diff --git a/Cargo.lock b/Cargo.lock
index 747bd6e..431289b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -13,9 +13,9 @@ dependencies = [
 
 [[package]]
 name = "adler2"
-version = "2.0.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
 [[package]]
 name = "aead"
@@ -134,23 +134,23 @@ checksum = "e539d3fca749fcee5236ab05e93a52867dd549cc157c8cb7f99595f3cedffdb5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
 name = "atomic"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d818003e740b63afc82337e3160717f4f63078720a810b7b903e70a5d1d2994"
+checksum = "a89cbf775b137e9b968e67227ef7f775587cde3fd31b0d8599dbd0f598a48340"
 dependencies = [
  "bytemuck",
 ]
 
 [[package]]
 name = "autocfg"
-version = "1.4.0"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 
 [[package]]
 name = "axum"
@@ -219,7 +219,7 @@ dependencies = [
  "miniz_oxide",
  "object",
  "rustc-demangle",
- "windows-targets",
+ "windows-targets 0.52.6",
 ]
 
 [[package]]
@@ -347,14 +347,14 @@ dependencies = [
  "proc-macro-crate",
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
 name = "bumpalo"
-version = "3.18.1"
+version = "3.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "793db76d6187cd04dff33004d8e6c9cc4e05cd330500379d2394209271b4aeee"
+checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
 
 [[package]]
 name = "bytecheck"
@@ -380,9 +380,9 @@ dependencies = [
 
 [[package]]
 name = "bytemuck"
-version = "1.23.0"
+version = "1.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9134a6ef01ce4b366b50689c94f82c14bc72bc5d0386829828a2e2752ef7958c"
+checksum = "5c76a5792e44e4abe34d3abf15636779261d45a7450612059293d1d2cfc63422"
 
 [[package]]
 name = "byteorder"
@@ -398,18 +398,18 @@ checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
 
 [[package]]
 name = "cc"
-version = "1.2.26"
+version = "1.2.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "956a5e21988b87f372569b66183b78babf23ebc2e744b733e4350a752c4dafac"
+checksum = "d487aa071b5f64da6f19a3e848e3578944b726ee5a4854b82172f02aa876bfdc"
 dependencies = [
  "shlex",
 ]
 
 [[package]]
 name = "cfg-if"
-version = "1.0.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+checksum = "9555578bc9e57714c812a1f84e4fc5b4d21fcb063490c624de019f7464c91268"
 
 [[package]]
 name = "cfg_aliases"
@@ -451,9 +451,9 @@ dependencies = [
 
 [[package]]
 name = "cipherstash-client"
-version = "0.22.2"
+version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0168885dfe967dc3884a51e415ce15c82343b7fd8be36b08d39f25f4fc727064"
+checksum = "3165e25e8e2cd848f80ed24f127e0e4c869860c9840dc1a723951b0bcd24b655"
 dependencies = [
  "aes-gcm-siv",
  "anyhow",
@@ -562,6 +562,19 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "const-hex"
+version = "1.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83e22e0ed40b96a48d3db274f72fd365bd78f67af39b6bbd47e8a15e1c6207ff"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "hex",
+ "proptest",
+ "serde",
+]
+
 [[package]]
 name = "constant_time_eq"
 version = "0.3.1"
@@ -656,7 +669,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -667,7 +680,7 @@ checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
 dependencies = [
  "darling_core",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -696,7 +709,7 @@ checksum = "cb7330aeadfbe296029522e6c40f315320aba36fc43a5b3632f3795348f3bd22"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
  "unicode-xid",
 ]
 
@@ -708,9 +721,9 @@ checksum = "abd57806937c9cc163efc8ea3910e00a62e2aeb0b8119f1793a978088f8f6b04"
 
 [[package]]
 name = "diesel"
-version = "2.2.10"
+version = "2.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff3e1edb1f37b4953dd5176916347289ed43d7119cc2e6c7c3f7849ff44ea506"
+checksum = "a917a9209950404d5be011c81d081a2692a822f73c3d6af586f0cab5ff50f614"
 dependencies = [
  "chrono",
  "diesel_derives",
@@ -719,15 +732,15 @@ dependencies = [
 
 [[package]]
 name = "diesel_derives"
-version = "2.2.5"
+version = "2.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68d4216021b3ea446fd2047f5c8f8fe6e98af34508a254a01e4d6bc1e844f84d"
+checksum = "52841e97814f407b895d836fa0012091dff79c6268f39ad8155d384c21ae0d26"
 dependencies = [
  "diesel_table_macro_syntax",
  "dsl_auto_type",
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -736,7 +749,7 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "209c735641a413bc68c4923a9d6ad4bcb3ca306b794edaa7eb0b3228a99ffb25"
 dependencies = [
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -778,7 +791,7 @@ checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -792,7 +805,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -804,7 +817,7 @@ dependencies = [
  "darling",
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -816,7 +829,7 @@ dependencies = [
  "darling",
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -833,12 +846,12 @@ checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
 name = "errno"
-version = "0.3.12"
+version = "0.3.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cea14ef9355e3beab063703aa9dab15afd25f0667c341310c1e5274bb1d0da18"
+checksum = "778e2ac28f6c47af28e4907f13ffd1e1ddbd400980a9abd7c8df189bf578a5ad"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -974,7 +987,7 @@ checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -1026,7 +1039,7 @@ dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasi 0.11.1+wasi-snapshot-preview1",
  "wasm-bindgen",
 ]
 
