Module eql 

Types for representing EQL payloads, and encryption/decryption functions.

Two wire envelopes are produced here:

• v2 (encrypt_eql → EqlCiphertext): matches the EQL v2.3 schema at cipherstash/encrypt-query-language/docs/reference/schema/eql-payload-v2.3.schema.json.
• v3 (encrypt_eql_v3 → EqlCiphertextV3): the eql_v3 envelope — scalar payloads drop the k discriminator, bloom bit positions are signed smallint[], and SteVec entries order by the CLLW-OPE op term only.

The two share one encryption pipeline (see encrypt_eql_with) and differ only in the wire types they assemble.

Structs

EncryptedPayload

Scalar EQL storage payload (k = "ct").

EncryptedPayloadV3

EQL v3 scalar storage payload — a flat {v, i, c, hm?, ob?, op?, bf?} object with no k discriminator (the shape the eql_v3 scalar domain CHECKs accept).

EncryptedQueryPayload

Root-scalar query payload — carries exactly one root-scope index term.

EncryptedQueryPayloadV3

v3 scalar query operand — {v, i, hm?, bf?, ob?, op?}: the stored EncryptedPayloadV3 minus the record ciphertext c (no k, no c).

EqlDecryptOpts

Options for EQL decryption operations.

EqlEncryptOpts

Options for EQL encryption operations.

Identifier

Identifies a specific database table and column pair.

PreparedPlaintext

A prepared plaintext value ready for EQL encryption.

SteVecEntry

One entry inside an SteVecPayload.

SteVecEntryV3

One entry in a v3 SteVec document — selector s, per-entry ciphertext c, optional array marker a, and exactly one of hm/op. Per-entry v/i/k are NOT carried; the envelope lives only at the root.

SteVecPayload

STE-vector EQL storage payload (k = "sv").

SteVecPayloadV3

EQL v3 SteVec document payload — {v, k: "sv", i, sv}. The root k discriminator IS kept (the v3 jsonb document models it).

SteVecQueryEntryV3

One entry of a v3 jsonb containment needle — selector s plus exactly one of hm/op.

SteVecQueryPayload

STE-vector query payload — carries either a selector lookup or a single per-element term used to match against an SteVecEntry.

SteVecQueryPayloadV3

v3 jsonb containment needle — {sv: [{s, hm|op}]}. Each entry is a selector plus exactly one term (mirrors eql_v3.to_ste_vec_query). No envelope.

Enums

EqlCiphertext

EQL v2.3 storage payload. One of two mutually exclusive root shapes discriminated by k.

EqlCiphertextV3

EQL v3 storage payload — the v3 analogue of EqlCiphertext.

EqlError

Errors that can occur during EQL encryption, decryption, and index operations.

EqlOperation

Specifies what to encrypt when encrypting encryption::Plaintext values.

EqlOutput

Output of encrypt_eql for a single PreparedPlaintext.

EqlOutputV3

Output of encrypt_eql_v3 for a single PreparedPlaintext — the v3 analogue of EqlOutput. Store inputs yield an EqlCiphertextV3; Query inputs an EqlQueryPayloadV3.

EqlQueryPayload

EQL query payload — partial encrypted payload used to match against stored EqlCiphertext values.

EqlQueryPayloadV3

EQL v3 query operand — the query-side counterpart of EqlCiphertextV3.

RootQueryTerm

Per-root-scalar query term. Exactly one of hm, bf, ob, or op.

SteVecEntryTerm

Equality / ordering term carried by an SteVecEntry.

SteVecEntryTermV3

Equality / ordering term on a v3 SteVec entry — exactly one of hm (equality) or op (CLLW-OPE ordering).

SteVecKind

The k: "sv" form discriminator carried by SteVecPayloadV3. A single-variant enum so serialization emits exactly "sv" and deserialization rejects anything else.

SteVecQueryTerm

Per-STE-vector query term. Exactly one of s, hm, oc, op, or q.

Constants

EQL_SCHEMA_VERSION

The current version of the EQL schema format.

EQL_SCHEMA_VERSION_V3

The EQL v3 schema version — encoded as v on every payload produced by encrypt_eql_v3.

Functions

decrypt_eql

Decrypts multiple EQL storage payloads back to plaintext.

decrypt_eql_fallible

Like decrypt_eql but decryption failure of one or more ciphertexts does not fail the entire operation. Instead, a decryption result (success or failure) is returned for every ciphertext.

encrypt_eql

Encrypts multiple plaintexts into EQL format.

encrypt_eql_v3

Encrypts multiple plaintexts into EQL v3 payloads.