameters

opts?

signal?

AbortSignal

Returns

Promise<Date>

Inherited from

EncryptedEnvelopeBase.decrypt

toJSON()

toJSON(): EncryptedEnvelopePlaceholder;

Defined in: ../execution/envelope-base.ts:225

Returns

EncryptedEnvelopePlaceholder

Inherited from

EncryptedEnvelopeBase.toJSON

toString()

toString(): string;

Defined in: ../execution/envelope-base.ts:229

Returns

string

Inherited from

EncryptedEnvelopeBase.toString

valueOf()

valueOf(): string;

Defined in: ../execution/envelope-base.ts:233

Returns

string

Inherited from

EncryptedEnvelopeBase.valueOf

[toPrimitive]()

toPrimitive: string;

Defined in: ../execution/envelope-base.ts:237

Returns

string

Inherited from

EncryptedEnvelopeBase.[toPrimitive]

from()

static from(plaintext): EncryptedDate;

Defined in: ../execution/envelope-date.ts:79

Construct a write-side envelope from a Date plaintext. Bulk-encrypt middleware populates the handle's ciphertext slot before the codec encodes the envelope to wire format.

Parameters

plaintext

Date

Returns

EncryptedDate

fromInternal()

static fromInternal(args): EncryptedDate;

Defined in: ../execution/envelope-date.ts:99

Construct a read-side envelope from a wire ciphertext + the column identity + the SDK used to decrypt the cell. Called from the codec decode body.

Parameters

args

EncryptedEnvelopeFromInternalArgs

Returns

EncryptedDate

EncryptedJson

Defined in: ../execution/envelope-json.ts:29

Extends

EncryptedEnvelopeBase<unknown>

Methods

applyDecryptedSdkResult()

static applyDecryptedSdkResult&lt;U&gt;(envelope, sdkResult): U;

Defined in: ../execution/envelope-base.ts:153

Apply an SDK bulk-decrypt result to an envelope: narrow the polymorphic SDK return through the subclass's EncryptedEnvelopeBase.parseDecryptedValue hook and cache the narrowed plaintext on the handle. Returns the narrowed plaintext for callers that want to observe it.

Lives as a static member rather than a free function in this module so it stays inside the class's lexical scope — TS's class-bounded-friend convention permits a static method to call a protected instance method on the same class, which is what lets parseDecryptedValue stay protected while still being reachable from ../decrypt-all.ts decryptAll.

Mirrors the conventional setHandle* mutator shape used elsewhere in this module — call sites stay symmetric across the encrypt path (setHandleCiphertext) and the decrypt path (EncryptedEnvelopeBase.applyDecryptedSdkResult).

Type Parameters

U

U

Parameters

envelope

EncryptedEnvelopeBase<U>

sdkResult

unknown

Returns

U

Inherited from

EncryptedEnvelopeBase.applyDecryptedSdkResult

expose()

expose(): EncryptedEnvelopeHandle&lt;unknown&gt;;

Defined in: ../execution/envelope-base.ts:174

Explicitly retrieve the wrapped handle. Modelled on Rust secrecy's SecretBox<T>::expose_secret: the handle is reachable, but you have to ask for it by name. Callers reach for expose() when they need to inspect or transport the ciphertext envelope, debug lifecycle state, or wire ad-hoc tooling around the SDK reference.

Mutating the returned handle is supported but unusual — the package's lifecycle mutators (setHandleCiphertext, setHandleRoutingKey, etc.) are the conventional path during encrypt / decrypt flow.

Returns

EncryptedEnvelopeHandle<unknown>

Inherited from

EncryptedEnvelopeBase.expose

decrypt()

decrypt(opts?): Promise&lt;unknown&gt;;

Defined in: ../execution/envelope-base.ts:195

Decrypt and return the plaintext.

If the handle's plaintext slot is already populated (write-side envelopes from from(plaintext), or read-side envelopes already materialized by decryptAll(...) or a prior decrypt()), returns the cached plaintext synchronously without consulting the SDK.
Otherwise (read-side handle without a cached plaintext), invokes the SDK's single-cell decrypt with the handle's routing context. The caller-supplied signal is forwarded to the SDK by identity per the umbrella cancellation contract; the SDK promise is also raced against the signal so an abort surfaces a RUNTIME.ABORTED { phase: 'decrypt' } envelope promptly even if the SDK body ignores the signal. The cached-plaintext fast path returns synchronously without consulting the signal — no IO, no abort observation point.

Parameters

opts?

signal?

AbortSignal

Returns

Promise<unknown>

Inherited from

EncryptedEnvelopeBase.decrypt

toJSON()

toJSON(): EncryptedEnvelopePlaceholder;

Defined in: ../execution/envelope-base.ts:225

Returns

EncryptedEnvelopePlaceholder

Inherited from

EncryptedEnvelopeBase.toJSON

toString()

toString(): string;

Defined in: ../execution/envelope-base.ts:229

Returns

string

Inherited from

EncryptedEnvelopeBase.toString

valueOf()

valueOf(): string;

Defined in: ../execution/envelope-base.ts:233

Returns

string

Inherited from

EncryptedEnvelopeBase.valueOf

[toPrimitive]()

toPrimitive: string;

Defined in: ../execution/envelope-base.ts:237

Returns

string

Inherited from

EncryptedEnvelopeBase.[toPrimitive]

from()

static from(plaintext): EncryptedJson;

Defined in: ../execution/envelope-json.ts:34

Parameters

plaintext

unknown

Returns

EncryptedJson

fromInternal()

static fromInternal(args): EncryptedJson;

Defined in: ../execution/envelope-json.ts:44

Parameters

args

EncryptedEnvelopeFromInternalArgs

Returns

EncryptedJson

EncryptedString

Defined in: ../execution/envelope-string.ts:37

Extends

EncryptedEnvelopeBase<string>

Methods

applyDecryptedSdkResult()

static applyDecryptedSdkResult&lt;U&gt;(envelope, sdkResult): U;

Defined in: ../execution/envelope-base.ts:153

Apply an SDK bulk-decrypt result to an envelope: narrow the polymorphic SDK return through the subclass's EncryptedEnvelopeBase.parseDecryptedValue hook and cache the narrowed plaintext on the handle. Returns the narrowed plaintext for callers that want to observe it.

Lives as a static member rather than a free function in this module so it stays inside the class's lexical scope — TS's class-bounded-friend convention permits a static method to call a protected instance method on the same class, which is what lets parseDecryptedValue stay protected while still being reachable from ../decrypt-all.ts decryptAll.

Mirrors the conventional setHandle* mutator shape used elsewhere in this module — call sites stay symmetric across the encrypt path (setHandleCiphertext) and the decrypt path (EncryptedEnvelopeBase.applyDecryptedSdkResult).

