Exports available from the `@cipherstash/stack` package root. Package exports in the @cipherstash/stack TypeScript API reference.

Package exports

Exports available from the @cipherstash/stack package root.

Interfaces

TokenResult

Defined in: ../../../node_modules/.bun/@[email protected]/node_modules/@cipherstash/auth/native.d.ts:11

The result of a successful getToken() call.

Contains the bearer credential and decoded JWT claims for service discovery.

Properties

token

token: string;

Defined in: ../../../node_modules/.bun/@[email protected]/node_modules/@cipherstash/auth/native.d.ts:13

The bearer token string (used as Authorization: Bearer <token>).

subject

subject: string;

Defined in: ../../../node_modules/.bun/@[email protected]/node_modules/@cipherstash/auth/native.d.ts:15

The subject claim from the JWT (e.g. "CS|auth0|user123" or "CS|CSAKkeyId").

workspaceId

workspaceId: string;

Defined in: ../../../node_modules/.bun/@[email protected]/node_modules/@cipherstash/auth/native.d.ts:17

The workspace identifier from the JWT.

issuer

issuer: string;

Defined in: ../../../node_modules/.bun/@[email protected]/node_modules/@cipherstash/auth/native.d.ts:19

The issuer URL from the JWT iss claim (i.e. the CTS host).

services

services: Record&lt;string, string&gt;;

Defined in: ../../../node_modules/.bun/@[email protected]/node_modules/@cipherstash/auth/native.d.ts:21

Service endpoint URLs from the JWT services claim (e.g. { zerokms: "https://..." }).

EncryptionClient

Defined in: encryption/client-v3.ts:155

The client type Encryption resolves to for the schema tuple S: a strongly-typed view over the native FFI-backed client, for EQL v3 schemas.

Every method derives its types from the concrete table / column builder arguments (which carry their branded types at the call site), so:

encrypt / encryptQuery pin the plaintext to the column's domain type (text → string, timestamp → Date, …);
encryptQuery additionally constrains queryType to the column's capabilities and rejects storage-only columns outright;
encryptModel / bulkEncryptModels validate schema-column fields against their inferred plaintext type (passthrough fields are untouched) and return a precise encrypted model;
decryptModel / bulkDecryptModels return the precise plaintext model, reconstructing Date values from the encrypt-config cast_as.

This is the way to name the client — reach for it whenever you need to declare a variable, field or return type before the await that produces it:

const users = encryptedTable("users", { email: types.TextSearch("email") })

let client: EncryptionClient&lt;readonly [typeof users]&gt;
client = await Encryption({ schemas: [users] })

For code that is generic over its schemas — integration adapters that build a table per test family, say — name the loose array:

let client: EncryptionClient&lt;readonly AnyV3Table[]&gt;

That keeps table and column arguments checked, but NOT the model input: with S loose, V3ModelInput<AnyV3Table, T> cannot resolve a per-column plaintext, so encryptModel / bulkEncryptModels reject a Record<string, unknown> model. An adapter holding untyped rows needs a cast at that boundary (@cipherstash/stack-supabase has exactly one, for exactly this reason). Name a concrete tuple wherever the schema IS known statically — that is the only form with full model typing.

Prefer this named type to Awaited<ReturnType<typeof Encryption>> when the concrete schema tuple matters: TypeScript's ReturnType reads the final overload and therefore produces the intentionally widened default client.

Type Parameters

S

S extends readonly AnyV3Table[] = readonly AnyV3Table[]

the tuple of registered v3 tables; table arguments must be a member of this tuple.

Methods

encrypt()

encrypt&lt;Table, Col&gt;(plaintext, opts): EncryptOperation;

Defined in: encryption/client-v3.ts:158

Type Parameters

Table

Table extends AnyV3Table

Col

Col extends AnyEncryptedV3Column

Parameters

plaintext

PlaintextForColumn<Col>

opts

table

Table

column

Col

Returns

EncryptOperation

encryptQuery()

Call Signature

encryptQuery&lt;Table, Col, QT&gt;(plaintext, opts): EncryptQueryOperation;

Defined in: encryption/client-v3.ts:163

Type Parameters

Table

Table extends AnyV3Table

Col

Col extends AnyEncryptedV3Column

QT

QT extends "equality" | "orderAndRange" | "freeTextSearch" | "searchableJson" = QueryTypesForColumn<Col>

Parameters

plaintext

PlaintextForColumn<Col>

opts

table

Table

column

Col

queryType?

QT

returnType?

