diff --git a/Cargo.lock b/Cargo.lock
index 5083992f..d8232f55 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -102,10 +102,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "android-tzdata"
-version = "0.1.1"
+name = "allocator-api2"
+version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 
 [[package]]
 name = "android_system_properties"
@@ -307,9 +307,9 @@ checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.13.3"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c953fe1ba023e6b7730c0d4b031d06f267f23a46167dcbd40316644b10a17ba"
+checksum = "5932a7d9d28b0d2ea34c6b3779d35e3dd6f6345317c34e73438c4f1f29144151"
 dependencies = [
  "aws-lc-sys",
  "untrusted 0.7.1",
@@ -318,9 +318,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.30.0"
+version = "0.33.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbfd150b5dbdb988bcc8fb1fe787eb6b7ee6180ca24da683b61ea5405f3d43ff"
+checksum = "1826f2e4cfc2cd19ee53c42fbf68e2f81ec21108e0b7ecf6a71cf062137360fc"
 dependencies = [
  "bindgen",
  "cc",
@@ -331,13 +331,13 @@ dependencies = [
 
 [[package]]
 name = "axum"
-version = "0.7.9"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
+checksum = "8a18ed336352031311f4e0b4dd2ff392d4fbb370777c9d18d7fc9d7359f73871"
 dependencies = [
- "async-trait",
  "axum-core",
  "bytes",
+ "form_urlencoded",
  "futures-util",
  "http",
  "http-body",
@@ -350,8 +350,7 @@ dependencies = [
  "mime",
  "percent-encoding",
  "pin-project-lite",
- "rustversion",
- "serde",
+ "serde_core",
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
@@ -365,25 +364,60 @@ dependencies = [
 
 [[package]]
 name = "axum-core"
-version = "0.4.5"
+version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
+checksum = "59446ce19cd142f8833f856eb31f3eb097812d1479ab224f54d72428ca21ea22"
 dependencies = [
- "async-trait",
  "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-extra"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9963ff19f40c6102c76756ef0a46004c0d58957d87259fc9208ff8441c12ab96"
+dependencies = [
+ "axum",
+ "axum-core",
+ "axum-macros",
+ "bytes",
+ "form_urlencoded",
  "futures-util",
  "http",
  "http-body",
  "http-body-util",
  "mime",
+ "percent-encoding",
  "pin-project-lite",
  "rustversion",
- "sync_wrapper",
+ "serde_core",
+ "serde_html_form",
  "tower-layer",
  "tower-service",
  "tracing",
 ]
 
+[[package]]
+name = "axum-macros"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "604fde5e028fea851ce1d8570bbdc034bec850d157f7569d10f347d06808c05c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.101",
+]
+
 [[package]]
 name = "backtrace"
 version = "0.3.74"
@@ -458,25 +492,22 @@ dependencies = [
 
 [[package]]
 name = "bindgen"
-version = "0.69.5"
+version = "0.72.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "271383c67ccabffb7381723dea0672a673f292304fcb45c01cc648c7a8d58088"
+checksum = "993776b509cfb49c750f11b8f07a46fa23e0a1386ffc01fb1e7d343efc387895"
 dependencies = [
  "bitflags 2.9.0",
  "cexpr",
  "clang-sys",
  "itertools",
- "lazy_static",
- "lazycell",
  "log",
  "prettyplease",
  "proc-macro2",
  "quote",
  "regex",
- "rustc-hash 1.1.0",
+ "rustc-hash",
  "shlex",
  "syn 2.0.101",
- "which",
 ]
 
 [[package]]
@@ -637,13 +668,50 @@ name = "bytes"
 version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "cached"
+version = "0.54.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9718806c4a2fe9e8a56fd736f97b340dd10ed1be8ed733ed50449f351dc33cae"
+dependencies = [
+ "ahash 0.8.11",
+ "cached_proc_macro",
+ "cached_proc_macro_types",
+ "hashbrown 0.14.5",
+ "once_cell",
+ "thiserror 1.0.69",
+ "web-time",
+]
+
+[[package]]
+name = "cached_proc_macro"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f42a145ed2d10dce2191e1dcf30cfccfea9026660e143662ba5eec4017d5daa"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.101",
+]
+
+[[package]]
+name = "cached_proc_macro_types"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ade8366b8bd5ba243f0a58f036cc0ca8a2f069cff1a2351ef1cac6b083e16fc0"
 
 [[package]]
 name = "cc"
-version = "1.2.17"
+version = "1.2.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fcb57c740ae1daf453ae85f16e37396f672b039e00d9d866e07ddb24e328e3a"
+checksum = "b97463e1064cb1b1c1384ad0a0b9c8abd0988e2a91f52606c80ef14aadb63e36"
 dependencies = [
+ "find-msvc-tools",
  "jobserver",
  "libc",
  "shlex",
@@ -678,17 +746,16 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "chrono"
-version = "0.4.40"
+version = "0.4.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a7964611d71df112cb1730f2ee67324fcf4d0fc6606acbbe9bfe06df124637c"
+checksum = "145052bdd345b87320e369255277e3fb5152762ad123a901ef5c262dd38fe8d2"
 dependencies = [
- "android-tzdata",
  "iana-time-zone",
  "js-sys",
  "num-traits",
  "serde",
  "wasm-bindgen",
- "windows-link",
+ "windows-link 0.2.1",
 ]
 
 [[package]]
@@ -712,9 +779,9 @@ dependencies = [
 
 [[package]]
 name = "cipherstash-client"
-version = "0.27.0"
+version = "0.30.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "229db71d51fb3dc5431cc20f5b543bb9d48f1177d9128573289f5dba723878d7"
+checksum = "8289d3e99f43e1224a9fec77da6683a26662defeab001757c5bd82f767e9b639"
 dependencies = [
  "aes-gcm-siv",
  "anyhow",
@@ -730,7 +797,7 @@ dependencies = [
  "cipherstash-core",
  "cllw-ore",
  "cts-common",
- "derive_more",
+ "derive_more 1.0.0",
  "dirs",
  "futures",
  "hex",
@@ -772,9 +839,9 @@ dependencies = [
 
