@cipherstash/stack-supabase
API reference for @cipherstash/stack-supabase: every exported type, function, and class, with signatures, parameters, and usage.
@cipherstash/stack-supabase
@cipherstash/stack-supabase
Interfaces
EncryptedQueryBuilder
Defined in: types.ts:303
The v3 builder type: the shared EncryptedQueryBuilderCore surface with
filter methods narrowed to FilterableKeys and order() to
OrderableKeys.
like/ilike are absent by construction. EQL v3 free-text search is fuzzy
bloom-filter token matching (@>), not SQL wildcard matching — % is
tokenized like any other character, so a like pattern is a category error.
The v3 dialect of Drizzle omits them for the same reason. Use matches.
Extends
EncryptedQueryBuilderCore<Row,FilterableKeys<Table,Row> &StringKeyOf<Row>,EncryptedQueryBuilder<Table,Row>,OrderableKeys<Table,Row> &StringKeyOf<Row>,PlaintextKeys<Table,Row> &StringKeyOf<Row>>
Type Parameters
Table
Table extends AnyV3Table
Row
Row extends Record<string, unknown>
Methods
matches()
matches<K>(column, value): EncryptedQueryBuilder<Table, Row>;Defined in: types.ts:320
Encrypted free-text token match on legacy EQL versions. EQL 3.0.2+ requires a query-domain cast PostgREST cannot express, so this fails fast.
Type Parameters
K
K extends string
Parameters
column
K
value
string
Returns
EncryptedQueryBuilder<Table, Row>
contains()
Call Signature
contains<K>(column, value): EncryptedQueryBuilder<Table, Row>;Defined in: types.ts:327
Native (exact) jsonb/array containment (@>). Plaintext columns only — an
encrypted column is a compile error (use matches). A scalar plaintext
column resolves its operand to never (@> is array/jsonb only).
Type Parameters
K
K extends string
Parameters
column
K
value
PlaintextContainsValue<Row[K]>
Returns
EncryptedQueryBuilder<Table, Row>
Call Signature
contains<K>(column, value): EncryptedQueryBuilder<Table, Row>;Defined in: types.ts:334
Encrypted JSON containment on legacy EQL versions. EQL 3.0.2+ requires an
eql_v3.query_json cast PostgREST cannot express, so this fails fast before
encrypting an operand into the request URL.
Type Parameters
K
K extends string
Parameters
column
K
value
EncryptedJsonContainsValue
Returns
EncryptedQueryBuilder<Table, Row>
selectorEq()
selectorEq<K>(
column,
path,
value): EncryptedQueryBuilder<Table, Row>;Defined in: types.ts:340
Encrypted JSONPath equality on legacy EQL versions. EQL 3.0.2+ fails fast because PostgREST cannot express the required query-domain cast.
Type Parameters
K
K extends string
Parameters
column
K
path
string
value
SelectorLeafValue
Returns
EncryptedQueryBuilder<Table, Row>
selectorNe()
selectorNe<K>(
column,
path,
value): EncryptedQueryBuilder<Table, Row>;Defined in: types.ts:347
Encrypted JSONPath inequality on legacy EQL versions. EQL 3.0.2+ fails fast because PostgREST cannot express the required query-domain cast.
Type Parameters
K
K extends string
Parameters
column
K
path
string
value
SelectorLeafValue
Returns
EncryptedQueryBuilder<Table, Row>
filter()
Call Signature
filter<K>(
column,
operator,
value): EncryptedQueryBuilder<Table, Row>;Defined in: types.ts:353
Raw legacy containment spelling. EQL 3.0.2+ rejects this before sending.
Type Parameters
K
K extends string
Parameters
column
K
operator
"cs"
value
EncryptedJsonContainsValue
Returns
EncryptedQueryBuilder<Table, Row>
Overrides
EncryptedQueryBuilderCore.filter
Call Signature
filter<K>(
column,
operator,
value): EncryptedQueryBuilder<Table, Row>;Defined in: types.ts:358
Type Parameters
K
K extends string
Parameters
column
K
operator
string
value
Row[K]
Returns
EncryptedQueryBuilder<Table, Row>
Overrides
EncryptedQueryBuilderCore.filternot()
Call Signature
not<K>(
column,
operator,
value): EncryptedQueryBuilder<Table, Row>;Defined in: types.ts:365
Negated legacy containment spelling. EQL 3.0.2+ rejects this before sending.
Type Parameters
K
K extends string
Parameters
column
K
operator
"contains"
value
EncryptedJsonContainsValue
Returns
EncryptedQueryBuilder<Table, Row>
Overrides
Call Signature
not<K>(
column,
operator,
value): EncryptedQueryBuilder<Table, Row>;Defined in: types.ts:370
Type Parameters
K
K extends string
Parameters
column
K
operator
string
value
Row[K]
Returns
EncryptedQueryBuilder<Table, Row>
Overrides
EncryptedQueryBuilderCore.notselect()
select(columns?, options?): EncryptedQueryBuilder;Defined in: types.ts:866
columns defaults to '*', matching supabase-js. A '*' select expands
to the introspected column list; when none is available (a client that
could not introspect) both select() and select('*') throw, because an
unexpanded * cannot cast the encrypted columns with ::jsonb.
Parameters
columns?
string
options?
head?
boolean
count?
"exact" | "planned" | "estimated"
Returns
Inherited from
EncryptedQueryBuilderCore.select
insert()
insert(data, options?): EncryptedQueryBuilder;Defined in: types.ts:870
Parameters
data
Partial<Row> | Partial<Row>[]
options?
count?
"exact" | "planned" | "estimated"
defaultToNull?
boolean
onConflict?
string
Returns
Inherited from
EncryptedQueryBuilderCore.insert
update()
update(data, options?): EncryptedQueryBuilder;Defined in: types.ts:878
Parameters
data
Partial<T>
options?
count?
"exact" | "planned" | "estimated"
Returns
Inherited from
EncryptedQueryBuilderCore.update
upsert()
upsert(data, options?): EncryptedQueryBuilder;Defined in: types.ts:882
Parameters
data
Partial<Row> | Partial<Row>[]
options?
count?
"exact" | "planned" | "estimated"
onConflict?
string
ignoreDuplicates?
boolean
defaultToNull?
boolean
Returns
Inherited from
EncryptedQueryBuilderCore.upsert
delete()
delete(options?): EncryptedQueryBuilder;Defined in: types.ts:891
Parameters
options?
count?
"exact" | "planned" | "estimated"
Returns
Inherited from
EncryptedQueryBuilderCore.delete
eq()
eq<K>(column, value): EncryptedQueryBuilder;Defined in: types.ts:892
Type Parameters
K
K extends string
Parameters
column
K
value
Row[K]
Returns
Inherited from
neq()
neq<K>(column, value): EncryptedQueryBuilder;Defined in: types.ts:893
Type Parameters
K
K extends string
Parameters
column
K
value
Row[K]
Returns
Inherited from
gt()
gt<K>(column, value): EncryptedQueryBuilder;Defined in: types.ts:894
Type Parameters
K
K extends string
Parameters
column
K
value
Row[K]
Returns
Inherited from
gte()
gte<K>(column, value): EncryptedQueryBuilder;Defined in: types.ts:895
Type Parameters
K
K extends string
Parameters
column
K
value
Row[K]
Returns
Inherited from
lt()
lt<K>(column, value): EncryptedQueryBuilder;Defined in: types.ts:896
Type Parameters
K
K extends string
Parameters
column
K
value
Row[K]
Returns
Inherited from
lte()
lte<K>(column, value): EncryptedQueryBuilder;Defined in: types.ts:897
Type Parameters
K
K extends string
Parameters
column
K
value
Row[K]
Returns
Inherited from
is()
Call Signature
is<K>(column, value): EncryptedQueryBuilder;Defined in: types.ts:917
IS NULL / IS TRUE / IS FALSE.
