@@ -35,3 +35,17 @@ default-members = ["tests/sqlx"]
 [workspace.lints.rust]
 dead_code = "deny"
 unused_imports = "deny"
+
+# Temporary, as in the repository root's Cargo.toml: eql-bindings'
+# `stack-encrypt` feature and tests/encryption compile stack-encrypt by path,
+# so the vitaminc crates it builds on come from the branch that implements
+# vitaminc ADR 0001 (cipherstash/vitaminc PRs #439 to #445) until vitaminc
+# releases it.
+[patch.crates-io]
+vitaminc = { git = "https://github.com/cipherstash/vitaminc", branch = "feat/aead-remove-legacy-traits" }
+vitaminc-aead = { git = "https://github.com/cipherstash/vitaminc", branch = "feat/aead-remove-legacy-traits" }
+vitaminc-aead-frame = { git = "https://github.com/cipherstash/vitaminc", branch = "feat/aead-remove-legacy-traits" }
+vitaminc-encrypt = { git = "https://github.com/cipherstash/vitaminc", branch = "feat/aead-remove-legacy-traits" }
+vitaminc-hmac = { git = "https://github.com/cipherstash/vitaminc", branch = "feat/aead-remove-legacy-traits" }
+vitaminc-prf = { git = "https://github.com/cipherstash/vitaminc", branch = "feat/aead-remove-legacy-traits" }
+vitaminc-protected = { git = "https://github.com/cipherstash/vitaminc", branch = "feat/aead-remove-legacy-traits" }
@@ -35,6 +35,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **The `stack-encrypt` feature builds on vitaminc ADR 0001.**
+  `encryption::targets` takes `FfiValue` and `ValueKind` from
+  `stack_encrypt::dynamic` (the feature turns on stack-encrypt's `dynamic`
+  feature) in place of `vitaminc-aead-value`, which is gone, and the
+  `Ciphertext` target takes any `Plaintext` plaintext and opens into any
+  `Decrypt + Send` type, as stack-encrypt's own targets do.
+
 - **Query-operand domain names switched to the `query_<name>` prefix, homed
   in the `eql_v3` schema.** The SQL domain names carried by the
   query twins — in `DomainType::sql_domain`, the names `QueryPayload::parse`
 
@@ -43,18 +43,15 @@ schemars = "1"
 # from the PACKAGED crate against the registry stack-encrypt instead:
 # `cargo publish --dry-run --all-features` in test-eql.yml at PR time, and
 # `publish_all_features` in ../../release-plz.toml at release time.
-stack-encrypt = { path = "../../../stack-encrypt", version = "0.2.0", optional = true, default-features = false }
+# `dynamic`: `FfiValue` / `ValueKind`, the runtime plaintext a plan field
+# target takes and the kind names a plan's `"type"` key spells
+# (`encryption::targets`).
+stack-encrypt = { path = "../../../stack-encrypt", version = "0.2.0", optional = true, default-features = false, features = ["dynamic"] }
 # The vitaminc line stack-encrypt is built on. `PrfValue` is named from this
 # crate directly (stack-encrypt re-exports only `IntoPrfContext` and
 # `PrfContext`), and two vitaminc lines in one graph do not interoperate, so
 # the requirement is stack-encrypt's.
 vitaminc-prf = { version = "0.5.0", optional = true }
-# `FfiValue` / `ValueKind`: the runtime plaintext a plan field target takes
-# and the kind names a plan's `"type"` key spells (`encryption::targets`).
-# Named from vitaminc directly, like `PrfValue` above, so the feature needs
-# nothing from stack-encrypt's own `dynamic` feature; the same line
-# stack-encrypt and the Go guest build against.
-vitaminc-aead-value = { version = "0.5.1", optional = true }
 # The plaintext a target reads out of its `Protected` runtime value is held
 # in `Zeroizing` until it is sealed, so the copy is wiped like the original.
 zeroize = { version = "1", optional = true }
@@ -67,7 +64,6 @@ default = []
 stack-encrypt = [
   "dep:stack-encrypt",
   "dep:vitaminc-prf",
-  "dep:vitaminc-aead-value",
   "dep:zeroize",
   "dep:thiserror",
   "dep:base64",
 
@@ -192,7 +192,7 @@ unknown one with "no such EQL type".
