chore(stack): upgrade EQL v3 bundle (timestamptz → timestamp) + cast_as fix

[tobyhede]

Stacked on #541. Tracks encrypt-query-language@2e64ca73, which renames the eql_v3.timestamptz* domains to eql_v3.timestamp*, and fixes the time-of-day truncation those domains suffered.

1. Bundle rename — timestamptz → timestamp

import { encryptedTable, types } from "@cipherstash/stack/eql/v3";

const events = encryptedTable("events", {
  occurredAt: types.Timestamp("occurred_at"),      // was types.Timestamptz
});

• types.Timestamptz* → types.Timestamp*; domain consts / classes / eqlType (eql_v3.timestamptz* → eql_v3.timestamp*); barrel re-exports.
• Regenerated the vendored SQL fixture (cipherstash-encrypt-v3.sql).
• Install tooling: the stale-install sentinel moves from eql_v3.text_search (present in both bundle generations) to eql_v3.timestamp (new this bundle), so a DB carrying an older install is detected as stale and reinstalled.

2. cast_as fix — preserve time-of-day

The native protect-ffi CastAs has a distinct timestamp variant (full date+time) separate from date (calendar-date only). Every timestamp domain was set to cast_as: 'date', so the native layer truncated the time-of-day to midnight on decrypt. Now:

types.Timestamp("t").build().cast_as    // 'timestamp'  (was 'date')
types.Date("d").build().cast_as         // 'date'       (unchanged)

• castAsEnum (SDK/native) and eqlCastAsEnum (wasm, via toEqlCastAs) gain timestamp; toEqlCastAs('timestamp') → 'timestamp'.
• PlaintextKind gains timestamp (decrypts to Date, like date); the four TIMESTAMP* domain consts set castAs: 'timestamp'.
• Typed client reconstructRow rebuilds Date for timestamp as well as date.
• Re-enables the previously-skipped schema-v3-client occurredAt round-trip (a ms-zeroed 12:34:56 instant) to pin time-of-day preservation live in CI.

Verified

• SDK level: timestamp columns emit cast_as: 'timestamp', date stays date, encryptConfigSchema validates, full pnpm build typechecks (incl. toEqlCastAs exhaustiveness).
• 210 v3 runtime + 58 type tests pass; no regressions. The live SQL/round-trip tests (incl. the re-enabled occurredAt) run in CI with credentials.

Note: the base commit on this branch (test(stack): v3 lock-context coverage …) belongs to #541 and will drop from this diff once #541 merges.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 61b52df

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes changesets to release 6 packages

Name	Type
@cipherstash/stack	Minor
@cipherstash/bench	Patch
@cipherstash/prisma-next	Patch
@cipherstash/basic-example	Patch
@cipherstash/prisma-next-example	Patch
@cipherstash/e2e	Patch

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2cc59dbe-f887-4374-86a3-638628b70f7d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/eql-v3-timestamp-bundle

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}