The null form is widened to EVERY row key, not just the filterable ones.
is is the one predicate never encrypted — isEncryptableTerm rejects it
outright, so no term is collected and no capability guard runs — and a NULL
plaintext is stored as a SQL NULL rather than a ciphertext. On a v3
storage-only column (types.Boolean, types.Integer, …) IS NULL is
therefore not merely legal but the ONLY predicate available, so narrowing it
to FK would deny the sole query those columns support.
The boolean form narrows to BK: IS TRUE against a jsonb ciphertext
column compares an envelope to a plaintext boolean, which is a type error in
the database, not a filter. FK is the wrong gate for it — that set
excludes only the STORAGE-ONLY columns, so a queryable encrypted column
(types.TextSearch, types.TextEq, any *_ord) is in FK and would still
compile is(col, true). Every encrypted column stores an envelope,
capability or not, so BK excludes them all.
Type Parameters
K
K extends string
Parameters
column
K
value
boolean | null
Returns
Inherited from
Call Signature
is<K>(column, value): EncryptedQueryBuilder;Defined in: types.ts:918
Type Parameters
K
K extends string
Parameters
column
K
value
null
Returns
Inherited from
in()
in<K>(column, values): EncryptedQueryBuilder;Defined in: types.ts:919
Type Parameters
K
K extends string
Parameters
column
K
values
Row[K][]
Returns
Inherited from
or()
Call Signature
or(filters, options?): EncryptedQueryBuilder;Defined in: types.ts:922
Parameters
filters
string
options?
referencedTable?
string
foreignTable?
string
Returns
Inherited from
Call Signature
or(conditions, options?): EncryptedQueryBuilder;Defined in: types.ts:926
Parameters
conditions
options?
referencedTable?
string
foreignTable?
string
Returns
Inherited from
match()
match(query): EncryptedQueryBuilder;Defined in: types.ts:930
Parameters
query
Partial<T>
Returns
Inherited from
EncryptedQueryBuilderCore.match
order()
order<K>(column, options?): EncryptedQueryBuilder;Defined in: types.ts:935
Type Parameters
K
K extends string
Parameters
column
K
options?
ascending?
boolean
nullsFirst?
boolean
referencedTable?
string
foreignTable?
string
Returns
Inherited from
EncryptedQueryBuilderCore.order
limit()
limit(count, options?): EncryptedQueryBuilder;Defined in: types.ts:944
Parameters
count
number
options?
referencedTable?
string
foreignTable?
string
Returns
Inherited from
EncryptedQueryBuilderCore.limit
range()
range(
from,
to,
options?): EncryptedQueryBuilder;Defined in: types.ts:948
Parameters
from
number
to
number
options?
referencedTable?
string
foreignTable?
string
Returns
Inherited from
EncryptedQueryBuilderCore.range
single()
single(): EncryptedSingleQueryBuilder<Row>;Defined in: types.ts:963
Return ONE row rather than an array — so the awaited data is T | null,
not T[]. Returns EncryptedSingleQueryBuilder rather than Self
because that change of shape is the whole point of the call: typing it
Self would keep promising T[] while the runtime hands back one object,
forcing every caller through a cast (data as unknown as Row).
Filters and transforms are not chainable afterwards, matching supabase-js —
single() is applied last.
Returns
EncryptedSingleQueryBuilder<Row>
Inherited from
EncryptedQueryBuilderCore.single
maybeSingle()
maybeSingle(): EncryptedSingleQueryBuilder<Row>;Defined in: types.ts:967
As single, but a zero-row result is data: null rather than an
error. Same T | null awaited shape — single() reports the missing row
through error instead.
Returns
EncryptedSingleQueryBuilder<Row>
Inherited from
EncryptedQueryBuilderCore.maybeSingle
csv()
csv(): EncryptedQueryBuilder;Defined in: types.ts:978
Always THROWS. PostgREST serializes rows server-side, so a CSV response
carries ciphertext the adapter never gets to decrypt. Declared so the call
is a loud runtime failure rather than a missing method, and typed Self
only to keep the chain shape — it never returns. Select rows normally and
serialize the decrypted data yourself.
Returns
Deprecated
Always throws on an encrypted query — select the rows normally, then serialize the decrypted data to CSV yourself.
Inherited from
abortSignal()
abortSignal(signal): EncryptedQueryBuilder;Defined in: types.ts:979
Parameters
signal
AbortSignal
Returns
Inherited from
EncryptedQueryBuilderCore.abortSignal
throwOnError()
throwOnError(): EncryptedQueryBuilder;Defined in: types.ts:980
Returns
Inherited from
EncryptedQueryBuilderCore.throwOnError
returns()
returns<U>(): EncryptedQueryBuilderUntyped<U>;Defined in: types.ts:985
Escape hatch: re-types the rows and drops back to the untyped v3 builder
surface. object, not Record<string, unknown>: an interface row type
has no implicit index signature and would be rejected by the latter, while
object still excludes string/number row types.
Type Parameters
U
U extends object
Returns
EncryptedQueryBuilderUntyped<U>
Inherited from
EncryptedQueryBuilderCore.returns
withLockContext()
withLockContext(lockContext): EncryptedQueryBuilder;Defined in: types.ts:988
Bind identity-aware encryption. Accepts either a plain
{ identityClaim } (the common form) or a LockContext instance.
Parameters
lockContext
LockContextInput
Returns
Inherited from
EncryptedQueryBuilderCore.withLockContext
audit()
audit(config): EncryptedQueryBuilder;Defined in: types.ts:989
Parameters
config
AuditConfig
Returns
Inherited from
EncryptedQueryBuilderCore.audit
then()
then<TResult1, TResult2>(onfulfilled?, onrejected?): PromiseLike<TResult1 | TResult2>;Defined in: ../../../../node_modules/typescript/lib/lib.es5.d.ts:1544
Attaches callbacks for the resolution and/or rejection of the Promise.
Type Parameters
TResult1
TResult1 = EncryptedSupabaseResponse<Row[]>
TResult2
TResult2 = never
Parameters
onfulfilled?
The callback to execute when the Promise is resolved.
(value) => TResult1 | PromiseLike<TResult1> | null
onrejected?
The callback to execute when the Promise is rejected.
(reason) => TResult2 | PromiseLike<TResult2> | null
Returns
PromiseLike<TResult1 | TResult2>
A Promise for the completion of which ever callback is executed.
Inherited from
EncryptedQueryBuilderCore.then
EncryptedQueryBuilderUntyped
Defined in: types.ts:390
The builder for a table with no declared schema. Without capability
information contains cannot be narrowed to match-indexed columns — the
runtime guard in the term-encryption path is the only protection — and
order()/is(col, true) cannot be narrowed either, so this surface takes
EncryptedQueryBuilderCore's OK/BK defaults. like/ilike are
absent here as on the typed surface.
For the same reason nothing here can tell an encrypted match column from a
plaintext jsonb one, so matches/contains accept the full native operand
union (which subsumes the encrypted column's string); the runtime resolves
the column and picks the encoding (and rejects the wrong-column-kind pairing).
Extends
EncryptedQueryBuilderCore<Row,StringKeyOf<Row>,EncryptedQueryBuilderUntyped<Row>>
Type Parameters
Row
Row extends object
Methods
matches()
matches<K>(column, value): EncryptedQueryBuilderUntyped<Row>;Defined in: types.ts:399
Fuzzy free-text token match on an encrypted match/search column. The operand is always the string term to tokenize (never an array/object), even on the untyped surface where the column kind is unknown.
Type Parameters
K
K extends string
Parameters
column
K
value
string
Returns
EncryptedQueryBuilderUntyped<Row>
contains()
contains<K>(column, value): EncryptedQueryBuilderUntyped<Row>;Defined in: types.ts:405
Native jsonb/array containment on plaintext columns. Encrypted JSON containment fails fast on EQL 3.0.2+.
Type Parameters
K
K extends string
Parameters
column
K
value
NativeContainsValue
Returns
EncryptedQueryBuilderUntyped<Row>
selectorEq()
selectorEq<K>(
column,
path,
value): EncryptedQueryBuilderUntyped<Row>;Defined in: types.ts:410
Legacy encrypted JSONPath equality; fails fast on EQL 3.0.2+.
