feat(eql): absorb the EQL subsystem, and kill the version skew

.changeset/eql-3-0-5-migration.md

@@ -0,0 +1,42 @@
+---
+'@cipherstash/stack-prisma': minor
+---
+
+Move the bundled EQL v3 migrations to **eql-3.0.5**, which renames the SQL
+function `eql_v3.ste_vec_contains` to `eql_v3.jsonb_document_contains`. The
+operators are unchanged (`@>` / `<@` on `public.eql_v3_json_search` behave
+exactly as before) — only callers that invoke the function **by name** are
+affected, which in practice means Supabase / PostgREST, since PostgREST calls
+functions rather than operators.
+
+Two artefacts carry the new bundle:
+
+- A new upgrade edge, `20260814T0000_upgrade_eql_v3_3_0_5`, carrying the
+  invariant `cipherstash:upgrade-eql-v3-bundle-3.0.5-v1`. Databases already
+  running an earlier bundle re-install through this edge on the next
+  `prisma-next migrate`, exactly as they did for 3.0.2 and 3.0.4.
+- The baseline install migration `20260601T0100_install_eql_v3_bundle`, whose
+  baked bundle moves to 3.0.5 and which gains a fourth no-SQL carrier op for
+  the new invariant. Fresh databases therefore land on 3.0.5 from the single
+  all-additive genesis edge, keeping `db init` (additive-only policy) working.
+
+**Action required.** The baseline's bytes — and so its `migrationHash` — have
+changed. If your project already has a `migrations/cipherstash/` directory
+generated against `@cipherstash/stack-prisma@1.0.0`, delete that directory and
+re-run `prisma-next migration plan` (or `migrate`); the seed phase regenerates
+it byte-identical to the shipped artefacts. Your database keeps its markers, so
+already-applied invariants are not re-run — the only new work is the 3.0.5
+upgrade edge.
+
+**Why the baseline was re-emitted rather than left frozen.** These artefacts are
+content-addressed and normally append-only: an EQL bump ships as a new upgrade
+directory and published directories are never rewritten. That rule cannot be
+followed here without a second `from: null` genesis edge, because no upgrade
+edge can ever be walked by `db init` — every upgrade edge is a self-edge, and
+the integrity checker requires a self-edge to carry a `data`-class op, which
+`db init`'s additive-only policy refuses. A fresh database must therefore
+collect every head-ref invariant from the genesis edge it walks. The
+append-only alternative would duplicate the full ~2.6 MB bundle into a new
+genesis edge on every EQL release, permanently; re-emitting was taken instead
+while 1.0.0 was two weeks old with negligible adoption, and is a decision to be
+re-argued on adoption numbers rather than repeated by default.

.changeset/supabase-skill-eql-305.md

@@ -0,0 +1,9 @@
+---
+'stash': patch
+---
+
+Update the bundled agent skills for eql-3.0.5. `skills/stash-supabase`
+re-states the PostgREST query-domain limitations against 3.0.5 (unchanged in
+substance — the typed `eql_v3.query_*` operand requirement still stands), and
+`skills/stash-postgres` drops a claim that the CLI pins `@cipherstash/eql` to
+an exact version, which stopped being true when EQL moved in-tree.

.github/actionlint.yaml

@@ -10,3 +10,9 @@
 self-hosted-runner:
   labels:
     - blacksmith-4vcpu-ubuntu-2404
+    # Every job in the imported EQL suite. Sixteen of them, and the size is
+    # deliberate upstream: the sharded SQLx matrix compiles the full Rust
+    # dependency tree, so the runner is chosen for the compile rather than for
+    # the tests. Kept as its own label rather than renamed to the 4vcpu one —
+    # rehoming those jobs is a cost decision, not a lint fix.
+    - blacksmith-16vcpu-ubuntu-2204

.github/dependabot.yml

@@ -149,6 +149,69 @@ updates:
         update-types:
           - version-update:semver-major
 
