stack is a module in @cipherstash/stack-prisma. TypeScript API reference with its signature, parameters, and usage.

@cipherstash/stack-prisma/stack — one-call setup for the @cipherstash/stack SDK against a Prisma Next contract (EQL v3).

Most consumers want cipherstashFromStack: it derives the v3 encryption schemas from your contract, constructs the @cipherstash/stack Encryption client from your CS_* env vars or local profile, builds the SDK adapter, and returns ready-to-spread extensions / middleware for postgres<Contract>({...}). The remaining exports are the primitives it composes, for advanced users who need to interpose custom logic (custom keyset, multi-tenant routing).

This subpath imports @cipherstash/stack directly. Consumers who implement CipherstashSdk against a different SDK should use ./runtime instead and pay no @cipherstash/stack bundle cost.

Properties

contractJson

readonly contractJson: V3ContractShape;

Defined in: ../stack/from-stack-v3.ts:48

The contract.json artefact emitted by prisma-next contract emit.

schemasV3?

readonly optional schemasV3: readonly AnyV3Table[];

Defined in: ../stack/from-stack-v3.ts:56

Optional schema override. Use this to add tables the contract does not model. For tables the contract does declare, the override must match on column names and EXACT public.eql_v3_* domain identity — divergence throws at setup.

encryptionConfig?

readonly optional encryptionConfig: ClientConfig;

Defined in: ../stack/from-stack-v3.ts:70

Pass-through to Encryption({ config }) (keyset overrides, logging, …).

ClientConfig no longer carries an eqlVersion field — @cipherstash/stack always authors EQL v3 — so there is no v2 escape hatch to reach from here. Encryption() throws on the mere PRESENCE of the key (`config.eqlVersion` has been removed), whatever its value — an explicit undefined excepted, since the type admits that one and cannot reject it — and whatever the schema set, so a config object carrying a leftover eqlVersion fails at setup rather than silently selecting a wire format.

CipherstashFromStackV3Result

Defined in: ../stack/from-stack-v3.ts:73

@cipherstash/stack-prisma/stack — one-call setup for the @cipherstash/stack SDK against a Prisma Next contract (EQL v3).

This subpath imports @cipherstash/stack directly. Consumers who implement CipherstashSdk against a different SDK should use ./runtime instead and pay no @cipherstash/stack bundle cost.

Properties

extensions

readonly extensions: readonly SqlRuntimeExtensionDescriptor&lt;"postgres"&gt;[];

Defined in: ../stack/from-stack-v3.ts:75

Ready to spread into postgres<Contract>({ extensions }).

middleware

readonly middleware: readonly SqlMiddleware&lt;Record&lt;string, unknown&gt;>[];

Defined in: ../stack/from-stack-v3.ts:77

Ready to spread into postgres<Contract>({ middleware }).

encryptionClient

readonly encryptionClient: EncryptionClient&lt;readonly AnyV3Table[]&gt;;

Defined in: ../stack/from-stack-v3.ts:82

The initialised v3 EncryptionClient for direct SDK access outside the ORM path (encryptModel, encryptQuery, …).

V3ContractShape

Defined in: ../v3/derive-schemas-v3.ts:51

Structural shape of the subset of contract.json this derivation reads — the 0.14 storage.namespaces.<ns>.entries.table envelope, mirroring the v2 ContractStorageView. Declared structurally (vs importing the framework type) so the derivation has no @prisma-next/* import-edge and is callable against a raw JSON-typed import.

Properties

storage?

readonly optional storage: {
  namespaces?: Readonly&lt;Record&lt;string, {
     entries?: {
        table?: Readonly&lt;Record&lt;..., ...&gt;>;
     };
  }>>;
};

Defined in: ../v3/derive-schemas-v3.ts:52

namespaces?

readonly optional namespaces: Readonly&lt;Record&lt;string, {
  entries?: {
     table?: Readonly&lt;Record&lt;..., ...&gt;>;
  };
}>>;

V3ContractColumnEntry

Defined in: ../v3/derive-schemas-v3.ts:79

One contract column, flattened out of the namespace envelope.