 ```rust,ignore
 use eql_bindings::encryption::targets;
 use stack_encrypt::Label;
-use vitaminc_aead_value::FfiValue;
+use stack_encrypt::dynamic::FfiValue;
 
 let column = Label::new(["users", "email"])?; // the field's context: table/column
 let stored: Vec<u8> = targets::encrypt("TextEq", &keyset, &column, FfiValue::String("alice@example.com".into()))?.await?;
 
@@ -62,7 +62,7 @@
 //! An encrypted EQL record is not a plaintext value:
 //! ```compile_fail
 //! use eql_bindings::v3::text::TextEq;
-//! fn require<T: stack_encrypt::Encrypt>() {}
+//! fn require<T: stack_encrypt::Plaintext>() {}
 //! require::<TextEq>();
 //! ```
 //! The text domain accepts text, and requires a concrete column identifier:
@@ -85,8 +85,8 @@ use stack_encrypt::target::transcode::{Reader, Transcode, Visitor};
 use stack_encrypt::target::{self, AeadContext, CallerContext};
 use stack_encrypt::{
     CipherText, ContextPiece, Decrypt, DecryptField, DecryptInto, Decryptable, Decryption,
-    Describe, Description, Encrypt, EncryptFrom, Encryption, Error, IntoContext, MaybeEmpty,
-    NonEmpty, SealedValue, StackCipherText,
+    Describe, Description, EncryptFrom, Encryption, Error, IntoContext, MaybeEmpty, NonEmpty,
+    Plaintext, SealedValue, StackCipherText,
 };
 use vitaminc_prf::PrfValue;
 
@@ -174,7 +174,7 @@ impl Reader for Ciphertext {
     }
 }
 
-impl<S: Encrypt + Clone> EncryptFrom<S> for Ciphertext {
+impl<S: Plaintext + Clone> EncryptFrom<S> for Ciphertext {
     type Context = AeadContext;
     fn encryption<'s, K: 'static>() -> Encryption<'s, S, Self, K, Self::Context>
     where
@@ -195,7 +195,7 @@ impl Visitor for NativeCiphertextVisitor {
         Ok(CipherText::Single(leaf))
     }
 }
-impl<P: Decrypt<'static> + 'static> DecryptInto<P> for Ciphertext {
+impl<P: Decrypt + Send + 'static> DecryptInto<P> for Ciphertext {
     type Context = AeadContext;
     fn decryption<K: 'static>(self, context: Self::Context) -> Decryption<P, K> {
         match self.read(NativeCiphertextVisitor) {
 
@@ -79,12 +79,12 @@
 use std::fmt;
 
 use serde::{de::DeserializeOwned, Serialize};
+use stack_encrypt::dynamic::{FfiValue, ValueKind};
 use stack_encrypt::kms::MaybeSend;
 use stack_encrypt::target::ExpectedContext;
 use stack_encrypt::{
     DecryptInto, EncryptFrom, Error, KeysetCipher, Label, NonEmpty, Pending, StackCipher,
 };
-use vitaminc_aead_value::{FfiValue, ValueKind};
 
 use crate::v3::targets::{decrypt_named, encrypt_named, query_named, TARGETS};
 use crate::Identifier;
 
@@ -4,8 +4,8 @@ use crate::encryption::targets::{
     open_target, refuse, refuse_query, run_target, Opener, Target, TargetError,
 };
 use crate::Identifier;
+use stack_encrypt::dynamic::FfiValue;
 use stack_encrypt::{KeysetCipher, NonEmpty, Pending};
-use vitaminc_aead_value::FfiValue;
 /// Every EQL type a plan may name as a target, in
 /// `eql-domains::CATALOG` order: one per stored domain (every flat
 /// scalar domain plus the SteVec document). Query twins are not
 
@@ -270,7 +270,7 @@ fn render_targets_from(rows: &[Row]) -> String {
     let file = quote! {
         #![doc = #mod_doc]
 
-        use vitaminc_aead_value::FfiValue;
+        use stack_encrypt::dynamic::FfiValue;
 
         use crate::encryption::targets::{#helpers refuse, refuse_query, Opener, Target, TargetError};
         use crate::Identifier;