runtime · @cipherstash/stack-prisma API

runtime is a module in @cipherstash/stack-prisma. TypeScript API reference with its signature, parameters, and usage.

EncryptedEnvelopeBase<bigint>

Methods

from()

static from(plaintext): EncryptedBigInt;

Defined in: envelope-bigint.ts:79

Construct a write-side envelope from a plaintext bigint. Bulk-encrypt middleware populates the handle's ciphertext slot before the codec encodes the envelope to wire format.

fromInternal()

static fromInternal(args): EncryptedBigInt;

Defined in: envelope-bigint.ts:94

Construct a read-side envelope from a wire ciphertext + the column identity + the SDK used to decrypt the cell. Called from the codec decode body.

EncryptedBoolean

Defined in: envelope-boolean.ts:21

Methods

from()

static from(plaintext): EncryptedBoolean;

Defined in: envelope-boolean.ts:26

fromInternal()

static fromInternal(args): EncryptedBoolean;

Defined in: envelope-boolean.ts:36

EncryptedDate

Defined in: envelope-date.ts:33

Methods

from()

static from(plaintext): EncryptedDate;

Defined in: envelope-date.ts:79

Construct a write-side envelope from a Date plaintext. Bulk-encrypt middleware populates the handle's ciphertext slot before the codec encodes the envelope to wire format.

fromInternal()

static fromInternal(args): EncryptedDate;

Defined in: envelope-date.ts:99

Construct a read-side envelope from a wire ciphertext + the column identity + the SDK used to decrypt the cell. Called from the codec decode body.

EncryptedJson

Defined in: envelope-json.ts:29

Methods

from()

static from(plaintext): EncryptedJson;

Defined in: envelope-json.ts:34

fromInternal()

static fromInternal(args): EncryptedJson;

Defined in: envelope-json.ts:44

EncryptedString

Defined in: envelope-string.ts:37

Methods

from()

static from(plaintext): EncryptedString;

Defined in: envelope-string.ts:47

Construct a write-side envelope from plaintext. Bulk-encrypt middleware populates the handle's ciphertext slot before the codec encodes the envelope to wire format.

fromInternal()

static fromInternal(args): EncryptedString;

Defined in: envelope-string.ts:62

Construct a read-side envelope from a wire ciphertext + the column identity + the SDK used to decrypt the cell. Called from the codec decode body.

Decode a v3 payload embedded in a database-produced JSON value — the path the SQL runtime takes for a relation include(), where a cell arrives inside a json_agg / json_build_object document with no SqlColumnRef attached.

Routing comes from the payload's own i identifier, which is all this path needs: the codec instance already closes over the SDK, so the envelope it builds is indistinguishable from one built by decode, and decryptAll batches it into the same (sdk, table, column) group.

Note this is NOT the inverse of encodeJson, which deliberately renders the opaque $encrypted* marker so a serialised envelope never carries ciphertext. Round-tripping an encodeJson marker back through here is not supported and raises below — the two methods serve the write and read directions of different planes.

No NULL handling here by design: the SQL runtime short-circuits a NULL cell before ever reaching a codec — the include-decode loop (sql-orm-client collection-dispatch) skips null/undefined column values, and the many-typed path skips null elements — so this method, like decode (guarded by the runtime's decodeField), only receives a non-null JSON payload. NULL-handling is the runtime's contract, not the codec's; returning null here would also break the framework's decodeJson(json): TInput (envelope) signature.

Parameters

json

JsonValue

Returns

E

Overrides

CodecImpl.decodeJson

EncryptedNumber

Defined in: envelope-number.ts:29

Extends

EncryptedEnvelopeBase<number>

Methods

from()

static from(plaintext): EncryptedNumber;

Defined in: envelope-number.ts:39

Construct a write-side envelope from a plaintext number. Bulk-encrypt middleware populates the handle's ciphertext slot before the codec encodes the envelope to wire format.

