diff --git a/CLAUDE.md b/CLAUDE.md index 2023eab47..aa923daa9 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -74,6 +74,8 @@ This is the **Encrypt Query Language (EQL)** - a PostgreSQL extension for search Adding a scalar encrypted-domain type is one row in the Rust catalog `eql-domains::CATALOG` (`crates/eql-domains/src/lib.rs`): a `DomainFamily` giving the type `name` (e.g. `int8`), its `ScalarKind` (the `kind` field), the `Domain`s mapping each generated (bare) domain name to its fixed index `Term`s (`eq => [Hm]`, `ord`/`ord_ore => [Ore]`), and the `Fixture` value list. Term capabilities are fixed in the `Term` enum's `impl` methods (with unit tests): `Hm` provides equality, and `Ore` provides equality plus ordering. There is no TOML manifest and no Python — the catalog is the source of truth, validated by the compiler (an undefined term or unknown scalar is a compile error) plus catalog `#[test]`s. `mise run build` runs `cargo run -p eql-codegen`, which regenerates the scalar SQL surface into `src/v3/scalars//` from `CATALOG` at the start of every build; that surface includes supported comparison wrappers plus blockers for native `jsonb` operators that would otherwise be reachable through domain fallback. `cargo run -p eql-codegen` regenerates every type at once (the same call `mise run build` uses; there is no per-type codegen task). The generated `*_types.sql` / `*_functions.sql` / `*_operators.sql` / `*_aggregates.sql` files are gitignored and never committed. The per-type plaintext fixture lists the SQLx matrix consumes are **not** a generated file — they are materialised from each `CATALOG` row at compile time as `eql_domains::INT4_VALUES` / `INT2_VALUES` (the `int_values!` macro) and read directly by `ScalarType::FIXTURE_VALUES`; a Rust source of truth no longer round-trips through a committed generated `.rs`. Generated SQL carries a `-- AUTOMATICALLY GENERATED FILE` header (the project-wide marker `docs:validate` greps on); change the catalog and rebuild, never hand-edit. Hand-written SQL beyond the fixed surface goes in `src/v3/scalars//_extensions.sql` with no auto-generated header and explicit `-- REQUIRE:` edges — that file IS committed. `jsonb` is out of scope for this scalar materializer. +The same generator also emits the **Rust payload bindings** under `crates/eql-bindings/src/v3/.rs` (structs + `DomainType` impls) and the `inventory.rs` `all()` list, from the same `CATALOG` — committed with a `// @generated` header (unlike the gitignored SQL, because `ts-rs`/`schemars` derive the committed TypeScript/JSON Schema off them and they must exist on a clean clone). The hand-written `DomainType` trait, the shared newtypes (`SchemaVersion`/`Identifier`/`Ciphertext`/`Hmac256`/`OreBlock256`/`BloomFilter`), the `PhantomData` plumbing, and the architectural module doc (including the non-derivable float-NaN and bool storage-only caveats) stay hand-written in `crates/eql-bindings/src/v3/{mod,domain_type,terms}.rs`. Generated structs carry a catalog-derived struct doc — a summary line (`` `eql_v3.` — . ``) plus a detail line listing the supported operators and required payload keys, all derived from data the catalog already holds (the capability label, `Term::operators_for_terms`, and `ENVELOPE_KEYS` ++ `Term::term_json_keys` — see `struct_doc_lines` in `crates/eql-codegen/src/bindings.rs`). The required-key list makes structural distinctions visible — e.g. `text_ord` lists `` `v` `i` `c` `hm` `ob` `` (dual-term) versus an integer `int4_ord`'s `` `v` `i` `c` `ob` ``. There are **no per-field docs**: per-field/term semantics live on the shared term newtypes (`terms.rs`, flowing into the TS term files and JSON Schema `$defs`), and non-derivable per-family caveats (float-NaN, bool storage-only) in `mod.rs`. Free-form prose belongs at the **struct level** (a future optional catalog `doc` field emitted as extra `#[doc]` lines), never as per-field docs. JSON Schemas are emitted by **schemars 1.x** as JSON Schema 2020-12. `mise run types:generate` regenerates the Rust bindings (via `eql-codegen bindings`) then the TS/JSON; `mise run types:check` is the committed-reference drift gate — it regenerates and `git diff`s all three (`crates/eql-bindings/src/v3` + `bindings/` + `schema/`), the same regenerate-and-diff pattern `codegen:parity` uses for the (gitignored) SQL surface, adapted because the bindings output is committed. + **Adding a new encrypted-domain type: follow `docs/reference/adding-a-scalar-encrypted-domain-type.md`.** The mechanics are fixed for ordered scalar domains; the catalog row only declares the name, kind, bare domain names, and terms. New term behavior belongs in the `Term` enum's `impl` methods in `crates/eql-domains/src` with tests, not in free-form catalog data. Regeneration is deterministic: an identical `CATALOG` produces byte-identical SQL. If `mise run build` produces unexpected output, the change is in `crates/eql-domains/src` (the catalog/terms) or `crates/eql-codegen/src` (the renderers) — not in random run-to-run variation. diff --git a/Cargo.lock b/Cargo.lock index 6e8969f29..aed770ec1 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1178,8 +1178,12 @@ version = "0.1.0" dependencies = [ "eql-domains", "minijinja", + "prettyplease", + "proc-macro2", + "quote", "serde", "serde_json", + "syn 2.0.108", "thiserror 2.0.18", ] @@ -3419,11 +3423,12 @@ dependencies = [ [[package]] name = "schemars" -version = "0.8.22" +version = "1.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3fbf2ae1b8bc8e02df939598064d22402220cd5bbcca1c76f7d6a310974d5615" +checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc" dependencies = [ "dyn-clone", + "ref-cast", "schemars_derive", "serde", "serde_json", @@ -3431,9 +3436,9 @@ dependencies = [ [[package]] name = "schemars_derive" -version = "0.8.22" +version = "1.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "32e265784ad618884abaea0600a9adf15393368d840e0222d101a072f3f7534d" +checksum = "7d115b50f4aaeea07e79c1912f645c7513d81715d0420f8bc77a18c6260b307f" dependencies = [ "proc-macro2", "quote", diff --git a/crates/eql-bindings/Cargo.toml b/crates/eql-bindings/Cargo.toml index ebec21b63..e7e84325a 100644 --- a/crates/eql-bindings/Cargo.toml +++ b/crates/eql-bindings/Cargo.toml @@ -10,7 +10,7 @@ serde = { version = "1", features = ["derive"] } # impl pins `const: 2` via serde_json::json!. serde_json = "1" ts-rs = "10" -schemars = "0.8" +schemars = "1" [dev-dependencies] # Parity oracle: tests/catalog_parity.rs asserts the v3 domain inventory diff --git a/crates/eql-bindings/bindings/v3/Bool.ts b/crates/eql-bindings/bindings/v3/Bool.ts index 06b4fdf35..e9fff3004 100644 --- a/crates/eql-bindings/bindings/v3/Bool.ts +++ b/crates/eql-bindings/bindings/v3/Bool.ts @@ -4,19 +4,8 @@ import type { Identifier } from "./Identifier"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.bool` — storage only / encryption-only; every operator is blocked. + * `eql_v3.bool` — storage-only domain. + * + * Operators: none. Required keys: `v` `i` `c`. */ -export type Bool = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, }; +export type Bool = { v: SchemaVersion, i: Identifier, c: Ciphertext, }; diff --git a/crates/eql-bindings/bindings/v3/Date.ts b/crates/eql-bindings/bindings/v3/Date.ts index 06002db6e..08a16cd62 100644 --- a/crates/eql-bindings/bindings/v3/Date.ts +++ b/crates/eql-bindings/bindings/v3/Date.ts @@ -4,19 +4,8 @@ import type { Identifier } from "./Identifier"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.date` — storage only; every operator is blocked. + * `eql_v3.date` — storage-only domain. + * + * Operators: none. Required keys: `v` `i` `c`. */ -export type Date = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, }; +export type Date = { v: SchemaVersion, i: Identifier, c: Ciphertext, }; diff --git a/crates/eql-bindings/bindings/v3/DateEq.ts b/crates/eql-bindings/bindings/v3/DateEq.ts index 9bad29675..cb1770f91 100644 --- a/crates/eql-bindings/bindings/v3/DateEq.ts +++ b/crates/eql-bindings/bindings/v3/DateEq.ts @@ -5,23 +5,8 @@ import type { Identifier } from "./Identifier"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.date_eq` — HMAC equality (`=`, `<>`). + * `eql_v3.date_eq` — equality domain. + * + * Operators: `=` `<>`. Required keys: `v` `i` `c` `hm`. */ -export type DateEq = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * HMAC-SHA-256 equality term. - */ -hm: Hmac256, }; +export type DateEq = { v: SchemaVersion, i: Identifier, c: Ciphertext, hm: Hmac256, }; diff --git a/crates/eql-bindings/bindings/v3/DateOrd.ts b/crates/eql-bindings/bindings/v3/DateOrd.ts index c81eb642a..f038cde74 100644 --- a/crates/eql-bindings/bindings/v3/DateOrd.ts +++ b/crates/eql-bindings/bindings/v3/DateOrd.ts @@ -5,23 +5,8 @@ import type { OreBlock256 } from "./OreBlock256"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.date_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`). + * `eql_v3.date_ord` — ordering domain. + * + * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. */ -export type DateOrd = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * Block-ORE order term. Serves equality too. - */ -ob: OreBlock256, }; +export type DateOrd = { v: SchemaVersion, i: Identifier, c: Ciphertext, ob: OreBlock256, }; diff --git a/crates/eql-bindings/bindings/v3/DateOrdOre.ts b/crates/eql-bindings/bindings/v3/DateOrdOre.ts index 4baf81f67..53235f461 100644 --- a/crates/eql-bindings/bindings/v3/DateOrdOre.ts +++ b/crates/eql-bindings/bindings/v3/DateOrdOre.ts @@ -5,23 +5,8 @@ import type { OreBlock256 } from "./OreBlock256"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.date_ord_ore` — full comparison, scheme-explicit name. + * `eql_v3.date_ord_ore` — ordering domain. + * + * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. */ -export type DateOrdOre = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * Block-ORE order term. Serves equality too. - */ -ob: OreBlock256, }; +export type DateOrdOre = { v: SchemaVersion, i: Identifier, c: Ciphertext, ob: OreBlock256, }; diff --git a/crates/eql-bindings/bindings/v3/Float4.ts b/crates/eql-bindings/bindings/v3/Float4.ts index 73752d78e..889bbef98 100644 --- a/crates/eql-bindings/bindings/v3/Float4.ts +++ b/crates/eql-bindings/bindings/v3/Float4.ts @@ -4,19 +4,8 @@ import type { Identifier } from "./Identifier"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.float4` — storage only; every operator is blocked. + * `eql_v3.float4` — storage-only domain. + * + * Operators: none. Required keys: `v` `i` `c`. */ -export type Float4 = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, }; +export type Float4 = { v: SchemaVersion, i: Identifier, c: Ciphertext, }; diff --git a/crates/eql-bindings/bindings/v3/Float4Eq.ts b/crates/eql-bindings/bindings/v3/Float4Eq.ts index d734162b5..4603cff7a 100644 --- a/crates/eql-bindings/bindings/v3/Float4Eq.ts +++ b/crates/eql-bindings/bindings/v3/Float4Eq.ts @@ -5,23 +5,8 @@ import type { Identifier } from "./Identifier"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.float4_eq` — HMAC equality (`=`, `<>`). + * `eql_v3.float4_eq` — equality domain. + * + * Operators: `=` `<>`. Required keys: `v` `i` `c` `hm`. */ -export type Float4Eq = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * HMAC-SHA-256 equality term. - */ -hm: Hmac256, }; +export type Float4Eq = { v: SchemaVersion, i: Identifier, c: Ciphertext, hm: Hmac256, }; diff --git a/crates/eql-bindings/bindings/v3/Float4Ord.ts b/crates/eql-bindings/bindings/v3/Float4Ord.ts index 658564a0d..f0e6bc746 100644 --- a/crates/eql-bindings/bindings/v3/Float4Ord.ts +++ b/crates/eql-bindings/bindings/v3/Float4Ord.ts @@ -5,23 +5,8 @@ import type { OreBlock256 } from "./OreBlock256"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.float4_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`). + * `eql_v3.float4_ord` — ordering domain. + * + * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. */ -export type Float4Ord = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * Block-ORE order term (8 blocks for float). Serves equality too. - */ -ob: OreBlock256, }; +export type Float4Ord = { v: SchemaVersion, i: Identifier, c: Ciphertext, ob: OreBlock256, }; diff --git a/crates/eql-bindings/bindings/v3/Float4OrdOre.ts b/crates/eql-bindings/bindings/v3/Float4OrdOre.ts index 9daebc7c3..6a586fc45 100644 --- a/crates/eql-bindings/bindings/v3/Float4OrdOre.ts +++ b/crates/eql-bindings/bindings/v3/Float4OrdOre.ts @@ -5,23 +5,8 @@ import type { OreBlock256 } from "./OreBlock256"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.float4_ord_ore` — full comparison, scheme-explicit name. + * `eql_v3.float4_ord_ore` — ordering domain. + * + * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. */ -export type Float4OrdOre = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * Block-ORE order term (8 blocks for float). Serves equality too. - */ -ob: OreBlock256, }; +export type Float4OrdOre = { v: SchemaVersion, i: Identifier, c: Ciphertext, ob: OreBlock256, }; diff --git a/crates/eql-bindings/bindings/v3/Float8.ts b/crates/eql-bindings/bindings/v3/Float8.ts index 71f064d6e..140dcb6d7 100644 --- a/crates/eql-bindings/bindings/v3/Float8.ts +++ b/crates/eql-bindings/bindings/v3/Float8.ts @@ -4,19 +4,8 @@ import type { Identifier } from "./Identifier"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.float8` — storage only; every operator is blocked. + * `eql_v3.float8` — storage-only domain. + * + * Operators: none. Required keys: `v` `i` `c`. */ -export type Float8 = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, }; +export type Float8 = { v: SchemaVersion, i: Identifier, c: Ciphertext, }; diff --git a/crates/eql-bindings/bindings/v3/Float8Eq.ts b/crates/eql-bindings/bindings/v3/Float8Eq.ts index 217146375..5a70ffca6 100644 --- a/crates/eql-bindings/bindings/v3/Float8Eq.ts +++ b/crates/eql-bindings/bindings/v3/Float8Eq.ts @@ -5,23 +5,8 @@ import type { Identifier } from "./Identifier"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.float8_eq` — HMAC equality (`=`, `<>`). + * `eql_v3.float8_eq` — equality domain. + * + * Operators: `=` `<>`. Required keys: `v` `i` `c` `hm`. */ -export type Float8Eq = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * HMAC-SHA-256 equality term. - */ -hm: Hmac256, }; +export type Float8Eq = { v: SchemaVersion, i: Identifier, c: Ciphertext, hm: Hmac256, }; diff --git a/crates/eql-bindings/bindings/v3/Float8Ord.ts b/crates/eql-bindings/bindings/v3/Float8Ord.ts index 209b1c2ed..48d87b396 100644 --- a/crates/eql-bindings/bindings/v3/Float8Ord.ts +++ b/crates/eql-bindings/bindings/v3/Float8Ord.ts @@ -5,23 +5,8 @@ import type { OreBlock256 } from "./OreBlock256"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.float8_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`). + * `eql_v3.float8_ord` — ordering domain. + * + * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. */ -export type Float8Ord = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * Block-ORE order term (8 blocks for float). Serves equality too. - */ -ob: OreBlock256, }; +export type Float8Ord = { v: SchemaVersion, i: Identifier, c: Ciphertext, ob: OreBlock256, }; diff --git a/crates/eql-bindings/bindings/v3/Float8OrdOre.ts b/crates/eql-bindings/bindings/v3/Float8OrdOre.ts index 9fd0d7184..106cb3cbc 100644 --- a/crates/eql-bindings/bindings/v3/Float8OrdOre.ts +++ b/crates/eql-bindings/bindings/v3/Float8OrdOre.ts @@ -5,23 +5,8 @@ import type { OreBlock256 } from "./OreBlock256"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.float8_ord_ore` — full comparison, scheme-explicit name. + * `eql_v3.float8_ord_ore` — ordering domain. + * + * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. */ -export type Float8OrdOre = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * Block-ORE order term (8 blocks for float). Serves equality too. - */ -ob: OreBlock256, }; +export type Float8OrdOre = { v: SchemaVersion, i: Identifier, c: Ciphertext, ob: OreBlock256, }; diff --git a/crates/eql-bindings/bindings/v3/Int2.ts b/crates/eql-bindings/bindings/v3/Int2.ts index 9e0d8f17d..c878a9dd6 100644 --- a/crates/eql-bindings/bindings/v3/Int2.ts +++ b/crates/eql-bindings/bindings/v3/Int2.ts @@ -4,19 +4,8 @@ import type { Identifier } from "./Identifier"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.int2` — storage only; every operator is blocked. + * `eql_v3.int2` — storage-only domain. + * + * Operators: none. Required keys: `v` `i` `c`. */ -export type Int2 = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, }; +export type Int2 = { v: SchemaVersion, i: Identifier, c: Ciphertext, }; diff --git a/crates/eql-bindings/bindings/v3/Int2Eq.ts b/crates/eql-bindings/bindings/v3/Int2Eq.ts index eb44df041..b87f16eda 100644 --- a/crates/eql-bindings/bindings/v3/Int2Eq.ts +++ b/crates/eql-bindings/bindings/v3/Int2Eq.ts @@ -5,23 +5,8 @@ import type { Identifier } from "./Identifier"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.int2_eq` — HMAC equality (`=`, `<>`). + * `eql_v3.int2_eq` — equality domain. + * + * Operators: `=` `<>`. Required keys: `v` `i` `c` `hm`. */ -export type Int2Eq = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * HMAC-SHA-256 equality term. - */ -hm: Hmac256, }; +export type Int2Eq = { v: SchemaVersion, i: Identifier, c: Ciphertext, hm: Hmac256, }; diff --git a/crates/eql-bindings/bindings/v3/Int2Ord.ts b/crates/eql-bindings/bindings/v3/Int2Ord.ts index 38e23008e..f8010d090 100644 --- a/crates/eql-bindings/bindings/v3/Int2Ord.ts +++ b/crates/eql-bindings/bindings/v3/Int2Ord.ts @@ -5,23 +5,8 @@ import type { OreBlock256 } from "./OreBlock256"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.int2_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`). + * `eql_v3.int2_ord` — ordering domain. + * + * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. */ -export type Int2Ord = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * Block-ORE order term. Serves equality too. - */ -ob: OreBlock256, }; +export type Int2Ord = { v: SchemaVersion, i: Identifier, c: Ciphertext, ob: OreBlock256, }; diff --git a/crates/eql-bindings/bindings/v3/Int2OrdOre.ts b/crates/eql-bindings/bindings/v3/Int2OrdOre.ts index 1193826a4..3bf31ac82 100644 --- a/crates/eql-bindings/bindings/v3/Int2OrdOre.ts +++ b/crates/eql-bindings/bindings/v3/Int2OrdOre.ts @@ -5,23 +5,8 @@ import type { OreBlock256 } from "./OreBlock256"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.int2_ord_ore` — full comparison, scheme-explicit name. + * `eql_v3.int2_ord_ore` — ordering domain. + * + * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. */ -export type Int2OrdOre = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * Block-ORE order term. Serves equality too. - */ -ob: OreBlock256, }; +export type Int2OrdOre = { v: SchemaVersion, i: Identifier, c: Ciphertext, ob: OreBlock256, }; diff --git a/crates/eql-bindings/bindings/v3/Int4.ts b/crates/eql-bindings/bindings/v3/Int4.ts index 3ab94a30e..4de3cd1ca 100644 --- a/crates/eql-bindings/bindings/v3/Int4.ts +++ b/crates/eql-bindings/bindings/v3/Int4.ts @@ -4,19 +4,8 @@ import type { Identifier } from "./Identifier"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.int4` — storage only; every operator is blocked. + * `eql_v3.int4` — storage-only domain. + * + * Operators: none. Required keys: `v` `i` `c`. */ -export type Int4 = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, }; +export type Int4 = { v: SchemaVersion, i: Identifier, c: Ciphertext, }; diff --git a/crates/eql-bindings/bindings/v3/Int4Eq.ts b/crates/eql-bindings/bindings/v3/Int4Eq.ts index 7510a83e1..da9cf0554 100644 --- a/crates/eql-bindings/bindings/v3/Int4Eq.ts +++ b/crates/eql-bindings/bindings/v3/Int4Eq.ts @@ -5,23 +5,8 @@ import type { Identifier } from "./Identifier"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.int4_eq` — HMAC equality (`=`, `<>`). + * `eql_v3.int4_eq` — equality domain. + * + * Operators: `=` `<>`. Required keys: `v` `i` `c` `hm`. */ -export type Int4Eq = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * HMAC-SHA-256 equality term. - */ -hm: Hmac256, }; +export type Int4Eq = { v: SchemaVersion, i: Identifier, c: Ciphertext, hm: Hmac256, }; diff --git a/crates/eql-bindings/bindings/v3/Int4Ord.ts b/crates/eql-bindings/bindings/v3/Int4Ord.ts index ee25c6707..e6993b126 100644 --- a/crates/eql-bindings/bindings/v3/Int4Ord.ts +++ b/crates/eql-bindings/bindings/v3/Int4Ord.ts @@ -5,23 +5,8 @@ import type { OreBlock256 } from "./OreBlock256"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.int4_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`). + * `eql_v3.int4_ord` — ordering domain. + * + * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. */ -export type Int4Ord = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * Block-ORE order term. Serves equality too. - */ -ob: OreBlock256, }; +export type Int4Ord = { v: SchemaVersion, i: Identifier, c: Ciphertext, ob: OreBlock256, }; diff --git a/crates/eql-bindings/bindings/v3/Int4OrdOre.ts b/crates/eql-bindings/bindings/v3/Int4OrdOre.ts index 17be0f8e3..5b697ff37 100644 --- a/crates/eql-bindings/bindings/v3/Int4OrdOre.ts +++ b/crates/eql-bindings/bindings/v3/Int4OrdOre.ts @@ -5,25 +5,8 @@ import type { OreBlock256 } from "./OreBlock256"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.int4_ord_ore` — full comparison (`=` `<>` `<` `<=` `>` `>=`), - * scheme-explicit name. Same shape as [`Int4Ord`], distinct SQL domain. + * `eql_v3.int4_ord_ore` — ordering domain. + * + * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. */ -export type Int4OrdOre = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * Block-ORE order term. Serves equality too — ORE over a - * full-domain `int4` is lossless, so no separate `hm` is carried. - */ -ob: OreBlock256, }; +export type Int4OrdOre = { v: SchemaVersion, i: Identifier, c: Ciphertext, ob: OreBlock256, }; diff --git a/crates/eql-bindings/bindings/v3/Int8.ts b/crates/eql-bindings/bindings/v3/Int8.ts index b8df9f2fe..550ab9de2 100644 --- a/crates/eql-bindings/bindings/v3/Int8.ts +++ b/crates/eql-bindings/bindings/v3/Int8.ts @@ -4,19 +4,8 @@ import type { Identifier } from "./Identifier"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.int8` — storage only; every operator is blocked. + * `eql_v3.int8` — storage-only domain. + * + * Operators: none. Required keys: `v` `i` `c`. */ -export type Int8 = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, }; +export type Int8 = { v: SchemaVersion, i: Identifier, c: Ciphertext, }; diff --git a/crates/eql-bindings/bindings/v3/Int8Eq.ts b/crates/eql-bindings/bindings/v3/Int8Eq.ts index c2633feee..aa236626c 100644 --- a/crates/eql-bindings/bindings/v3/Int8Eq.ts +++ b/crates/eql-bindings/bindings/v3/Int8Eq.ts @@ -5,23 +5,8 @@ import type { Identifier } from "./Identifier"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.int8_eq` — HMAC equality (`=`, `<>`). + * `eql_v3.int8_eq` — equality domain. + * + * Operators: `=` `<>`. Required keys: `v` `i` `c` `hm`. */ -export type Int8Eq = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * HMAC-SHA-256 equality term. - */ -hm: Hmac256, }; +export type Int8Eq = { v: SchemaVersion, i: Identifier, c: Ciphertext, hm: Hmac256, }; diff --git a/crates/eql-bindings/bindings/v3/Int8Ord.ts b/crates/eql-bindings/bindings/v3/Int8Ord.ts index 7199defdb..f1da6cfee 100644 --- a/crates/eql-bindings/bindings/v3/Int8Ord.ts +++ b/crates/eql-bindings/bindings/v3/Int8Ord.ts @@ -5,23 +5,8 @@ import type { OreBlock256 } from "./OreBlock256"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.int8_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`). + * `eql_v3.int8_ord` — ordering domain. + * + * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. */ -export type Int8Ord = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * Block-ORE order term. Serves equality too. - */ -ob: OreBlock256, }; +export type Int8Ord = { v: SchemaVersion, i: Identifier, c: Ciphertext, ob: OreBlock256, }; diff --git a/crates/eql-bindings/bindings/v3/Int8OrdOre.ts b/crates/eql-bindings/bindings/v3/Int8OrdOre.ts index 6dd492db2..064490c92 100644 --- a/crates/eql-bindings/bindings/v3/Int8OrdOre.ts +++ b/crates/eql-bindings/bindings/v3/Int8OrdOre.ts @@ -5,23 +5,8 @@ import type { OreBlock256 } from "./OreBlock256"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.int8_ord_ore` — full comparison, scheme-explicit name. + * `eql_v3.int8_ord_ore` — ordering domain. + * + * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. */ -export type Int8OrdOre = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * Block-ORE order term. Serves equality too. - */ -ob: OreBlock256, }; +export type Int8OrdOre = { v: SchemaVersion, i: Identifier, c: Ciphertext, ob: OreBlock256, }; diff --git a/crates/eql-bindings/bindings/v3/Numeric.ts b/crates/eql-bindings/bindings/v3/Numeric.ts index dfcda818a..99277adcf 100644 --- a/crates/eql-bindings/bindings/v3/Numeric.ts +++ b/crates/eql-bindings/bindings/v3/Numeric.ts @@ -4,19 +4,8 @@ import type { Identifier } from "./Identifier"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.numeric` — storage only; every operator is blocked. + * `eql_v3.numeric` — storage-only domain. + * + * Operators: none. Required keys: `v` `i` `c`. */ -export type Numeric = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, }; +export type Numeric = { v: SchemaVersion, i: Identifier, c: Ciphertext, }; diff --git a/crates/eql-bindings/bindings/v3/NumericEq.ts b/crates/eql-bindings/bindings/v3/NumericEq.ts index e3b3ff466..f318b3017 100644 --- a/crates/eql-bindings/bindings/v3/NumericEq.ts +++ b/crates/eql-bindings/bindings/v3/NumericEq.ts @@ -5,23 +5,8 @@ import type { Identifier } from "./Identifier"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.numeric_eq` — HMAC equality (`=`, `<>`). + * `eql_v3.numeric_eq` — equality domain. + * + * Operators: `=` `<>`. Required keys: `v` `i` `c` `hm`. */ -export type NumericEq = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * HMAC-SHA-256 equality term. - */ -hm: Hmac256, }; +export type NumericEq = { v: SchemaVersion, i: Identifier, c: Ciphertext, hm: Hmac256, }; diff --git a/crates/eql-bindings/bindings/v3/NumericOrd.ts b/crates/eql-bindings/bindings/v3/NumericOrd.ts index 491295dc4..6945e4d1f 100644 --- a/crates/eql-bindings/bindings/v3/NumericOrd.ts +++ b/crates/eql-bindings/bindings/v3/NumericOrd.ts @@ -5,23 +5,8 @@ import type { OreBlock256 } from "./OreBlock256"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.numeric_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`). + * `eql_v3.numeric_ord` — ordering domain. + * + * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. */ -export type NumericOrd = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * Block-ORE order term (14 blocks for numeric). Serves equality too. - */ -ob: OreBlock256, }; +export type NumericOrd = { v: SchemaVersion, i: Identifier, c: Ciphertext, ob: OreBlock256, }; diff --git a/crates/eql-bindings/bindings/v3/NumericOrdOre.ts b/crates/eql-bindings/bindings/v3/NumericOrdOre.ts index 846437451..3c14fcaa2 100644 --- a/crates/eql-bindings/bindings/v3/NumericOrdOre.ts +++ b/crates/eql-bindings/bindings/v3/NumericOrdOre.ts @@ -5,23 +5,8 @@ import type { OreBlock256 } from "./OreBlock256"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.numeric_ord_ore` — full comparison, scheme-explicit name. + * `eql_v3.numeric_ord_ore` — ordering domain. + * + * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. */ -export type NumericOrdOre = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * Block-ORE order term (14 blocks for numeric). Serves equality too. - */ -ob: OreBlock256, }; +export type NumericOrdOre = { v: SchemaVersion, i: Identifier, c: Ciphertext, ob: OreBlock256, }; diff --git a/crates/eql-bindings/bindings/v3/Text.ts b/crates/eql-bindings/bindings/v3/Text.ts index e506a5a45..a6274a5da 100644 --- a/crates/eql-bindings/bindings/v3/Text.ts +++ b/crates/eql-bindings/bindings/v3/Text.ts @@ -4,19 +4,8 @@ import type { Identifier } from "./Identifier"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.text` — storage only; every operator is blocked. + * `eql_v3.text` — storage-only domain. + * + * Operators: none. Required keys: `v` `i` `c`. */ -export type Text = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, }; +export type Text = { v: SchemaVersion, i: Identifier, c: Ciphertext, }; diff --git a/crates/eql-bindings/bindings/v3/TextEq.ts b/crates/eql-bindings/bindings/v3/TextEq.ts index e6650c6d3..e3e5c7b5c 100644 --- a/crates/eql-bindings/bindings/v3/TextEq.ts +++ b/crates/eql-bindings/bindings/v3/TextEq.ts @@ -5,23 +5,8 @@ import type { Identifier } from "./Identifier"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.text_eq` — HMAC equality (`=`, `<>`). + * `eql_v3.text_eq` — equality domain. + * + * Operators: `=` `<>`. Required keys: `v` `i` `c` `hm`. */ -export type TextEq = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * HMAC-SHA-256 equality term. - */ -hm: Hmac256, }; +export type TextEq = { v: SchemaVersion, i: Identifier, c: Ciphertext, hm: Hmac256, }; diff --git a/crates/eql-bindings/bindings/v3/TextMatch.ts b/crates/eql-bindings/bindings/v3/TextMatch.ts index 400812f51..f1f85c9e3 100644 --- a/crates/eql-bindings/bindings/v3/TextMatch.ts +++ b/crates/eql-bindings/bindings/v3/TextMatch.ts @@ -5,23 +5,8 @@ import type { Identifier } from "./Identifier"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.text_match` — Bloom-filter containment match. + * `eql_v3.text_match` — match domain. + * + * Operators: `@>` `<@`. Required keys: `v` `i` `c` `bf`. */ -export type TextMatch = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * Bloom-filter match term (signed smallint bit positions). - */ -bf: BloomFilter, }; +export type TextMatch = { v: SchemaVersion, i: Identifier, c: Ciphertext, bf: BloomFilter, }; diff --git a/crates/eql-bindings/bindings/v3/TextOrd.ts b/crates/eql-bindings/bindings/v3/TextOrd.ts index e3e1de7d6..f6c7c856d 100644 --- a/crates/eql-bindings/bindings/v3/TextOrd.ts +++ b/crates/eql-bindings/bindings/v3/TextOrd.ts @@ -6,29 +6,8 @@ import type { OreBlock256 } from "./OreBlock256"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.text_ord` — full lexicographic comparison - * (`=` `<>` `<` `<=` `>` `>=`). Carries both `hm` (equality) and `ob` - * (ordering) — text routes equality through `hm` (`[Hm, Ore]`). + * `eql_v3.text_ord` — ordering domain. + * + * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `hm` `ob`. */ -export type TextOrd = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * HMAC-SHA-256 equality term. Text routes `=`/`<>` through `hm`. - */ -hm: Hmac256, -/** - * Block-ORE order term. - */ -ob: OreBlock256, }; +export type TextOrd = { v: SchemaVersion, i: Identifier, c: Ciphertext, hm: Hmac256, ob: OreBlock256, }; diff --git a/crates/eql-bindings/bindings/v3/TextOrdOre.ts b/crates/eql-bindings/bindings/v3/TextOrdOre.ts index 7aed3dd52..f1e264af5 100644 --- a/crates/eql-bindings/bindings/v3/TextOrdOre.ts +++ b/crates/eql-bindings/bindings/v3/TextOrdOre.ts @@ -6,30 +6,8 @@ import type { OreBlock256 } from "./OreBlock256"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.text_ord_ore` — full lexicographic comparison, - * scheme-explicit name. Unlike the integer ordered domains (`[Ore]` only), - * text routes equality through `hm` rather than the ORE term, so the domain - * carries both `hm` and `ob` (`[Hm, Ore]`). + * `eql_v3.text_ord_ore` — ordering domain. + * + * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `hm` `ob`. */ -export type TextOrdOre = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * HMAC-SHA-256 equality term. Text routes `=`/`<>` through `hm`. - */ -hm: Hmac256, -/** - * Block-ORE order term. - */ -ob: OreBlock256, }; +export type TextOrdOre = { v: SchemaVersion, i: Identifier, c: Ciphertext, hm: Hmac256, ob: OreBlock256, }; diff --git a/crates/eql-bindings/bindings/v3/TextSearch.ts b/crates/eql-bindings/bindings/v3/TextSearch.ts index e95709378..fe46d46cf 100644 --- a/crates/eql-bindings/bindings/v3/TextSearch.ts +++ b/crates/eql-bindings/bindings/v3/TextSearch.ts @@ -7,33 +7,8 @@ import type { OreBlock256 } from "./OreBlock256"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.text_search` — the full text search surface: HMAC equality, ORE - * ordering, and Bloom-filter containment match (`[Hm, Ore, Bloom]`). The - * superset domain combining `_eq`, `_ord`, and `_match`. + * `eql_v3.text_search` — search domain. + * + * Operators: `=` `<>` `<` `<=` `>` `>=` `@>` `<@`. Required keys: `v` `i` `c` `hm` `ob` `bf`. */ -export type TextSearch = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * HMAC-SHA-256 equality term. - */ -hm: Hmac256, -/** - * Block-ORE order term. - */ -ob: OreBlock256, -/** - * Bloom-filter match term (signed smallint bit positions). - */ -bf: BloomFilter, }; +export type TextSearch = { v: SchemaVersion, i: Identifier, c: Ciphertext, hm: Hmac256, ob: OreBlock256, bf: BloomFilter, }; diff --git a/crates/eql-bindings/bindings/v3/Timestamptz.ts b/crates/eql-bindings/bindings/v3/Timestamptz.ts index 62ddc82ec..ad15c7ede 100644 --- a/crates/eql-bindings/bindings/v3/Timestamptz.ts +++ b/crates/eql-bindings/bindings/v3/Timestamptz.ts @@ -4,19 +4,8 @@ import type { Identifier } from "./Identifier"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.timestamptz` — storage only; every operator is blocked. + * `eql_v3.timestamptz` — storage-only domain. + * + * Operators: none. Required keys: `v` `i` `c`. */ -export type Timestamptz = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, }; +export type Timestamptz = { v: SchemaVersion, i: Identifier, c: Ciphertext, }; diff --git a/crates/eql-bindings/bindings/v3/TimestamptzEq.ts b/crates/eql-bindings/bindings/v3/TimestamptzEq.ts index e27254734..d0d09d557 100644 --- a/crates/eql-bindings/bindings/v3/TimestamptzEq.ts +++ b/crates/eql-bindings/bindings/v3/TimestamptzEq.ts @@ -5,23 +5,8 @@ import type { Identifier } from "./Identifier"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.timestamptz_eq` — HMAC equality (`=`, `<>`). + * `eql_v3.timestamptz_eq` — equality domain. + * + * Operators: `=` `<>`. Required keys: `v` `i` `c` `hm`. */ -export type TimestamptzEq = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * HMAC-SHA-256 equality term. - */ -hm: Hmac256, }; +export type TimestamptzEq = { v: SchemaVersion, i: Identifier, c: Ciphertext, hm: Hmac256, }; diff --git a/crates/eql-bindings/bindings/v3/TimestamptzOrd.ts b/crates/eql-bindings/bindings/v3/TimestamptzOrd.ts index 19b975732..b99b4a208 100644 --- a/crates/eql-bindings/bindings/v3/TimestamptzOrd.ts +++ b/crates/eql-bindings/bindings/v3/TimestamptzOrd.ts @@ -5,23 +5,8 @@ import type { OreBlock256 } from "./OreBlock256"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.timestamptz_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`). + * `eql_v3.timestamptz_ord` — ordering domain. + * + * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. */ -export type TimestamptzOrd = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * Block-ORE order term (12 blocks for timestamptz). Serves equality too. - */ -ob: OreBlock256, }; +export type TimestamptzOrd = { v: SchemaVersion, i: Identifier, c: Ciphertext, ob: OreBlock256, }; diff --git a/crates/eql-bindings/bindings/v3/TimestamptzOrdOre.ts b/crates/eql-bindings/bindings/v3/TimestamptzOrdOre.ts index a84d68088..497782692 100644 --- a/crates/eql-bindings/bindings/v3/TimestamptzOrdOre.ts +++ b/crates/eql-bindings/bindings/v3/TimestamptzOrdOre.ts @@ -5,23 +5,8 @@ import type { OreBlock256 } from "./OreBlock256"; import type { SchemaVersion } from "./SchemaVersion"; /** - * `eql_v3.timestamptz_ord_ore` — full comparison, scheme-explicit name. + * `eql_v3.timestamptz_ord_ore` — ordering domain. + * + * Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. */ -export type TimestamptzOrdOre = { -/** - * Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - * value fails deserialization. - */ -v: SchemaVersion, -/** - * Table/column identifier. Required by the domain CHECK. - */ -i: Identifier, -/** - * mp_base85 source ciphertext. Required by the domain CHECK. - */ -c: Ciphertext, -/** - * Block-ORE order term (12 blocks for timestamptz). Serves equality too. - */ -ob: OreBlock256, }; +export type TimestamptzOrdOre = { v: SchemaVersion, i: Identifier, c: Ciphertext, ob: OreBlock256, }; diff --git a/crates/eql-bindings/schema/v3/bool.json b/crates/eql-bindings/schema/v3/bool.json index bcbad6546..2700a83a7 100644 --- a/crates/eql-bindings/schema/v3/bool.json +++ b/crates/eql-bindings/schema/v3/bool.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/bool.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,8 +18,8 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, @@ -32,37 +29,25 @@ "type": "integer" } }, - "description": "`eql_v3.bool` — storage only / encryption-only; every operator is blocked.", + "$id": "https://schemas.cipherstash.com/eql/v3/bool.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.bool` — storage-only domain.\n\nOperators: none. Required keys: `v` `i` `c`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "v" + "c" ], "title": "Bool", "type": "object" diff --git a/crates/eql-bindings/schema/v3/date.json b/crates/eql-bindings/schema/v3/date.json index 706e4b566..1c17fab22 100644 --- a/crates/eql-bindings/schema/v3/date.json +++ b/crates/eql-bindings/schema/v3/date.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/date.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,8 +18,8 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, @@ -32,37 +29,25 @@ "type": "integer" } }, - "description": "`eql_v3.date` — storage only; every operator is blocked.", + "$id": "https://schemas.cipherstash.com/eql/v3/date.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.date` — storage-only domain.\n\nOperators: none. Required keys: `v` `i` `c`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "v" + "c" ], "title": "Date", "type": "object" diff --git a/crates/eql-bindings/schema/v3/date_eq.json b/crates/eql-bindings/schema/v3/date_eq.json index d7cf20d1b..e1904b313 100644 --- a/crates/eql-bindings/schema/v3/date_eq.json +++ b/crates/eql-bindings/schema/v3/date_eq.json @@ -1,14 +1,11 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/date_eq.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" }, "Hmac256": { - "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains (`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", + "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains\n(`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", "type": "string" }, "Identifier": { @@ -25,8 +22,8 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, @@ -36,46 +33,29 @@ "type": "integer" } }, - "description": "`eql_v3.date_eq` — HMAC equality (`=`, `<>`).", + "$id": "https://schemas.cipherstash.com/eql/v3/date_eq.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.date_eq` — equality domain.\n\nOperators: `=` `<>`. Required keys: `v` `i` `c` `hm`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "hm": { - "allOf": [ - { - "$ref": "#/definitions/Hmac256" - } - ], - "description": "HMAC-SHA-256 equality term." + "$ref": "#/$defs/Hmac256" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", - "hm", + "v", "i", - "v" + "c", + "hm" ], "title": "DateEq", "type": "object" diff --git a/crates/eql-bindings/schema/v3/date_ord.json b/crates/eql-bindings/schema/v3/date_ord.json index 90bbfbfce..2a64c4c7d 100644 --- a/crates/eql-bindings/schema/v3/date_ord.json +++ b/crates/eql-bindings/schema/v3/date_ord.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/date_ord.