EncryptedReturnType

Returns

EncryptQueryOperation

Call Signature

encryptQuery(terms): BatchEncryptQueryOperation;

Defined in: encryption/client-v3.ts:178

Batch query terms remain correlated by table, column, value and capability.

Parameters

terms

readonly QueryTermForSchemas<S>[]

Returns

BatchEncryptQueryOperation

encryptModel()

encryptModel&lt;Table, T&gt;(input, table): EncryptModelOperation&lt;V3EncryptedModel&lt;Table, T&gt;>;

Defined in: encryption/client-v3.ts:182

Type Parameters

Table

Table extends AnyV3Table

T

T extends Record<string, unknown>

Parameters

input

V3ModelInput<Table, T>

table

Table

Returns

EncryptModelOperation<V3EncryptedModel<Table, T>>

bulkEncryptModels()

bulkEncryptModels&lt;Table, T&gt;(input, table): BulkEncryptModelsOperation&lt;V3EncryptedModel&lt;Table, T&gt;>;

Defined in: encryption/client-v3.ts:187

Type Parameters

Table

Table extends AnyV3Table

T

T extends Record<string, unknown>

Parameters

input

V3ModelInput<Table, T>[]

table

Table

Returns

BulkEncryptModelsOperation<V3EncryptedModel<Table, T>>

decrypt()

decrypt(encrypted): DecryptOperation;

Defined in: encryption/client-v3.ts:220

Decrypt a single stored payload, resolving to the FFI plaintext union (JsPlaintext) unchanged.

A date / timestamp column comes back as the string it was stored as, not a Date — where decryptModel(row, table) reconstructs it. Same value, two JavaScript types, depending on which method read it (#779).

The scalar form cannot be strongly typed: TypeScript has no way to know which column a runtime Encrypted came from, so the static type has to be the whole union. That is a statement about the type layer only. At runtime every payload carries its own i: { t, c } table/column identity, so for one of the tables this client was initialized with, the cast_as is reachable from here — skipping reconstruction is a deliberate contract line, not a missing capability. JsPlaintext excludes Date by construction, and that is the type callers have annotated against; reconstructing without widening it would make the type a lie.

(A payload from a table NOT in the client's schemas — the legacy EQL v2 read path — is the one case where the capability genuinely is absent: the i names a table there is no encrypt config to resolve. The contract is the same either way, which is why the boundary is drawn at the method and not per payload.)

For Date values, read through decryptModel / bulkDecryptModels with the table, or rebuild at the call site (new Date(value)).

Parameters

encrypted

EncryptedPayload

Returns

DecryptOperation

decryptModel()

Call Signature

decryptModel&lt;Table, T&gt;(
   input, 
   table, 
   lockContext): LockBoundDecryptModelOperation&lt;V3ModelInput&lt;Table, T&gt;>;

Defined in: encryption/client-v3.ts:239

Decrypt a model, returning the precise plaintext shape for table. Date columns are reconstructed from the encrypt-config cast_as.

Pass lockContext to decrypt identity-bound data — the same context that was supplied at encrypt time must be provided here (or chain .withLockContext() on the returned operation).

Returns a chainable AuditableDecryptModelOperation: await it for the Result, or chain .audit({ metadata }) / .withLockContext() first. The per-row Date reconstruction is applied to the successful result.

Passing lockContext positionally returns the LockBoundDecryptModelOperation instead, which offers .audit() but not .withLockContext() — a context binds exactly once, and binding twice throws.

Type Parameters

Table

Table extends AnyV3Table

T

T extends Record<string, unknown>

Parameters

input

T

table

Table

lockContext

LockContextInput | undefined

Returns

LockBoundDecryptModelOperation<V3ModelInput<Table, T>>

Call Signature

decryptModel&lt;Table, T&gt;(input, table): AuditableDecryptModelOperation&lt;V3ModelInput&lt;Table, T&gt;>;

Defined in: encryption/client-v3.ts:244

Type Parameters

Table

Table extends AnyV3Table

T

T extends Record<string, unknown>

Parameters

input

T

table

Table

Returns

AuditableDecryptModelOperation<V3ModelInput<Table, T>>

Call Signature

decryptModel&lt;T&gt;(input): AuditableDecryptModelOperation&lt;Decrypted&lt;T&gt;>;

Defined in: encryption/client-v3.ts:266

Table-less form: decrypt whatever encrypted fields the model carries, with no Date reconstruction and no precise plaintext shape. The table argument is what selects the reconstruction map, and Decrypted<T> types every decrypted field as string to match. (For a table that IS registered, the payload's own i: { t, c } would resolve the cast_as — declining to use it is what keeps this arity's runtime agreeing with its declared type. #779.)

