fix(eql-codegen): a producible type without a query twin gets no query arm

Review of #1095: render_targets_rs expected every producible type to have a
query twin, so the day the storage-only `Text` joins ENCRYPTION_DOMAINS the
generator would have panicked instead of writing the table. The query arms
now skip a type without a twin, and the query dispatch's fall-through
refuses it as answering no query: eql-bindings gains TargetError::NoQuery
and refuse_query (used by the generated fall-through and by the public
`query`), stack-encrypt's TargetError gains the matching variant, and the
guest maps it (STATUS_ENCODING, pinned in the status table test).
Rendering is factored over a row slice so a test can flip `Text` to
producible and assert two arms and no query arm.

Claude-Session: https://claude.ai/code/session_01V3WFXwax4J3uecpFEJ6yHc

Author: coderdan

languages/golang/encrypt/guest/Cargo.lock

@@ -359,6 +359,9 @@ mod tests {
                 name: "email".into(),
                 label: "users/email".into(),
             },
+            TargetError::NoQuery {
+                name: "Text".into(),
+            },
             TargetError::Kind {
                 name: "email".into(),
                 target: "TextEq".into(),

languages/golang/encrypt/guest/src/status.rs

@@ -116,6 +116,9 @@ fn convert(error: eql_bindings::encryption::targets::TargetError) -> TargetError
             name: name.to_owned(),
             reason: reason.to_owned(),
         },
+        Eql::NoQuery { name } => TargetError::NoQuery {
+            name: name.to_owned(),
+        },
         Eql::Context { label } => TargetError::Column {
             name: String::new(),
             label,

languages/golang/encrypt/guest/src/targets.rs

@@ -170,6 +170,13 @@ pub enum TargetError {
         /// The table's reason.
         reason: &'static str,
     },
+    /// The type is produced, and answers no query: a storage-only type has
+    /// no query twin, so there is no operand to derive.
+    #[error("{name} answers no query: it is a storage-only type")]
+    NoQuery {
+        /// The type's name.
+        name: &'static str,
+    },
     /// The field's context is not an EQL column: an [`Identifier`] is a
     /// two-segment label, table then column, and this label is not one.
     #[error("{label:?} is not an EQL column identifier: expected two segments, table and column")]
@@ -324,6 +331,9 @@ pub fn query<'a, K: 'static>(
     plaintext: FfiValue,
 ) -> Result<Pending<'a, Vec<u8>, K>, TargetError> {
     producible(name)?;
+    if let Some(error) = no_query(target(name)) {
+        return Err(error);
+    }
     let column = Identifier::from_label(context)?;
     query_named(name, keyset, column, plaintext)
 }
@@ -338,6 +348,24 @@ fn producible(name: &str) -> Result<(), TargetError> {
 
 /// The error for a name without a dispatch arm: unproducible when the table
 /// has it, unknown otherwise. Called by the generated dispatch's fall-through.
+/// The error for a query on a name the query dispatch has no arm for: a
+/// producible type with no query twin answers no query; otherwise what
+/// [`refuse`] says. Called by the generated query dispatch's fall-through.
+pub(crate) fn refuse_query(name: &str) -> TargetError {
+    no_query(target(name)).unwrap_or_else(|| refuse(name))
+}
+
+/// `NoQuery` for a producible type without a query twin, else `None`: the
+/// one case the query dispatch refuses that the others do not.
+fn no_query(target: Option<&'static Target>) -> Option<TargetError> {
+    match target {
+        Some(target) if target.producible && target.query.is_none() => {
+            Some(TargetError::NoQuery { name: target.name })
+        }
+        _ => None,
+    }
+}
+
 pub(crate) fn refuse(name: &str) -> TargetError {
     match target(name) {
         Some(target) => TargetError::Unproducible {
@@ -511,6 +539,47 @@ mod tests {
         }
     }
 
+    #[test]
+    fn a_producible_type_without_a_query_twin_answers_no_query() {
+        // No such type in the catalog today (`Text` is not producible), so
+        // the rule is pinned on a synthetic row; `refuse_query` on the live
+        // table falls through to `refuse`.
+        let storage_only = Target {
+            name: "Text",
+            family: "text",
+            suffix: "",
+            plaintext: Some("string"),
+            sql_domain: "public.eql_v3_text",
+            indexes: &[],
+            query: None,
+            query_sql_domain: None,
+            producible: true,
+            reason: None,
+        };
+        let leaked: &'static Target = Box::leak(Box::new(storage_only));
+        assert!(matches!(
+            no_query(Some(leaked)),
+            Some(TargetError::NoQuery { name: "Text" })
+        ));
+        assert_eq!(
+            no_query(Some(leaked)).unwrap().to_string(),
+            "Text answers no query: it is a storage-only type"
+        );
+        assert!(
+            no_query(target("TextEq")).is_none(),
+            "TextEq answers a query"
+        );
+        assert!(
+            no_query(target("Text")).is_none(),
+            "an unproducible type is refused as that"
+        );
+        assert!(matches!(
+            refuse_query("Text"),
+            TargetError::Unproducible { .. }
+        ));
+        assert!(matches!(refuse_query("Nope"), TargetError::Unknown { .. }));
+    }
+
     #[test]
     fn refusals_name_the_type_and_its_reason() {
         assert!(matches!(refuse("Nope"), TargetError::Unknown { name } if name == "Nope"));