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,13 +18,13 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, "OreBlock256": { - "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore` domains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's domain, so it serves equality too. The block count is width-agnostic on the wire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the array just carries more block strings. SQL-side constructor: `eql_v3.ore_block_256`.", + "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore`\ndomains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's\ndomain, so it serves equality too. The block count is width-agnostic on the\nwire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the\narray just carries more block strings. SQL-side constructor:\n`eql_v3.ore_block_256`.", "items": { "type": "string" }, @@ -39,46 +36,29 @@ "type": "integer" } }, - "description": "`eql_v3.date_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`).", + "$id": "https://schemas.cipherstash.com/eql/v3/date_ord.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.date_ord` — ordering domain.\n\nOperators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "ob": { - "allOf": [ - { - "$ref": "#/definitions/OreBlock256" - } - ], - "description": "Block-ORE order term. Serves equality too." + "$ref": "#/$defs/OreBlock256" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "ob", - "v" + "c", + "ob" ], "title": "DateOrd", "type": "object" diff --git a/crates/eql-bindings/schema/v3/date_ord_ore.json b/crates/eql-bindings/schema/v3/date_ord_ore.json index 9c4da4bd0..b2ffeda8b 100644 --- a/crates/eql-bindings/schema/v3/date_ord_ore.json +++ b/crates/eql-bindings/schema/v3/date_ord_ore.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/date_ord_ore.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,13 +18,13 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, "OreBlock256": { - "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore` domains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's domain, so it serves equality too. The block count is width-agnostic on the wire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the array just carries more block strings. SQL-side constructor: `eql_v3.ore_block_256`.", + "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore`\ndomains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's\ndomain, so it serves equality too. The block count is width-agnostic on the\nwire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the\narray just carries more block strings. SQL-side constructor:\n`eql_v3.ore_block_256`.", "items": { "type": "string" }, @@ -39,46 +36,29 @@ "type": "integer" } }, - "description": "`eql_v3.date_ord_ore` — full comparison, scheme-explicit name.", + "$id": "https://schemas.cipherstash.com/eql/v3/date_ord_ore.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.date_ord_ore` — ordering domain.\n\nOperators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "ob": { - "allOf": [ - { - "$ref": "#/definitions/OreBlock256" - } - ], - "description": "Block-ORE order term. Serves equality too." + "$ref": "#/$defs/OreBlock256" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "ob", - "v" + "c", + "ob" ], "title": "DateOrdOre", "type": "object" diff --git a/crates/eql-bindings/schema/v3/float4.json b/crates/eql-bindings/schema/v3/float4.json index 747728d8a..b4d726a2c 100644 --- a/crates/eql-bindings/schema/v3/float4.json +++ b/crates/eql-bindings/schema/v3/float4.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/float4.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,8 +18,8 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, @@ -32,37 +29,25 @@ "type": "integer" } }, - "description": "`eql_v3.float4` — storage only; every operator is blocked.", + "$id": "https://schemas.cipherstash.com/eql/v3/float4.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.float4` — storage-only domain.\n\nOperators: none. Required keys: `v` `i` `c`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "v" + "c" ], "title": "Float4", "type": "object" diff --git a/crates/eql-bindings/schema/v3/float4_eq.json b/crates/eql-bindings/schema/v3/float4_eq.json index e81332781..90469a3a8 100644 --- a/crates/eql-bindings/schema/v3/float4_eq.json +++ b/crates/eql-bindings/schema/v3/float4_eq.json @@ -1,14 +1,11 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/float4_eq.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" }, "Hmac256": { - "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains (`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", + "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains\n(`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", "type": "string" }, "Identifier": { @@ -25,8 +22,8 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, @@ -36,46 +33,29 @@ "type": "integer" } }, - "description": "`eql_v3.float4_eq` — HMAC equality (`=`, `<>`).", + "$id": "https://schemas.cipherstash.com/eql/v3/float4_eq.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.float4_eq` — equality domain.\n\nOperators: `=` `<>`. Required keys: `v` `i` `c` `hm`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "hm": { - "allOf": [ - { - "$ref": "#/definitions/Hmac256" - } - ], - "description": "HMAC-SHA-256 equality term." + "$ref": "#/$defs/Hmac256" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", - "hm", + "v", "i", - "v" + "c", + "hm" ], "title": "Float4Eq", "type": "object" diff --git a/crates/eql-bindings/schema/v3/float4_ord.json b/crates/eql-bindings/schema/v3/float4_ord.json index 76d06d29e..aa05fb2cd 100644 --- a/crates/eql-bindings/schema/v3/float4_ord.json +++ b/crates/eql-bindings/schema/v3/float4_ord.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/float4_ord.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,13 +18,13 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, "OreBlock256": { - "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore` domains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's domain, so it serves equality too. The block count is width-agnostic on the wire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the array just carries more block strings. SQL-side constructor: `eql_v3.ore_block_256`.", + "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore`\ndomains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's\ndomain, so it serves equality too. The block count is width-agnostic on the\nwire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the\narray just carries more block strings. SQL-side constructor:\n`eql_v3.ore_block_256`.", "items": { "type": "string" }, @@ -39,46 +36,29 @@ "type": "integer" } }, - "description": "`eql_v3.float4_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`).", + "$id": "https://schemas.cipherstash.com/eql/v3/float4_ord.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.float4_ord` — ordering domain.\n\nOperators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "ob": { - "allOf": [ - { - "$ref": "#/definitions/OreBlock256" - } - ], - "description": "Block-ORE order term (8 blocks for float). Serves equality too." + "$ref": "#/$defs/OreBlock256" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "ob", - "v" + "c", + "ob" ], "title": "Float4Ord", "type": "object" diff --git a/crates/eql-bindings/schema/v3/float4_ord_ore.json b/crates/eql-bindings/schema/v3/float4_ord_ore.json index 1ecbcb1e3..790a2390b 100644 --- a/crates/eql-bindings/schema/v3/float4_ord_ore.json +++ b/crates/eql-bindings/schema/v3/float4_ord_ore.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/float4_ord_ore.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,13 +18,13 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, "OreBlock256": { - "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore` domains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's domain, so it serves equality too. The block count is width-agnostic on the wire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the array just carries more block strings. SQL-side constructor: `eql_v3.ore_block_256`.", + "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore`\ndomains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's\ndomain, so it serves equality too. The block count is width-agnostic on the\nwire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the\narray just carries more block strings. SQL-side constructor:\n`eql_v3.ore_block_256`.", "items": { "type": "string" }, @@ -39,46 +36,29 @@ "type": "integer" } }, - "description": "`eql_v3.float4_ord_ore` — full comparison, scheme-explicit name.", + "$id": "https://schemas.cipherstash.com/eql/v3/float4_ord_ore.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.float4_ord_ore` — ordering domain.\n\nOperators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "ob": { - "allOf": [ - { - "$ref": "#/definitions/OreBlock256" - } - ], - "description": "Block-ORE order term (8 blocks for float). Serves equality too." + "$ref": "#/$defs/OreBlock256" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "ob", - "v" + "c", + "ob" ], "title": "Float4OrdOre", "type": "object" diff --git a/crates/eql-bindings/schema/v3/float8.json b/crates/eql-bindings/schema/v3/float8.json index 671d7996e..ee3cb70ac 100644 --- a/crates/eql-bindings/schema/v3/float8.json +++ b/crates/eql-bindings/schema/v3/float8.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/float8.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,8 +18,8 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, @@ -32,37 +29,25 @@ "type": "integer" } }, - "description": "`eql_v3.float8` — storage only; every operator is blocked.", + "$id": "https://schemas.cipherstash.com/eql/v3/float8.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.float8` — storage-only domain.\n\nOperators: none. Required keys: `v` `i` `c`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "v" + "c" ], "title": "Float8", "type": "object" diff --git a/crates/eql-bindings/schema/v3/float8_eq.json b/crates/eql-bindings/schema/v3/float8_eq.json index a83bfa1ca..b1780b509 100644 --- a/crates/eql-bindings/schema/v3/float8_eq.json +++ b/crates/eql-bindings/schema/v3/float8_eq.json @@ -1,14 +1,11 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/float8_eq.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" }, "Hmac256": { - "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains (`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", + "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains\n(`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", "type": "string" }, "Identifier": { @@ -25,8 +22,8 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, @@ -36,46 +33,29 @@ "type": "integer" } }, - "description": "`eql_v3.float8_eq` — HMAC equality (`=`, `<>`).", + "$id": "https://schemas.cipherstash.com/eql/v3/float8_eq.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.float8_eq` — equality domain.\n\nOperators: `=` `<>`. Required keys: `v` `i` `c` `hm`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "hm": { - "allOf": [ - { - "$ref": "#/definitions/Hmac256" - } - ], - "description": "HMAC-SHA-256 equality term." + "$ref": "#/$defs/Hmac256" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", - "hm", + "v", "i", - "v" + "c", + "hm" ], "title": "Float8Eq", "type": "object" diff --git a/crates/eql-bindings/schema/v3/float8_ord.json b/crates/eql-bindings/schema/v3/float8_ord.json index 2753c67cb..dfe7171af 100644 --- a/crates/eql-bindings/schema/v3/float8_ord.json +++ b/crates/eql-bindings/schema/v3/float8_ord.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/float8_ord.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,13 +18,13 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, "OreBlock256": { - "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore` domains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's domain, so it serves equality too. The block count is width-agnostic on the wire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the array just carries more block strings. SQL-side constructor: `eql_v3.ore_block_256`.", + "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore`\ndomains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's\ndomain, so it serves equality too. The block count is width-agnostic on the\nwire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the\narray just carries more block strings. SQL-side constructor:\n`eql_v3.ore_block_256`.", "items": { "type": "string" }, @@ -39,46 +36,29 @@ "type": "integer" } }, - "description": "`eql_v3.float8_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`).", + "$id": "https://schemas.cipherstash.com/eql/v3/float8_ord.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.float8_ord` — ordering domain.\n\nOperators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "ob": { - "allOf": [ - { - "$ref": "#/definitions/OreBlock256" - } - ], - "description": "Block-ORE order term (8 blocks for float). Serves equality too." + "$ref": "#/$defs/OreBlock256" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "ob", - "v" + "c", + "ob" ], "title": "Float8Ord", "type": "object" diff --git a/crates/eql-bindings/schema/v3/float8_ord_ore.json b/crates/eql-bindings/schema/v3/float8_ord_ore.json index ea2153a74..e3a997c73 100644 --- a/crates/eql-bindings/schema/v3/float8_ord_ore.json +++ b/crates/eql-bindings/schema/v3/float8_ord_ore.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/float8_ord_ore.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,13 +18,13 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, "OreBlock256": { - "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore` domains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's domain, so it serves equality too. The block count is width-agnostic on the wire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the array just carries more block strings. SQL-side constructor: `eql_v3.ore_block_256`.", + "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore`\ndomains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's\ndomain, so it serves equality too. The block count is width-agnostic on the\nwire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the\narray just carries more block strings. SQL-side constructor:\n`eql_v3.ore_block_256`.", "items": { "type": "string" }, @@ -39,46 +36,29 @@ "type": "integer" } }, - "description": "`eql_v3.float8_ord_ore` — full comparison, scheme-explicit name.", + "$id": "https://schemas.cipherstash.com/eql/v3/float8_ord_ore.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.float8_ord_ore` — ordering domain.\n\nOperators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "ob": { - "allOf": [ - { - "$ref": "#/definitions/OreBlock256" - } - ], - "description": "Block-ORE order term (8 blocks for float). Serves equality too." + "$ref": "#/$defs/OreBlock256" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "ob", - "v" + "c", + "ob" ], "title": "Float8OrdOre", "type": "object" diff --git a/crates/eql-bindings/schema/v3/int2.json b/crates/eql-bindings/schema/v3/int2.json index 118cfbf2d..5720f8dbc 100644 --- a/crates/eql-bindings/schema/v3/int2.json +++ b/crates/eql-bindings/schema/v3/int2.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/int2.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,8 +18,8 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, @@ -32,37 +29,25 @@ "type": "integer" } }, - "description": "`eql_v3.int2` — storage only; every operator is blocked.", + "$id": "https://schemas.cipherstash.com/eql/v3/int2.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.int2` — storage-only domain.\n\nOperators: none. Required keys: `v` `i` `c`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "v" + "c" ], "title": "Int2", "type": "object" diff --git a/crates/eql-bindings/schema/v3/int2_eq.json b/crates/eql-bindings/schema/v3/int2_eq.json index 2b3616d7f..daae2e487 100644 --- a/crates/eql-bindings/schema/v3/int2_eq.json +++ b/crates/eql-bindings/schema/v3/int2_eq.json @@ -1,14 +1,11 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/int2_eq.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" }, "Hmac256": { - "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains (`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", + "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains\n(`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", "type": "string" }, "Identifier": { @@ -25,8 +22,8 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, @@ -36,46 +33,29 @@ "type": "integer" } }, - "description": "`eql_v3.int2_eq` — HMAC equality (`=`, `<>`).", + "$id": "https://schemas.cipherstash.com/eql/v3/int2_eq.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.int2_eq` — equality domain.\n\nOperators: `=` `<>`. Required keys: `v` `i` `c` `hm`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "hm": { - "allOf": [ - { - "$ref": "#/definitions/Hmac256" - } - ], - "description": "HMAC-SHA-256 equality term." + "$ref": "#/$defs/Hmac256" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", - "hm", + "v", "i", - "v" + "c", + "hm" ], "title": "Int2Eq", "type": "object" diff --git a/crates/eql-bindings/schema/v3/int2_ord.json b/crates/eql-bindings/schema/v3/int2_ord.json index bb851fc09..e91805b64 100644 --- a/crates/eql-bindings/schema/v3/int2_ord.json +++ b/crates/eql-bindings/schema/v3/int2_ord.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/int2_ord.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,13 +18,13 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, "OreBlock256": { - "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore` domains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's domain, so it serves equality too. The block count is width-agnostic on the wire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the array just carries more block strings. SQL-side constructor: `eql_v3.ore_block_256`.", + "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore`\ndomains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's\ndomain, so it serves equality too. The block count is width-agnostic on the\nwire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the\narray just carries more block strings. SQL-side constructor:\n`eql_v3.ore_block_256`.", "items": { "type": "string" }, @@ -39,46 +36,29 @@ "type": "integer" } }, - "description": "`eql_v3.int2_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`).", + "$id": "https://schemas.cipherstash.com/eql/v3/int2_ord.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.int2_ord` — ordering domain.\n\nOperators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "ob": { - "allOf": [ - { - "$ref": "#/definitions/OreBlock256" - } - ], - "description": "Block-ORE order term. Serves equality too." + "$ref": "#/$defs/OreBlock256" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "ob", - "v" + "c", + "ob" ], "title": "Int2Ord", "type": "object" diff --git a/crates/eql-bindings/schema/v3/int2_ord_ore.json b/crates/eql-bindings/schema/v3/int2_ord_ore.json index 14782a109..78e1f83ac 100644 --- a/crates/eql-bindings/schema/v3/int2_ord_ore.json +++ b/crates/eql-bindings/schema/v3/int2_ord_ore.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/int2_ord_ore.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,13 +18,13 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, "OreBlock256": { - "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore` domains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's domain, so it serves equality too. The block count is width-agnostic on the wire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the array just carries more block strings. SQL-side constructor: `eql_v3.ore_block_256`.", + "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore`\ndomains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's\ndomain, so it serves equality too. The block count is width-agnostic on the\nwire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the\narray just carries more block strings. SQL-side constructor:\n`eql_v3.ore_block_256`.", "items": { "type": "string" }, @@ -39,46 +36,29 @@ "type": "integer" } }, - "description": "`eql_v3.int2_ord_ore` — full comparison, scheme-explicit name.", + "$id": "https://schemas.cipherstash.com/eql/v3/int2_ord_ore.