feat: upgrade to EQL v3 — cipherstash-client 0.42, typed jsonb domains, v3 typecheck & transform

[freshtonic]

Migrates CipherStash Proxy from EQL v2 to EQL v3.

The central change is how an encrypted column is declared. Under v2 every encrypted column had the same opaque eql_v2_encrypted composite type, and its searchable capabilities lived somewhere else entirely — rows in an eql_v2_configuration table, populated by eql_v2.add_search_config calls. Under v3 the column type is the configuration: a typed jsonb domain such as eql_v3_text_search or eql_v3_integer_ord encodes both the scalar type and the searches the column supports.

-- EQL v2                                  -- EQL v3
encrypted_email eql_v2_encrypted           encrypted_email eql_v3_text_search  -- eq + ord + LIKE
encrypted_dob   eql_v2_encrypted           encrypted_dob   eql_v3_date_ord     -- ord + range + eq
encrypted_salary eql_v2_encrypted          encrypted_salary eql_v3_bigint_ord

SELECT eql_v2.add_search_config(           -- (nothing — the domain says it)
  'users', 'encrypted_email', 'unique', 'text');
SELECT eql_v2.add_search_config(
  'users', 'encrypted_email', 'match', 'text');
-- …and one call per index, per column

That single change ripples through the whole stack, which is why this PR is large: the proxy stops reading a config table and infers encrypt config from the schema, the type checker gains a domain identity per column, and every rewrite rule has to emit the v3 functional term form rather than v2's bare operators.

Breaking changes

• Existing v2 data and schemas must be migrated to v3. There is no dual-mode support — this build speaks v3 only. A surviving eql_v2_encrypted column is served as a plaintext passthrough column with a loud ops-visible warning: Proxy performs no encryption on writes or decryption on reads for it.
• eql_v2.add_search_config and eql_v2.add_encrypted_constraint are gone, as is the eql_v2_configuration table. Declare the domain type instead.
• Requires EQL 3.0.3 installed in the target database.

Dependencies

	before	after
cipherstash-client / cipherstash-config	0.34.1-alpha.4	0.42.0
eql-bindings	—	3.0.3
EQL (CS_EQL_VERSION)	eql-2.3.0-pre.3	eql-3.0.3

Upgrading to cipherstash-client 0.42.0 also lets the vendored stack-auth copy go — it was the CIP-3159 hotfix patch and is no longer referenced. That deletion accounts for most of the ~12k removed lines; the substantive diff is far smaller than the headline numbers suggest.

New capabilities

• Equality on encrypted JSON fields — WHERE col -> 'field' = 'value', in both the simple and extended protocols, and in the ->> and jsonb_path_query_first(col, path) = value spellings, with <> as the negation. The field and the value are fused into a single encrypted value-selector needle and matched by containment, so a query never reveals the field and the value separately. Exact and case-sensitive; the value must be a JSON scalar.
• Encrypted full-text match with @@ on text columns whose domain carries a bloom-filter term.
• Range comparisons on encrypted JSON fields, and array indexing for encrypted JSON search (ArrayIndexMode::ALL).

Fixed along the way

• LIKE/ILIKE on an encrypted column is now gated by the column's token-match capability. It previously bypassed capability checking and was silently accepted on columns that cannot do fuzzy match.
• ORDER BY on an encrypted column now orders by its ordering term, and GROUP BY groups by its equality term, projecting grouped columns through eql_v3.grouped_value. Both previously fell through to raw jsonb semantics over the ciphertext — which is non-deterministic, so the results were wrong rather than merely unsorted.

Reviewer's map

The commits are ordered so the story reads top to bottom; reviewing by commit is likely easier than by file.

area	what to look at
packages/eql-mapper (+3672/-312)	the bulk. inference/unifier/types.rs for DomainIdentity/TokenType; transformation_rules/ for the rewrite pipeline — cast_full_payload_operands, rewrite_eql_comparison_ops, rewrite_eql_match_ops, rewrite_eql_order_by, rewrite_eql_group_by, rewrite_json_value_selector_eq are new, replacing cast_literals_as_encrypted / cast_params_as_encrypted
packages/cipherstash-proxy (+1684/-804)	proxy/encrypt_config/from_domain.rs (config inferred from the domain typname), proxy/schema/eql_domains.rs, and the v3 encrypt/decrypt paths in proxy/zerokms/ and postgresql/messages/data_row.rs
docs/	docs/plans/2026-07-20-eql-v3-type-checker-handoff.md is the design record; ADRs cover the domain-identity and rewrite-pipeline decisions
tests/, packages/showcase	fixtures and the healthcare showcase converted to v3 domains

Testing

tests/sql/schema.sql, the benchmark schema and the showcase schema are all v3 now, and the integration suite is v3-shaped.

Ten backwards-compatibility tests in packages/cipherstash-proxy-integration/src/eql_regression.rs are #[ignore]d: they pin captured v2 ciphertext and ::eql_v2_encrypted casts, neither of which exists under v3. They need fixtures regenerated from a v3 baseline before they can be re-enabled.

Acknowledgment

By submitting this pull request, I confirm that CipherStash can use, modify, copy, and redistribute this contribution, under the terms of CipherStash's choice.

Summary by CodeRabbit

• New Features
  • Upgraded encrypted SQL processing to EQL v3 using schema-driven, self-configuring encrypted domain types.
  • Added/enhanced encrypted querying: full-text @@, richer JSON equality/inequality and containment (including <>, ->/->>, jsonb_path_query_first), plus SELECT DISTINCT ... ORDER BY support for encrypted sorts.
• Bug Fixes
  • Tightened capability gating for LIKE/ILIKE; improved encrypted JSON selector typing and error clarity.
  • Fixed/clarified rewriting edge cases for updates with reused parameters and corrected GROUP BY handling (including rejecting SELECT * with encrypted GROUP BY).
• Documentation
  • Updated architecture, setup, reference, errors, and showcase materials to reflect EQL v3 and v2 migration requirements.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR migrates the proxy and EQL Mapper from EQL v2 to EQL v3, introducing domain-derived configuration, EQL v3 wire types, encrypted JSON rewrites, reshaped parameter plans, updated protocol handling, schemas, tests, and documentation.

Changes

EQL v3 migration

Layer / File(s)	Summary
Domain model and schema configuration packages/eql-mapper/src/inference/..., packages/eql-mapper/src/model/..., packages/cipherstash-proxy/src/proxy/schema/..., packages/cipherstash-proxy/src/proxy/encrypt_config/...	EQL v3 domains resolve to DomainIdentity, EqlTraits, column types, and encryption configuration without the v2 configuration table.
Mapper inference and rewrite pipeline packages/eql-mapper/src/inference/..., packages/eql-mapper/src/transformation_rules/..., packages/eql-mapper/src/param_plan.rs, packages/eql-mapper/src/type_checked_statement.rs	Comparison, match, containment, JSON selector, ordering, grouping, and distinct operations rewrite to EQL v3 terms and functions while tracking query operands and parameter reshaping.
Proxy protocol and encryption flow packages/cipherstash-proxy/src/postgresql/..., packages/cipherstash-proxy/src/proxy/zerokms/...	EQL v3 outputs, SteVec decryption, JSON wire encodings, rewritten bind parameters, parameter OIDs, and query-operand payloads are handled through PostgreSQL protocol processing.
Schemas, tests, and documentation docs/..., tests/..., packages/cipherstash-proxy-integration/..., packages/showcase/...	Schemas and examples use self-configuring EQL v3 domains; integration coverage validates distinct ordering, JSON selectors, reused parameters, and capability-specific behavior.
Dependency and release configuration Cargo.toml, mise.toml, mise.local.example.toml	CipherStash crates and EQL assets are pinned to EQL v3-compatible releases and the vendored stack-auth patch is removed.

Estimated code review effort: 5 (Critical) | ~120 minutes

Possibly related issues

• EQL v2 removal: review remediation for #772 stack#778 — Tracks related EQL v2 removal and migration-safety work.
• Remove EQL v2 repo-wide (umbrella) stack#707 — Covers making EQL v3 the sole supported generation.
• Migration rewriter: dollar-quoted DDL is invisible to the corpus index, so the already-encrypted guard is bypassed and a live DROP COLUMN is emitted over ciphertext stack#811 — Relates to recognizing EQL v3 encrypted columns in migration rewriting.

Possibly related PRs

• cipherstash/proxy#423 — Shares the EQL v3 wire-format, output-type, frontend, and SteVec migration.
• cipherstash/proxy#409 — Overlaps on EqlOutput encryption and mapper rewrite plumbing.
• cipherstash/proxy#386 — Relates to encryption configuration construction in the same manager path.

Suggested reviewers: tobyhede

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the core migration to EQL v3, including dependency upgrades and typed jsonb domain/typecheck changes.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/upgrade-to-eql-v3

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 11

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

packages/cipherstash-proxy/src/proxy/mod.rs (1)

88-105: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Validate the installed EQL version before startup

eql_version degrades failures to None, and startup only prints a warning when the installed version differs from EQL_VERSION_AT_BUILD_TIME without comparing it against the required minimum (3.0.3). That can allow a v2 or older v3 database to continue and treat schema columns without EQL v3 domains as plaintext passthrough. Fail fast or block startup when the detected version is below the required minimum.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/cipherstash-proxy/src/proxy/mod.rs` around lines 88 - 105, Update
eql_version and its startup validation to parse the detected database version
and enforce the minimum required EQL version 3.0.3, blocking startup when the
version is missing, invalid, or below that minimum instead of allowing None to
continue as a warning-only path. Preserve successful startup for compatible
versions and retain the existing version-mismatch reporting for otherwise valid
versions.

🧹 Nitpick comments (10)

docs/errors.md (1)

636-638: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add a language to the new fenced code blocks.

markdownlint flags these three new fenced blocks (Lines 636, 695, 718) for missing a language identifier (MD040).

📝 Suggested fix

-```
+```text
 An encrypted jsonb column is configured for ORE ordering, which EQL v3 does not support.

(apply the same ` ```text ` fence to the blocks at Lines 695 and 718)
</details>






Also applies to: 695-697, 718-720

<details>
<summary>🤖 Prompt for AI Agents</summary>

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @docs/errors.md around lines 636 - 638, Update the three fenced code blocks
in docs/errors.md around the encrypted jsonb message and the blocks near lines
695 and 718 to specify the text language identifier; preserve each block’s
existing content and use the same text fence consistently.

</details>

<!-- cr-comment:v1:5c99a1de39a3531d959d5527 -->

_Source: Linters/SAST tools_

</blockquote></details>
<details>
<summary>packages/cipherstash-proxy-integration/src/select/indexing.rs (1)</summary><blockquote>

`37-38`: _📐 Maintainability & Code Quality_ | _🔵 Trivial_ | _⚡ Quick win_

**Don't swallow the `CREATE INDEX` result.**

`let _ = client.simple_query(sql).await` hides a failed index creation, so this test would still pass if `eql_v3.ord_term` were the wrong term function for `eql_v3_text_search` — the one thing the v3 index migration needs to prove here. Since the table is shared, tolerate only the "already exists" case rather than all errors.



