fix(mapper): make the late native fallback for unresolved value nodes fail closed (CIP-3715)

Unifier::resolve_unresolved_value_nodes resolved *any* ast::Value node
still untyped after inference to Native — fail-open one layer below the
CIP-3699/CIP-3700 inference gaps: a literal or param in a clause that
inference never constrained was silently typed Native and could skip
encryption. (Its Result was also discarded at the call site.)

Audit of every shape reaching the fallback (instrumented run of the
mapper suite), and where each is now typed:

- WHERE / HAVING / join ON conditions (`WHERE true`, `ON true`,
  `WHERE $1`): boolean contexts are always native — pinned to Native in
  InferType<Select>. A bare encrypted column as a condition
  (`WHERE enc_col`) is now rejected.
- ORDER BY / GROUP BY literal keys (`ORDER BY 1`, `GROUP BY 1`): the
  literal reaches the database as a plain constant regardless of which
  projected column the ordinal selects — pinned to Native where the
  clause is inferred (also covers ordinals after set operations, which
  resolve against no single projection).
- Values whose type escapes only through a projection (`SELECT 'lit'`,
  `SELECT $1`, CASE results and ARRAY elements in a projection,
  `SELECT 1` inside EXISTS, unreferenced derived-table columns): these
  relate to nothing and cannot be EQL — still defaulted to Native at
  resolve time, but now scoped to type variables reachable from a
  Query/Statement node's type instead of applying to any value node.

Anything else unresolved at resolve time is now
TypeError::UnresolvedValue naming the value, and the error propagates
instead of being swallowed. Known shapes that now fail closed instead
of silently passing: window frame bounds (`ROWS BETWEEN 1 PRECEDING …`)
and aggregate FILTER clauses — both inference gaps owned by CIP-3699.

Author: freshtonic

CHANGELOG.md

@@ -64,6 +64,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 - **`SELECT … INTO` an encrypted column is now rejected**: the statement copies data into a table the encryption schema has never seen, leaving unreachable ciphertext there. Native-only projections pass through as before.
 
+- **Literals and params that escape type checking now fail closed**: a literal or parameter whose type was never worked out during type checking used to be silently assumed to be plaintext — so a value in a clause the type checker did not cover could skip encryption without any error. Proxy now only makes that assumption where it is provably safe (a value that only flows to the client through a `SELECT` projection, such as `SELECT 'lit'` or `SELECT $1`); anywhere else the statement is rejected with an error naming the value. As part of this, `WHERE`/`HAVING`/join `ON` conditions and `ORDER BY`/`GROUP BY` ordinals are now explicitly typed as plaintext where they appear, and an encrypted column used bare as a boolean condition (for example `WHERE enc_col`) is rejected instead of being forwarded to the database.
+
 ## [2.2.4] - 2026-06-18
 
 ### Fixed

packages/eql-mapper/src/eql_mapper.rs

@@ -153,7 +153,10 @@ impl<'ast> EqlMapper<'ast> {
             .borrow_mut()
             .resolve_unresolved_associated_types();
 
-        let _ = self.unifier.borrow_mut().resolve_unresolved_value_nodes();
+        // A failure here is a genuine type-checking failure: it means a value node escaped
+        // inference entirely, and assuming it is native would be fail-open (the value could
+        // relate to an encrypted column and silently skip encryption).
+        self.unifier.borrow_mut().resolve_unresolved_value_nodes()?;
 
         let projection = self.projection_type(statement);
         let params = self.param_types(&self.unifier.borrow());

packages/eql-mapper/src/inference/infer_type_impls/query_statement.rs

@@ -71,6 +71,16 @@ impl<'ast> InferType<'ast, Query> for TypeInferencer<'ast> {
                     for order_by_expr in exprs {
                         let key = resolve_positional_key(select, &order_by_expr.expr);
                         self.unify_node_with_bound(key, EqlTrait::Ord)?;
+
+                        // A key written as a literal (`ORDER BY 1`) reaches the
+                        // database as a plain constant — PostgreSQL only accepts
+                        // integer ordinals here — so the literal itself is always
+                        // native, independently of the projected column it selects.
+                        // This also covers ordinals that cannot be resolved against a
+                        // projection, e.g. `ORDER BY 1` after a set operation.
+                        if matches!(&order_by_expr.expr, Expr::Value(_)) {
+                            self.unify_node_with_type(&order_by_expr.expr, Type::native())?;
+                        }
                     }
                 }
 

packages/eql-mapper/src/inference/infer_type_impls/select.rs

@@ -1,5 +1,7 @@
 use eql_mapper_macros::trace_infer;
-use sqltk::parser::ast::{Distinct, Expr, GroupByExpr, Select, SelectItem};
+use sqltk::parser::ast::{
+    Distinct, Expr, GroupByExpr, JoinConstraint, JoinOperator, Select, SelectItem,
+};
 
 use super::query_statement::resolve_positional_key;
 use crate::unifier::{Projection, Type, Value};
@@ -31,6 +33,58 @@ impl<'ast> InferType<'ast, Select> for TypeInferencer<'ast> {
             }
         }
 