Type Parameters
K
K extends string
Parameters
column
K
path
string
value
SelectorLeafValue
Returns
EncryptedQueryBuilderUntyped<Row>
selectorNe()
selectorNe<K>(
column,
path,
value): EncryptedQueryBuilderUntyped<Row>;Defined in: types.ts:416
Legacy encrypted JSONPath inequality; fails fast on EQL 3.0.2+.
Type Parameters
K
K extends string
Parameters
column
K
path
string
value
SelectorLeafValue
Returns
EncryptedQueryBuilderUntyped<Row>
select()
select(columns?, options?): EncryptedQueryBuilderUntyped;Defined in: types.ts:866
columns defaults to '*', matching supabase-js. A '*' select expands
to the introspected column list; when none is available (a client that
could not introspect) both select() and select('*') throw, because an
unexpanded * cannot cast the encrypted columns with ::jsonb.
Parameters
columns?
string
options?
head?
boolean
count?
"exact" | "planned" | "estimated"
Returns
Inherited from
EncryptedQueryBuilderCore.select
insert()
insert(data, options?): EncryptedQueryBuilderUntyped;Defined in: types.ts:870
Parameters
data
Partial<Row> | Partial<Row>[]
options?
count?
"exact" | "planned" | "estimated"
defaultToNull?
boolean
onConflict?
string
Returns
Inherited from
EncryptedQueryBuilderCore.insert
update()
update(data, options?): EncryptedQueryBuilderUntyped;Defined in: types.ts:878
Parameters
data
Partial<T>
options?
count?
"exact" | "planned" | "estimated"
Returns
Inherited from
EncryptedQueryBuilderCore.update
upsert()
upsert(data, options?): EncryptedQueryBuilderUntyped;Defined in: types.ts:882
Parameters
data
Partial<Row> | Partial<Row>[]
options?
count?
"exact" | "planned" | "estimated"
onConflict?
string
ignoreDuplicates?
boolean
defaultToNull?
boolean
Returns
Inherited from
EncryptedQueryBuilderCore.upsert
delete()
delete(options?): EncryptedQueryBuilderUntyped;Defined in: types.ts:891
Parameters
options?
count?
"exact" | "planned" | "estimated"
Returns
Inherited from
EncryptedQueryBuilderCore.delete
eq()
eq<K>(column, value): EncryptedQueryBuilderUntyped;Defined in: types.ts:892
Type Parameters
K
K extends string
Parameters
column
K
value
Row[K]
Returns
Inherited from
neq()
neq<K>(column, value): EncryptedQueryBuilderUntyped;Defined in: types.ts:893
Type Parameters
K
K extends string
Parameters
column
K
value
Row[K]
Returns
Inherited from
gt()
gt<K>(column, value): EncryptedQueryBuilderUntyped;Defined in: types.ts:894
Type Parameters
K
K extends string
Parameters
column
K
value
Row[K]
Returns
Inherited from
gte()
gte<K>(column, value): EncryptedQueryBuilderUntyped;Defined in: types.ts:895
Type Parameters
K
K extends string
Parameters
column
K
value
Row[K]
Returns
Inherited from
lt()
lt<K>(column, value): EncryptedQueryBuilderUntyped;Defined in: types.ts:896
Type Parameters
K
K extends string
Parameters
column
K
value
Row[K]
Returns
Inherited from
lte()
lte<K>(column, value): EncryptedQueryBuilderUntyped;Defined in: types.ts:897
Type Parameters
K
K extends string
Parameters
column
K
value
Row[K]
Returns
Inherited from
is()
Call Signature
is<K>(column, value): EncryptedQueryBuilderUntyped;Defined in: types.ts:917
IS NULL / IS TRUE / IS FALSE.
The null form is widened to EVERY row key, not just the filterable ones.
is is the one predicate never encrypted — isEncryptableTerm rejects it
outright, so no term is collected and no capability guard runs — and a NULL
plaintext is stored as a SQL NULL rather than a ciphertext. On a v3
storage-only column (types.Boolean, types.Integer, …) IS NULL is
therefore not merely legal but the ONLY predicate available, so narrowing it
to FK would deny the sole query those columns support.
The boolean form narrows to BK: IS TRUE against a jsonb ciphertext
column compares an envelope to a plaintext boolean, which is a type error in
the database, not a filter. FK is the wrong gate for it — that set
excludes only the STORAGE-ONLY columns, so a queryable encrypted column
(types.TextSearch, types.TextEq, any *_ord) is in FK and would still
compile is(col, true). Every encrypted column stores an envelope,
capability or not, so BK excludes them all.
Type Parameters
K
K extends string
Parameters
column
K
value
boolean | null
Returns
Inherited from
Call Signature
is<K>(column, value): EncryptedQueryBuilderUntyped;Defined in: types.ts:918
Type Parameters
K
K extends string
Parameters
column
K
value
null
Returns
Inherited from
in()
in<K>(column, values): EncryptedQueryBuilderUntyped;Defined in: types.ts:919
Type Parameters
K
K extends string
Parameters
column
K
values
Row[K][]
Returns
Inherited from
filter()
filter<K>(
column,
operator,
value): EncryptedQueryBuilderUntyped;Defined in: types.ts:920
Type Parameters
K
K extends string
Parameters
column
K
operator
string
value
Row[K]
Returns
Inherited from
EncryptedQueryBuilderCore.filter
not()
not<K>(
column,
operator,
value): EncryptedQueryBuilderUntyped;Defined in: types.ts:921
Type Parameters
K
K extends string
Parameters
column
K
operator
string
value
Row[K]
Returns
Inherited from
or()
Call Signature
or(filters, options?): EncryptedQueryBuilderUntyped;Defined in: types.ts:922
Parameters
filters
string
options?
referencedTable?
string
foreignTable?
string
Returns
Inherited from
Call Signature
or(conditions, options?): EncryptedQueryBuilderUntyped;Defined in: types.ts:926
Parameters
conditions
options?
referencedTable?
string
foreignTable?
string
Returns
Inherited from
match()
match(query): EncryptedQueryBuilderUntyped;Defined in: types.ts:930
Parameters
query
Partial<T>
Returns
Inherited from
EncryptedQueryBuilderCore.match
order()
order<K>(column, options?): EncryptedQueryBuilderUntyped;Defined in: types.ts:935
Type Parameters
K
K extends string
Parameters
column
K
options?
ascending?
boolean
nullsFirst?
boolean
referencedTable?
string
foreignTable?
string
Returns
Inherited from
EncryptedQueryBuilderCore.order
limit()
limit(count, options?): EncryptedQueryBuilderUntyped;Defined in: types.ts:944
Parameters
count
number
options?
referencedTable?
string
foreignTable?
string
Returns
Inherited from
EncryptedQueryBuilderCore.limit
range()
range(
from,
to,
options?): EncryptedQueryBuilderUntyped;Defined in: types.ts:948
Parameters
from
number
to
number
options?
referencedTable?
string
foreignTable?
string
Returns
Inherited from
EncryptedQueryBuilderCore.range
single()
single(): EncryptedSingleQueryBuilder<Row>;Defined in: types.ts:963
Return ONE row rather than an array — so the awaited data is T | null,
not T[]. Returns EncryptedSingleQueryBuilder rather than Self
because that change of shape is the whole point of the call: typing it
Self would keep promising T[] while the runtime hands back one object,
forcing every caller through a cast (data as unknown as Row).
Filters and transforms are not chainable afterwards, matching supabase-js —
single() is applied last.
Returns
EncryptedSingleQueryBuilder<Row>
Inherited from
EncryptedQueryBuilderCore.single
maybeSingle()
maybeSingle(): EncryptedSingleQueryBuilder<Row>;Defined in: types.ts:967
As single, but a zero-row result is data: null rather than an
error. Same T | null awaited shape — single() reports the missing row
through error instead.