<details>
<summary>♻️ Assert index creation succeeds</summary>

```diff
-        let sql = "CREATE INDEX IF NOT EXISTS encrypted_text_ord_term_idx ON encrypted (eql_v3.ord_term(encrypted_text))";
-        let _ = client.simple_query(sql).await;
+        let sql = "CREATE INDEX IF NOT EXISTS encrypted_text_ord_term_idx ON encrypted (eql_v3.ord_term(encrypted_text))";
+        client.simple_query(sql).await.unwrap();

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/cipherstash-proxy-integration/src/select/indexing.rs` around lines
37 - 38, Update the CREATE INDEX setup in the indexing test to inspect the
result of client.simple_query(sql).await and fail on errors, while explicitly
tolerating only the expected “already exists” error for the shared table. Do not
discard other failures, so an incorrect eql_v3.ord_term index function causes
the test to fail.

packages/cipherstash-proxy/src/postgresql/context/statement.rs (1)

130-132: 🩺 Stability & Availability | 🔵 Trivial | 💤 Low value

Assert the output-param mapping contract.

This is the only call site using output_params_from_plan, and get_output_param_columns is documented as positional over PlanPlan::outputs, but zip() still drops a trailing mapper output if that invariant ever breaks. A debug-level length assertion here makes the contract explicit without hiding future mismatches in rewrite output.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/cipherstash-proxy/src/postgresql/context/statement.rs` around lines
130 - 132, Add a debug-level assertion before the positional zip in the
output_params_from_plan flow, verifying that get_output_param_columns returns
the same number of entries as plan.outputs(). Preserve the existing positional
mapping while making any length mismatch explicit instead of silently dropping
trailing mapper outputs.

packages/cipherstash-proxy/src/error.rs (1)

377-381: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

UnsupportedV3QueryTerm collapses into a message with no friendly text or doc link.

Both v3/v2 SteVec rejections map to InvalidIndexTerm, whose #[error("InvalidIndexTerm")] (Line 254-255) gives the customer an opaque identifier — unlike the new SteVec variants. Since UnsupportedV3QueryTerm is reachable from a real query shape, consider a dedicated variant (or at least a friendly message plus doc link on InvalidIndexTerm).

As per coding guidelines: "Customer-facing errors must include friendly messages and documentation links".

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/cipherstash-proxy/src/error.rs` around lines 377 - 381, The EqlError
mapping in the error conversion must give UnsupportedV3QueryTerm a
customer-facing message and documentation link instead of the opaque
InvalidIndexTerm text. Update the relevant error enum variant and its mapping,
while preserving the existing UnsupportedSteVecInV2 behavior unless it requires
the same customer-facing treatment.

Source: Coding guidelines

packages/cipherstash-proxy/src/postgresql/data/from_sql.rs (1)

122-153: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add unit tests for the new JSON operand helpers.

json_selector_path, json_value_selector_plaintext, literal_json_value and json_ord_scalar_plaintext encode subtle contracts (rooting, scalar-only rejection, invalid-JSON-as-string fallback, number→f64). This file already has a mod tests; a few table-driven cases here would pin the behaviour that the integration suite currently can't cover (several JSON tests are ignored under v3).

Also applies to: 161-192, 226-235

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/cipherstash-proxy/src/postgresql/data/from_sql.rs` around lines 122
- 153, Add focused table-driven unit tests in the existing tests module covering
json_selector_path, json_value_selector_plaintext, literal_json_value, and
json_ord_scalar_plaintext. Assert rooted selector paths, scalar acceptance and
object/array rejection, invalid JSON string fallback, and numeric conversion to
f64, including representative valid and edge cases.

packages/eql-mapper/src/model/schema.rs (1)

44-53: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Display omits the newly added domain identity.

#[display("Eql({})", _0)] renders only the EqlTraits, so the DomainIdentity this variant now carries never appears in diagnostics — which is the field the v3 loader populates and the one you'd want when debugging a domain mismatch.

♻️ Include the domain

-    #[display("Eql({})", _0)]
+    #[display("Eql({}, {})", _0, _1.domain.value)]
     Eql(EqlTraits, DomainIdentity),

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/eql-mapper/src/model/schema.rs` around lines 44 - 53, Update the
Display format on ColumnKind::Eql to include both EqlTraits and DomainIdentity,
ensuring diagnostics expose the domain identity populated by the v3 schema
loader while preserving the Native formatting.

packages/cipherstash-proxy/src/proxy/sql/select_table_schemas.sql (1)

4-9: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Make the aggregate ordering explicit so the three arrays stay positionally aligned.

packages/cipherstash-proxy/src/proxy/schema/manager.rs (Lines 140-144) and packages/cipherstash-proxy/src/proxy/encrypt_config/manager.rs (Line 207) zip columns, column_type_names, and column_domain_names positionally. Aggregate input order is unspecified in SQL, so encode it here rather than relying on it.

🛡️ Proposed fix

-    array_agg(c.column_name)::text[] AS columns,
-    array_agg(c.udt_name)::text[] AS column_type_names,
+    array_agg(c.column_name ORDER BY c.ordinal_position)::text[] AS columns,
+    array_agg(c.udt_name ORDER BY c.ordinal_position)::text[] AS column_type_names,
     -- EQL v3 encrypted columns are jsonb-backed DOMAINs, so `udt_name` reports
     -- the base type (`jsonb`); the domain typname (e.g. `eql_v3_integer_ord`)
     -- is only available via `domain_name`. NULL for non-domain columns.
-    array_agg(c.domain_name)::text[] AS column_domain_names
+    array_agg(c.domain_name ORDER BY c.ordinal_position)::text[] AS column_domain_names

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/cipherstash-proxy/src/proxy/sql/select_table_schemas.sql` around
lines 4 - 9, Update the three array_agg expressions in the select-table-schemas
query to use the same explicit ORDER BY key, such as the column ordinal
position, so columns, column_type_names, and column_domain_names remain
positionally aligned. Preserve the existing casts and selected values.

tests/tasks/test/integration/psql-passthrough.sh (1)

25-28: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Passthrough test lost its only EQL-specific assertion.

With the eql_v2_configuration probe gone, this script only checks SELECT 1 twice. A SELECT eql_v3.version(); through the proxy (same call Proxy::eql_version makes in packages/cipherstash-proxy/src/proxy/mod.rs) restores an equivalent v3 check for near-zero cost.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/tasks/test/integration/psql-passthrough.sh` around lines 25 - 28,
Update the passthrough integration test near the EQL v3 configuration comment to
add a proxied `SELECT eql_v3.version();` assertion, matching the call used by
`Proxy::eql_version`. Retain the existing generic `SELECT 1` sanity checks and
ensure the new query executes through the proxy.

packages/cipherstash-proxy/src/proxy/schema/manager.rs (1)

172-174: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Consider rate-limiting or metricising the legacy-column warning.

load_schema runs on every reload tick, so this warns once per legacy column per interval for the lifetime of the process. A counter/gauge (or a once-per-schema-change log) keeps the signal without flooding logs.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/cipherstash-proxy/src/proxy/schema/manager.rs` around lines 172 -
174, Update the legacy-column warning in load_schema so repeated reload ticks do
not emit an unbounded warning for the same unchanged column. Reuse an existing
metric or schema-change tracking mechanism if available, recording the
legacy-column condition while preserving the warning’s table and column context;
otherwise emit the warning only when the schema state changes.

packages/cipherstash-proxy/src/proxy/encrypt_config/from_domain.rs (1)

36-47: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Searchability of JSON domains is decided by a name suffix here, but by the eql-bindings catalog in eql_domains.rs.

packages/cipherstash-proxy/src/proxy/schema/eql_domains.rs derives JSON capabilities from term_json_keys() == None (catalog-driven, cannot drift), while this path uses domain.ends_with("_search"). Any future searchable JSON domain whose typname does not end in _search would type-check as JsonLike + Contain yet be configured storage-only, so writes would silently carry no SteVec terms. Consider deriving this from DomainIdentity/the catalog instead of the suffix.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/cipherstash-proxy/src/proxy/encrypt_config/from_domain.rs` around
lines 36 - 47, The JSON search-index decision in the identity.token ==
TokenType::Json branch currently relies on domain.ends_with("_search"), which
can diverge from the catalog. Reuse DomainIdentity or the eql_domains catalog
capability (the same term_json_keys() == None logic) to determine whether the
domain is searchable, and add the SteVec index for every catalog-marked
searchable JSON domain while leaving storage-only domains without one.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ARCHITECTURE.md`:
- Around line 117-126: Update the pipeline rules table to match the chain
assembled by type_checked_statement.rs::make_transformer: rename the casting
rows to SubstituteEncryptedLiterals and CastFullPayloadOperands, remove the
inaccurate CastParamsAsEncrypted entry, and add RewriteJsonValueSelectorEq,
RewriteEqlOrderBy, and RewriteEqlGroupBy with descriptions of their behavior.
Preserve the existing descriptions for rules that remain in the actual chain.

In `@docs/reference/searchable-json.md`:
- Line 150: Update the `->` and `->>` headings in searchable-json.md to include
`eql_v3_json_search` as the left-hand operand type, matching the operand-type
format used by sibling operator headings while preserving their existing return
descriptions.

In `@packages/cipherstash-proxy-integration/src/eql_regression.rs`:
- Line 157: The EQL regression fixtures remain disabled because generation and
insert_encrypted_directly still use v2 ciphertext and eql_v2_encrypted casts. In
packages/cipherstash-proxy-integration/src/eql_regression.rs:157-157, port
fixture generation and direct insertion to v3/jsonb payloads, regenerate
fixtures, and remove the ignore; then regenerate and re-enable text coverage at
268-268, int2 at 300-300, int4 at 330-330, int8 at 360-360, float8 at 390-390,
boolean at 420-420, JSONB decryption at 450-450, JSON field access at 480-480,
and JSON array coverage at 532-532.

In `@packages/cipherstash-proxy/src/postgresql/data/from_sql.rs`:
- Around line 109-120: Update json_selector_path to treat any selector beginning
with the JSON path root character '$' as already rooted, including '$', '$[0]',
'$["a"]', and '$[*].b'; only prepend '$.' for unrooted field names.

In `@packages/cipherstash-proxy/src/postgresql/messages/bind.rs`:
- Around line 195-212: Preserve the client-declared type for selector operands
instead of assigning them JSONB through output_params_from_plan. Add or
propagate a distinct selector marker so Parse::rewrite_param_types does not
apply the column-based JSONB rewrite, while apply_encrypted continues using
rewrite_text for the raw selector bytes.

In `@packages/cipherstash-proxy/src/postgresql/messages/data_row.rs`:
- Around line 302-307: Update the fixture provenance comment above the
to_ciphertext_* fixtures to reference EQL v3.0.3 instead of v3.0.2, matching the
version pinned by the migration. Leave the fixture descriptions and regeneration
guidance unchanged.

In `@packages/cipherstash-proxy/src/proxy/encrypt_config/manager.rs`:
- Around line 202-223: Update load_encrypt_config to preserve table_schema from
SCHEMA_QUERY when building each eql::Identifier, so configurations for
same-named tables in different schemas cannot overwrite one another. Carry the
schema through the table scan and include it in map.insert alongside table_name
and column, or restrict SCHEMA_QUERY to the served schema.

In `@packages/eql-mapper/docs/adr/0003-v3-rewrite-pipeline.md`:
- Around line 37-39: Add the text language identifier to both fenced code blocks
in the ADR, including the example around the operator transformation and the
block around the salary comparison, so the Markdown fences satisfy MD040 without
changing their contents.

In `@packages/eql-mapper/src/inference/infer_type_impls/expr.rs`:
- Around line 168-192: Propagate whether JSON-selector fusion succeeded from
infer_json_value_selector instead of treating every Ok result as handled. Update
the Eq/NotEq branches in the binary-expression inference flow to set handled
only when fusion unifies the value type; when fusion declines, leave handled
false so get_sql_binop_rule(op).apply_constraints(...) performs ordinary typing