Properties

tableName

readonly tableName: string;

Defined in: ../v3/derive-schemas-v3.ts:80

columnName

readonly columnName: string;

Defined in: ../v3/derive-schemas-v3.ts:81

codecId

readonly codecId: string | undefined;

Defined in: ../v3/derive-schemas-v3.ts:82

nativeType

readonly nativeType: string | undefined;

Defined in: ../v3/derive-schemas-v3.ts:83

CipherstashV3Client

Defined in: ../v3/sdk-adapter-v3.ts:74

Minimal structural view of the stack v3 client this adapter drives — satisfied by the EncryptionClient that Encryption returns (whatever its schema tuple) AND by a hand-rolled test double, neither needing a cast.

encryptQuery's never operands are deliberate (same rationale as @cipherstash/stack-drizzle's OperandEncryptionClient): the real client's encryptQuery is generic — queryType is constrained to the column's own query types — which a concrete signature here cannot match. never params keep the structural surface satisfiable by that generic method; the call sites cast their real operands.

Methods

bulkEncrypt()

bulkEncrypt(payload, opts): PromiseLike&lt;StackResult&lt;readonly {
  data: unknown;
}[]&gt;>;

Defined in: ../v3/sdk-adapter-v3.ts:75

Parameters

payload

readonly { plaintext: unknown; }[]

opts

table

AnyV3Table

column

AnyEncryptedV3Column

Returns

PromiseLike<StackResult<readonly { data: unknown; }[]>>

decrypt()

decrypt(encrypted): PromiseLike&lt;StackResult&lt;unknown&gt;>;

Defined in: ../v3/sdk-adapter-v3.ts:79

Parameters

encrypted

unknown

Returns

PromiseLike<StackResult<unknown>>

bulkDecrypt()

bulkDecrypt(payloads): PromiseLike&lt;StackResult&lt;readonly {
  data?: unknown;
  error?: unknown;
}[]&gt;>;

Defined in: ../v3/sdk-adapter-v3.ts:80

Parameters

payloads

readonly { data: unknown; }[]

Returns

PromiseLike<StackResult<readonly { data?: unknown; error?: unknown; }[]>>

encryptQuery()

Call Signature

encryptQuery(plaintext, opts): PromiseLike&lt;StackResult&lt;unknown&gt;>;

Defined in: ../v3/sdk-adapter-v3.ts:87

Parameters

plaintext

never

opts

never

Returns

PromiseLike<StackResult<unknown>>

Call Signature

encryptQuery(terms): PromiseLike&lt;StackResult&lt;readonly unknown[]&gt;>;

Defined in: ../v3/sdk-adapter-v3.ts:88

Parameters

terms

never

Returns

PromiseLike<StackResult<readonly unknown[]>>

Functions

cipherstashFromStack()

function cipherstashFromStack(opts): Promise&lt;CipherstashFromStackV3Result&gt;;

Defined in: ../stack/from-stack-v3.ts:85

Parameters

opts

CipherstashFromStackV3Options

Returns

Promise<CipherstashFromStackV3Result>

v3ContractColumnEntries()

function v3ContractColumnEntries(contractJson): V3ContractColumnEntry[];

Defined in: ../v3/derive-schemas-v3.ts:92

Flatten every contract column across all namespaces/tables. Shared by deriveStackSchemasV3 and cipherstashFromStack's v2-codec-id scan (a v3 client is v3-only; foreign cipherstash codec ids are a hard error there).

Parameters

contractJson

V3ContractShape

Returns

V3ContractColumnEntry[]

deriveStackSchemasV3()

function deriveStackSchemasV3(contractJson): readonly AnyV3Table[];

Defined in: ../v3/derive-schemas-v3.ts:117

Derive an array of v3 EncryptedTable builders from a Prisma Next contract. Returns an empty array when no v3 cipherstash columns are present; callers must still pass at least one table to Encryption({ schemas }), which requires a non-empty array.

Parameters

contractJson

V3ContractShape

Returns

readonly AnyV3Table[]

assertV3SchemasAgree()

function assertV3SchemasAgree(derived, override): void;

Defined in: ../v3/from-stack-v3-validate.ts:22

Assert that a user-supplied v3 table override agrees with the contract-derived table on every column: same column set (keyed by the physical DB column name) and, per column, the same concrete public.eql_v3_* domain. Throws with a fix-the-schema hint on the first divergence.

Parameters

derived

AnyV3Table

override

AnyV3Table

Returns

void

createCipherstashV3Sdk()

function createCipherstashV3Sdk(client, schemas): CipherstashSdk;

Defined in: ../v3/sdk-adapter-v3.ts:112

Build a CipherstashSdk from a stack v3 client plus the v3 schemas it was constructed with.

schemas should be the exact AnyV3Table[] passed to Encryption({ schemas }) (typically the return value of deriveStackSchemasV3). The adapter uses it to translate framework (table, column) routing-key strings back to the typed schema objects the client's operations expect.

stack

On this page