Repository navigation
stash-supabase skill lacks raw-pg / no-ORM guidance (only covers the encryptedSupabase JS wrapper) #601
Description
Activity
Verified against current main:
stash-supabasenow routes hand-written SQL and RPC users to the canonicalstash-postgresskill. That guide covers EQL v3 over plainpgandpostgres-js, including query-domain operand casts, operator mapping, parameter binding, reads/decryption, signed-range decomposition, indexing handoff, and troubleshooting. The suggested thin term-to-operator helper was not built; it was an optional API suggestion rather than required documentation, and any new helper should be evaluated as a separate API proposal. Closing the documented guidance gap as completed.Audit correction: the Run 2 closing comment overstated the then-current
stash-postgrescoverage. The guide did not yet contain the signed-range decomposition for anabs()bucket.That missing recipe is now added in the pending
stashpatch changesetstash-postgres-signed-range: it expressesmin <= abs(column) < maxas positive and negative signed ranges, encrypts all four bounds, and documents the reversed inequalities on the negative branch. The rest of the closing disposition is unchanged.
Summary
The
stash-supabaseagent skill only documents theencryptedSupabase(Supabase JS SDK) wrapper. For a Supabase app whose data layer is plainpg/ raw SQL (no ORM, no supabase-js), there is no guidance on the actual EQL SQL surface, so an integrating agent has to reverse-engineer it frompg_operator/pg_cast/ the EQL SQL. This is the lowest-level (and most foot-gun-prone) integration path, and it's undocumented.What's missing
A raw-SQL reference for reading/querying
eql_v2_encryptedcolumns:$n::jsonb::eql_v2_encrypted~~/~~*→ free-text match (bloom filter)=→ equality (hmac)<<=>>=→ order/range (ORE)col::jsonb, then decrypt in app codeabs()over ORE: ORE can't expressabs(), so an absolute-value bucket must be decomposed into signed ranges, e.g.((c >= min AND c < max) OR (c <= -min AND c > -max))Suggestion
Add a raw-
pg/ no-ORM section to the Supabase skill (or a general encryption skill), and ideally ship a thinterm → SQL operatorhelper — analogous to the Drizzle / Supabase adapters — so the no-ORM path isn't hand-written EQL SQL. Two independent agents (implementer + assessor) both flagged this as the largest DX gap for this surface.Found via a CipherStash integration eval on
cipherstash/supabase-nextjs-starter(hono-pg surface, plainpg). Full report: https://github.com/cipherstash/supabase-nextjs-starter/blob/feat/multi-surface-starters/docs/evals/hono-pg/2026-07-09-self-assessment.md (see "Docs gaps").