 [[package]]
 name = "cipherstash-config"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30104045751da6e528e83804f4b22d0cddcb27aacce0e1c79604872ddb076bbf"
+checksum = "d277d6f9749f5bf7ae43d317c4860c73893ce4ae2ffbba5b2d5d02d078ebf4cc"
 dependencies = [
  "serde",
  "thiserror 1.0.69",
@@ -829,7 +896,7 @@ dependencies = [
  "rustls-platform-verifier",
  "serde",
  "serde_json",
- "socket2",
+ "socket2 0.5.8",
  "sqltk",
  "temp-env",
  "thiserror 2.0.12",
@@ -923,13 +990,14 @@ checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6"
 
 [[package]]
 name = "cllw-ore"
-version = "0.1.0"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1b01c26e11101044f85802e31d842483ef983a890c03472d9489f6969cf865a"
+checksum = "61894ceda17ee0b19d2255a7813c878d283ef55c35ca6c6f64e7220cacc1f72f"
 dependencies = [
  "bit-vec",
  "bitvec",
  "blake3",
+ "hex",
  "postgres-derive",
  "postgres-types",
  "regex",
@@ -1113,23 +1181,32 @@ dependencies = [
 
 [[package]]
 name = "cts-common"
-version = "0.3.0"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "058540fce9a147af37cab4f55a5f9d8ae7f35f66efeec58c08cce6beb173d9c3"
+checksum = "6ab8098fcbe24a615b214857f9a06c48932438c060ecc32ea9e41481adea9faf"
 dependencies = [
  "arrayvec",
  "axum",
+ "axum-extra",
  "base32",
+ "cached",
+ "chrono",
+ "derive_more 2.0.1",
  "diesel",
+ "either",
  "fake 3.1.0",
  "http",
  "miette",
  "nom 8.0.0",
+ "openssl-sys",
+ "pq-sys",
  "rand 0.8.5",
  "regex",
  "serde",
  "thiserror 1.0.69",
  "url",
+ "utoipa",
+ "uuid",
  "vitaminc",
 ]
 
@@ -1235,7 +1312,16 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4a9b99b9cbbe49445b21764dc0625032a89b145a2642e67603e1c936f5458d05"
 dependencies = [
- "derive_more-impl",
+ "derive_more-impl 1.0.0",
+]
+
+[[package]]
+name = "derive_more"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "093242cf7570c207c83073cf82f79706fe7b8317e98620a47d5be7c3d8497678"
+dependencies = [
+ "derive_more-impl 2.0.1",
 ]
 
 [[package]]
@@ -1250,6 +1336,18 @@ dependencies = [
  "unicode-xid",
 ]
 
+[[package]]
+name = "derive_more-impl"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bda628edc44c4bb645fbe0f758797143e4e07926f7ebf4e9bdfbd3d2ce621df3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.101",
+ "unicode-xid",
+]
+
 [[package]]
 name = "deunicode"
 version = "1.6.1"
@@ -1398,12 +1496,15 @@ name = "either"
 version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+dependencies = [
+ "serde",
+]
 
 [[package]]
 name = "eql-mapper"
 version = "1.0.0"
 dependencies = [
- "derive_more",
+ "derive_more 1.0.0",
  "eql-mapper-macros",
  "impl-trait-for-tuples",
  "pretty_assertions",
@@ -1514,6 +1615,12 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4443176a9f2c162692bd3d352d745ef9413eec5782a80d8fd6f8a1ac692a07f7"
 
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a3076410a55c90011c298b04d0cfa770b00fa04e1e3c97d3f6c9de105a03844"
+
 [[package]]
 name = "flagset"
 version = "0.4.6"
@@ -1754,6 +1861,10 @@ name = "hashbrown"
 version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+dependencies = [
+ "ahash 0.8.11",
+ "allocator-api2",
+]
 
 [[package]]
 name = "hashbrown"
@@ -1794,15 +1905,6 @@ dependencies = [
  "digest",
 ]
 
-[[package]]
-name = "home"
-version = "0.5.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589533453244b0995c858700322199b2becb13b627df2851f64a2775d024abcf"
-dependencies = [
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "http"
 version = "1.3.1"
@@ -1902,7 +2004,7 @@ dependencies = [
  "http-body",
  "hyper",
  "pin-project-lite",
- "socket2",
+ "socket2 0.5.8",
  "tokio",
  "tower-service",
  "tracing",
@@ -2096,6 +2198,7 @@ checksum = "3954d50fe15b02142bf25d3b8bdadb634ec3948f103d04ffe3031bc8fe9d7058"
 dependencies = [
  "equivalent",
  "hashbrown 0.15.2",
+ "serde",
 ]
 
 [[package]]
@@ -2199,17 +2302,11 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
-[[package]]
-name = "lazycell"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
-
 [[package]]
 name = "libc"
-version = "0.2.171"
+version = "0.2.177"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c19937216e9d3aa9956d9bb8dfc0b0c8beb6058fc4f7a4dc4d850edf86a237d6"
+checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"
 
 [[package]]
 name = "libloading"
@@ -2237,12 +2334,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "linux-raw-sys"
-version = "0.4.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
-
 [[package]]
 name = "linux-raw-sys"
 version = "0.9.3"
@@ -2301,9 +2392,9 @@ dependencies = [
 
 [[package]]
 name = "matchit"
-version = "0.7.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
 
 [[package]]
 name = "md-5"
@@ -2606,6 +2697,28 @@ version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
 