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.int2_ord_ore` — ordering domain.\n\nOperators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "ob": { - "allOf": [ - { - "$ref": "#/definitions/OreBlock256" - } - ], - "description": "Block-ORE order term. Serves equality too." + "$ref": "#/$defs/OreBlock256" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "ob", - "v" + "c", + "ob" ], "title": "Int2OrdOre", "type": "object" diff --git a/crates/eql-bindings/schema/v3/int4.json b/crates/eql-bindings/schema/v3/int4.json index 4e8506272..fc239d942 100644 --- a/crates/eql-bindings/schema/v3/int4.json +++ b/crates/eql-bindings/schema/v3/int4.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/int4.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,8 +18,8 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, @@ -32,37 +29,25 @@ "type": "integer" } }, - "description": "`eql_v3.int4` — storage only; every operator is blocked.", + "$id": "https://schemas.cipherstash.com/eql/v3/int4.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.int4` — storage-only domain.\n\nOperators: none. Required keys: `v` `i` `c`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "v" + "c" ], "title": "Int4", "type": "object" diff --git a/crates/eql-bindings/schema/v3/int4_eq.json b/crates/eql-bindings/schema/v3/int4_eq.json index cf88e7f7d..f919adb1c 100644 --- a/crates/eql-bindings/schema/v3/int4_eq.json +++ b/crates/eql-bindings/schema/v3/int4_eq.json @@ -1,14 +1,11 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/int4_eq.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" }, "Hmac256": { - "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains (`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", + "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains\n(`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", "type": "string" }, "Identifier": { @@ -25,8 +22,8 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, @@ -36,46 +33,29 @@ "type": "integer" } }, - "description": "`eql_v3.int4_eq` — HMAC equality (`=`, `<>`).", + "$id": "https://schemas.cipherstash.com/eql/v3/int4_eq.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.int4_eq` — equality domain.\n\nOperators: `=` `<>`. Required keys: `v` `i` `c` `hm`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "hm": { - "allOf": [ - { - "$ref": "#/definitions/Hmac256" - } - ], - "description": "HMAC-SHA-256 equality term." + "$ref": "#/$defs/Hmac256" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", - "hm", + "v", "i", - "v" + "c", + "hm" ], "title": "Int4Eq", "type": "object" diff --git a/crates/eql-bindings/schema/v3/int4_ord.json b/crates/eql-bindings/schema/v3/int4_ord.json index 5eb0b7eca..7d3e26ccf 100644 --- a/crates/eql-bindings/schema/v3/int4_ord.json +++ b/crates/eql-bindings/schema/v3/int4_ord.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/int4_ord.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,13 +18,13 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, "OreBlock256": { - "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore` domains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's domain, so it serves equality too. The block count is width-agnostic on the wire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the array just carries more block strings. SQL-side constructor: `eql_v3.ore_block_256`.", + "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore`\ndomains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's\ndomain, so it serves equality too. The block count is width-agnostic on the\nwire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the\narray just carries more block strings. SQL-side constructor:\n`eql_v3.ore_block_256`.", "items": { "type": "string" }, @@ -39,46 +36,29 @@ "type": "integer" } }, - "description": "`eql_v3.int4_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`).", + "$id": "https://schemas.cipherstash.com/eql/v3/int4_ord.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.int4_ord` — ordering domain.\n\nOperators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "ob": { - "allOf": [ - { - "$ref": "#/definitions/OreBlock256" - } - ], - "description": "Block-ORE order term. Serves equality too." + "$ref": "#/$defs/OreBlock256" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "ob", - "v" + "c", + "ob" ], "title": "Int4Ord", "type": "object" diff --git a/crates/eql-bindings/schema/v3/int4_ord_ore.json b/crates/eql-bindings/schema/v3/int4_ord_ore.json index 326d2688b..baff10a3a 100644 --- a/crates/eql-bindings/schema/v3/int4_ord_ore.json +++ b/crates/eql-bindings/schema/v3/int4_ord_ore.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/int4_ord_ore.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,13 +18,13 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, "OreBlock256": { - "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore` domains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's domain, so it serves equality too. The block count is width-agnostic on the wire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the array just carries more block strings. SQL-side constructor: `eql_v3.ore_block_256`.", + "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore`\ndomains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's\ndomain, so it serves equality too. The block count is width-agnostic on the\nwire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the\narray just carries more block strings. SQL-side constructor:\n`eql_v3.ore_block_256`.", "items": { "type": "string" }, @@ -39,46 +36,29 @@ "type": "integer" } }, - "description": "`eql_v3.int4_ord_ore` — full comparison (`=` `<>` `<` `<=` `>` `>=`), scheme-explicit name. Same shape as [`Int4Ord`], distinct SQL domain.", + "$id": "https://schemas.cipherstash.com/eql/v3/int4_ord_ore.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.int4_ord_ore` — ordering domain.\n\nOperators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "ob": { - "allOf": [ - { - "$ref": "#/definitions/OreBlock256" - } - ], - "description": "Block-ORE order term. Serves equality too — ORE over a full-domain `int4` is lossless, so no separate `hm` is carried." + "$ref": "#/$defs/OreBlock256" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "ob", - "v" + "c", + "ob" ], "title": "Int4OrdOre", "type": "object" diff --git a/crates/eql-bindings/schema/v3/int8.json b/crates/eql-bindings/schema/v3/int8.json index be50c73b5..32e0867c9 100644 --- a/crates/eql-bindings/schema/v3/int8.json +++ b/crates/eql-bindings/schema/v3/int8.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/int8.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,8 +18,8 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, @@ -32,37 +29,25 @@ "type": "integer" } }, - "description": "`eql_v3.int8` — storage only; every operator is blocked.", + "$id": "https://schemas.cipherstash.com/eql/v3/int8.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.int8` — storage-only domain.\n\nOperators: none. Required keys: `v` `i` `c`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "v" + "c" ], "title": "Int8", "type": "object" diff --git a/crates/eql-bindings/schema/v3/int8_eq.json b/crates/eql-bindings/schema/v3/int8_eq.json index 3a7d30424..f7cb6396d 100644 --- a/crates/eql-bindings/schema/v3/int8_eq.json +++ b/crates/eql-bindings/schema/v3/int8_eq.json @@ -1,14 +1,11 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/int8_eq.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" }, "Hmac256": { - "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains (`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", + "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains\n(`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", "type": "string" }, "Identifier": { @@ -25,8 +22,8 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, @@ -36,46 +33,29 @@ "type": "integer" } }, - "description": "`eql_v3.int8_eq` — HMAC equality (`=`, `<>`).", + "$id": "https://schemas.cipherstash.com/eql/v3/int8_eq.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.int8_eq` — equality domain.\n\nOperators: `=` `<>`. Required keys: `v` `i` `c` `hm`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "hm": { - "allOf": [ - { - "$ref": "#/definitions/Hmac256" - } - ], - "description": "HMAC-SHA-256 equality term." + "$ref": "#/$defs/Hmac256" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", - "hm", + "v", "i", - "v" + "c", + "hm" ], "title": "Int8Eq", "type": "object" diff --git a/crates/eql-bindings/schema/v3/int8_ord.json b/crates/eql-bindings/schema/v3/int8_ord.json index b3146c347..fcb82fbb8 100644 --- a/crates/eql-bindings/schema/v3/int8_ord.json +++ b/crates/eql-bindings/schema/v3/int8_ord.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/int8_ord.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,13 +18,13 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, "OreBlock256": { - "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore` domains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's domain, so it serves equality too. The block count is width-agnostic on the wire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the array just carries more block strings. SQL-side constructor: `eql_v3.ore_block_256`.", + "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore`\ndomains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's\ndomain, so it serves equality too. The block count is width-agnostic on the\nwire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the\narray just carries more block strings. SQL-side constructor:\n`eql_v3.ore_block_256`.", "items": { "type": "string" }, @@ -39,46 +36,29 @@ "type": "integer" } }, - "description": "`eql_v3.int8_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`).", + "$id": "https://schemas.cipherstash.com/eql/v3/int8_ord.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.int8_ord` — ordering domain.\n\nOperators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "ob": { - "allOf": [ - { - "$ref": "#/definitions/OreBlock256" - } - ], - "description": "Block-ORE order term. Serves equality too." + "$ref": "#/$defs/OreBlock256" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "ob", - "v" + "c", + "ob" ], "title": "Int8Ord", "type": "object" diff --git a/crates/eql-bindings/schema/v3/int8_ord_ore.json b/crates/eql-bindings/schema/v3/int8_ord_ore.json index 4c14eb987..630860268 100644 --- a/crates/eql-bindings/schema/v3/int8_ord_ore.json +++ b/crates/eql-bindings/schema/v3/int8_ord_ore.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/int8_ord_ore.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,13 +18,13 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, "OreBlock256": { - "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore` domains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's domain, so it serves equality too. The block count is width-agnostic on the wire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the array just carries more block strings. SQL-side constructor: `eql_v3.ore_block_256`.", + "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore`\ndomains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's\ndomain, so it serves equality too. The block count is width-agnostic on the\nwire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the\narray just carries more block strings. SQL-side constructor:\n`eql_v3.ore_block_256`.", "items": { "type": "string" }, @@ -39,46 +36,29 @@ "type": "integer" } }, - "description": "`eql_v3.int8_ord_ore` — full comparison, scheme-explicit name.", + "$id": "https://schemas.cipherstash.com/eql/v3/int8_ord_ore.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.int8_ord_ore` — ordering domain.\n\nOperators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "ob": { - "allOf": [ - { - "$ref": "#/definitions/OreBlock256" - } - ], - "description": "Block-ORE order term. Serves equality too." + "$ref": "#/$defs/OreBlock256" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "ob", - "v" + "c", + "ob" ], "title": "Int8OrdOre", "type": "object" diff --git a/crates/eql-bindings/schema/v3/numeric.json b/crates/eql-bindings/schema/v3/numeric.json index c89d356f7..ac996aeaf 100644 --- a/crates/eql-bindings/schema/v3/numeric.json +++ b/crates/eql-bindings/schema/v3/numeric.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/numeric.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,8 +18,8 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, @@ -32,37 +29,25 @@ "type": "integer" } }, - "description": "`eql_v3.numeric` — storage only; every operator is blocked.", + "$id": "https://schemas.cipherstash.com/eql/v3/numeric.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.numeric` — storage-only domain.\n\nOperators: none. Required keys: `v` `i` `c`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "v" + "c" ], "title": "Numeric", "type": "object" diff --git a/crates/eql-bindings/schema/v3/numeric_eq.json b/crates/eql-bindings/schema/v3/numeric_eq.json index 8cfc98c83..5160cd5d9 100644 --- a/crates/eql-bindings/schema/v3/numeric_eq.json +++ b/crates/eql-bindings/schema/v3/numeric_eq.json @@ -1,14 +1,11 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/numeric_eq.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" }, "Hmac256": { - "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains (`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", + "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains\n(`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", "type": "string" }, "Identifier": { @@ -25,8 +22,8 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, @@ -36,46 +33,29 @@ "type": "integer" } }, - "description": "`eql_v3.numeric_eq` — HMAC equality (`=`, `<>`).", + "$id": "https://schemas.cipherstash.com/eql/v3/numeric_eq.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.numeric_eq` — equality domain.\n\nOperators: `=` `<>`. Required keys: `v` `i` `c` `hm`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "hm": { - "allOf": [ - { - "$ref": "#/definitions/Hmac256" - } - ], - "description": "HMAC-SHA-256 equality term." + "$ref": "#/$defs/Hmac256" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", - "hm", + "v", "i", - "v" + "c", + "hm" ], "title": "NumericEq", "type": "object" diff --git a/crates/eql-bindings/schema/v3/numeric_ord.json b/crates/eql-bindings/schema/v3/numeric_ord.json index f4d6571b1..f9936db57 100644 --- a/crates/eql-bindings/schema/v3/numeric_ord.json +++ b/crates/eql-bindings/schema/v3/numeric_ord.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/numeric_ord.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,13 +18,13 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, "OreBlock256": { - "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore` domains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's domain, so it serves equality too. The block count is width-agnostic on the wire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the array just carries more block strings. SQL-side constructor: `eql_v3.ore_block_256`.", + "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore`\ndomains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's\ndomain, so it serves equality too. The block count is width-agnostic on the\nwire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the\narray just carries more block strings. SQL-side constructor:\n`eql_v3.ore_block_256`.", "items": { "type": "string" }, @@ -39,46 +36,29 @@ "type": "integer" } }, - "description": "`eql_v3.numeric_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`).", + "$id": "https://schemas.cipherstash.com/eql/v3/numeric_ord.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.numeric_ord` — ordering domain.\n\nOperators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "ob": { - "allOf": [ - { - "$ref": "#/definitions/OreBlock256" - } - ], - "description": "Block-ORE order term (14 blocks for numeric). Serves equality too." + "$ref": "#/$defs/OreBlock256" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "ob", - "v" + "c", + "ob" ], "title": "NumericOrd", "type": "object" diff --git a/crates/eql-bindings/schema/v3/numeric_ord_ore.json b/crates/eql-bindings/schema/v3/numeric_ord_ore.json index 748b2ba62..355e8c8f1 100644 --- a/crates/eql-bindings/schema/v3/numeric_ord_ore.json +++ b/crates/eql-bindings/schema/v3/numeric_ord_ore.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/numeric_ord_ore.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,13 +18,13 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, "OreBlock256": { - "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore` domains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's domain, so it serves equality too. The block count is width-agnostic on the wire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the array just carries more block strings. SQL-side constructor: `eql_v3.ore_block_256`.", + "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore`\ndomains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's\ndomain, so it serves equality too. The block count is width-agnostic on the\nwire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the\narray just carries more block strings. SQL-side constructor:\n`eql_v3.ore_block_256`.", "items": { "type": "string" }, @@ -39,46 +36,29 @@ "type": "integer" } }, - "description": "`eql_v3.numeric_ord_ore` — full comparison, scheme-explicit name.", + "$id": "https://schemas.cipherstash.com/eql/v3/numeric_ord_ore.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.numeric_ord_ore` — ordering domain.\n\nOperators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "ob": { - "allOf": [ - { - "$ref": "#/definitions/OreBlock256" - } - ], - "description": "Block-ORE order term (14 blocks for numeric). Serves equality too." + "$ref": "#/$defs/OreBlock256" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "ob", - "v" + "c", + "ob" ], "title": "NumericOrdOre", "type": "object" diff --git a/crates/eql-bindings/schema/v3/text.json b/crates/eql-bindings/schema/v3/text.json index 4b4e34d95..efb51f906 100644 --- a/crates/eql-bindings/schema/v3/text.json +++ b/crates/eql-bindings/schema/v3/text.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/text.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,8 +18,8 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, @@ -32,37 +29,25 @@ "type": "integer" } }, - "description": "`eql_v3.text` — storage only; every operator is blocked.", + "$id": "https://schemas.cipherstash.com/eql/v3/text.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.text` — storage-only domain.\n\nOperators: none. Required keys: `v` `i` `c`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "v" + "c" ], "title": "Text", "type": "object" diff --git a/crates/eql-bindings/schema/v3/text_eq.json b/crates/eql-bindings/schema/v3/text_eq.json index 71a0f15e0..2b15151a9 100644 --- a/crates/eql-bindings/schema/v3/text_eq.json +++ b/crates/eql-bindings/schema/v3/text_eq.json @@ -1,14 +1,11 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/text_eq.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" }, "Hmac256": { - "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains (`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", + "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains\n(`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", "type": "string" }, "Identifier": { @@ -25,8 +22,8 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, @@ -36,46 +33,29 @@ "type": "integer" } }, - "description": "`eql_v3.text_eq` — HMAC equality (`=`, `<>`).", + "$id": "https://schemas.cipherstash.com/eql/v3/text_eq.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.text_eq` — equality domain.