Returns
EncryptedSingleQueryBuilder<Row>
Inherited from
EncryptedQueryBuilderCore.maybeSingle
csv()
csv(): EncryptedQueryBuilderUntyped;Defined in: types.ts:978
Always THROWS. PostgREST serializes rows server-side, so a CSV response
carries ciphertext the adapter never gets to decrypt. Declared so the call
is a loud runtime failure rather than a missing method, and typed Self
only to keep the chain shape — it never returns. Select rows normally and
serialize the decrypted data yourself.
Returns
Deprecated
Always throws on an encrypted query — select the rows normally, then serialize the decrypted data to CSV yourself.
Inherited from
abortSignal()
abortSignal(signal): EncryptedQueryBuilderUntyped;Defined in: types.ts:979
Parameters
signal
AbortSignal
Returns
Inherited from
EncryptedQueryBuilderCore.abortSignal
throwOnError()
throwOnError(): EncryptedQueryBuilderUntyped;Defined in: types.ts:980
Returns
Inherited from
EncryptedQueryBuilderCore.throwOnError
returns()
returns<U>(): EncryptedQueryBuilderUntyped<U>;Defined in: types.ts:985
Escape hatch: re-types the rows and drops back to the untyped v3 builder
surface. object, not Record<string, unknown>: an interface row type
has no implicit index signature and would be rejected by the latter, while
object still excludes string/number row types.
Type Parameters
U
U extends object
Returns
EncryptedQueryBuilderUntyped<U>
Inherited from
EncryptedQueryBuilderCore.returns
withLockContext()
withLockContext(lockContext): EncryptedQueryBuilderUntyped;Defined in: types.ts:988
Bind identity-aware encryption. Accepts either a plain
{ identityClaim } (the common form) or a LockContext instance.
Parameters
lockContext
LockContextInput
Returns
Inherited from
EncryptedQueryBuilderCore.withLockContext
audit()
audit(config): EncryptedQueryBuilderUntyped;Defined in: types.ts:989
Parameters
config
AuditConfig
Returns
Inherited from
EncryptedQueryBuilderCore.audit
then()
then<TResult1, TResult2>(onfulfilled?, onrejected?): PromiseLike<TResult1 | TResult2>;Defined in: ../../../../node_modules/typescript/lib/lib.es5.d.ts:1544
Attaches callbacks for the resolution and/or rejection of the Promise.
Type Parameters
TResult1
TResult1 = EncryptedSupabaseResponse<Row[]>
TResult2
TResult2 = never
Parameters
onfulfilled?
The callback to execute when the Promise is resolved.
(value) => TResult1 | PromiseLike<TResult1> | null
onrejected?
The callback to execute when the Promise is rejected.
(reason) => TResult2 | PromiseLike<TResult2> | null
Returns
PromiseLike<TResult1 | TResult2>
A Promise for the completion of which ever callback is executed.
Inherited from
EncryptedQueryBuilderCore.then
EncryptedSupabaseInstance
Defined in: types.ts:425
Untyped instance (no schemas): rows default to Record<string, unknown>
and from accepts any table name.
Methods
from()
from<Row>(tableName): EncryptedQueryBuilderUntyped<Row>;Defined in: types.ts:426
Type Parameters
Row
Row extends object = Record<string, unknown>
Parameters
tableName
string
Returns
EncryptedQueryBuilderUntyped<Row>
TypedEncryptedSupabaseInstance
Defined in: types.ts:445
Typed instance (with schemas: S): a declared table name resolves to the
narrowed v3 builder; any other table name falls back to the untyped surface.
The fallback overload is REQUIRED, not a convenience. The design spec
promises a gradient — "declare one table, leave the rest introspected;
undeclared tables behave exactly as they would with no schemas at all".
With only the keyof S overload, schemas: { users } makes from('orders')
a compile error even though orders was introspected and works perfectly at
runtime. Declaring one table would silently make every other table
unreachable.
Overload order matters: the literal-constrained signature is declared first,
so TypeScript prefers it whenever the argument is a declared key and only
falls through to string otherwise.
Type Parameters
S
S extends V3Schemas
Methods
from()
Call Signature
from<K>(table): EncryptedQueryBuilder<S[K], InferPlaintext<S[K]>>;Defined in: types.ts:446
Type Parameters
K
K extends string
Parameters
table
K
Returns
EncryptedQueryBuilder<S[K], InferPlaintext<S[K]>>
Call Signature
from<Row>(table): EncryptedQueryBuilderUntyped<Row>;Defined in: types.ts:449
Type Parameters
Row
Row extends object = Record<string, unknown>
Parameters
table
string
Returns
EncryptedQueryBuilderUntyped<Row>
EncryptedSingleQueryBuilder
Defined in: types.ts:482
The builder returned by single()/maybeSingle(): awaits to a SINGLE row
(data: T | null) instead of an array.
FILTERS and TRANSFORMS are deliberately absent — applying one after single()
would change the query the single-row promise was made about.
What IS carried is exactly: then (via PromiseLike), abortSignal,
throwOnError, returns, withLockContext and audit. That is a
hand-written list, not a passthrough. It narrows the static API only:
single()/maybeSingle() return the same builder instance, so a method
omitted here is still a property of that object at runtime — the type is what
stops you reaching it, not the implementation.
It is therefore NOT parity with postgrest-js, which carries a different set:
its single() returns a PostgrestBuilder, carrying
returns/overrideTypes/throwOnError/setHeader (and NOT abortSignal,
which lives on PostgrestTransformBuilder). Relative to that, this adapter
keeps abortSignal as a deliberate superset — an abort is not a query change
— and adds the two encryption-specific configurators, which the runtime reads
at execute time and so remain valid after single(); but postgrest-js's
overrideTypes and setHeader have NO adapter equivalent, on this surface or
any other.
Extends
PromiseLike<EncryptedSupabaseResponse<T>>
Type Parameters
T
T
Methods
abortSignal()
abortSignal(signal): EncryptedSingleQueryBuilder<T>;Defined in: types.ts:484
Parameters
signal
AbortSignal
Returns
EncryptedSingleQueryBuilder<T>
throwOnError()
throwOnError(): EncryptedSingleQueryBuilder<T>;Defined in: types.ts:485
Returns
EncryptedSingleQueryBuilder<T>
returns()
returns<U>(): EncryptedSingleQueryBuilder<U>;Defined in: types.ts:490
Re-type the ROW. The single-row awaited shape is preserved — U, not U[].
object, not Record<string, unknown>: an interface row type has no
implicit index signature and would be rejected by the latter (upstream
postgrest-js constrains its returns type parameter not at all).
Type Parameters
U
U extends object
Returns
EncryptedSingleQueryBuilder<U>
withLockContext()
withLockContext(lockContext): EncryptedSingleQueryBuilder<T>;Defined in: types.ts:492
Bind identity-aware encryption. Read at execute time, so order-independent.
Parameters
lockContext
LockContextInput
Returns
EncryptedSingleQueryBuilder<T>
audit()
audit(config): EncryptedSingleQueryBuilder<T>;Defined in: types.ts:494
Attach audit metadata. Read at execute time, so order-independent.
Parameters
config
AuditConfig
Returns
EncryptedSingleQueryBuilder<T>
then()
then<TResult1, TResult2>(onfulfilled?, onrejected?): PromiseLike<TResult1 | TResult2>;Defined in: ../../../../node_modules/typescript/lib/lib.es5.d.ts:1544
Attaches callbacks for the resolution and/or rejection of the Promise.
Type Parameters
TResult1
TResult1 = EncryptedSupabaseResponse<T>
TResult2
TResult2 = never
Parameters
onfulfilled?
The callback to execute when the Promise is resolved.
(value) => TResult1 | PromiseLike<TResult1> | null
onrejected?
The callback to execute when the Promise is rejected.
(reason) => TResult2 | PromiseLike<TResult2> | null
Returns
PromiseLike<TResult1 | TResult2>
A Promise for the completion of which ever callback is executed.
Inherited from
PromiseLike.thenSupabaseClientLike
Defined in: types.ts:806
Methods
from()
from(table): any;Defined in: types.ts:807
Parameters
table
string
Returns
any
EncryptedQueryBuilderCore
Defined in: types.ts:847
Every builder method shared by the TYPED (EncryptedQueryBuilder) and UNTYPED (EncryptedQueryBuilderUntyped) surfaces. Both are EQL v3 — they differ only in how much they can narrow, not in dialect.