Type Parameters

U

U

Parameters

envelope

EncryptedEnvelopeBase<U>

sdkResult

unknown

Returns

U

Inherited from

EncryptedEnvelopeBase.applyDecryptedSdkResult

expose()

expose(): EncryptedEnvelopeHandle&lt;string&gt;;

Defined in: ../execution/envelope-base.ts:174

Explicitly retrieve the wrapped handle. Modelled on Rust secrecy's SecretBox<T>::expose_secret: the handle is reachable, but you have to ask for it by name. Callers reach for expose() when they need to inspect or transport the ciphertext envelope, debug lifecycle state, or wire ad-hoc tooling around the SDK reference.

Mutating the returned handle is supported but unusual — the package's lifecycle mutators (setHandleCiphertext, setHandleRoutingKey, etc.) are the conventional path during encrypt / decrypt flow.

Returns

EncryptedEnvelopeHandle<string>

Inherited from

EncryptedEnvelopeBase.expose

decrypt()

decrypt(opts?): Promise&lt;string&gt;;

Defined in: ../execution/envelope-base.ts:195

Decrypt and return the plaintext.

If the handle's plaintext slot is already populated (write-side envelopes from from(plaintext), or read-side envelopes already materialized by decryptAll(...) or a prior decrypt()), returns the cached plaintext synchronously without consulting the SDK.
Otherwise (read-side handle without a cached plaintext), invokes the SDK's single-cell decrypt with the handle's routing context. The caller-supplied signal is forwarded to the SDK by identity per the umbrella cancellation contract; the SDK promise is also raced against the signal so an abort surfaces a RUNTIME.ABORTED { phase: 'decrypt' } envelope promptly even if the SDK body ignores the signal. The cached-plaintext fast path returns synchronously without consulting the signal — no IO, no abort observation point.

Parameters

opts?

signal?

AbortSignal

Returns

Promise<string>

Inherited from

EncryptedEnvelopeBase.decrypt

toJSON()

toJSON(): EncryptedEnvelopePlaceholder;

Defined in: ../execution/envelope-base.ts:225

Returns

EncryptedEnvelopePlaceholder

Inherited from

EncryptedEnvelopeBase.toJSON

toString()

toString(): string;

Defined in: ../execution/envelope-base.ts:229

Returns

string

Inherited from

EncryptedEnvelopeBase.toString

valueOf()

valueOf(): string;

Defined in: ../execution/envelope-base.ts:233

Returns

string

Inherited from

EncryptedEnvelopeBase.valueOf

[toPrimitive]()

toPrimitive: string;

Defined in: ../execution/envelope-base.ts:237

Returns

string

Inherited from

EncryptedEnvelopeBase.[toPrimitive]

from()

static from(plaintext): EncryptedString;

Defined in: ../execution/envelope-string.ts:47

Construct a write-side envelope from plaintext. Bulk-encrypt middleware populates the handle's ciphertext slot before the codec encodes the envelope to wire format.

Parameters

plaintext

string

Returns

EncryptedString

fromInternal()

static fromInternal(args): EncryptedString;

Defined in: ../execution/envelope-string.ts:62

Construct a read-side envelope from a wire ciphertext + the column identity + the SDK used to decrypt the cell. Called from the codec decode body.

Parameters

args

EncryptedEnvelopeFromInternalArgs

Returns

EncryptedString

CipherstashV3CellCodec

Defined in: ../v3/codec-runtime-v3.ts:158

Extends

CodecImpl<string, readonly CodecTrait[], unknown, E>

Type Parameters

E

E extends EncryptedEnvelopeBase<unknown>

Constructors

Constructor

new CipherstashV3CellCodec&lt;E&gt;(
   descriptor, 
   sdk, 
   typeName, 
   fromInternal): CipherstashV3CellCodec&lt;E&gt;;

Defined in: ../v3/codec-runtime-v3.ts:173

Parameters

descriptor

AnyCodecDescriptor

sdk

CipherstashSdk

typeName

string

fromInternal

FromInternal

Returns

CipherstashV3CellCodec<E>

Overrides

CodecImpl&lt;string, readonly CodecTrait[], unknown, E&gt;.constructor

Properties

descriptor

readonly descriptor: CodecDescriptor&lt;any&gt;;

Defined in: ../../../../node_modules/.bun/@[email protected]/node_modules/@prisma-next/framework-components/dist/codec-types-4tPB4m_G.d.mts:123

Inherited from

CodecImpl.descriptor

Accessors

id

Get Signature

get id(): Id;

Defined in: ../../../../node_modules/.bun/@[email protected]/node_modules/@prisma-next/framework-components/dist/codec-types-4tPB4m_G.d.mts:128

Unique codec identifier in namespace/name@version format (e.g. pg/timestamptz@1). The factory sets this to the descriptor's codecId; consumers use it as a back-reference for descriptor lookups and for decode-error diagnostics.

Returns

Id

Inherited from

CodecImpl.id

Methods

encode()

encode(value, _ctx): Promise&lt;unknown&gt;;

Defined in: ../v3/codec-runtime-v3.ts:185

Parameters

value

E

_ctx

SqlCodecCallContext

Returns

Promise<unknown>

Overrides

CodecImpl.encode

decode()

decode(wire, ctx): Promise&lt;E&gt;;

Defined in: ../v3/codec-runtime-v3.ts:234

Parameters

wire

unknown

ctx

SqlCodecCallContext

Returns

Promise<E>

Overrides

CodecImpl.decode

encodeJson()

encodeJson(_value): JsonValue;

Defined in: ../v3/codec-runtime-v3.ts:315

Parameters

_value

E

Returns

JsonValue

Overrides

CodecImpl.encodeJson

decodeJson()

decodeJson(json): E;

Defined in: ../v3/codec-runtime-v3.ts:347

Decode a v3 payload embedded in a database-produced JSON value — the path the SQL runtime takes for a relation include(), where a cell arrives inside a json_agg / json_build_object document with no SqlColumnRef attached.

Routing comes from the payload's own i identifier, which is all this path needs: the codec instance already closes over the SDK, so the envelope it builds is indistinguishable from one built by decode, and decryptAll batches it into the same (sdk, table, column) group.

Note this is NOT the inverse of encodeJson, which deliberately renders the opaque $encrypted* marker so a serialised envelope never carries ciphertext. Round-tripping an encodeJson marker back through here is not supported and raises below — the two methods serve the write and read directions of different planes.

No NULL handling here by design: the SQL runtime short-circuits a NULL cell before ever reaching a codec — the include-decode loop (sql-orm-client collection-dispatch) skips null/undefined column values, and the many-typed path skips null elements — so this method, like decode (guarded by the runtime's decodeField), only receives a non-null JSON payload. NULL-handling is the runtime's contract, not the codec's; returning null here would also break the framework's decodeJson(json): TInput (envelope) signature.