\n\nOperators: `=` `<>`. Required keys: `v` `i` `c` `hm`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "hm": { - "allOf": [ - { - "$ref": "#/definitions/Hmac256" - } - ], - "description": "HMAC-SHA-256 equality term." + "$ref": "#/$defs/Hmac256" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", - "hm", + "v", "i", - "v" + "c", + "hm" ], "title": "TextEq", "type": "object" diff --git a/crates/eql-bindings/schema/v3/text_match.json b/crates/eql-bindings/schema/v3/text_match.json index cedacf786..c1453dbea 100644 --- a/crates/eql-bindings/schema/v3/text_match.json +++ b/crates/eql-bindings/schema/v3/text_match.json @@ -1,14 +1,11 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/text_match.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "BloomFilter": { "description": "Bloom-filter match term — the `bf` wire key. Backs the `_match` domains (`@>`/`<@` containment). Signed i16: EQL stores the filter as PostgreSQL `smallint[]`, and filters sized above 32768 emit upper-half bit positions as negative signed values.", "items": { "format": "int16", - "maximum": 32767.0, - "minimum": -32768.0, + "maximum": 32767, + "minimum": -32768, "type": "integer" }, "type": "array" @@ -31,8 +28,8 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, @@ -42,46 +39,29 @@ "type": "integer" } }, - "description": "`eql_v3.text_match` — Bloom-filter containment match.", + "$id": "https://schemas.cipherstash.com/eql/v3/text_match.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.text_match` — match domain.\n\nOperators: `@>` `<@`. Required keys: `v` `i` `c` `bf`.", "properties": { "bf": { - "allOf": [ - { - "$ref": "#/definitions/BloomFilter" - } - ], - "description": "Bloom-filter match term (signed smallint bit positions)." + "$ref": "#/$defs/BloomFilter" }, "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "bf", - "c", + "v", "i", - "v" + "c", + "bf" ], "title": "TextMatch", "type": "object" diff --git a/crates/eql-bindings/schema/v3/text_ord.json b/crates/eql-bindings/schema/v3/text_ord.json index 0b69333db..b8873f5d7 100644 --- a/crates/eql-bindings/schema/v3/text_ord.json +++ b/crates/eql-bindings/schema/v3/text_ord.json @@ -1,14 +1,11 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/text_ord.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" }, "Hmac256": { - "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains (`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", + "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains\n(`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", "type": "string" }, "Identifier": { @@ -25,13 +22,13 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, "OreBlock256": { - "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore` domains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's domain, so it serves equality too. The block count is width-agnostic on the wire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the array just carries more block strings. SQL-side constructor: `eql_v3.ore_block_256`.", + "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore`\ndomains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's\ndomain, so it serves equality too. The block count is width-agnostic on the\nwire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the\narray just carries more block strings. SQL-side constructor:\n`eql_v3.ore_block_256`.", "items": { "type": "string" }, @@ -43,55 +40,33 @@ "type": "integer" } }, - "description": "`eql_v3.text_ord` — full lexicographic comparison (`=` `<>` `<` `<=` `>` `>=`). Carries both `hm` (equality) and `ob` (ordering) — text routes equality through `hm` (`[Hm, Ore]`).", + "$id": "https://schemas.cipherstash.com/eql/v3/text_ord.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.text_ord` — ordering domain.\n\nOperators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `hm` `ob`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "hm": { - "allOf": [ - { - "$ref": "#/definitions/Hmac256" - } - ], - "description": "HMAC-SHA-256 equality term. Text routes `=`/`<>` through `hm`." + "$ref": "#/$defs/Hmac256" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "ob": { - "allOf": [ - { - "$ref": "#/definitions/OreBlock256" - } - ], - "description": "Block-ORE order term." + "$ref": "#/$defs/OreBlock256" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ + "v", + "i", "c", "hm", - "i", - "ob", - "v" + "ob" ], "title": "TextOrd", "type": "object" diff --git a/crates/eql-bindings/schema/v3/text_ord_ore.json b/crates/eql-bindings/schema/v3/text_ord_ore.json index 094f9a49d..422d1fa23 100644 --- a/crates/eql-bindings/schema/v3/text_ord_ore.json +++ b/crates/eql-bindings/schema/v3/text_ord_ore.json @@ -1,14 +1,11 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/text_ord_ore.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" }, "Hmac256": { - "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains (`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", + "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains\n(`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", "type": "string" }, "Identifier": { @@ -25,13 +22,13 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, "OreBlock256": { - "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore` domains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's domain, so it serves equality too. The block count is width-agnostic on the wire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the array just carries more block strings. SQL-side constructor: `eql_v3.ore_block_256`.", + "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore`\ndomains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's\ndomain, so it serves equality too. The block count is width-agnostic on the\nwire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the\narray just carries more block strings. SQL-side constructor:\n`eql_v3.ore_block_256`.", "items": { "type": "string" }, @@ -43,55 +40,33 @@ "type": "integer" } }, - "description": "`eql_v3.text_ord_ore` — full lexicographic comparison, scheme-explicit name. Unlike the integer ordered domains (`[Ore]` only), text routes equality through `hm` rather than the ORE term, so the domain carries both `hm` and `ob` (`[Hm, Ore]`).", + "$id": "https://schemas.cipherstash.com/eql/v3/text_ord_ore.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.text_ord_ore` — ordering domain.\n\nOperators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `hm` `ob`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "hm": { - "allOf": [ - { - "$ref": "#/definitions/Hmac256" - } - ], - "description": "HMAC-SHA-256 equality term. Text routes `=`/`<>` through `hm`." + "$ref": "#/$defs/Hmac256" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "ob": { - "allOf": [ - { - "$ref": "#/definitions/OreBlock256" - } - ], - "description": "Block-ORE order term." + "$ref": "#/$defs/OreBlock256" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ + "v", + "i", "c", "hm", - "i", - "ob", - "v" + "ob" ], "title": "TextOrdOre", "type": "object" diff --git a/crates/eql-bindings/schema/v3/text_search.json b/crates/eql-bindings/schema/v3/text_search.json index 2beaeffe8..d24d35a7e 100644 --- a/crates/eql-bindings/schema/v3/text_search.json +++ b/crates/eql-bindings/schema/v3/text_search.json @@ -1,14 +1,11 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/text_search.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "BloomFilter": { "description": "Bloom-filter match term — the `bf` wire key. Backs the `_match` domains (`@>`/`<@` containment). Signed i16: EQL stores the filter as PostgreSQL `smallint[]`, and filters sized above 32768 emit upper-half bit positions as negative signed values.", "items": { "format": "int16", - "maximum": 32767.0, - "minimum": -32768.0, + "maximum": 32767, + "minimum": -32768, "type": "integer" }, "type": "array" @@ -18,7 +15,7 @@ "type": "string" }, "Hmac256": { - "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains (`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", + "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains\n(`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", "type": "string" }, "Identifier": { @@ -35,13 +32,13 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, "OreBlock256": { - "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore` domains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's domain, so it serves equality too. The block count is width-agnostic on the wire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the array just carries more block strings. SQL-side constructor: `eql_v3.ore_block_256`.", + "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore`\ndomains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's\ndomain, so it serves equality too. The block count is width-agnostic on the\nwire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the\narray just carries more block strings. SQL-side constructor:\n`eql_v3.ore_block_256`.", "items": { "type": "string" }, @@ -53,64 +50,37 @@ "type": "integer" } }, - "description": "`eql_v3.text_search` — the full text search surface: HMAC equality, ORE ordering, and Bloom-filter containment match (`[Hm, Ore, Bloom]`). The superset domain combining `_eq`, `_ord`, and `_match`.", + "$id": "https://schemas.cipherstash.com/eql/v3/text_search.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.text_search` — search domain.\n\nOperators: `=` `<>` `<` `<=` `>` `>=` `@>` `<@`. Required keys: `v` `i` `c` `hm` `ob` `bf`.", "properties": { "bf": { - "allOf": [ - { - "$ref": "#/definitions/BloomFilter" - } - ], - "description": "Bloom-filter match term (signed smallint bit positions)." + "$ref": "#/$defs/BloomFilter" }, "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "hm": { - "allOf": [ - { - "$ref": "#/definitions/Hmac256" - } - ], - "description": "HMAC-SHA-256 equality term." + "$ref": "#/$defs/Hmac256" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "ob": { - "allOf": [ - { - "$ref": "#/definitions/OreBlock256" - } - ], - "description": "Block-ORE order term." + "$ref": "#/$defs/OreBlock256" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "bf", + "v", + "i", "c", "hm", - "i", "ob", - "v" + "bf" ], "title": "TextSearch", "type": "object" diff --git a/crates/eql-bindings/schema/v3/timestamptz.json b/crates/eql-bindings/schema/v3/timestamptz.json index 72a154d8e..72979fc1a 100644 --- a/crates/eql-bindings/schema/v3/timestamptz.json +++ b/crates/eql-bindings/schema/v3/timestamptz.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/timestamptz.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,8 +18,8 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, @@ -32,37 +29,25 @@ "type": "integer" } }, - "description": "`eql_v3.timestamptz` — storage only; every operator is blocked.", + "$id": "https://schemas.cipherstash.com/eql/v3/timestamptz.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.timestamptz` — storage-only domain.\n\nOperators: none. Required keys: `v` `i` `c`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "v" + "c" ], "title": "Timestamptz", "type": "object" diff --git a/crates/eql-bindings/schema/v3/timestamptz_eq.json b/crates/eql-bindings/schema/v3/timestamptz_eq.json index 90fc71d48..75fd55757 100644 --- a/crates/eql-bindings/schema/v3/timestamptz_eq.json +++ b/crates/eql-bindings/schema/v3/timestamptz_eq.json @@ -1,14 +1,11 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/timestamptz_eq.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" }, "Hmac256": { - "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains (`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", + "description": "HMAC-SHA-256 equality term — the `hm` wire key. Backs the `_eq` domains\n(`=`, `<>`). SQL-side constructor: `eql_v3.hmac_256`.", "type": "string" }, "Identifier": { @@ -25,8 +22,8 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, @@ -36,46 +33,29 @@ "type": "integer" } }, - "description": "`eql_v3.timestamptz_eq` — HMAC equality (`=`, `<>`).", + "$id": "https://schemas.cipherstash.com/eql/v3/timestamptz_eq.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.timestamptz_eq` — equality domain.\n\nOperators: `=` `<>`. Required keys: `v` `i` `c` `hm`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "hm": { - "allOf": [ - { - "$ref": "#/definitions/Hmac256" - } - ], - "description": "HMAC-SHA-256 equality term." + "$ref": "#/$defs/Hmac256" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", - "hm", + "v", "i", - "v" + "c", + "hm" ], "title": "TimestamptzEq", "type": "object" diff --git a/crates/eql-bindings/schema/v3/timestamptz_ord.json b/crates/eql-bindings/schema/v3/timestamptz_ord.json index 993bc94c8..ea45adf33 100644 --- a/crates/eql-bindings/schema/v3/timestamptz_ord.json +++ b/crates/eql-bindings/schema/v3/timestamptz_ord.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/timestamptz_ord.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,13 +18,13 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, "OreBlock256": { - "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore` domains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's domain, so it serves equality too. The block count is width-agnostic on the wire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the array just carries more block strings. SQL-side constructor: `eql_v3.ore_block_256`.", + "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore`\ndomains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's\ndomain, so it serves equality too. The block count is width-agnostic on the\nwire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the\narray just carries more block strings. SQL-side constructor:\n`eql_v3.ore_block_256`.", "items": { "type": "string" }, @@ -39,46 +36,29 @@ "type": "integer" } }, - "description": "`eql_v3.timestamptz_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`).", + "$id": "https://schemas.cipherstash.com/eql/v3/timestamptz_ord.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.timestamptz_ord` — ordering domain.\n\nOperators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "ob": { - "allOf": [ - { - "$ref": "#/definitions/OreBlock256" - } - ], - "description": "Block-ORE order term (12 blocks for timestamptz). Serves equality too." + "$ref": "#/$defs/OreBlock256" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "ob", - "v" + "c", + "ob" ], "title": "TimestamptzOrd", "type": "object" diff --git a/crates/eql-bindings/schema/v3/timestamptz_ord_ore.json b/crates/eql-bindings/schema/v3/timestamptz_ord_ore.json index 9d202d6e2..731b3e0ac 100644 --- a/crates/eql-bindings/schema/v3/timestamptz_ord_ore.json +++ b/crates/eql-bindings/schema/v3/timestamptz_ord_ore.json @@ -1,8 +1,5 @@ { - "$id": "https://schemas.cipherstash.com/eql/v3/timestamptz_ord_ore.json", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "definitions": { + "$defs": { "Ciphertext": { "description": "mp_base85 source ciphertext — the `c` envelope key.\n\nRequired by every v3 domain CHECK; present on every payload.", "type": "string" @@ -21,13 +18,13 @@ } }, "required": [ - "c", - "t" + "t", + "c" ], "type": "object" }, "OreBlock256": { - "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore` domains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's domain, so it serves equality too. The block count is width-agnostic on the wire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the array just carries more block strings. SQL-side constructor: `eql_v3.ore_block_256`.", + "description": "Block-ORE order term — the `ob` wire key. Backs the `_ord` / `_ord_ore`\ndomains (`=` `<>` `<` `<=` `>` `>=`); ORE is lossless over the scalar's\ndomain, so it serves equality too. The block count is width-agnostic on the\nwire (8 for the int scalars, 12 for timestamptz, 14 for numeric) — the\narray just carries more block strings. SQL-side constructor:\n`eql_v3.ore_block_256`.", "items": { "type": "string" }, @@ -39,46 +36,29 @@ "type": "integer" } }, - "description": "`eql_v3.timestamptz_ord_ore` — full comparison, scheme-explicit name.", + "$id": "https://schemas.cipherstash.com/eql/v3/timestamptz_ord_ore.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "`eql_v3.timestamptz_ord_ore` — ordering domain.\n\nOperators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`.", "properties": { "c": { - "allOf": [ - { - "$ref": "#/definitions/Ciphertext" - } - ], - "description": "mp_base85 source ciphertext. Required by the domain CHECK." + "$ref": "#/$defs/Ciphertext" }, "i": { - "allOf": [ - { - "$ref": "#/definitions/Identifier" - } - ], - "description": "Table/column identifier. Required by the domain CHECK." + "$ref": "#/$defs/Identifier" }, "ob": { - "allOf": [ - { - "$ref": "#/definitions/OreBlock256" - } - ], - "description": "Block-ORE order term (12 blocks for timestamptz). Serves equality too." + "$ref": "#/$defs/OreBlock256" }, "v": { - "allOf": [ - { - "$ref": "#/definitions/SchemaVersion" - } - ], - "description": "Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other value fails deserialization." + "$ref": "#/$defs/SchemaVersion" } }, "required": [ - "c", + "v", "i", - "ob", - "v" + "c", + "ob" ], "title": "TimestamptzOrdOre", "type": "object" diff --git a/crates/eql-bindings/src/lib.rs b/crates/eql-bindings/src/lib.rs index 6146d3ccf..44052e591 100644 --- a/crates/eql-bindings/src/lib.rs +++ b/crates/eql-bindings/src/lib.rs @@ -76,27 +76,20 @@ impl<'de> Deserialize<'de> for SchemaVersion { /// Manual schema: pins `v` to the literal `2` (`const`), mirroring the /// domain CHECK — the derive would emit an unconstrained integer. impl schemars::JsonSchema for SchemaVersion { - fn schema_name() -> String { - "SchemaVersion".to_owned() + fn schema_name() -> std::borrow::Cow<'static, str> { + "SchemaVersion".into() } - fn json_schema(_: &mut schemars::gen::SchemaGenerator) -> schemars::schema::Schema { - schemars::schema::SchemaObject { - instance_type: Some(schemars::schema::InstanceType::Integer.into()), - const_value: Some(serde_json::json!(EQL_SCHEMA_VERSION)), - metadata: Some(Box::new(schemars::schema::Metadata { - // KEEP IN SYNC with the `SchemaVersion` doc comment above — it - // is the canonical text. A derived `JsonSchema` would copy the - // doc comment automatically; this manual impl can't, so this - // hand-written copy must be updated alongside it. - description: Some( - "The envelope version field (`v`) — always exactly `2` on the wire.".to_owned(), - ), - ..Default::default() - })), - ..Default::default() - } - .into() + fn json_schema(_: &mut schemars::SchemaGenerator) -> schemars::Schema { + // KEEP IN SYNC with the `SchemaVersion` doc comment above — it is the + // canonical text. A derived `JsonSchema` would copy the doc comment + // automatically; this manual impl can't, so this hand-written copy + // must be updated alongside it. + schemars::json_schema!