+  # ── Cargo (packages/eql — the second Rust workspace) ───────────
+  # The EQL subtree brought a second Cargo workspace: five members
+  # (crates/eql-{domains,codegen,tests-macros,bindings} plus tests/sqlx) and
+  # its own Cargo.lock. It needs its own entry because Dependabot's cargo
+  # `directory:` is a single workspace root, not a glob — the protect-ffi entry
+  # above cannot reach it. The lockfile-to-ecosystem check in
+  # e2e/tests/supply-chain.e2e.test.ts asserts coverage per ECOSYSTEM, so it
+  # was already satisfied by that entry and would NOT have caught this gap;
+  # the symptom would simply have been that no PR ever arrived.
+  - package-ecosystem: cargo
+    # The workspace root, where Cargo.toml and Cargo.lock live. Not `/`, and
+    # not a crate directory — same trap as the protect-ffi entry documents.
+    directory: /packages/eql
+    # Monthly, matching protect-ffi and for the same reason: validating a
+    # Cargo.lock bump here means the sharded SQLx matrix in test-eql.yml, which
+    # compiles the full dependency tree and runs against live Postgres with
+    # CipherStash credentials. Security fixes are unaffected — those are driven
+    # by alerts, not by `schedule`.
+    #
+    # No `day:`, for the reason recorded above: it applies to `interval: weekly`
+    # and would be configuration that does nothing.
+    schedule:
+      interval: monthly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 3
+    labels:
+      - dependencies
+      - supply-chain
+    commit-message:
+      prefix: "chore"
+      include: scope
+    groups:
+      cargo-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    ignore:
+      # `cipherstash-client = "=0.42.0"` in tests/sqlx/Cargo.toml — the SAME
+      # exact pin, at the SAME version, as packages/protect-ffi. That is not a
+      # coincidence and it is the reason the subtree was imported: the two now
+      # share one release train, and a Dependabot PR that moved one workspace
+      # and not the other would reintroduce precisely the skew the absorption
+      # removed. Bump both, manually, in step with the npm catalog.
+      #
+      # Same caveat as above: `ignore` suppresses security PRs too. osv-scanner
+      # is the compensating control and already reaches this lockfile
+      # (`--recursive ./`).
+      - dependency-name: "cipherstash-client"
+      - dependency-name: "cts-common"
+      - dependency-name: "stack-auth"
+      - dependency-name: "stack-profile"
+      # Published from this workspace by release-plz. A Dependabot PR proposing
+      # a registry version for a crate we release here would fight the lockstep
+      # version hook (scripts/sync-lockstep-versions.mjs).
+      - dependency-name: "eql-bindings"
+      # Major bumps are reviewed and applied manually, not by Dependabot.
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
+
   # ── GitHub Actions ─────────────────────────────────────────────
   - package-ecosystem: github-actions
     directory: /