@@ -1065,9 +1078,9 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.15.3"
+version = "0.15.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84b26c544d002229e640969970a2e74021aadf6e2f96372b9c58eff97de08eb3"
+checksum = "5971ac85611da7067dbfcabef3c70ebb5606018acd9e2a3903a0da507521e0d5"
 
 [[package]]
 name = "heck"
@@ -1344,12 +1357,12 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.9.0"
+version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e"
+checksum = "fe4cd85333e22411419a0bcae1297d25e58c9443848b11dc6a86fefe8c78a661"
 dependencies = [
  "equivalent",
- "hashbrown 0.15.3",
+ "hashbrown 0.15.4",
 ]
 
 [[package]]
@@ -1428,15 +1441,15 @@ checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
 [[package]]
 name = "libc"
-version = "0.2.172"
+version = "0.2.174"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
+checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776"
 
 [[package]]
 name = "libredox"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
+checksum = "1580801010e535496706ba011c15f8532df6b42297d2e471fec38ceadd8c0638"
 dependencies = [
  "bitflags 2.9.1",
  "libc",
@@ -1488,9 +1501,9 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.7.4"
+version = "2.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
 
 [[package]]
 name = "miette"
@@ -1519,7 +1532,7 @@ checksum = "db5b29714e950dbb20d5e6f74f9dcec4edbcc1067bb7f8ed198c097b8c1a818b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -1530,9 +1543,9 @@ checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.8.8"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3be647b768db090acb35d5ec5db2b0e1f1de11133ca123b9eacf5137868f892a"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
 dependencies = [
  "adler2",
 ]
@@ -1544,7 +1557,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"
 dependencies = [
  "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasi 0.11.1+wasi-snapshot-preview1",
  "windows-sys 0.59.0",
 ]
 
@@ -1701,7 +1714,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -1754,9 +1767,9 @@ dependencies = [
 
 [[package]]
 name = "owo-colors"
-version = "4.2.1"
+version = "4.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26995317201fa17f3656c36716aed4a7c81743a9634ac4c99c0eeda495db0cec"
+checksum = "48dd4f4a2c8405440fd0462561f0e5806bd0f77e86f51c761481bdd4018b545e"
 
 [[package]]
 name = "parking_lot"
@@ -1840,7 +1853,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -1910,6 +1923,22 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "proptest"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fcdab19deb5195a31cf7726a210015ff1496ba1464fd42cb4f537b8b01b471f"
+dependencies = [
+ "bitflags 2.9.1",
+ "lazy_static",
+ "num-traits",
+ "rand 0.9.1",
+ "rand_chacha 0.9.0",
+ "rand_xorshift",
+ "regex-syntax",
+ "unarray",
+]
+
 [[package]]
 name = "protect-ffi"
 version = "0.1.0"
@@ -1955,9 +1984,9 @@ dependencies = [
 
 [[package]]
 name = "r-efi"
-version = "5.2.0"
+version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 
 [[package]]
 name = "radium"
@@ -2024,6 +2053,15 @@ dependencies = [
  "getrandom 0.3.3",
 ]
 
+[[package]]
+name = "rand_xorshift"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a"
+dependencies = [
+ "rand_core 0.9.3",
+]
+
 [[package]]
 name = "recipher"
 version = "0.1.3"
@@ -2105,9 +2143,9 @@ dependencies = [
 
 [[package]]
 name = "reqwest"
-version = "0.12.19"
+version = "0.12.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2f8e5513d63f2e5b386eb5106dc67eaf3f84e95258e210489136b8b92ad6119"
+checksum = "eabf4c97d9130e2bf606614eb937e86edac8292eaa6f422f995d7e8de1eb1813"
 dependencies = [
  "base64",
  "bytes",
@@ -2118,12 +2156,9 @@ dependencies = [
  "hyper",
  "hyper-tls",
  "hyper-util",
- "ipnet",
  "js-sys",
  "log",
- "mime",
  "native-tls",
- "once_cell",
  "percent-encoding",
  "pin-project-lite",
  "rustls-pki-types",
@@ -2253,9 +2288,9 @@ dependencies = [
 
 [[package]]
 name = "rust_decimal"
-version = "1.37.1"
+version = "1.37.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "faa7de2ba56ac291bd90c6b9bece784a52ae1411f9506544b3eae36dd2356d50"
+checksum = "b203a6425500a03e0919c42d3c47caca51e79f1132046626d2c8871c5092035d"
 dependencies = [
  "arrayvec",
  "borsh",
@@ -2269,9 +2304,9 @@ dependencies = [
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.24"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
+checksum = "989e6739f80c4ad5b13e0fd7fe89531180375b18520cc8c82080e4dc4035b84f"
 
 [[package]]
 name = "rustix"
@@ -2387,7 +2422,7 @@ checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -2475,12 +2510,9 @@ checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
 
 [[package]]
 name = "slab"
-version = "0.4.9"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
-dependencies = [
- "autocfg",
-]
+checksum = "04dc19736151f35336d325007ac991178d504a119863a2fcb3758cdb5e52c50d"
 
