chore(stack): EQL v3 concrete types via protect-ffi 0.28

Squashes the concrete-type domain work and the protect-ffi 0.24 -> 0.28
bump into a single commit, removing the intermediate 0.27 -> 0.28 rename
and re-bump churn (package.json, pnpm-lock.yaml, changeset).

Author: tobyhede

.changeset/eql-v3-ffi-0-28-concrete-types.md

@@ -0,0 +1,5 @@
+---
+'@cipherstash/stack': minor
+---
+
+Upgrade `@cipherstash/protect-ffi` to 0.28.0 and update EQL v3 concrete Postgres domain names to match the SQL fixture (`integer*`, `smallint*`, `bool`, `real*`, and `double*`). The public factories remain semantic (`Integer`, `Smallint`, `Boolean`, `Real`, `Double`) while their concrete domains change, so this is a minor release.

.changeset/eql-v3-typed-client.md

@@ -11,19 +11,19 @@ Every method derives its types from the concrete `table` / `column` builder
 arguments:
 
 - `encrypt` / `encryptQuery` pin the plaintext to the column's domain type
-  (`text → string`, `int8 → bigint`, `timestamp → Date`, …).
+  (`text → string`, `timestamp → Date`, …).
 - `encryptQuery` constrains `queryType` to the column's capabilities and rejects
   storage-only columns at compile time.
 - `encryptModel` / `bulkEncryptModels` validate schema-column fields against their
   inferred plaintext type (passthrough fields are untouched) and return a precise
   encrypted model.
 - `decryptModel` / `bulkDecryptModels` return the precise plaintext model,
-  reconstructing `Date` / `bigint` values from the encrypt-config `cast_as`.
+  reconstructing `Date` values from the encrypt-config `cast_as`.
 
 Because the typed methods bind to the concrete branded v3 classes, a hand-rolled
 structural table/column is rejected — closing the soundness gap where a non-branded
 table could be encrypted at runtime while typed as plaintext.
 
 Runtime behaviour is unchanged: the encrypt/query paths return the same operations
-as the base client; only the model-decrypt paths add a per-column `Date` / `bigint`
+as the base client; only the model-decrypt paths add a per-column `Date`
 reconstruction step. The v2 client surface (`Encryption`) is untouched.

.changeset/eql-v3-typed-schema.md

@@ -2,6 +2,6 @@
 '@cipherstash/stack': minor
 ---
 
-Add EQL v3 schema builders for all generated SQL domains under `@cipherstash/stack/eql/v3`, exposed as the `types` namespace (one member per EQL v3 domain, e.g. `types.TextEq` / `types.Int4Ord` / `types.Timestamp`), including explicit query capability metadata (`getQueryCapabilities()` / `isQueryable()`) and v3 table support in model encryption helpers (`encryptModel` / `bulkEncryptModels`).
+Add EQL v3 schema builders for supported generated SQL domains under `@cipherstash/stack/eql/v3`, exposed as the `types` namespace (one member per supported EQL v3 domain, e.g. `types.TextEq` / `types.IntegerOrd` / `types.Timestamp`), including explicit query capability metadata (`getQueryCapabilities()` / `isQueryable()`) and v3 table support in model encryption helpers (`encryptModel` / `bulkEncryptModels`).
 
-Also widen the accepted plaintext input type for `encrypt` / `encryptQuery` to include `Date` and `bigint` (via the new `Plaintext` type), so v3 `date` / `timestamp` / `int8` domains can be encrypted and queried with their natural JavaScript values.
+Also widen the accepted plaintext input type for `encrypt` / `encryptQuery` to include `Date` (via the new `Plaintext` type), so v3 `date` / `timestamp` domains can be encrypted and queried with their natural JavaScript values.

.changeset/skip-v3-bigint.md

@@ -0,0 +1,5 @@
+---
+'@cipherstash/stack': patch
+---
+
+Omit EQL v3 bigint factories from the public DSL and test matrix until native bigint round-tripping is supported.