and reports the capability error.

In `@packages/eql-mapper/src/inference/sql_types/sql_decls.rs`:
- Around line 113-123: Update get_eql_v3_function_name to accept v3 counterparts
only when fn_name is unqualified or explicitly qualified with pg_catalog; reject
other schemas before constructing the eql_v3 name. Preserve the existing
SQL_FUNCTION_TYPES lookup and return behavior for permitted function names.

In `@packages/eql-mapper/src/transformation_rules/rewrite_eql_match_ops.rs`:
- Around line 49-67: Update match_predicate to return whether the matched
identity is on the left side of the @@ expression, rather than only a boolean
negation flag. In apply, use that column_is_left result to normalize
original_col and original_pat from left/right or right/left, and build
match_term so the column is always the containment operand regardless of source
ordering.

---

Outside diff comments:
In `@packages/cipherstash-proxy/src/proxy/mod.rs`:
- Around line 88-105: Update eql_version and its startup validation to parse the
detected database version and enforce the minimum required EQL version 3.0.3,
blocking startup when the version is missing, invalid, or below that minimum
instead of allowing None to continue as a warning-only path. Preserve successful
startup for compatible versions and retain the existing version-mismatch
reporting for otherwise valid versions.

---

Nitpick comments:
In `@docs/errors.md`:
- Around line 636-638: Update the three fenced code blocks in docs/errors.md
around the encrypted jsonb message and the blocks near lines 695 and 718 to
specify the text language identifier; preserve each block’s existing content and
use the same text fence consistently.

In `@packages/cipherstash-proxy-integration/src/select/indexing.rs`:
- Around line 37-38: Update the CREATE INDEX setup in the indexing test to
inspect the result of client.simple_query(sql).await and fail on errors, while
explicitly tolerating only the expected “already exists” error for the shared
table. Do not discard other failures, so an incorrect eql_v3.ord_term index
function causes the test to fail.

In `@packages/cipherstash-proxy/src/error.rs`:
- Around line 377-381: The EqlError mapping in the error conversion must give
UnsupportedV3QueryTerm a customer-facing message and documentation link instead
of the opaque InvalidIndexTerm text. Update the relevant error enum variant and
its mapping, while preserving the existing UnsupportedSteVecInV2 behavior unless
it requires the same customer-facing treatment.

In `@packages/cipherstash-proxy/src/postgresql/context/statement.rs`:
- Around line 130-132: Add a debug-level assertion before the positional zip in
the output_params_from_plan flow, verifying that get_output_param_columns
returns the same number of entries as plan.outputs(). Preserve the existing
positional mapping while making any length mismatch explicit instead of silently
dropping trailing mapper outputs.

In `@packages/cipherstash-proxy/src/postgresql/data/from_sql.rs`:
- Around line 122-153: Add focused table-driven unit tests in the existing tests
module covering json_selector_path, json_value_selector_plaintext,
literal_json_value, and json_ord_scalar_plaintext. Assert rooted selector paths,
scalar acceptance and object/array rejection, invalid JSON string fallback, and
numeric conversion to f64, including representative valid and edge cases.

In `@packages/cipherstash-proxy/src/proxy/encrypt_config/from_domain.rs`:
- Around line 36-47: The JSON search-index decision in the identity.token ==
TokenType::Json branch currently relies on domain.ends_with("_search"), which
can diverge from the catalog. Reuse DomainIdentity or the eql_domains catalog
capability (the same term_json_keys() == None logic) to determine whether the
domain is searchable, and add the SteVec index for every catalog-marked
searchable JSON domain while leaving storage-only domains without one.

In `@packages/cipherstash-proxy/src/proxy/schema/manager.rs`:
- Around line 172-174: Update the legacy-column warning in load_schema so
repeated reload ticks do not emit an unbounded warning for the same unchanged
column. Reuse an existing metric or schema-change tracking mechanism if
available, recording the legacy-column condition while preserving the warning’s
table and column context; otherwise emit the warning only when the schema state
changes.

In `@packages/cipherstash-proxy/src/proxy/sql/select_table_schemas.sql`:
- Around line 4-9: Update the three array_agg expressions in the
select-table-schemas query to use the same explicit ORDER BY key, such as the
column ordinal position, so columns, column_type_names, and column_domain_names
remain positionally aligned. Preserve the existing casts and selected values.

In `@packages/eql-mapper/src/model/schema.rs`:
- Around line 44-53: Update the Display format on ColumnKind::Eql to include
both EqlTraits and DomainIdentity, ensuring diagnostics expose the domain
identity populated by the v3 schema loader while preserving the Native
formatting.

In `@tests/tasks/test/integration/psql-passthrough.sh`:
- Around line 25-28: Update the passthrough integration test near the EQL v3
configuration comment to add a proxied `SELECT eql_v3.version();` assertion,
matching the call used by `Proxy::eql_version`. Retain the existing generic
`SELECT 1` sanity checks and ensure the new query executes through the proxy.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: add8c498-7993-4275-b16e-6273a7a579b3

📥 Commits

Reviewing files that changed from the base of the PR and between bfa9b3b and d962a10.

⛔ Files ignored due to path filters (2)

• Cargo.lock is excluded by !**/*.lock
• vendor/stack-auth/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (118)

• ARCHITECTURE.md
• CHANGELOG.md
• CLAUDE.md
• CONTEXT-MAP.md
• Cargo.toml
• docs/errors.md
• docs/how-to/index.md
• docs/plans/2026-07-20-eql-v3-type-checker-handoff.md
• docs/reference/index.md
• docs/reference/searchable-json.md
• docs/sql/schema-example.sql
• mise.local.example.toml
• mise.toml
• packages/cipherstash-proxy-integration/src/disable_mapping.rs
• packages/cipherstash-proxy-integration/src/eql_regression.rs
• packages/cipherstash-proxy-integration/src/extended_protocol_error_messages.rs
• packages/cipherstash-proxy-integration/src/map_ope_index_where.rs
• packages/cipherstash-proxy-integration/src/map_ore_index_where.rs
• packages/cipherstash-proxy-integration/src/map_unique_index.rs
• packages/cipherstash-proxy-integration/src/select/indexing.rs
• packages/cipherstash-proxy-integration/src/select/jsonb_array_length.rs
• packages/cipherstash-proxy-integration/src/select/jsonb_containment_index.rs
• packages/cipherstash-proxy-integration/src/select/jsonb_term_filter.rs
• packages/cipherstash-proxy/Cargo.toml
• packages/cipherstash-proxy/src/error.rs
• packages/cipherstash-proxy/src/lib.rs
• packages/cipherstash-proxy/src/postgresql/backend.rs
• packages/cipherstash-proxy/src/postgresql/column_mapper.rs
• packages/cipherstash-proxy/src/postgresql/context/mod.rs
• packages/cipherstash-proxy/src/postgresql/context/statement.rs
• packages/cipherstash-proxy/src/postgresql/data/from_sql.rs
• packages/cipherstash-proxy/src/postgresql/data/mod.rs
• packages/cipherstash-proxy/src/postgresql/frontend.rs
• packages/cipherstash-proxy/src/postgresql/messages/bind.rs
• packages/cipherstash-proxy/src/postgresql/messages/data_row.rs
• packages/cipherstash-proxy/src/postgresql/messages/mod.rs
• packages/cipherstash-proxy/src/postgresql/messages/param_description.rs
• packages/cipherstash-proxy/src/postgresql/messages/parse.rs
• packages/cipherstash-proxy/src/proxy/encrypt_config/from_domain.rs
• packages/cipherstash-proxy/src/proxy/encrypt_config/manager.rs
• packages/cipherstash-proxy/src/proxy/encrypt_config/mod.rs
• packages/cipherstash-proxy/src/proxy/mod.rs
• packages/cipherstash-proxy/src/proxy/schema/eql_domains.rs
• packages/cipherstash-proxy/src/proxy/schema/manager.rs
• packages/cipherstash-proxy/src/proxy/schema/mod.rs
• packages/cipherstash-proxy/src/proxy/sql/select_config.sql
• packages/cipherstash-proxy/src/proxy/sql/select_table_schemas.sql
• packages/cipherstash-proxy/src/proxy/zerokms/zerokms.rs
• packages/eql-mapper-macros/src/parse_type_decl.rs
• packages/eql-mapper/CONTEXT.md
• packages/eql-mapper/docs/adr/0001-functional-index-rewrite.md
• packages/eql-mapper/docs/adr/0002-token-type-as-inert-identity.md
• packages/eql-mapper/docs/adr/0003-v3-rewrite-pipeline.md
• packages/eql-mapper/src/eql_mapper.rs
• packages/eql-mapper/src/inference/infer_type_impls/expr.rs
• packages/eql-mapper/src/inference/infer_type_impls/insert_statement.rs
• packages/eql-mapper/src/inference/mod.rs
• packages/eql-mapper/src/inference/sql_types/sql_decls.rs
• packages/eql-mapper/src/inference/unifier/eql_traits.rs
• packages/eql-mapper/src/inference/unifier/type_env.rs
• packages/eql-mapper/src/inference/unifier/types.rs
• packages/eql-mapper/src/inference/unifier/unify_types.rs
• packages/eql-mapper/src/json_value_selector.rs
• packages/eql-mapper/src/lib.rs
• packages/eql-mapper/src/model/schema.rs
• packages/eql-mapper/src/model/schema_delta.rs
• packages/eql-mapper/src/param_plan.rs
• packages/eql-mapper/src/query_operands.rs
• packages/eql-mapper/src/renumber_params.rs
• packages/eql-mapper/src/test_helpers.rs
• packages/eql-mapper/src/transformation_rules/cast_full_payload_operands.rs
• packages/eql-mapper/src/transformation_rules/cast_literals_as_encrypted.rs
• packages/eql-mapper/src/transformation_rules/cast_params_as_encrypted.rs
• packages/eql-mapper/src/transformation_rules/helpers.rs
• packages/eql-mapper/src/transformation_rules/mod.rs
• packages/eql-mapper/src/transformation_rules/preserve_effective_aliases.rs
• packages/eql-mapper/src/transformation_rules/rewrite_containment_ops.rs
• packages/eql-mapper/src/transformation_rules/rewrite_eql_comparison_ops.rs
• packages/eql-mapper/src/transformation_rules/rewrite_eql_group_by.rs
• packages/eql-mapper/src/transformation_rules/rewrite_eql_match_ops.rs
• packages/eql-mapper/src/transformation_rules/rewrite_eql_order_by.rs
• packages/eql-mapper/src/transformation_rules/rewrite_json_value_selector_eq.rs
• packages/eql-mapper/src/transformation_rules/rewrite_standard_sql_fns_on_eql_types.rs
• packages/eql-mapper/src/transformation_rules/substitute_encrypted_literals.rs
• packages/eql-mapper/src/type_checked_statement.rs
• packages/showcase/CLAUDE.md
• packages/showcase/Cargo.toml
• packages/showcase/README.md
• packages/showcase/src/data.rs
• packages/showcase/src/main.rs
• packages/showcase/src/model.rs
• packages/showcase/src/schema.sql
• tests/benchmark/sql/benchmark-schema.sql
• tests/sql/schema-uninstall.sql
• tests/sql/schema.sql
• tests/tasks/test/integration/psql-passthrough.sh
• vendor/stack-auth/.gitignore
• vendor/stack-auth/Cargo.toml
• vendor/stack-auth/LICENSE
• vendor/stack-auth/README.md
• vendor/stack-auth/examples/auto_strategy.rs
• vendor/stack-auth/examples/device_code.rs
• vendor/stack-auth/src/access_key.rs
• vendor/stack-auth/src/access_key_refresher.rs
• vendor/stack-auth/src/access_key_strategy.rs
• vendor/stack-auth/src/auto_refresh.rs
• vendor/stack-auth/src/auto_strategy.rs
• vendor/stack-auth/src/device_client.rs
• vendor/stack-auth/src/device_code/mod.rs
• vendor/stack-auth/src/device_code/protocol.rs
• vendor/stack-auth/src/device_code/tests.rs
• vendor/stack-auth/src/lib.rs
• vendor/stack-auth/src/oauth_refresher.rs
• vendor/stack-auth/src/oauth_strategy.rs
• vendor/stack-auth/src/refresher.rs
• vendor/stack-auth/src/service_token.rs
• vendor/stack-auth/src/static_token_strategy.rs
• vendor/stack-auth/src/token.rs

💤 Files with no reviewable changes (25)

• vendor/stack-auth/.gitignore
• vendor/stack-auth/README.md
• vendor/stack-auth/Cargo.toml
• packages/cipherstash-proxy/src/proxy/sql/select_config.sql
• vendor/stack-auth/src/static_token_strategy.rs
• vendor/stack-auth/src/access_key_strategy.rs
• packages/eql-mapper/src/transformation_rules/cast_literals_as_encrypted.rs
• vendor/stack-auth/examples/auto_strategy.rs
• packages/eql-mapper/src/transformation_rules/cast_params_as_encrypted.rs
• vendor/stack-auth/src/oauth_refresher.rs
• vendor/stack-auth/src/refresher.rs
• vendor/stack-auth/examples/device_code.rs
• vendor/stack-auth/LICENSE
• vendor/stack-auth/src/access_key.rs
• vendor/stack-auth/src/device_code/tests.rs
• vendor/stack-auth/src/oauth_strategy.rs
• vendor/stack-auth/src/device_client.rs
• vendor/stack-auth/src/auto_refresh.rs
• vendor/stack-auth/src/auto_strategy.rs
• vendor/stack-auth/src/token.rs
• vendor/stack-auth/src/access_key_refresher.rs
• vendor/stack-auth/src/device_code/mod.rs
• vendor/stack-auth/src/device_code/protocol.rs
• vendor/stack-auth/src/service_token.rs
• vendor/stack-auth/src/lib.rs

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Pipeline table doesn't match the actual rule set.

