feat(stack,cli)!: re-baseline EQL v3 on eql-3.0.0 GA and protect-ffi 0.29

protect-ffi 0.28 → 0.29 and @cipherstash/eql 3.0.0-alpha.3 → 3.0.0:

- Rename every EQL v3 column-domain reference to the GA naming convention:
  flat, prefixed domains in public (public.eql_v3_text_search,
  public.eql_v3_integer_ord, …). Query domains stay eql_v3.query_<name>.
  DOMAIN_REGISTRY keys, introspection params, drizzle DDL emission, tests,
  skills, and the supabase reference doc all follow.
- v3 scalar/selector encryptQuery no longer throws: protect-ffi 0.29 mints
  term-only eql_v3.query_<name> operands, the query_jsonb needle, and bare
  selector hashes. EQL_V3_QUERY_UNSUPPORTED is gone; docs updated. The
  supabase adapter and drizzle operators keep the full-envelope operand
  design (PostgREST cannot cast filter values; the SQL function per proof
  selects the term).
- Pin ste_vec mode: 'standard' in the v2 searchableJson() builders (stack
  and @cipherstash/schema). 0.29 flipped the library default to compat
  (EQL v3's op term); unpinned, every v2 JSON containment query matches
  nothing and new rows stop being comparable with existing ones. The v2
  wire format stays byte-stable.
- CLI: vendor cipherstash-encrypt-v3.sql from the pinned @cipherstash/eql
  package (sha256-verified against its releaseManifest) instead of a
  hand-vendored stack fixture. Drop the v3 Supabase bundle variant: since
  eql-3.0.0 one artifact installs everywhere (operator classes self-skip on
  insufficient_privilege; ORE-backed domains are disabled when the opclass
  is absent, CIP-3468). --supabase now only adds the role grants for v3.
- encrypt-lock-context guards split into one client per wire format;
  EncryptionV3 override test asserts the v3 pin.
- Skills: add the EQL v3 typed-schema section to stash-encryption, the
  eql/v3/drizzle integration to stash-drizzle, and re-sync stash-supabase +
  docs/reference/supabase-sdk.md against the current adapter (contains()
  instead of like/ilike, no freeTextSearch tuner, introspecting factory,
  single install artifact).
- AGENTS.md subpath-export list gains eql/v3, eql/v3/drizzle, and v3.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: calvinbrewer

.changeset/cli-eql-v3-single-bundle.md

@@ -0,0 +1,16 @@
+---
+'stash': minor
+---
+
+`stash eql install --eql-version 3` now installs the eql-3.0.0 GA bundle,
+vendored from the pinned `@cipherstash/eql` package (sha256-verified).
+
+Since eql-3.0.0 one artifact installs everywhere: the operator-class
+statements self-skip when the role lacks superuser (managed Postgres,
+Supabase) and the bundle disables the ORE-backed encrypted domains it cannot
+support. The separate v3 Supabase bundle variant is gone — `--supabase` and
+`--exclude-operator-family` no longer select a different v3 file (the role
+GRANTs for `eql_v3` / `eql_v3_internal` still apply with `--supabase`).
+
+The bundled skills are also refreshed for the eql-3.0.0 naming convention
+(`public.eql_v3_<name>` column domains) and the EQL v3 typed-schema surface.