 [[package]]
 name = "smallvec"
@@ -2573,9 +2605,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.101"
+version = "2.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ce2b7fc941b3a24138a0a7cf8e858bfc6a992e7978a068a5c760deb0ed43caf"
+checksum = "17b6f705963418cdb9927482fa304bc562ece2fdd4f616084c50b7023b435a40"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2599,7 +2631,7 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -2638,7 +2670,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c13547615a44dc9c452a8a534638acdf07120d4b6847c8178705da06306a3057"
 dependencies = [
  "unicode-linebreak",
- "unicode-width 0.2.0",
+ "unicode-width 0.2.1",
 ]
 
 [[package]]
@@ -2667,7 +2699,7 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -2678,7 +2710,7 @@ checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -2730,7 +2762,7 @@ checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -2775,7 +2807,7 @@ dependencies = [
  "serde_spanned",
  "toml_datetime",
  "toml_write",
- "winnow 0.7.10",
+ "winnow 0.7.11",
 ]
 
 [[package]]
@@ -2844,13 +2876,13 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.29"
+version = "0.1.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b1ffbcf9c6f6b99d386e7444eb608ba646ae452a36b39737deb9663b610f662"
+checksum = "81383ab64e72a7a8b8e13130c49e3dab29def6d0c7d76a03087b3cf71c5c6903"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -2874,6 +2906,12 @@ version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f"
 
+[[package]]
+name = "unarray"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
+
 [[package]]
 name = "unicode-bidi"
 version = "0.3.18"
@@ -2915,9 +2953,9 @@ checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
 
 [[package]]
 name = "unicode-width"
-version = "0.2.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fc81956842c57dac11422a97c3b8195a1ff727f06e85c84ed2e8aa277c9a0fd"
+checksum = "4a1a07cc7db3810833284e8d372ccdc6da29741639ecc70c9ec107df0fa6154c"
 
 [[package]]
 name = "unicode-xid"
@@ -3029,9 +3067,9 @@ dependencies = [
 
 [[package]]
 name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
+version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "wasi"
@@ -3064,7 +3102,7 @@ dependencies = [
  "log",
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
  "wasm-bindgen-shared",
 ]
 
@@ -3099,7 +3137,7 @@ checksum = "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
@@ -3181,7 +3219,7 @@ checksum = "a47fddd13af08290e67f4acabf4b459f647552718f683a7b415d290ac744a836"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -3192,14 +3230,14 @@ checksum = "bd9211b69f8dcdfa817bfd14bf1c97c9188afa36f4750130fcdf3f400eca9fa8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
 name = "windows-link"
-version = "0.1.1"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76840935b766e1b0a05c0066835fb9ec80071d4c09a16f6bd5f7e655e3c14c38"
+checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
 
 [[package]]
 name = "windows-result"
@@ -3240,7 +3278,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets",
+ "windows-targets 0.52.6",
 ]
 
 [[package]]
@@ -3249,7 +3287,16 @@ version = "0.59.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
 dependencies = [
- "windows-targets",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.2",
 ]
 
 [[package]]
@@ -3261,13 +3308,29 @@ dependencies = [
  "windows_aarch64_gnullvm 0.52.6",
  "windows_aarch64_msvc 0.52.6",
  "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm",
+ "windows_i686_gnullvm 0.52.6",
  "windows_i686_msvc 0.52.6",
  "windows_x86_64_gnu 0.52.6",
  "windows_x86_64_gnullvm 0.52.6",
  "windows_x86_64_msvc 0.52.6",
 ]
 
+[[package]]
+name = "windows-targets"
+version = "0.53.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c66f69fcc9ce11da9966ddb31a40968cad001c5bedeb5c2b82ede4253ab48aef"
+dependencies = [
+ "windows_aarch64_gnullvm 0.53.0",
+ "windows_aarch64_msvc 0.53.0",
+ "windows_i686_gnu 0.53.0",
+ "windows_i686_gnullvm 0.53.0",
+ "windows_i686_msvc 0.53.0",
+ "windows_x86_64_gnu 0.53.0",
+ "windows_x86_64_gnullvm 0.53.0",
+ "windows_x86_64_msvc 0.53.0",
+]
+
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.42.2"
@@ -3280,6 +3343,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86b8d5f90ddd19cb4a147a5fa63ca848db3df085e25fee3cc10b39b6eebae764"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.42.2"
@@ -3292,6 +3361,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7651a1f62a11b8cbd5e0d42526e55f2c99886c77e007179efff86c2b137e66c"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.42.2"
@@ -3304,12 +3379,24 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
+[[package]]
+name = "windows_i686_gnu"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1dc67659d35f387f5f6c479dc4e28f1d4bb90ddd1a5d3da2e5d97b42d6272c3"
+
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce6ccbdedbf6d6354471319e781c0dfef054c81fbc7cf83f338a4296c0cae11"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.42.2"
@@ -3322,6 +3409,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
+[[package]]
+name = "windows_i686_msvc"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "581fee95406bb13382d2f65cd4a908ca7b1e4c2f1917f143ba16efe98a589b5d"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.42.2"
@@ -3334,6 +3427,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e55b5ac9ea33f2fc1716d1742db15574fd6fc8dadc51caab1c16a3d3b4190ba"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.42.2"
@@ -3346,6 +3445,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a6e035dd0599267ce1ee132e51c27dd29437f63325753051e71dd9e42406c57"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.42.2"
@@ -3358,6 +3463,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "271414315aff87387382ec3d271b52d7ae78726f5d44ac98b4f4030c91880486"
+
 [[package]]
 name = "winnow"
 version = "0.6.26"
@@ -3369,9 +3480,9 @@ dependencies = [
 
