fix(eql): build the stack-encrypt feature against the in-repo stack-encrypt

#971 was written against stack-encrypt as cipherstash-suite#2215 had it
on 2026-09-12. stack-encrypt now lives here and has moved on in two ways
this crate touches:

- vitaminc 0.5 gives a context one view, `IntoContext`, and derives the
  AAD and the PRF context from it. `Identifier` implements that, over
  the same (table, column) pair, instead of `IntoAad` and
  `IntoPrfContext` separately.
- `EncryptFrom::encryption()` no longer takes the context; it is
  supplied when the description runs, and `Encryption` carries its type.

eql-bindings now depends on stack-encrypt by path and version, and the
test crate by path, so the temporary-patch helper
`tasks/dev/with-stack-encrypt.sh` has nothing left to do and is gone,
with the README section and workflow comment that pointed at it.

Refs #971

Author: coderdan

.github/workflows/test-eql.yml

@@ -561,8 +561,6 @@ jobs:
           rustup component add --toolchain "${active_rust_toolchain}" rustfmt clippy
           mise run test:crates
 
-      # Registry builds require the unpublished Stack Encrypt crates from
-      # cipherstash-suite#2215 to be published before this change merges.
       - name: Test Rust text equality with PostgreSQL
         env:
           PGPASSWORD: postgres

packages/eql/crates/eql-bindings/README.md

@@ -110,9 +110,8 @@ The generated API docs include a complete, executable example in the
 [source](src/encryption/example.rs) is also run by the encryption test crate:
 
 ```bash
-# From packages/eql, using the unpublished suite checkout:
-bash tasks/dev/with-stack-encrypt.sh /path/to/cipherstash-suite \
-  test -p eql-encryption-tests --test text_eq_example
+# From packages/eql:
+cargo test -p eql-encryption-tests --test text_eq_example
 ```
 
 With an initialized cipher, the essential calls are:
@@ -149,25 +148,20 @@ these payloads through the existing `public.eql_v3_text_eq` and
 `eql_v3.query_text_eq` domains and their equality extractor index. Writers and
 query producers for these values must use this same profile.
 
-### Developing against the unpublished crates
+### Developing the `stack-encrypt` feature
 
-Stack Encrypt and its runtime prerequisites must be published before the normal
-registry-based build, CI, and `eql-bindings` publication can succeed. Regenerate
-`Cargo.lock` without local overrides once they are published, before merging.
-During development, use a checkout containing
-[cipherstash-suite#2215](https://github.com/cipherstash/cipherstash-suite/pull/2215)
-(tested with commit `cbb3e000009b5974e90ec7da98d015b4b19a7270`):
+Stack Encrypt lives in this repository (`packages/stack-encrypt`), and the
+feature depends on it by path and version: in-tree builds use the path, and the
+published `eql-bindings` resolves the version from crates.io. Publish the
+matching `stack-encrypt` before releasing an `eql-bindings` that needs it.
 
 ```bash
-# From packages/eql. Generates a temporary Cargo patch; no local paths are committed.
-bash tasks/dev/with-stack-encrypt.sh /path/to/cipherstash-suite \
-  test -p eql-encryption-tests
-bash tasks/dev/with-stack-encrypt.sh /path/to/cipherstash-suite \
-  test -p eql-bindings --features stack-encrypt
+# From packages/eql:
+cargo test -p eql-encryption-tests
+cargo test -p eql-bindings --features stack-encrypt
 
 # Against a disposable PostgreSQL database, using fresh encryption and a fake KMS:
 psql "$EQL_TEST_DATABASE_URL" -v ON_ERROR_STOP=1 \
   -f crates/eql-bindings/sql/cipherstash-encrypt.sql
-bash tasks/dev/with-stack-encrypt.sh /path/to/cipherstash-suite \
-  test -p eql-encryption-tests --test text_eq -- --ignored
+cargo test -p eql-encryption-tests --test text_eq -- --ignored
 ```

packages/eql/crates/eql-bindings/src/encryption.rs

@@ -72,9 +72,9 @@ use stack_encrypt::sem::EqualityTerm;
 use stack_encrypt::target::transcode::{Reader, Transcode, Visitor};
 use stack_encrypt::target::{self, AeadContext, CallerContext};
 use stack_encrypt::{
-    Aad, AadPiece, CipherText, Decrypt, DecryptField, DecryptInto, Decryptable, Decryption,
-    Encrypt, EncryptFrom, Encryption, Error, IntoAad, IntoPrfContext, MaybeEmpty, NonEmpty,
-    PrfContext, SealedValue, StackCipherText,
+    CipherText, ContextPiece, Decrypt, DecryptField, DecryptInto, Decryptable, Decryption, Encrypt,
+    EncryptFrom, Encryption, Error, IntoContext, MaybeEmpty, NonEmpty, SealedValue,
+    StackCipherText,
 };
 use vitaminc_prf::PrfValue;
 
@@ -110,17 +110,13 @@ impl MaybeEmpty for Identifier {
         self.t.is_empty() || self.c.is_empty()
     }
 }
-impl<'a> IntoAad<'a> for Identifier {
-    fn into_aad(self) -> Aad<'a> {
-        (self.t, self.c).into_aad()
-    }
-    fn into_aad_piece(self) -> AadPiece<'a> {
-        (self.t, self.c).into_aad_piece()
-    }
-}
-impl<'a> IntoPrfContext<'a> for Identifier {
-    fn into_prf_context(self) -> PrfContext<'a> {
-        (self.t, self.c).into_prf_context()
+// One context view serves both derivations: vitaminc's `IntoAad` and
+// `IntoPrfContext` are blankets over `IntoContext`, so the ciphertext AAD, the
+// ZeroKMS descriptor and the equality term's PRF context all see the same
+// (table, column) pair.
+impl<'a> IntoContext<'a> for Identifier {
+    fn into_context(self) -> ContextPiece<'a> {
+        (self.t, self.c).into_context()
     }
 }
 
@@ -154,11 +150,11 @@ impl Reader for Ciphertext {
 
 impl<S: Encrypt + Clone> EncryptFrom<S> for Ciphertext {
     type Context = AeadContext;
-    fn encryption<'s, K: 'static>(context: Self::Context) -> Encryption<'s, S, Self, K>
+    fn encryption<'s, K: 'static>() -> Encryption<'s, S, Self, K, Self::Context>
     where
         S: 's,
     {
-        target::ciphertext(context).transcode()
+        target::ciphertext().transcode()
     }
 }
 
@@ -208,11 +204,11 @@ impl Transcode for Hmac256 {
 }
 impl<S: PrfValue + Clone> EncryptFrom<S> for Hmac256 {
     type Context = CallerContext;
-    fn encryption<'s, K: 'static>(context: Self::Context) -> Encryption<'s, S, Self, K>
+    fn encryption<'s, K: 'static>() -> Encryption<'s, S, Self, K, Self::Context>
     where
         S: 's,
     {
-        target::equality(context).transcode()
+        target::equality().transcode()
     }
 }
 impl Decryptable for Hmac256 {