Parameters

json

JsonValue

Returns

E

Overrides

CodecImpl.decodeJson

EncryptedNumber

Defined in: ../v3/envelope-number.ts:29

Extends

EncryptedEnvelopeBase<number>

Methods

applyDecryptedSdkResult()

static applyDecryptedSdkResult&lt;U&gt;(envelope, sdkResult): U;

Defined in: ../execution/envelope-base.ts:153

Apply an SDK bulk-decrypt result to an envelope: narrow the polymorphic SDK return through the subclass's EncryptedEnvelopeBase.parseDecryptedValue hook and cache the narrowed plaintext on the handle. Returns the narrowed plaintext for callers that want to observe it.

Lives as a static member rather than a free function in this module so it stays inside the class's lexical scope — TS's class-bounded-friend convention permits a static method to call a protected instance method on the same class, which is what lets parseDecryptedValue stay protected while still being reachable from ../decrypt-all.ts decryptAll.

Mirrors the conventional setHandle* mutator shape used elsewhere in this module — call sites stay symmetric across the encrypt path (setHandleCiphertext) and the decrypt path (EncryptedEnvelopeBase.applyDecryptedSdkResult).

Type Parameters

U

U

Parameters

envelope

EncryptedEnvelopeBase<U>

sdkResult

unknown

Returns

U

Inherited from

EncryptedEnvelopeBase.applyDecryptedSdkResult

expose()

expose(): EncryptedEnvelopeHandle&lt;number&gt;;

Defined in: ../execution/envelope-base.ts:174

Explicitly retrieve the wrapped handle. Modelled on Rust secrecy's SecretBox<T>::expose_secret: the handle is reachable, but you have to ask for it by name. Callers reach for expose() when they need to inspect or transport the ciphertext envelope, debug lifecycle state, or wire ad-hoc tooling around the SDK reference.

Mutating the returned handle is supported but unusual — the package's lifecycle mutators (setHandleCiphertext, setHandleRoutingKey, etc.) are the conventional path during encrypt / decrypt flow.

Returns

EncryptedEnvelopeHandle<number>

Inherited from

EncryptedEnvelopeBase.expose

decrypt()

decrypt(opts?): Promise&lt;number&gt;;

Defined in: ../execution/envelope-base.ts:195

Decrypt and return the plaintext.

If the handle's plaintext slot is already populated (write-side envelopes from from(plaintext), or read-side envelopes already materialized by decryptAll(...) or a prior decrypt()), returns the cached plaintext synchronously without consulting the SDK.
Otherwise (read-side handle without a cached plaintext), invokes the SDK's single-cell decrypt with the handle's routing context. The caller-supplied signal is forwarded to the SDK by identity per the umbrella cancellation contract; the SDK promise is also raced against the signal so an abort surfaces a RUNTIME.ABORTED { phase: 'decrypt' } envelope promptly even if the SDK body ignores the signal. The cached-plaintext fast path returns synchronously without consulting the signal — no IO, no abort observation point.

Parameters

opts?

signal?

AbortSignal

Returns

Promise<number>

Inherited from

EncryptedEnvelopeBase.decrypt

toJSON()

toJSON(): EncryptedEnvelopePlaceholder;

Defined in: ../execution/envelope-base.ts:225

Returns

EncryptedEnvelopePlaceholder

Inherited from

EncryptedEnvelopeBase.toJSON

toString()

toString(): string;

Defined in: ../execution/envelope-base.ts:229

Returns

string

Inherited from

EncryptedEnvelopeBase.toString

valueOf()

valueOf(): string;

Defined in: ../execution/envelope-base.ts:233

Returns

string

Inherited from

EncryptedEnvelopeBase.valueOf

[toPrimitive]()

toPrimitive: string;

Defined in: ../execution/envelope-base.ts:237

Returns

string

Inherited from

EncryptedEnvelopeBase.[toPrimitive]

from()

static from(plaintext): EncryptedNumber;

Defined in: ../v3/envelope-number.ts:39

Construct a write-side envelope from a plaintext number. Bulk-encrypt middleware populates the handle's ciphertext slot before the codec encodes the envelope to wire format.

Parameters

plaintext

number

Returns

EncryptedNumber

fromInternal()

static fromInternal(args): EncryptedNumber;

Defined in: ../v3/envelope-number.ts:54

Construct a read-side envelope from a wire ciphertext + the column identity + the SDK used to decrypt the cell. Called from the codec decode body.

Parameters

args

EncryptedEnvelopeFromInternalArgs

Returns

EncryptedNumber

EncryptionOperatorError

Defined in: ../v3/query-term.ts:37

A dedicated error for v3 operator gating, operand-coercion, and misuse failures, carrying the offending column/table/operator for diagnostics.

INTENTIONAL FORK of @cipherstash/stack-drizzle's error of the same name (same shape, same rationale): sharing it would couple two independently-versioned public packages. v3-owned — the v2 operator surface keeps throwing plain TypeErrors.

Extends

Error

Constructors

Constructor

new EncryptionOperatorError(message, context?): EncryptionOperatorError;

Defined in: ../v3/query-term.ts:38

Parameters

message

string

context?

columnName?

string

tableName?

string

operator?

string

Returns

EncryptionOperatorError

Overrides

Error.constructor

Properties

context?

readonly optional context: {
  columnName?: string;
  tableName?: string;
  operator?: string;
};

Defined in: ../v3/query-term.ts:40

columnName?

optional columnName: string;

tableName?

optional tableName: string;

operator?

optional operator: string;

stackTraceLimit

static stackTraceLimit: number;

Defined in: ../../../../node_modules/.bun/@[email protected]/node_modules/@types/node/globals.d.ts:68

The Error.stackTraceLimit property specifies the number of stack frames collected by a stack trace (whether generated by new Error().stack or Error.captureStackTrace(obj)).

The default value is 10 but may be set to any valid JavaScript number. Changes will affect any stack trace captured after the value has been changed.

If set to a non-number value, or set to a negative number, stack traces will not capture any frames.

Inherited from

Error.stackTraceLimit

cause?

optional cause: unknown;

Defined in: ../../../../../node_modules/typescript/lib/lib.es2022.error.d.ts:26

Inherited from

Error.cause

name

name: string;

Defined in: ../../../../../node_modules/typescript/lib/lib.es5.d.ts:1076

Inherited from

Error.name

message

message: string;

Defined in: ../../../../../node_modules/typescript/lib/lib.es5.d.ts:1077

Inherited from

Error.message

stack?

optional stack: string;

Defined in: ../../../../../node_modules/typescript/lib/lib.es5.d.ts:1078

Inherited from

Error.stack

Methods

captureStackTrace()

static captureStackTrace(targetObject, constructorOpt?): void;

Defined in: ../../../../node_modules/.bun/@[email protected]/node_modules/@types/node/globals.d.ts:52

Creates a .stack property on targetObject, which when accessed returns a string representing the location in the code at which Error.captureStackTrace() was called.

const myObject = {};
Error.captureStackTrace(myObject);
myObject.stack;  // Similar to `new Error().stack`

The first line of the trace will be prefixed with ${myObject.name}: ${myObject.message}.