This table was updated for v3 but doesn't line up with the rules actually wired into the pipeline (type_checked_statement.rs::make_transformer, per this stack's own diff): the real chain is SubstituteEncryptedLiterals, RewriteStandardSqlFnsOnEqlTypes, RewriteContainmentOps, RewriteJsonValueSelectorEq, RewriteEqlComparisonOps, RewriteEqlMatchOps, RewriteEqlOrderBy, RewriteEqlGroupBy, CastFullPayloadOperands, PreserveEffectiveAliases, FailOnPlaceholderChange. The rows CastLiteralsAsEncrypted/CastParamsAsEncrypted don't match any rule struct name in that chain (the actual casting rules are SubstituteEncryptedLiterals and CastFullPayloadOperands), and three rules central to this PR — RewriteJsonValueSelectorEq, RewriteEqlOrderBy, RewriteEqlGroupBy — are missing from the table entirely.

📝 Suggested correction direction

-| `CastLiteralsAsEncrypted` | Replaces plaintext literals with the ciphertext cast to the column's v3 domain (`::public.eql_v3_*`) or, for a query operand, its query twin (`::eql_v3.query_*`) |
-| `CastParamsAsEncrypted` | Wraps parameter placeholders (`$1`, `$2`, ...) with the same v3 domain casts |
+| `SubstituteEncryptedLiterals` | Replaces plaintext literals with the ciphertext cast to the column's v3 domain (`::public.eql_v3_*`) or, for a query operand, its query twin (`::eql_v3.query_*`) |
+| `RewriteJsonValueSelectorEq` | Rewrites encrypted JSON field equality/inequality to value-selector containment |
+| `RewriteEqlOrderBy` | Rewrites `ORDER BY` on an encrypted column to order by its ordering term |
+| `RewriteEqlGroupBy` | Rewrites `GROUP BY` on an encrypted column to group by its equality term, lifting projections through `eql_v3.grouped_value` |
+| `CastFullPayloadOperands` | Wraps `INSERT`/`UPDATE` value placeholders (`$1`, `$2`, ...) with the column's full-payload v3 domain cast |

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	| Rule | What it does |
	|---|---|
	| `CastLiteralsAsEncrypted` | Replaces plaintext literals with `eql_v2.cast_as_encrypted(ciphertext)` |
	| `CastParamsAsEncrypted` | Wraps parameter placeholders (`$1`, `$2`, ...) with encrypted casts |
	| `RewriteContainmentOps` | Transforms `col @> val` to `eql_v2.jsonb_contains(col, val)` |
	| `RewriteStandardSqlFnsOnEqlTypes` | Rewrites `min()`, `max()`, `jsonb_path_query()` etc. to `eql_v2.*` equivalents |
	| `RewriteEqlComparisonOps` | Rewrites scalar comparisons: `col <op> x` → `eql_v3.<term>(col) <op> eql_v3.<term>(x)` (term chosen from the column's domain: `eq_term`/`ord_term`/`ord_term_ore`) |
	| `RewriteEqlMatchOps` | Rewrites `LIKE`/`ILIKE`/`@@` to `eql_v3.match_term(a) @> eql_v3.match_term(b)` |
	| `RewriteContainmentOps` | Rewrites JSON `@>`/`<@` to `eql_v3.jsonb_contains`/`jsonb_contained_by`, and `->`/`->>` to `eql_v3."->"`/`"->>"` |
	| `RewriteStandardSqlFnsOnEqlTypes` | Rewrites `min()`, `max()`, `jsonb_path_query()` etc. to their `eql_v3.*` counterparts (`count()` stays native) |
	| `CastLiteralsAsEncrypted` | Replaces plaintext literals with the ciphertext cast to the column's v3 domain (`::public.eql_v3_*`) or, for a query operand, its query twin (`::eql_v3.query_*`) |
	| `CastParamsAsEncrypted` | Wraps parameter placeholders (`$1`, `$2`, ...) with the same v3 domain casts |
	| `PreserveEffectiveAliases` | Maintains column aliases through transformations |
	| `FailOnPlaceholderChange` | Postcondition check that prepared statement placeholders weren't corrupted |
	| Rule | What it does |
	|---|---|
	| `RewriteEqlComparisonOps` | Rewrites scalar comparisons: `col <op> x` → `eql_v3.<term>(col) <op> eql_v3.<term>(x)` (term chosen from the column's domain: `eq_term`/`ord_term`/`ord_term_ore`) |
	| `RewriteEqlMatchOps` | Rewrites `LIKE`/`ILIKE`/`@@` to `eql_v3.match_term(a) @> eql_v3.match_term(b)` |
	| `RewriteContainmentOps` | Rewrites JSON `@>`/`<@` to `eql_v3.jsonb_contains`/`jsonb_contained_by`, and `->`/`->>` to `eql_v3."->"`/`"->>"` |
	| `RewriteStandardSqlFnsOnEqlTypes` | Rewrites `min()`, `max()`, `jsonb_path_query()` etc. to their `eql_v3.*` counterparts (`count()` stays native) |
	| `SubstituteEncryptedLiterals` | Replaces plaintext literals with the ciphertext cast to the column's v3 domain (`::public.eql_v3_*`) or, for a query operand, its query twin (`::eql_v3.query_*`) |
	| `RewriteJsonValueSelectorEq` | Rewrites encrypted JSON field equality/inequality to value-selector containment |
	| `RewriteEqlOrderBy` | Rewrites `ORDER BY` on an encrypted column to order by its ordering term |
	| `RewriteEqlGroupBy` | Rewrites `GROUP BY` on an encrypted column to group by its equality term, lifting projections through `eql_v3.grouped_value` |
	| `CastFullPayloadOperands` | Wraps `INSERT`/`UPDATE` value placeholders (`$1`, `$2`, ...) with the column's full-payload v3 domain cast |
	| `PreserveEffectiveAliases` | Maintains column aliases through transformations |
	| `FailOnPlaceholderChange` | Postcondition check that prepared statement placeholders weren't corrupted |

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ARCHITECTURE.md` around lines 117 - 126, Update the pipeline rules table to
match the chain assembled by type_checked_statement.rs::make_transformer: rename
the casting rows to SubstituteEncryptedLiterals and CastFullPayloadOperands,
remove the inaccurate CastParamsAsEncrypted entry, and add
RewriteJsonValueSelectorEq, RewriteEqlOrderBy, and RewriteEqlGroupBy with
descriptions of their behavior. Preserve the existing descriptions for rules
that remain in the actual chain.

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

->/->> headings dropped the left operand's type.

Both headings read -> text returns eql_v3_json_search decrypted as jsonb / ->> text returns eql_v3_json_search decrypted as jsonb, omitting the left-hand operand's type entirely. Every sibling operator heading in this doc (e.g. @>/<@ at lines 270 and 325) explicitly names both operand types (eql_v3_json_search @> eql_v3_json_search returns boolean). This looks like a leftover from the v2→v3 heading rewrite (the old eql_v2_encrypted -> prefix was dropped but never replaced with eql_v3_json_search ->).

📝 Proposed fix

-### `-> text returns eql_v3_json_search decrypted as jsonb`
+### `eql_v3_json_search -> text returns eql_v3_json_search decrypted as jsonb`

-### `->> text returns eql_v3_json_search decrypted as jsonb`
+### `eql_v3_json_search ->> text returns eql_v3_json_search decrypted as jsonb`

Also applies to: 204-204

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/reference/searchable-json.md` at line 150, Update the `->` and `->>`
headings in searchable-json.md to include `eql_v3_json_search` as the left-hand
operand type, matching the operand-type format used by sibling operator headings
while preserving their existing return descriptions.

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

Port the fixture path before disabling these regressions.

“Regenerate fixtures from a v3 baseline” cannot re-enable this suite: insert_encrypted_directly still casts fixture payloads to eql_v2_encrypted. V3-generated fixtures will therefore fail reinsertion, leaving encryption, decryption, and JSON regression coverage permanently skipped.

• packages/cipherstash-proxy-integration/src/eql_regression.rs#L157-L157: port fixture generation and direct insertion to v3/jsonb payloads, then unignore generation.
• packages/cipherstash-proxy-integration/src/eql_regression.rs#L268-L268: regenerate and re-enable text regression coverage.
• packages/cipherstash-proxy-integration/src/eql_regression.rs#L300-L300: regenerate and re-enable int2 coverage.
• packages/cipherstash-proxy-integration/src/eql_regression.rs#L330-L330: regenerate and re-enable int4 coverage.
• packages/cipherstash-proxy-integration/src/eql_regression.rs#L360-L360: regenerate and re-enable int8 coverage.
• packages/cipherstash-proxy-integration/src/eql_regression.rs#L390-L390: regenerate and re-enable float8 coverage.
• packages/cipherstash-proxy-integration/src/eql_regression.rs#L420-L420: regenerate and re-enable boolean coverage.
• packages/cipherstash-proxy-integration/src/eql_regression.rs#L450-L450: regenerate and re-enable JSONB decryption coverage.
• packages/cipherstash-proxy-integration/src/eql_regression.rs#L480-L480: regenerate and re-enable JSON field-access coverage.
• packages/cipherstash-proxy-integration/src/eql_regression.rs#L532-L532: regenerate and re-enable JSON array coverage.

📍 Affects 1 file

• packages/cipherstash-proxy-integration/src/eql_regression.rs#L157-L157 (this comment)
• packages/cipherstash-proxy-integration/src/eql_regression.rs#L268-L268
• packages/cipherstash-proxy-integration/src/eql_regression.rs#L300-L300
• packages/cipherstash-proxy-integration/src/eql_regression.rs#L330-L330
• packages/cipherstash-proxy-integration/src/eql_regression.rs#L360-L360
• packages/cipherstash-proxy-integration/src/eql_regression.rs#L390-L390
• packages/cipherstash-proxy-integration/src/eql_regression.rs#L420-L420
• packages/cipherstash-proxy-integration/src/eql_regression.rs#L450-L450
• packages/cipherstash-proxy-integration/src/eql_regression.rs#L480-L480
• packages/cipherstash-proxy-integration/src/eql_regression.rs#L532-L532

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/cipherstash-proxy-integration/src/eql_regression.rs` at line 157,
The EQL regression fixtures remain disabled because generation and
insert_encrypted_directly still use v2 ciphertext and eql_v2_encrypted casts. In
packages/cipherstash-proxy-integration/src/eql_regression.rs:157-157, port
fixture generation and direct insertion to v3/jsonb payloads, regenerate
fixtures, and remove the ignore; then regenerate and re-enable text coverage at
268-268, int2 at 300-300, int4 at 330-330, int8 at 360-360, float8 at 390-390,
boolean at 420-420, JSONB decryption at 450-450, JSON field access at 480-480,
and JSON array coverage at 532-532.

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Rooted-path detection only recognises the $. prefix.

jsonb_path_query accepts rooted paths that don't begin with $. — '$', '$[0]', '$["a"]', '$[*].b'. Those get re-rooted into $.$, $.$[0], etc., producing a selector that silently matches nothing rather than erroring.

🐛 Proposed fix

 pub fn json_selector_path(val: &str) -> String {
-    if val.starts_with("$.") {
+    if val.starts_with('$') {
         val.to_string()
     } else {
         format!("$.{val}")
     }
 }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	/// Normalises a JSON field selector to an eJSONPath rooted at `$`.
	///
	/// `->`/`->>` take a bare field name (`name`), `jsonb_path_query*` takes a path
	/// (`nested.title`, or already-rooted `$.nested.title`). The client's
	/// `Selector::parse` only accepts the rooted form.
	pub fn json_selector_path(val: &str) -> String {
	if val.starts_with("$.") {
	val.to_string()
	} else {
	format!("$.{val}")
	}
	}
	/// Normalises a JSON field selector to an eJSONPath rooted at `$`.
	///
	/// `->`/`->>` take a bare field name (`name`), `jsonb_path_query*` takes a path
	/// (`nested.title`, or already-rooted `$.nested.title`). The client's
	/// `Selector::parse` only accepts the rooted form.
	pub fn json_selector_path(val: &str) -> String {
	if val.starts_with('$') {
	val.to_string()
	} else {
	format!("$.{val}")
	}
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/cipherstash-proxy/src/postgresql/data/from_sql.rs` around lines 109
- 120, Update json_selector_path to treat any selector beginning with the JSON
path root character '$' as already rooted, including '$', '$[0]', '$["a"]', and
'$[*].b'; only prepend '$.' for unrooted field names.

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
rg -n 'table_schema' --type=sql packages/cipherstash-proxy/src/proxy/sql
ast-grep run --pattern 'Identifier::new($$$)' --lang rust packages/cipherstash-proxy/src | head -50
rg -nP -C3 'fn new\s*\(' packages/cipherstash-proxy/src --glob '*identifier*'

Repository: cipherstash/proxy

Length of output: 1735

---

🏁 Script executed:

#!/bin/bash
set -e
printf '--- manager relevant sections ---\n'
sed -n '1,260p' packages/cipherstash-proxy/src/proxy/encrypt_config/manager.rs
printf '\n--- schema SQL ---\n'
cat -n packages/cipherstash-proxy/src/proxy/sql/select_table_schemas.sql
printf '\n--- eql identifier occurrences ---\n'
rg -n 'pub struct Identifier|impl .*Identifier|Identifier|schema' packages/cipherstash-proxy/src --glob '*.rs'

Repository: cipherstash/proxy

Length of output: 246

---

🏁 Script executed:

#!/bin/bash
set -e
echo '--- manager relevant sections ---'
sed -n '1,280p' packages/cipherstash-proxy/src/proxy/encrypt_config/manager.rs
echo
echo '--- schema SQL ---'
cat -n packages/cipherstash-proxy/src/proxy/sql/select_table_schemas.sql
echo
echo '--- eql identifier occurrences ---'
rg -n 'pub struct Identifier|impl .*Identifier|Identifier|schema' packages/cipherstash-proxy/src --glob '*.rs'

Repository: cipherstash/proxy

Length of output: 30354

---

🏁 Script executed:

#!/bin/bash
set -e
echo '--- schema manager / load_schema relevant sections ---'
sed -n '1,225p' packages/cipherstash-proxy/src/proxy/schema/manager.rs
echo
echo '--- find package manifests for cipherstash-client source / dependency ---'
fd -i 'Cargo.toml|Cargo.lock' . -d 6 | while read -r f; do
  grep -n 'cipherstash-client\|cipherstash_proxy\|cipherstash-client\|packages=cipherstash-proxy' "$f" || true
done
echo
echo '--- identifier definitions and constructor usage in codebase ---'
rg -n 'struct Identifier|enum Identifier|pub fn new|impl .*Identifier' --glob '*.rs' --glob '!packages/cipherstash-proxy/src/postgresql/data/from_sql.rs'

