test(stack): eql v3 domain test-matrix + equality-via-ORE fix

.github/workflows/tests.yml

@@ -160,7 +160,7 @@ jobs:
         run: pnpm exec turbo run test:e2e --filter @cipherstash/e2e
 
   # Verifies @cipherstash/stack/wasm-inline works under Deno — i.e. the
-  # WASM build of protect-ffi 0.25+ and auth 0.38+ can round-trip an
+  # WASM build of protect-ffi 0.26+ and auth 0.40+ can round-trip an
   # encryption against ZeroKMS / CTS in a runtime with no native
   # bindings available. The deno.json deliberately omits --allow-ffi so
   # a silent fallback to the NAPI module is impossible.

packages/cli/tests/helpers/run.ts

@@ -59,19 +59,24 @@ export function run(args: string[], opts: RunOptions = {}): Promise<RunResult> {
 
   let stdout = ''
   let stderr = ''
+  // Preserve the true interleaving order of the combined transcript by
+  // recording chunks as they arrive, while keeping stdout/stderr separate.
+  const chunks: string[] = []
   child.stdout.setEncoding('utf8')
   child.stderr.setEncoding('utf8')
   child.stdout.on('data', (d: string) => {
     stdout += d
+    chunks.push(d)
   })
   child.stderr.on('data', (d: string) => {
     stderr += d
+    chunks.push(d)
   })
 
   return new Promise<RunResult>((res, rej) => {
     child.on('error', rej)
     child.on('close', (code, signal) => {
-      res(buildRunResult(code, signal, stdout, stderr))
+      res(buildRunResult(code, signal, stdout, stderr, chunks.join('')))
     })
   })
 }
@@ -83,14 +88,20 @@ export function run(args: string[], opts: RunOptions = {}): Promise<RunResult> {
  * `code`/`signal` is non-null on `'close'` — this must never coerce a null
  * `code` to `0`, or a signal-terminated child (crash, SIGKILL, OOM) would be
  * misreported as a clean exit.
+ *
+ * `raw` defaults to `stdout + stderr` (fine for the unit tests below, which
+ * pass pre-baked strings with no real interleaving to preserve); `run()`
+ * itself always passes the chunk-interleaved transcript explicitly, since
+ * naive concatenation can reorder output relative to a real child process's
+ * actual stdout/stderr write sequence.
  */
 export function buildRunResult(
   code: number | null,
   signal: NodeJS.Signals | null,
   stdout: string,
   stderr: string,
+  raw: string = stdout + stderr,
 ): RunResult {
-  const raw = stdout + stderr
   return {
     exitCode: code,
     signal,

packages/stack/__tests__/cjs-require.test.ts

@@ -90,7 +90,7 @@ describe('CJS consumers can require the built bundles', () => {
     const v3Bundle = path.join(distDir, 'schema', 'v3', 'index.cjs')
     const script = [
       `const v3 = require(${JSON.stringify(v3Bundle)})`,
-      `const required = ['encryptedTextSearchColumn', 'encryptedInt4Column', 'encryptedBoolColumn', 'encryptedTimestamptzColumn']`,
+      `const required = ['encryptedTextSearchColumn', 'encryptedInt4Column', 'encryptedBoolColumn', 'encryptedTimestamptzColumn', 'encryptedTable', 'buildEncryptConfig']`,
       `const missing = required.filter((k) => typeof v3[k] !== 'function')`,
       `if (missing.length > 0) { throw new Error('missing v3 CJS exports: ' + missing.join(', ')) }`,
     ].join('\n')

packages/stack/__tests__/helpers/stub-auth-wasm-inline.ts

@@ -13,3 +13,11 @@ export const AccessKeyStrategy = {
     )
   },
 }
+
+export const OidcFederationStrategy = {
+  create: (): never => {
+    throw new Error(
+      '[test stub]: auth/wasm-inline OidcFederationStrategy.create not implemented',
+    )
+  },
+}