Parameters

plaintext

number

Returns

EncryptedNumber

fromInternal()

static fromInternal(args): EncryptedNumber;

Defined in: envelope-number.ts:54

Construct a read-side envelope from a wire ciphertext + the column identity + the SDK used to decrypt the cell. Called from the codec decode body.

Parameters

args

EncryptedEnvelopeFromInternalArgs

Returns

EncryptedNumber

EncryptionOperatorError

Defined in: query-term.ts:37

A dedicated error for v3 operator gating, operand-coercion, and misuse failures, carrying the offending column/table/operator for diagnostics.

INTENTIONAL FORK of @cipherstash/stack-drizzle's error of the same name (same shape, same rationale): sharing it would couple two independently-versioned public packages. v3-owned — the v2 operator surface keeps throwing plain TypeErrors.

Extends

Error

Constructors

Constructor

new EncryptionOperatorError(message, context?): EncryptionOperatorError;

Defined in: query-term.ts:38

Parameters

message

string

context?

columnName?

string

tableName?

string

operator?

string

Returns

EncryptionOperatorError

Overrides

Error.constructor

Properties

context?

readonly optional context: {
  columnName?: string;
  tableName?: string;
  operator?: string;
};

Defined in: query-term.ts:40

columnName?

optional columnName: string;

tableName?

optional tableName: string;

operator?

optional operator: string;

Interfaces

DecryptAllOptions

Defined in: decrypt-all.ts:68

Runtime-plane entry point for the CipherStash extension (EQL v3).

Consumed at query time by application runtimes: the value envelopes (EncryptedString, EncryptedNumber, EncryptedBigInt, …), decryptAll, the CipherStash SDK shape the v3 codec runtime + bulk-encrypt middleware depend on, and the v3 runtime descriptor / operators.

The runtime entry point is deliberately separate from ./control (descriptor, codec lifecycle hook, contract-space artefacts) so apps that only emit migrations against cipherstash never load the runtime, and apps that only run queries never load the migration-time descriptor — the control plane and runtime plane are tree-shakable along this seam.

createCipherstashV3RuntimeDescriptor({ sdk }) is the recommended composition entry — it bundles the SDK-bound v3 codecs and the runtime-plane codecDescriptors slot into a single SqlRuntimeExtensionDescriptor<'postgres'>. The bulk-encrypt middleware ships as bulkEncryptMiddlewareV3(sdk).

Properties

signal?

readonly optional signal: AbortSignal;

Defined in: decrypt-all.ts:69

CipherstashRoutingKey

Defined in: sdk.ts:29

Routing-key tuple used by bulkEncrypt/bulkDecrypt to group requests so each ZeroKMS round-trip handles one homogeneous batch. Routing key is (table, column).

Properties

table

readonly table: string;

Defined in: sdk.ts:30

column

readonly column: string;

Defined in: sdk.ts:31

CipherstashSingleDecryptArgs

Defined in: sdk.ts:34

Properties

ciphertext

readonly ciphertext: unknown;

Defined in: sdk.ts:40

The wire ciphertext to decrypt. Opaque to the framework; the SDK inspects the embedded i.t / i.c schema markers to pick the right cast_as for the round-trip.

table

readonly table: string;

Defined in: sdk.ts:41

column

readonly column: string;

Defined in: sdk.ts:42

signal?

readonly optional signal: AbortSignal;

Defined in: sdk.ts:43

CipherstashBulkEncryptArgs

Defined in: sdk.ts:46

Properties

routingKey

readonly routingKey: CipherstashRoutingKey;

Defined in: sdk.ts:47

values

readonly values: readonly unknown[];

Defined in: sdk.ts:54

Plaintext values to encrypt. Polymorphic at the SDK boundary: each batch is homogeneously typed by its (table, column) routing key, so the SDK derives the EQL cast_as from the search-config already registered on the column rather than from a per-batch hint.

signal?

readonly optional signal: AbortSignal;

Defined in: sdk.ts:55

CipherstashBulkDecryptArgs

Defined in: sdk.ts:58

Properties

routingKey

readonly routingKey: CipherstashRoutingKey;

Defined in: sdk.ts:59

ciphertexts

readonly ciphertexts: readonly unknown[];

Defined in: sdk.ts:60

signal?

readonly optional signal: AbortSignal;

Defined in: sdk.ts:61

CipherstashSdk

Defined in: sdk.ts:70

The framework-native CipherStash SDK contract consumed by the envelope, codec, middleware, and decryptAll surfaces. Real implementations wrap a CipherStash EncryptionClient; tests construct mock SDKs that implement these three methods directly.