Repository: cipherstash/proxy

Length of output: 7721

---

🌐 Web query:

cipherstash-client 0.42.0 eql Identifier::new source

💡 Result:

In the cipherstash-client Rust SDK, the Identifier::new method is used to construct a new identifier, which represents the specific table and column associated with an encrypted payload [1][2]. This identifier is a core component within the eql module, which handles the types and encryption/decryption logic required to interact with CipherStash's Encrypt Query Language (EQL) [3][4]. The cipherstash-client SDK (version 0.42.0 is the current version on crates.io as of July 2026) [5] provides the necessary abstractions to work with EQL. While specific method signatures can evolve between versions, the Identifier struct is utilized within the EncryptedPayload structure to uniquely identify the data's origin schema [1]. You can access the official documentation for the latest version of the crate on docs.rs to view the precise signature and implementation details for Identifier::new and related types [3][6].

Citations:

• 1: https://docs.rs/cipherstash-client/latest/cipherstash_client/eql/struct.EncryptedPayload.html
• 2: https://docs.rs/cipherstash-client/latest/cipherstash_client/eql/enum.EqlCiphertext.html
• 3: https://docs.rs/cipherstash-client/latest/cipherstash_client/
• 4: https://docs.rs/cipherstash-client/latest/cipherstash_client/index.html
• 5: https://crates.io/crates/cipherstash-client
• 6: https://docs.rs/cipherstash-client/latest/cipherstash_client/all.html

---

🌐 Web query:

github.com/cipherstash/proxy src/eql/schema.rs cipherstash-client Identifier new

💡 Result:

In the context of the CipherStash Proxy codebase, particularly within src/eql/schema.rs, Identifier::new is a method used to construct an Identifier object, which represents a SQL identifier (such as a table or column name) [1]. Historically, this has been used in the IndexResolver to handle schema-qualified table names [1]. For instance, it allows the proxy to correctly resolve TableColumn lookups by using a fully qualified table name rather than just a bare table name, ensuring that schema-qualified EncryptConfig keys are matched correctly [1]. While cipherstash-client is a distinct Rust crate providing SDK functionality (such as managing keysets, workspace access, and authentication), the Identifier type found in cipherstash/proxy is typically part of the proxy's internal logic for parsing and mapping SQL statements to EQL (Encrypt Query Language) [1][2]. It should not be confused with the Name struct or other resource identifiers found in the cipherstash-client crate, which are used for managing CipherStash service resources [3][4].

Citations:

• 1: feat: client 0.38.0 migration — drop vendored stack-auth + EQL v2.3 mapper support (CIP-3233) #409
• 2: https://crates.io/crates/cipherstash-client
• 3: https://docs.rs/cipherstash-client/latest/cipherstash_client/
• 4: https://docs.rs/cipherstash-client/latest/cipherstash_client/struct.Name.html

---

🌐 Web query:

crates.io cipherstash-client 0.42.0 eql.rs Identifier fn new

💡 Result:

In the cipherstash-client crate (version 0.42.0), the Identifier type located in the cipherstash_client::eql module is used to represent a specific database table and column pair [1][2]. While the public documentation for cipherstash_client confirms that Identifier is a key component for EQL payloads and internal configuration lookups [1][2][3], it does not explicitly document a public new constructor method for the Identifier struct. Typically, in this SDK, identifiers are managed through internal resolution paths or are implicitly handled by the types that contain them, such as EncryptedPayload [2]. If you are attempting to construct an identifier, note that internal codebase discussions suggest that when resolving configuration, the SDK performs lookups that rely on fully qualified table names [3]. Developers should rely on the documented interfaces for EQL operations rather than manually constructing internal structures unless those methods are explicitly exposed as public API [1][2].

Citations:

• 1: https://docs.rs/cipherstash-client/latest/cipherstash_client/eql/index.html
• 2: https://docs.rs/cipherstash-client/latest/cipherstash_client/eql/struct.EncryptedPayload.html
• 3: feat: client 0.38.0 migration — drop vendored stack-auth + EQL v2.3 mapper support (CIP-3233) #409

---

🌐 Web query:

ghcr.io crates.io source cipherstash-client 0.42.0 eql identifier

💡 Result:

The cipherstash-client crate is an official Rust SDK provided by CipherStash for interacting with their services, such as ZeroKMS, the CipherStash Token Service (CTS), and Audit logging [1][2]. As of July 28, 2026, version 0.42.0 is the latest published version on crates.io [1]. Regarding the Encrypt Query Language (EQL) components in the client: 1. Identifier: Within the cipherstash_client::eql module, Identifier is a struct used to identify specific database table and column pairs associated with encrypted payloads [3][4]. The EqlCiphertext enum provides a method identifier which returns the identifier for a given payload [5]. 2. EQL Payload Format: In the context of EQL, the identifier is part of the EncryptedPayload structure, which includes fields such as the table identifier (i.t) and column identifier (i.c) [4][6]. 3. Container/Registry: While you mentioned ghcr.io, cipherstash-client is primarily distributed as a Rust crate via crates.io [1]. The CipherStash suite source code is maintained on GitHub (https://github.com/cipherstash/cipherstash-suite) [1], and container images for related infrastructure (like CipherStash Proxy) may be hosted on ghcr.io, but the client library itself is consumed as a dependency in Rust projects via Cargo [1][2].

Citations:

• 1: https://crates.io/crates/cipherstash-client
• 2: https://docs.rs/cipherstash-client/latest/cipherstash_client/index.html
• 3: https://docs.rs/cipherstash-client/latest/cipherstash_client/eql/index.html
• 4: https://docs.rs/cipherstash-client/latest/cipherstash_client/eql/struct.EncryptedPayload.html
• 5: https://docs.rs/cipherstash-client/latest/cipherstash_client/eql/enum.EqlCiphertext.html
• 6: https://github.com/cipherstash/encrypt-query-language/blob/main/docs/reference/PAYLOAD.md

---

🌐 Web query:

site:docs.rs/cipherstash-client/0.42.0 cipherstash_client::eql::Identifier

💡 Result:

There is no publicly indexed documentation or code reference for a specific identifier named cipherstash_client::eql::Identifier. CipherStash is a data security platform that provides searchable encryption for PostgreSQL [1]. Its architecture relies on the Encrypt Query Language (EQL), which defines the abstractions, JSONB payload formats, and indexing functions required to perform operations like equality, range, and free-text search directly over encrypted data [1][2]. While CipherStash utilizes Rust for its proxy and core encryption libraries [2][3], the specific path or struct cipherstash_client::eql::Identifier does not appear in the available project repositories [1][2][3][4][5]. It is possible that this refers to an internal, non-public, or deprecated API, or a component of a specific implementation that is not exposed in the main documentation.

Citations:

• 1: https://github.com/cipherstash/cipherstash
• 2: https://github.com/cipherstash/proxy?tab=readme-ov-file
• 3: https://www.github.com/cipherstash
• 4: https://github.com/cipherstash/protectjs
• 5: https://github.com/cipherstash/stack

---

🌐 Web query:

github.com/cipherstash/cipherstash-src 0.42.0 e Ql Identifier::new table column

💡 Result:

The reference to Identifier::new in the context of CipherStash's internal codebases (specifically within the cipherstash/proxy repository) relates to the construction of identifiers for table-column lookups during EQL (Encrypt Query Language) processing [1]. In internal development (such as the migration work cited in cipherstash/proxy pull requests), Identifier::new is used to construct identifiers that map data rows to specific schema-qualified table columns [1]. Developers have been advised to ensure that Identifier::new is called with fully qualified table names to prevent lookup failures, particularly for schema-qualified tables that might otherwise default to an incorrect lookup path [1]. This identifier structure is fundamental to how CipherStash handles encrypted data, where each piece of ciphertext is associated with a specific table and column (often represented as an object with t for table and c for column) to enable correct decryption and index utilization [2]. Please note that cipherstash-src is not a standard public repository name; CipherStash repositories are typically organized by their specific components, such as proxy, stack, encrypt-query-language, or cipherstash-client [3]. The usage described pertains to internal Rust-based infrastructure within the cipherstash/proxy project [1].

Citations:

• 1: feat: client 0.38.0 migration — drop vendored stack-auth + EQL v2.3 mapper support (CIP-3233) #409
• 2: https://cipherstash.com/docs/stack/reference/cipher-cell
• 3: https://github.com/cipherstash/cipherstash

---

🌐 Web query:

crates.io source cipherstash-client 0.42.0 identifier.rs New Identifier table column

💡 Result:

In the cipherstash-client crate, specifically within the cipherstash_client::eql module, the Identifier struct is used to represent the table and column to which an encrypted payload belongs [1][2]. The EncryptedPayload struct, which is defined in cipherstash_client::eql, contains an identifier field of type Identifier [2]. According to the documentation for this struct, this identifier serves to identify the "Table and column this payload belongs to" [2]. While there is no public file named identifier.rs exposed as a top-level module in the crate documentation, the Identifier type is a core component within the eql module, which handles CipherStash encryption schemes and indexers [3][4][2]. The version 0.42.0 of cipherstash-client was published on July 19, 2026 [5]. You can review the specific implementation details by accessing the source code for the eql module in the cipherstash/cipherstash-suite repository on GitHub [5].

Citations:

• 1: https://docs.rs/cipherstash-client/latest/cipherstash_client/all.html
• 2: https://docs.rs/cipherstash-client/latest/cipherstash_client/eql/struct.EncryptedPayload.html
• 3: https://docs.rs/cipherstash-client/latest/cipherstash_client/
• 4: https://docs.rs/cipherstash-client/latest/cipherstash_client/index.html
• 5: https://crates.io/crates/cipherstash-client

---

🌐 Web query:

rust docs.rs source cipherstash-client 0.42.0 Identifier::new table column Identifier struct

💡 Result:

In the cipherstash-client crate (version 0.42.0), the Identifier struct is located within the cipherstash_client::eql module [1]. This struct is used to uniquely identify a database table and column pair [2][3][1]. While the documentation confirms the existence of the Identifier struct and its role in EQL payloads [2][3][1], specific public constructor methods such as Identifier::new are not explicitly documented in the available crate documentation. References in development discussions suggest that Identifier construction may be used during index resolution to target fully qualified table and column names for configuration lookups [4]. For further implementation details, you may need to inspect the source code directly or examine the private module visibility if the constructor is not exposed in the public API.

Citations:

• 1: https://docs.rs/cipherstash-client/latest/cipherstash_client/eql/index.html
• 2: https://docs.rs/cipherstash-client/latest/cipherstash_client/eql/struct.EncryptedPayload.html
• 3: https://docs.rs/cipherstash-client/latest/cipherstash_client/eql/struct.SteVecPayload.html
• 4: feat: client 0.38.0 migration — drop vendored stack-auth + EQL v2.3 mapper support (CIP-3233) #409

---

Include the schema when loading encrypt config

SCHEMA_QUERY groups by table_schema, table_name but load_encrypt_config inserts into HashMap<eql::Identifier> with only table_name and column. Same-named tables in different schemas overwrite each other, so a column can receive the wrong domain config or drop encryption mapping entirely. Restrict the query/scanner to the served schema, or carry the loaded schema into the config key before inserting.
[low_effort_and_HIGH_reward not applicable]

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/cipherstash-proxy/src/proxy/encrypt_config/manager.rs` around lines
202 - 223, Update load_encrypt_config to preserve table_schema from SCHEMA_QUERY
when building each eql::Identifier, so configurations for same-named tables in
different schemas cannot overwrite one another. Carry the schema through the
table scan and include it in map.insert alongside table_name and column, or
restrict SCHEMA_QUERY to the served schema.

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Add language identifiers to fenced code blocks.

Static analysis flags both fenced blocks as missing a language tag (MD040).

📝 Proposed fix

-```
+```text
 col <op> operand   →   eql_v3.<term>(col) <op> eql_v3.<term>(operand)