This is the read path for rows that predate this client's schemas — legacy EQL v2 models above all, whose table is not, and cannot be, a member of S. It is also the arity the pre-v3 client exposed, so callers and adapters written against that shape keep compiling. The runtime has always accepted the one-arg call; without this signature the type layer forbids the very compatibility the client promises. Prefer the two-arg form whenever the table IS registered.

Type Parameters

T

T extends Record<string, unknown>

Parameters

input

T

Returns

AuditableDecryptModelOperation<Decrypted<T>>

bulkDecryptModels()

Call Signature

bulkDecryptModels&lt;Table, T&gt;(
   input, 
   table, 
   lockContext): LockBoundDecryptModelOperation&lt;V3ModelInput&lt;Table, T&gt;[]>;

Defined in: encryption/client-v3.ts:270

Type Parameters

Table

Table extends AnyV3Table

T

T extends Record<string, unknown>

Parameters

input

T[]

table

Table

lockContext

LockContextInput | undefined

Returns

LockBoundDecryptModelOperation<V3ModelInput<Table, T>[]>

Call Signature

bulkDecryptModels&lt;Table, T&gt;(input, table): AuditableDecryptModelOperation&lt;V3ModelInput&lt;Table, T&gt;[]>;

Defined in: encryption/client-v3.ts:275

Type Parameters

Table

Table extends AnyV3Table

T

T extends Record<string, unknown>

Parameters

input

T[]

table

Table

Returns

AuditableDecryptModelOperation<V3ModelInput<Table, T>[]>

Call Signature

bulkDecryptModels&lt;T&gt;(input): AuditableDecryptModelOperation&lt;Decrypted&lt;T&gt;[]>;

Defined in: encryption/client-v3.ts:281

Table-less bulk form — see the one-arg decryptModel overload.

Type Parameters

T

T extends Record<string, unknown>

Parameters

input

T[]

Returns

AuditableDecryptModelOperation<Decrypted<T>[]>

bulkEncrypt()

bulkEncrypt&lt;Table, Col&gt;(plaintexts, opts): BulkEncryptOperation;

Defined in: encryption/client-v3.ts:285

Type Parameters

Table

Table extends AnyV3Table

Col

Col extends AnyEncryptedV3Column

Parameters

plaintexts

BulkEncryptPayloadFor<Col>

opts

table

Table

column

Col

Returns

BulkEncryptOperation

bulkDecrypt()

bulkDecrypt(payloads): BulkDecryptOperation;

Defined in: encryption/client-v3.ts:299

Decrypt many stored payloads in one ZeroKMS round trip, position-stable with a per-item { data } | { error } entry.

Draws the same boundary as decrypt, for the same reason: no Date reconstruction — date-like columns arrive as their stored strings. Prefer bulkDecryptModels with the table when you want the column's declared plaintext type back (#779).

Parameters

payloads

BulkDecryptPayload

Returns

BulkDecryptOperation

getEncryptConfig()

getEncryptConfig(): 
  | {
  v: number;
  tables: Record&lt;string, Record&lt;string, {
     cast_as:   | "string"
        | "number"
        | "bigint"
        | "boolean"
        | "date"
        | "text"
        | "timestamp"
        | "json";
     indexes: {
        ore?: {
        };
        ope?: {
        };
        unique?: {
           token_filters?: {
              kind: ...;
           }[];
        };
        match?: {
           tokenizer?:   | {
              kind: "standard";
            }
              | {
              kind: "ngram";
              token_length: number;
            };
           token_filters?: {
              kind: ...;
           }[];
           k?: number;
           m?: number;
           include_original?: boolean;
        };
        ste_vec?: {
           prefix: string;
           array_index_mode?:   | "all"
              | "none"
              | {
              item?: ... | ... | ...;
              wildcard?: ... | ... | ...;
              position?: ... | ... | ...;
            };
           mode?: "standard" | "compat";
        };
     };
  }&gt;>;
}
  | undefined;

Defined in: encryption/client-v3.ts:300

Returns

| { v: number; tables: Record<string, Record<string, { cast_as: | "string" | "number" | "bigint" | "boolean" | "date" | "text" | "timestamp" | "json"; indexes: { ore?: { }; ope?: { }; unique?: { token_filters?: { kind: ...; }[]; }; match?: { tokenizer?: | { kind: "standard"; } | { kind: "ngram"; token_length: number; }; token_filters?: { kind: ...; }[]; k?: number; m?: number; include_original?: boolean; }; ste_vec?: { prefix: string; array_index_mode?: | "all" | "none" | { item?: ... | ... | ...; wildcard?: ... | ... | ...; position?: ... | ... | ...; }; mode?: "standard" | "compat"; }; }; }>>; } | undefined

