cipherstash · coderdan · May 5, 2026 · May 4, 2026 · May 4, 2026 · May 4, 2026
diff --git a/src/blake3/compare.sql b/src/blake3/compare.sql
@@ -22,6 +22,7 @@
 CREATE FUNCTION eql_v2.compare_blake3(a eql_v2_encrypted, b eql_v2_encrypted)
   RETURNS integer
   IMMUTABLE STRICT PARALLEL SAFE
+  SET search_path = pg_catalog, extensions, public
 AS $$
   DECLARE
     a_term eql_v2.blake3;

diff --git a/src/blake3/functions.sql b/src/blake3/functions.sql
@@ -14,6 +14,7 @@
 CREATE FUNCTION eql_v2.blake3(val jsonb)
   RETURNS eql_v2.blake3
   IMMUTABLE STRICT PARALLEL SAFE
+  SET search_path = pg_catalog, extensions, public
 AS $$
 	BEGIN
     IF val IS NULL THEN
@@ -45,6 +46,7 @@ $$ LANGUAGE plpgsql;
 CREATE FUNCTION eql_v2.blake3(val eql_v2_encrypted)
   RETURNS eql_v2.blake3
   IMMUTABLE STRICT PARALLEL SAFE
+  SET search_path = pg_catalog, extensions, public
 AS $$
   BEGIN
     RETURN (SELECT eql_v2.blake3(val.data));
@@ -64,6 +66,7 @@ $$ LANGUAGE plpgsql;
 CREATE FUNCTION eql_v2.has_blake3(val jsonb)
   RETURNS boolean
   IMMUTABLE STRICT PARALLEL SAFE
+  SET search_path = pg_catalog, extensions, public
 AS $$
 	BEGIN
     RETURN val ->> 'b3' IS NOT NULL;
@@ -83,6 +86,7 @@ $$ LANGUAGE plpgsql;
 CREATE FUNCTION eql_v2.has_blake3(val eql_v2_encrypted)
   RETURNS boolean
   IMMUTABLE STRICT PARALLEL SAFE
+  SET search_path = pg_catalog, extensions, public
 AS $$
 	BEGIN
     RETURN eql_v2.has_blake3(val.data);

diff --git a/src/bloom_filter/functions.sql b/src/bloom_filter/functions.sql
@@ -15,6 +15,7 @@
 CREATE FUNCTION eql_v2.bloom_filter(val jsonb)
   RETURNS eql_v2.bloom_filter
   IMMUTABLE STRICT PARALLEL SAFE
+  SET search_path = pg_catalog, extensions, public
 AS $$
 	BEGIN
     IF val IS NULL THEN
@@ -42,6 +43,7 @@ $$ LANGUAGE plpgsql;
 CREATE FUNCTION eql_v2.bloom_filter(val eql_v2_encrypted)
   RETURNS eql_v2.bloom_filter
   IMMUTABLE STRICT PARALLEL SAFE
+  SET search_path = pg_catalog, extensions, public
 AS $$
   BEGIN
     RETURN (SELECT eql_v2.bloom_filter(val.data));
@@ -61,6 +63,7 @@ $$ LANGUAGE plpgsql;
 CREATE FUNCTION eql_v2.has_bloom_filter(val jsonb)
   RETURNS boolean
   IMMUTABLE STRICT PARALLEL SAFE
+  SET search_path = pg_catalog, extensions, public
 AS $$
 	BEGIN
     RETURN val ->> 'bf' IS NOT NULL;
@@ -80,6 +83,7 @@ $$ LANGUAGE plpgsql;
 CREATE FUNCTION eql_v2.has_bloom_filter(val eql_v2_encrypted)
   RETURNS boolean
   IMMUTABLE STRICT PARALLEL SAFE
+  SET search_path = pg_catalog, extensions, public
 AS $$
 	BEGIN
     RETURN eql_v2.has_bloom_filter(val.data);