The optional constructorOpt argument accepts a function. If given, all frames above constructorOpt, including constructorOpt, will be omitted from the generated stack trace.

The constructorOpt argument is useful for hiding implementation details of error generation from the user. For instance:

function a() {
  b();
}

function b() {
  c();
}

function c() {
  // Create an error without stack trace to avoid calculating the stack trace twice.
  const { stackTraceLimit } = Error;
  Error.stackTraceLimit = 0;
  const error = new Error();
  Error.stackTraceLimit = stackTraceLimit;

  // Capture the stack trace above function b
  Error.captureStackTrace(error, b); // Neither function c, nor b is included in the stack trace
  throw error;
}

a();

Parameters

targetObject

object

constructorOpt?

Function

Returns

void

Inherited from

Error.captureStackTrace

prepareStackTrace()

static prepareStackTrace(err, stackTraces): any;

Defined in: ../../../../node_modules/.bun/@[email protected]/node_modules/@types/node/globals.d.ts:56

Parameters

err

Error

stackTraces

CallSite[]

Returns

any

See

https://v8.dev/docs/stack-trace-api#customizing-stack-traces

Inherited from

Error.prepareStackTrace

isError()

static isError(error): error is Error;

Defined in: ../../../../../node_modules/typescript/lib/lib.esnext.error.d.ts:23

Indicates whether the argument provided is a built-in Error instance or not.

Parameters

error

unknown

Returns

error is Error

Inherited from

Error.isError

Interfaces

DecryptAllOptions

Defined in: ../execution/decrypt-all.ts:68

Runtime-plane entry point for the CipherStash extension (EQL v3).

Consumed at query time by application runtimes: the value envelopes (EncryptedString, EncryptedNumber, EncryptedBigInt, …), decryptAll, the CipherStash SDK shape the v3 codec runtime + bulk-encrypt middleware depend on, and the v3 runtime descriptor / operators.

The runtime entry point is deliberately separate from ./control (descriptor, codec lifecycle hook, contract-space artefacts) so apps that only emit migrations against cipherstash never load the runtime, and apps that only run queries never load the migration-time descriptor — the control plane and runtime plane are tree-shakable along this seam.

createCipherstashV3RuntimeDescriptor({ sdk }) is the recommended composition entry — it bundles the SDK-bound v3 codecs and the runtime-plane codecDescriptors slot into a single SqlRuntimeExtensionDescriptor<'postgres'>. The bulk-encrypt middleware ships as bulkEncryptMiddlewareV3(sdk).

Properties

signal?

readonly optional signal: AbortSignal;

Defined in: ../execution/decrypt-all.ts:69

CipherstashRoutingKey

Defined in: ../execution/sdk.ts:29

Routing-key tuple used by bulkEncrypt/bulkDecrypt to group requests so each ZeroKMS round-trip handles one homogeneous batch. Routing key is (table, column).

Properties

table

readonly table: string;

Defined in: ../execution/sdk.ts:30

column

readonly column: string;

Defined in: ../execution/sdk.ts:31

CipherstashSingleDecryptArgs

Defined in: ../execution/sdk.ts:34

Properties

ciphertext

readonly ciphertext: unknown;

Defined in: ../execution/sdk.ts:40

The wire ciphertext to decrypt. Opaque to the framework; the SDK inspects the embedded i.t / i.c schema markers to pick the right cast_as for the round-trip.

table

readonly table: string;

Defined in: ../execution/sdk.ts:41

column

readonly column: string;

Defined in: ../execution/sdk.ts:42

signal?

readonly optional signal: AbortSignal;

Defined in: ../execution/sdk.ts:43

CipherstashBulkEncryptArgs

Defined in: ../execution/sdk.ts:46

Properties

routingKey

readonly routingKey: CipherstashRoutingKey;

Defined in: ../execution/sdk.ts:47

values

readonly values: readonly unknown[];

Defined in: ../execution/sdk.ts:54

Plaintext values to encrypt. Polymorphic at the SDK boundary: each batch is homogeneously typed by its (table, column) routing key, so the SDK derives the EQL cast_as from the search-config already registered on the column rather than from a per-batch hint.

signal?

readonly optional signal: AbortSignal;

Defined in: ../execution/sdk.ts:55

CipherstashBulkDecryptArgs

Defined in: ../execution/sdk.ts:58

Properties

routingKey

readonly routingKey: CipherstashRoutingKey;

Defined in: ../execution/sdk.ts:59

ciphertexts

readonly ciphertexts: readonly unknown[];

Defined in: ../execution/sdk.ts:60

signal?

readonly optional signal: AbortSignal;

Defined in: ../execution/sdk.ts:61

CipherstashSdk

Defined in: ../execution/sdk.ts:70

The framework-native CipherStash SDK contract consumed by the envelope, codec, middleware, and decryptAll surfaces. Real implementations wrap a CipherStash EncryptionClient; tests construct mock SDKs that implement these three methods directly.

Methods

decrypt()

decrypt(args): Promise&lt;string&gt;;

Defined in: ../execution/sdk.ts:71

Parameters

args

CipherstashSingleDecryptArgs

Returns

Promise<string>

bulkEncrypt()

bulkEncrypt(args): Promise&lt;readonly unknown[]&gt;;

Defined in: ../execution/sdk.ts:72

Parameters

args

CipherstashBulkEncryptArgs

Returns

Promise<readonly unknown[]>

bulkDecrypt()

bulkDecrypt(args): Promise&lt;readonly unknown[]&gt;;

Defined in: ../execution/sdk.ts:73

Parameters

args

CipherstashBulkDecryptArgs

Returns

Promise<readonly unknown[]>

CipherstashV3CodecParams

Defined in: ../v3/codec-runtime-v3.ts:64

Per-domain params emitted by v3 authoring as a static typeParams block. Purely descriptive — the runtime codec ignores them (the capability set already determined the descriptor's traits at derivation time).