packages/stack/__tests__/schema-v3-client.test.ts

@@ -236,4 +236,37 @@ describeLive('eql_v3 client integration', () => {
     expect(decrypted.createdOn).toEqual(day)
     expect(decrypted.notes).toBe('hello')
   }, 30000)
+
+  // Hygiene: `occurredAt` (a timestamptz column, camelCase property →
+  // snake_case DB name `occurred_at`) was declared in the test table but never
+  // asserted. Give it a real round-trip through the model path, complementing
+  // the `createdOn` date case above. (`matrix-live.test.ts` is the canonical
+  // generic coverage for all timestamptz tiers; this pins the named column.)
+  //
+  // SKIPPED (CI run 28569708268, PR #540): fails against live credentials —
+  // decrypted `occurredAt` comes back at midnight (`00:00:00.000Z`), losing
+  // the time-of-day. Root cause: `@cipherstash/protect-ffi`'s native
+  // `CastAs` has a distinct `'timestamp'` variant (full date+time) separate
+  // from `'date'` (calendar-date only), but this SDK's `CastAs`/`PlaintextKind`
+  // types never included `'timestamp'` — every `timestamptz` domain sets
+  // `cast_as: 'date'`, identical to the plain `date` domain, so the native
+  // layer truncates it. Pre-existing SDK gap, not a test bug; re-enable once
+  // `timestamptz` gets its own native cast_as.
+  it.skip('round-trips a timestamptz occurredAt column through the model path', async () => {
+    const typed = typedClient(protectClient, users)
+    // Zero milliseconds: the FFI drops sub-second precision, so a ms-bearing
+    // instant would perturb the reconstructed value.
+    const moment = new Date('2026-07-01T12:34:56.000Z')
+
+    const encrypted = unwrapResult(
+      await typed.encryptModel({ occurredAt: moment, notes: 'seen' }, users),
+    )
+    // Must become a ciphertext, not remain a Date (no plaintext passthrough).
+    expect(encrypted.occurredAt).not.toBeInstanceOf(Date)
+    expect(encrypted.occurredAt).toHaveProperty('c')
+
+    const decrypted = unwrapResult(await typed.decryptModel(encrypted, users))
+    expect(decrypted.occurredAt).toBeInstanceOf(Date)
+    expect(decrypted.occurredAt).toEqual(moment)
+  }, 30000)
 })

packages/stack/__tests__/schema-v3-pg.test.ts

@@ -320,4 +320,86 @@ describeLivePg('eql_v3 text_search postgres integration', () => {
 
     expect(rows.map((row) => row.id)).toContain(inserted.id)
   }, 30000)
+
+  // Correctness proof for the equality-via-ORE fix (Part A). The deterministic
+  // regression proves `resolveIndexType` resolves equality to `ore` instead of
+  // throwing; this proves the resulting term actually SELECTS the right rows
+  // against real Postgres, using the SQL `=` operator on the ORE term.
+  it('selects the exact row for an equality term via ORE on an int4_ord column', async () => {
+    async function insertAge(age: number): Promise<number> {
+      const ageCt = unwrapResult(
+        await protectClient.encrypt(age, {
+          table: typedTable,
+          column: typedTable.age,
+        }),
+      ) as postgres.JSONValue
+      const nick = unwrapResult(
+        await protectClient.encrypt(`nick-${age}`, {
+          table: typedTable,
+          column: typedTable.nickname,
+        }),
+      ) as postgres.JSONValue
+      const act = unwrapResult(
+        await protectClient.encrypt(true, {
+          table: typedTable,
+          column: typedTable.active,
+        }),
+      ) as postgres.JSONValue
+      const [row] = await sql<{ id: number }[]>`
+        INSERT INTO protect_ci_v3_typed_domains (age, nickname, active, test_run_id)
+        VALUES (
+          ${sql.json(ageCt)}::eql_v3.int4_ord,
+          ${sql.json(nick)}::eql_v3.text_eq,
+          ${sql.json(act)}::eql_v3.bool,
+          ${TEST_RUN_ID}
+        )
+        RETURNING id
+      `
+      return row.id
+    }
+
+    const ids = {
+      thirty: await insertAge(30),
+      thirtySeven: await insertAge(37),
+      fortyTwo: await insertAge(42),
+    }
+
+    // Equality term encrypted with queryType:'equality' — post-fix this resolves
+    // to the ore (`ob`) term; the SQL `=` operator makes it an equality match.
+    const equalityTerm = unwrapResult(
+      await protectClient.encryptQuery(37, {
+        table: typedTable,
+        column: typedTable.age,
+        queryType: 'equality',
+      }),
+    ) as postgres.JSONValue
+
+    const matched = await sql<{ id: number }[]>`
+      SELECT id
+      FROM protect_ci_v3_typed_domains
+      WHERE test_run_id = ${TEST_RUN_ID}
+        AND eql_v3.ord_term(age) = eql_v3.ore_block_256(${sql.json(equalityTerm)}::jsonb)
+      ORDER BY id
+    `
+    // Exactly the age=37 row — not the 30 or 42 rows.
+    expect(matched.map((row) => row.id)).toEqual([ids.thirtySeven])
+    expect(matched.map((row) => row.id)).not.toContain(ids.thirty)
+    expect(matched.map((row) => row.id)).not.toContain(ids.fortyTwo)
+
+    // A non-matching value selects nothing.
+    const missTerm = unwrapResult(
+      await protectClient.encryptQuery(99, {
+        table: typedTable,
+        column: typedTable.age,
+        queryType: 'equality',
+      }),
+    ) as postgres.JSONValue
+    const none = await sql<{ id: number }[]>`
+      SELECT id
+      FROM protect_ci_v3_typed_domains
+      WHERE test_run_id = ${TEST_RUN_ID}
+        AND eql_v3.ord_term(age) = eql_v3.ore_block_256(${sql.json(missTerm)}::jsonb)
+    `
+    expect(none).toHaveLength(0)
+  }, 30000)
 })