diff --git a/src/common.sql b/src/common.sql
@@ -23,7 +23,9 @@
 --!
 --! @note Returns false immediately if lengths differ (length is not secret)
 --! @note Used for secure comparison of cryptographic values
-CREATE FUNCTION eql_v2.bytea_eq(a bytea, b bytea) RETURNS boolean AS $$
+CREATE FUNCTION eql_v2.bytea_eq(a bytea, b bytea) RETURNS boolean
+  SET search_path = pg_catalog, extensions, public
+AS $$
 DECLARE
     result boolean;
     differing bytea;
@@ -59,7 +61,9 @@ $$ LANGUAGE plpgsql;
 --! @note Returns NULL if input is JSON null
 --! @note Each array element is hex-decoded to bytea
 CREATE FUNCTION eql_v2.jsonb_array_to_bytea_array(val jsonb)
-RETURNS bytea[] AS $$
+RETURNS bytea[]
+  SET search_path = pg_catalog, extensions, public
+AS $$
 DECLARE
   terms_arr bytea[];
 BEGIN
@@ -87,6 +91,7 @@ $$ LANGUAGE plpgsql;
 --! @see eql_v2.log(text, text) for contextual logging
 CREATE FUNCTION eql_v2.log(s text)
     RETURNS void
+  SET search_path = pg_catalog, extensions, public
 AS $$
   BEGIN
     RAISE NOTICE '[LOG] %', s;
@@ -106,6 +111,7 @@ $$ LANGUAGE plpgsql;
 --! @see eql_v2.log(text)
 CREATE FUNCTION eql_v2.log(ctx text, s text)
     RETURNS void
+  SET search_path = pg_catalog, extensions, public
 AS $$
   BEGIN
     RAISE NOTICE '[LOG] % %', ctx, s;

diff --git a/src/config/constraints.sql b/src/config/constraints.sql
@@ -44,6 +44,7 @@ END;
 CREATE FUNCTION eql_v2.config_check_indexes(val jsonb)
   RETURNS BOOLEAN
   IMMUTABLE STRICT PARALLEL SAFE
+  SET search_path = pg_catalog, extensions, public
 AS $$
 	BEGIN
 
@@ -75,6 +76,7 @@ $$ LANGUAGE plpgsql;
 CREATE FUNCTION eql_v2.config_check_cast(val jsonb)
   RETURNS BOOLEAN
   IMMUTABLE STRICT PARALLEL SAFE
+  SET search_path = pg_catalog, extensions, public
 AS $$
   DECLARE
     _valid_types text[] := '{text, int, small_int, big_int, real, double, boolean, date, jsonb, json, float, decimal, timestamp}';
@@ -113,6 +115,7 @@ $$ LANGUAGE plpgsql;
 --! @note Used in CHECK constraint on eql_v2_configuration table
 CREATE FUNCTION eql_v2.config_check_tables(val jsonb)
   RETURNS boolean
+  SET search_path = pg_catalog, extensions, public
 AS $$
 	BEGIN
     IF (val ? 'tables') THEN
@@ -136,6 +139,7 @@ $$ LANGUAGE plpgsql;
 --! @note Used in CHECK constraint on eql_v2_configuration table
 CREATE FUNCTION eql_v2.config_check_version(val jsonb)
   RETURNS boolean
+  SET search_path = pg_catalog, extensions, public
 AS $$
 	BEGIN
     IF (val ? 'v') THEN

diff --git a/src/config/functions.sql b/src/config/functions.sql
@@ -32,6 +32,7 @@
 CREATE FUNCTION eql_v2.add_search_config(table_name text, column_name text, index_name text, cast_as text DEFAULT 'text', opts jsonb DEFAULT '{}', migrating boolean DEFAULT false)
   RETURNS jsonb
 