({ + "type": "integer", + "const": EQL_SCHEMA_VERSION, + "description": "The envelope version field (`v`) — always exactly `2` on the wire.", + }) } } diff --git a/crates/eql-bindings/src/v3/bool.rs b/crates/eql-bindings/src/v3/bool.rs index 0b2396a62..858a5806c 100644 --- a/crates/eql-bindings/src/v3/bool.rs +++ b/crates/eql-bindings/src/v3/bool.rs @@ -1,50 +1,30 @@ -//! The `bool` encrypted-domain family — the storage-only / encryption-only -//! scalar. -//! -//! | Rust type | SQL domain | Required keys | Operators | -//! |------------|----------------|---------------|---------------------| -//! | [`Bool`] | `eql_v3.bool` | `v` `i` `c` | none (storage only) | -//! -//! `bool` is the only **storage-only** scalar: it has no `_eq`/`_ord` domain -//! and carries no index term, so the value is encrypted at rest and decrypted -//! by the proxy but is never searchable server-side. A two-value column has so -//! little cardinality that any searchable index (even HMAC equality) would -//! trivially leak the plaintext distribution. The payload is `{v,i,c}` only — -//! no `hm`/`ob`/`bf` — and every operator on the domain is blocked. - -use schemars::{schema::RootSchema, schema_for}; - +// @generated by eql-codegen from the eql-domains catalog — do not edit +//! The `bool` encrypted-domain family — generated from the eql-domains catalog. use crate::v3::terms::Ciphertext; use crate::v3::DomainType; use crate::{Identifier, SchemaVersion}; -use schemars::JsonSchema; +use schemars::{schema_for, JsonSchema, Schema}; use serde::{Deserialize, Serialize}; use ts_rs::TS; - -/// `eql_v3.bool` — storage only / encryption-only; every operator is blocked. +/// `eql_v3.bool` — storage-only domain. +/// +/// Operators: none. Required keys: `v` `i` `c`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Bool { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, } - impl DomainType for Bool { fn sql_domain_static() -> &'static str { "eql_v3.bool" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Bool) } } diff --git a/crates/eql-bindings/src/v3/date.rs b/crates/eql-bindings/src/v3/date.rs index 1da37028f..3e0fa45fd 100644 --- a/crates/eql-bindings/src/v3/date.rs +++ b/crates/eql-bindings/src/v3/date.rs @@ -1,131 +1,99 @@ -//! The `date` encrypted-domain family — an ordered, non-integer scalar. -//! Same four-domain ordered shape as [`crate::v3::int4`] (ORE compares -//! ciphertext, so dates order like integers); see that module for the -//! capability table. - -use schemars::{schema::RootSchema, schema_for}; - +// @generated by eql-codegen from the eql-domains catalog — do not edit +//! The `date` encrypted-domain family — generated from the eql-domains catalog. use crate::v3::terms::{Ciphertext, Hmac256, OreBlock256}; use crate::v3::DomainType; use crate::{Identifier, SchemaVersion}; -use schemars::JsonSchema; +use schemars::{schema_for, JsonSchema, Schema}; use serde::{Deserialize, Serialize}; use ts_rs::TS; - -/// `eql_v3.date` — storage only; every operator is blocked. +/// `eql_v3.date` — storage-only domain. +/// +/// Operators: none. Required keys: `v` `i` `c`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Date { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, } - impl DomainType for Date { fn sql_domain_static() -> &'static str { "eql_v3.date" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Date) } } - -/// `eql_v3.date_eq` — HMAC equality (`=`, `<>`). +/// `eql_v3.date_eq` — equality domain. +/// +/// Operators: `=` `<>`. Required keys: `v` `i` `c` `hm`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct DateEq { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// HMAC-SHA-256 equality term. pub hm: Hmac256, } - impl DomainType for DateEq { fn sql_domain_static() -> &'static str { "eql_v3.date_eq" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(DateEq) } } - -/// `eql_v3.date_ord_ore` — full comparison, scheme-explicit name. +/// `eql_v3.date_ord_ore` — ordering domain. +/// +/// Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct DateOrdOre { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// Block-ORE order term. Serves equality too. pub ob: OreBlock256, } - impl DomainType for DateOrdOre { fn sql_domain_static() -> &'static str { "eql_v3.date_ord_ore" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(DateOrdOre) } } - -/// `eql_v3.date_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`). +/// `eql_v3.date_ord` — ordering domain. +/// +/// Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct DateOrd { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// Block-ORE order term. Serves equality too. pub ob: OreBlock256, } - impl DomainType for DateOrd { fn sql_domain_static() -> &'static str { "eql_v3.date_ord" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(DateOrd) } } diff --git a/crates/eql-bindings/src/v3/domain_type.rs b/crates/eql-bindings/src/v3/domain_type.rs new file mode 100644 index 000000000..6eee3694a --- /dev/null +++ b/crates/eql-bindings/src/v3/domain_type.rs @@ -0,0 +1,83 @@ +//! The hand-written `DomainType` trait and its `PhantomData` enumeration +//! plumbing — the stable, NON-generated core of the v3 bindings surface. The +//! per-family payload structs and the `inventory.rs` `all()` list are generated +//! from `eql-domains::CATALOG` by `eql-codegen`; this trait, the schema-id base, +//! and the blanket `PhantomData` impl are authored by hand. + +use std::marker::PhantomData; + +use schemars::{schema_for, JsonSchema, Schema}; + +/// The PostgreSQL schema every domain in this module inhabits. +pub const SQL_SCHEMA: &str = "eql_v3"; + +/// Base URL for the canonical `$id` of every published v3 JSON Schema. +/// The per-domain `$id` is `{SCHEMA_ID_BASE}{domain}.json` (see +/// [`DomainType::schema_id`]); `tests/export.rs` injects it at write time. +pub const SCHEMA_ID_BASE: &str = "https://schemas.cipherstash.com/eql/v3/"; + +/// One v3 domain type — implemented by every payload type, so any payload +/// value can report the SQL domain it inhabits (`payload.sql_domain()`). +/// +/// Each token file implements this next to the type it describes; the SQL +/// domain string is defined exactly once, in that impl. `all()` is generated +/// from `eql-domains::CATALOG` (`inventory.rs`), so it cannot drift; the +/// published JSON Schema wire contract is pinned by `tests/catalog_parity.rs`. +/// Public so FFI consumers can enumerate the protocol surface too. +pub trait DomainType { + /// Fully-qualified SQL domain name, e.g. `"eql_v3.int4_eq"` — the + /// per-type fact everything else derives from, defined once in each + /// type's impl. + /// + /// `where Self: Sized` keeps the trait object-safe (the method is + /// excluded from the vtable); through `dyn DomainType`, use + /// [`Self::sql_domain`]. + fn sql_domain_static() -> &'static str + where + Self: Sized; + + /// Fully-qualified SQL domain name of this payload value. + fn sql_domain(&self) -> &'static str; + + /// Unqualified SQL domain name (e.g. `"int4_eq"`) — [`Self::sql_domain`] + /// minus the schema qualifier; matches `eql-domains` + /// `DomainFamily::domain_name`. + fn domain(&self) -> &'static str { + self.sql_domain() + .strip_prefix("eql_v3.") + .expect("sql_domain must be qualified with the eql_v3 schema") + } + + /// Canonical `$id` for this domain's published JSON Schema — + /// `{SCHEMA_ID_BASE}{domain}.json`. The single source of truth for the + /// identity `tests/export.rs` injects; pinned by `tests/catalog_parity.rs`. + fn schema_id(&self) -> String { + format!("{SCHEMA_ID_BASE}{}.json", self.domain()) + } + + /// The type's JSON Schema. + fn schema(&self) -> Schema; +} + +/// Type-level handle: lets [`all`] enumerate the domain types without +/// payload values to box — `Box::new(PhantomData::)` is zero-sized, +/// and the delegation goes through [`DomainType::sql_domain_static`], so no +/// payload instance is ever constructed. +/// +/// [`all`]: super::all +impl DomainType for PhantomData +where + T: DomainType + JsonSchema, +{ + fn sql_domain_static() -> &'static str { + T::sql_domain_static() + } + + fn sql_domain(&self) -> &'static str { + T::sql_domain_static() + } + + fn schema(&self) -> Schema { + schema_for!(T) + } +} diff --git a/crates/eql-bindings/src/v3/float4.rs b/crates/eql-bindings/src/v3/float4.rs index 4af550230..944f5265e 100644 --- a/crates/eql-bindings/src/v3/float4.rs +++ b/crates/eql-bindings/src/v3/float4.rs @@ -1,141 +1,99 @@ -//! The `float4` encrypted-domain family — an ordered, non-integer scalar -//! backed by IEEE-754 `real` (`f32`). Same four-domain ordered shape as -//! [`crate::v3::int4`] (ORE compares ciphertext, so floats order like -//! integers); see that module for the capability table. -//! -//! Both float widths encrypt through a single f64 crypto path -//! (`Plaintext::Float`): a `real` is widened to f64 before encryption, so the -//! wire shape here is identical to [`crate::v3::float8`] — an 8-block `ob` term -//! (`f64::ENCODED_LEN == 8`, same as `int8`). `float4` vs `float8` is purely a -//! Postgres-surface distinction (column type, domain name). -//! -//! Special-value behaviour (`-0.0`, `±Inf`, and the **NaN is not rejected -//! server-side — reject it client-side** caveat) is identical to `float8`; see -//! [`crate::v3::float8`] for the full note. - -use schemars::{schema::RootSchema, schema_for}; - +// @generated by eql-codegen from the eql-domains catalog — do not edit +//! The `float4` encrypted-domain family — generated from the eql-domains catalog. use crate::v3::terms::{Ciphertext, Hmac256, OreBlock256}; use crate::v3::DomainType; use crate::{Identifier, SchemaVersion}; -use schemars::JsonSchema; +use schemars::{schema_for, JsonSchema, Schema}; use serde::{Deserialize, Serialize}; use ts_rs::TS; - -/// `eql_v3.float4` — storage only; every operator is blocked. +/// `eql_v3.float4` — storage-only domain. +/// +/// Operators: none. Required keys: `v` `i` `c`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Float4 { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, } - impl DomainType for Float4 { fn sql_domain_static() -> &'static str { "eql_v3.float4" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Float4) } } - -/// `eql_v3.float4_eq` — HMAC equality (`=`, `<>`). +/// `eql_v3.float4_eq` — equality domain. +/// +/// Operators: `=` `<>`. Required keys: `v` `i` `c` `hm`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Float4Eq { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// HMAC-SHA-256 equality term. pub hm: Hmac256, } - impl DomainType for Float4Eq { fn sql_domain_static() -> &'static str { "eql_v3.float4_eq" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Float4Eq) } } - -/// `eql_v3.float4_ord_ore` — full comparison, scheme-explicit name. +/// `eql_v3.float4_ord_ore` — ordering domain. +/// +/// Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Float4OrdOre { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// Block-ORE order term (8 blocks for float). Serves equality too. pub ob: OreBlock256, } - impl DomainType for Float4OrdOre { fn sql_domain_static() -> &'static str { "eql_v3.float4_ord_ore" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Float4OrdOre) } } - -/// `eql_v3.float4_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`). +/// `eql_v3.float4_ord` — ordering domain. +/// +/// Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Float4Ord { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// Block-ORE order term (8 blocks for float). Serves equality too. pub ob: OreBlock256, } - impl DomainType for Float4Ord { fn sql_domain_static() -> &'static str { "eql_v3.float4_ord" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Float4Ord) } } diff --git a/crates/eql-bindings/src/v3/float8.rs b/crates/eql-bindings/src/v3/float8.rs index de2ebba3c..4442ad27b 100644 --- a/crates/eql-bindings/src/v3/float8.rs +++ b/crates/eql-bindings/src/v3/float8.rs @@ -1,150 +1,99 @@ -//! The `float8` encrypted-domain family — an ordered, non-integer scalar -//! backed by IEEE-754 `double precision` (`f64`), the native width of the float -//! crypto path. Same four-domain ordered shape as [`crate::v3::int4`]; see that -//! module for the capability table. -//! -//! Both float widths encrypt through a single f64 crypto path -//! (`Plaintext::Float`), so the wire shape is identical to -//! [`crate::v3::float4`] — an 8-block `ob` term (`f64::ENCODED_LEN == 8`, same -//! as `int8`). -//! -//! ## Special values (caller-facing) -//! -//! `-0.0` canonicalizes to `+0.0` (equal under `=`, IEEE-consistent) and -//! `±Inf` order correctly (`-Inf < finite < +Inf`). **NaN is unordered and -//! unspecified in the encoder**: it can be encrypted, stored, and pass the -//! domain CHECK, but it carries **no comparison guarantee** and does NOT follow -//! IEEE semantics (where NaN compares false against everything). The domain -//! CHECK validates only the envelope — it cannot inspect the ciphertext — so a -//! NaN payload is never rejected server-side. **Reject NaN client-side before -//! encryption** if your column must not contain it; otherwise a NaN row sorts -//! at an arbitrary (but deterministic) position in an encrypted range scan -//! rather than being excluded the way native Postgres `double precision` would. -//! See the `float_special` regression suite for the locked behaviour. - -use schemars::{schema::RootSchema, schema_for}; - +// @generated by eql-codegen from the eql-domains catalog — do not edit +//! The `float8` encrypted-domain family — generated from the eql-domains catalog. use crate::v3::terms::{Ciphertext, Hmac256, OreBlock256}; use crate::v3::DomainType; use crate::{Identifier, SchemaVersion}; -use schemars::JsonSchema; +use schemars::{schema_for, JsonSchema, Schema}; use serde::{Deserialize, Serialize}; use ts_rs::TS; - -/// `eql_v3.float8` — storage only; every operator is blocked. +/// `eql_v3.float8` — storage-only domain. +/// +/// Operators: none. Required keys: `v` `i` `c`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Float8 { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, } - impl DomainType for Float8 { fn sql_domain_static() -> &'static str { "eql_v3.float8" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Float8) } } - -/// `eql_v3.float8_eq` — HMAC equality (`=`, `<>`). +/// `eql_v3.float8_eq` — equality domain. +/// +/// Operators: `=` `<>`. Required keys: `v` `i` `c` `hm`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Float8Eq { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// HMAC-SHA-256 equality term. pub hm: Hmac256, } - impl DomainType for Float8Eq { fn sql_domain_static() -> &'static str { "eql_v3.float8_eq" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Float8Eq) } } - -/// `eql_v3.float8_ord_ore` — full comparison, scheme-explicit name. +/// `eql_v3.float8_ord_ore` — ordering domain. +/// +/// Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Float8OrdOre { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// Block-ORE order term (8 blocks for float). Serves equality too. pub ob: OreBlock256, } - impl DomainType for Float8OrdOre { fn sql_domain_static() -> &'static str { "eql_v3.float8_ord_ore" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Float8OrdOre) } } - -/// `eql_v3.float8_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`). +/// `eql_v3.float8_ord` — ordering domain. +/// +/// Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Float8Ord { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// Block-ORE order term (8 blocks for float). Serves equality too. pub ob: OreBlock256, } - impl DomainType for Float8Ord { fn sql_domain_static() -> &'static str { "eql_v3.float8_ord" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Float8Ord) } } diff --git a/crates/eql-bindings/src/v3/int2.rs b/crates/eql-bindings/src/v3/int2.rs index 6ee64e5af..102a56cec 100644 --- a/crates/eql-bindings/src/v3/int2.rs +++ b/crates/eql-bindings/src/v3/int2.rs @@ -1,129 +1,99 @@ -//! The `int2` encrypted-domain family. Same four-domain ordered shape as -//! [`crate::v3::int4`] — see that module for the capability table. - -use schemars::{schema::RootSchema, schema_for}; - +// @generated by eql-codegen from the eql-domains catalog — do not edit +//! The `int2` encrypted-domain family — generated from the eql-domains catalog. use crate::v3::terms::{Ciphertext, Hmac256, OreBlock256}; use crate::v3::DomainType; use crate::{Identifier, SchemaVersion}; -use schemars::JsonSchema; +use schemars::{schema_for, JsonSchema, Schema}; use serde::{Deserialize, Serialize}; use ts_rs::TS; - -/// `eql_v3.int2` — storage only; every operator is blocked. +/// `eql_v3.int2` — storage-only domain. +/// +/// Operators: none. Required keys: `v` `i` `c`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Int2 { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, } - impl DomainType for Int2 { fn sql_domain_static() -> &'static str { "eql_v3.int2" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Int2) } } - -/// `eql_v3.int2_eq` — HMAC equality (`=`, `<>`). +/// `eql_v3.int2_eq` — equality domain. +/// +/// Operators: `=` `<>`. Required keys: `v` `i` `c` `hm`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Int2Eq { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// HMAC-SHA-256 equality term. pub hm: Hmac256, } - impl DomainType for Int2Eq { fn sql_domain_static() -> &'static str { "eql_v3.int2_eq" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Int2Eq) } } - -/// `eql_v3.int2_ord_ore` — full comparison, scheme-explicit name. +/// `eql_v3.int2_ord_ore` — ordering domain. +/// +/// Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Int2OrdOre { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// Block-ORE order term. Serves equality too. pub ob: OreBlock256, } - impl DomainType for Int2OrdOre { fn sql_domain_static() -> &'static str { "eql_v3.int2_ord_ore" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Int2OrdOre) } } - -/// `eql_v3.int2_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`). +/// `eql_v3.int2_ord` — ordering domain. +/// +/// Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Int2Ord { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// Block-ORE order term. Serves equality too. pub ob: OreBlock256, } - impl DomainType for Int2Ord { fn sql_domain_static() -> &'static str { "eql_v3.int2_ord" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Int2Ord) } } diff --git a/crates/eql-bindings/src/v3/int4.rs b/crates/eql-bindings/src/v3/int4.rs index 74296f495..274acb957 100644 --- a/crates/eql-bindings/src/v3/int4.rs +++ b/crates/eql-bindings/src/v3/int4.rs @@ -1,137 +1,99 @@ -//! The `int4` encrypted-domain family — the reference scalar. -//! -//! | Rust type | SQL domain | Required keys | Operators | -//! |----------------|------------------------|---------------|----------------------------| -//! | [`Int4`] | `eql_v3.int4` | `v` `i` `c` | none (storage only) | -//! | [`Int4Eq`] | `eql_v3.int4_eq` | `v` `i` `c` `hm` | `=` `<>` | -//! | [`Int4OrdOre`] | `eql_v3.int4_ord_ore` | `v` `i` `c` `ob` | `=` `<>` `<` `<=` `>` `>=` | -//! | [`Int4Ord`] | `eql_v3.int4_ord` | `v` `i` `c` `ob` | `=` `<>` `<` `<=` `>` `>=` | - -use schemars::{schema::RootSchema, schema_for}; - +// @generated by eql-codegen from the eql-domains catalog — do not edit +//! The `int4` encrypted-domain family — generated from the eql-domains catalog. use crate::v3::terms::{Ciphertext, Hmac256, OreBlock256}; use crate::v3::DomainType; use crate::{Identifier, SchemaVersion}; -use schemars::JsonSchema; +use schemars::{schema_for, JsonSchema, Schema}; use serde::{Deserialize, Serialize}; use ts_rs::TS; - -/// `eql_v3.int4` — storage only; every operator is blocked. +/// `eql_v3.int4` — storage-only domain. +/// +/// Operators: none. Required keys: `v` `i` `c`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Int4 { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, } - impl DomainType for Int4 { fn sql_domain_static() -> &'static str { "eql_v3.int4" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Int4) } } - -/// `eql_v3.int4_eq` — HMAC equality (`=`, `<>`). +/// `eql_v3.int4_eq` — equality domain. +/// +/// Operators: `=` `<>`. Required keys: `v` `i` `c` `hm`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Int4Eq { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// HMAC-SHA-256 equality term. pub hm: Hmac256, } - impl DomainType for Int4Eq { fn sql_domain_static() -> &'static str { "eql_v3.int4_eq" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Int4Eq) } } - -/// `eql_v3.int4_ord_ore` — full comparison (`=` `<>` `<` `<=` `>` `>=`), -/// scheme-explicit name. Same shape as [`Int4Ord`], distinct SQL domain. +/// `eql_v3.int4_ord_ore` — ordering domain. +/// +/// Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Int4OrdOre { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// Block-ORE order term. Serves equality too — ORE over a - /// full-domain `int4` is lossless, so no separate `hm` is carried. pub ob: OreBlock256, } - impl DomainType for Int4OrdOre { fn sql_domain_static() -> &'static str { "eql_v3.int4_ord_ore" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Int4OrdOre) } } - -/// `eql_v3.int4_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`). +/// `eql_v3.int4_ord` — ordering domain. +/// +/// Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Int4Ord { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// Block-ORE order term. Serves equality too. pub ob: OreBlock256, } - impl DomainType for Int4Ord { fn sql_domain_static() -> &'static str { "eql_v3.int4_ord" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Int4Ord) } } diff --git a/crates/eql-bindings/src/v3/int8.rs b/crates/eql-bindings/src/v3/int8.rs index 0bd46fd29..f3f8bc2f2 100644 --- a/crates/eql-bindings/src/v3/int8.rs +++ b/crates/eql-bindings/src/v3/int8.rs @@ -1,129 +1,99 @@ -//! The `int8` encrypted-domain family. Same four-domain ordered shape as -//! [`crate::v3::int4`] — see that module for the capability table. - -use schemars::{schema::RootSchema, schema_for}; - +// @generated by eql-codegen from the eql-domains catalog — do not edit +//! The `int8` encrypted-domain family — generated from the eql-domains catalog. use crate::v3::terms::{Ciphertext, Hmac256, OreBlock256}; use crate::v3::DomainType; use crate::{Identifier, SchemaVersion}; -use schemars::JsonSchema; +use schemars::{schema_for, JsonSchema, Schema}; use serde::{Deserialize, Serialize}; use ts_rs::TS; - -/// `eql_v3.int8` — storage only; every operator is blocked. +/// `eql_v3.int8` — storage-only domain. +/// +/// Operators: none. Required keys: `v` `i` `c`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Int8 { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, } - impl DomainType for Int8 { fn sql_domain_static() -> &'static str { "eql_v3.int8" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Int8) } } - -/// `eql_v3.int8_eq` — HMAC equality (`=`, `<>`). +/// `eql_v3.int8_eq` — equality domain. +/// +/// Operators: `=` `<>`. Required keys: `v` `i` `c` `hm`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Int8Eq { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// HMAC-SHA-256 equality term. pub hm: Hmac256, } - impl DomainType for Int8Eq { fn sql_domain_static() -> &'static str { "eql_v3.int8_eq" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Int8Eq) } } - -/// `eql_v3.int8_ord_ore` — full comparison, scheme-explicit name. +/// `eql_v3.int8_ord_ore` — ordering domain. +/// +/// Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Int8OrdOre { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// Block-ORE order term. Serves equality too. pub ob: OreBlock256, } - impl DomainType for Int8OrdOre { fn sql_domain_static() -> &'static str { "eql_v3.int8_ord_ore" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Int8OrdOre) } } - -/// `eql_v3.int8_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`). +/// `eql_v3.int8_ord` — ordering domain. +/// +/// Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Int8Ord { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// Block-ORE order term. Serves equality too. pub ob: OreBlock256, } - impl DomainType for Int8Ord { fn sql_domain_static() -> &'static str { "eql_v3.int8_ord" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Int8Ord) } } diff --git a/crates/eql-bindings/src/v3/inventory.rs b/crates/eql-bindings/src/v3/inventory.rs new file mode 100644 index 000000000..ca185607f --- /dev/null +++ b/crates/eql-bindings/src/v3/inventory.rs @@ -0,0 +1,48 @@ +// @generated by eql-codegen from the eql-domains catalog — do not edit +//! The `all()` inventory — every v3 domain payload type in eql-domains::CATALOG order. Generated from the catalog; the DomainType trait, the shared newtypes, and the architectural module doc stay hand-written (domain_type.rs / terms.rs / mod.rs). +use super::domain_type::DomainType; +use std::marker::PhantomData; +/// Every v3 domain type, in `eql-domains::CATALOG` order — generated. +pub fn all() -> Vec> { + vec![ + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + Box::new(PhantomData::), + ] +} diff --git a/crates/eql-bindings/src/v3/mod.rs b/crates/eql-bindings/src/v3/mod.rs index 53998b457..2fffced62 100644 --- a/crates/eql-bindings/src/v3/mod.rs +++ b/crates/eql-bindings/src/v3/mod.rs @@ -4,11 +4,10 @@ //! capability-encoded design from the original int4 scalar prototype //! (PR #236's first cut), formalized: //! the SQL surface is generated from `eql-domains::CATALOG`, and these types -//! mirror it 1:1 (enforced by `tests/catalog_parity.rs`, which fails if the -//! catalog and [`all`] ever disagree on the set or order of domains; the -//! catalog-derived wire-key gate is schema-based and lands with the stacked -//! schemars change, with per-type strictness spot checks in -//! `tests/v3_conformance.rs`). +//! mirror it 1:1 — `all()` is generated from the same catalog (`inventory.rs`), +//! so it cannot drift; the published JSON Schema wire contract is pinned by +//! `tests/catalog_parity.rs` and the emitted `.ts` property order by +//! `tests/ts_property_order.rs`. //! //! **Versioning.** "v3" is the SQL schema generation (`eql_v3.*` domains). //! The JSON envelope version is still `v: 2` ([`crate::EQL_SCHEMA_VERSION`]) — @@ -27,6 +26,13 @@ //! (SQL-side) by the domain CHECK. A missing term key is a deserialization //! error — the Rust analogue of the CHECK constraint. //! +//! One exception to "`ob` for `_ord`": `text`'s ordered domains carry **both** +//! `hm` and `ob` (`text_ord`, `text_ord_ore`, `text_search`), where the non-text +//! ordered domains carry `ob` alone. Text routes `=`/`<>` through `hm` rather +//! than the ORE term because lexicographic ORE over text is not equality- +//! lossless, so equality needs the HMAC. The generated struct doc surfaces this +//! structurally — its required-keys line lists `hm` `ob` rather than just `ob`. +//! //! The types are also **strict**: every struct is //! `#[serde(deny_unknown_fields)]`, so a payload carrying keys outside the //! domain's set fails to deserialize rather than being silently stripped on @@ -43,138 +49,41 @@ //! mode this tier exists to retire, and `_ord` vs `_ord_ore` are identical //! shapes that no sniffing can separate. Consumers read from a typed column //! and already know the domain. - -use std::marker::PhantomData; - -use schemars::{schema::RootSchema, schema_for, JsonSchema}; +//! +//! ## Per-family caller-facing notes +//! +//! These are not derivable from the catalog and are documented here because the +//! per-family modules are generated. +//! +//! **`float8` / `float4` special values.** `-0.0` canonicalizes to `+0.0` +//! (equal under `=`, IEEE-consistent) and `±Inf` order correctly +//! (`-Inf < finite < +Inf`). **NaN is unordered and unspecified in the +//! encoder**: it can be encrypted, stored, and pass the domain CHECK, but it +//! carries **no comparison guarantee** and does NOT follow IEEE semantics. The +//! domain CHECK validates only the envelope — it cannot inspect the ciphertext +//! — so a NaN payload is never rejected server-side. **Reject NaN client-side +//! before encryption** if your column must not contain it; otherwise a NaN row +//! sorts at an arbitrary (but deterministic) position in an encrypted range +//! scan. See the `float_special` regression suite for the locked behaviour. +//! +//! **`bool` is storage-only by design.** It has no `_eq`/`_ord` domain and +//! carries no index term: a two-value column has so little cardinality that any +//! searchable index (even HMAC equality) would trivially leak the plaintext +//! distribution. The payload is `{v,i,c}` only and every operator is blocked. pub mod bool; pub mod date; +pub mod domain_type; pub mod float4; pub mod float8; pub mod int2; pub mod int4; pub mod int8; +pub mod inventory; pub mod numeric; pub mod terms; pub mod text; pub mod timestamptz; -/// The PostgreSQL schema every domain in this module inhabits. -pub const SQL_SCHEMA: &str = "eql_v3"; - -/// Base URL for the canonical `$id` of every published v3 JSON Schema. -/// The per-domain `$id` is `{SCHEMA_ID_BASE}{domain}.json` (see -/// [`DomainType::schema_id`]); `tests/export.rs` injects it at write time. -pub const SCHEMA_ID_BASE: &str = "https://schemas.cipherstash.com/eql/v3/"; - -/// One v3 domain type — implemented by every payload type, so any payload -/// value can report the SQL domain it inhabits (`payload.sql_domain()`). -/// -/// Each token file implements this next to the type it describes; the SQL -/// domain string is defined exactly once, in that impl, and -/// `tests/catalog_parity.rs` cross-checks every entry of [`all`] against -/// `eql-domains::CATALOG` — a typo'd or mis-ordered domain fails there. -/// Public so FFI consumers can enumerate the protocol surface too. -pub trait DomainType { - /// Fully-qualified SQL domain name, e.g. `"eql_v3.int4_eq"` — the - /// per-type fact everything else derives from, defined once in each - /// type's impl. - /// - /// `where Self: Sized` keeps the trait object-safe (the method is - /// excluded from the vtable); through `dyn DomainType`, use - /// [`Self::sql_domain`]. - fn sql_domain_static() -> &'static str - where - Self: Sized; - - /// Fully-qualified SQL domain name of this payload value. - fn sql_domain(&self) -> &'static str; - - /// Unqualified SQL domain name (e.g. `"int4_eq"`) — [`Self::sql_domain`] - /// minus the schema qualifier; matches `eql-domains` - /// `DomainFamily::domain_name`. - fn domain(&self) -> &'static str { - self.sql_domain() - .strip_prefix("eql_v3.") - .expect("sql_domain must be qualified with the eql_v3 schema") - } - - /// Canonical `$id` for this domain's published JSON Schema — - /// `{SCHEMA_ID_BASE}{domain}.json`. The single source of truth for the - /// identity `tests/export.rs` injects; pinned by `tests/catalog_parity.rs`. - fn schema_id(&self) -> String { - format!("{SCHEMA_ID_BASE}{}.json", self.domain()) - } - - /// The type's JSON Schema. - fn schema(&self) -> RootSchema; -} - -/// Type-level handle: lets [`all`] enumerate the domain types without -/// payload values to box — `Box::new(PhantomData::)` is zero-sized, -/// and the delegation goes through [`DomainType::sql_domain_static`], so no -/// payload instance is ever constructed. -impl DomainType for PhantomData -where - T: DomainType + JsonSchema, -{ - fn sql_domain_static() -> &'static str { - T::sql_domain_static() - } - - fn sql_domain(&self) -> &'static str { - T::sql_domain_static() - } - - fn schema(&self) -> RootSchema { - schema_for!(T) - } -} - -/// Every v3 domain type, in `eql-domains::CATALOG` order (token order, then -/// each token's domains in manifest order) — the one hand-maintained list of -/// types in the crate. -pub fn all() -> Vec> { - vec![ - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - Box::new(PhantomData::), - ] -} +pub use domain_type::{DomainType, SCHEMA_ID_BASE, SQL_SCHEMA}; +pub use inventory::all; diff --git a/crates/eql-bindings/src/v3/numeric.rs b/crates/eql-bindings/src/v3/numeric.rs index d7d5b08a8..30f57ca07 100644 --- a/crates/eql-bindings/src/v3/numeric.rs +++ b/crates/eql-bindings/src/v3/numeric.rs @@ -1,136 +1,99 @@ -//! The `numeric` encrypted-domain family — an ordered, non-integer scalar -//! backed by `rust_decimal::Decimal`. Same four-domain ordered shape as -//! [`crate::v3::int4`] (ORE compares ciphertext, so decimals order like -//! integers); see that module for the capability table. -//! -//! `numeric` is the first scalar whose native ORE term is wider than 8 blocks -//! (14 blocks): the wire shape is unchanged — the `ob` array simply carries -//! more block strings — and the generalized `eql_v3.ore_block_256` comparator -//! orders any block count, so no new type is needed here. - -use schemars::{schema::RootSchema, schema_for}; - +// @generated by eql-codegen from the eql-domains catalog — do not edit +//! The `numeric` encrypted-domain family — generated from the eql-domains catalog. use crate::v3::terms::{Ciphertext, Hmac256, OreBlock256}; use crate::v3::DomainType; use crate::{Identifier, SchemaVersion}; -use schemars::JsonSchema; +use schemars::{schema_for, JsonSchema, Schema}; use serde::{Deserialize, Serialize}; use ts_rs::TS; - -/// `eql_v3.numeric` — storage only; every operator is blocked. +/// `eql_v3.numeric` — storage-only domain. +/// +/// Operators: none. Required keys: `v` `i` `c`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Numeric { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, } - impl DomainType for Numeric { fn sql_domain_static() -> &'static str { "eql_v3.numeric" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Numeric) } } - -/// `eql_v3.numeric_eq` — HMAC equality (`=`, `<>`). +/// `eql_v3.numeric_eq` — equality domain. +/// +/// Operators: `=` `<>`. Required keys: `v` `i` `c` `hm`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct NumericEq { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// HMAC-SHA-256 equality term. pub hm: Hmac256, } - impl DomainType for NumericEq { fn sql_domain_static() -> &'static str { "eql_v3.numeric_eq" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(NumericEq) } } - -/// `eql_v3.numeric_ord_ore` — full comparison, scheme-explicit name. +/// `eql_v3.numeric_ord_ore` — ordering domain. +/// +/// Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct NumericOrdOre { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// Block-ORE order term (14 blocks for numeric). Serves equality too. pub ob: OreBlock256, } - impl DomainType for NumericOrdOre { fn sql_domain_static() -> &'static str { "eql_v3.numeric_ord_ore" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(NumericOrdOre) } } - -/// `eql_v3.numeric_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`). +/// `eql_v3.numeric_ord` — ordering domain. +/// +/// Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct NumericOrd { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// Block-ORE order term (14 blocks for numeric). Serves equality too. pub ob: OreBlock256, } - impl DomainType for NumericOrd { fn sql_domain_static() -> &'static str { "eql_v3.numeric_ord" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(NumericOrd) } } diff --git a/crates/eql-bindings/src/v3/terms.rs b/crates/eql-bindings/src/v3/terms.rs index b322ed87d..3275afccc 100644 --- a/crates/eql-bindings/src/v3/terms.rs +++ b/crates/eql-bindings/src/v3/terms.rs @@ -53,47 +53,28 @@ pub struct BloomFilter(pub Vec); /// so an out-of-range bit position would pass schema validation and fail /// at the database. impl schemars::JsonSchema for BloomFilter { - fn schema_name() -> String { - "BloomFilter".to_owned() + fn schema_name() -> std::borrow::Cow<'static, str> { + "BloomFilter".into() } - fn json_schema(_: &mut schemars::gen::SchemaGenerator) -> schemars::schema::Schema { - use schemars::schema::{ - ArrayValidation, InstanceType, Metadata, NumberValidation, Schema, SchemaObject, - }; - let items = SchemaObject { - instance_type: Some(InstanceType::Integer.into()), - format: Some("int16".to_owned()), - number: Some(Box::new(NumberValidation { - minimum: Some(f64::from(i16::MIN)), - maximum: Some(f64::from(i16::MAX)), - ..Default::default() - })), - ..Default::default() - }; - SchemaObject { - instance_type: Some(InstanceType::Array.into()), - array: Some(Box::new(ArrayValidation { - items: Some(Schema::Object(items).into()), - ..Default::default() - })), - metadata: Some(Box::new(Metadata { - // KEEP IN SYNC with the doc comment on `BloomFilter` above — it - // is the canonical text. A derived `JsonSchema` would copy the - // doc comment automatically; this manual impl can't, so this - // hand-written paraphrase must be updated alongside it. - description: Some( - "Bloom-filter match term — the `bf` wire key. Backs the `_match` \ - domains (`@>`/`<@` containment). Signed i16: EQL stores the filter \ - as PostgreSQL `smallint[]`, and filters sized above 32768 emit \ - upper-half bit positions as negative signed values." - .to_owned(), - ), - ..Default::default() - })), - ..Default::default() - } - .into() + fn json_schema(_: &mut schemars::SchemaGenerator) -> schemars::Schema { + // KEEP IN SYNC with the doc comment on `BloomFilter` above — it is the + // canonical text. A derived `JsonSchema` would copy the doc comment + // automatically; this manual impl can't, so this hand-written + // paraphrase must be updated alongside it. + schemars::json_schema!({ + "type": "array", + "items": { + "type": "integer", + "format": "int16", + "minimum": i16::MIN, + "maximum": i16::MAX, + }, + "description": "Bloom-filter match term — the `bf` wire key. Backs the `_match` \ + domains (`@>`/`<@` containment). Signed i16: EQL stores the filter \ + as PostgreSQL `smallint[]`, and filters sized above 32768 emit \ + upper-half bit positions as negative signed values.", + }) } } diff --git a/crates/eql-bindings/src/v3/text.rs b/crates/eql-bindings/src/v3/text.rs index 2d6b05987..921d5a6ea 100644 --- a/crates/eql-bindings/src/v3/text.rs +++ b/crates/eql-bindings/src/v3/text.rs @@ -1,205 +1,149 @@ -//! The `text` encrypted-domain family — the ordered shape of -//! [`crate::v3::int4`] plus a `_match` domain backed by the Bloom-filter -//! term (`@>`/`<@` containment for `LIKE`-style matching). - -use schemars::{schema::RootSchema, schema_for}; - +// @generated by eql-codegen from the eql-domains catalog — do not edit +//! The `text` encrypted-domain family — generated from the eql-domains catalog. use crate::v3::terms::{BloomFilter, Ciphertext, Hmac256, OreBlock256}; use crate::v3::DomainType; use crate::{Identifier, SchemaVersion}; -use schemars::JsonSchema; +use schemars::{schema_for, JsonSchema, Schema}; use serde::{Deserialize, Serialize}; use ts_rs::TS; - -/// `eql_v3.text` — storage only; every operator is blocked. +/// `eql_v3.text` — storage-only domain. +/// +/// Operators: none. Required keys: `v` `i` `c`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Text { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, } - impl DomainType for Text { fn sql_domain_static() -> &'static str { "eql_v3.text" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Text) } } - -/// `eql_v3.text_eq` — HMAC equality (`=`, `<>`). +/// `eql_v3.text_eq` — equality domain. +/// +/// Operators: `=` `<>`. Required keys: `v` `i` `c` `hm`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct TextEq { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// HMAC-SHA-256 equality term. pub hm: Hmac256, } - impl DomainType for TextEq { fn sql_domain_static() -> &'static str { "eql_v3.text_eq" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(TextEq) } } - -/// `eql_v3.text_match` — Bloom-filter containment match. +/// `eql_v3.text_match` — match domain. +/// +/// Operators: `@>` `<@`. Required keys: `v` `i` `c` `bf`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct TextMatch { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// Bloom-filter match term (signed smallint bit positions). pub bf: BloomFilter, } - impl DomainType for TextMatch { fn sql_domain_static() -> &'static str { "eql_v3.text_match" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(TextMatch) } } - -/// `eql_v3.text_ord_ore` — full lexicographic comparison, -/// scheme-explicit name. Unlike the integer ordered domains (`[Ore]` only), -/// text routes equality through `hm` rather than the ORE term, so the domain -/// carries both `hm` and `ob` (`[Hm, Ore]`). +/// `eql_v3.text_ord_ore` — ordering domain. +/// +/// Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `hm` `ob`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct TextOrdOre { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// HMAC-SHA-256 equality term. Text routes `=`/`<>` through `hm`. pub hm: Hmac256, - /// Block-ORE order term. pub ob: OreBlock256, } - impl DomainType for TextOrdOre { fn sql_domain_static() -> &'static str { "eql_v3.text_ord_ore" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(TextOrdOre) } } - -/// `eql_v3.text_ord` — full lexicographic comparison -/// (`=` `<>` `<` `<=` `>` `>=`). Carries both `hm` (equality) and `ob` -/// (ordering) — text routes