Type Aliases

AuthFailure

type AuthFailure = 
  | FailureBase & {
  type: "REQUEST_ERROR";
}
  | FailureBase & {
  type: "ACCESS_DENIED";
}
  | FailureBase & {
  type: "EXPIRED_TOKEN";
}
  | FailureBase & {
  type: "INVALID_GRANT";
}
  | FailureBase & {
  type: "INVALID_CLIENT";
}
  | FailureBase & {
  type: "INVALID_URL";
}
  | FailureBase & {
  type: "INVALID_REGION";
}
  | FailureBase & {
  type: "INVALID_TOKEN";
}
  | FailureBase & {
  type: "SERVER_ERROR";
}
  | FailureBase & {
  type: "NOT_AUTHENTICATED";
}
  | FailureBase & {
  type: "MISSING_WORKSPACE_CRN";
}
  | FailureBase & {
  type: "INVALID_ACCESS_KEY";
}
  | FailureBase & {
  type: "INVALID_CRN";
}
  | FailureBase & {
  type: "WORKSPACE_MISMATCH";
  expected: string;
  actual: string;
}
  | FailureBase & {
  type: "INVALID_WORKSPACE_ID";
}
  | FailureBase & {
  type: "ALREADY_CONSUMED";
}
  | FailureBase & {
  type: "INTERNAL_ERROR";
}
  | FailureBase & {
  type: "CUSTOM";
}
  | FailureBase & {
  type: "STORE_ERROR";
};

Defined in: ../../../node_modules/.bun/@[email protected]/node_modules/@cipherstash/auth/index.d.ts:42

A domain failure returned in the failure arm of a Result. Discriminated by type; narrow on it to access per-variant payload (e.g. WORKSPACE_MISMATCH's expected/actual).

AuthErrorCode

type AuthErrorCode = AuthFailure["type"];

Defined in: ../../../node_modules/.bun/@[email protected]/node_modules/@cipherstash/auth/index.d.ts:64

The machine-readable discriminant carried by every AuthFailure.

AccessKeyStrategy

type AccessKeyStrategy = InstanceType&lt;typeof auth.AccessKeyStrategy&gt;;

Defined in: index.ts:26

AutoStrategy

type AutoStrategy = InstanceType&lt;typeof auth.AutoStrategy&gt;;

Defined in: index.ts:28

DeviceSessionStrategy

type DeviceSessionStrategy = InstanceType&lt;typeof auth.DeviceSessionStrategy&gt;;

Defined in: index.ts:30

OidcFederationStrategy

type OidcFederationStrategy = InstanceType&lt;typeof auth.OidcFederationStrategy&gt;;

Defined in: index.ts:34

Encrypted

type Encrypted = CipherStashEncryptedPayload;

Defined in: types.ts:63

Structural type representing encrypted data stored in the database. Always carries a ciphertext. Covers BOTH wire formats: the EQL v2.3 payloads (k: "ct" / k: "sv") and the EQL v3 payloads (flat {v: 3, i, c, …} scalars and {v: 3, k: "sv", i, sv} SteVec documents). Schema authoring is v3-only, so encrypt always produces v3; decrypt accepts both regardless. v3 scalars carry no k discriminator, so narrow with 'k' in payload before reading it. See also EncryptedValue for branded nominal typing, and EncryptedQuery for the search-term shape returned by encryptQuery.

Variables

AccessKeyStrategy

const AccessKeyStrategy: typeof AccessKeyStrategy = auth.AccessKeyStrategy;

Defined in: index.ts:26

AutoStrategy

const AutoStrategy: typeof AutoStrategy = auth.AutoStrategy;

Defined in: index.ts:28

DeviceSessionStrategy

const DeviceSessionStrategy: typeof DeviceSessionStrategy = auth.DeviceSessionStrategy;

Defined in: index.ts:30

OidcFederationStrategy

const OidcFederationStrategy: typeof OidcFederationStrategy = auth.OidcFederationStrategy;

Defined in: index.ts:34

Functions

encryptedToPgComposite()

function encryptedToPgComposite(obj): EncryptedPgComposite;

Defined in: encryption/helpers/index.ts:31

Helper function to transform an encrypted payload into a PostgreSQL composite type. Use this when inserting data via Supabase or similar clients.

function isEncryptedPayload(value): value is EncryptedPayload;

Defined in: encryption/helpers/index.ts:129

Helper function to check if a value is an encrypted payload