+  SET search_path = pg_catalog, extensions, public
 AS $$
   DECLARE
     o jsonb;
@@ -108,6 +109,7 @@ $$ LANGUAGE plpgsql;
 --! @see eql_v2.modify_search_config
 CREATE FUNCTION eql_v2.remove_search_config(table_name text, column_name text, index_name text, migrating boolean DEFAULT false)
   RETURNS jsonb
+  SET search_path = pg_catalog, extensions, public
 AS $$
   DECLARE
     _config jsonb;
@@ -178,6 +180,7 @@ $$ LANGUAGE plpgsql;
 --! @see eql_v2.remove_search_config
 CREATE FUNCTION eql_v2.modify_search_config(table_name text, column_name text, index_name text, cast_as text DEFAULT 'text', opts jsonb DEFAULT '{}', migrating boolean DEFAULT false)
   RETURNS jsonb
+  SET search_path = pg_catalog, extensions, public
 AS $$
   BEGIN
     PERFORM eql_v2.remove_search_config(table_name, column_name, index_name, migrating);
@@ -204,6 +207,7 @@ $$ LANGUAGE plpgsql;
 --! @see eql_v2.add_column
 CREATE FUNCTION eql_v2.migrate_config()
   RETURNS boolean
+  SET search_path = pg_catalog, extensions, public
 AS $$
 	BEGIN
 
@@ -241,6 +245,7 @@ $$ LANGUAGE plpgsql;
 --! @see eql_v2.add_column
 CREATE FUNCTION eql_v2.activate_config()
   RETURNS boolean
+  SET search_path = pg_catalog, extensions, public
 AS $$
 	BEGIN
 
@@ -270,6 +275,7 @@ $$ LANGUAGE plpgsql;
 --! @see eql_v2.add_search_config
 CREATE FUNCTION eql_v2.discard()
   RETURNS boolean
+  SET search_path = pg_catalog, extensions, public
 AS $$
   BEGIN
     IF EXISTS (SELECT FROM public.eql_v2_configuration c WHERE c.state = 'pending') THEN
@@ -305,6 +311,7 @@ $$ LANGUAGE plpgsql;
 --! @see eql_v2.remove_column
 CREATE FUNCTION eql_v2.add_column(table_name text, column_name text, cast_as text DEFAULT 'text', migrating boolean DEFAULT false)
   RETURNS jsonb
+  SET search_path = pg_catalog, extensions, public
 AS $$
   DECLARE
     key text;
@@ -368,6 +375,7 @@ $$ LANGUAGE plpgsql;
 --! @see eql_v2.remove_search_config
 CREATE FUNCTION eql_v2.remove_column(table_name text, column_name text, migrating boolean DEFAULT false)
   RETURNS jsonb
+  SET search_path = pg_catalog, extensions, public
 AS $$
   DECLARE
     key text;
@@ -466,6 +474,7 @@ CREATE FUNCTION eql_v2.config() RETURNS TABLE (
     decrypts_as text,
     indexes jsonb
 )
+  SET search_path = pg_catalog, extensions, public
 AS $$
 BEGIN
     RETURN QUERY

diff --git a/src/config/functions_private.sql b/src/config/functions_private.sql
@@ -11,6 +11,7 @@
 CREATE FUNCTION eql_v2.config_default(config jsonb)
   RETURNS jsonb
   IMMUTABLE PARALLEL SAFE
+  SET search_path = pg_catalog, extensions, public
 AS $$
   BEGIN
     IF config IS NULL THEN
@@ -32,6 +33,7 @@ $$ LANGUAGE plpgsql;
 CREATE FUNCTION eql_v2.config_add_table(table_name text, config jsonb)
   RETURNS jsonb
   IMMUTABLE PARALLEL SAFE
+  SET search_path = pg_catalog, extensions, public
 AS $$
   DECLARE
     tbl jsonb;
@@ -56,6 +58,7 @@ $$ LANGUAGE plpgsql;
 CREATE FUNCTION eql_v2.config_add_column(table_name text, column_name text, config jsonb)
   RETURNS jsonb
   IMMUTABLE PARALLEL SAFE
+  SET search_path = pg_catalog, extensions, public
 AS $$
   DECLARE
     col jsonb;
@@ -82,6 +85,7 @@ $$ LANGUAGE plpgsql;
 CREATE FUNCTION eql_v2.config_add_cast(table_name text, column_name text, cast_as text, config jsonb)
   RETURNS jsonb
   IMMUTABLE PARALLEL SAFE
+  SET search_path = pg_catalog, extensions, public
 AS $$
   BEGIN
     SELECT jsonb_set(config, array['tables', table_name, column_name, 'cast_as'], to_jsonb(cast_as)) INTO config;
@@ -104,6 +108,7 @@ $$ LANGUAGE plpgsql;
 CREATE FUNCTION eql_v2.config_add_index(table_name text, column_name text, index_name text, opts jsonb, config jsonb)
   RETURNS jsonb
   IMMUTABLE PARALLEL SAFE
+  SET search_path = pg_catalog, extensions, public
 AS $$
   BEGIN
     SELECT jsonb_insert(config, array['tables', table_name, column_name, 'indexes', index_name], opts) INTO config;