Self is the concrete builder each method returns, so a surface that omits a
method does not have it laundered back in by a chained call whose return type
widened to the base interface.
Free-text search lives on the sub-interfaces rather than here, because its
key set differs between the two: matches() narrows to the encrypted
match/search columns on the typed surface, and to every row key on the
untyped one. Neither surface carries like/ilike — EQL v3 free-text is
fuzzy bloom-token matching, not SQL pattern matching, so the builder rewrites
a like on an encrypted column to matches at record time (see
query-builder.ts). They survive in this file only as the internal
FilterOp union and on the raw SupabaseQueryBuilder seam, both
of which still serve plaintext columns.
Extends
PromiseLike<EncryptedSupabaseResponse<T[]>>
Extended by
Type Parameters
T
T extends object
FK
FK extends StringKeyOf<T>
Self
Self
OK
OK extends StringKeyOf<T> = FK
BK
BK extends StringKeyOf<T> = FK
Methods
select()
select(columns?, options?): Self;Defined in: types.ts:866
columns defaults to '*', matching supabase-js. A '*' select expands
to the introspected column list; when none is available (a client that
could not introspect) both select() and select('*') throw, because an
unexpanded * cannot cast the encrypted columns with ::jsonb.
Parameters
columns?
string
options?
head?
boolean
count?
"exact" | "planned" | "estimated"
Returns
Self
insert()
insert(data, options?): Self;Defined in: types.ts:870
Parameters
data
Partial<T> | Partial<T>[]
options?
count?
"exact" | "planned" | "estimated"
defaultToNull?
boolean
onConflict?
string
Returns
Self
update()
update(data, options?): Self;Defined in: types.ts:878
Parameters
data
Partial<T>
options?
count?
"exact" | "planned" | "estimated"
Returns
Self
upsert()
upsert(data, options?): Self;Defined in: types.ts:882
Parameters
data
Partial<T> | Partial<T>[]
options?
count?
"exact" | "planned" | "estimated"
onConflict?
string
ignoreDuplicates?
boolean
defaultToNull?
boolean
Returns
Self
delete()
delete(options?): Self;Defined in: types.ts:891
Parameters
options?
count?
"exact" | "planned" | "estimated"
Returns
Self
eq()
eq<K>(column, value): Self;Defined in: types.ts:892
Type Parameters
K
K extends string
Parameters
column
K
value
T[K]
Returns
Self
neq()
neq<K>(column, value): Self;Defined in: types.ts:893
Type Parameters
K
K extends string
Parameters
column
K
value
T[K]
Returns
Self
gt()
gt<K>(column, value): Self;Defined in: types.ts:894
Type Parameters
K
K extends string
Parameters
column
K
value
T[K]
Returns
Self
gte()
gte<K>(column, value): Self;Defined in: types.ts:895
Type Parameters
K
K extends string
Parameters
column
K
value
T[K]
Returns
Self
lt()
lt<K>(column, value): Self;Defined in: types.ts:896
Type Parameters
K
K extends string
Parameters
column
K
value
T[K]
Returns
Self
lte()
lte<K>(column, value): Self;Defined in: types.ts:897
Type Parameters
K
K extends string
Parameters
column
K
value
T[K]
Returns
Self
is()
Call Signature
is<K>(column, value): Self;Defined in: types.ts:917
IS NULL / IS TRUE / IS FALSE.
The null form is widened to EVERY row key, not just the filterable ones.
is is the one predicate never encrypted — isEncryptableTerm rejects it
outright, so no term is collected and no capability guard runs — and a NULL
plaintext is stored as a SQL NULL rather than a ciphertext. On a v3
storage-only column (types.Boolean, types.Integer, …) IS NULL is
therefore not merely legal but the ONLY predicate available, so narrowing it
to FK would deny the sole query those columns support.
The boolean form narrows to BK: IS TRUE against a jsonb ciphertext
column compares an envelope to a plaintext boolean, which is a type error in
the database, not a filter. FK is the wrong gate for it — that set
excludes only the STORAGE-ONLY columns, so a queryable encrypted column
(types.TextSearch, types.TextEq, any *_ord) is in FK and would still
compile is(col, true). Every encrypted column stores an envelope,
capability or not, so BK excludes them all.
Type Parameters
K
K extends string
Parameters
column
K
value
boolean | null
Returns
Self
Call Signature
is<K>(column, value): Self;Defined in: types.ts:918
Type Parameters
K
K extends string
Parameters
column
K
value
null
Returns
Self
in()
in<K>(column, values): Self;Defined in: types.ts:919
Type Parameters
K
K extends string
Parameters
column
K
values
T[K][]
Returns
Self
filter()
filter<K>(
column,
operator,
value): Self;Defined in: types.ts:920
Type Parameters
K
K extends string
Parameters
column
K
operator
string
value
T[K]
Returns
Self
not()
not<K>(
column,
operator,
value): Self;Defined in: types.ts:921
Type Parameters
K
K extends string
Parameters
column
K
operator
string
value
T[K]
Returns
Self
or()
Call Signature
or(filters, options?): Self;Defined in: types.ts:922
Parameters
filters
string
options?
referencedTable?
string
foreignTable?
string
Returns
Self
Call Signature
or(conditions, options?): Self;Defined in: types.ts:926
Parameters
conditions
options?
referencedTable?
string
foreignTable?
string
Returns
Self
match()
match(query): Self;Defined in: types.ts:930
Parameters
query
Partial<T>
Returns
Self
order()
order<K>(column, options?): Self;Defined in: types.ts:935
Type Parameters
K
K extends string
Parameters
column
K
options?
ascending?
boolean
nullsFirst?
boolean
referencedTable?
string
foreignTable?
string
Returns
Self
limit()
limit(count, options?): Self;Defined in: types.ts:944
Parameters
count
number
options?
referencedTable?
string
foreignTable?
string
Returns
Self
range()
range(
from,
to,
options?): Self;Defined in: types.ts:948
Parameters
from
number
to
number
options?
referencedTable?
string
foreignTable?
string
Returns
Self
single()
single(): EncryptedSingleQueryBuilder<T>;Defined in: types.ts:963
Return ONE row rather than an array — so the awaited data is T | null,
not T[]. Returns EncryptedSingleQueryBuilder rather than Self
because that change of shape is the whole point of the call: typing it
Self would keep promising T[] while the runtime hands back one object,
forcing every caller through a cast (data as unknown as Row).
Filters and transforms are not chainable afterwards, matching supabase-js —
single() is applied last.
Returns
EncryptedSingleQueryBuilder<T>
maybeSingle()
maybeSingle(): EncryptedSingleQueryBuilder<T>;Defined in: types.ts:967
As single, but a zero-row result is data: null rather than an
error. Same T | null awaited shape — single() reports the missing row
through error instead.
Returns
EncryptedSingleQueryBuilder<T>
csv()
csv(): Self;Defined in: types.ts:978
Always THROWS. PostgREST serializes rows server-side, so a CSV response
carries ciphertext the adapter never gets to decrypt. Declared so the call
is a loud runtime failure rather than a missing method, and typed Self
only to keep the chain shape — it never returns. Select rows normally and
serialize the decrypted data yourself.
Returns
Self
Deprecated
Always throws on an encrypted query — select the rows normally, then serialize the decrypted data to CSV yourself.
abortSignal()
abortSignal(signal): Self;Defined in: types.ts:979
Parameters
signal
AbortSignal
Returns
Self
throwOnError()
throwOnError(): Self;Defined in: types.ts:980
Returns
Self
returns()
returns<U>(): EncryptedQueryBuilderUntyped<U>;Defined in: types.ts:985
Escape hatch: re-types the rows and drops back to the untyped v3 builder
surface. object, not Record<string, unknown>: an interface row type
has no implicit index signature and would be rejected by the latter, while
object still excludes string/number row types.