+        // `WHERE`, `HAVING` and join `ON` conditions are boolean expressions,
+        // and booleans are always native — every EQL comparison produces a
+        // native result. Pin the condition to `Native` so that a bare literal
+        // or placeholder condition (`WHERE true`, `ON true`, `WHERE $1`) is
+        // typed where the clause is inferred instead of relying on the late
+        // unresolved-value fallback, and so that an encrypted value can never
+        // itself be the condition.
+        if let Some(selection) = &select.selection {
+            self.unify_node_with_type(selection, Type::native())?;
+        }
+
+        if let Some(having) = &select.having {
+            self.unify_node_with_type(having, Type::native())?;
+        }
+
+        for table_with_joins in &select.from {
+            for join in &table_with_joins.joins {
+                let constraint = match &join.join_operator {
+                    JoinOperator::Join(constraint)
+                    | JoinOperator::Inner(constraint)
+                    | JoinOperator::Left(constraint)
+                    | JoinOperator::LeftOuter(constraint)
+                    | JoinOperator::Right(constraint)
+                    | JoinOperator::RightOuter(constraint)
+                    | JoinOperator::FullOuter(constraint)
+                    | JoinOperator::Semi(constraint)
+                    | JoinOperator::LeftSemi(constraint)
+                    | JoinOperator::RightSemi(constraint)
+                    | JoinOperator::Anti(constraint)
+                    | JoinOperator::LeftAnti(constraint)
+                    | JoinOperator::RightAnti(constraint)
+                    | JoinOperator::StraightJoin(constraint) => Some(constraint),
+
+                    JoinOperator::AsOf {
+                        match_condition,
+                        constraint,
+                    } => {
+                        self.unify_node_with_type(match_condition, Type::native())?;
+                        Some(constraint)
+                    }
+
+                    JoinOperator::CrossJoin
+                    | JoinOperator::CrossApply
+                    | JoinOperator::OuterApply => None,
+                };
+
+                if let Some(JoinConstraint::On(condition)) = constraint {
+                    self.unify_node_with_type(condition, Type::native())?;
+                }
+            }
+        }
+
         // Deduplication is equality, so every expression `DISTINCT` dedupes on
         // must support it. For an encrypted column that means its domain has to
         // carry an equality term — `eql_v3_boolean`, for instance, is
@@ -75,6 +129,14 @@ impl<'ast> InferType<'ast, Select> for TypeInferencer<'ast> {
             for expr in exprs {
                 let key = resolve_positional_key(Some(select), expr);
                 self.unify_node_with_bound(key, EqlTrait::Eq)?;
+
+                // A key written as a literal (`GROUP BY 1`) reaches the
+                // database as a plain constant — PostgreSQL only accepts
+                // integer ordinals here — so the literal itself is always
+                // native, independently of the projected column it selects.
+                if matches!(expr, Expr::Value(_)) {
+                    self.unify_node_with_type(expr, Type::native())?;
+                }
             }
         }
 

packages/eql-mapper/src/inference/type_error.rs

@@ -21,6 +21,13 @@ pub enum TypeError {
     #[error("unified type contains unresolved type variable: {}", _0)]
     Incomplete(String),
 
+    #[error(
+        "the type of value `{}` was never constrained during type inference; \
+         refusing to assume it is native",
+        _0
+    )]
+    UnresolvedValue(String),
+
     #[error("{}", _0)]
     Expected(String),
 

packages/eql-mapper/src/inference/unifier/mod.rs

@@ -1,4 +1,9 @@
-use std::{cell::RefCell, collections::HashMap, rc::Rc, sync::Arc};
+use std::{
+    cell::RefCell,
+    collections::{HashMap, HashSet},
+    rc::Rc,
+    sync::Arc,
+};
 
 mod eql_traits;
 mod instantiated_type_env;
@@ -71,13 +76,20 @@ impl<'ast> Unifier<'ast> {
         self.registry.borrow_mut().get_param_type(param)
     }
 
-    /// [`sqltk::parser::ast::Value`] nodes with type `Type::Var(_)` after the inference phase is complete will be unified
-    /// with [`NativeValue`].
+    /// Resolves [`sqltk::parser::ast::Value`] nodes (literals and params) whose type is still an
+    /// unresolved `Type::Var(_)` after the inference phase is complete.
     ///
-    /// This can happen when a literal or param is never used in an expression that would constrain its type.
+    /// A value's type can legitimately remain unconstrained in exactly one situation: it escapes
+    /// the statement only through a projection. Either it is selected straight to the client
+    /// (`SELECT 'lit'`, `SELECT $1`) or it belongs to a projection that nothing consumes (an
+    /// unreferenced derived-table column, the projection of an `EXISTS (...)` subquery). Such a
+    /// value cannot be an EQL type — every EQL-typed position is constrained during inference —
+    /// so it is resolved to [`NativeValue`].
     ///
-    /// In that case, it is safe to resolve its type as native because it cannot possibly be an EQL type, which are
-    /// always correctly inferred.
+    /// Any other unresolved value node means an inference rule failed to constrain the position
+    /// that owns it. Falling back to native there would be fail-open: a value in an unvisited
+    /// clause could relate to an encrypted column and silently skip encryption. Those nodes fail
+    /// closed with [`TypeError::UnresolvedValue`].
     pub(crate) fn resolve_unresolved_value_nodes(&mut self) -> Result<(), TypeError> {
         let unresolved_value_nodes: Vec<_> = self
             .registry
@@ -88,13 +100,83 @@ impl<'ast> Unifier<'ast> {
             .filter(|(_, ty)| matches!(&**ty, Type::Var(_)))
             .collect();
 