 [[package]]
 name = "winnow"
-version = "0.7.10"
+version = "0.7.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c06928c8748d81b05c9be96aad92e1b6ff01833332f281e8cfca3be4b35fc9ec"
+checksum = "74c7b26e3480b707944fc872477815d29a8e429d2f93a1ce000f5fa84a15cbcd"
 dependencies = [
  "memchr",
 ]
@@ -3420,28 +3531,28 @@ checksum = "38da3c9736e16c5d3c8c597a9aaa5d1fa565d0532ae05e27c24aa62fb32c0ab6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
  "synstructure",
 ]
 
 [[package]]
 name = "zerocopy"
-version = "0.8.25"
+version = "0.8.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1702d9583232ddb9174e01bb7c15a2ab8fb1bc6f227aa1233858c351a3ba0cb"
+checksum = "1039dd0d3c310cf05de012d8a39ff557cb0d23087fd44cad61df08fc31907a2f"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.25"
+version = "0.8.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28a6e20d751156648aa063f3800b706ee209a32c0b4d9f24be3d980b01be55ef"
+checksum = "9ecf5b4cc5364572d7f4c329661bcc82724222973f2cab6f050a4e5c22f75181"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
@@ -3461,7 +3572,7 @@ checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
  "synstructure",
 ]
 
@@ -3482,18 +3593,19 @@ checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
 
 [[package]]
 name = "zerokms-protocol"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01a9d0d8103cfa862b451f2c35144301df25a233f7fae041666b890a1578c3b1"
+checksum = "af31358bcf35336b9990ce1d6f671f66cca00385fb21f55db155e38b7ec666cd"
 dependencies = [
  "async-trait",
  "base64",
  "cipherstash-config",
+ "const-hex",
  "fake 2.10.0",
  "opaque-debug",
  "rand 0.8.5",
@@ -3534,5 +3646,5 @@ checksum = "5b96237efa0c878c64bd89c436f661be4e46b2f3eff1ebb976f7ef2321d2f58f"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.101",
+ "syn 2.0.104",
 ]
diff --git a/crates/protect-ffi/Cargo.toml b/crates/protect-ffi/Cargo.toml
index 57dd73e..4a1957e 100644
--- a/crates/protect-ffi/Cargo.toml
+++ b/crates/protect-ffi/Cargo.toml
@@ -12,7 +12,7 @@ crate-type = ["cdylib"]
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-cipherstash-client = "0.22.2"
+cipherstash-client = "0.23.0"
 hex = { version = "0.4.3", default-features = false }
 libc = "0.2"
 once_cell = { version = "1.20.2", default-features = false }
diff --git a/crates/protect-ffi/src/encrypt_config.rs b/crates/protect-ffi/src/encrypt_config.rs
index a8bac27..574d74f 100644
--- a/crates/protect-ffi/src/encrypt_config.rs
+++ b/crates/protect-ffi/src/encrypt_config.rs
@@ -13,8 +13,10 @@ const SUPPORTED_SCHEMA_VERSIONS: &[u32] = &[2];
 /// Table and column identifier for encryption configuration lookup.
 #[derive(Clone, Debug, Deserialize, Eq, Hash, PartialEq, Serialize)]
 pub struct Identifier {
+    /// The table name.
     #[serde(rename = "t")]
     pub table: String,
+    /// The column name.
     #[serde(rename = "c")]
     pub column: String,
 }
@@ -61,16 +63,20 @@ impl IntoIterator for Table {
 /// Root encryption configuration structure parsed from JSON.
 #[derive(Debug, Deserialize, Serialize, Clone, Default)]
 pub struct EncryptConfig {
+    /// The schema version.
     #[serde(rename = "v")]
     pub version: u32,
+    /// The set of table configurations.
     pub tables: Tables,
 }
 
-/// Column configuration with encryption casting and index options.
+/// Column configuration with casting and encryption indexes.
 #[derive(Debug, Default, Deserialize, Serialize, Clone, PartialEq)]
 pub struct Column {
+    /// Data type casting for this column.
     #[serde(default)]
     cast_as: CastAs,
+    /// Collection of encryption indexes for this column.
     #[serde(default)]
     indexes: Indexes,
 }
@@ -79,28 +85,42 @@ pub struct Column {
 #[derive(Debug, Default, Clone, Copy, Serialize, Deserialize, PartialEq)]
 #[serde(rename_all = "snake_case")]
 pub enum CastAs {
+    /// Treat as UTF-8 text (default).
     #[default]
     Text,
+    /// Treat as a boolean value.
     Boolean,
+    /// Treat as a 16-bit integer.
     SmallInt,
+    /// Treat as a 32-bit integer.
     Int,
+    /// Treat as a 64-bit integer.
     BigInt,
+    /// Treat as a single-precision float.
     Real,
+    /// Treat as a double-precision float.
     Double,
+    /// Treat as a date.
     Date,
+    /// Treat as a JSONB value.
     #[serde(rename = "jsonb")]
     JsonB,
 }
 
