fix(stack-encrypt): a marker's operator methods take the value by value

A marker query took every value by reference, `AGE.between(&18, &65)`,
so that a string literal could be copied in through `ToOwned`. A number
by reference reads oddly for a `Copy` type, as the review of #1595 said.

The methods now take the value by value through `QueryInput`: an owned
scalar is moved into the query, and a borrowed text or byte string is
copied into an owned one. The scalars are listed, since a blanket over
`Zeroize` would overlap the borrowed impls under coherence. The query
wipes the owned value as before. The trybuild snapshot follows the
bound's new name.

Refs #1486, #1590.

Author: coderdan

docs/plans/2026-10-24-stack-encrypt-api-plan.md

@@ -350,14 +350,14 @@ EQL query type the marker fixes. Decided on 7 November 2026.
 // On `next` since pull request #1595, with the index's query term as
 // the output type (`EqualityTerm`, `RangeQuery<OreTerm<u32>>`,
 // `MatchQuery`); the EQL query types follow with the EQL owned
-// implementations. The bounds are passed by reference.
+// implementations. A value is passed by value; a string literal as it is.
 let by_email: TextEqQuery = EncryptedMember::EMAIL
     .eq("alice@example.com")
     .scope(tenant)
     .encrypt(&keyset)
     .await?;
 let adults: IntegerOrdQuery = EncryptedMember::AGE
-    .between(&18, &65)
+    .between(18, 65)
     .scope(tenant)
     .encrypt(&keyset)
     .await?;

packages/stack-encrypt/CHANGELOG.md

@@ -23,7 +23,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `bind` method, and ends with `.encrypt(&keyset)`. The output is the
   index's query term. A query from a marker derives under the declaration
   the derive wrote, so it is the stored term. No plan is written by hand
-  beside the record. The query's copy of the value is wiped when it is
+  beside the record. A method takes its value by value, and a string
+  literal as it is (`QueryInput`). The query's value is wiped when it is
   derived, refused, or dropped. `assert_context!` takes a marker, and
   `Marker::contexts()` is the record's contexts narrowed to the field.
   Not yet (#1596): a field of several indexes, a nullable field, and a

packages/stack-encrypt/src/lib.rs

@@ -586,7 +586,7 @@ pub use contexts::{
 };
 pub use descriptor::{Describe, Description, Descriptor, Label, LabelError};
 pub use keyset::KeysetCipher;
-pub use marker::{BetweenQuery, MarkedQuery, Marker, Needs, Ready, ScopeInput};
+pub use marker::{BetweenQuery, MarkedQuery, Marker, Needs, QueryInput, Ready, ScopeInput};
 pub use plan::{all, Plan, PlanError};
 // stack-kms is a public dependency: `StackCipher` is generic over its
 // `DataKeySource`, and `StackCipherBuilder::kms` takes its `StackKms`. It is

packages/stack-encrypt/src/marker.rs

@@ -56,7 +56,7 @@
 //!     .await?;
 //! assert_eq!(by_email, stored.email.terms);
 //! let adults = EncryptedUser::AGE
-//!     .between(&18u32, &36)
+//!     .between(18u32, 36)
 //!     .scope(Scope::new(42u64))
 //!     .encrypt(&keyset)
 //!     .await?;
@@ -75,7 +75,7 @@
 //! # What a marker does not check
 //!
 //! An equality marker takes a value of any type that the equality index
-//! accepts: `EMAIL.eq(&42u64)` compiles on a text field and matches
+//! accepts: `EMAIL.eq(42u64)` compiles on a text field and matches
 //! nothing, because the derive sees the record's field types and not the
 //! plaintext struct's. An order marker fixes the type, since `OreTerm<S>`
 //! names it. A field whose type is several indexes, such as
@@ -203,22 +203,95 @@ fn wipe_pair<S: Zeroize>((mut lo, mut hi): (S, S)) {
     hi.zeroize();
 }
 
