import { Encryption } from "@cipherstash/stack"
import { users } from "./schema"

try {
  const client = await Encryption({
    schemas: [users],
    config: { /* optional — reads CS_* env vars by default */ },
  })
} catch (error) {
  console.error("Init failed:", error.message)
}

type EncryptionClientConfig = {
  workspaceCrn: string          // CRN format: "crn:<region>:<workspace-id>"
  clientId: string              // Client identifier
  clientKey: string             // Client key material for ZeroKMS
  accessKey: string             // API key for CipherStash API
  keyset?: {
    name?: string               // Keyset name (multi-tenant isolation)
    id?: string                 // Keyset UUID (alternative to name)
  }
}

type Result<T, E = EncryptionError> =
  | { data: T; failure?: never }
  | { failure: E; data?: never }

type EncryptionError = {
  type: "ClientInitError" | "EncryptionError" | "DecryptionError"
        | "LockContextError" | "CtsTokenError"
  message: string
}

const result = await client.encrypt("hello", { column: users.email, table: users })

if (result.failure) {
  // result.failure.type: string
  // result.failure.message: string
  console.error(result.failure.type, result.failure.message)
} else {
  // result.data: the encrypted payload
  console.log(result.data)
}

const result = await client.encrypt(plaintext, {
  column: users.email,
  table: users,
})
// result.data: Encrypted payload

const result = await client.decrypt(encryptedData)
// result.data: plaintext value

type User = { id: string; email: string; createdAt: Date }

const result = await client.encryptModel<User>(
  { id: "user_123", email: "alice@example.com", createdAt: new Date() },
  users
)
// result.data: { id: "user_123", email: Encrypted, createdAt: Date }

const result = await client.decryptModel<User>(encryptedModel)
// result.data: { id: "user_123", email: "alice@example.com", createdAt: Date }

// Single query
const result = await client.encryptQuery("alice@example.com", {
  column: users.email,
  table: users,
  queryType: "equality", // optional — auto-inferred from column indexes
})

// Batch query (multiple terms in one ZeroKMS call)
const results = await client.encryptQuery([
  { value: "alice@example.com", column: users.email, table: users, queryType: "equality" as const },
  { value: "bob", column: users.email, table: users, queryType: "freeTextSearch" as const },
])

const result = await client.bulkEncrypt(
  [
    { id: "u1", plaintext: "alice@example.com" },
    { id: "u2", plaintext: "bob@example.com" },
    { id: "u3", plaintext: null },
  ],
  { column: users.email, table: users }
)
// result.data: [{ id: "u1", data: Encrypted }, ...]

const result = await client.bulkDecrypt(encryptedPayloads)

for (const item of result.data) {
  if ("data" in item) {
    console.log(`${item.id}: ${item.data}`)
  } else {
    console.error(`${item.id} failed: ${item.error}`)
  }
}

const result = await client.bulkEncryptModels(userModels, users)
// result.data: array of encrypted models

const result = await client.bulkDecryptModels(encryptedModels)
// result.data: array of decrypted models

const result = await client
  .encrypt(plaintext, { column: users.email, table: users })
  .withLockContext(lockContext)                           // identity-aware encryption
  .audit({ metadata: { action: "create" } })             // audit trail

import {
  encryptedTable,
  encryptedColumn,
  encryptedField,
} from "@cipherstash/stack/schema"

import type { InferPlaintext, InferEncrypted } from "@cipherstash/stack/schema"

type UserPlaintext = InferPlaintext<typeof users>
// { email: string; age: string; address: string }

type UserEncrypted = InferEncrypted<typeof users>
// { email: Encrypted; age: Encrypted; address: Encrypted }

import { LockContext } from "@cipherstash/stack/identity"

// Default: uses the "sub" claim
const lc = new LockContext()

// Custom claims
const lc = new LockContext({
  context: { identityClaim: ["sub", "org_id"] }
})

// Identify user
const result = await lc.identify(jwtToken)
if (result.failure) {
  console.error(result.failure.message)
} else {
  const lockContext = result.data
  // Use with .withLockContext(lockContext)
}