diff --git a/src/encrypted/aggregates.sql b/src/encrypted/aggregates.sql
@@ -18,6 +18,7 @@
 CREATE FUNCTION eql_v2.min(a eql_v2_encrypted, b eql_v2_encrypted)
   RETURNS eql_v2_encrypted
 STRICT
+  SET search_path = pg_catalog, extensions, public
 AS $$
   BEGIN
     IF a < b THEN
@@ -66,6 +67,7 @@ CREATE AGGREGATE eql_v2.min(eql_v2_encrypted)
 CREATE FUNCTION eql_v2.max(a eql_v2_encrypted, b eql_v2_encrypted)
 RETURNS eql_v2_encrypted
 STRICT
+  SET search_path = pg_catalog, extensions, public
 AS $$
   BEGIN
     IF a > b THEN

diff --git a/src/encrypted/constraints.sql b/src/encrypted/constraints.sql
@@ -17,6 +17,7 @@
 --! @see eql_v2.check_encrypted
 CREATE FUNCTION eql_v2._encrypted_check_i(val jsonb)
   RETURNS boolean
+  SET search_path = pg_catalog, extensions, public
 AS $$
 	BEGIN
     IF val ? 'i' THEN
@@ -41,6 +42,7 @@ $$ LANGUAGE plpgsql;
 --! @see eql_v2.check_encrypted
 CREATE FUNCTION eql_v2._encrypted_check_i_ct(val jsonb)
   RETURNS boolean
+  SET search_path = pg_catalog, extensions, public
 AS $$
 	BEGIN
     IF (val->'i' ?& array['t', 'c']) THEN
@@ -64,6 +66,7 @@ $$ LANGUAGE plpgsql;
 --! @see eql_v2.check_encrypted
 CREATE FUNCTION eql_v2._encrypted_check_v(val jsonb)
   RETURNS boolean
+  SET search_path = pg_catalog, extensions, public
 AS $$
 	BEGIN
     IF (val ? 'v') THEN
@@ -94,6 +97,7 @@ $$ LANGUAGE plpgsql;
 --! @see eql_v2.check_encrypted
 CREATE FUNCTION eql_v2._encrypted_check_c(val jsonb)
   RETURNS boolean
+  SET search_path = pg_catalog, extensions, public
 AS $$
 	BEGIN
     IF (val ? 'c') THEN

diff --git a/src/encrypted/functions.sql b/src/encrypted/functions.sql
@@ -21,6 +21,7 @@
 CREATE FUNCTION eql_v2.ciphertext(val jsonb)
   RETURNS text
   IMMUTABLE STRICT PARALLEL SAFE
+  SET search_path = pg_catalog, extensions, public
 AS $$
 	BEGIN
     IF val ? 'c' THEN
@@ -65,7 +66,8 @@ $$;
 --!
 --! @see eql_v2.grouped_value
 CREATE FUNCTION eql_v2._first_grouped_value(jsonb, jsonb)
-RETURNS jsonb AS $$
+RETURNS jsonb
+AS $$
   SELECT COALESCE($1, $2);
 $$ LANGUAGE sql IMMUTABLE;
 