+[[package]]
+name = "openssl-src"
+version = "300.5.4+3.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a507b3792995dae9b0df8a1c1e3771e8418b7c2d9f0baeba32e6fe8b06c7cb72"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.111"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82cab2d520aa75e3c58898289429321eb788c3106963d0dc886ec7a5f4adc321"
+dependencies = [
+ "cc",
+ "libc",
+ "openssl-src",
+ "pkg-config",
+ "vcpkg",
+]
+
 [[package]]
 name = "ore-rs"
 version = "0.8.0"
@@ -2767,6 +2880,12 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
+[[package]]
+name = "pkg-config"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+
 [[package]]
 name = "polyval"
 version = "0.6.2"
@@ -2847,6 +2966,28 @@ dependencies = [
  "zerocopy 0.8.24",
 ]
 
+[[package]]
+name = "pq-src"
+version = "0.3.10+libpq-18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56ef39ce621f4993d6084fdcd4cbf1e01c84bdba53109cfad095d2cf441b85b9"
+dependencies = [
+ "cc",
+ "openssl-sys",
+]
+
+[[package]]
+name = "pq-sys"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "574ddd6a267294433f140b02a726b0640c43cf7c6f717084684aaa3b285aba61"
+dependencies = [
+ "libc",
+ "pkg-config",
+ "pq-src",
+ "vcpkg",
+]
+
 [[package]]
 name = "pretty_assertions"
 version = "1.4.1"
@@ -2956,9 +3097,9 @@ dependencies = [
  "pin-project-lite",
  "quinn-proto",
  "quinn-udp",
- "rustc-hash 2.1.1",
+ "rustc-hash",
  "rustls",
- "socket2",
+ "socket2 0.5.8",
  "thiserror 2.0.12",
  "tokio",
  "tracing",
@@ -2976,7 +3117,7 @@ dependencies = [
  "lru-slab",
  "rand 0.9.0",
  "ring",
- "rustc-hash 2.1.1",
+ "rustc-hash",
  "rustls",
  "rustls-pki-types",
  "slab",
@@ -2995,7 +3136,7 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2",
+ "socket2 0.5.8",
  "tracing",
  "windows-sys 0.59.0",
 ]
@@ -3407,12 +3548,6 @@ version = "0.1.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
 
-[[package]]
-name = "rustc-hash"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
-
 [[package]]
 name = "rustc-hash"
 version = "2.1.1"
@@ -3437,19 +3572,6 @@ dependencies = [
  "nom 7.1.3",
 ]
 
-[[package]]
-name = "rustix"
-version = "0.38.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
-dependencies = [
- "bitflags 2.9.0",
- "errno",
- "libc",
- "linux-raw-sys 0.4.15",
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "rustix"
 version = "1.0.3"
@@ -3459,7 +3581,7 @@ dependencies = [
  "bitflags 2.9.0",
  "errno",
  "libc",
- "linux-raw-sys 0.9.3",
+ "linux-raw-sys",
  "windows-sys 0.59.0",
 ]
 
@@ -3627,10 +3749,11 @@ checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0"
 
 [[package]]
 name = "serde"
-version = "1.0.219"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
 dependencies = [
+ "serde_core",
  "serde_derive",
 ]
 
@@ -3653,17 +3776,39 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
 [[package]]
 name = "serde_derive"
-version = "1.0.219"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.101",
 ]
 
+[[package]]
+name = "serde_html_form"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2f2d7ff8a2140333718bb329f5c40fc5f0865b84c426183ce14c97d2ab8154f"
+dependencies = [
+ "form_urlencoded",
+ "indexmap",
+ "itoa",
+ "ryu",
+ "serde_core",
+]
+
 [[package]]
 name = "serde_json"
 version = "1.0.140"
@@ -3818,6 +3963,16 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "socket2"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17129e116933cf371d018bb80ae557e889637989d8638274fb25622827b03881"
+dependencies = [
+ "libc",
+ "windows-sys 0.60.2",
+]
+
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -3993,7 +4148,7 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "45c6481c4829e4cc63825e62c49186a34538b7b2750b73b266581ffb612fb5ed"
 dependencies = [
- "rustix 1.0.3",
+ "rustix",
  "windows-sys 0.59.0",
 ]
 
@@ -4136,27 +4291,26 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.44.2"
+version = "1.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6b88822cbe49de4185e3a4cbf8321dd487cf5fe0c5c65695fef6346371e9c48"
+checksum = "ff360e02eab121e0bc37a2d3b4d4dc622e6eda3a8e5253d5435ecf5bd4c68408"
 dependencies = [
- "backtrace",
  "bytes",
  "libc",
  "mio",
  "parking_lot 0.12.3",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2",
+ "socket2 0.6.1",
  "tokio-macros",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "tokio-macros"
-version = "2.5.0"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
+checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4183,7 +4337,7 @@ dependencies = [
  "postgres-protocol",
  "postgres-types",
  "rand 0.9.0",
- "socket2",
+ "socket2 0.5.8",
  "tokio",
  "tokio-util",
  "whoami",
@@ -4499,6 +4653,31 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
+[[package]]
+name = "utoipa"
+version = "5.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2fcc29c80c21c31608227e0912b2d7fddba57ad76b606890627ba8ee7964e993"
+dependencies = [
+ "indexmap",
+ "serde",
+ "serde_json",
+ "utoipa-gen",
+]
+
+[[package]]
+name = "utoipa-gen"
+version = "5.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d79d08d92ab8af4c5e8a6da20c47ae3f61a0f1dabc1997cdf2d082b757ca08b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.101",
+ "url",
+ "uuid",
+]
+
 [[package]]
 name = "uuid"
 version = "1.16.0"
@@ -4518,6 +4697,12 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
 [[package]]
 name = "version_check"
 version = "0.9.5"
@@ -4526,19 +4711,47 @@ checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
 [[package]]
 name = "vitaminc"
-version = "0.1.0-pre2"
+version = "0.1.0-pre3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3e4c7e4e19bd3795b3bc4b99aa31d43d1b06a9c6fd9297ce8237467869d268c"
+checksum = "565a7733c4d683c67ca8e9815d81a132d7bd3e83f3b9f42e8b28e79bbd4bb1ce"
 dependencies = [
+ "vitaminc-encrypt",
  "vitaminc-protected",
  "vitaminc-random",
+ "vitaminc-traits",
+]
+
+[[package]]
+name = "vitaminc-aead"
+version = "0.1.0-pre3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c049ed06ef3e9e66356a063c7110263fc810ffa6837f6a5e1b83448ce32d3b5d"
+dependencies = [
+ "bytes",
+ "serde",
+ "vitaminc-protected",
+ "vitaminc-random",
+ "zeroize",
+]
+
+[[package]]
+name = "vitaminc-encrypt"
+version = "0.1.0-pre3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ded1d063f6c5421f0c25901407c436047eefa3e9dd9f0e12d3f3771a234fa624"
+dependencies = [
+ "aws-lc-rs",
+ "vitaminc-aead",
+ "vitaminc-protected",
+ "vitaminc-random",
+ "zeroize",
 ]
 