equality through `hm` (`[Hm, Ore]`). +/// `eql_v3.text_ord` — ordering domain. +/// +/// Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `hm` `ob`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct TextOrd { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// HMAC-SHA-256 equality term. Text routes `=`/`<>` through `hm`. pub hm: Hmac256, - /// Block-ORE order term. pub ob: OreBlock256, } - impl DomainType for TextOrd { fn sql_domain_static() -> &'static str { "eql_v3.text_ord" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(TextOrd) } } - -/// `eql_v3.text_search` — the full text search surface: HMAC equality, ORE -/// ordering, and Bloom-filter containment match (`[Hm, Ore, Bloom]`). The -/// superset domain combining `_eq`, `_ord`, and `_match`. +/// `eql_v3.text_search` — search domain. +/// +/// Operators: `=` `<>` `<` `<=` `>` `>=` `@>` `<@`. Required keys: `v` `i` `c` `hm` `ob` `bf`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct TextSearch { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// HMAC-SHA-256 equality term. pub hm: Hmac256, - /// Block-ORE order term. pub ob: OreBlock256, - /// Bloom-filter match term (signed smallint bit positions). pub bf: BloomFilter, } - impl DomainType for TextSearch { fn sql_domain_static() -> &'static str { "eql_v3.text_search" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(TextSearch) } } diff --git a/crates/eql-bindings/src/v3/timestamptz.rs b/crates/eql-bindings/src/v3/timestamptz.rs index a86ad5d57..d5d8342b1 100644 --- a/crates/eql-bindings/src/v3/timestamptz.rs +++ b/crates/eql-bindings/src/v3/timestamptz.rs @@ -1,137 +1,99 @@ -//! The `timestamptz` encrypted-domain family — an ordered, non-integer scalar. -//! Same four-domain ordered shape as [`crate::v3::int4`] (ORE compares -//! ciphertext, so timestamps order like integers); see that module for the -//! capability table. -//! -//! cipherstash encrypts timestamps at native 12-block ORE width. The family -//! was equality-only while EQL's ORE comparator was hardcoded to 8 blocks; -//! now that `eql_v3.ore_block_256` derives the block count from the term -//! length, the 12-block `ob` term orders correctly and the ordered domains -//! ship. The wire shape is unchanged — the `ob` array just carries 12 blocks. - -use schemars::{schema::RootSchema, schema_for}; - +// @generated by eql-codegen from the eql-domains catalog — do not edit +//! The `timestamptz` encrypted-domain family — generated from the eql-domains catalog. use crate::v3::terms::{Ciphertext, Hmac256, OreBlock256}; use crate::v3::DomainType; use crate::{Identifier, SchemaVersion}; -use schemars::JsonSchema; +use schemars::{schema_for, JsonSchema, Schema}; use serde::{Deserialize, Serialize}; use ts_rs::TS; - -/// `eql_v3.timestamptz` — storage only; every operator is blocked. +/// `eql_v3.timestamptz` — storage-only domain. +/// +/// Operators: none. Required keys: `v` `i` `c`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct Timestamptz { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, } - impl DomainType for Timestamptz { fn sql_domain_static() -> &'static str { "eql_v3.timestamptz" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(Timestamptz) } } - -/// `eql_v3.timestamptz_eq` — HMAC equality (`=`, `<>`). +/// `eql_v3.timestamptz_eq` — equality domain. +/// +/// Operators: `=` `<>`. Required keys: `v` `i` `c` `hm`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct TimestamptzEq { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// HMAC-SHA-256 equality term. pub hm: Hmac256, } - impl DomainType for TimestamptzEq { fn sql_domain_static() -> &'static str { "eql_v3.timestamptz_eq" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(TimestamptzEq) } } - -/// `eql_v3.timestamptz_ord_ore` — full comparison, scheme-explicit name. +/// `eql_v3.timestamptz_ord_ore` — ordering domain. +/// +/// Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct TimestamptzOrdOre { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// Block-ORE order term (12 blocks for timestamptz). Serves equality too. pub ob: OreBlock256, } - impl DomainType for TimestamptzOrdOre { fn sql_domain_static() -> &'static str { "eql_v3.timestamptz_ord_ore" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(TimestamptzOrdOre) } } - -/// `eql_v3.timestamptz_ord` — full comparison (`=` `<>` `<` `<=` `>` `>=`). +/// `eql_v3.timestamptz_ord` — ordering domain. +/// +/// Operators: `=` `<>` `<` `<=` `>` `>=`. Required keys: `v` `i` `c` `ob`. #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, TS, JsonSchema)] #[ts(export, export_to = "v3/")] #[serde(deny_unknown_fields)] pub struct TimestamptzOrd { - /// Envelope version — always `2` (`EQL_SCHEMA_VERSION`); any other - /// value fails deserialization. pub v: SchemaVersion, - /// Table/column identifier. Required by the domain CHECK. pub i: Identifier, - /// mp_base85 source ciphertext. Required by the domain CHECK. pub c: Ciphertext, - /// Block-ORE order term (12 blocks for timestamptz). Serves equality too. pub ob: OreBlock256, } - impl DomainType for TimestamptzOrd { fn sql_domain_static() -> &'static str { "eql_v3.timestamptz_ord" } - fn sql_domain(&self) -> &'static str { Self::sql_domain_static() } - - fn schema(&self) -> RootSchema { + fn schema(&self) -> Schema { schema_for!(TimestamptzOrd) } } diff --git a/crates/eql-bindings/tests/catalog_parity.rs b/crates/eql-bindings/tests/catalog_parity.rs index 53bfa16a3..aeebcd611 100644 --- a/crates/eql-bindings/tests/catalog_parity.rs +++ b/crates/eql-bindings/tests/catalog_parity.rs @@ -1,12 +1,16 @@ -//! The drift gate: the v3 domain inventory must mirror `eql-domains::CATALOG` -//! — the same catalog that generates the `eql_v3` SQL surface — exactly: -//! every domain, in catalog order, and every domain's wire contract, pinned -//! through the published JSON Schema. schemars output reflects the real -//! serde contract, so per domain this catches an `Option` term field or a -//! wrong wire key (`required`), a struct that lost -//! `#[serde(deny_unknown_fields)]` (`additionalProperties: false`), and a -//! `v` field that is not [`eql_bindings::SchemaVersion`] (the `$ref` and its -//! `const: 2`). Behavioural spot checks of the same properties live in +//! The drift gate: every v3 domain's wire contract — pinned through the +//! published JSON Schema — must match `eql-domains::CATALOG`, the same catalog +//! that GENERATES both the SQL surface and these payload structs. schemars +//! output reflects the real serde contract, so per domain this catches a +//! wrong/dropped required key, a struct that lost +//! `#[serde(deny_unknown_fields)]` (`additionalProperties: false`), and a `v` +//! field that is not [`eql_bindings::SchemaVersion`] (the `$ref` and its +//! `const: 2`). The inventory set/order IS policed here by +//! `inventory_exactly_covers_catalog_in_order()`, which asserts `v3::all()` +//! lists exactly the `CATALOG` domains in catalog order (the generated +//! `inventory.rs` byte-parity gate lives in eql-codegen; this covers the +//! compiled `all()`). The emitted `.ts` property order is pinned by +//! `tests/ts_property_order.rs`. Behavioural spot checks live in //! `tests/v3_conformance.rs`. use std::collections::BTreeSet; @@ -15,19 +19,6 @@ use eql_bindings::{v3, EQL_SCHEMA_VERSION}; use eql_domains::{Term, CATALOG, ENVELOPE_KEYS}; use serde_json::{json, Value}; -#[test] -fn inventory_exactly_covers_catalog() { - let expected: Vec = CATALOG - .iter() - .flat_map(|spec| spec.domains.iter().map(|d| spec.domain_name(d))) - .collect(); - let actual: Vec<&str> = v3::all().iter().map(|e| e.domain()).collect(); - assert_eq!( - actual, expected, - "v3::all() must list every CATALOG domain, in catalog order" - ); -} - /// The *published* JSON Schemas must agree with the catalog: each domain's /// schema `required` list is exactly envelope + catalog term keys — the /// artifact schema consumers validate against cannot drift from the SQL @@ -43,13 +34,14 @@ fn schema_required_keys_match_catalog_terms() { .find(|e| e.domain() == name) .unwrap_or_else(|| panic!("no domain inventory entry for {name}")); - let schema = entry.schema(); - let object = schema - .schema - .object - .as_ref() - .unwrap_or_else(|| panic!("{name}: schema is not an object")); - let required: BTreeSet<&str> = object.required.iter().map(String::as_str).collect(); + let schema: Value = serde_json::to_value(entry.schema()) + .unwrap_or_else(|e| panic!("{name}: schema does not serialize: {e}")); + let required: BTreeSet<&str> = schema["required"] + .as_array() + .unwrap_or_else(|| panic!("{name}: schema has no required array")) + .iter() + .map(|v| v.as_str().expect("required entry is a string")) + .collect(); let expected: BTreeSet<&str> = ENVELOPE_KEYS .iter() @@ -65,6 +57,30 @@ fn schema_required_keys_match_catalog_terms() { } } +/// `v3::all()` must list exactly the catalog domains, in catalog order. The +/// generated `inventory.rs` makes this structurally true, but the only cargo- +/// level guard was `schema_required_keys_match_catalog_terms`, which iterates +/// CATALOG and *finds* each entry — it catches a missing entry but neither an +/// extra entry nor a wrong order. (The byte-parity gate in eql-codegen covers +/// the generated `inventory.rs` source; this covers the actually-compiled +/// `all()` at the eql-bindings level.) A direct ordered `assert_eq!` restores +/// both directions, the regression dropped when `inventory_exactly_covers_catalog` +/// was removed (commit 27c200c4). +#[test] +fn inventory_exactly_covers_catalog_in_order() { + let expected: Vec = CATALOG + .iter() + .flat_map(|spec| spec.domains.iter().map(move |d| spec.domain_name(d))) + .collect(); + let actual: Vec = v3::all().iter().map(|e| e.domain().to_string()).collect(); + assert_eq!( + actual, expected, + "v3::all() must list exactly the catalog domains in catalog order \ + (extra/missing entry or reordering) — regenerate with \ + `mise run types:generate` and commit inventory.rs" + ); +} + /// The published `$id` is the schema's identity URL — `tests/export.rs` /// injects [`v3::DomainType::schema_id`] into every written file. Pin its /// shape with independent literals (NOT the helper, which would only test @@ -125,18 +141,18 @@ fn schemas_are_strict() { (struct lost #[serde(deny_unknown_fields)]?)" ); assert_eq!( - schema.pointer("/definitions/Identifier/additionalProperties"), + schema.pointer("/$defs/Identifier/additionalProperties"), Some(&json!(false)), "{name}: Identifier definition must set additionalProperties: false" ); assert_eq!( - schema.pointer("/properties/v/allOf/0/$ref"), - Some(&json!("#/definitions/SchemaVersion")), + schema.pointer("/properties/v/$ref"), + Some(&json!("#/$defs/SchemaVersion")), "{name}: the v property must $ref the SchemaVersion definition \ (field declared as a bare integer instead of SchemaVersion?)" ); assert_eq!( - schema.pointer("/definitions/SchemaVersion/const"), + schema.pointer("/$defs/SchemaVersion/const"), Some(&json!(EQL_SCHEMA_VERSION)), "{name}: SchemaVersion must pin const: {EQL_SCHEMA_VERSION}" ); diff --git a/crates/eql-bindings/tests/mod_pins_catalog.rs b/crates/eql-bindings/tests/mod_pins_catalog.rs new file mode 100644 index 000000000..0a5bf26aa --- /dev/null +++ b/crates/eql-bindings/tests/mod_pins_catalog.rs @@ -0,0 +1,41 @@ +//! Permanent guard: the HAND-WRITTEN `src/v3/mod.rs` `pub mod ;` list +//! stays in step with `eql_domains::CATALOG`. `generate_bindings` owns the +//! `.rs` files and `inventory.rs` but deliberately never touches `mod.rs` +//! (it carries the architectural module doc and the non-derivable float-NaN / +//! bool caveats). So adding a family to the catalog writes `.rs` + +//! `inventory.rs` referencing `super::::…`, but if the dev forgets to add +//! `pub mod ;` to `mod.rs` the only symptom is a cryptic `E0433` +//! ("failed to resolve: use of undeclared module") during `cargo test` — and only +//! AFTER the in-place regen has already overwritten committed source. This test +//! converts that into a friendly, catalog-pinned assertion with a fix hint. + +use eql_domains::CATALOG; + +#[test] +fn mod_rs_declares_every_catalog_family() { + let path = format!("{}/src/v3/mod.rs", env!("CARGO_MANIFEST_DIR")); + let src = std::fs::read_to_string(&path).unwrap_or_else(|e| panic!("read {path}: {e}")); + + // A `pub mod ;` declaration, ignoring leading indentation. The list is + // flat and unattributed, so an exact-line match is sufficient and avoids + // false positives from substrings inside doc comments. + let declared: std::collections::BTreeSet<&str> = src + .lines() + .filter_map(|l| { + let l = l.trim(); + l.strip_prefix("pub mod ") + .and_then(|rest| rest.strip_suffix(';')) + }) + .collect(); + + for family in CATALOG { + assert!( + declared.contains(family.name), + "crates/eql-bindings/src/v3/mod.rs is missing `pub mod {0};` for catalog \ + family `{0}`. mod.rs stays hand-written (it carries the architectural \ + module doc + caveats), so generate_bindings cannot add it for you — \ + add the line by hand.", + family.name + ); + } +} diff --git a/crates/eql-bindings/tests/ts_property_order.rs b/crates/eql-bindings/tests/ts_property_order.rs new file mode 100644 index 000000000..4a6472641 --- /dev/null +++ b/crates/eql-bindings/tests/ts_property_order.rs @@ -0,0 +1,61 @@ +//! Permanent guard: the emitted TypeScript property order for every domain is +//! envelope (`v`, `i`, `c`) then one property per term in `Term::term_json_keys` +//! order. ts-rs carries struct-declaration order into the `.ts`, and that order +//! is the load-bearing wire contract consumers read. Nothing else pins it: +//! `v3_conformance` compares `serde_json::Value` (a `BTreeMap`, no +//! `preserve_order`) so it is order-INSENSITIVE; `catalog_parity` compares a +//! `BTreeSet`; and `types:check` is regenerate-then-diff, which keeps committed +//! `.ts` in step with the *current* generator but cannot catch a generator order +//! regression that is regenerated + committed self-consistently. + +use eql_domains::{Term, CATALOG}; + +/// Property identifiers, in declared order, from a ts-rs `export type X = { … }` +/// file. Layout-independent: ts-rs emits the body on a single line when fields +/// carry no doc comments (the doc-less generated structs) and across multiple +/// lines when they do, so we scope to the `export type` declaration's brace +/// body and split it on `,` rather than scanning per line. Each property is a +/// `name: Type` segment; the leading `ident:` token is the property name. +fn ts_property_order(ts: &str) -> Vec { + let decl = ts + .find("export type") + .expect("ts-rs file has an `export type` declaration"); + let after = &ts[decl..]; + let open = after.find('{').expect("export type has a brace body"); + let close = after.rfind('}').expect("export type closes its brace body"); + let body = &after[open + 1..close]; + body.split(',') + .filter_map(|seg| { + let (head, _) = seg.split_once(':')?; + let id = head.trim(); + if id.is_empty() || !id.chars().all(|c| c.is_ascii_alphanumeric() || c == '_') { + return None; + } + Some(id.to_string()) + }) + .collect() +} + +#[test] +fn every_ts_export_has_envelope_then_term_property_order() { + for family in CATALOG { + for domain in family.domains { + let stem = domain.struct_ident(family.name); + let path = format!("{}/bindings/v3/{stem}.ts", env!("CARGO_MANIFEST_DIR")); + let ts = std::fs::read_to_string(&path).unwrap_or_else(|e| panic!("read {path}: {e}")); + + let mut expected = vec!["v".to_string(), "i".to_string(), "c".to_string()]; + expected.extend( + Term::term_json_keys(domain.terms) + .iter() + .map(|s| s.to_string()), + ); + + assert_eq!( + ts_property_order(&ts), + expected, + "TS property order mismatch for {stem} ({path})" + ); + } + } +} diff --git a/crates/eql-codegen/Cargo.toml b/crates/eql-codegen/Cargo.toml index bec6f3989..b245640ca 100644 --- a/crates/eql-codegen/Cargo.toml +++ b/crates/eql-codegen/Cargo.toml @@ -10,6 +10,10 @@ minijinja = "2" serde = { version = "1", features = ["derive"] } serde_json = "1" thiserror = "2" +quote = "1" +proc-macro2 = "1" +syn = { version = "2", features = ["full"] } +prettyplease = "=0.2.37" [[bin]] name = "eql-codegen" diff --git a/crates/eql-codegen/src/bindings.rs b/crates/eql-codegen/src/bindings.rs new file mode 100644 index 000000000..e6c4a3efc --- /dev/null +++ b/crates/eql-codegen/src/bindings.rs @@ -0,0 +1,597 @@ +//! The Rust payload-bindings emitter: renders `eql_domains::CATALOG` to the +//! committed `crates/eql-bindings/src/v3/.rs` structs + `DomainType` +//! impls and the generated `inventory.rs` (`all()`), the same generate-to- +//! committed-source mechanism `generate.rs` uses for SQL. Token stream via +//! `quote!`, formatted by `prettyplease::unparse` then the repo's stable +//! `rustfmt` (prettyplease is rustfmt-clean but not rustfmt-identical), with +//! the `// @generated` ownership marker prepended as line 1. + +use std::path::{Path, PathBuf}; + +use proc_macro2::TokenStream; +use quote::{format_ident, quote}; + +use eql_domains::{Domain, DomainFamily, Term, CATALOG, ENVELOPE_KEYS}; + +use crate::consts::RUST_GENERATED_MARKER; +use crate::writer::{ + clean_generated_files, ensure_generated_paths_writable, write_generated_file, GeneratedKind, + WriteError, +}; + +/// Format a token stream into committed Rust source. `prettyplease::unparse` +/// gives deterministic, parseable output; the `@generated` marker is prepended +/// as line 1 (syn/prettyplease drop free-standing line comments, so it cannot +/// live inside the token stream); then the whole file is run through `rustfmt` +/// so it is byte-for-byte what `cargo fmt --check` (`mise run test:crates`) +/// expects. +pub fn format_rs(tokens: TokenStream) -> String { + let file: syn::File = syn::parse2(tokens).expect("emit syntactically valid Rust"); + let body = prettyplease::unparse(&file); + let with_marker = format!("{RUST_GENERATED_MARKER}\n{body}"); + rustfmt(&with_marker) +} + +/// Pipe Rust source through the repo's `rustfmt` (stdin → stdout). Fails loudly: +/// codegen is a dev-time tool and `rustfmt` is always present where `cargo fmt` +/// runs. `rustfmt` preserves the leading `// @generated` line comment, so the +/// marker stays exactly line 1. +fn rustfmt(src: &str) -> String { + use std::io::Write; + use std::process::{Command, Stdio}; + + let mut child = Command::new("rustfmt") + .args(["--edition", "2021"]) + .stdin(Stdio::piped()) + .stdout(Stdio::piped()) + .stderr(Stdio::piped()) + .spawn() + .expect("spawn rustfmt (is the Rust toolchain on PATH?)"); + child + .stdin + .take() + .expect("rustfmt stdin") + .write_all(src.as_bytes()) + .expect("write to rustfmt"); + let out = child.wait_with_output().expect("wait for rustfmt"); + assert!( + out.status.success(), + "rustfmt failed: {}", + String::from_utf8_lossy(&out.stderr) + ); + String::from_utf8(out.stdout).expect("rustfmt output is UTF-8") +} + +/// Capability label for a domain's single catalog-derived doc line, keyed on +/// the bare domain name. The match is keyed on the `&str` bare name (finer than +/// the typed [`eql_domains::Role`], which collapses `match`/`search` into +/// `Ord`), so it cannot be made exhaustive at the type level. Instead the +/// catch-all `panic!`s: an unmapped bare-domain name aborts codegen loudly, +/// forcing a deliberate label choice rather than silently emitting generic-but- +/// wrong doc text — preserving the "compile-checked catalog" guarantee. +fn capability_label(domain_name: &str) -> &'static str { + match domain_name { + "" => "storage-only domain", + "eq" => "equality domain", + "ord" | "ord_ore" => "ordering domain", + "match" => "match domain", + "search" => "search domain", + other => panic!( + "unmapped bare domain name {other:?} — add it to capability_label \ + in crates/eql-codegen/src/bindings.rs" + ), + } +} + +/// Render the catalog-derived struct doc lines for a domain: a summary line +/// (`` `eql_v3.` —