Type Parameters
U
U extends object
Returns
EncryptedQueryBuilderUntyped<U>
withLockContext()
withLockContext(lockContext): Self;Defined in: types.ts:988
Bind identity-aware encryption. Accepts either a plain
{ identityClaim } (the common form) or a LockContext instance.
Parameters
lockContext
LockContextInput
Returns
Self
audit()
audit(config): Self;Defined in: types.ts:989
Parameters
config
AuditConfig
Returns
Self
then()
then<TResult1, TResult2>(onfulfilled?, onrejected?): PromiseLike<TResult1 | TResult2>;Defined in: ../../../../node_modules/typescript/lib/lib.es5.d.ts:1544
Attaches callbacks for the resolution and/or rejection of the Promise.
Type Parameters
TResult1
TResult1 = EncryptedSupabaseResponse<T[]>
TResult2
TResult2 = never
Parameters
onfulfilled?
The callback to execute when the Promise is resolved.
(value) => TResult1 | PromiseLike<TResult1> | null
onrejected?
The callback to execute when the Promise is rejected.
(reason) => TResult2 | PromiseLike<TResult2> | null
Returns
PromiseLike<TResult1 | TResult2>
A Promise for the completion of which ever callback is executed.
Inherited from
PromiseLike.thenType Aliases
V3Schemas
type V3Schemas = Record<string, AnyV3Table>;Defined in: schema-builder.ts:7
A record of declared v3 tables, keyed by table name.
EncryptedSupabaseOptions
type EncryptedSupabaseOptions<S> = {
databaseUrl?: string;
config?: ClientConfig;
schemas?: S;
};Defined in: types.ts:26
Options for import('./index').encryptedSupabase.
Type Parameters
S
S extends
| V3Schemas
| undefined = undefined
declared v3 tables. When present, from() is constrained to
the declared table names and returns typed builders, and the tables are
verified against the database at construction.
Properties
databaseUrl?
optional databaseUrl: string;Defined in: types.ts:31
Postgres connection string for introspection. Defaults to
process.env.DATABASE_URL.
config?
optional config: ClientConfig;Defined in: types.ts:33
Passed through to the v3-only encryption client.
schemas?
optional schemas: S;Defined in: types.ts:45
Optional declared v3 tables, keyed by table name (each record key MUST
equal its table's tableName). Declaring a table adds compile-time types
and startup verification; undeclared tables behave exactly as with no
schemas.
Declaring a text_search column does NOT change its match behaviour: a
declared and a synthesized text_search column build byte-identically, and
neither types.TextSearch nor EncryptedTextSearchColumn accepts match
options. See the contains note on EncryptedQueryBuilderImpl.
FilterableKeys
type FilterableKeys<Table, Row> = Exclude<Extract<keyof Row, string>, NonScalarQueryableV3Keys<Table>>;Defined in: types.ts:106
Row keys a v3 builder accepts in SCALAR filter methods: every row key except
the table's encrypted columns with no scalar capability (storage-only
columns, and types.Json documents — see NonScalarQueryableV3Keys;
before #650's searchableJson arm the two sets coincided). Plaintext
(non-schema) columns pass through untouched.
Type Parameters
Table
Table extends AnyV3Table
Row
Row extends Record<string, unknown>
FreeTextSearchableKeys
type FreeTextSearchableKeys<Table, Row> = Exclude<Extract<keyof Row, string>, NonFreeTextSearchV3Keys<Table>>;Defined in: types.ts:132
Row keys a v3 builder accepts in contains(): every row key except the
table's encrypted columns that lack a match index. Plaintext columns pass
through, where contains is PostgREST's native jsonb/array containment.
Type Parameters
Table
Table extends AnyV3Table
Row
Row extends Record<string, unknown>
EncryptedSupabaseResponse
type EncryptedSupabaseResponse<T> = {
data: T | null;
error: | EncryptedSupabaseError
| null;
count: number | null;
status: number;
statusText: string;
};Defined in: types.ts:497
Type Parameters
T
T
Properties
data
data: T | null;Defined in: types.ts:498
error
error:
| EncryptedSupabaseError
| null;Defined in: types.ts:499
count
count: number | null;Defined in: types.ts:500
status
status: number;Defined in: types.ts:501
statusText
statusText: string;Defined in: types.ts:502
EncryptedSupabaseError
type EncryptedSupabaseError = {
message: string;
details?: string;
hint?: string;
code?: string;
encryptionError?: EncryptionError;
};Defined in: types.ts:505
Properties
message
message: string;Defined in: types.ts:506
details?
optional details: string;Defined in: types.ts:507
hint?
optional hint: string;Defined in: types.ts:508
code?
optional code: string;Defined in: types.ts:509
encryptionError?
optional encryptionError: EncryptionError;Defined in: types.ts:510
PendingOrCondition
type PendingOrCondition = {
column: string;
op: FilterOp;
negate?: boolean;
value: unknown;
sourceSpan?: {
start: number;
end: number;
};
};Defined in: types.ts:549
Properties
column
column: string;Defined in: types.ts:550
op
op: FilterOp;Defined in: types.ts:551
negate?
optional negate: boolean;Defined in: types.ts:554
PostgREST's column.not.<op>.<value> negation. Kept off op so the
in-list split and the query-type mapping both key on the real operator.
value
value: unknown;Defined in: types.ts:555
sourceSpan?
optional sourceSpan: {
start: number;
end: number;
};Defined in: types.ts:559
Character range in the caller's original string-form .or() expression.
Internal only: lets the encrypted adapter replace this leaf without
rebuilding (and corrupting) surrounding and(...) / or(...) groups.
start
start: number;end
end: number;EncryptedSupabaseV3Options
type EncryptedSupabaseV3Options<S> = EncryptedSupabaseOptions<S>;Defined in: types.ts:999
Type Parameters
S
S extends
| V3Schemas
| undefined = undefined
Deprecated
V3FilterableKeys
type V3FilterableKeys<Table, Row> = FilterableKeys<Table, Row>;Defined in: types.ts:1008
Type Parameters
Table
Table extends AnyV3Table
Row
Row extends Record<string, unknown>
Deprecated
Use FilterableKeys.
V3FreeTextSearchableKeys
type V3FreeTextSearchableKeys<Table, Row> = FreeTextSearchableKeys<Table, Row>;Defined in: types.ts:1014
Type Parameters
Table
Table extends AnyV3Table
Row
Row extends Record<string, unknown>
Deprecated
EncryptedQueryBuilderV3
type EncryptedQueryBuilderV3<Table, Row> = EncryptedQueryBuilder<Table, Row>;Defined in: types.ts:1048
Type Parameters
Table
Table extends AnyV3Table
Row
Row extends Record<string, unknown>
Deprecated
EncryptedQueryBuilderV3Untyped
type EncryptedQueryBuilderV3Untyped<Row> = EncryptedQueryBuilderUntyped<Row>;Defined in: types.ts:1054
Type Parameters
Row
Row extends Record<string, unknown>
Deprecated
Use EncryptedQueryBuilderUntyped.
EncryptedSupabaseV3Instance
type EncryptedSupabaseV3Instance = EncryptedSupabaseInstance;Defined in: types.ts:1059
Deprecated
Use EncryptedSupabaseInstance.
TypedEncryptedSupabaseV3Instance
type TypedEncryptedSupabaseV3Instance<S> = TypedEncryptedSupabaseInstance<S>;Defined in: types.ts:1062
Type Parameters
S
S extends V3Schemas
Deprecated
Use TypedEncryptedSupabaseInstance.
Variables
encryptedSupabaseV3()
const encryptedSupabaseV3: {
<S> (supabaseUrl, supabaseKey, options): Promise<TypedEncryptedSupabaseInstance<S>>;
(supabaseUrl, supabaseKey, options?): Promise<EncryptedSupabaseInstance>;
<S> (supabaseClient, options): Promise<TypedEncryptedSupabaseInstance<S>>;
(supabaseClient, options?): Promise<EncryptedSupabaseInstance>;
} = encryptedSupabase;Defined in: index.ts:275
Call Signature
<S>(
supabaseUrl,
supabaseKey,
options): Promise<TypedEncryptedSupabaseInstance<S>>;Create an encrypted Supabase wrapper over native EQL v3 column domains by
introspecting the database at connect time. Detects EQL v3 columns by their
Postgres domain and derives each column's encryption config from it — callers
do not pass a schema to from(). Supplying schemas is optional: it adds
compile-time types and verifies the declared tables against the database at
construction.