+/// What a marker's operator methods take: an owned scalar, moved into the
+/// query, or a borrowed text or byte string, copied into it. A number is
+/// given by value, `AGE.between(18, 65)`, and a string literal as it is,
+/// `EMAIL.eq("ada@example.com")`. The query holds the owned value and
+/// wipes it when it is derived, refused or dropped. The scalars are the
+/// ones the indexes accept: the booleans, the integers, the floats, text,
+/// bytes, the [`value`](crate::value) types, and an `Option` of each.
+pub trait QueryInput {
+    /// The owned value the query holds.
+    type Value: Zeroize + 'static;
+    /// The value, owned.
+    fn into_value(self) -> Self::Value;
+}
+macro_rules! owned_query_inputs {
+    ($($ty:ty),+ $(,)?) => {$(
+        impl QueryInput for $ty {
+            type Value = $ty;
+            fn into_value(self) -> $ty {
+                self
+            }
+        }
+    )+};
+}
+owned_query_inputs!(
+    bool,
+    u8,
+    u16,
+    u32,
+    u64,
+    u128,
+    i8,
+    i16,
+    i32,
+    i64,
+    i128,
+    f32,
+    f64,
+    String,
+    Vec<u8>,
+    crate::value::Date,
+    crate::value::Timestamp,
+    crate::value::Decimal,
+);
+impl<V: QueryInput> QueryInput for Option<V> {
+    type Value = Option<V::Value>;
+    fn into_value(self) -> Self::Value {
+        self.map(V::into_value)
+    }
+}
+impl QueryInput for &str {
+    type Value = String;
+    fn into_value(self) -> String {
+        self.to_owned()
+    }
+}
+impl QueryInput for &String {
+    type Value = String;
+    fn into_value(self) -> String {
+        self.clone()
+    }
+}
+impl QueryInput for &[u8] {
+    type Value = Vec<u8>;
+    fn into_value(self) -> Vec<u8> {
+        self.to_vec()
+    }
+}
+impl QueryInput for &Vec<u8> {
+    type Value = Vec<u8>;
+    fn into_value(self) -> Vec<u8> {
+        self.clone()
+    }
+}
+
 /// One method per operator. Each exists only where the field's target type
 /// answers the operator ([`Answers`]), so a missing one is a compile error
-/// that names the field's indexes. The value is copied into the query
-/// (`ToOwned`), and the copy is wiped when the query is derived, refused or
+/// that names the field's indexes. The value is moved or copied into the
+/// query ([`QueryInput`]), and wiped when the query is derived, refused or
 /// dropped.
 macro_rules! operator_methods {
     ($($(#[$doc:meta])* $method:ident => $op:ident;)+) => {$(
         impl<T, C: ScopeInput> Marker<T, C> {
             $(#[$doc])*
-            pub fn $method<Q>(self, value: &Q) -> MarkedQuery<T, $op, Q::Owned, C::Start>
+            pub fn $method<Q>(self, value: Q) -> MarkedQuery<T, $op, Q::Value, C::Start>
             where
-                Q: ?Sized + ToOwned,
-                Q::Owned: Zeroize + 'static,
-                T: Answers<$op, Q::Owned> + LabelledTarget,
+                Q: QueryInput,
+                T: Answers<$op, Q::Value> + LabelledTarget,
             {
-                self.query(value.to_owned(), wipe_one)
+                self.query(value.into_value(), wipe_one)
             }
         }
     )+};
@@ -244,13 +317,12 @@ impl<T, C: ScopeInput> Marker<T, C> {
     /// Rows whose value is between `lo` and `hi`, inclusive
     /// ([`op::Between`](Between)): one term carrying both bounds, derived
     /// under one context.
-    pub fn between<Q>(self, lo: &Q, hi: &Q) -> BetweenQuery<T, Q::Owned, C::Start>
+    pub fn between<Q>(self, lo: Q, hi: Q) -> BetweenQuery<T, Q::Value, C::Start>
     where
-        Q: ?Sized + ToOwned,
-        Q::Owned: Zeroize + 'static,
-        T: Answers<Between, (Q::Owned, Q::Owned)> + LabelledTarget,
+        Q: QueryInput,
+        T: Answers<Between, (Q::Value, Q::Value)> + LabelledTarget,
     {
-        self.query((lo.to_owned(), hi.to_owned()), wipe_pair)
+        self.query((lo.into_value(), hi.into_value()), wipe_pair)
     }
 }
 
