docs(prisma-next): EQL v3 concrete per-domain design (design A)#603
docs(prisma-next): EQL v3 concrete per-domain design (design A)#603tobyhede wants to merge 2 commits into
Conversation
Design for authoring EQL v3 columns in @cipherstash/prisma-next via concrete per-domain constructors that map 1:1 to the public.* Postgres domains, with capabilities encoded in the type system (no boolean-option surface, no resolver). Reflects protect-ffi 0.28: public.* domains + eql_v3.* operator functions, first-class BigInt family, DOMAIN_REGISTRY as source of truth, separate v2/v3 entry points, and concrete per-domain types threaded end-to-end.
|
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Add the design-A implementation plan and remediate the review findings. Real bugs fixed: - cipherstashBetween is now a self-parenthesised conjunction '(gte AND lte)' so any generic NOT/OR composition is safe (Postgres binds NOT tighter than AND; the 9c82f50 bug class). Operator-lowering tests pin the full parenthesised skeleton for all operators and assert NOT (gte AND lte). - v3ToDriver restores bigintSafeReplacer; a stray bigint in a malformed envelope serialises instead of throwing. Pinned by a test. - codec-runtime encode test now exercises the real envelope/.expose() contract (the old test fed a plain object with no .expose(), so it never passed). - constants-v3 drift test replaced the masking cast with a pinned literal tuple (as const satisfies) + bidirectional Exclude guard + runtime equality check. Type spine (the core of v3): - Authoring factories are typed per-domain via v3Authored(types.X): distinct return type per domain, literal codecId/nativeType/capabilities (never string/unknown). Mandatory column-types.test-d.ts pins non-assignability + literal field types. Derivation preserves the concrete column type. Separate v2/v3 entry points (decision 1b): - v3 registers its own extension descriptor with a distinct CIPHERSTASH_V3_SPACE_ID/VERSION, keeping the same cipherstash* method names, and is never co-registered with v2 (the flat OperationRegistry rejects the duplicate method). Task 7 replaces the two-client dispatch with a v3-only cipherstashFromStackV3; a v2 codec id in a v3 contract is a hard error. Plan under docs/superpowers/plans/ (locally git-excluded; force-added). Remaining (follow-up): encrypted ORDER BY (asc/desc -> eql_v3.ord_term), shared-primitive lift to eql/v3/, bulk-middleware edge-case tests, live plaintext-oracle suite, genuine property tests, minor type cleanups.
tobyhede
force-pushed
the
docs/eql-v3-prisma-next-design
branch
from
94eb842 to
0d7f021
Compare
1 participant
Summary
Design spec for authoring EQL v3 columns in
@cipherstash/prisma-nextvia concrete per-domain constructors that map 1:1 to thepublic.*Postgres domains — capabilities encoded in the type system, no boolean-option surface, no runtime resolver.Grounded against
feat/eql-v3-supabase-adapter(protect-ffi 0.28):public.*domains (native types) +eql_v3.*operator functions — the two schemas are distinct and must not be conflated.EncryptedBigInt/Eq/Ord); only searchable JSON stays V2-only;public.booleanis storage-only.DOMAIN_REGISTRY(no hand-maintained table).codecId/nativeType/capabilities, threaded end-to-end, with mandatory*.test-d.ts.OperationRegistrydisallows override).asc/desc→eql_v3.ord_term);betweenparenthesisation +bigintSafeReplaceras correctness invariants; framework-neutral primitives (codec, gate index-sets, fn-schema/op-map) lifted toeql/v3/.Status
docs/superpowers/specs/2026-07-08-eql-v3-prisma-next-design.md)