Fix EQL v3 concrete domains

Author: tobyhede

.changeset/eql-v3-ffi-0-27-concrete-types.md

@@ -2,4 +2,4 @@
 '@cipherstash/stack': patch
 ---
 
-Upgrade `@cipherstash/protect-ffi` to 0.27.0 and update the EQL v3 concrete type factories/domains to the new names (`Integer`, `Smallint`, `Boolean`, `Real`, `Double`, and `Bigint`).
+Upgrade `@cipherstash/protect-ffi` to 0.27.0 and update EQL v3 concrete Postgres domain names to match the SQL fixture (`int4*`, `int2*`, `bool`, `float4*`, and `float8*`).

.changeset/eql-v3-typed-client.md

@@ -11,19 +11,19 @@ Every method derives its types from the concrete `table` / `column` builder
 arguments:
 
 - `encrypt` / `encryptQuery` pin the plaintext to the column's domain type
-  (`text → string`, `int8 → bigint`, `timestamp → Date`, …).
+  (`text → string`, `timestamp → Date`, …).
 - `encryptQuery` constrains `queryType` to the column's capabilities and rejects
   storage-only columns at compile time.
 - `encryptModel` / `bulkEncryptModels` validate schema-column fields against their
   inferred plaintext type (passthrough fields are untouched) and return a precise
   encrypted model.
 - `decryptModel` / `bulkDecryptModels` return the precise plaintext model,
-  reconstructing `Date` / `bigint` values from the encrypt-config `cast_as`.
+  reconstructing `Date` values from the encrypt-config `cast_as`.
 
 Because the typed methods bind to the concrete branded v3 classes, a hand-rolled
 structural table/column is rejected — closing the soundness gap where a non-branded
 table could be encrypted at runtime while typed as plaintext.
 
 Runtime behaviour is unchanged: the encrypt/query paths return the same operations
-as the base client; only the model-decrypt paths add a per-column `Date` / `bigint`
+as the base client; only the model-decrypt paths add a per-column `Date`
 reconstruction step. The v2 client surface (`Encryption`) is untouched.

.changeset/eql-v3-typed-schema.md

@@ -2,6 +2,6 @@
 '@cipherstash/stack': minor
 ---
 
-Add EQL v3 schema builders for all generated SQL domains under `@cipherstash/stack/eql/v3`, exposed as the `types` namespace (one member per EQL v3 domain, e.g. `types.TextEq` / `types.IntegerOrd` / `types.Timestamp`), including explicit query capability metadata (`getQueryCapabilities()` / `isQueryable()`) and v3 table support in model encryption helpers (`encryptModel` / `bulkEncryptModels`).
+Add EQL v3 schema builders for supported generated SQL domains under `@cipherstash/stack/eql/v3`, exposed as the `types` namespace (one member per supported EQL v3 domain, e.g. `types.TextEq` / `types.IntegerOrd` / `types.Timestamp`), including explicit query capability metadata (`getQueryCapabilities()` / `isQueryable()`) and v3 table support in model encryption helpers (`encryptModel` / `bulkEncryptModels`).
 
-Also widen the accepted plaintext input type for `encrypt` / `encryptQuery` to include `Date` and `bigint` (via the new `Plaintext` type), so v3 `date` / `timestamp` / `int8` domains can be encrypted and queried with their natural JavaScript values.
+Also widen the accepted plaintext input type for `encrypt` / `encryptQuery` to include `Date` (via the new `Plaintext` type), so v3 `date` / `timestamp` domains can be encrypted and queried with their natural JavaScript values.

.changeset/skip-v3-bigint.md

@@ -0,0 +1,5 @@
+---
+'@cipherstash/stack': patch
+---
+
+Omit EQL v3 bigint factories from the public DSL and test matrix until native bigint round-tripping is supported.