.github/workflows/bench-eql.yml

@@ -0,0 +1,119 @@
+name: "Bench EQL"
+
+# Ported from cipherstash/encrypt-query-language with the subtree. See
+# `.github/workflows/test-eql.yml` for the full account of what the move costs;
+# this file needed the same four path rewrites plus two changes of its own,
+# noted at the steps that carry them.
+#
+# Runs the slow benchmark / regression / scale SQLx tests gated behind the
+# `bench` cargo feature. Not on pull requests — those use the fast `test-eql`
+# workflow.
+# Triggers:
+#   - push to main (catches regressions before release)
+#   - nightly schedule (additional smoke)
+#   - manual workflow_dispatch (PR triage)
+on:
+  push:
+    branches:
+      - main
+    # Repo-root relative, so every entry gained the subtree prefix. Unprefixed,
+    # `src/**/*.sql` and `tests/sqlx/**/*` match nothing under this repository's
+    # root and the bench would simply stop running on pushes — silently, since
+    # a workflow that never triggers reports nothing at all.
+    paths:
+      - ".github/workflows/bench-eql.yml"
+      - "packages/eql/src/**/*.sql"
+      - "packages/eql/tests/sqlx/**/*"
+      - "packages/eql/tasks/**/*"
+      - "packages/eql/crates/**"
+      - "packages/eql/Cargo.toml"
+      - "packages/eql/Cargo.lock"
+
+  schedule:
+    # 02:00 UTC daily
+    - cron: "0 2 * * *"
+
+  workflow_dispatch:
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+  MISE_VERBOSE: "1"
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash {0}
+    # Every `run:` here is written against the EQL root.
+    working-directory: packages/eql
+
+jobs:
+  bench:
+    name: "Bench EQL (Postgres 17)"
+    runs-on: blacksmith-16vcpu-ubuntu-2204
+    timeout-minutes: 60
+
+    env:
+      POSTGRES_VERSION: "17"
+
+    steps:
+      # SHA-pinned, where upstream used floating major tags. The rest of the
+      # imported suite already pins by SHA; a mutable tag on a job that holds
+      # live CipherStash credentials means the code running there can change
+      # without a commit here. Same three pins as test-eql.yml — keep them in
+      # step. (checkout moves v4 -> v6 with this, matching that file.)
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      # Fast pre-flight: fail in seconds if a secret was rotated or cleared,
+      # before the rust-cache restore and a bench run budgeted at 60 minutes.
+      # This is a scheduled job, so nobody is watching it start — the difference
+      # between failing here and failing in `test:bench` is a legible nightly
+      # failure versus "Auth strategy error: Not authenticated" an hour in.
+      - uses: ./.github/actions/require-cs-secrets
+        with:
+          workspace-crn: ${{ vars.CS_WORKSPACE_CRN }}
+          client-id: ${{ vars.CS_CLIENT_ID }}
+          client-key: ${{ secrets.CS_CLIENT_KEY }}
+          client-access-key: ${{ secrets.CS_CLIENT_ACCESS_KEY }}
+
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+        with:
+          version: 2026.4.0
+          install: true
+          cache: true
+          # mise reads config from cwd and its PARENTS, so an action running at
+          # the repo root never sees packages/eql/mise.toml.
+          working_directory: packages/eql
+
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          workspaces: packages/eql
+          shared-key: sqlx-tests
+
+      - name: Setup database
+        run: |
+          mise run postgres:up postgres-${POSTGRES_VERSION} --extra-args "--detach --wait"
+
+      - name: Run bench tests
+        # CS_* scoped to THIS step only (least privilege): test:bench -> test:sqlx:prep
+        # -> fixture:generate:all encrypts via cipherstash-client and needs BOTH a
+        # ZeroKMS auth credential (CS_CLIENT_ACCESS_KEY + CS_WORKSPACE_CRN) AND a client
+        # key (CS_CLIENT_ID + CS_CLIENT_KEY); without them it fails "Auth strategy error:
+        # Not authenticated". Kept off job scope so checkout/mise/rust-cache actions
+        # never see them.
+        #
+        # CS_WORKSPACE_CRN and CS_CLIENT_ID read from `vars.`, not `secrets.` —
+        # this repo keeps the two non-sensitive ones there. Reading them from
+        # `secrets.` yields the empty string rather than an error.
+        env:
+          CS_CLIENT_ACCESS_KEY: ${{ secrets.CS_CLIENT_ACCESS_KEY }}
+          CS_WORKSPACE_CRN: ${{ vars.CS_WORKSPACE_CRN }}
+          CS_CLIENT_ID: ${{ vars.CS_CLIENT_ID }}
+          CS_CLIENT_KEY: ${{ secrets.CS_CLIENT_KEY }}
+        run: |
+          export active_rust_toolchain=$(rustup show active-toolchain | cut -d' ' -f1)
+          rustup component add --toolchain ${active_rust_toolchain} rustfmt clippy
+          mise run --output prefix test:bench --postgres ${POSTGRES_VERSION}

.github/workflows/fta-v3.yml

@@ -82,10 +82,10 @@ jobs:
       # reflow trips this step without a real complexity increase, re-measure
       # (`npx fta src --format table`) before assuming the code got worse.
       - name: Analyze stack (eql/v3) complexity
-        run: pnpm --filter @cipherstash/stack run analyze:complexity
+        run: pnpm exec turbo run analyze:complexity --filter @cipherstash/stack
 
       - name: Analyze stack-drizzle complexity
-        run: pnpm --filter @cipherstash/stack-drizzle run analyze:complexity
+        run: pnpm exec turbo run analyze:complexity --filter @cipherstash/stack-drizzle
 
       - name: Analyze stack-supabase complexity
-        run: pnpm --filter @cipherstash/stack-supabase run analyze:complexity
+        run: pnpm exec turbo run analyze:complexity --filter @cipherstash/stack-supabase