 [[package]]
 name = "vitaminc-protected"
-version = "0.1.0-pre2"
+version = "0.1.0-pre3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f032763fc27651980ec2c811917d9cccc566ec126250be75d82d3f8d1e37cc26"
+checksum = "cf363bf624d149a8862a79a879b22d9b3f50bebabe90a7bdfb0a2b2f42844cdb"
 dependencies = [
  "bitvec",
  "digest",
@@ -4546,19 +4759,59 @@ dependencies = [
  "serde",
  "serde_bytes",
  "subtle",
+ "vitaminc-protected-derive",
  "zeroize",
 ]
 
+[[package]]
+name = "vitaminc-protected-derive"
+version = "0.1.0-pre3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7baafd4f0fa70bb246ac6895f5695ba1fdd529688ba5b92f8ae39922e1b1cb7a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.101",
+]
+
 [[package]]
 name = "vitaminc-random"
-version = "0.1.0-pre2"
+version = "0.1.0-pre3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a544c02ef2c1724db33d7bcb8df2c1f8c2ddab27965e57cc5373c55b8da567b6"
+checksum = "24b9a9c7c91719dc780486f2e026f92f31650584b7dcf5b175a597cd0e01325e"
 dependencies = [
  "rand 0.8.5",
  "rand_chacha 0.3.1",
  "thiserror 1.0.69",
  "vitaminc-protected",
+ "vitaminc-random-derives",
+ "zeroize",
+]
+
+[[package]]
+name = "vitaminc-random-derives"
+version = "0.1.0-pre3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7258fae4c7ca793a984edca016bcf03c0d64c5f8803fd57c62caed8fe16aeda"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.101",
+]
+
+[[package]]
+name = "vitaminc-traits"
+version = "0.1.0-pre3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10dcb9cabed5726f1c2c997d60850309302938654b621f6b3028a5499be74821"
+dependencies = [
+ "anyhow",
+ "bytes",
+ "rmp-serde",
+ "serde",
+ "thiserror 1.0.69",
+ "vitaminc-protected",
+ "vitaminc-random",
  "zeroize",
 ]
 
@@ -4735,18 +4988,6 @@ dependencies = [
  "rustls-pki-types",
 ]
 
-[[package]]
-name = "which"
-version = "4.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
-dependencies = [
- "either",
- "home",
- "once_cell",
- "rustix 0.38.44",
-]
-
 [[package]]
 name = "whoami"
 version = "1.6.0"
@@ -4798,7 +5039,7 @@ dependencies = [
  "windows-collections",
  "windows-core 0.61.2",
  "windows-future",
- "windows-link",
+ "windows-link 0.1.1",
  "windows-numerics",
 ]
 
@@ -4828,7 +5069,7 @@ checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
 dependencies = [
  "windows-implement",
  "windows-interface",
- "windows-link",
+ "windows-link 0.1.1",
  "windows-result",
  "windows-strings 0.4.2",
 ]
@@ -4840,7 +5081,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc6a41e98427b19fe4b73c550f060b59fa592d7d686537eebf9385621bfbad8e"
 dependencies = [
  "windows-core 0.61.2",
- "windows-link",
+ "windows-link 0.1.1",
  "windows-threading",
 ]
 
@@ -4872,6 +5113,12 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "76840935b766e1b0a05c0066835fb9ec80071d4c09a16f6bd5f7e655e3c14c38"
 
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
 [[package]]
 name = "windows-numerics"
 version = "0.2.0"
@@ -4879,7 +5126,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9150af68066c4c5c07ddc0ce30421554771e528bde427614c61038bc2c92c2b1"
 dependencies = [
  "windows-core 0.61.2",
- "windows-link",
+ "windows-link 0.1.1",
 ]
 
 [[package]]
@@ -4890,7 +5137,7 @@ checksum = "4286ad90ddb45071efd1a66dfa43eb02dd0dfbae1545ad6cc3c51cf34d7e8ba3"
 dependencies = [
  "windows-result",
  "windows-strings 0.3.1",
- "windows-targets 0.53.0",
+ "windows-targets 0.53.5",
 ]
 
 [[package]]
@@ -4899,7 +5146,7 @@ version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
 dependencies = [
- "windows-link",
+ "windows-link 0.1.1",
 ]
 
 [[package]]
@@ -4908,7 +5155,7 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "87fa48cc5d406560701792be122a10132491cff9d0aeb23583cc2dcafc847319"
 dependencies = [
- "windows-link",
+ "windows-link 0.1.1",
 ]
 
 [[package]]
@@ -4917,7 +5164,7 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
 dependencies = [
- "windows-link",
+ "windows-link 0.1.1",
 ]
 