```diff
-```
+```text
 salary > 'x'   →   eql_v3.ord_term(salary) > eql_v3.ord_term('<ct>'::jsonb::eql_v3.query_numeric_ord)

</details>


Also applies to: 72-74

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 markdownlint-cli2 (0.23.0)</summary>

[warning] 37-37: Fenced code blocks should have a language specified

(MD040, fenced-code-language)

</details>

</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @packages/eql-mapper/docs/adr/0003-v3-rewrite-pipeline.md around lines 37 -
39, Add the text language identifier to both fenced code blocks in the ADR,
including the example around the operator transformation and the block around
the salary comparison, so the Markdown fences satisfy MD040 without changing
their contents.

</details>

<!-- fingerprinting:phantom:medusa:beignet -->

<!-- cr-indicator-types:potential_issue -->

<!-- cr-comment:v1:1c13aebd952dcac2f6b57278 -->

_Source: Linters/SAST tools_

<!-- This is an auto-generated comment by CodeRabbit -->

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Declined JSON-selector fusion never falls through to ordinary typing as documented.

infer_json_value_selector's doc comment says an unresolvable selector "declines" fusion so the comparison "falls through to ordinary typing" to produce a clear capability error. But the function just returns Ok(()) without unifying value's type, and the caller unconditionally sets handled = true afterward — so get_sql_binop_rule(op).apply_constraints(...) (the promised fallback) is never invoked. When the selector is a column reference or function call, value's type variable is left completely unconstrained instead of failing the capability check, likely surfacing a confusing TypeError::Incomplete (unresolved type variable) rather than the intended, clearer bounds error.

🐛 Proposed fix: propagate fusion success back to the caller

     fn infer_json_value_selector(
         &self,
         json: EqlValue,
         selector: &'ast Expr,
         value: &'ast Expr,
-    ) -> Result<(), TypeError> {
+    ) -> Result<bool, TypeError> {
         let Some(source) = Self::json_selector_source(selector) else {
-            return Ok(());
+            return Ok(false);
         };

         self.unify_node_with_type(
             value,
             Type::Value(Value::Eql(EqlTerm::JsonValueSelector(json))),
         )?;

         match Self::as_ast_value(value) {
             Some(ast::Value::Placeholder(placeholder)) => {
                 if let Ok(param) = Param::try_from(placeholder) {
                     self.record_json_value_selector_param(param, source);
                 }
             }
             Some(node) => self.record_json_value_selector_literal(node, source),
             None => {}
         }

-        Ok(())
+        Ok(true)
     }

                             (Some((json, selector)), None) => {
-                                self.infer_json_value_selector(json, selector, right)?;
-                                self.unify_node_with_type(expr_val, Type::native())?;
-                                true
+                                if self.infer_json_value_selector(json, selector, right)? {
+                                    self.unify_node_with_type(expr_val, Type::native())?;
+                                    true
+                                } else {
+                                    false
+                                }
                             }
                             (None, Some((json, selector))) => {
-                                self.infer_json_value_selector(json, selector, left)?;
-                                self.unify_node_with_type(expr_val, Type::native())?;
-                                true
+                                if self.infer_json_value_selector(json, selector, left)? {
+                                    self.unify_node_with_type(expr_val, Type::native())?;
+                                    true
+                                } else {
+                                    false
+                                }
                             }

Want me to open a Linear issue (CIP-) to track this?

Based on learnings, issues in this repo are tracked in Linear under the Product Engineering team using CIP- keys.

Also applies to: 633-667

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/eql-mapper/src/inference/infer_type_impls/expr.rs` around lines 168
- 192, Propagate whether JSON-selector fusion succeeded from
infer_json_value_selector instead of treating every Ok result as handled. Update
the Eq/NotEq branches in the binary-expression inference flow to set handled
only when fusion unifies the value type; when fusion declines, leave handled
false so get_sql_binop_rule(op).apply_constraints(...) performs ordinary typing
and reports the capability error.

Source: Learnings

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
rg -n -C3 'get_eql_v3_function_name\s*\(' packages/eql-mapper
rg -n -C3 'RewriteStandardSqlFnsOnEqlTypes' packages/eql-mapper

Repository: cipherstash/proxy

Length of output: 7534

---

🏁 Script executed:

#!/bin/bash
sed -n '1,150p' packages/eql-mapper/src/inference/sql_types/sql_decls.rs
printf '\n--- transformer ---\n'
sed -n '1,110p' packages/eql-mapper/src/transformation_rules/rewrite_standard_sql_fns_on_eql_types.rs

Repository: cipherstash/proxy

Length of output: 9219

---

Restrict v3 counterpart lookup to pg_catalog functions.

fn_name.0.last() maps qualified calls like custom_schema.min(...) to eql_v3.min(...) because the lookup only inspects the final identifier. The v3 rewriting should apply only to unqualified functions and explicitly pg_catalog.<name> calls.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/eql-mapper/src/inference/sql_types/sql_decls.rs` around lines 113 -
123, Update get_eql_v3_function_name to accept v3 counterparts only when fn_name
is unqualified or explicitly qualified with pg_catalog; reject other schemas
before constructing the eql_v3 name. Preserve the existing SQL_FUNCTION_TYPES
lookup and return behavior for permitted function names.

