Module eql 

Types for representing EQL payloads, and encryption/decryption functions.

Two wire envelopes are produced here:

• v2 (encrypt_eql → EqlCiphertext): matches the EQL v2.3 schema at cipherstash/encrypt-query-language/docs/reference/schema/eql-payload-v2.3.schema.json.
• v3 (encrypt_eql_v3 → EqlCiphertextV3): the eql_v3 envelope — scalar payloads drop the k discriminator, bloom bit positions are signed smallint[], and SteVec entries order by the CLLW-OPE op term only.

The two share one encryption pipeline (see encrypt_eql_with) and differ only in the wire types they assemble.

Structs

EncryptedPayload

Scalar EQL storage payload (k = "ct").

EncryptedPayloadV3

EQL v3 scalar storage payload — a flat {v, i, c, hm?, ob?, op?, bf?} object with no k discriminator (the shape the eql_v3 scalar domain CHECKs accept).

EncryptedQueryPayload

Root-scalar query payload — carries exactly one root-scope index term.

EncryptedQueryPayloadV3

v3 scalar query operand — {v, i, hm?, bf?, ob?, op?}: the stored EncryptedPayloadV3 minus the record ciphertext c (no k, no c).

EqlDecryptOpts

Options for EQL decryption operations.

EqlEncryptOpts

Options for EQL encryption operations.

Identifier

Identifies a specific database table and column pair.

PreparedPlaintext

A prepared plaintext value ready for EQL encryption.

SteVecEntry

One entry inside an SteVecPayload.

SteVecEntryV3

One entry in a v3 SteVec document — selector s, per-entry ciphertext c, optional array marker a, and (number/string path entries only) the CLLW-OPE ordering term op. Per-entry v/i/k are NOT carried; the envelope (including the key header h) lives only at the root.

SteVecPayload

STE-vector EQL storage payload (k = "sv").

SteVecPayloadV3

EQL v3 SteVec document payload — {v, k: "sv", i, h, sv}. The root k discriminator IS kept (the v3 jsonb document models it).

SteVecQueryEntryV3

One entry of a v3 jsonb containment needle — selector s plus, for orderable path entries, the op ordering term.

SteVecQueryPayload

STE-vector query payload — carries either a selector lookup or a single per-element term used to match against an SteVecEntry.

SteVecQueryPayloadV3

v3 jsonb containment needle — {sv: [{s, op?}]}. Each entry is a selector plus, for orderable path entries, the ordering term; value-selector and structural entries are selector-only (matched on presence). No envelope.

Enums

EqlCiphertext

EQL v2.3 storage payload. One of two mutually exclusive root shapes discriminated by k.

EqlCiphertextV3

EQL v3 storage payload — the v3 analogue of EqlCiphertext.

EqlError

Errors that can occur during EQL encryption, decryption, and index operations.

EqlOperation

Specifies what to encrypt when encrypting encryption::Plaintext values.

EqlOutput

Output of encrypt_eql for a single PreparedPlaintext.

EqlOutputV3

Output of encrypt_eql_v3 for a single PreparedPlaintext — the v3 analogue of EqlOutput. Store inputs yield an EqlCiphertextV3; Query inputs an EqlQueryPayloadV3.

EqlQueryPayload

EQL query payload — partial encrypted payload used to match against stored EqlCiphertext values.

EqlQueryPayloadV3

EQL v3 query operand — the query-side counterpart of EqlCiphertextV3.

RootQueryTerm

Per-root-scalar query term. Exactly one of hm, bf, ob, or op.

SteVecEntryTerm

Ordering term carried by a number/string SteVecEntry path entry — the ordering primitive selected by the column’s SteVecMode: Ope (op, Compat mode — CLLW OPE) or OreCllw (oc, Standard mode — CLLW ORE, the legacy v2 protocol). Domain separation between numeric and string ordering ciphertexts is enforced on the plaintext bit-stream before CLLW encryption — numeric and string ciphertexts therefore sort into disjoint ranges, but the domain tag is not visible by hex-decoding the oc / op ciphertext alone.

SteVecEntryTermV3

Ordering term on a v3 SteVec entry — the CLLW-OPE op.

SteVecKind

The k: "sv" form discriminator carried by SteVecPayloadV3. A single-variant enum so serialization emits exactly "sv" and deserialization rejects anything else.

SteVecQueryTerm

Per-STE-vector query term. Exactly one of s, hm, oc, op, or q.

Constants

EQL_SCHEMA_VERSION

The current version of the EQL schema format.

EQL_SCHEMA_VERSION_V3

The EQL v3 schema version — encoded as v on every payload produced by encrypt_eql_v3.

Functions

decrypt_eql

Decrypts multiple EQL storage payloads back to plaintext.

decrypt_eql_fallible

Like decrypt_eql but decryption failure of one or more ciphertexts does not fail the entire operation. Instead, a decryption result (success or failure) is returned for every ciphertext.

encrypt_eql

Encrypts multiple plaintexts into EQL format.

encrypt_eql_v3

Encrypts multiple plaintexts into EQL v3 payloads.