Methods

decrypt()

decrypt(args): Promise&lt;string&gt;;

Defined in: sdk.ts:71

Parameters

args

CipherstashSingleDecryptArgs

Returns

Promise<string>

bulkEncrypt()

bulkEncrypt(args): Promise&lt;readonly unknown[]&gt;;

Defined in: sdk.ts:72

Parameters

args

CipherstashBulkEncryptArgs

Returns

Promise<readonly unknown[]>

bulkDecrypt()

bulkDecrypt(args): Promise&lt;readonly unknown[]&gt;;

Defined in: sdk.ts:73

Parameters

args

CipherstashBulkDecryptArgs

Returns

Promise<readonly unknown[]>

CipherstashV3CodecParams

Defined in: codec-runtime-v3.ts:64

Per-domain params emitted by v3 authoring as a static typeParams block. Purely descriptive — the runtime codec ignores them (the capability set already determined the descriptor's traits at derivation time).

Properties

castAs

readonly castAs: string;

Defined in: codec-runtime-v3.ts:65

capabilities

readonly capabilities: object;

Defined in: codec-runtime-v3.ts:66

CreateCipherstashV3RuntimeDescriptorOptions

Defined in: runtime-v3.ts:36

Properties

sdk

readonly sdk: CipherstashSdk;

Defined in: runtime-v3.ts:37

Type Aliases

EncryptedBigIntHandle

type EncryptedBigIntHandle = EncryptedEnvelopeHandle&lt;bigint&gt;;

Defined in: envelope-bigint.ts:23

EncryptedBigIntFromInternalArgs

type EncryptedBigIntFromInternalArgs = EncryptedEnvelopeFromInternalArgs;

Defined in: envelope-bigint.ts:25

EncryptedBooleanHandle

type EncryptedBooleanHandle = EncryptedEnvelopeHandle&lt;boolean&gt;;

Defined in: envelope-boolean.ts:17

EncryptedBooleanFromInternalArgs

type EncryptedBooleanFromInternalArgs = EncryptedEnvelopeFromInternalArgs;

Defined in: envelope-boolean.ts:19

EncryptedDateHandle

type EncryptedDateHandle = EncryptedEnvelopeHandle&lt;Date&gt;;

Defined in: envelope-date.ts:29

EncryptedDateFromInternalArgs

type EncryptedDateFromInternalArgs = EncryptedEnvelopeFromInternalArgs;

Defined in: envelope-date.ts:31

EncryptedJsonHandle

type EncryptedJsonHandle = EncryptedEnvelopeHandle&lt;unknown&gt;;

Defined in: envelope-json.ts:25

EncryptedJsonFromInternalArgs

type EncryptedJsonFromInternalArgs = EncryptedEnvelopeFromInternalArgs;

Defined in: envelope-json.ts:27

EncryptedStringHandle

type EncryptedStringHandle = EncryptedEnvelopeHandle&lt;string&gt;;

Defined in: envelope-string.ts:33

EncryptedStringFromInternalArgs

type EncryptedStringFromInternalArgs = EncryptedEnvelopeFromInternalArgs;

Defined in: envelope-string.ts:35

CipherstashV3CodecId

type CipherstashV3CodecId = `cipherstash/eql-v3/${StripSchema&lt;EqlTypeFromGetter&lt;AnyEncryptedV3Column&gt;>}@1`;

Defined in: constants-v3.ts:45

Compile-time closed union: one concrete codec id per catalog domain. A catalog change that adds/drops a domain surfaces as a type error at the satisfies line below. The domain segment is the GA registry key VERBATIM (eql_v3_*); the leading eql-v3 path token is the logical version tag.