.changeset/eql-v3-ga-rebaseline.md

@@ -0,0 +1,23 @@
+---
+'@cipherstash/stack': minor
+---
+
+Re-baseline EQL v3 on the eql-3.0.0 GA release and protect-ffi 0.29.
+
+- **Breaking (v3 preview surface):** the EQL v3 column domains follow the
+  eql-3.0.0 naming convention — flat, prefixed names in `public`
+  (`public.eql_v3_text_search`, `public.eql_v3_integer_ord`, …) instead of the
+  alpha-era bare names. Databases installed from an alpha bundle must be
+  re-installed (`stash eql install --eql-version 3` replaces the schema).
+- `encryptQuery` under `eqlVersion: 3` now returns EQL v3 query operands
+  (protect-ffi 0.29): term-only scalar operands for the `eql_v3.query_<name>`
+  domains, the `eql_v3.query_jsonb` containment needle, and bare selector
+  hashes for JSON path queries — v3 scalar and selector queries no longer
+  throw `EQL_V3_QUERY_UNSUPPORTED` (the code is gone).
+- v2 `searchableJson()` columns now pin the SteVec encoding to `standard`
+  explicitly. protect-ffi 0.29 flipped the library default to `compat`
+  (EQL v3's encoding); without the pin, v2 JSON containment queries would
+  silently match nothing and newly written rows would not be comparable with
+  existing ones.
+- The EQL v3 test/install SQL is sourced from the pinned `@cipherstash/eql`
+  package (3.0.0) instead of a hand-vendored fixture.

.changeset/schema-stevec-standard-pin.md

@@ -0,0 +1,8 @@
+---
+'@cipherstash/schema': patch
+---
+
+`searchableJson()` now pins the SteVec encoding mode to `standard` explicitly.
+protect-ffi 0.29 flipped the library default to `compat` (the EQL v3
+encoding); pinning keeps the v2 wire format byte-stable so existing encrypted
+JSON columns stay queryable and comparable.

.github/workflows/tests.yml

@@ -78,13 +78,14 @@ jobs:
       - name: Test — lint script self-tests
         run: pnpm run test:scripts
 
-      # The EQL v3 bundles in packages/cli/src/sql are vendored (derived from
-      # the stack fixture monolith by gen:eql-v3-sql). Regenerate and fail on
-      # any diff so the fixture and the shipped bundles cannot drift silently.
-      - name: Check — vendored EQL v3 SQL bundles are in sync
+      # The EQL v3 bundle in packages/cli/src/sql is vendored from the pinned
+      # @cipherstash/eql package (sha256-verified by gen:eql-v3-sql).
+      # Regenerate and fail on any diff so the pin and the shipped bundle
+      # cannot drift silently.
+      - name: Check — vendored EQL v3 SQL bundle is in sync
         run: |
           pnpm --filter stash run gen:eql-v3-sql
-          git diff --exit-code -- packages/cli/src/sql/cipherstash-encrypt-v3.sql packages/cli/src/sql/cipherstash-encrypt-v3-supabase.sql
+          git diff --exit-code -- packages/cli/src/sql/cipherstash-encrypt-v3.sql
 
       - name: Create .env file in ./packages/protect/
         run: |

AGENTS.md

@@ -72,7 +72,7 @@ If these variables are missing, tests that require live encryption will fail or
 ## Repository Layout
 
 - `packages/stack`: Main package (`@cipherstash/stack`) containing the encryption client and all integrations
-  - Subpath exports: `@cipherstash/stack`, `@cipherstash/stack/client`, `@cipherstash/stack/identity`, `@cipherstash/stack/schema`, `@cipherstash/stack/types`, `@cipherstash/stack/drizzle`, `@cipherstash/stack/dynamodb`, `@cipherstash/stack/supabase`, `@cipherstash/stack/encryption`, `@cipherstash/stack/errors`, `@cipherstash/stack/wasm-inline`
+  - Subpath exports: `@cipherstash/stack`, `@cipherstash/stack/client`, `@cipherstash/stack/identity`, `@cipherstash/stack/schema`, `@cipherstash/stack/eql/v3`, `@cipherstash/stack/eql/v3/drizzle`, `@cipherstash/stack/v3`, `@cipherstash/stack/types`, `@cipherstash/stack/drizzle`, `@cipherstash/stack/dynamodb`, `@cipherstash/stack/supabase`, `@cipherstash/stack/encryption`, `@cipherstash/stack/errors`, `@cipherstash/stack/wasm-inline`
 - `packages/protect`: Core encryption library (internal, re-exported via `@cipherstash/stack`)
   - `src/index.ts`: Public API (`Encryption`, exports)
   - `src/ffi/index.ts`: `EncryptionClient` implementation, bridges to `@cipherstash/protect-ffi`