packages/stack/__tests__/cjs-require.test.ts

@@ -93,7 +93,7 @@ describe('CJS consumers can require the built bundles', () => {
       `if (typeof v3.encryptedTable !== 'function') { throw new Error('missing v3 CJS export: encryptedTable') }`,
       `if (typeof v3.buildEncryptConfig !== 'function') { throw new Error('missing v3 CJS export: buildEncryptConfig') }`,
       `if (typeof v3.types !== 'object' || v3.types === null) { throw new Error('missing v3 CJS export: types namespace') }`,
-      `const requiredTypes = ['TextSearch', 'TextEq', 'IntegerOrd', 'Boolean', 'Timestamp', 'Bigint']`,
+      `const requiredTypes = ['TextSearch', 'TextEq', 'IntegerOrd', 'Boolean', 'Timestamp']`,
       `const missing = requiredTypes.filter((k) => typeof v3.types[k] !== 'function')`,
       `if (missing.length > 0) { throw new Error('missing v3 types.* CJS members: ' + missing.join(', ')) }`,
     ].join('\n')

packages/stack/__tests__/schema-v3-pg.test.ts

@@ -1,6 +1,6 @@
 import 'dotenv/config'
 import postgres from 'postgres'
-import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest'
+import { afterAll, beforeAll, beforeEach, expect, it } from 'vitest'
 import type { EncryptionClient } from '@/encryption'
 import { encryptedTable, types } from '@/eql/v3'
 import { Encryption } from '@/index'
@@ -107,9 +107,9 @@ beforeAll(async () => {
   await sql`
     CREATE TABLE IF NOT EXISTS protect_ci_v3_typed_domains (
       id INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-      age eql_v3.integer_ord NOT NULL,
+      age eql_v3.int4_ord NOT NULL,
       nickname eql_v3.text_eq NOT NULL,
-      active eql_v3.boolean NOT NULL,
+      active eql_v3.bool NOT NULL,
       test_run_id TEXT NOT NULL
     )
   `
@@ -280,9 +280,9 @@ describeLivePg('eql_v3 text_search postgres integration', () => {
     const [inserted] = await sql<{ id: number }[]>`
       INSERT INTO protect_ci_v3_typed_domains (age, nickname, active, test_run_id)
       VALUES (
-        ${sql.json(age as postgres.JSONValue)}::eql_v3.integer_ord,
+        ${sql.json(age as postgres.JSONValue)}::eql_v3.int4_ord,
         ${sql.json(nickname as postgres.JSONValue)}::eql_v3.text_eq,
-        ${sql.json(active as postgres.JSONValue)}::eql_v3.boolean,
+        ${sql.json(active as postgres.JSONValue)}::eql_v3.bool,
         ${TEST_RUN_ID}
       )
       RETURNING id
@@ -333,9 +333,9 @@ describeLivePg('eql_v3 text_search postgres integration', () => {
       const [row] = await sql<{ id: number }[]>`
         INSERT INTO protect_ci_v3_typed_domains (age, nickname, active, test_run_id)
         VALUES (
-          ${sql.json(ageCt)}::eql_v3.integer_ord,
+          ${sql.json(ageCt)}::eql_v3.int4_ord,
           ${sql.json(nick)}::eql_v3.text_eq,
-          ${sql.json(act)}::eql_v3.boolean,
+          ${sql.json(act)}::eql_v3.bool,
           ${TEST_RUN_ID}
         )
         RETURNING id

packages/stack/__tests__/schema-v3.test-d.ts

@@ -21,6 +21,11 @@ describe('eql_v3 schema type inference', () => {
     expectTypeOf(col).toEqualTypeOf<EncryptedTextSearchColumn>()
   })
 
+  it('does not expose bigint factories until native bigint round-tripping lands', () => {
+    // @ts-expect-error - bigint v3 domains are intentionally not public yet
+    types.Bigint('large')
+  })
+
   it('encryptedTable exposes column builders as typed properties', () => {
     const users = encryptedTable('users', {
       email: types.TextSearch('email'),

packages/stack/__tests__/schema-v3.test.ts

@@ -157,33 +157,26 @@ describe('eql_v3 text_match column', () => {
 })
 