-/// Collection of index configurations for searchable encryption.
+/// Collection of indexes for searchable encryption and uniqueness constraints.
 #[derive(Debug, Deserialize, Serialize, Clone, Default, PartialEq)]
 pub struct Indexes {
+    /// Unique index for exact equality queries and enforcing database uniqueness constraints.
     #[serde(rename = "unique")]
     unique_index: Option<UniqueIndexOpts>,
+    /// Order-revealing encryption index for equality checks, range comparisons, range queries,
+    /// and sorting operations.
     #[serde(rename = "ore")]
     ore_index: Option<OreIndexOpts>,
+    /// Full-text search index using bloom filters for probabilistic text matching.
     #[serde(rename = "match")]
     match_index: Option<MatchIndexOpts>,
+    /// Structured text encryption vector index for JSONB containment queries.
     #[serde(rename = "ste_vec")]
     ste_vec_index: Option<SteVecIndexOpts>,
 }
@@ -112,14 +132,19 @@ pub struct OreIndexOpts {}
 /// Configuration options for full-text search indexes using bloom filters.
 #[derive(Debug, Deserialize, Serialize, Clone, PartialEq)]
 pub struct MatchIndexOpts {
+    /// The tokenizer to use for splitting text.
     #[serde(default = "default_tokenizer")]
     tokenizer: Tokenizer,
+    /// Token filters to apply to tokens.
     #[serde(default)]
     token_filters: Vec<TokenFilter>,
+    /// Number of hash functions for the bloom filter.
     #[serde(default = "default_k")]
     k: usize,
+    /// Bloom filter size in bits.
     #[serde(default = "default_m")]
     m: usize,
+    /// Whether to include the original value in the index.
     #[serde(default)]
     include_original: bool,
 }
@@ -127,6 +152,7 @@ pub struct MatchIndexOpts {
 /// Configuration options for structured text encryption vectors.
 #[derive(Debug, Deserialize, Serialize, Clone, PartialEq)]
 pub struct SteVecIndexOpts {
+    /// The prefix for the structured text encryption vector.
     prefix: String,
 }
 
@@ -145,9 +171,11 @@ fn default_m() -> usize {
     2048
 }
 
-/// Configuration options for HMAC-based unique constraint indexes.
+/// Configuration options for HMAC unique indexes that enable exact equality queries and
+/// database uniqueness constraints.
 #[derive(Debug, Deserialize, Serialize, Clone, PartialEq)]
 pub struct UniqueIndexOpts {
+    /// Token filters to apply to unique index tokens.
     #[serde(default)]
     token_filters: Vec<TokenFilter>,
 }
@@ -182,7 +210,8 @@ impl FromStr for EncryptConfig {
 }
 
 impl EncryptConfig {
-    /// Convert the encryption configuration into a HashMap for fast column lookups.
+    /// Convert the encryption configuration into a [`HashMap`] mapping [`Identifier`] to
+    /// [`ColumnConfig`] for fast column lookups.
     pub fn into_config_map(self) -> HashMap<Identifier, ColumnConfig> {
         let mut map = HashMap::new();
         for (table_name, columns) in self.tables.into_iter() {
@@ -197,7 +226,7 @@ impl EncryptConfig {
 }
 
 impl Column {
-    /// Convert this column configuration into a CipherStash ColumnConfig.
+    /// Convert this column configuration into a [`ColumnConfig`].
     pub fn into_column_config(self, name: &String) -> ColumnConfig {
         let mut config = ColumnConfig::build(name.to_string()).casts_as(self.cast_as.into());
 
diff --git a/crates/protect-ffi/src/lib.rs b/crates/protect-ffi/src/lib.rs
index e432280..a54a779 100644
--- a/crates/protect-ffi/src/lib.rs
+++ b/crates/protect-ffi/src/lib.rs
@@ -1,7 +1,10 @@
-//! PHP bindings for the CipherStash Client SDK.
+//! FFI bindings for the CipherStash Client SDK.
 //!
-//! Provides C-compatible functions for PHP FFI integration with proper
+//! This crate provides C-compatible functions for PHP FFI integration with proper
 //! error handling and memory management.
+//!
+//! The main entry point is the [`Client`] type, which manages encryption and decryption
+//! operations. All FFI functions operate on or return a pointer to a [`Client`] instance.
 
 use cipherstash_client::{
     config::{
@@ -47,23 +50,24 @@ pub struct Client {
     encrypt_config: Arc<HashMap<Identifier, ColumnConfig>>,
 }
 