Properties

castAs

readonly castAs: string;

Defined in: ../v3/codec-runtime-v3.ts:65

capabilities

readonly capabilities: object;

Defined in: ../v3/codec-runtime-v3.ts:66

CreateCipherstashV3RuntimeDescriptorOptions

Defined in: ../v3/runtime-v3.ts:36

Properties

sdk

readonly sdk: CipherstashSdk;

Defined in: ../v3/runtime-v3.ts:37

Type Aliases

EncryptedBigIntHandle

type EncryptedBigIntHandle = EncryptedEnvelopeHandle&lt;bigint&gt;;

Defined in: ../execution/envelope-bigint.ts:23

EncryptedBigIntFromInternalArgs

type EncryptedBigIntFromInternalArgs = EncryptedEnvelopeFromInternalArgs;

Defined in: ../execution/envelope-bigint.ts:25

EncryptedBooleanHandle

type EncryptedBooleanHandle = EncryptedEnvelopeHandle&lt;boolean&gt;;

Defined in: ../execution/envelope-boolean.ts:17

EncryptedBooleanFromInternalArgs

type EncryptedBooleanFromInternalArgs = EncryptedEnvelopeFromInternalArgs;

Defined in: ../execution/envelope-boolean.ts:19

EncryptedDateHandle

type EncryptedDateHandle = EncryptedEnvelopeHandle&lt;Date&gt;;

Defined in: ../execution/envelope-date.ts:29

EncryptedDateFromInternalArgs

type EncryptedDateFromInternalArgs = EncryptedEnvelopeFromInternalArgs;

Defined in: ../execution/envelope-date.ts:31

EncryptedJsonHandle

type EncryptedJsonHandle = EncryptedEnvelopeHandle&lt;unknown&gt;;

Defined in: ../execution/envelope-json.ts:25

EncryptedJsonFromInternalArgs

type EncryptedJsonFromInternalArgs = EncryptedEnvelopeFromInternalArgs;

Defined in: ../execution/envelope-json.ts:27

EncryptedStringHandle

type EncryptedStringHandle = EncryptedEnvelopeHandle&lt;string&gt;;

Defined in: ../execution/envelope-string.ts:33

EncryptedStringFromInternalArgs

type EncryptedStringFromInternalArgs = EncryptedEnvelopeFromInternalArgs;

Defined in: ../execution/envelope-string.ts:35

CipherstashV3CodecId

type CipherstashV3CodecId = `cipherstash/eql-v3/${StripSchema&lt;EqlTypeFromGetter&lt;AnyEncryptedV3Column&gt;>}@1`;

Defined in: ../extension-metadata/constants-v3.ts:45

Compile-time closed union: one concrete codec id per catalog domain. A catalog change that adds/drops a domain surfaces as a type error at the satisfies line below. The domain segment is the GA registry key VERBATIM (eql_v3_*); the leading eql-v3 path token is the logical version tag.

EncryptedNumberHandle

type EncryptedNumberHandle = EncryptedEnvelopeHandle&lt;number&gt;;

Defined in: ../v3/envelope-number.ts:25

EncryptedNumberFromInternalArgs

type EncryptedNumberFromInternalArgs = EncryptedEnvelopeFromInternalArgs;

Defined in: ../v3/envelope-number.ts:27

V3QueryTermType

type V3QueryTermType = Extract&lt;QueryTypeName, 
  | "equality"
  | "orderAndRange"
  | "freeTextSearch"
  | "searchableJson"
  | "steVecSelector"
  | "steVecValueSelector"
  | "steVecTerm"&gt;;

Defined in: ../v3/query-term.ts:57

The query-term flavours a v3 operator can mint — the subset of the stack's QueryTypeName union used by the v3 operators. JSON selector predicates use the explicit SteVec flavours because path hashing, value-selector equality, and scalar ordering have distinct wire shapes.

Variables

CIPHERSTASH_V3_CODEC_IDS

const CIPHERSTASH_V3_CODEC_IDS: readonly ["cipherstash/eql-v3/eql_v3_integer@1", "cipherstash/eql-v3/eql_v3_integer_eq@1", "cipherstash/eql-v3/eql_v3_integer_ord_ore@1", "cipherstash/eql-v3/eql_v3_integer_ord@1", "cipherstash/eql-v3/eql_v3_smallint@1", "cipherstash/eql-v3/eql_v3_smallint_eq@1", "cipherstash/eql-v3/eql_v3_smallint_ord_ore@1", "cipherstash/eql-v3/eql_v3_smallint_ord@1", "cipherstash/eql-v3/eql_v3_bigint@1", "cipherstash/eql-v3/eql_v3_bigint_eq@1", "cipherstash/eql-v3/eql_v3_bigint_ord_ore@1", "cipherstash/eql-v3/eql_v3_bigint_ord@1", "cipherstash/eql-v3/eql_v3_date@1", "cipherstash/eql-v3/eql_v3_date_eq@1", "cipherstash/eql-v3/eql_v3_date_ord_ore@1", "cipherstash/eql-v3/eql_v3_date_ord@1", "cipherstash/eql-v3/eql_v3_timestamp@1", "cipherstash/eql-v3/eql_v3_timestamp_eq@1", "cipherstash/eql-v3/eql_v3_timestamp_ord_ore@1", "cipherstash/eql-v3/eql_v3_timestamp_ord@1", "cipherstash/eql-v3/eql_v3_numeric@1", "cipherstash/eql-v3/eql_v3_numeric_eq@1", "cipherstash/eql-v3/eql_v3_numeric_ord_ore@1", "cipherstash/eql-v3/eql_v3_numeric_ord@1", "cipherstash/eql-v3/eql_v3_text@1", "cipherstash/eql-v3/eql_v3_text_eq@1", "cipherstash/eql-v3/eql_v3_text_match@1", "cipherstash/eql-v3/eql_v3_text_ord_ore@1", "cipherstash/eql-v3/eql_v3_text_ord@1", "cipherstash/eql-v3/eql_v3_text_search@1", "cipherstash/eql-v3/eql_v3_boolean@1", "cipherstash/eql-v3/eql_v3_real@1", "cipherstash/eql-v3/eql_v3_real_eq@1", "cipherstash/eql-v3/eql_v3_real_ord_ore@1", "cipherstash/eql-v3/eql_v3_real_ord@1", "cipherstash/eql-v3/eql_v3_double@1", "cipherstash/eql-v3/eql_v3_double_eq@1", "cipherstash/eql-v3/eql_v3_double_ord_ore@1", "cipherstash/eql-v3/eql_v3_double_ord@1", "cipherstash/eql-v3/eql_v3_json_search@1"];

Defined in: ../extension-metadata/constants-v3.ts:62

PINNED literal tuple — the compile-time source of truth for the v3 codec-id set. Hand-listed, one entry per catalog domain (INCLUDING the *_ord_ore variants that authoring does not expose but the codec/derivation layer still decodes). This is deliberately NOT V3_CODEC_IDS as readonly CipherstashV3CodecId[] — that is a masking cast that asserts the derived array IS the union and so catches NO drift. Here, catalog drift fails to COMPILE in both directions:

satisfies readonly CipherstashV3CodecId[] fails if a listed id is no longer a catalog domain (a domain removed / renamed).
_NoUnpinnedDomain (below) fails if the catalog gained a domain not pinned here. The runtime drift test additionally asserts this equals the registry-derived V3_CODEC_IDS (guarding the derivation itself).