 describe('eql_v3 concrete type names', () => {
-  it('exposes the renamed concrete type factories and emits the new EQL v3 domain names', () => {
-    expect(types.Integer('n').getEqlType()).toBe('eql_v3.integer')
-    expect(types.IntegerEq('n').getEqlType()).toBe('eql_v3.integer_eq')
-    expect(types.IntegerOrdOre('n').getEqlType()).toBe('eql_v3.integer_ord_ore')
-    expect(types.IntegerOrd('n').getEqlType()).toBe('eql_v3.integer_ord')
-
-    expect(types.Smallint('n').getEqlType()).toBe('eql_v3.smallint')
-    expect(types.SmallintEq('n').getEqlType()).toBe('eql_v3.smallint_eq')
-    expect(types.SmallintOrdOre('n').getEqlType()).toBe(
-      'eql_v3.smallint_ord_ore',
-    )
-    expect(types.SmallintOrd('n').getEqlType()).toBe('eql_v3.smallint_ord')
-
-    expect(types.Bigint('n').getEqlType()).toBe('eql_v3.bigint')
-    expect(types.BigintEq('n').getEqlType()).toBe('eql_v3.bigint_eq')
-    expect(types.BigintOrdOre('n').getEqlType()).toBe('eql_v3.bigint_ord_ore')
-    expect(types.BigintOrd('n').getEqlType()).toBe('eql_v3.bigint_ord')
-
-    expect(types.Boolean('b').getEqlType()).toBe('eql_v3.boolean')
-    expect(types.Real('n').getEqlType()).toBe('eql_v3.real')
-    expect(types.RealEq('n').getEqlType()).toBe('eql_v3.real_eq')
-    expect(types.RealOrdOre('n').getEqlType()).toBe('eql_v3.real_ord_ore')
-    expect(types.RealOrd('n').getEqlType()).toBe('eql_v3.real_ord')
-    expect(types.Double('n').getEqlType()).toBe('eql_v3.double')
-    expect(types.DoubleEq('n').getEqlType()).toBe('eql_v3.double_eq')
-    expect(types.DoubleOrdOre('n').getEqlType()).toBe('eql_v3.double_ord_ore')
-    expect(types.DoubleOrd('n').getEqlType()).toBe('eql_v3.double_ord')
+  it('preserves public factory names while exposing concrete Postgres domain names', () => {
+    expect(types.Integer('n').getEqlType()).toBe('eql_v3.int4')
+    expect(types.IntegerEq('n').getEqlType()).toBe('eql_v3.int4_eq')
+    expect(types.IntegerOrdOre('n').getEqlType()).toBe('eql_v3.int4_ord_ore')
+    expect(types.IntegerOrd('n').getEqlType()).toBe('eql_v3.int4_ord')
+
+    expect(types.Smallint('n').getEqlType()).toBe('eql_v3.int2')
+    expect(types.SmallintEq('n').getEqlType()).toBe('eql_v3.int2_eq')
+    expect(types.SmallintOrdOre('n').getEqlType()).toBe('eql_v3.int2_ord_ore')
+    expect(types.SmallintOrd('n').getEqlType()).toBe('eql_v3.int2_ord')
+
+    expect(types.Boolean('b').getEqlType()).toBe('eql_v3.bool')
+    expect(types.Real('n').getEqlType()).toBe('eql_v3.float4')
+    expect(types.RealEq('n').getEqlType()).toBe('eql_v3.float4_eq')
+    expect(types.RealOrdOre('n').getEqlType()).toBe('eql_v3.float4_ord_ore')
+    expect(types.RealOrd('n').getEqlType()).toBe('eql_v3.float4_ord')
+    expect(types.Double('n').getEqlType()).toBe('eql_v3.float8')
+    expect(types.DoubleEq('n').getEqlType()).toBe('eql_v3.float8_eq')
+    expect(types.DoubleOrdOre('n').getEqlType()).toBe('eql_v3.float8_ord_ore')
+    expect(types.DoubleOrd('n').getEqlType()).toBe('eql_v3.float8_ord')
   })
 })
 

packages/stack/__tests__/v3-matrix/catalog.ts

@@ -23,10 +23,6 @@ import type {
   QueryCapabilities,
 } from '@/eql/v3'
 import {
-  EncryptedBigintColumn,
-  EncryptedBigintEqColumn,
-  EncryptedBigintOrdColumn,
-  EncryptedBigintOrdOreColumn,
   EncryptedBooleanColumn,
   EncryptedDateColumn,
   EncryptedDateEqColumn,
@@ -103,7 +99,7 @@ export type DomainSpec = Readonly<{
    * tell `integer` from `double`, and a fractional value on an int-named domain is
    * untested territory (it would truncate against a real narrow PG column).
    */
-  samples: ReadonlyArray<string | number | bigint | boolean | Date>
+  samples: ReadonlyArray<string | number | boolean | Date>
   /**
    * Values that MUST fail encryption. Number domains reject `NaN`/`±Infinity`
    * via a global guard; other domains omit this.
@@ -179,7 +175,6 @@ const TEXT_SEARCH_IDX: Indexes = {
 // smallint/integer, fractionals for real/double/numeric. See `DomainSpec.samples`.
 const SMALLINT_S = [0, -1, 32767, -32768] as const
 const INTEGER_S = [0, -42, 2147483647, -2147483648] as const
-const BIGINT_S = [0n, -1n, 9223372036854775807n, -9223372036854775808n] as const
 const REAL_S = [0, 77.5, -117.25, 0.5] as const
 const DOUBLE_S = [0, -117.123456, 1e15, -1e15] as const
 const NUMERIC_S = [0, 12345.678, -42, -0.5] as const
@@ -216,20 +211,15 @@ const NUM_ERR = [
 // biome-ignore format: one row per domain reads as a table; keep it dense.
 export const V3_MATRIX = {
   // integer
-  'eql_v3.integer': { builder: types.Integer, ColumnClass: EncryptedIntegerColumn, castAs: 'number', capabilities: STORAGE, indexes: NONE, samples: INTEGER_S, errorSamples: NUM_ERR },
-  'eql_v3.integer_eq': { builder: types.IntegerEq, ColumnClass: EncryptedIntegerEqColumn, castAs: 'number', capabilities: EQ, indexes: UNIQUE_IDX, samples: INTEGER_S, errorSamples: NUM_ERR },
-  'eql_v3.integer_ord_ore': { builder: types.IntegerOrdOre, ColumnClass: EncryptedIntegerOrdOreColumn, castAs: 'number', capabilities: ORD, indexes: ORE_IDX, samples: INTEGER_S, errorSamples: NUM_ERR },
-  'eql_v3.integer_ord': { builder: types.IntegerOrd, ColumnClass: EncryptedIntegerOrdColumn, castAs: 'number', capabilities: ORD, indexes: ORE_IDX, samples: INTEGER_S, errorSamples: NUM_ERR },
+  'eql_v3.int4': { builder: types.Integer, ColumnClass: EncryptedIntegerColumn, castAs: 'number', capabilities: STORAGE, indexes: NONE, samples: INTEGER_S, errorSamples: NUM_ERR },
+  'eql_v3.int4_eq': { builder: types.IntegerEq, ColumnClass: EncryptedIntegerEqColumn, castAs: 'number', capabilities: EQ, indexes: UNIQUE_IDX, samples: INTEGER_S, errorSamples: NUM_ERR },
+  'eql_v3.int4_ord_ore': { builder: types.IntegerOrdOre, ColumnClass: EncryptedIntegerOrdOreColumn, castAs: 'number', capabilities: ORD, indexes: ORE_IDX, samples: INTEGER_S, errorSamples: NUM_ERR },
+  'eql_v3.int4_ord': { builder: types.IntegerOrd, ColumnClass: EncryptedIntegerOrdColumn, castAs: 'number', capabilities: ORD, indexes: ORE_IDX, samples: INTEGER_S, errorSamples: NUM_ERR },
   // smallint
-  'eql_v3.smallint': { builder: types.Smallint, ColumnClass: EncryptedSmallintColumn, castAs: 'number', capabilities: STORAGE, indexes: NONE, samples: SMALLINT_S, errorSamples: NUM_ERR },
-  'eql_v3.smallint_eq': { builder: types.SmallintEq, ColumnClass: EncryptedSmallintEqColumn, castAs: 'number', capabilities: EQ, indexes: UNIQUE_IDX, samples: SMALLINT_S, errorSamples: NUM_ERR },
-  'eql_v3.smallint_ord_ore': { builder: types.SmallintOrdOre, ColumnClass: EncryptedSmallintOrdOreColumn, castAs: 'number', capabilities: ORD, indexes: ORE_IDX, samples: SMALLINT_S, errorSamples: NUM_ERR },
-  'eql_v3.smallint_ord': { builder: types.SmallintOrd, ColumnClass: EncryptedSmallintOrdColumn, castAs: 'number', capabilities: ORD, indexes: ORE_IDX, samples: SMALLINT_S, errorSamples: NUM_ERR },
-  // bigint
-  'eql_v3.bigint': { builder: types.Bigint, ColumnClass: EncryptedBigintColumn, castAs: 'bigint', capabilities: STORAGE, indexes: NONE, samples: BIGINT_S },
-  'eql_v3.bigint_eq': { builder: types.BigintEq, ColumnClass: EncryptedBigintEqColumn, castAs: 'bigint', capabilities: EQ, indexes: UNIQUE_IDX, samples: BIGINT_S },
-  'eql_v3.bigint_ord_ore': { builder: types.BigintOrdOre, ColumnClass: EncryptedBigintOrdOreColumn, castAs: 'bigint', capabilities: ORD, indexes: ORE_IDX, samples: BIGINT_S },
-  'eql_v3.bigint_ord': { builder: types.BigintOrd, ColumnClass: EncryptedBigintOrdColumn, castAs: 'bigint', capabilities: ORD, indexes: ORE_IDX, samples: BIGINT_S },
+  'eql_v3.int2': { builder: types.Smallint, ColumnClass: EncryptedSmallintColumn, castAs: 'number', capabilities: STORAGE, indexes: NONE, samples: SMALLINT_S, errorSamples: NUM_ERR },