EncryptedNumberHandle

type EncryptedNumberHandle = EncryptedEnvelopeHandle&lt;number&gt;;

Defined in: envelope-number.ts:25

EncryptedNumberFromInternalArgs

type EncryptedNumberFromInternalArgs = EncryptedEnvelopeFromInternalArgs;

Defined in: envelope-number.ts:27

V3QueryTermType

type V3QueryTermType = Extract&lt;QueryTypeName, 
  | "equality"
  | "orderAndRange"
  | "freeTextSearch"
  | "searchableJson"
  | "steVecSelector"
  | "steVecValueSelector"
  | "steVecTerm"&gt;;

Defined in: query-term.ts:57

The query-term flavours a v3 operator can mint — the subset of the stack's QueryTypeName union used by the v3 operators. JSON selector predicates use the explicit SteVec flavours because path hashing, value-selector equality, and scalar ordering have distinct wire shapes.

Variables

CIPHERSTASH_V3_CODEC_IDS

const CIPHERSTASH_V3_CODEC_IDS: readonly ["cipherstash/eql-v3/eql_v3_integer@1", "cipherstash/eql-v3/eql_v3_integer_eq@1", "cipherstash/eql-v3/eql_v3_integer_ord_ore@1", "cipherstash/eql-v3/eql_v3_integer_ord@1", "cipherstash/eql-v3/eql_v3_smallint@1", "cipherstash/eql-v3/eql_v3_smallint_eq@1", "cipherstash/eql-v3/eql_v3_smallint_ord_ore@1", "cipherstash/eql-v3/eql_v3_smallint_ord@1", "cipherstash/eql-v3/eql_v3_bigint@1", "cipherstash/eql-v3/eql_v3_bigint_eq@1", "cipherstash/eql-v3/eql_v3_bigint_ord_ore@1", "cipherstash/eql-v3/eql_v3_bigint_ord@1", "cipherstash/eql-v3/eql_v3_date@1", "cipherstash/eql-v3/eql_v3_date_eq@1", "cipherstash/eql-v3/eql_v3_date_ord_ore@1", "cipherstash/eql-v3/eql_v3_date_ord@1", "cipherstash/eql-v3/eql_v3_timestamp@1", "cipherstash/eql-v3/eql_v3_timestamp_eq@1", "cipherstash/eql-v3/eql_v3_timestamp_ord_ore@1", "cipherstash/eql-v3/eql_v3_timestamp_ord@1", "cipherstash/eql-v3/eql_v3_numeric@1", "cipherstash/eql-v3/eql_v3_numeric_eq@1", "cipherstash/eql-v3/eql_v3_numeric_ord_ore@1", "cipherstash/eql-v3/eql_v3_numeric_ord@1", "cipherstash/eql-v3/eql_v3_text@1", "cipherstash/eql-v3/eql_v3_text_eq@1", "cipherstash/eql-v3/eql_v3_text_match@1", "cipherstash/eql-v3/eql_v3_text_ord_ore@1", "cipherstash/eql-v3/eql_v3_text_ord@1", "cipherstash/eql-v3/eql_v3_text_search@1", "cipherstash/eql-v3/eql_v3_boolean@1", "cipherstash/eql-v3/eql_v3_real@1", "cipherstash/eql-v3/eql_v3_real_eq@1", "cipherstash/eql-v3/eql_v3_real_ord_ore@1", "cipherstash/eql-v3/eql_v3_real_ord@1", "cipherstash/eql-v3/eql_v3_double@1", "cipherstash/eql-v3/eql_v3_double_eq@1", "cipherstash/eql-v3/eql_v3_double_ord_ore@1", "cipherstash/eql-v3/eql_v3_double_ord@1", "cipherstash/eql-v3/eql_v3_json_search@1"];