CIPHERSTASH_V3_SPACE_ID

const CIPHERSTASH_V3_SPACE_ID: "cipherstash-eql-v3";

Defined in: ../extension-metadata/constants-v3.ts:160

CIPHERSTASH_V3_EXTENSION_VERSION

const CIPHERSTASH_V3_EXTENSION_VERSION: "1.0.0";

Defined in: ../extension-metadata/constants-v3.ts:161

cipherstashV3ParamsSchema

const cipherstashV3ParamsSchema: Type&lt;{
  castAs: string;
  capabilities: object;
}, {
}&gt;;

Defined in: ../v3/codec-runtime-v3.ts:69

Functions

decryptAll()

function decryptAll(rows, opts?): Promise&lt;void&gt;;

Defined in: ../execution/decrypt-all.ts:95

Walk a result set and bulk-decrypt every cipherstash envelope (any EncryptedEnvelopeBase subclass) reachable from it. After the returned promise resolves, every touched envelope's decrypt() returns the cached plaintext synchronously without consulting the SDK. Heterogeneous result sets are supported — envelopes of different concrete types (e.g. EncryptedString and EncryptedDate reachable from the same row) are grouped by (sdk, table, column) and the SDK's polymorphic bulkDecrypt return is narrowed per envelope through each subclass's EncryptedEnvelopeBase.parseDecryptedValue hook.

The walker is a no-op when no envelopes are reachable (returns without making any SDK call), so it is cheap to call defensively after queries that may or may not contain encrypted columns.

Parameters

rows

unknown

opts?

DecryptAllOptions

Returns

Promise<void>

isCipherstashV3CodecId()

function isCipherstashV3CodecId(id): id is "cipherstash/eql-v3/eql_v3_text_search@1" | "cipherstash/eql-v3/eql_v3_integer@1" | "cipherstash/eql-v3/eql_v3_integer_eq@1" | "cipherstash/eql-v3/eql_v3_integer_ord_ore@1" | "cipherstash/eql-v3/eql_v3_integer_ord@1" | "cipherstash/eql-v3/eql_v3_smallint@1" | "cipherstash/eql-v3/eql_v3_smallint_eq@1" | "cipherstash/eql-v3/eql_v3_smallint_ord_ore@1" | "cipherstash/eql-v3/eql_v3_smallint_ord@1" | "cipherstash/eql-v3/eql_v3_bigint@1" | "cipherstash/eql-v3/eql_v3_bigint_eq@1" | "cipherstash/eql-v3/eql_v3_bigint_ord_ore@1" | "cipherstash/eql-v3/eql_v3_bigint_ord@1" | "cipherstash/eql-v3/eql_v3_date@1" | "cipherstash/eql-v3/eql_v3_date_eq@1" | "cipherstash/eql-v3/eql_v3_date_ord_ore@1" | "cipherstash/eql-v3/eql_v3_date_ord@1" | "cipherstash/eql-v3/eql_v3_timestamp@1" | "cipherstash/eql-v3/eql_v3_timestamp_eq@1" | "cipherstash/eql-v3/eql_v3_timestamp_ord_ore@1" | "cipherstash/eql-v3/eql_v3_timestamp_ord@1" | "cipherstash/eql-v3/eql_v3_numeric@1" | "cipherstash/eql-v3/eql_v3_numeric_eq@1" | "cipherstash/eql-v3/eql_v3_numeric_ord_ore@1" | "cipherstash/eql-v3/eql_v3_numeric_ord@1" | "cipherstash/eql-v3/eql_v3_text@1" | "cipherstash/eql-v3/eql_v3_text_eq@1" | "cipherstash/eql-v3/eql_v3_text_match@1" | "cipherstash/eql-v3/eql_v3_text_ord_ore@1" | "cipherstash/eql-v3/eql_v3_text_ord@1" | "cipherstash/eql-v3/eql_v3_boolean@1" | "cipherstash/eql-v3/eql_v3_real@1" | "cipherstash/eql-v3/eql_v3_real_eq@1" | "cipherstash/eql-v3/eql_v3_real_ord_ore@1" | "cipherstash/eql-v3/eql_v3_real_ord@1" | "cipherstash/eql-v3/eql_v3_double@1" | "cipherstash/eql-v3/eql_v3_double_eq@1" | "cipherstash/eql-v3/eql_v3_double_ord_ore@1" | "cipherstash/eql-v3/eql_v3_double_ord@1" | "cipherstash/eql-v3/eql_v3_json_search@1";

Defined in: ../extension-metadata/constants-v3.ts:124

Parameters

id

string

Returns

id is "cipherstash/eql-v3/eql_v3_text_search@1" | "cipherstash/eql-v3/eql_v3_integer@1" | "cipherstash/eql-v3/eql_v3_integer_eq@1" | "cipherstash/eql-v3/eql_v3_integer_ord_ore@1" | "cipherstash/eql-v3/eql_v3_integer_ord@1" | "cipherstash/eql-v3/eql_v3_smallint@1" | "cipherstash/eql-v3/eql_v3_smallint_eq@1" | "cipherstash/eql-v3/eql_v3_smallint_ord_ore@1" | "cipherstash/eql-v3/eql_v3_smallint_ord@1" | "cipherstash/eql-v3/eql_v3_bigint@1" | "cipherstash/eql-v3/eql_v3_bigint_eq@1" | "cipherstash/eql-v3/eql_v3_bigint_ord_ore@1" | "cipherstash/eql-v3/eql_v3_bigint_ord@1" | "cipherstash/eql-v3/eql_v3_date@1" | "cipherstash/eql-v3/eql_v3_date_eq@1" | "cipherstash/eql-v3/eql_v3_date_ord_ore@1" | "cipherstash/eql-v3/eql_v3_date_ord@1" | "cipherstash/eql-v3/eql_v3_timestamp@1" | "cipherstash/eql-v3/eql_v3_timestamp_eq@1" | "cipherstash/eql-v3/eql_v3_timestamp_ord_ore@1" | "cipherstash/eql-v3/eql_v3_timestamp_ord@1" | "cipherstash/eql-v3/eql_v3_numeric@1" | "cipherstash/eql-v3/eql_v3_numeric_eq@1" | "cipherstash/eql-v3/eql_v3_numeric_ord_ore@1" | "cipherstash/eql-v3/eql_v3_numeric_ord@1" | "cipherstash/eql-v3/eql_v3_text@1" | "cipherstash/eql-v3/eql_v3_text_eq@1" | "cipherstash/eql-v3/eql_v3_text_match@1" | "cipherstash/eql-v3/eql_v3_text_ord_ore@1" | "cipherstash/eql-v3/eql_v3_text_ord@1" | "cipherstash/eql-v3/eql_v3_boolean@1" | "cipherstash/eql-v3/eql_v3_real@1" | "cipherstash/eql-v3/eql_v3_real_eq@1" | "cipherstash/eql-v3/eql_v3_real_ord_ore@1" | "cipherstash/eql-v3/eql_v3_real_ord@1" | "cipherstash/eql-v3/eql_v3_double@1" | "cipherstash/eql-v3/eql_v3_double_eq@1" | "cipherstash/eql-v3/eql_v3_double_ord_ore@1" | "cipherstash/eql-v3/eql_v3_double_ord@1" | "cipherstash/eql-v3/eql_v3_json_search@1"

bulkEncryptMiddlewareV3()

function bulkEncryptMiddlewareV3(sdk): SqlMiddleware;

Defined in: ../v3/bulk-encrypt-v3.ts:72

Construct the v3 bulk-encrypt middleware. The returned middleware is stateless aside from the captured sdk reference; one instance per (v3) runtime extension is the expected pattern.