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Reversed @@ operand order isn't normalized, producing backwards match_term containment.

match_predicate's .or_else fallback anticipates the encrypted column appearing on either side of @@, but apply always binds original_col = left, original_pat = right positionally (Lines 98-104) and builds the output as match_term(left) @> match_term(right). For 'pattern' @@ email_col (a syntactically valid, if unusual, ordering that Postgres's own @@ operator supports symmetrically), this emits match_term(pattern) @> match_term(col) instead of the intended match_term(col) @> match_term(pattern) — a silently wrong containment check rather than an error.

🐛 Proposed fix: track which side matched and normalize (col, pattern) order

-    fn match_predicate(&self, expr: &'ast Expr) -> Option<(DomainIdentity, bool)> {
+    /// Returns `(domain identity, negated, column_is_left)`.
+    fn match_predicate(&self, expr: &'ast Expr) -> Option<(DomainIdentity, bool, bool)> {
         match expr {
             Expr::Like {
                 expr, negated, any, ..
             }
             | Expr::ILike {
                 expr, negated, any, ..
-            } if !*any => self.eql_identity_of(expr).map(|id| (id, *negated)),
+            } if !*any => self.eql_identity_of(expr).map(|id| (id, *negated, true)),
             Expr::BinaryOp {
                 left,
                 op: BinaryOperator::AtAt,
                 right,
-            } => self
-                .eql_identity_of(left)
-                .or_else(|| self.eql_identity_of(right))
-                .map(|id| (id, false)),
+            } => {
+                if let Some(id) = self.eql_identity_of(left) {
+                    Some((id, false, true))
+                } else {
+                    self.eql_identity_of(right).map(|id| (id, false, false))
+                }
+            }
             _ => None,
         }
     }

Then in apply, use the column_is_left flag to pick (original_col, original_pat) from (left, right) or (right, left) accordingly, so the output always builds match_term(col) @> match_term(pattern) regardless of source ordering.

Also applies to: 98-134, 136-141

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/eql-mapper/src/transformation_rules/rewrite_eql_match_ops.rs` around
lines 49 - 67, Update match_predicate to return whether the matched identity is
on the left side of the @@ expression, rather than only a boolean negation flag.
In apply, use that column_is_left result to normalize original_col and
original_pat from left/right or right/left, and build match_term so the column
is always the containment operand regardless of source ordering.

[coderdan]

Reviewer: Codex (GPT-5.6 Sol).

Five correctness findings follow.

[coderdan]

[P1] Track query roles per placeholder occurrence

When one placeholder is reused for storage and querying, e.g. UPDATE t SET enc = $1 WHERE enc = $1, this marks both renumbered outputs query-only. The proxy strips ciphertext from the SET value, so its stored-domain cast fails. Track the role per AST occurrence/output instead of per input parameter.

[coderdan]

[P2] Declare selector-only parameters as text

When a client supplies Parse OIDs for json_col -> $1 or jsonb_path_query(json_col, $1), the selector still has an encrypted column configuration, but the rewritten EQL function expects bare text. Forcing JSONB here makes PostgreSQL reject the rewritten Parse. Special-case JsonAccessor/JsonPath outputs as text.

[coderdan]

[P2] Decode binary text JSON-field operands as strings

For extended ->> equality with a binary TEXT/VARCHAR RHS, normal bytes such as Alice are passed directly to serde_json::Value::from_sql and rejected instead of receiving the text-format string fallback. The same issue affects JsonOrd. Decode textual PostgreSQL types as String before JSON parsing.

[coderdan]

[P2] Avoid wrapping aggregate projections in grouped_value

For SELECT MIN(enc) FROM t GROUP BY enc, MIN(enc) resolves to the same EqlValue as the grouped column, so this predicate wraps it as grouped_value(eql_v3.min(enc)). PostgreSQL rejects that nested aggregate. Only direct grouped-column projections should be lifted.

[coderdan]

[P2] Handle wildcard projections in GROUP BY rewrites

For a valid query such as SELECT * FROM t GROUP BY id, enc, the encrypted key becomes eq_term(enc), but the wildcard still projects bare enc, causing PostgreSQL's “must appear in GROUP BY” error. Expand/lift encrypted wildcard columns or reject this shape before emitting invalid SQL.

[coderdan]

Nice work. Findings from the Codex review should be addressed, particularly the P1.

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (2)

packages/eql-mapper/src/transformation_rules/rewrite_eql_distinct_order_by.rs (1)

259-287: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

zip silently truncates if a prior rule changed the projection length.

original_select.projection and the already-rewritten inner_select.projection are assumed to be positionally identical. If any earlier rule ever adds or removes a projection item (the group-by rewrite rewrites items in place today, but that is an implicit invariant), the zip drops the trailing columns from outer_projection and the client silently loses columns. A length assertion turning this into an explicit EqlMapperError::Transform is cheap insurance.

🛡️ Proposed guard

+        if original_select.projection.len() != inner_select.projection.len() {
+            return Err(EqlMapperError::Transform(
+                "SELECT DISTINCT projection changed length during rewriting; cannot wrap in a \
+                 subquery for ORDER BY on an encrypted column"
+                    .to_string(),
+            ));
+        }
+
         let mut outer_projection = Vec::with_capacity(inner_select.projection.len());

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@packages/eql-mapper/src/transformation_rules/rewrite_eql_distinct_order_by.rs`
around lines 259 - 287, Validate that original_select.projection and
inner_select.projection have equal lengths before the zip loop, returning an
EqlMapperError::Transform when they differ. Keep the existing positional rewrite
unchanged once the lengths match, preventing zip from silently dropping trailing
projection items.

packages/eql-mapper/src/lib.rs (1)

2601-2655: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Consider covering LIMIT/OFFSET retention and the unnamed-projection case.

The rule keeps limit_clause on the wrapping query and falls back to "?column?" when derive_effective_alias returns None (rewrite_eql_distinct_order_by.rs lines 284-285, 318-329). Neither branch is exercised here; the integration suite only covers LIMIT. Two extra table rows (e.g. ... ORDER BY salary LIMIT 2 and a projection like SELECT DISTINCT id + 1, salary ...) would pin both.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/eql-mapper/src/lib.rs` around lines 2601 - 2655, Extend the
table-driven tests around the existing DISTINCT ORDER BY cases to cover both
untested branches: add a query with ORDER BY salary and LIMIT 2, asserting the
rewritten query retains LIMIT 2 on the outer wrapper, and add a query with an
unnamed projection such as id + 1, asserting the output uses the ?column?
fallback alias from derive_effective_alias. Keep the expected SQL normalized
consistently with the existing assertions.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@packages/eql-mapper/src/transformation_rules/rewrite_eql_distinct_order_by.rs`:
- Around line 239-254: Prevent the rewrite path from returning Ok(false) after
mutating target.body. Validate the target shape and confirm target.body is a
SetExpr::Select before replacing it, or restore the original body on any
subsequent rejection; update the related branches around inner_select and
plan_order_sources so unexpected shapes return a proper error or leave the
statement unchanged.
- Around line 289-313: Update the synthetic alias generation and references used
by the rewrite rule, including the symbols creating __eql_col_* and __eql_ord_*
identifiers, so generated names cannot collide with literal user columns. Apply
the same reserved or unambiguous naming consistently to inner projection aliases
and outer ORDER BY identifiers, while preserving the existing mapping between
hoisted terms and their aliases.

---

Nitpick comments:
In `@packages/eql-mapper/src/lib.rs`:
- Around line 2601-2655: Extend the table-driven tests around the existing
DISTINCT ORDER BY cases to cover both untested branches: add a query with ORDER
BY salary and LIMIT 2, asserting the rewritten query retains LIMIT 2 on the
outer wrapper, and add a query with an unnamed projection such as id + 1,
asserting the output uses the ?column? fallback alias from
derive_effective_alias. Keep the expected SQL normalized consistently with the
existing assertions.

In
`@packages/eql-mapper/src/transformation_rules/rewrite_eql_distinct_order_by.rs`:
- Around line 259-287: Validate that original_select.projection and
inner_select.projection have equal lengths before the zip loop, returning an
EqlMapperError::Transform when they differ. Keep the existing positional rewrite
unchanged once the lengths match, preventing zip from silently dropping trailing
projection items.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d611b051-533c-4900-a983-28a092b9d182

📥 Commits

Reviewing files that changed from the base of the PR and between d962a10 and 77577f3.

📒 Files selected for processing (7)

• CHANGELOG.md
• packages/cipherstash-proxy-integration/src/select/distinct_order_by.rs
• packages/cipherstash-proxy-integration/src/select/mod.rs
• packages/eql-mapper/src/lib.rs
• packages/eql-mapper/src/transformation_rules/mod.rs
• packages/eql-mapper/src/transformation_rules/rewrite_eql_distinct_order_by.rs
• packages/eql-mapper/src/type_checked_statement.rs

🚧 Files skipped from review as they are similar to previous changes (3)

• packages/eql-mapper/src/transformation_rules/mod.rs
• CHANGELOG.md
• packages/eql-mapper/src/type_checked_statement.rs

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Silent Ok(false) on shapes applies_to/plan_order_sources already accepted.

Lines 240, 253 and 274 return Ok(false) after the rule has committed to rewriting — line 253 in particular happens after target.body was swapped out for an empty Values, leaving the query mutated into VALUES () with the original body dropped. These branches should be unreachable given applies_to (checked on the original) and the wildcard rejection, but if they ever fire the failure mode is a corrupted statement rather than an error.

🛡️ Proposed fix for the body-swap path

-        let SetExpr::Select(mut inner_select) = *body else {
-            return Ok(false);
-        };
+        let SetExpr::Select(mut inner_select) = *body else {
+            return Err(EqlMapperError::Transform(
+                "SELECT DISTINCT body was not a SELECT after rewriting".to_string(),
+            ));
+        };

Also applies to: 269-275

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@packages/eql-mapper/src/transformation_rules/rewrite_eql_distinct_order_by.rs`
around lines 239 - 254, Prevent the rewrite path from returning Ok(false) after
mutating target.body. Validate the target shape and confirm target.body is a
SetExpr::Select before replacing it, or restore the original body on any
subsequent rejection; update the related branches around inner_select and
plan_order_sources so unexpected shapes return a proper error or leave the
statement unchanged.