Defined in: constants-v3.ts:62

PINNED literal tuple — the compile-time source of truth for the v3 codec-id set. Hand-listed, one entry per catalog domain (INCLUDING the *_ord_ore variants that authoring does not expose but the codec/derivation layer still decodes). This is deliberately NOT V3_CODEC_IDS as readonly CipherstashV3CodecId[] — that is a masking cast that asserts the derived array IS the union and so catches NO drift. Here, catalog drift fails to COMPILE in both directions:

satisfies readonly CipherstashV3CodecId[] fails if a listed id is no longer a catalog domain (a domain removed / renamed).
_NoUnpinnedDomain (below) fails if the catalog gained a domain not pinned here. The runtime drift test additionally asserts this equals the registry-derived V3_CODEC_IDS (guarding the derivation itself).

CIPHERSTASH_V3_SPACE_ID

const CIPHERSTASH_V3_SPACE_ID: "cipherstash-eql-v3";

Defined in: constants-v3.ts:160

CIPHERSTASH_V3_EXTENSION_VERSION

const CIPHERSTASH_V3_EXTENSION_VERSION: "1.0.0";

Defined in: constants-v3.ts:161

cipherstashV3ParamsSchema

const cipherstashV3ParamsSchema: Type&lt;{
  castAs: string;
  capabilities: object;
}, {
}&gt;;

Defined in: codec-runtime-v3.ts:69

Functions

decryptAll()

function decryptAll(rows, opts?): Promise&lt;void&gt;;

Defined in: decrypt-all.ts:95

Walk a result set and bulk-decrypt every cipherstash envelope (any EncryptedEnvelopeBase subclass) reachable from it. After the returned promise resolves, every touched envelope's decrypt() returns the cached plaintext synchronously without consulting the SDK. Heterogeneous result sets are supported — envelopes of different concrete types (e.g. EncryptedString and EncryptedDate reachable from the same row) are grouped by (sdk, table, column) and the SDK's polymorphic bulkDecrypt return is narrowed per envelope through each subclass's EncryptedEnvelopeBase.parseDecryptedValue hook.

The walker is a no-op when no envelopes are reachable (returns without making any SDK call), so it is cheap to call defensively after queries that may or may not contain encrypted columns.

Parameters

rows

unknown

opts?

DecryptAllOptions

Returns

Promise<void>

isCipherstashV3CodecId()

function isCipherstashV3CodecId(id): id is "cipherstash/eql-v3/eql_v3_text_search@1" | "cipherstash/eql-v3/eql_v3_integer@1" | "cipherstash/eql-v3/eql_v3_integer_eq@1" | "cipherstash/eql-v3/eql_v3_integer_ord_ore@1" | "cipherstash/eql-v3/eql_v3_integer_ord@1" | "cipherstash/eql-v3/eql_v3_smallint@1" | "cipherstash/eql-v3/eql_v3_smallint_eq@1" | "cipherstash/eql-v3/eql_v3_smallint_ord_ore@1" | "cipherstash/eql-v3/eql_v3_smallint_ord@1" | "cipherstash/eql-v3/eql_v3_bigint@1" | "cipherstash/eql-v3/eql_v3_bigint_eq@1" | "cipherstash/eql-v3/eql_v3_bigint_ord_ore@1" | "cipherstash/eql-v3/eql_v3_bigint_ord@1" | "cipherstash/eql-v3/eql_v3_date@1" | "cipherstash/eql-v3/eql_v3_date_eq@1" | "cipherstash/eql-v3/eql_v3_date_ord_ore@1" | "cipherstash/eql-v3/eql_v3_date_ord@1" | "cipherstash/eql-v3/eql_v3_timestamp@1" | "cipherstash/eql-v3/eql_v3_timestamp_eq@1" | "cipherstash/eql-v3/eql_v3_timestamp_ord_ore@1" | "cipherstash/eql-v3/eql_v3_timestamp_ord@1" | "cipherstash/eql-v3/eql_v3_numeric@1" | "cipherstash/eql-v3/eql_v3_numeric_eq@1" | "cipherstash/eql-v3/eql_v3_numeric_ord_ore@1" | "cipherstash/eql-v3/eql_v3_numeric_ord@1" | "cipherstash/eql-v3/eql_v3_text@1" | "cipherstash/eql-v3/eql_v3_text_eq@1" | "cipherstash/eql-v3/eql_v3_text_match@1" | "cipherstash/eql-v3/eql_v3_text_ord_ore@1" | "cipherstash/eql-v3/eql_v3_text_ord@1" | "cipherstash/eql-v3/eql_v3_boolean@1" | "cipherstash/eql-v3/eql_v3_real@1" | "cipherstash/eql-v3/eql_v3_real_eq@1" | "cipherstash/eql-v3/eql_v3_real_ord_ore@1" | "cipherstash/eql-v3/eql_v3_real_ord@1" | "cipherstash/eql-v3/eql_v3_double@1" | "cipherstash/eql-v3/eql_v3_double_eq@1" | "cipherstash/eql-v3/eql_v3_double_ord_ore@1" | "cipherstash/eql-v3/eql_v3_double_ord@1" | "cipherstash/eql-v3/eql_v3_json_search@1";