 [[package]]
@@ -4962,6 +5209,24 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link 0.2.1",
+]
+
 [[package]]
 name = "windows-targets"
 version = "0.42.2"
@@ -4995,10 +5260,11 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.53.0"
+version = "0.53.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1e4c7e8ceaaf9cb7d7507c974735728ab453b67ef8f18febdd7c11fe59dca8b"
+checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
 dependencies = [
+ "windows-link 0.2.1",
  "windows_aarch64_gnullvm 0.53.0",
  "windows_aarch64_msvc 0.53.0",
  "windows_i686_gnu 0.53.0",
@@ -5015,7 +5281,7 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b66463ad2e0ea3bbf808b7f1d371311c80e115c0b71d60efc142cafbcfb057a6"
 dependencies = [
- "windows-link",
+ "windows-link 0.1.1",
 ]
 
 [[package]]
@@ -5346,14 +5612,15 @@ dependencies = [
 
 [[package]]
 name = "zerokms-protocol"
-version = "0.7.0"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d03a43cb707f0722fdb9b2ff145e93427f8510540315be02ad015c2da061f2eb"
+checksum = "d250d0934f3b3071c9d7a91dd26b389c45d5b1f8653aa6660e4efee09bf3063a"
 dependencies = [
  "async-trait",
  "base64",
  "cipherstash-config",
  "const-hex",
+ "cts-common",
  "fake 2.10.0",
  "opaque-debug",
  "rand 0.8.5",
diff --git a/Cargo.toml b/Cargo.toml
index 68c5ce83..e0697e91 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -43,8 +43,9 @@ debug = true
 