@@ -119,6 +121,7 @@ CREATE AGGREGATE eql_v2.grouped_value(jsonb) (
 --! @see eql_v2.remove_encrypted_constraint
 CREATE FUNCTION eql_v2.add_encrypted_constraint(table_name TEXT, column_name TEXT)
   RETURNS void
+  SET search_path = pg_catalog, extensions, public
 AS $$
 	BEGIN
     EXECUTE format('ALTER TABLE %I ADD CONSTRAINT eql_v2_encrypted_constraint_%I_%I CHECK (eql_v2.check_encrypted(%I))', table_name, table_name, column_name, column_name);
@@ -147,6 +150,7 @@ $$ LANGUAGE plpgsql;
 --! @see eql_v2.add_encrypted_constraint
 CREATE FUNCTION eql_v2.remove_encrypted_constraint(table_name TEXT, column_name TEXT)
   RETURNS void
+  SET search_path = pg_catalog, extensions, public
 AS $$
 	BEGIN
 		EXECUTE format('ALTER TABLE %I DROP CONSTRAINT IF EXISTS eql_v2_encrypted_constraint_%I_%I', table_name, table_name, column_name);

diff --git a/src/encrypted/hash.sql b/src/encrypted/hash.sql
@@ -34,6 +34,7 @@
 CREATE FUNCTION eql_v2.hash_encrypted(val eql_v2_encrypted)
   RETURNS integer
   IMMUTABLE STRICT PARALLEL SAFE
+  SET search_path = pg_catalog, extensions, public
 AS $$
 DECLARE
   ste_val eql_v2_encrypted;

diff --git a/src/encryptindex/functions.sql b/src/encryptindex/functions.sql
@@ -26,6 +26,7 @@
 CREATE FUNCTION eql_v2.diff_config(a JSONB, b JSONB)
 	RETURNS TABLE(table_name TEXT, column_name TEXT)
 IMMUTABLE STRICT PARALLEL SAFE
+  SET search_path = pg_catalog, extensions, public
 AS $$
   BEGIN
     RETURN QUERY
@@ -65,6 +66,7 @@ $$ LANGUAGE plpgsql;
 --! @see eql_v2.select_target_columns
 CREATE FUNCTION eql_v2.select_pending_columns()
 	RETURNS TABLE(table_name TEXT, column_name TEXT)
+  SET search_path = pg_catalog, extensions, public
 AS $$
 	DECLARE
 		active JSONB;
@@ -155,6 +157,7 @@ $$ LANGUAGE sql;
 --! @see eql_v2.rename_encrypted_columns
 CREATE FUNCTION eql_v2.create_encrypted_columns()
 	RETURNS TABLE(table_name TEXT, column_name TEXT)
+  SET search_path = pg_catalog, extensions, public
 AS $$
 	BEGIN
     FOR table_name, column_name IN
@@ -182,6 +185,7 @@ $$ LANGUAGE plpgsql;
 --! @see eql_v2.create_encrypted_columns
 CREATE FUNCTION eql_v2.rename_encrypted_columns()
 	RETURNS TABLE(table_name TEXT, column_name TEXT, target_column TEXT)
+  SET search_path = pg_catalog, extensions, public
 AS $$
 	BEGIN
     FOR table_name, column_name, target_column IN
@@ -209,6 +213,7 @@ $$ LANGUAGE plpgsql;
 --! @note Configuration tracking mechanism is implementation-specific
 CREATE FUNCTION eql_v2.count_encrypted_with_active_config(table_name TEXT, column_name TEXT)
   RETURNS BIGINT
+  SET search_path = pg_catalog, extensions, public
 AS $$
 DECLARE
   result BIGINT;

diff --git a/src/hmac_256/compare.sql b/src/hmac_256/compare.sql
@@ -22,6 +22,7 @@
 CREATE FUNCTION eql_v2.compare_hmac_256(a eql_v2_encrypted, b eql_v2_encrypted)
   RETURNS integer
   IMMUTABLE STRICT PARALLEL SAFE
+  SET search_path = pg_catalog, extensions, public
 AS $$
   DECLARE
     a_term eql_v2.hmac_256;