-/// An encrypted value that can contain either ciphertext or searchable vector data.
+/// An encrypted value with associated encryption indexes or structured text encryption vectors.
 #[derive(Debug, Deserialize, Serialize)]
 #[serde(tag = "k")]
 pub enum Encrypted {
-    /// Standard encrypted ciphertext with optional search indexes.
+    /// Encrypted ciphertext with encryption indexes based on column configuration.
     #[serde(rename = "ct")]
     Ciphertext {
         /// Base85-encoded ciphertext containing the encrypted data.
         #[serde(rename = "c")]
         ciphertext: String,
-        /// HMAC index for exact equality queries and uniqueness constraints (optional).
+        /// HMAC index for exact equality queries and uniqueness constraints.
         #[serde(rename = "hm")]
         unique_index: Option<String>,
-        /// Order-revealing encryption index for range queries (optional).
+        /// Order-revealing encryption index for equality checks, range comparisons, range queries, and
+        /// sorting operations.
         #[serde(rename = "ob")]
         ore_index: Option<Vec<String>>,
-        /// Bloom filter index for full-text search queries (optional).
+        /// Bloom filter index for full-text search queries.
         #[serde(rename = "bf")]
         match_index: Option<Vec<u16>>,
         /// Table and column identifier for this encrypted value.
@@ -73,7 +77,7 @@ pub enum Encrypted {
         #[serde(rename = "v")]
         version: u16,
     },
-    /// Structured text encryption vector for JSONB containment queries.
+    /// Encrypted ciphertext with structured text encryption vector for JSONB containment queries.
     #[serde(rename = "sv")]
     SteVec {
         /// Base85-encoded ciphertext containing the encrypted data.
@@ -153,13 +157,13 @@ struct ClientConfig {
 ///
 /// # Errors
 ///
-/// Returns an error if the configuration string is invalid JSON, contains unsupported
-/// encryption options, or if the CipherStash client cannot be initialized.
+/// Returns an error if the `config_str` is invalid JSON, contains unsupported
+/// encryption options, or if the client cannot be initialized.
 ///
 /// # Safety
 ///
 /// The caller must ensure `config_str` points to a valid null-terminated C string.
-/// The returned pointer must be freed using `free_client()`.
+/// The returned pointer must be freed using [`free_client()`].
 #[no_mangle]
 pub extern "C" fn new_client(
     config_str: *const c_char,
@@ -199,7 +203,7 @@ async fn new_client_inner(encrypt_config: EncryptConfig) -> Result<Client, Error
 
 /// Encrypts plaintext for a specific table column.
 ///
-/// Returns a JSON string containing the encrypted result and search indexes.
+/// Returns a JSON string containing the encrypted result and encryption indexes.
 ///
 /// # Errors
 ///
@@ -209,7 +213,7 @@ async fn new_client_inner(encrypt_config: EncryptConfig) -> Result<Client, Error
 /// # Safety
 ///
 /// All pointer parameters must be valid null-terminated C strings.
-/// The returned pointer must be freed using `free_string()`.
+/// The returned pointer must be freed using [`free_string()`].
 #[no_mangle]
 pub extern "C" fn encrypt(
     client: *const Client,
@@ -321,13 +325,13 @@ fn parse_encryption_context(context_json: &str) -> Result<Vec<zerokms::Context>,
 ///
 /// # Errors
 ///
-/// Returns an error if the ciphertext is invalid, the encryption context JSON is malformed,
+/// Returns an error if the `ciphertext` is invalid, the encryption context JSON is malformed,
 /// or decryption fails due to key or permission issues.
 ///
 /// # Safety
 ///
 /// All pointer parameters must be valid null-terminated C strings.
-/// The returned pointer must be freed using `free_string()`.
+/// The returned pointer must be freed using [`free_string()`].
 #[no_mangle]
 pub extern "C" fn decrypt(
     client: *const Client,
@@ -410,7 +414,7 @@ fn to_eql_encrypted(
 ) -> Result<Encrypted, Error> {
     match encrypted {
         encryption::Encrypted::Record(ciphertext, terms) => {
-            // Collect search indexes from encryption terms
+            // Collect encryption indexes from encryption terms
             struct Indexes {
                 unique_index: Option<String>,
                 ore_index: Option<Vec<String>>,
@@ -502,27 +506,40 @@ fn format_index_term_ore(bytes: &Vec<u8>) -> Vec<String> {
     vec![format_index_term_ore_bytea(bytes)]
 }
 
+/// Bulk encryption request item containing plaintext data and metadata.
 #[derive(Deserialize)]
 struct BulkEncryptItem {
+    /// The plaintext data to encrypt.
     plaintext: String,
+    /// The target column name.
     column: String,
+    /// The target table name.
     table: String,
+    /// Optional encryption context (defaults to empty if not provided).
     #[serde(default)]
     context: Option<serde_json::Value>,
 }
 
+/// Bulk decryption request item containing ciphertext and optional context.
 #[derive(Deserialize)]
 struct BulkDecryptItem {
+    /// The ciphertext to decrypt.
     ciphertext: String,
+    /// Optional encryption context (defaults to empty if not provided).
     #[serde(default)]
     context: Option<serde_json::Value>,
 }
 