 [workspace.dependencies]
 sqltk = { version = "0.10.0" }
-cipherstash-client = "0.27.0"
-cts-common = { version = "0.3.0" }
+cipherstash-client = "0.30.0"
+cts-common = { version = "0.4.0" }
+
 thiserror = "2.0.9"
 tokio = { version = "1.44.2", features = ["full"] }
 tracing = "0.1"
diff --git a/packages/cipherstash-proxy/src/eql/mod.rs b/packages/cipherstash-proxy/src/eql/mod.rs
deleted file mode 100644
index 58962789..00000000
--- a/packages/cipherstash-proxy/src/eql/mod.rs
+++ /dev/null
@@ -1,254 +0,0 @@
-use cipherstash_client::zerokms::EncryptedRecord;
-use serde::{Deserialize, Serialize};
-use sqltk::parser::ast::Ident;
-
-#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
-pub struct Plaintext {
-    #[serde(rename = "p")]
-    pub plaintext: String,
-    #[serde(rename = "i")]
-    pub identifier: Identifier,
-    #[serde(rename = "v")]
-    pub version: u16,
-    #[serde(rename = "q")]
-    pub for_query: Option<ForQuery>,
-}
-
-#[derive(Clone, Debug, Deserialize, Eq, Hash, PartialEq, Serialize)]
-pub struct Identifier {
-    #[serde(rename = "t")]
-    pub table: String,
-    #[serde(rename = "c")]
-    pub column: String,
-}
-
-impl Identifier {
-    pub fn new<S>(table: S, column: S) -> Self
-    where
-        S: Into<String>,
-    {
-        let table = table.into();
-        let column = column.into();
-
-        Self { table, column }
-    }
-
-    pub fn table(&self) -> &String {
-        &self.table
-    }
-
-    pub fn column(&self) -> &String {
-        &self.column
-    }
-}
-
-impl From<(&Ident, &Ident)> for Identifier {
-    fn from((table, column): (&Ident, &Ident)) -> Self {
-        Self {
-            table: table.value.to_owned(),
-            column: column.value.to_owned(),
-        }
-    }
-}
-
-#[derive(Clone, Copy, Debug, Deserialize, PartialEq, Serialize)]
-#[serde(rename_all = "snake_case")]
-pub enum ForQuery {
-    Match,
-    Ore,
-    Unique,
-    SteVec, // Should this be SteVecContainment?
-    EjsonPath,
-    SteVecTerm,
-}
-
-#[derive(Debug, Deserialize, Serialize)]
-pub struct EqlEncrypted {
-    #[serde(rename = "i")]
-    pub(crate) identifier: Identifier,
-    #[serde(rename = "v")]
-    pub(crate) version: u16,
-
-    #[serde(flatten)]
-    pub(crate) body: EqlEncryptedBody,
-}
-
-#[derive(Debug, Deserialize, Serialize)]
-pub struct EqlEncryptedBody {
-    #[serde(
-        rename = "c",
-        // serialize_with = "serialize_option_encrypted_record",
-        default,
-        with = "formats::mp_base85",
-        // with = "encrypted_record::formats::mp_base85",
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub(crate) ciphertext: Option<EncryptedRecord>,
-
-    #[serde(flatten)]
-    pub(crate) indexes: EqlEncryptedIndexes,
-
-    #[serde(rename = "a", skip_serializing_if = "Option::is_none")]
-    pub(crate) is_array_item: Option<bool>,
-}
-
-// /// Serializes an Option<EncryptedRecord> using the mp_base85 format.
-// pub fn serialize_option_encrypted_record<S>(
-//     value: &Option<EncryptedRecord>,
-//     serializer: S,
-// ) -> Result<S::Ok, S::Error>
-// where
-//     S: Serializer,
-// {
-//     match value {
-//         Some(record) => {
-//             encrypted_record::formats::mp_base85::serialize(record, serializer)
-//             // serialize(record, serializer)
-//             // let encoded = record.to_mp_base85().map_err(serde::ser::Error::custom)?;
-//             // serializer.serialize_some(&encoded)
-//         }
-//         None => serializer.serialize_none(),
-//     }
-// }
-pub mod formats {
-    pub mod mp_base85 {
-        use super::super::*;
-        use serde::Deserialize;
-
-        pub fn serialize<S>(
-            ciphertext: &Option<EncryptedRecord>,
-            serializer: S,
-        ) -> Result<S::Ok, S::Error>
-        where
-            S: serde::Serializer,
-        {
-            // encrypted_record::formats::mp_base85
-            match ciphertext {
-                Some(record) => {
-                    let s = record.to_mp_base85().map_err(serde::ser::Error::custom)?;
-                    serializer.serialize_some(&s)
-                }
-
-                None => serializer.serialize_none(),
-            }
-        }
-
-        pub fn deserialize<'de, D>(deserializer: D) -> Result<Option<EncryptedRecord>, D::Error>
-        where
-            D: serde::Deserializer<'de>,
-        {
-            let s: Option<String> = Option::deserialize(deserializer)?;
-            if let Some(s) = s {
-                Ok(EncryptedRecord::from_mp_base85(&s)
-                    // .map_err(serde::de::Error::custom)
-                    .ok())
-            } else {
-                Ok(None)
-            }
-        }
-    }
-}
-
-///
-/// EqlEncryptedIndexes
-///   - null values should not be serialized
-///   - the null carries through to the database as this is the EQL JSON format
-#[derive(Debug, Deserialize, Serialize, Default)]
-pub struct EqlEncryptedIndexes {
-    #[serde(rename = "ob", skip_serializing_if = "Option::is_none")]
-    pub(crate) ore_block_u64_8_256: Option<Vec<String>>,
-
-    #[serde(rename = "bf", skip_serializing_if = "Option::is_none")]
-    pub(crate) bloom_filter: Option<Vec<u16>>,
-
-    #[serde(rename = "hm", skip_serializing_if = "Option::is_none")]
-    pub(crate) hmac_256: Option<String>,
-
-    #[serde(rename = "s", skip_serializing_if = "Option::is_none")]
-    pub(crate) selector: Option<String>,
-
-    #[serde(rename = "b3", skip_serializing_if = "Option::is_none")]
-    pub(crate) blake3: Option<String>,
-
-    #[serde(rename = "ocf", skip_serializing_if = "Option::is_none")]
-    pub(crate) ore_cllw_u64_8: Option<String>,
-
-    #[serde(rename = "ocv", skip_serializing_if = "Option::is_none")]
-    pub(crate) ore_cllw_var_8: Option<String>,
-
-    #[serde(rename = "sv", skip_serializing_if = "Option::is_none")]
-    pub(crate) ste_vec_index: Option<Vec<EqlEncryptedBody>>,
-}
-
-#[cfg(test)]
-mod tests {
-    use crate::{
-        eql::{EqlEncryptedBody, EqlEncryptedIndexes},
-        EqlEncrypted,
-    };
-
-    use super::{Identifier, Plaintext};
-    use cipherstash_client::zerokms::EncryptedRecord;
-    use recipher::key::Iv;
-    use uuid::Uuid;
-
-    #[test]
-    pub fn plaintext_json() {
-        let identifier = Identifier::new("table", "column");
-        let pt = Plaintext {
-            identifier,
-            plaintext: "plaintext".to_string(),
-            version: 1,
-            for_query: None,
-        };
-
-        let value = serde_json::to_value(&pt).unwrap();
-
-        let i = &value["i"];
-        let t = &i["t"];
-        assert_eq!(t, "table");
-
-        let result: Plaintext = serde_json::from_value(value).unwrap();
-        assert_eq!(pt, result);
-    }
-
-    #[test]
-    pub fn ciphertext_json() {
-        let expected = Identifier::new("table", "column");
-
-        let ciphertext = Some(EncryptedRecord {
-            iv: Iv::default(),
-            ciphertext: vec![1; 32],
-            tag: vec![1; 16],
-            descriptor: "ciphertext".to_string(),
-            keyset_id: Some(Uuid::new_v4()),
-        });
-        let ct = EqlEncrypted {
-            identifier: expected.clone(),
-            version: 1,
-            body: EqlEncryptedBody {
-                ciphertext,
-                indexes: EqlEncryptedIndexes {
-                    ore_block_u64_8_256: None,
-                    bloom_filter: None,
-                    hmac_256: None,
-                    blake3: None,
-                    selector: None,
-                    ore_cllw_u64_8: None,
-                    ore_cllw_var_8: None,
-                    ste_vec_index: None,
-                },
-                is_array_item: None,
-            },
-        };
-
-        let value = serde_json::to_value(&ct).unwrap();
-
-        let i = &value["i"];
-        let t = &i["t"];
-        assert_eq!(t, "table");
-
-        let result: EqlEncrypted = serde_json::from_value(value).unwrap();
-        assert_eq!(expected, result.identifier);
-    }
-}
diff --git a/packages/cipherstash-proxy/src/lib.rs b/packages/cipherstash-proxy/src/lib.rs
index 9d466006..1392fc69 100644
--- a/packages/cipherstash-proxy/src/lib.rs
+++ b/packages/cipherstash-proxy/src/lib.rs
@@ -3,7 +3,6 @@
 pub mod cli;
 pub mod config;
 pub mod connect;
-pub mod eql;
 pub mod error;
 pub mod log;
 pub mod postgresql;
@@ -14,9 +13,9 @@ pub mod tls;
 pub use crate::cli::Args;
 pub use crate::cli::Migrate;
 pub use crate::config::{DatabaseConfig, ServerConfig, TandemConfig, TlsConfig};
-pub use crate::eql::{EqlEncrypted, ForQuery, Identifier, Plaintext};
 pub use crate::log::init;
 pub use crate::proxy::Proxy;
+pub use cipherstash_client::eql::{EqlEncrypted, ForQuery, Identifier, Plaintext};
 
 use std::mem;
 
