chore: bump EQL pins eql-2.2.1 → eql-2.3.1

PR #476 (merged before this branch's rebase) pinned every EQL install
script and the postgres-eql CI container at eql-2.2.1. This branch
upgrades the code to emit the EQL v2.3 payload format, so every pin
must move in lockstep — otherwise CI runs the new bytes against the
old EQL extension and JSON inserts hit `_encrypted_check_c`.

Flipped:

- `.github/workflows/tests.yml` — container image
  `ghcr.io/cipherstash/postgres-eql:17-2.2.1` → `17-2.3.1`.
- `local/docker-compose.yml` — same tag; the bench workflow
  (`tests-bench.yml`) consumes this compose file via
  `docker compose up --wait`.
- `packages/cli/src/installer/index.ts` and
  `packages/drizzle/src/bin/generate-eql-migration.ts` — `EQL_VERSION`
  constant.
- The three docs the `EQL_VERSION` pin appears in
  (`packages/protect/README.md`, `packages/drizzle/README.md`,
  `packages/drizzle/GENERATE_EQL_MIGRATION_CLI.md`).

The vendored SQL in `packages/cli/src/sql/*.sql` and the prisma-next
install bundle were already eql-2.3.1 from earlier in this PR; the
example app's `examples/prisma/migrations/cipherstash/install_eql_bundle/`
copy was also synced. `@cipherstash/schema` no longer bundles any
`.sql` (verified — no `*.sql` under `packages/schema/`).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 2 people

.github/workflows/tests.yml

@@ -15,11 +15,11 @@ jobs:
 
     # Postgres + EQL for the integration tests. Official EQL image —
     # PostgreSQL 17 with EQL pre-installed via /docker-entrypoint-initdb.d.
-    # Pinned to eql-2.2.1 to match the EQL payload format the code emits
+    # Pinned to eql-2.3.1 to match the EQL payload format the code emits
     # (protect-ffi 0.21.x); bump in lockstep with the protect-ffi upgrade.
     services:
       postgres:
-        image: ghcr.io/cipherstash/postgres-eql:17-2.2.1
+        image: ghcr.io/cipherstash/postgres-eql:17-2.3.1
         env:
           POSTGRES_USER: cipherstash
           POSTGRES_PASSWORD: password

local/docker-compose.yml

@@ -2,7 +2,7 @@ services:
   postgres: &postgres
     # PostgreSQL 17 with CipherStash EQL pre-installed (official image).
     # Pinned by tag — bump in lockstep with the EQL version the code targets.
-    image: ghcr.io/cipherstash/postgres-eql:17-2.2.1
+    image: ghcr.io/cipherstash/postgres-eql:17-2.3.1
     environment:
       PGPORT: 5432
       POSTGRES_DB: "cipherstash"

packages/cli/src/installer/index.ts

@@ -4,7 +4,7 @@ import pg from 'pg'
 
 // EQL release, pinned to match the EQL payload format this package emits.
 // Bump in lockstep with @cipherstash/protect-ffi.
-const EQL_VERSION = 'eql-2.2.1'
+const EQL_VERSION = 'eql-2.3.1'
 const EQL_INSTALL_URL =
   `https://github.com/cipherstash/encrypt-query-language/releases/download/${EQL_VERSION}/cipherstash-encrypt.sql`
 const EQL_INSTALL_NO_OPERATOR_FAMILY_URL =

packages/drizzle/GENERATE_EQL_MIGRATION_CLI.md

@@ -98,7 +98,7 @@ Or use your custom migration workflow.
 ### Before (manual):
 ```bash
 npx drizzle-kit generate --custom --name=install-eql
-curl -sL https://github.com/cipherstash/encrypt-query-language/releases/download/eql-2.2.1/cipherstash-encrypt.sql > drizzle/0001_install-eql.sql
+curl -sL https://github.com/cipherstash/encrypt-query-language/releases/download/eql-2.3.1/cipherstash-encrypt.sql > drizzle/0001_install-eql.sql
 npx drizzle-kit migrate
 ```
 

packages/drizzle/README.md

@@ -64,7 +64,7 @@ If you prefer to install EQL manually:
 
 ```bash
 npx drizzle-kit generate --custom --name=install-eql
-curl -sL https://github.com/cipherstash/encrypt-query-language/releases/download/eql-2.2.1/cipherstash-encrypt.sql > drizzle/0001_install-eql.sql
+curl -sL https://github.com/cipherstash/encrypt-query-language/releases/download/eql-2.3.1/cipherstash-encrypt.sql > drizzle/0001_install-eql.sql
 npx drizzle-kit migrate
 ```
 

packages/drizzle/src/bin/generate-eql-migration.ts

@@ -6,7 +6,7 @@ import { detectRunner } from './runner.js'
 
 // EQL release, pinned to match the EQL payload format this package emits.
 // Bump in lockstep with @cipherstash/protect-ffi.
-const EQL_VERSION = 'eql-2.2.1'
+const EQL_VERSION = 'eql-2.3.1'
 const EQL_INSTALL_URL =
   `https://github.com/cipherstash/encrypt-query-language/releases/download/${EQL_VERSION}/cipherstash-encrypt.sql`
 

packages/protect/README.md

@@ -817,14 +817,14 @@ To enable searchable encryption in PostgreSQL, [install the EQL custom types and
 1. Download the EQL install script. The version is pinned to match this release of Protect.js — install exactly this version:
 
    ```sh
-   curl -sLo cipherstash-encrypt.sql https://github.com/cipherstash/encrypt-query-language/releases/download/eql-2.2.1/cipherstash-encrypt.sql
+   curl -sLo cipherstash-encrypt.sql https://github.com/cipherstash/encrypt-query-language/releases/download/eql-2.3.1/cipherstash-encrypt.sql
    ```
 
    Using [Supabase](https://supabase.com/)? We ship an EQL release specifically for Supabase.
    Download the matching Supabase EQL install script:
 
    ```sh
-   curl -sLo cipherstash-encrypt-supabase.sql https://github.com/cipherstash/encrypt-query-language/releases/download/eql-2.2.1/cipherstash-encrypt-supabase.sql
+   curl -sLo cipherstash-encrypt-supabase.sql https://github.com/cipherstash/encrypt-query-language/releases/download/eql-2.3.1/cipherstash-encrypt-supabase.sql
    ```
 
 2. Run this command to install the custom types and functions: