…ption on the edge

Closes #662. `WasmEncryptionClient` exposed only encrypt/decrypt/isEncrypted,
so encrypted WHERE-clause search was architecturally impossible on Deno/edge
runtimes — even though the protect-ffi WASM build has carried
encryptQuery/encryptQueryBulk all along. The 2026-07-16 skilltester edge run
hit exactly this wall (grep -c encryptQuery dist/wasm-inline.js == 0).

Adds encryptQuery + encryptQueryBulk minting ciphertext-free EQL v3 query
terms (equality / match / ORE / JSON containment+selector). Index-type
resolution is a local ~40-line port of the native client's resolveIndexType
(this module deliberately never imports @cipherstash/protect — that would
drag the Node-only native FFI into the WASM bundle); explicit queryType is
validated against the column's indexes, omission infers by the same
unique > match > ore > ste_vec priority as the native client, and
searchableJson infers selector-vs-term from the plaintext shape. Errors
throw (consistent with this surface); the bulk form is position-stable with
nulls passing through.

Tests: unit suite pins resolution, FFI opts shape, validation, null
handling, and bulk stability against a mocked WASM module; the Deno e2e
smoke now also mints a live term (v:3, ciphertext-free) and exercises the
bulk path.

Claude-Session: https://claude.ai/code/session_01MxTTPaPP16m6br7Hoab94w

The Deno e2e caught it live: serde on the WASM side fails with "invalid
type: unit value, expected a string" when queryOp is present-but-undefined
(the native NAPI layer tolerates undefined optionals; serde-wasm does not).
Omit the field at both call sites AND in resolveQueryIndex's return (the
queryTypeToQueryOp map only carries JSON ops, so eq/match/ore mapped to
undefined). Unit test now pins the field is ABSENT, not undefined.

Claude-Session: https://claude.ai/code/session_01MxTTPaPP16m6br7Hoab94w

…surface

Review feedback on #676:

- encryptQuery/encryptQueryBulk get complete TSDoc: @example per query type
  (equality, free-text, ORE range, JSON containment + selector) each with
  the ::eql_v3.query_<domain> SQL cast pattern, @param/@returns/@throws,
  the ciphertext-free semantics, and the domain→query-type mapping
  (including the query_jsonb irregular). WasmEncryptQueryOptions.queryType
  documents all four types and the inference rules (be explicit on
  multi-index domains like TextSearch).

- New e2e/wasm/query-types.test.ts: live matrix mirroring the adapters'
  per-query-type coverage — one real ZeroKMS term per type (equality/unique,
  freeTextSearch/match, orderAndRange/ore on IntegerOrd, searchableJson
  selector + containment on Json), plus inference and a mixed-type bulk
  with null passthrough. Every term asserted v3 + ciphertext-free. Each
  type crosses the WASM serde boundary live — the layer that already ate
  two mock-invisible bugs (undefined fields; the `queries` batch field).

Claude-Session: https://claude.ai/code/session_01MxTTPaPP16m6br7Hoab94w

Third live catch from the Deno query-type matrix: orderAndRange on a v3
IntegerOrd column failed 'index type "ore" is not configured' — the local
resolver was ported from packages/protect's OLDER helper, but stack has its
own @/encryption/helpers/infer-index-type with three v3 behaviours the port
lacked: the ore→ope swap for v3 ord domains, equality answered via the
ordering index on order-capable columns without `unique`, and ope in the
inference priority.

Delete the port entirely and import the shared resolver — it's type-only on
protect-ffi, so it's WASM-bundle-safe, and the lockstep-by-comment risk goes
away by construction. Unit tests pin the two previously-missing behaviours
(ope swap; equality-via-ordering) so they're covered without live creds.

Claude-Session: https://claude.ai/code/session_01MxTTPaPP16m6br7Hoab94w

Fifth live catch, again in the test's assumptions: eql_v3.query_jsonb
containment needles are strict {sv: [query-entry]} — no v field (per
protect-ffi's SteVecQuery contract; "no c" enforced by
is_valid_ste_vec_query_payload). Only SCALAR query terms carry the v:3
envelope. The e2e now pins each kind's true wire shape: scalar envelope,
bare selector string, sv containment needle — all ciphertext-free.

Claude-Session: https://claude.ai/code/session_01MxTTPaPP16m6br7Hoab94w

…g creds

Review feedback on #676, part two:

1. The Deno e2e suites now FAIL with an actionable message naming every
   missing CS_* variable instead of silently skipping — a skipped credential
   suite reads as green coverage that never ran (the integration harness
   doctrine, applied to e2e/wasm).