Defined in: constants-v3.ts:124

Parameters

id

string

Returns

bulkEncryptMiddlewareV3()

function bulkEncryptMiddlewareV3(sdk): SqlMiddleware;

Defined in: bulk-encrypt-v3.ts:72

Construct the v3 bulk-encrypt middleware. The returned middleware is stateless aside from the captured sdk reference; one instance per (v3) runtime extension is the expected pattern.

Parameters

sdk

CipherstashSdk

Returns

SqlMiddleware

createV3CodecDescriptors()

function createV3CodecDescriptors(sdk): readonly RuntimeParameterizedCodecDescriptor&lt;CipherstashV3CodecParams&gt;[];

Defined in: codec-runtime-v3.ts:437

One runtime descriptor per catalog domain (all 40, including the authoring-unexposed *_ord_ore variants — the codec layer must decode whatever the catalog can name), closed over sdk so multi-tenant deployments can compose multiple cipherstash extensions side-by-side without cross-talk.

Parameters

sdk

CipherstashSdk

Returns

readonly RuntimeParameterizedCodecDescriptor<CipherstashV3CodecParams>[]

cipherstashV3QueryOperations()

function cipherstashV3QueryOperations(): SqlOperationDescriptors;

Defined in: operators-v3.ts:796

Cipherstash's v3 query-operations contributions. Wired into the v3 runtime descriptor (Task 7's createCipherstashV3RuntimeDescriptor) — and ONLY that descriptor (decision 1b: a client is v2 or v3, never both; pinned in test/v3/operator-gating-v3.test.ts).

Operator → trait → lowering:

eqlEq / eqlNeq / eqlIn / eqlNotIn (cipherstash:equality) → eql_v3.eq / eql_v3.neq / OR-of-eq
eqlGt / eqlGte / eqlLt / eqlLte / eqlBetween / eqlNotBetween (cipherstash:order-and-range) → eql_v3.gt/gte/lt/lte, range as a self-parenthesised (gte AND lte) conjunction
eqlMatch (cipherstash:free-text-search) → eql_v3.matches — a bloom-filter TOKEN MATCH (order/multiplicity-insensitive, one-sided: may false-positive), NOT SQL pattern matching. Guarded up front: needles the column's match index cannot answer are rejected (matchNeedleError), and SQL wildcards are normalised away or rejected (see matchOperator).
eqlJsonContains (cipherstash:searchable-json) → exact jsonb containment via OPERATOR(public.@>).
eqlJsonPathEq/Neq/Gt/Gte/Lt/Lte (cipherstash:searchable-json) → exact value-selector containment for equality, or selector extraction plus a ciphertext-free scalar query term for ordering.

Every operand renders as $n::eql_v3.query_<domain> (irregularly ::eql_v3.query_json for JSON), matching the stack-drizzle v3 dialect byte-for-byte.

Returns

SqlOperationDescriptors

eqlAsc()

function eqlAsc(col): OrderByItem;

Defined in: operators-v3.ts:938

ASC sort over an order-capable v3 column, via the encrypted order-term extractor: ORDER BY eql_v3.ord_term(col) ASC (or ord_term_ore on a block-ORE domain).