packages/eql/crates/eql-bindings/src/encryption/targets.rs

@@ -1,6 +1,8 @@
 // @generated by eql-codegen from the eql-domains catalog — do not edit
 //! The EQL types a Stack Encrypt data plan may name as a field target — every stored v3 domain type in eql-domains::CATALOG order, as data a guest serializes (`TARGETS`), with the by-name dispatch that runs a producible type's own Rust plan. Generated from the catalog; the descriptor type, the errors and the public entry points stay hand-written in `crate::encryption::targets`, which documents the wire format.
-use crate::encryption::targets::{open_target, refuse, run_target, Opener, Target, TargetError};
+use crate::encryption::targets::{
+    open_target, refuse, refuse_query, run_target, Opener, Target, TargetError,
+};
 use crate::Identifier;
 use stack_encrypt::{KeysetCipher, NonEmpty, Pending};
 use vitaminc_aead_value::FfiValue;
@@ -750,7 +752,8 @@ pub(crate) fn decrypt_named<'a, K: 'static>(
     }
 }
 /// Run the named type's query twin for one plaintext, or refuse the
-/// name as `encrypt_named` does.
+/// name: as `encrypt_named` does, or as answering no query
+/// (`TargetError::NoQuery`) for a producible type with no twin.
 pub(crate) fn query_named<'a, K: 'static>(
     name: &str,
     keyset: &'a KeysetCipher<'_, K>,
@@ -761,6 +764,6 @@ pub(crate) fn query_named<'a, K: 'static>(
         "TextEq" => {
             run_target::<super::text::TextEqQuery, String, K>("TextEq", keyset, column, plaintext)
         }
-        _ => Err(refuse(name)),
+        _ => Err(refuse_query(name)),
     }
 }

packages/eql/crates/eql-bindings/src/v3/targets.rs

@@ -54,7 +54,12 @@ const JSON_INDEX_KEY: &str = "json";
 /// encoding for the stack-encrypt producer profile is unspecified, which is
 /// every family but text today.
 pub fn plaintext(family: &DomainFamily) -> Option<(&'static str, &'static str)> {
-    (family.name == "text").then_some(("string", "String"))
+    plaintext_of(family.name)
+}
+
+/// [`plaintext`], by family name: what a rendered row carries.
+fn plaintext_of(family: &str) -> Option<(&'static str, &'static str)> {
+    (family == "text").then_some(("string", "String"))
 }
 
 /// Why the engine cannot produce a stored domain's EQL type today, or
@@ -175,8 +180,13 @@ fn option_str(value: Option<&str>) -> TokenStream {
 
 /// Render the generated `crates/eql-bindings/src/v3/targets.rs`.
 pub fn render_targets_rs() -> String {
-    let rows = rows();
+    render_targets_from(&rows())
+}
 
+/// Render the target table and dispatch from the given rows: the catalog's
+/// in [`render_targets_rs`], a synthetic set in tests (a producible type
+/// with no query twin is not in the catalog today).
+fn render_targets_from(rows: &[Row]) -> String {
     let entries: TokenStream = rows
         .iter()
         .map(|r| {
@@ -209,43 +219,38 @@ pub fn render_targets_rs() -> String {
 
     // One arm per producible type. The plaintext Rust type is the family's;
     // a producible family always has one, since a derive names it.
-    let producible: Vec<(&Row, &'static DomainFamily)> = stored_payload_domains()
-        .zip(rows.iter())
-        .filter(|(_, r)| r.reason.is_none())
-        .map(|((f, _), r)| (r, f))
-        .collect();
-    let arm = |r: &Row, f: &DomainFamily, strukt: &str| {
+    let producible: Vec<&Row> = rows.iter().filter(|r| r.reason.is_none()).collect();
+    let arm = |r: &Row, strukt: &str| {
         let name = &r.name;
-        let module = format_ident!("{}", f.name);
+        let module = format_ident!("{}", r.family);
         let ty = format_ident!("{strukt}");
-        let (_, rust) = plaintext(f).expect("a producible family has a specified plaintext");
+        let (_, rust) =
+            plaintext_of(r.family).expect("a producible family has a specified plaintext");
         let source = format_ident!("{rust}");
         (name.clone(), quote!(super::#module::#ty), quote!(#source))
     };
     let encrypt_arms: TokenStream = producible
         .iter()
-        .map(|(r, f)| {
-            let (name, ty, source) = arm(r, f, &r.name);
+        .map(|r| {
+            let (name, ty, source) = arm(r, &r.name);
             quote! { #name => run_target::<#ty, #source, K>(#name, keyset, column, plaintext), }
         })
         .collect();
     let decrypt_arms: TokenStream = producible
         .iter()
-        .map(|(r, f)| {
-            let (name, ty, source) = arm(r, f, &r.name);
+        .map(|r| {
+            let (name, ty, source) = arm(r, &r.name);
             quote! { #name => open_target::<#ty, #source, K>(#name, opener, column, stored), }
         })
         .collect();
+    // A producible type with no query twin (a storage-only domain) gets no
+    // query arm: the fall-through refuses it as answering no query.
     let query_arms: TokenStream = producible
         .iter()
-        .map(|(r, f)| {
-            let query = r
-                .query
-                .as_ref()
-                .map(|(n, _)| n.as_str())
-                .expect("a producible type has a query twin");
-            let (name, ty, source) = arm(r, f, query);
-            quote! { #name => run_target::<#ty, #source, K>(#name, keyset, column, plaintext), }
+        .filter_map(|r| {
+            let (query, _) = r.query.as_ref()?;
+            let (name, ty, source) = arm(r, query);
+            Some(quote! { #name => run_target::<#ty, #source, K>(#name, keyset, column, plaintext), })
         })
         .collect();
     let helpers = if producible.is_empty() {
@@ -267,7 +272,7 @@ pub fn render_targets_rs() -> String {
 