+/// Search term creation request item containing plaintext and target metadata.
 #[derive(Deserialize)]
 struct SearchTermItem {
+    /// The plaintext data to create search terms for.
     plaintext: String,
+    /// The target column name.
     column: String,
+    /// The target table name.
     table: String,
+    /// Optional encryption context (defaults to empty if not provided).
     #[serde(default)]
     context: Option<serde_json::Value>,
 }
@@ -537,7 +554,7 @@ struct SearchTermItem {
 /// # Safety
 ///
 /// All pointer parameters must be valid null-terminated C strings.
-/// The returned pointer must be freed using `free_string()`.
+/// The returned pointer must be freed using [`free_string()`].
 #[no_mangle]
 pub extern "C" fn encrypt_bulk(
     client: *const Client,
@@ -626,13 +643,13 @@ async fn encrypt_bulk_inner(
 ///
 /// # Errors
 ///
-/// Returns an error if the JSON input is malformed, contains invalid ciphertext,
+/// Returns an error if the JSON input is malformed, contains invalid `ciphertext`,
 /// has malformed encryption context, or if decryption fails.
 ///
 /// # Safety
 ///
 /// All pointer parameters must be valid null-terminated C strings.
-/// The returned pointer must be freed using `free_string()`.
+/// The returned pointer must be freed using [`free_string()`].
 #[no_mangle]
 pub extern "C" fn decrypt_bulk(
     client: *const Client,
@@ -698,7 +715,8 @@ async fn decrypt_bulk_inner(
 /// Creates encrypted search terms for querying encrypted data.
 ///
 /// Returns a JSON array of encrypted search terms that can be used in database queries.
-/// Each search term contains the search indexes (ore, match, unique, ste_vec) but not the full ciphertext.
+/// Each search term contains the encryption indexes (`unique`, `ore`, `match`, `ste_vec`)
+/// but not the full ciphertext.
 ///
 /// # Errors
 ///
@@ -708,7 +726,7 @@ async fn decrypt_bulk_inner(
 /// # Safety
 ///
 /// All pointer parameters must be valid null-terminated C strings.
-/// The returned pointer must be freed using `free_string()`.
+/// The returned pointer must be freed using [`free_string()`].
 #[no_mangle]
 pub extern "C" fn create_search_terms(
     client: *const Client,
@@ -796,7 +814,7 @@ pub extern "C" fn create_search_terms(
 ///
 /// # Safety
 ///
-/// The client pointer must have been returned by `new_client()` and not previously freed.
+/// The `client` pointer must have been returned by [`new_client()`] and not previously freed.
 #[no_mangle]
 pub extern "C" fn free_client(client: *mut Client) {
     safe_ffi::free_boxed_client(client);
@@ -806,7 +824,7 @@ pub extern "C" fn free_client(client: *mut Client) {
 ///
 /// # Safety
 ///
-/// The string pointer must have been returned by this library and not previously freed.
+/// The `s` pointer must have been returned by this library and not previously freed.
 #[no_mangle]
 pub extern "C" fn free_string(s: *mut c_char) {
     safe_ffi::free_c_string(s);
diff --git a/crates/protect-ffi/src/plaintext_target.rs b/crates/protect-ffi/src/plaintext_target.rs
index 01ef71b..330ce1f 100644
--- a/crates/protect-ffi/src/plaintext_target.rs
+++ b/crates/protect-ffi/src/plaintext_target.rs
@@ -1,4 +1,4 @@
-//! PlaintextTarget creation with workarounds for upstream SDK limitations.
+//! [`PlaintextTarget`] creation with workaround for upstream SDK.
 
 use cipherstash_client::{
     encryption::PlaintextTarget,
@@ -7,24 +7,19 @@ use cipherstash_client::{
 
 use crate::Error;
 
-/// Creates a PlaintextTarget with specialized handling for JSONB columns with ste_vec indexes.
+/// Creates a [`PlaintextTarget`] with specialized handling for JSONB columns with `ste_vec` indexes.
 ///
-/// # Workaround
+/// For JSONB columns configured with `ste_vec` indexes, JSON strings are pre-parsed to
+/// [`serde_json::Value`] to ensure correct type resolution in the upstream SDK. The expected
+/// behavior in the upstream SDK is to resolve JSON strings as
+/// [`cipherstash_client::encryption::Plaintext::Utf8Str`] instead of
+/// [`cipherstash_client::encryption::Plaintext::JsonB`], so this pre-parsing step ensures the
+/// correct type inference for `ste_vec` index compatibility.
 ///
-/// This function works around a type resolution limitation in cipherstash-client v0.22.2
-/// where JSON string inputs to JSONB columns configured with `ste_vec` indexes
-/// are resolved as `Plaintext::Utf8Str` instead of the expected `Plaintext::JsonB`.
+/// # Errors
 ///
-/// **Context:** The upstream SDK's type resolution has incomplete support for
-/// the interaction between JSONB casting and structured text encryption vectors,
-/// resulting in string type inference instead of JSONB type.
-///
-/// **Solution:** Pre-parse JSON strings to `serde_json::Value` to bypass the
-/// type inference limitation and directly provide the correct input type.
-///
-/// # TODO
-///
-/// Remove this workaround when cipherstash-client addresses the type resolution limitation.
+/// Returns an error if the input string is not valid JSON when targeting a JSONB column
+/// with `ste_vec` indexes.
 pub fn new(plaintext: String, column_config: &ColumnConfig) -> Result<PlaintextTarget, Error> {
     let needs_json_parsing = column_config.cast_type == ColumnType::JsonB
         && column_config
diff --git a/crates/protect-ffi/src/safe_ffi.rs b/crates/protect-ffi/src/safe_ffi.rs
index 1b870c7..4704b22 100644
--- a/crates/protect-ffi/src/safe_ffi.rs
+++ b/crates/protect-ffi/src/safe_ffi.rs
@@ -9,7 +9,7 @@ use std::ptr;
 ///
 /// # Errors
 ///
-/// Returns `Error::NullPointer` if the provided pointer is null.
+/// Returns [`Error::NullPointer`] if the provided pointer is null.
 ///
 /// # Safety
 ///
@@ -22,12 +22,12 @@ pub fn client_ref<'a>(client: *const Client) -> Result<&'a Client, Error> {
     }
 }
 