A free-standing helper, not a registered operator — same rationale as the v2 cipherstashAsc: sort returns an OrderByItem, not the boolean predicate the registry's where-binding pipeline expects. The eql prefix keeps the export distinct from the v2 helper AND names the vocabulary it belongs to (free-standing exports share one barrel namespace). Unlike v2 (bare-column sort over eql_v2_encrypted's native operator family), v3 domains have no cross-row comparison operators — sorting MUST extract the order term. Synchronous: no operand, so no query term is minted.

Parameters

col

Expression<ScopeField>

Returns

OrderByItem

eqlDesc()

function eqlDesc(col): OrderByItem;

Defined in: operators-v3.ts:945

DESC sort over an order-capable v3 column. See eqlAsc.

Parameters

col

Expression<ScopeField>

Returns

OrderByItem

eqlJsonPathAsc()

function eqlJsonPathAsc(col, path): OrderByItem;

Defined in: operators-v3.ts:994

ASC sort over a scalar leaf in an encrypted JSON document. Missing paths produce SQL NULL and follow PostgreSQL's normal NULL ordering.

Parameters

col

Expression<ScopeField>

path

string

Returns

OrderByItem

eqlJsonPathDesc()

function eqlJsonPathDesc(col, path): OrderByItem;

Defined in: operators-v3.ts:1004

DESC counterpart to eqlJsonPathAsc.

Parameters

col

Expression<ScopeField>

path

string

Returns

OrderByItem

markV3QueryTerm()

function markV3QueryTerm(envelope, queryType): void;

Defined in: query-term.ts:88

Mark an envelope as a v3 QUERY TERM of the given flavour. Stamped by every operator at lowering time; consumed by the v3 SDK boundary (Task 7), which must encrypt marked envelopes via encryptQuery({ queryType }) — a ciphertext-free term — instead of the storage bulkEncrypt path. Write-once-wins with a conflict check, mirroring setHandleRoutingKey: one envelope instance feeds one query flavour.

Parameters

envelope

EncryptedEnvelopeBase<unknown>

queryType

V3QueryTermType

Returns

void

v3QueryTermTypeOf()

function v3QueryTermTypeOf(envelope): 
  | V3QueryTermType
  | undefined;

Defined in: query-term.ts:105

Read an envelope's query-term mark. undefined means the envelope is a storage value (write path), not a query term.

Parameters

envelope

unknown

Returns

| V3QueryTermType | undefined

createCipherstashV3RuntimeDescriptor()

function createCipherstashV3RuntimeDescriptor(opts): SqlRuntimeExtensionDescriptor&lt;"postgres"&gt;;

Defined in: runtime-v3.ts:49

Compose the SDK-bound v3 codec descriptors + query operations into a single SqlRuntimeExtensionDescriptor<'postgres'>.

The descriptor is per-SDK: each codec captures the SDK for the read-side decrypt path. Multi-tenant deployments construct one descriptor per tenant SDK so per-tenant key material never crosses runtimes (same contract as v2).

Parameters

opts

CreateCipherstashV3RuntimeDescriptorOptions

Returns

SqlRuntimeExtensionDescriptor<"postgres">

v3ToDriver()

function v3ToDriver(value): string | null;

Defined in: wire-v3.ts:29

Serialise an EQL payload to plain JSONB text; null/undefined → null.

Parameters

value

unknown

Returns

string | null

v3FromDriver()

Call Signature

function v3FromDriver&lt;T&gt;(value): T;

Defined in: wire-v3.ts:44

Parse a JSONB wire back to the EQL payload. Text wires are JSON.parsed; objects (drivers that pre-parse jsonb) pass through; null/undefined are preserved as-is — the overloads keep that passthrough visible to callers (a nullable input yields a nullable result) instead of laundering null into T.

function v3FromDriver&lt;T&gt;(value): T | null | undefined;

Defined in: wire-v3.ts:45