         use vitaminc_aead_value::FfiValue;
 
-        use crate::encryption::targets::{#helpers refuse, Opener, Target, TargetError};
+        use crate::encryption::targets::{#helpers refuse, refuse_query, Opener, Target, TargetError};
         use crate::Identifier;
         use stack_encrypt::{KeysetCipher, NonEmpty, Pending};
 
@@ -309,7 +314,8 @@ pub fn render_targets_rs() -> String {
         }
 
         /// Run the named type's query twin for one plaintext, or refuse the
-        /// name as `encrypt_named` does.
+        /// name: as `encrypt_named` does, or as answering no query
+        /// (`TargetError::NoQuery`) for a producible type with no twin.
         pub(crate) fn query_named<'a, K: 'static>(
             name: &str,
             keyset: &'a KeysetCipher<'_, K>,
@@ -318,7 +324,7 @@ pub fn render_targets_rs() -> String {
         ) -> Result<Pending<'a, Vec<u8>, K>, TargetError> {
             match name {
                 #query_arms
-                _ => Err(refuse(name)),
+                _ => Err(refuse_query(name)),
             }
         }
     };
@@ -497,6 +503,49 @@ mod tests {
         // producible ones and the three fall-throughs.
         let arms = out.matches("\" => ").count();
         assert_eq!(arms, ENCRYPTION_DOMAINS.len() * 3, "arms: {out}");
-        assert_eq!(out.matches("_ => Err(refuse(name))").count(), 3);
+        assert_eq!(out.matches("_ => Err(refuse(name))").count(), 2);
+        assert_eq!(out.matches("_ => Err(refuse_query(name))").count(), 1);
+    }
+
+    /// A producible type with no query twin — a storage-only domain, once
+    /// its derive lands — renders encrypt and decrypt arms and no query arm,
+    /// rather than aborting the generator: the query dispatch's fall-through
+    /// refuses it as answering no query. Not in the catalog today, so the
+    /// row is flipped by hand.
+    #[test]
+    fn a_producible_type_without_a_query_twin_gets_no_query_arm() {
+        let mut rows = rows();
+        let text = rows
+            .iter_mut()
+            .find(|r| r.name == "Text")
+            .expect("the storage-only text domain");
+        assert!(text.query.is_none() && text.reason.is_some());
+        text.reason = None;
+        let out: String = render_targets_from(&rows)
+            .split_whitespace()
+            .collect::<Vec<_>>()
+            .join(" ");
+        let arms_for = |helper: &str| {
+            out.matches(&format!(
+                "\"Text\" => {{ {helper}::<super::text::Text, String, K>(\"Text\","
+            ))
+            .count()
+                + out
+                    .matches(&format!(
+                        "\"Text\" => {helper}::<super::text::Text, String, K>(\"Text\","
+                    ))
+                    .count()
+        };
+        assert_eq!(arms_for("run_target"), 1, "one encrypt arm: {out}");
+        assert_eq!(arms_for("open_target"), 1, "one decrypt arm: {out}");
+        assert!(
+            !out.contains("TextQuery"),
+            "no query arm for a type with no twin: {out}"
+        );
+        assert_eq!(
+            out.matches("\" => ").count(),
+            (ENCRYPTION_DOMAINS.len() + 1) * 3 - 1,
+            "every producible type has three arms but the twinless one, which has two"
+        );
     }
 }

packages/eql/crates/eql-codegen/src/targets.rs

@@ -167,6 +167,14 @@ pub enum TargetError {
         /// The descriptor's reason.
         reason: String,
     },
+    /// The type is produced and answers no query: a storage-only EQL type
+    /// has no query twin, so a query on a field that names it derives
+    /// nothing.
+    #[error("{name} answers no query: it is a storage-only type")]
+    NoQuery {
+        /// The type's name.
+        name: String,
+    },
     /// The plan extends every field's label by the caller's parts (a tenant,
     /// a region), and an EQL value stores a table and a column only: there
     /// is no column for the extended label. A plan with a target field is