2. New packages/stack/integration/wasm/ runs the FULL shared v3 family suite
   (@cipherstash/test-kit) over the WASM entry — every covered domain, every
   capability-derived positive and negative op, real ZeroKMS encryption and
   real row matching in a real Postgres, exactly like the Drizzle/Supabase
   adapters. The WASM surface mints terms only, so the adapter IS the SQL
   layer: per-field client.encrypt inserts, and each query op renders the
   documented raw-SQL recipe (eql_v3.<fn>(col, $n::jsonb::eql_v3.query_<d>),
   parenthesised gte/lte ranges, contains for bloom, ord_term ordering);
   in/notIn decompose over ONE encryptQueryBulk batch per list, exercising
   the bulk path on every family. Passing proves the whole edge recipe:
   WASM term → query-domain cast → indexed operator → correct rows.

   Wiring: test-kit's adapter name union gains 'wasm'; stack's integration
   vitest restores the REAL protect-ffi/auth wasm modules (the shared alias
   stubs them for unit tests); the suite joins integration-drizzle.yml's
   CS_IT_SUITE on both db legs, with wasm-inline.ts added to the path
   filters. Date/timestamp values cross the boundary as ISO strings
   (WasmPlaintext has no Date arm — serde doesn't consult toJSON).

   Validated locally to the credential boundary: with a live postgres-eql
   and dummy CS_* values, collection, EQL install, DDL, schema construction,
   and the WASM factory all execute, failing precisely at
   AccessKeyStrategy.create(INVALID_CRN) — CI's real secrets take it from
   there.

Claude-Session: https://claude.ai/code/session_01MxTTPaPP16m6br7Hoab94w

Two failures from the first live run of the WASM family suite:

1. Every family failed its domain CHECK at insert. Root cause is a
   postgres.js serializer trap, reproduced locally with a hand-valid
   envelope and no credentials: the $n::jsonb casts make the server
   type those params as jsonb, and postgres.js serializes jsonb params
   with JSON.stringify — so the adapter's pre-stringified payloads were
   encoded twice, arriving as jsonb *string* scalars that fail every
   jsonb_typeof(VALUE) = 'object' domain check. Bind the raw objects
   instead (storage payloads and query terms both) and let the driver
   stringify exactly once. A pre-insert assertWireEnvelope pin now
   names the payload, not the column domain, if a boundary shape ever
   regresses.

2. roundtrip.test.ts referenced env without calling requireEnv() —
   ReferenceError under Deno. Bound it, and added storage-payload wire
   pins (property access + JSON round-trip) so the Deno job also proves
   the envelope survives JSON.stringify — the exact crossing every SQL
   insert performs, which isEncrypted/decrypt alone cannot pin.

Claude-Session: https://claude.ai/code/session_01MxTTPaPP16m6br7Hoab94w

…rdening

Product fix: the WASM encryptQuery/encryptQueryBulk now run the same
pre-FFI guards as every other query path (assertValidNumericValue,
assertValueIndexCompatibility) — NaN/Infinity/out-of-int64 bigint and
numeric-on-match-index fail with the named errors the Node entry raises
instead of an opaque serde failure or a silently no-match term. Both
paths now share one toFfiQueryTerm() so the serde-omission and ope-swap
subtleties can't drift between single and bulk; the deliberate as-never
casts at the FFI seam carry biome-ignore reasons per AGENTS.md.

Test hardening from the same review:
- FFI stub gains encryptQuery/encryptQueryBulk so unmocked unit tests
  fail with the stub's named error, not 'is not a function'
- query-types.test.ts gains roundtrip's ffi:false permissions pin
- wasm adapter expectRejected discriminates capability rejections from
  infrastructure failures (mirrors the Supabase adapter's doctrine)
- empty in/notIn lists throw (parity with drizzle inArrayOp) instead of
  rendering 'WHERE ()'
- independent ZeroKMS round-trips run concurrently (per-field encrypts,
  bulk-insert rows, between lo/hi terms)
- dropped the redundant '| null' from encryptQuery's signature and the
  gratuitous 'null as unknown as string' casts it appeared to justify
- fixed the nonexistent .env.example pointer in both Deno suites and
  the stale skip-behavior comments in tests.yml/integration-drizzle.yml
- three new unit pins for the validation behavior (828 total green)

Claude-Session: https://claude.ai/code/session_01MxTTPaPP16m6br7Hoab94w