Merge pull request #326 from cipherstash/feat/update-ffi

feat: delegate credential loading to protect-ffi

Author: coderdan

.changeset/upgrade-protect-ffi.md

@@ -0,0 +1,14 @@
+---
+"@cipherstash/protect": minor
+"@cipherstash/stack": minor
+"@cipherstash/schema": minor
+"@cipherstash/drizzle": patch
+---
+
+Upgrade protect-ffi to 0.21.0 and enable array_index_mode for searchable JSON
+
+- Upgrade `@cipherstash/protect-ffi` to 0.21.0 across all packages
+- Enable `array_index_mode: 'all'` on STE vec indexes so JSON array operations
+  (jsonb_array_elements, jsonb_array_length, array containment) work correctly
+- Delegate credential resolution entirely to protect-ffi's `withEnvCredentials`
+- Download latest EQL at build/runtime instead of bundling hardcoded SQL files

local/Dockerfile

@@ -1,8 +1,12 @@
 FROM postgres:latest
 
+RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates && rm -rf /var/lib/apt/lists/*
+
+# Download latest EQL install script
+RUN curl -sLo /tmp/cipherstash-encrypt.sql https://github.com/cipherstash/encrypt-query-language/releases/latest/download/cipherstash-encrypt.sql
+
 # Copy the custom entrypoint script and SQL files
 COPY postgres-entrypoint.sh /usr/local/bin/postgres-entrypoint.sh
-COPY cipherstash-encrypt-2-1-8.sql /tmp/cipherstash-encrypt-2-1-8.sql
 COPY create-ci-table.sql /tmp/create-ci-table.sql
 
 # Make the entrypoint script executable