.github/workflows/macro-expand-eql.yml

@@ -0,0 +1,95 @@
+name: "Macro expand EQL"
+
+# Ported from cipherstash/encrypt-query-language with the subtree. See
+# `.github/workflows/test-eql.yml` for what the move costs (three path rewrites
+# here) and `scripts/__tests__/eql-suite-ci.test.mjs` for why a workflow left in
+# `packages/eql/.github/` runs nowhere.
+#
+# Regenerates the matrix `cargo expand` snapshots (one per reachable
+# `scalar_matrix!` arm: integer = [eq, ord], text = [eq, ord, search], boolean =
+# [storage]) and fails if any has drifted from its committed copy. This is a
+# body-level fidelity backstop for the matrix macros — the name-inventory
+# snapshot (test-eql.yml `matrix-coverage` job) catches add/remove of whole
+# arms; this catches changes *inside* the generated bodies.
+#
+# Non-blocking by design: it is NOT a required PR check. `cargo expand` needs a
+# nightly toolchain, so it is isolated off the PR path.
+#   - nightly schedule (the backstop that flags a forgotten local regen)
+#   - manual workflow_dispatch
+#
+# GAP (intended): there is no `pull_request` trigger, so a change that only
+# touches macro *bodies* (no arm add/remove) can merge without ever running
+# here and will first surface as a red nightly run afterwards. Accept this — the
+# expand lane needs nightly and stays off the PR critical path by design.
+#
+# The pinned nightly date lives in ONE place: the `cargo +nightly-...` invocation
+# in the `test:matrix:expand` mise task. The install step below DERIVES the date
+# from mise.toml (grep), so there is nothing to keep in lockstep — bump it once in
+# mise.toml. The snapshot then only moves when the macro moves, not when nightly
+# reformats its expansion.
+on:
+  schedule:
+    # 03:00 UTC daily
+    - cron: "0 3 * * *"
+
+  workflow_dispatch:
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+  MISE_VERBOSE: "1"
+
+defaults:
+  run:
+    shell: bash {0}
+    # Every `run:` here is written against the EQL root: `mise.toml` for the
+    # nightly grep, and `tests/sqlx/snapshots` for the drift diff.
+    working-directory: packages/eql
+
+permissions:
+  contents: read
+
+jobs:
+  macro-expand:
+    name: "Macro expand drift (nightly)"
+    runs-on: blacksmith-16vcpu-ubuntu-2204
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+        with:
+          version: 2026.4.0
+          install: true
+          cache: true
+          working_directory: packages/eql
+
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          workspaces: packages/eql/tests/sqlx
+          shared-key: sqlx-tests
+
+      # Derive the pinned nightly date from mise.toml (single source of truth —
+      # the `cargo +nightly-...` invocation in the `test:matrix:expand` task) so
+      # there is nothing to bump in lockstep here. cargo-expand is likewise pinned
+      # once in mise.toml's [tools] (`cargo:cargo-expand`) and installed by the
+      # mise-action step above, so its version is single-sourced too — no
+      # hardcoded version lives in this workflow. It drives the rustfmt pass, so
+      # an unpinned version could drift the snapshot even with a frozen macro +
+      # nightly. The snapshot then only moves when the macro moves.
+      - name: Install pinned nightly toolchain
+        run: |
+          NIGHTLY=$(grep -oE 'nightly-[0-9]{4}-[0-9]{2}-[0-9]{2}' mise.toml | head -1)
+          test -n "$NIGHTLY" || { echo "could not find pinned nightly in mise.toml"; exit 1; }
+          rustup toolchain install "$NIGHTLY" --profile minimal --component rustfmt
+
+      - name: Regenerate and verify the matrix expansion snapshots
+        run: |
+          mise run test:matrix:expand
+          git diff --exit-code -- \
+            tests/sqlx/snapshots/integer_expanded.rs \
+            tests/sqlx/snapshots/text_expanded.rs \
+            tests/sqlx/snapshots/boolean_expanded.rs \
+            || { echo "Expansion snapshot stale — run 'mise run test:matrix:expand' (needs the pinned nightly) and commit."; exit 1; }

.github/workflows/prisma-next-e2e.yml

@@ -149,7 +149,7 @@ jobs:
         run: pnpm exec turbo run build --filter @cipherstash/stack-prisma
 
       - name: Emit example contract
-        run: pnpm --filter @cipherstash/prisma-example emit
+        run: pnpm exec turbo run emit --filter @cipherstash/prisma-example
 
       - name: Start E2E Postgres container
         working-directory: examples/prisma

.github/workflows/release.yml

@@ -278,6 +278,15 @@ jobs:
         uses: changesets/action@v1.9.0
         with:
           publish: pnpm run release
+          # LOAD-BEARING, and it fails OPEN if removed. Without `version:` the
+          # action runs its own built-in `changeset version` and never invokes
+          # the root `version` script — so `scripts/sync-lockstep-versions.mjs`
+          # would not run, npm would bump while
+          # packages/eql/crates/eql-bindings/Cargo.toml and the bundled SQL
+          # assets kept the old version, and the first symptom would be a
+          # published crate disagreeing with the SQL bundle it ships.
+          # Asserted by scripts/__tests__/release-version-hook.test.mjs.
+          version: pnpm run version
           commitMode: 'github-api'
         env:
           # No NPM_TOKEN — publishing authenticates via npm OIDC trusted