@@ -444,4 +516,48 @@ mod tests {
         assert_eq!(wipes.load(Ordering::SeqCst), 0, "nothing left to wipe");
         drop(taken);
     }
+
+    /// An owned scalar is the query's as it is, for each scalar the
+    /// indexes accept; a borrowed text or byte string is copied into an
+    /// owned one.
+    #[test]
+    fn a_query_input_is_owned_or_copied_in() {
+        use crate::value::{Date, Decimal, Timestamp};
+        macro_rules! owned_as_it_is {
+            ($($value:expr),+ $(,)?) => {$(
+                assert_eq!($value.into_value(), $value);
+                assert_eq!(Some($value).into_value(), Some($value));
+            )+};
+        }
+        owned_as_it_is!(
+            true,
+            7u8,
+            7u16,
+            7u32,
+            7u64,
+            7u128,
+            -7i8,
+            -7i16,
+            -7i32,
+            -7i64,
+            -7i128,
+            0.5f32,
+            0.5f64,
+            String::from("ada"),
+            b"ada".to_vec(),
+        );
+        let date = Date::from_days_since_epoch(7).unwrap();
+        assert_eq!(date.into_value().days_since_epoch(), 7);
+        let instant = Timestamp::new(7, 9).unwrap();
+        let instant = instant.into_value();
+        assert_eq!((instant.seconds(), instant.nanoseconds()), (7, 9));
+        let decimal = Decimal::new(75, 1).unwrap();
+        let decimal = decimal.into_value();
+        assert_eq!((decimal.mantissa(), decimal.scale()), (75, 1));
+
+        assert_eq!("ada".into_value(), String::from("ada"));
+        assert_eq!((&String::from("ada")).into_value(), String::from("ada"));
+        assert_eq!(b"ada"[..].into_value(), b"ada".to_vec());
+        assert_eq!((&b"ada".to_vec()).into_value(), b"ada".to_vec());
+    }
 }

packages/stack-encrypt/tests/markers.rs

@@ -243,7 +243,7 @@ mod a_marker_query {
 
         // A bound equal to the stored value derives the stored term.
         let at_36 = EncryptedUser::AGE
-            .gte(&36u32)
+            .gte(36u32)
             .scope(Scope::new(42u64))
             .encrypt(&keyset)
             .await
@@ -253,7 +253,7 @@ mod a_marker_query {
         // A range carries one term per bound, each as the stored term of
         // that value would be.
         let adults = EncryptedUser::AGE
-            .between(&18u32, &36u32)
+            .between(18u32, 36u32)
             .scope(Scope::new(42u64))
             .encrypt(&keyset)
             .await

packages/stack-encrypt/tests/ui/marker_operator_not_answered.rs

@@ -22,6 +22,6 @@ struct EncryptedUser {
 fn main() {
     let _ = EncryptedUser::EMAIL.eq("ada@example.com");
     let _ = EncryptedUser::EMAIL.gt("ada@example.com");
-    let _ = EncryptedUser::AGE.between(&18u32, &65);
+    let _ = EncryptedUser::AGE.between(18u32, 65);
     let _ = EncryptedUser::AGE.matches("36");
 }

packages/stack-encrypt/tests/ui/marker_operator_not_answered.stderr

@@ -20,7 +20,7 @@ help: the trait `Answers<stack_encrypt::op::Gt, _>` is not implemented for `Equa
 note: required by a bound in `Marker::<T, C>::gt`
   --> src/marker.rs
    |
-   |                   T: Answers<$op, Q::Owned> + LabelledTarget,
+   |                   T: Answers<$op, Q::Value> + LabelledTarget,
    |                      ^^^^^^^^^^^^^^^^^^^^^^ required by this bound in `Marker::<T, C>::gt`
 ...
    | / operator_methods! {
@@ -56,7 +56,7 @@ error[E0277]: `OreTerm<u32>` does not answer `stack_encrypt::op::Matches` given
 note: required by a bound in `Marker::<T, C>::matches`
   --> src/marker.rs
    |
-   |                   T: Answers<$op, Q::Owned> + LabelledTarget,
+   |                   T: Answers<$op, Q::Value> + LabelledTarget,
    |                      ^^^^^^^^^^^^^^^^^^^^^^ required by this bound in `Marker::<T, C>::matches`
 ...
    | / operator_methods! {