e2e/wasm/deno.json

@@ -3,13 +3,34 @@
   "//2": "stack is imported via a file URL because the wasm-inline subpath isn't on a published version yet — once stack ships with /wasm-inline this can switch to a plain npm: specifier. protect-ffi and auth resolve via npm: against the workspace's installed versions (Deno's nodeModulesDir: auto lets it use what pnpm fetched).",
   "//3": "No --allow-ffi grant. If protect-ffi ever silently fell back to a native binding under Deno, the test would fail on missing FFI permission — this is the WASM guarantee.",
   "nodeModulesDir": "auto",
+  "//4": "Deno 2.9+ enforces a 24h minimumDependencyAge cooldown by default. Mirror pnpm-workspace.yaml's supply-chain policy (minimumReleaseAge: 7d + minimumReleaseAgeExclude) so the two toolchains agree: keep the 7-day cooldown for third-party deps, but exempt the first-party CipherStash packages this test imports — they ship on their own cadence and are bumped in lockstep. Without the exclude, a just-published protect-ffi/auth (e.g. 0.28.0) fails resolution until it ages past the window.",
+  "//5": "Deno's exclude does not support globs, so the per-platform native binary sub-packages (optional deps published in lockstep at the same version) are enumerated explicitly — mirrors pnpm-workspace.yaml's protect-ffi-* / auth-* wildcards.",
+  "minimumDependencyAge": {
+    "age": "P7D",
+    "exclude": [
+      "npm:@cipherstash/protect-ffi",
+      "npm:@cipherstash/protect-ffi-darwin-arm64",
+      "npm:@cipherstash/protect-ffi-darwin-x64",
+      "npm:@cipherstash/protect-ffi-linux-arm64-gnu",
+      "npm:@cipherstash/protect-ffi-linux-x64-gnu",
+      "npm:@cipherstash/protect-ffi-linux-x64-musl",
+      "npm:@cipherstash/protect-ffi-win32-x64-msvc",
+      "npm:@cipherstash/auth",
+      "npm:@cipherstash/auth-darwin-arm64",
+      "npm:@cipherstash/auth-darwin-x64",
+      "npm:@cipherstash/auth-linux-arm64-gnu",
+      "npm:@cipherstash/auth-linux-x64-gnu",
+      "npm:@cipherstash/auth-linux-x64-musl",
+      "npm:@cipherstash/auth-win32-x64-msvc"
+    ]
+  },
   "tasks": {
     "//task": "--no-check because TypeScript can't infer the column-on-table intersection types when stack is loaded via file URL (the dist .d.ts strips brand info). This test exists to verify RUNTIME WASM round-trips — type narrowing is covered by the package's own vitest suite.",
     "test": "deno test --no-check --allow-env --allow-net --allow-read --allow-sys --no-prompt"
   },
   "imports": {
     "@cipherstash/stack/wasm-inline": "../../packages/stack/dist/wasm-inline.js",
-    "@cipherstash/protect-ffi/wasm-inline": "npm:@cipherstash/protect-ffi@0.26.0/wasm-inline",
+    "@cipherstash/protect-ffi/wasm-inline": "npm:@cipherstash/protect-ffi@0.28.0/wasm-inline",
     "@cipherstash/auth/wasm-inline": "npm:@cipherstash/auth@0.40.0/wasm-inline"
   }
 }

packages/stack/__tests__/cjs-require.test.ts

@@ -93,7 +93,7 @@ describe('CJS consumers can require the built bundles', () => {
       `if (typeof v3.encryptedTable !== 'function') { throw new Error('missing v3 CJS export: encryptedTable') }`,
       `if (typeof v3.buildEncryptConfig !== 'function') { throw new Error('missing v3 CJS export: buildEncryptConfig') }`,
       `if (typeof v3.types !== 'object' || v3.types === null) { throw new Error('missing v3 CJS export: types namespace') }`,
-      `const requiredTypes = ['TextSearch', 'TextEq', 'Int4Ord', 'Bool', 'Timestamp']`,
+      `const requiredTypes = ['TextSearch', 'TextEq', 'IntegerOrd', 'Boolean', 'Timestamp']`,
       `const missing = requiredTypes.filter((k) => typeof v3.types[k] !== 'function')`,
       `if (missing.length > 0) { throw new Error('missing v3 types.* CJS members: ' + missing.join(', ')) }`,
     ].join('\n')

packages/stack/__tests__/encrypt-lock-context-guards.test.ts

@@ -40,7 +40,7 @@ const users = encryptedTable('users', {
 })
 
 const usersV3 = encryptedTableV3('users_v3', {
-  score: types.Int4Ord('score'),
+  score: types.IntegerOrd('score'),
 })
 
 // biome-ignore lint/suspicious/noExplicitAny: test helper reads the Result union

packages/stack/__tests__/error-codes.test.ts

@@ -5,6 +5,7 @@ import type { EncryptionClient } from '@/encryption'
 import { EncryptionErrorTypes } from '@/errors'
 import { Encryption } from '@/index'
 import { encryptedColumn, encryptedTable } from '@/schema'
+import type { BulkDecryptPayload } from '@/types'
 
 /** FFI tests require longer timeout due to client initialization */
 const FFI_TEST_TIMEOUT = 30_000
@@ -246,26 +247,30 @@ describe('FFI Error Code Preservation', () => {
 
   describe('bulkDecrypt error codes', () => {
     it(
-      'returns undefined code for malformed ciphertexts (non-FFI validation)',
+      'returns per-item errors for malformed ciphertexts',
       async () => {
-        // bulkDecrypt uses the "fallible" FFI API (decryptBulkFallible) which normally:
-        // - Succeeds at the operation level
-        // - Returns per-item results with either { data } or { error }
-        //
-        // However, malformed ciphertexts cause parsing errors BEFORE the fallible API,
-        // which throws and triggers a top-level failure (not per-item errors).
-        // These pre-FFI errors don't have structured FFI error codes.
+        // bulkDecrypt uses the fallible FFI API, so malformed items are
+        // reported per item instead of failing the whole operation.
         const invalidCiphertexts = [
           { data: { i: { t: 'test_table', c: 'email' }, v: 2, c: 'invalid1' } },
           { data: { i: { t: 'test_table', c: 'email' }, v: 2, c: 'invalid2' } },
-        ]
+        ] as unknown as BulkDecryptPayload
 
         const result = await protectClient.bulkDecrypt(invalidCiphertexts)
 
-        expect(result.failure).toBeDefined()
-        expect(result.failure?.type).toBe(EncryptionErrorTypes.DecryptionError)
-        // FFI parsing errors don't have structured error codes
-        expect(result.failure?.code).toBeUndefined()
+        if (result.failure) {
+          throw new Error(
+            `Expected per-item errors, got ${result.failure.type}`,
+          )
+        }
+
+        expect(result.data).toHaveLength(2)
+        expect(result.data.every((item) => 'error' in item)).toBe(true)
+
+        for (const item of result.data) {
+          expect(item.error).toBeDefined()
+          expect('code' in item).toBe(false)
+        }
       },
       FFI_TEST_TIMEOUT,
     )