-        for (_, ty) in unresolved_value_nodes {
-            self.unify(ty, Type::native().into())?;
+        if unresolved_value_nodes.is_empty() {
+            return Ok(());
+        }
+
+        let projection_reachable = self.projection_reachable_tvars();
+
+        for (node, ty) in unresolved_value_nodes {
+            match &*ty {
+                Type::Var(Var(tvar, _)) if projection_reachable.contains(tvar) => {
+                    self.unify(ty.clone(), Type::native().into())?;
+                }
+                _ => return Err(TypeError::UnresolvedValue(node.to_string())),
+            }
         }
 
         Ok(())
     }
 
+    /// The set of type variables reachable from the type of any [`sqltk::parser::ast::Query`] or
+    /// [`sqltk::parser::ast::Statement`] node — i.e. from some projection in the statement.
+    ///
+    /// These are the positions whose types escape to the client (or are discarded, as with the
+    /// projection of an `EXISTS` subquery or an unreferenced derived-table column) rather than
+    /// relating to any other expression, which is what makes defaulting them to native sound.
+    fn projection_reachable_tvars(&self) -> HashSet<TypeVar> {
+        let mut types: Vec<Arc<Type>> = Vec::new();
+
+        {
+            let registry = self.registry.borrow();
+            types.extend(
+                registry
+                    .get_nodes_and_types::<sqltk::parser::ast::Query>()
+                    .into_iter()
+                    .map(|(_, ty)| ty),
+            );
+            types.extend(
+                registry
+                    .get_nodes_and_types::<sqltk::parser::ast::Statement>()
+                    .into_iter()
+                    .map(|(_, ty)| ty),
+            );
+        }
+
+        let mut tvars = HashSet::new();
+        for ty in types {
+            Self::collect_tvars(&ty.follow_tvars(self), &mut tvars);
+        }
+
+        tvars
+    }
+
+    /// Collects every [`TypeVar`] occurring in `ty` (which must already have had its type
+    /// variables followed via [`Type::follow_tvars`]) into `tvars`.
+    fn collect_tvars(ty: &Type, tvars: &mut HashSet<TypeVar>) {
+        match ty {
+            Type::Var(Var(tvar, _)) => {
+                tvars.insert(*tvar);
+            }
+            Type::Value(Value::Projection(projection)) => {
+                for column in projection.columns() {
+                    Self::collect_tvars(&column.ty, tvars);
+                }
+            }
+            Type::Value(Value::Array(Array(element_ty))) => {
+                Self::collect_tvars(element_ty, tvars);
+            }
+            Type::Value(Value::SetOf(set_of)) => {
+                Self::collect_tvars(&set_of.inner_ty(), tvars);
+            }
+            Type::Value(Value::Eql(_) | Value::Native(_)) => {}
+            Type::Associated(associated) => {
+                Self::collect_tvars(&associated.impl_ty, tvars);
+                Self::collect_tvars(&associated.resolved_ty, tvars);
+            }
+        }
+    }
+
     pub(crate) fn resolve_unresolved_associated_types(&mut self) -> Result<(), TypeError> {
         let unresolved_associated_types: Vec<_> = self
             .registry
@@ -375,10 +457,31 @@ pub(crate) mod test_util {
 mod test {
     use eql_mapper_macros::shallow_init_types;
 
+    use crate::inference::TypeError;
     use crate::unifier::Unifier;
     use crate::unifier::{EqlTraits, InstantiateType};
     use crate::{DepMut, TypeRegistry};
 
+    /// A value node whose type variable is not reachable from any projection has escaped
+    /// inference: no rule constrained the position that owns it. Resolving it to native would
+    /// be fail-open (the value could relate to an encrypted column and silently skip
+    /// encryption), so it must be a type error instead.
+    #[test]
+    fn unresolved_value_node_not_reachable_from_a_projection_fails_closed() {
+        let value = sqltk::parser::ast::Value::Boolean(true);
+
+        let mut unifier = Unifier::new(DepMut::new(TypeRegistry::new()));
+
+        // Registers the node with a fresh, unconstrained type variable — simulating a value
+        // node that was traversed but never constrained by any inference rule.
+        let _ = unifier.get_node_type(&value);
+
+        assert_eq!(
+            unifier.resolve_unresolved_value_nodes(),
+            Err(TypeError::UnresolvedValue("true".to_string()))
+        );
+    }
+
     #[test]
     fn eq_native() {
         let mut unifier = Unifier::new(DepMut::new(TypeRegistry::new()));