Encrypted data is stored as EQL v3 payloads. This wrapper is EQL v3 only — it
both authors and reads v3, and the legacy v2 authoring surface (a hand-written
client-side schema and from(tableName, schema)) has been removed. It does
not auto-read an eql_v2_encrypted column: introspection recognises the
public.eql_v3_* domains exclusively, so a v2 column never enters the
encrypt config and is returned as an untouched passthrough. No v2 ciphertext
is stranded — decryption in @cipherstash/stack is generation-agnostic, so
legacy payloads still decrypt through the core client (decrypt /
decryptModel). Handle mixed-generation data explicitly on the caller side.
Requires a Postgres connection (options.databaseUrl or DATABASE_URL) for
introspection, so it cannot run in a Worker or the browser.
A column is an EQL v3 column when its type is one of the public domains the
EQL v3 bundle installs. The domain names the capabilities, and introspection
turns it into the column's encryption config:
CREATE TABLE users (
id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
email public.eql_v3_text_search, -- equality, ordering, free-text match
age public.eql_v3_integer_ord, -- equality, ordering
name text -- plaintext passthrough, untouched
);Type Parameters
S
S extends V3Schemas
Parameters
supabaseUrl
string
supabaseKey
string
options
EncryptedSupabaseOptions<S> & {
schemas: S;
}
Returns
Promise<TypedEncryptedSupabaseInstance<S>>
Example
const supabase = await encryptedSupabase(supabaseUrl, supabaseKey)
await supabase.from('users').insert({ email: '[email protected]' })
const { data } = await supabase.from('users').select().eq('email', '[email protected]')Call Signature
(
supabaseUrl,
supabaseKey,
options?): Promise<EncryptedSupabaseInstance>;Create an encrypted Supabase wrapper over native EQL v3 column domains by
introspecting the database at connect time. Detects EQL v3 columns by their
Postgres domain and derives each column's encryption config from it — callers
do not pass a schema to from(). Supplying schemas is optional: it adds
compile-time types and verifies the declared tables against the database at
construction.
Encrypted data is stored as EQL v3 payloads. This wrapper is EQL v3 only — it
both authors and reads v3, and the legacy v2 authoring surface (a hand-written
client-side schema and from(tableName, schema)) has been removed. It does
not auto-read an eql_v2_encrypted column: introspection recognises the
public.eql_v3_* domains exclusively, so a v2 column never enters the
encrypt config and is returned as an untouched passthrough. No v2 ciphertext
is stranded — decryption in @cipherstash/stack is generation-agnostic, so
legacy payloads still decrypt through the core client (decrypt /
decryptModel). Handle mixed-generation data explicitly on the caller side.
Requires a Postgres connection (options.databaseUrl or DATABASE_URL) for
introspection, so it cannot run in a Worker or the browser.
A column is an EQL v3 column when its type is one of the public domains the
EQL v3 bundle installs. The domain names the capabilities, and introspection
turns it into the column's encryption config:
CREATE TABLE users (
id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
email public.eql_v3_text_search, -- equality, ordering, free-text match
age public.eql_v3_integer_ord, -- equality, ordering
name text -- plaintext passthrough, untouched
);Parameters
supabaseUrl
string
supabaseKey
string
options?
Returns
Promise<EncryptedSupabaseInstance>
Example
const supabase = await encryptedSupabase(supabaseUrl, supabaseKey)
await supabase.from('users').insert({ email: '[email protected]' })
const { data } = await supabase.from('users').select().eq('email', '[email protected]')Call Signature
<S>(supabaseClient, options): Promise<TypedEncryptedSupabaseInstance<S>>;Create an encrypted Supabase wrapper over native EQL v3 column domains by
introspecting the database at connect time. Detects EQL v3 columns by their
Postgres domain and derives each column's encryption config from it — callers
do not pass a schema to from(). Supplying schemas is optional: it adds
compile-time types and verifies the declared tables against the database at
construction.
Encrypted data is stored as EQL v3 payloads. This wrapper is EQL v3 only — it
both authors and reads v3, and the legacy v2 authoring surface (a hand-written
client-side schema and from(tableName, schema)) has been removed. It does
not auto-read an eql_v2_encrypted column: introspection recognises the
public.eql_v3_* domains exclusively, so a v2 column never enters the
encrypt config and is returned as an untouched passthrough. No v2 ciphertext
is stranded — decryption in @cipherstash/stack is generation-agnostic, so
legacy payloads still decrypt through the core client (decrypt /
decryptModel). Handle mixed-generation data explicitly on the caller side.
Requires a Postgres connection (options.databaseUrl or DATABASE_URL) for
introspection, so it cannot run in a Worker or the browser.
A column is an EQL v3 column when its type is one of the public domains the
EQL v3 bundle installs. The domain names the capabilities, and introspection
turns it into the column's encryption config:
CREATE TABLE users (
id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
email public.eql_v3_text_search, -- equality, ordering, free-text match
age public.eql_v3_integer_ord, -- equality, ordering
name text -- plaintext passthrough, untouched
);Type Parameters
S
S extends V3Schemas
Parameters
supabaseClient
options
EncryptedSupabaseOptions<S> & {
schemas: S;
}
Returns
Promise<TypedEncryptedSupabaseInstance<S>>
Example
const supabase = await encryptedSupabase(supabaseUrl, supabaseKey)
await supabase.from('users').insert({ email: '[email protected]' })
const { data } = await supabase.from('users').select().eq('email', '[email protected]')Call Signature
(supabaseClient, options?): Promise<EncryptedSupabaseInstance>;Create an encrypted Supabase wrapper over native EQL v3 column domains by
introspecting the database at connect time. Detects EQL v3 columns by their
Postgres domain and derives each column's encryption config from it — callers
do not pass a schema to from(). Supplying schemas is optional: it adds
compile-time types and verifies the declared tables against the database at
construction.
Encrypted data is stored as EQL v3 payloads. This wrapper is EQL v3 only — it
both authors and reads v3, and the legacy v2 authoring surface (a hand-written
client-side schema and from(tableName, schema)) has been removed. It does
not auto-read an eql_v2_encrypted column: introspection recognises the
public.eql_v3_* domains exclusively, so a v2 column never enters the
encrypt config and is returned as an untouched passthrough. No v2 ciphertext
is stranded — decryption in @cipherstash/stack is generation-agnostic, so
legacy payloads still decrypt through the core client (decrypt /
decryptModel). Handle mixed-generation data explicitly on the caller side.
Requires a Postgres connection (options.databaseUrl or DATABASE_URL) for
introspection, so it cannot run in a Worker or the browser.
A column is an EQL v3 column when its type is one of the public domains the
EQL v3 bundle installs. The domain names the capabilities, and introspection
turns it into the column's encryption config:
CREATE TABLE users (
id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
email public.eql_v3_text_search, -- equality, ordering, free-text match
age public.eql_v3_integer_ord, -- equality, ordering
name text -- plaintext passthrough, untouched
);Parameters
supabaseClient
options?
Returns
Promise<EncryptedSupabaseInstance>
Example
const supabase = await encryptedSupabase(supabaseUrl, supabaseKey)
await supabase.from('users').insert({ email: '[email protected]' })
const { data } = await supabase.from('users').select().eq('email', '[email protected]')Deprecated
Use encryptedSupabase. encryptedSupabaseV3 is a
type-identical alias kept for existing imports; the V3 suffix is redundant
now that EQL v3 is the only generation this wrapper authors.