-/// Safely convert a raw C string to a Rust String.
+/// Safely convert a raw C string to a Rust [`String`].
 ///
 /// # Errors
 ///
-/// Returns `Error::NullPointer` if the provided pointer is null, or
-/// `Error::Utf8` if the C string contains invalid UTF-8.
+/// Returns [`Error::NullPointer`] if the provided pointer is null, or
+/// [`Error::Utf8`] if the C string contains invalid UTF-8.
 ///
 /// # Safety
 ///
@@ -43,11 +43,11 @@ pub fn c_str_to_string(s: *const c_char) -> Result<String, Error> {
     }
 }
 
-/// Safely convert an optional C string (can be null) to an Option<String>.
+/// Safely convert an optional C string (can be null) to an [`Option<String>`].
 ///
 /// # Errors
 ///
-/// Returns `Error::Utf8` if the C string contains invalid UTF-8.
+/// Returns [`Error::Utf8`] if the C string contains invalid UTF-8.
 ///
 /// # Safety
 ///
@@ -60,11 +60,11 @@ pub fn optional_c_str_to_string(s: *const c_char) -> Result<Option<String>, Erro
     }
 }
 
-/// Convert a Rust String to a C string pointer.
+/// Convert a Rust [`String`] to a C string pointer.
 ///
 /// # Errors
 ///
-/// Returns `Error::StringConversion` if the string contains null bytes.
+/// Returns [`Error::StringConversion`] if the string contains null bytes.
 pub fn string_to_c_str(s: String) -> Result<*mut c_char, Error> {
     CString::new(s)
         .map(|cs| cs.into_raw())
@@ -75,7 +75,7 @@ pub fn string_to_c_str(s: String) -> Result<*mut c_char, Error> {
 ///
 /// # Safety
 ///
-/// The caller must ensure the pointer was created by Box::into_raw and hasn't been freed.
+/// The caller must ensure the pointer was created by [`Box::into_raw`] and hasn't been freed.
 pub fn free_boxed_client(client: *mut Client) {
     if !client.is_null() {
         unsafe {
@@ -88,7 +88,7 @@ pub fn free_boxed_client(client: *mut Client) {
 ///
 /// # Safety
 ///
-/// The caller must ensure the pointer was created by CString::into_raw and hasn't been freed.
+/// The caller must ensure the pointer was created by [`CString::into_raw`] and hasn't been freed.
 pub fn free_c_string(s: *mut c_char) {
     if !s.is_null() {
         unsafe {
@@ -101,7 +101,7 @@ pub fn free_c_string(s: *mut c_char) {
 ///
 /// # Safety
 ///
-/// The caller must ensure error_out points to a valid mutable pointer.
+/// The caller must ensure `error_out` points to a valid mutable pointer.
 pub fn set_error(error_out: *mut *mut c_char, error: &Error) {
     if !error_out.is_null() {
         let error_msg = format!("{}", error);
@@ -117,7 +117,7 @@ pub fn set_error(error_out: *mut *mut c_char, error: &Error) {
 ///
 /// # Safety
 ///
-/// The caller must ensure error_out points to a valid mutable pointer.
+/// The caller must ensure `error_out` points to a valid mutable pointer.
 pub fn clear_error(error_out: *mut *mut c_char) {
     if !error_out.is_null() {
         unsafe {
diff --git a/platforms/darwin-arm64/libprotect_ffi.dylib b/platforms/darwin-arm64/libprotect_ffi.dylib
index 2885569..4f531af 100644
Binary files a/platforms/darwin-arm64/libprotect_ffi.dylib and b/platforms/darwin-arm64/libprotect_ffi.dylib differ
diff --git a/platforms/darwin-x64/libprotect_ffi.dylib b/platforms/darwin-x64/libprotect_ffi.dylib
index 27a0ba5..fe2b5fd 100644
Binary files a/platforms/darwin-x64/libprotect_ffi.dylib and b/platforms/darwin-x64/libprotect_ffi.dylib differ
diff --git a/platforms/linux-arm64-gnu/libprotect_ffi.so b/platforms/linux-arm64-gnu/libprotect_ffi.so
index 12f74c0..ba82035 100644
Binary files a/platforms/linux-arm64-gnu/libprotect_ffi.so and b/platforms/linux-arm64-gnu/libprotect_ffi.so differ
diff --git a/platforms/linux-x64-gnu/libprotect_ffi.so b/platforms/linux-x64-gnu/libprotect_ffi.so
index 72141e1..97c86fb 100644
Binary files a/platforms/linux-x64-gnu/libprotect_ffi.so and b/platforms/linux-x64-gnu/libprotect_ffi.so differ
diff --git a/platforms/win32-x64-msvc/protect_ffi.dll b/platforms/win32-x64-msvc/protect_ffi.dll
index 2e22efa..3f4b183 100644
Binary files a/platforms/win32-x64-msvc/protect_ffi.dll and b/platforms/win32-x64-msvc/protect_ffi.dll differ