Parameters

sdk

CipherstashSdk

Returns

SqlMiddleware

createV3CodecDescriptors()

function createV3CodecDescriptors(sdk): readonly RuntimeParameterizedCodecDescriptor&lt;CipherstashV3CodecParams&gt;[];

Defined in: ../v3/codec-runtime-v3.ts:437

One runtime descriptor per catalog domain (all 40, including the authoring-unexposed *_ord_ore variants — the codec layer must decode whatever the catalog can name), closed over sdk so multi-tenant deployments can compose multiple cipherstash extensions side-by-side without cross-talk.

Parameters

sdk

CipherstashSdk

Returns

readonly RuntimeParameterizedCodecDescriptor<CipherstashV3CodecParams>[]

cipherstashV3QueryOperations()

function cipherstashV3QueryOperations(): SqlOperationDescriptors;

Defined in: ../v3/operators-v3.ts:796

Cipherstash's v3 query-operations contributions. Wired into the v3 runtime descriptor (Task 7's createCipherstashV3RuntimeDescriptor) — and ONLY that descriptor (decision 1b: a client is v2 or v3, never both; pinned in test/v3/operator-gating-v3.test.ts).

Operator → trait → lowering:

eqlEq / eqlNeq / eqlIn / eqlNotIn (cipherstash:equality) → eql_v3.eq / eql_v3.neq / OR-of-eq
eqlGt / eqlGte / eqlLt / eqlLte / eqlBetween / eqlNotBetween (cipherstash:order-and-range) → eql_v3.gt/gte/lt/lte, range as a self-parenthesised (gte AND lte) conjunction
eqlMatch (cipherstash:free-text-search) → eql_v3.matches — a bloom-filter TOKEN MATCH (order/multiplicity-insensitive, one-sided: may false-positive), NOT SQL pattern matching. Guarded up front: needles the column's match index cannot answer are rejected (matchNeedleError), and SQL wildcards are normalised away or rejected (see matchOperator).
eqlJsonContains (cipherstash:searchable-json) → exact jsonb containment via OPERATOR(public.@>).
eqlJsonPathEq/Neq/Gt/Gte/Lt/Lte (cipherstash:searchable-json) → exact value-selector containment for equality, or selector extraction plus a ciphertext-free scalar query term for ordering.

Every operand renders as $n::eql_v3.query_<domain> (irregularly ::eql_v3.query_json for JSON), matching the stack-drizzle v3 dialect byte-for-byte.

Returns

SqlOperationDescriptors

eqlAsc()

function eqlAsc(col): OrderByItem;

Defined in: ../v3/operators-v3.ts:938

ASC sort over an order-capable v3 column, via the encrypted order-term extractor: ORDER BY eql_v3.ord_term(col) ASC (or ord_term_ore on a block-ORE domain).

A free-standing helper, not a registered operator — same rationale as the v2 cipherstashAsc: sort returns an OrderByItem, not the boolean predicate the registry's where-binding pipeline expects. The eql prefix keeps the export distinct from the v2 helper AND names the vocabulary it belongs to (free-standing exports share one barrel namespace). Unlike v2 (bare-column sort over eql_v2_encrypted's native operator family), v3 domains have no cross-row comparison operators — sorting MUST extract the order term. Synchronous: no operand, so no query term is minted.

Parameters

col

Expression<ScopeField>

Returns

OrderByItem

eqlDesc()

function eqlDesc(col): OrderByItem;

Defined in: ../v3/operators-v3.ts:945

DESC sort over an order-capable v3 column. See eqlAsc.

Parameters

col

Expression<ScopeField>

Returns

OrderByItem

eqlJsonPathAsc()

function eqlJsonPathAsc(col, path): OrderByItem;

Defined in: ../v3/operators-v3.ts:994

ASC sort over a scalar leaf in an encrypted JSON document. Missing paths produce SQL NULL and follow PostgreSQL's normal NULL ordering.

Parameters

col

Expression<ScopeField>

path

string

Returns

OrderByItem

eqlJsonPathDesc()

function eqlJsonPathDesc(col, path): OrderByItem;

Defined in: ../v3/operators-v3.ts:1004

DESC counterpart to eqlJsonPathAsc.

Parameters

col

Expression<ScopeField>

path

string

Returns

OrderByItem

markV3QueryTerm()

function markV3QueryTerm(envelope, queryType): void;

Defined in: ../v3/query-term.ts:88

Mark an envelope as a v3 QUERY TERM of the given flavour. Stamped by every operator at lowering time; consumed by the v3 SDK boundary (Task 7), which must encrypt marked envelopes via encryptQuery({ queryType }) — a ciphertext-free term — instead of the storage bulkEncrypt path. Write-once-wins with a conflict check, mirroring setHandleRoutingKey: one envelope instance feeds one query flavour.

Parameters

envelope

EncryptedEnvelopeBase<unknown>

queryType

V3QueryTermType

Returns

void

v3QueryTermTypeOf()

function v3QueryTermTypeOf(envelope): 
  | V3QueryTermType
  | undefined;

Defined in: ../v3/query-term.ts:105

Read an envelope's query-term mark. undefined means the envelope is a storage value (write path), not a query term.

Parameters

envelope

unknown

Returns

| V3QueryTermType | undefined

createCipherstashV3RuntimeDescriptor()

function createCipherstashV3RuntimeDescriptor(opts): SqlRuntimeExtensionDescriptor&lt;"postgres"&gt;;

Defined in: ../v3/runtime-v3.ts:49

Compose the SDK-bound v3 codec descriptors + query operations into a single SqlRuntimeExtensionDescriptor<'postgres'>.

The descriptor is per-SDK: each codec captures the SDK for the read-side decrypt path. Multi-tenant deployments construct one descriptor per tenant SDK so per-tenant key material never crosses runtimes (same contract as v2).

Parameters

opts

CreateCipherstashV3RuntimeDescriptorOptions

Returns

SqlRuntimeExtensionDescriptor<"postgres">

v3ToDriver()

function v3ToDriver(value): string | null;

Defined in: ../v3/wire-v3.ts:29

Serialise an EQL payload to plain JSONB text; null/undefined → null.