+  'eql_v3.int2_eq': { builder: types.SmallintEq, ColumnClass: EncryptedSmallintEqColumn, castAs: 'number', capabilities: EQ, indexes: UNIQUE_IDX, samples: SMALLINT_S, errorSamples: NUM_ERR },
+  'eql_v3.int2_ord_ore': { builder: types.SmallintOrdOre, ColumnClass: EncryptedSmallintOrdOreColumn, castAs: 'number', capabilities: ORD, indexes: ORE_IDX, samples: SMALLINT_S, errorSamples: NUM_ERR },
+  'eql_v3.int2_ord': { builder: types.SmallintOrd, ColumnClass: EncryptedSmallintOrdColumn, castAs: 'number', capabilities: ORD, indexes: ORE_IDX, samples: SMALLINT_S, errorSamples: NUM_ERR },
   // date
   'eql_v3.date': { builder: types.Date, ColumnClass: EncryptedDateColumn, castAs: 'date', capabilities: STORAGE, indexes: NONE, samples: DATE_S },
   'eql_v3.date_eq': { builder: types.DateEq, ColumnClass: EncryptedDateEqColumn, castAs: 'date', capabilities: EQ, indexes: UNIQUE_IDX, samples: DATE_S },
@@ -253,15 +243,15 @@ export const V3_MATRIX = {
   'eql_v3.text_ord': { builder: types.TextOrd, ColumnClass: EncryptedTextOrdColumn, castAs: 'string', capabilities: ORD, indexes: TEXT_ORD_IDX, samples: TEXT_ORE_S },
   'eql_v3.text_search': { builder: types.TextSearch, ColumnClass: EncryptedTextSearchColumn, castAs: 'string', capabilities: FULL, indexes: TEXT_SEARCH_IDX, samples: TEXT_ORE_S },
   // boolean
-  'eql_v3.boolean': { builder: types.Boolean, ColumnClass: EncryptedBooleanColumn, castAs: 'boolean', capabilities: STORAGE, indexes: NONE, samples: BOOLEAN_S },
+  'eql_v3.bool': { builder: types.Boolean, ColumnClass: EncryptedBooleanColumn, castAs: 'boolean', capabilities: STORAGE, indexes: NONE, samples: BOOLEAN_S },
   // real
-  'eql_v3.real': { builder: types.Real, ColumnClass: EncryptedRealColumn, castAs: 'number', capabilities: STORAGE, indexes: NONE, samples: REAL_S, errorSamples: NUM_ERR },
-  'eql_v3.real_eq': { builder: types.RealEq, ColumnClass: EncryptedRealEqColumn, castAs: 'number', capabilities: EQ, indexes: UNIQUE_IDX, samples: REAL_S, errorSamples: NUM_ERR },
-  'eql_v3.real_ord_ore': { builder: types.RealOrdOre, ColumnClass: EncryptedRealOrdOreColumn, castAs: 'number', capabilities: ORD, indexes: ORE_IDX, samples: REAL_S, errorSamples: NUM_ERR },
-  'eql_v3.real_ord': { builder: types.RealOrd, ColumnClass: EncryptedRealOrdColumn, castAs: 'number', capabilities: ORD, indexes: ORE_IDX, samples: REAL_S, errorSamples: NUM_ERR },
+  'eql_v3.float4': { builder: types.Real, ColumnClass: EncryptedRealColumn, castAs: 'number', capabilities: STORAGE, indexes: NONE, samples: REAL_S, errorSamples: NUM_ERR },
+  'eql_v3.float4_eq': { builder: types.RealEq, ColumnClass: EncryptedRealEqColumn, castAs: 'number', capabilities: EQ, indexes: UNIQUE_IDX, samples: REAL_S, errorSamples: NUM_ERR },
+  'eql_v3.float4_ord_ore': { builder: types.RealOrdOre, ColumnClass: EncryptedRealOrdOreColumn, castAs: 'number', capabilities: ORD, indexes: ORE_IDX, samples: REAL_S, errorSamples: NUM_ERR },
+  'eql_v3.float4_ord': { builder: types.RealOrd, ColumnClass: EncryptedRealOrdColumn, castAs: 'number', capabilities: ORD, indexes: ORE_IDX, samples: REAL_S, errorSamples: NUM_ERR },
   // double
-  'eql_v3.double': { builder: types.Double, ColumnClass: EncryptedDoubleColumn, castAs: 'number', capabilities: STORAGE, indexes: NONE, samples: DOUBLE_S, errorSamples: NUM_ERR },
-  'eql_v3.double_eq': { builder: types.DoubleEq, ColumnClass: EncryptedDoubleEqColumn, castAs: 'number', capabilities: EQ, indexes: UNIQUE_IDX, samples: DOUBLE_S, errorSamples: NUM_ERR },
-  'eql_v3.double_ord_ore': { builder: types.DoubleOrdOre, ColumnClass: EncryptedDoubleOrdOreColumn, castAs: 'number', capabilities: ORD, indexes: ORE_IDX, samples: DOUBLE_S, errorSamples: NUM_ERR },
-  'eql_v3.double_ord': { builder: types.DoubleOrd, ColumnClass: EncryptedDoubleOrdColumn, castAs: 'number', capabilities: ORD, indexes: ORE_IDX, samples: DOUBLE_S, errorSamples: NUM_ERR },
+  'eql_v3.float8': { builder: types.Double, ColumnClass: EncryptedDoubleColumn, castAs: 'number', capabilities: STORAGE, indexes: NONE, samples: DOUBLE_S, errorSamples: NUM_ERR },
+  'eql_v3.float8_eq': { builder: types.DoubleEq, ColumnClass: EncryptedDoubleEqColumn, castAs: 'number', capabilities: EQ, indexes: UNIQUE_IDX, samples: DOUBLE_S, errorSamples: NUM_ERR },
+  'eql_v3.float8_ord_ore': { builder: types.DoubleOrdOre, ColumnClass: EncryptedDoubleOrdOreColumn, castAs: 'number', capabilities: ORD, indexes: ORE_IDX, samples: DOUBLE_S, errorSamples: NUM_ERR },
+  'eql_v3.float8_ord': { builder: types.DoubleOrd, ColumnClass: EncryptedDoubleOrdColumn, castAs: 'number', capabilities: ORD, indexes: ORE_IDX, samples: DOUBLE_S, errorSamples: NUM_ERR },
 } as const satisfies Record<EqlV3TypeName, DomainSpec>