Functions
encryptedSupabase()
Call Signature
function encryptedSupabase<S>(
supabaseUrl,
supabaseKey,
options): Promise<TypedEncryptedSupabaseInstance<S>>;Defined in: index.ts:85
Create an encrypted Supabase wrapper over native EQL v3 column domains by
introspecting the database at connect time. Detects EQL v3 columns by their
Postgres domain and derives each column's encryption config from it — callers
do not pass a schema to from(). Supplying schemas is optional: it adds
compile-time types and verifies the declared tables against the database at
construction.
Encrypted data is stored as EQL v3 payloads. This wrapper is EQL v3 only — it
both authors and reads v3, and the legacy v2 authoring surface (a hand-written
client-side schema and from(tableName, schema)) has been removed. It does
not auto-read an eql_v2_encrypted column: introspection recognises the
public.eql_v3_* domains exclusively, so a v2 column never enters the
encrypt config and is returned as an untouched passthrough. No v2 ciphertext
is stranded — decryption in @cipherstash/stack is generation-agnostic, so
legacy payloads still decrypt through the core client (decrypt /
decryptModel). Handle mixed-generation data explicitly on the caller side.
Requires a Postgres connection (options.databaseUrl or DATABASE_URL) for
introspection, so it cannot run in a Worker or the browser.
A column is an EQL v3 column when its type is one of the public domains the
EQL v3 bundle installs. The domain names the capabilities, and introspection
turns it into the column's encryption config:
CREATE TABLE users (
id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
email public.eql_v3_text_search, -- equality, ordering, free-text match
age public.eql_v3_integer_ord, -- equality, ordering
name text -- plaintext passthrough, untouched
);Type Parameters
S
S extends V3Schemas
Parameters
supabaseUrl
string
supabaseKey
string
options
EncryptedSupabaseOptions<S> & {
schemas: S;
}
Returns
Promise<TypedEncryptedSupabaseInstance<S>>
Example
const supabase = await encryptedSupabase(supabaseUrl, supabaseKey)
await supabase.from('users').insert({ email: '[email protected]' })
const { data } = await supabase.from('users').select().eq('email', '[email protected]')Call Signature
function encryptedSupabase(
supabaseUrl,
supabaseKey,
options?): Promise<EncryptedSupabaseInstance>;Defined in: index.ts:90
Create an encrypted Supabase wrapper over native EQL v3 column domains by
introspecting the database at connect time. Detects EQL v3 columns by their
Postgres domain and derives each column's encryption config from it — callers
do not pass a schema to from(). Supplying schemas is optional: it adds
compile-time types and verifies the declared tables against the database at
construction.
Encrypted data is stored as EQL v3 payloads. This wrapper is EQL v3 only — it
both authors and reads v3, and the legacy v2 authoring surface (a hand-written
client-side schema and from(tableName, schema)) has been removed. It does
not auto-read an eql_v2_encrypted column: introspection recognises the
public.eql_v3_* domains exclusively, so a v2 column never enters the
encrypt config and is returned as an untouched passthrough. No v2 ciphertext
is stranded — decryption in @cipherstash/stack is generation-agnostic, so
legacy payloads still decrypt through the core client (decrypt /
decryptModel). Handle mixed-generation data explicitly on the caller side.
Requires a Postgres connection (options.databaseUrl or DATABASE_URL) for
introspection, so it cannot run in a Worker or the browser.
A column is an EQL v3 column when its type is one of the public domains the
EQL v3 bundle installs. The domain names the capabilities, and introspection
turns it into the column's encryption config:
CREATE TABLE users (
id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
email public.eql_v3_text_search, -- equality, ordering, free-text match
age public.eql_v3_integer_ord, -- equality, ordering
name text -- plaintext passthrough, untouched
);Parameters
supabaseUrl
string
supabaseKey
string
options?
Returns
Promise<EncryptedSupabaseInstance>
Example
const supabase = await encryptedSupabase(supabaseUrl, supabaseKey)
await supabase.from('users').insert({ email: '[email protected]' })
const { data } = await supabase.from('users').select().eq('email', '[email protected]')Call Signature
function encryptedSupabase<S>(supabaseClient, options): Promise<TypedEncryptedSupabaseInstance<S>>;Defined in: index.ts:95
Create an encrypted Supabase wrapper over native EQL v3 column domains by
introspecting the database at connect time. Detects EQL v3 columns by their
Postgres domain and derives each column's encryption config from it — callers
do not pass a schema to from(). Supplying schemas is optional: it adds
compile-time types and verifies the declared tables against the database at
construction.
Encrypted data is stored as EQL v3 payloads. This wrapper is EQL v3 only — it
both authors and reads v3, and the legacy v2 authoring surface (a hand-written
client-side schema and from(tableName, schema)) has been removed. It does
not auto-read an eql_v2_encrypted column: introspection recognises the
public.eql_v3_* domains exclusively, so a v2 column never enters the
encrypt config and is returned as an untouched passthrough. No v2 ciphertext
is stranded — decryption in @cipherstash/stack is generation-agnostic, so
legacy payloads still decrypt through the core client (decrypt /
decryptModel). Handle mixed-generation data explicitly on the caller side.
Requires a Postgres connection (options.databaseUrl or DATABASE_URL) for
introspection, so it cannot run in a Worker or the browser.
A column is an EQL v3 column when its type is one of the public domains the
EQL v3 bundle installs. The domain names the capabilities, and introspection
turns it into the column's encryption config:
CREATE TABLE users (
id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
email public.eql_v3_text_search, -- equality, ordering, free-text match
age public.eql_v3_integer_ord, -- equality, ordering
name text -- plaintext passthrough, untouched
);Type Parameters
S
S extends V3Schemas
Parameters
supabaseClient
options
EncryptedSupabaseOptions<S> & {
schemas: S;
}
Returns
Promise<TypedEncryptedSupabaseInstance<S>>
Example
const supabase = await encryptedSupabase(supabaseUrl, supabaseKey)
await supabase.from('users').insert({ email: '[email protected]' })
const { data } = await supabase.from('users').select().eq('email', '[email protected]')Call Signature
function encryptedSupabase(supabaseClient, options?): Promise<EncryptedSupabaseInstance>;Defined in: index.ts:99
Create an encrypted Supabase wrapper over native EQL v3 column domains by
introspecting the database at connect time. Detects EQL v3 columns by their
Postgres domain and derives each column's encryption config from it — callers
do not pass a schema to from(). Supplying schemas is optional: it adds
compile-time types and verifies the declared tables against the database at
construction.
Encrypted data is stored as EQL v3 payloads. This wrapper is EQL v3 only — it
both authors and reads v3, and the legacy v2 authoring surface (a hand-written
client-side schema and from(tableName, schema)) has been removed. It does
not auto-read an eql_v2_encrypted column: introspection recognises the
public.eql_v3_* domains exclusively, so a v2 column never enters the
encrypt config and is returned as an untouched passthrough. No v2 ciphertext
is stranded — decryption in @cipherstash/stack is generation-agnostic, so
legacy payloads still decrypt through the core client (decrypt /
decryptModel). Handle mixed-generation data explicitly on the caller side.
Requires a Postgres connection (options.databaseUrl or DATABASE_URL) for
introspection, so it cannot run in a Worker or the browser.
A column is an EQL v3 column when its type is one of the public domains the
EQL v3 bundle installs. The domain names the capabilities, and introspection
turns it into the column's encryption config:
CREATE TABLE users (
id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
email public.eql_v3_text_search, -- equality, ordering, free-text match
age public.eql_v3_integer_ord, -- equality, ordering
name text -- plaintext passthrough, untouched
);Parameters
supabaseClient
options?
Returns
Promise<EncryptedSupabaseInstance>
Example
const supabase = await encryptedSupabase(supabaseUrl, supabaseKey)
await supabase.from('users').insert({ email: '[email protected]' })
const { data } = await supabase.from('users').select().eq('email', '[email protected]')Edge Functions
Run CipherStash encryption inside Supabase Edge Functions using the @cipherstash/stack WebAssembly build, with the CipherStash token cached across invocations in an HTTP-only cookie.
Overview
Searchable field-level encryption for Prisma ORM 8: declare encrypted columns in schema.prisma and query them with the Prisma ORM.