Parameters

value

unknown

Returns

string | null

v3FromDriver()

Call Signature

function v3FromDriver&lt;T&gt;(value): T;

Defined in: ../v3/wire-v3.ts:44

Parse a JSONB wire back to the EQL payload. Text wires are JSON.parsed; objects (drivers that pre-parse jsonb) pass through; null/undefined are preserved as-is — the overloads keep that passthrough visible to callers (a nullable input yields a nullable result) instead of laundering null into T.

Type Parameters

T

T

Parameters

value

string | object

Returns

T

Call Signature

function v3FromDriver&lt;T&gt;(value): T | null | undefined;

Defined in: ../v3/wire-v3.ts:45

Parse a JSONB wire back to the EQL payload. Text wires are JSON.parsed; objects (drivers that pre-parse jsonb) pass through; null/undefined are preserved as-is — the overloads keep that passthrough visible to callers (a nullable input yields a nullable result) instead of laundering null into T.

Type Parameters

T

T

Parameters

value

string | object | null | undefined

Returns

T | null | undefined

pack

pack is a module in @cipherstash/stack-prisma. TypeScript API reference with its signature, parameters, and usage.

stack

stack is a module in @cipherstash/stack-prisma. TypeScript API reference with its signature, parameters, and usage.

On this page

runtime Classes EncryptedBigInt Extends Methods applyDecryptedSdkResult()Type Parameters U Parameters envelope sdkResult Returns Inherited from expose()Returns Inherited from decrypt()Parameters opts?signal?Returns Inherited from toJSON()Returns Inherited from toString()Returns Inherited from valueOf()Returns Inherited from [toPrimitive]()Returns Inherited from from()Parameters plaintext Returns fromInternal()Parameters args Returns EncryptedBoolean Extends Methods applyDecryptedSdkResult()Type Parameters U Parameters envelope sdkResult Returns Inherited from expose()Returns Inherited from decrypt()Parameters opts?signal?Returns Inherited from toJSON()Returns Inherited from toString()Returns Inherited from valueOf()Returns Inherited from [toPrimitive]()Returns Inherited from from()Parameters plaintext Returns fromInternal()Parameters args Returns EncryptedDate Extends Methods applyDecryptedSdkResult()Type Parameters U Parameters envelope sdkResult Returns Inherited from expose()Returns Inherited from decrypt()Parameters opts?signal?Returns Inherited from toJSON()Returns Inherited from toString()Returns Inherited from valueOf()Returns Inherited from [toPrimitive]()Returns Inherited from from()Parameters plaintext Returns fromInternal()Parameters args Returns EncryptedJson Extends Methods applyDecryptedSdkResult()Type Parameters U Parameters envelope sdkResult Returns Inherited from expose()Returns Inherited from decrypt()Parameters opts?signal?Returns Inherited from toJSON()Returns Inherited from toString()Returns Inherited from valueOf()Returns Inherited from [toPrimitive]()Returns Inherited from from()Parameters plaintext Returns fromInternal()Parameters args Returns EncryptedString Extends Methods applyDecryptedSdkResult()Type Parameters U Parameters envelope sdkResult Returns Inherited from expose()Returns Inherited from decrypt()Parameters opts?signal?Returns Inherited from toJSON()Returns Inherited from toString()Returns Inherited from valueOf()Returns Inherited from [toPrimitive]()Returns Inherited from from()Parameters plaintext Returns fromInternal()Parameters args Returns CipherstashV3CellCodec Extends Type Parameters E Constructors Constructor Parameters descriptor sdk typeName fromInternal Returns Overrides Properties descriptor Inherited from Accessors id Get Signature Returns Inherited from Methods encode()Parameters value _ctx Returns Overrides decode()Parameters wire ctx Returns Overrides encodeJson()Parameters _value Returns Overrides decodeJson()Parameters json Returns Overrides EncryptedNumber Extends Methods applyDecryptedSdkResult()Type Parameters U Parameters envelope sdkResult Returns Inherited from expose()Returns Inherited from decrypt()Parameters opts?signal?Returns Inherited from toJSON()Returns Inherited from toString()Returns Inherited from valueOf()Returns Inherited from [toPrimitive]()Returns Inherited from from()Parameters plaintext Returns fromInternal()Parameters args Returns EncryptionOperatorError Extends Constructors Constructor Parameters message context?columnName?tableName?operator?Returns Overrides Properties context?columnName?tableName?operator?stackTraceLimit Inherited from cause?Inherited from name Inherited from message Inherited from stack?Inherited from Methods captureStackTrace()Parameters targetObject constructorOpt?Returns Inherited from prepareStackTrace()Parameters err stackTraces Returns See Inherited from isError()Parameters error Returns Inherited from Interfaces DecryptAllOptions Properties signal?CipherstashRoutingKey Properties table column CipherstashSingleDecryptArgs Properties ciphertext table column signal?CipherstashBulkEncryptArgs Properties routingKey values signal?CipherstashBulkDecryptArgs Properties routingKey ciphertexts signal?CipherstashSdk Methods decrypt()Parameters args Returns bulkEncrypt()Parameters args Returns bulkDecrypt()Parameters args Returns CipherstashV3CodecParams Properties castAs capabilities CreateCipherstashV3RuntimeDescriptorOptions Properties sdk Type Aliases EncryptedBigIntHandle EncryptedBigIntFromInternalArgs EncryptedBooleanHandle EncryptedBooleanFromInternalArgs EncryptedDateHandle EncryptedDateFromInternalArgs EncryptedJsonHandle EncryptedJsonFromInternalArgs EncryptedStringHandle EncryptedStringFromInternalArgs CipherstashV3CodecId EncryptedNumberHandle EncryptedNumberFromInternalArgs V3QueryTermType Variables CIPHERSTASH_V3_CODEC_IDS CIPHERSTASH_V3_SPACE_ID CIPHERSTASH_V3_EXTENSION_VERSION cipherstashV3ParamsSchema Functions decryptAll()Parameters rows opts?Returns isCipherstashV3CodecId()Parameters id Returns bulkEncryptMiddlewareV3()Parameters sdk Returns createV3CodecDescriptors()Parameters sdk Returns cipherstashV3QueryOperations()Returns eqlAsc()Parameters col Returns eqlDesc()Parameters col Returns eqlJsonPathAsc()Parameters col path Returns eqlJsonPathDesc()Parameters col path Returns markV3QueryTerm()Parameters envelope queryType Returns v3QueryTermTypeOf()Parameters envelope Returns createCipherstashV3RuntimeDescriptor()Parameters opts Returns v3ToDriver()Parameters value Returns v3FromDriver()Call Signature Type Parameters T Parameters value Returns Call Signature Type Parameters T Parameters value Returns