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
rg -n '__eql' packages/eql-mapper/src packages/cipherstash-proxy/src | head -40

Repository: cipherstash/proxy

Length of output: 3474

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== candidate files =="
git ls-files | rg '(\.rs$|manifest|Cargo\.toml)$' | rg 'packages/eql-mapper' | head -80

echo
echo "== relevant source outline =="
ast-grep outline packages/eql-mapper/src/transformation_rules/rewrite_eql_distinct_order_by.rs --view condensed || true

echo
echo "== relevant source section =="
sed -n '1,260p' packages/eql-mapper/src/transformation_rules/rewrite_eql_distinct_order_by.rs | nl -ba

echo
echo "== identifier-related usages in mapper =="
rg -n '\bIdent::new\b|order_by|OrderSource|rewrite.*distinct|distinct.*order|distinct' packages/eql-mapper/src -S | head -200

Repository: cipherstash/proxy

Length of output: 4226

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== relevant source section =="
awk '{print NR": "$0}' packages/eql-mapper/src/transformation_rules/rewrite_eql_distinct_order_by.rs | sed -n '1,270p'

echo
echo "== imports and tests mentioning reserved names or collision handling =="
rg -n '__eql|Ident::new|reserved|shadow|collision|alias|OrderBySource|OrderSource|hoist' packages/eql-mapper/src/transformation_rules/rewrite_eql_distinct_order_by.rs packages/eql-mapper/src -S | head -240

echo
echo "== file size =="
wc -l packages/eql-mapper/src/transformation_rules/rewrite_eql_distinct_order_by.rs

Repository: cipherstash/proxy

Length of output: 38983

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== sqltk Ident::new and parser docs/definition if local =="
rg -n 'struct Ident|fn new\(|impl Ident|Ident::new|unquoted|Identifier|quote' Cargo.lock Cargo.toml packages -S \
  | grep -E 'sqltk|Ident::new|struct Ident|fn new\(|unquoted|Identifier' | head -200

echo
echo "== Cargo.toml deps for sqltk =="
rg -n 'sqltk|postgres|sqlx|sql_' Cargo.toml packages/eql-mapper/Cargo.toml -S || true

echo
echo "== local sqltk source in target/cache only, read-only =="
find $HOME/.cargo/registry/src $HOME/.cargo/git/checkouts 2>/dev/null -path '*sqltk*' \( -name '*.rs' -o -name 'Cargo.toml' \) | head -50

Repository: cipherstash/proxy

Length of output: 24308

---

🌐 Web query:

sqltk Ident::new to_string quoted parser Ident unquoted

💡 Result:

In the context of the sqltk-parser crate, which is a derivative of sqlparser-rs, the Ident struct represents a SQL identifier and tracks its value and optional quote style [1][2][3]. When using Ident, the following concepts apply regarding construction and representation: Ident::new: This constructor creates a new identifier with the specified value, defaulting to no quotes (None for quote_style) and an empty span [1][4]. Quoting vs. Unquoted: The Ident struct includes a quote_style field (Option). An identifier is considered "quoted" if it was delimited by characters like double quotes in the source SQL, and "unquoted" (or plain) if no such delimiters were present [1][5]. Other methods such as with_quote exist to explicitly create identifiers with specific quote characters [1]. to_string: The Ident struct implements the to_string method (or via the Display trait), which reconstructs the identifier's string representation, typically including the original quote style if present [1][2]. This allows the parser to preserve identifier metadata during AST-to-SQL round trips [2]. While some external projects or custom implementations (such as dbt-xdbc) may use their own Ident structures with explicit Plain/Unquoted variants or custom constructor logic [6], the standard sqlparser/sqltk-parser AST Ident is defined by its value and an optional quote_style [1][7].

Citations:

• 1: https://docs.rs/sqlparser/latest/sqlparser/ast/struct.Ident.html
• 2: https://docs.rs/sqltk-parser/latest/sqltk_parser/
• 3: https://github.com/cipherstash/sqltk
• 4: https://docs.rs/datafusion/latest/datafusion/sql/sqlparser/ast/struct.Ident.html
• 5: https://docs.rs/sqlparser/latest/src/sqlparser/tokenizer.rs.html
• 6: https://github.com/dbt-labs/dbt-fusion/blob/ed90a8ea/crates/dbt-xdbc/src/sql/ident.rs
• 7: https://docs.rs/sqltk-parser/latest/sqltk_parser/ast/index.html

---

Avoid colliding with literal __eql_* columns.

This rule creates unquoted synthetic identifiers with Ident::new("...__eql_col_0") and Ident::new("...__eql_ord_0"). If the original query selects or orders by a column literally named __eql_col_0, the wrapping subquery’s ORDER BY __eql_col_0 can resolve to the user column instead of the reserved synthetic projected column. Use a reserved/unambiguous name for both outer ORDER BY references and inner aliases, or reject/use quoted variants that preserve the original effective alias.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@packages/eql-mapper/src/transformation_rules/rewrite_eql_distinct_order_by.rs`
around lines 289 - 313, Update the synthetic alias generation and references
used by the rewrite rule, including the symbols creating __eql_col_* and
__eql_ord_* identifiers, so generated names cannot collide with literal user
columns. Apply the same reserved or unambiguous naming consistently to inner
projection aliases and outer ORDER BY identifiers, while preserving the existing
mapping between hoisted terms and their aliases.

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

packages/eql-mapper/src/renumber_params.rs (1)

80-100: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Pin the query-operand cast shape for wrapped_placeholder.

wrapped_placeholder is the only decision point that turns an eql_v3.query_* cast into query_operands; it silently returns None whenever the cast body is not a single placeholder. Add a same-crate test that asserts helper-built query operands emit <placeholder>::JSONB::eql_v3.query_*, so a future change to cast_expr_to_v3_domain fails loudly instead of making the mapped payload choose the stored shape by accident.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/eql-mapper/src/renumber_params.rs` around lines 80 - 100, Add a
same-crate test covering the query-operand construction path through
wrapped_placeholder and cast_expr_to_v3_domain. Build query operands with the
existing helper, then assert the emitted operand cast has the exact
<placeholder>::JSONB::eql_v3.query_* shape, ensuring the placeholder remains the
cast body expected by wrapped_placeholder.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@packages/eql-mapper/src/renumber_params.rs`:
- Around line 80-100: Add a same-crate test covering the query-operand
construction path through wrapped_placeholder and cast_expr_to_v3_domain. Build
query operands with the existing helper, then assert the emitted operand cast
has the exact <placeholder>::JSONB::eql_v3.query_* shape, ensuring the
placeholder remains the cast body expected by wrapped_placeholder.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3b44d0db-00aa-49c5-848b-c900b0a5681e

📥 Commits

Reviewing files that changed from the base of the PR and between 77577f3 and 3dfe95e.

📒 Files selected for processing (17)

• CHANGELOG.md
• packages/cipherstash-proxy-integration/src/select/distinct_order_by.rs
• packages/cipherstash-proxy-integration/src/select/jsonb_selector_param_types.rs
• packages/cipherstash-proxy-integration/src/select/mod.rs
• packages/cipherstash-proxy-integration/src/update/mod.rs
• packages/cipherstash-proxy-integration/src/update/update_with_reused_param.rs
• packages/cipherstash-proxy/src/postgresql/data/from_sql.rs
• packages/cipherstash-proxy/src/postgresql/messages/parse.rs
• packages/eql-mapper/src/inference/infer_type_impls/select.rs
• packages/eql-mapper/src/inference/unifier/mod.rs
• packages/eql-mapper/src/lib.rs
• packages/eql-mapper/src/renumber_params.rs
• packages/eql-mapper/src/transformation_rules/mod.rs
• packages/eql-mapper/src/transformation_rules/rewrite_eql_distinct.rs
• packages/eql-mapper/src/transformation_rules/rewrite_eql_distinct_order_by.rs
• packages/eql-mapper/src/transformation_rules/rewrite_eql_group_by.rs
• packages/eql-mapper/src/type_checked_statement.rs

🚧 Files skipped from review as they are similar to previous changes (9)

• packages/cipherstash-proxy-integration/src/select/mod.rs
• packages/eql-mapper/src/transformation_rules/rewrite_eql_group_by.rs
• CHANGELOG.md
• packages/cipherstash-proxy-integration/src/select/distinct_order_by.rs
• packages/eql-mapper/src/type_checked_statement.rs
• packages/eql-mapper/src/transformation_rules/rewrite_eql_distinct_order_by.rs
• packages/cipherstash-proxy/src/postgresql/messages/parse.rs
• packages/cipherstash-proxy/src/postgresql/data/from_sql.rs
• packages/eql-mapper/src/lib.rs

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Files:"
git ls-files | rg 'packages/eql-mapper/(src/transformation_rules/rewrite_eql_distinct\.rs|src/inference/infer_type_impls/select\.rs|src/renumber_params\.rs|src/.)' | head -100

echo
echo "rewrite_eql_distinct outline:"
ast-grep outline packages/eql-mapper/src/transformation_rules/rewrite_eql_distinct.rs 2>/dev/null || true

echo
echo "relevant rewrite_eql_distinct lines 1-180:"
sed -n '1,180p' packages/eql-mapper/src/transformation_rules/rewrite_eql_distinct.rs

echo
echo "relevant select inference lines 1-100:"
sed -n '1,100p' packages/eql-mapper/src/inference/infer_type_impls/select.rs

Repository: cipherstash/proxy

Length of output: 13047

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Locate SelectItem-related code:"
git ls-files | rg 'packages/eql-mapper/src/.*(select.*item|select_items)|packages/eql-mapper/src/transformation_rules/rewrite_eql_distinct\.rs|packages/eql-mapper/src/inference/infer_type_impls/select_items\.rs|packages/eql-mapper/src/inference/infer_type_impls/select_item\.rs'

echo
echo "select_item inference:"
sed -n '1,180p' packages/eql-mapper/src/inference/infer_type_impls/select_item.rs

echo
echo "select_items inference:"
sed -n '1,180p' packages/eql-mapper/src/inference/infer_type_impls/select_items.rs

echo
echo "Search for wildcard resolution/usages:"
rg -n "SelectItem::Wildcard|Wildcard|wildcard|expand|projection" packages/eql-mapper/src -S

echo
echo "Struct definitions:"
rg -n "struct Select|enum SelectItem|pub enum SelectItem|Unresolved|Star" packages/eql-mapper/src -S

Repository: cipherstash/proxy

Length of output: 34625

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Type env projection access:"
sed -n '200,280p' packages/eql-mapper/src/inference/unifier/type_env.rs
sed -n '1,220p' packages/eql-mapper/src/inference/unifier/types.rs | sed -n '/impl Projection/,/pub fn flatten/p'
sed -n '130,200p' packages/eql-mapper/src/inference/unifier/types.rs

echo
echo "Scope tracker wildcard implementation:"
sed -n '90,155p' packages/eql-mapper/src/scope_tracker.rs
sed -n '190,230p' packages/eql-mapper/src/inference/mod.rs

echo
echo "Relevant existing tests:"
sed -n '715,780p' packages/eql-mapper/src/lib.rs
sed -n '795,825p' packages/eql-mapper/src/lib.rs
sed -n '1550,1565p' packages/eql-mapper/src/lib.rs
sed -n '2817,2895p' packages/eql-mapper/src/lib.rs
sed -n '2735,2763p' packages/eql-mapper/src/lib.rs

Repository: cipherstash/proxy

Length of output: 16842

---

Resolve wildcard projection columns before skipping them. Both the DISTINCT rewrite and the DISTINCT type bound skip SelectItem::Wildcard, so SELECT DISTINCT * FROM t bypasses the equality-term protection for encrypted columns hidden behind the wildcard. In the rewrite, a lone-wildcard projection makes distinct all None, returning Ok(false) before the wildcard rejection; in type inference, the wildcard item is never passed to unify_node_with_eq_bound. Check or expand the wildcard columns first, matching the explicit rejection already used for wildcards alongside named encrypted columns.

📍 Affects 2 files

• packages/eql-mapper/src/transformation_rules/rewrite_eql_distinct.rs#L72-L115 (this comment)
• packages/eql-mapper/src/inference/infer_type_impls/select.rs#L23-L34