diff --git a/packages/cipherstash-proxy/src/postgresql/backend.rs b/packages/cipherstash-proxy/src/postgresql/backend.rs
index f093716e..4a667835 100644
--- a/packages/cipherstash-proxy/src/postgresql/backend.rs
+++ b/packages/cipherstash-proxy/src/postgresql/backend.rs
@@ -7,7 +7,6 @@ use super::messages::row_description::RowDescription;
 use super::messages::BackendCode;
 use super::Column;
 use crate::connect::Sender;
-use crate::eql::EqlEncrypted;
 use crate::error::{EncryptError, Error};
 use crate::log::{CONTEXT, DEVELOPMENT, MAPPER, PROTOCOL};
 use crate::postgresql::context::Portal;
@@ -21,6 +20,7 @@ use crate::prometheus::{
 };
 use crate::proxy::EncryptionService;
 use bytes::BytesMut;
+use cipherstash_client::eql::EqlEncrypted;
 use metrics::{counter, histogram};
 use std::time::Instant;
 use tokio::io::AsyncRead;
diff --git a/packages/cipherstash-proxy/src/postgresql/column_mapper.rs b/packages/cipherstash-proxy/src/postgresql/column_mapper.rs
index c63bba03..b8600e31 100644
--- a/packages/cipherstash-proxy/src/postgresql/column_mapper.rs
+++ b/packages/cipherstash-proxy/src/postgresql/column_mapper.rs
@@ -1,10 +1,10 @@
 use crate::{
-    eql::Identifier,
     error::{EncryptError, Error},
     log::MAPPER,
     postgresql::Column,
     proxy::EncryptConfig,
 };
+use cipherstash_client::eql::Identifier;
 use eql_mapper::{EqlTerm, TableColumn, TypeCheckedStatement};
 use postgres_types::Type;
 use std::sync::Arc;
@@ -40,7 +40,8 @@ impl ColumnMapper {
             let configured_column = match &**ty {
                 eql_mapper::Type::Value(eql_mapper::Value::Eql(eql_term)) => {
                     let TableColumn { table, column } = eql_term.table_column();
-                    let identifier: Identifier = Identifier::from((table, column));
+                    let identifier: Identifier =
+                        Identifier::new(table.value.to_string(), column.value.to_string());
 
                     debug!(
                         target: MAPPER,
@@ -74,7 +75,8 @@ impl ColumnMapper {
             let configured_column = match param {
                 (_, eql_mapper::Value::Eql(eql_term)) => {
                     let TableColumn { table, column } = eql_term.table_column();
-                    let identifier = Identifier::from((table, column));
+                    let identifier =
+                        Identifier::new(table.value.to_string(), column.value.to_string());
 
                     debug!(
                         target: MAPPER,
@@ -102,7 +104,7 @@ impl ColumnMapper {
 
         for (eql_term, _) in typed_statement.literals.iter() {
             let TableColumn { table, column } = eql_term.table_column();
-            let identifier = Identifier::from((table, column));
+            let identifier = Identifier::new(table.value.to_string(), column.value.to_string());
 
             debug!(
                 target: MAPPER,
diff --git a/packages/cipherstash-proxy/src/postgresql/messages/bind.rs b/packages/cipherstash-proxy/src/postgresql/messages/bind.rs
index 5e0da063..ed528a87 100644
--- a/packages/cipherstash-proxy/src/postgresql/messages/bind.rs
+++ b/packages/cipherstash-proxy/src/postgresql/messages/bind.rs
@@ -1,5 +1,4 @@
 use super::{maybe_json, maybe_jsonb, Name, NULL};
-use crate::eql;
 use crate::error::{Error, MappingError, ProtocolError};
 use crate::log::MAPPER;
 use crate::postgresql::context::column::Column;
@@ -9,6 +8,7 @@ use crate::postgresql::protocol::BytesMutReadString;
 use crate::{SIZE_I16, SIZE_I32};
 use bytes::{Buf, BufMut, BytesMut};
 use cipherstash_client::encryption::Plaintext;
+use cipherstash_client::eql::{self, EqlEncrypted};
 use postgres_types::Type;
 use std::fmt::{self, Display, Formatter};
 use std::io::Cursor;
@@ -81,7 +81,7 @@ impl Bind {
         Ok(plaintexts)
     }
 
-    pub fn rewrite(&mut self, encrypted: Vec<Option<eql::EqlEncrypted>>) -> Result<(), Error> {
+    pub fn rewrite(&mut self, encrypted: Vec<Option<EqlEncrypted>>) -> Result<(), Error> {
         for (idx, ct) in encrypted.iter().enumerate() {
             if let Some(ct) = ct {
                 let json = serde_json::to_value(ct)?;
diff --git a/packages/cipherstash-proxy/src/postgresql/messages/data_row.rs b/packages/cipherstash-proxy/src/postgresql/messages/data_row.rs
index 8f9e0b29..ed94a591 100644
--- a/packages/cipherstash-proxy/src/postgresql/messages/data_row.rs
+++ b/packages/cipherstash-proxy/src/postgresql/messages/data_row.rs
@@ -1,11 +1,11 @@
 use super::{BackendCode, NULL};
 use crate::{
-    eql,
     error::{EncryptError, Error, ProtocolError},
     log::DECRYPT,
     postgresql::Column,
 };
 use bytes::{Buf, BufMut, BytesMut};
+use cipherstash_client::eql::EqlEncrypted;
 use std::io::Cursor;
 use tracing::{debug, error};
 
@@ -23,7 +23,7 @@ impl DataRow {
     pub fn as_ciphertext(
         &mut self,
         column_configuration: &Vec<Option<Column>>,
-    ) -> Vec<Option<eql::EqlEncrypted>> {
+    ) -> Vec<Option<EqlEncrypted>> {
         let mut result = vec![];
         for (data_column, column_config) in self.columns.iter_mut().zip(column_configuration) {
             let encrypted = column_config
@@ -175,7 +175,7 @@ impl TryFrom<DataColumn> for BytesMut {
     }
 }
 