packages/stack/__tests__/v3-matrix/matrix-live-pg.test.ts

@@ -34,7 +34,7 @@
  */
 import 'dotenv/config'
 import postgres from 'postgres'
-import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { afterAll, beforeAll, expect, it } from 'vitest'
 import { EncryptionV3, encryptedTable } from '@/encryption/v3'
 import { unwrapResult } from '../fixtures'
 import { installEqlV3IfNeeded } from '../helpers/eql-v3'
@@ -63,7 +63,7 @@ const sql = LIVE_EQL_V3_PG_ENABLED
 const TABLE_NAME = 'v3_matrix_live_pg'
 const TEST_RUN_ID = `matrix-live-pg-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
 
-/** `eql_v3.integer_ord` -> `integer_ord`: a valid, unique Postgres column name. */
+/** `eql_v3.int4_ord` -> `int4_ord`: a valid, unique Postgres column name. */
 const slug = (t: EqlV3TypeName): string => t.replace('eql_v3.', '')
 
 const expectDecryptedStorageValue = (
@@ -108,7 +108,7 @@ const table = encryptedTable(TABLE_NAME, columns as never)
 const hasIndex = (
   indexes: DomainSpec['indexes'],
   key: 'unique' | 'ore' | 'match',
-): boolean => Boolean((indexes ?? {})[key])
+): boolean => Boolean(indexes?.[key])
 
 const matchDomains = domains.filter(([, spec]) =>
   hasIndex(spec.indexes, 'match'),