-impl TryFrom<&mut DataColumn> for eql::EqlEncrypted {
+impl TryFrom<&mut DataColumn> for EqlEncrypted {
     type Error = Error;
 
     fn try_from(col: &mut DataColumn) -> Result<Self, Error> {
diff --git a/packages/cipherstash-proxy/src/proxy/encrypt_config/config.rs b/packages/cipherstash-proxy/src/proxy/encrypt_config/config.rs
index 65b758f0..3c2d493c 100644
--- a/packages/cipherstash-proxy/src/proxy/encrypt_config/config.rs
+++ b/packages/cipherstash-proxy/src/proxy/encrypt_config/config.rs
@@ -1,10 +1,10 @@
-use crate::{
-    eql,
-    error::{ConfigError, Error},
-};
-use cipherstash_client::schema::{
-    column::{Index, IndexType, TokenFilter, Tokenizer},
-    ColumnConfig, ColumnType,
+use crate::error::{ConfigError, Error};
+use cipherstash_client::{
+    eql::Identifier,
+    schema::{
+        column::{Index, IndexType, TokenFilter, Tokenizer},
+        ColumnConfig, ColumnType,
+    },
 };
 use serde::{Deserialize, Serialize};
 use std::{collections::HashMap, str::FromStr};
@@ -145,12 +145,12 @@ impl ColumnEncryptionConfig {
         self.tables.0.is_empty()
     }
 
-    pub fn into_config_map(self) -> HashMap<eql::Identifier, ColumnConfig> {
+    pub fn into_config_map(self) -> HashMap<Identifier, ColumnConfig> {
         let mut map = HashMap::new();
         for (table_name, columns) in self.tables.into_iter() {
             for (column_name, column) in columns.into_iter() {
                 let column_config = column.into_column_config(&column_name);
-                let key = eql::Identifier::new(&table_name, &column_name);
+                let key = Identifier::new(&table_name, &column_name);
                 map.insert(key, column_config);
             }
         }
@@ -192,12 +192,12 @@ impl Column {
 
 #[cfg(test)]
 mod tests {
-    use eql::Identifier;
+    use cipherstash_client::eql::Identifier;
     use serde_json::json;
 
     use super::*;
 
-    fn parse(json: serde_json::Value) -> HashMap<eql::Identifier, ColumnConfig> {
+    fn parse(json: serde_json::Value) -> HashMap<Identifier, ColumnConfig> {
         serde_json::from_value::<ColumnEncryptionConfig>(json)
             .map(|config| config.into_config_map())
             .expect("Error ok")
diff --git a/packages/cipherstash-proxy/src/proxy/encrypt_config/manager.rs b/packages/cipherstash-proxy/src/proxy/encrypt_config/manager.rs
index ed8bb44f..5bfc3014 100644
--- a/packages/cipherstash-proxy/src/proxy/encrypt_config/manager.rs
+++ b/packages/cipherstash-proxy/src/proxy/encrypt_config/manager.rs
@@ -1,11 +1,12 @@
 use crate::{
     config::DatabaseConfig,
-    connect, eql,
+    connect,
     error::{ConfigError, Error},
     log::ENCRYPT_CONFIG,
     proxy::ENCRYPT_CONFIG_QUERY,
 };
 use arc_swap::ArcSwap;
+use cipherstash_client::eql;
 use cipherstash_client::schema::ColumnConfig;
 use serde_json::Value;
 use std::{collections::HashMap, sync::Arc, time::Duration};
diff --git a/packages/cipherstash-proxy/src/proxy/zerokms/mod.rs b/packages/cipherstash-proxy/src/proxy/zerokms/mod.rs
index 35f10506..21cf4429 100644
--- a/packages/cipherstash-proxy/src/proxy/zerokms/mod.rs
+++ b/packages/cipherstash-proxy/src/proxy/zerokms/mod.rs
@@ -5,7 +5,6 @@ pub use zerokms::ZeroKms;
 
 use crate::{
     config::TandemConfig,
-    eql::{self, EqlEncryptedBody, EqlEncryptedIndexes},
     error::{EncryptError, Error},
     Identifier, EQL_SCHEMA_VERSION,
 };
@@ -14,6 +13,7 @@ use cipherstash_client::{
     config::EnvSource,
     credentials::{auto_refresh::AutoRefresh, ServiceCredentials},
     encryption::{Encrypted, EncryptedEntry, EncryptedSteVecTerm, IndexTerm, Plaintext},
+    eql::{self, EqlEncryptedBody, EqlEncryptedIndexes},
     zerokms::ClientKey,
     ConsoleConfig, CtsConfig, ZeroKMS, ZeroKMSConfig,
 };
@@ -134,6 +134,7 @@ pub(crate) fn to_eql_encrypted(
                         EncryptedSteVecTerm::OreVariable(ore) => {
                             ore_cclw_var_index = Some(hex::encode(&ore))
                         }
+                        _ => ore_cclw_var_index = None,
                     },
                     IndexTerm::SteQueryVec(_query) => {} // TODO: what do we do here?
                     IndexTerm::Null => {}
@@ -187,6 +188,7 @@ pub(crate) fn to_eql_encrypted(
                                 ore_cllw_var_8: Some(hex::encode(&ore)),
                                 ..Default::default()
                             },
+                            _ => EqlEncryptedIndexes::default(),
                         };
 
                         eql::EqlEncryptedBody {
diff --git a/packages/cipherstash-proxy/src/proxy/zerokms/zerokms.rs b/packages/cipherstash-proxy/src/proxy/zerokms/zerokms.rs
index c45e1d39..4c682d4e 100644
--- a/packages/cipherstash-proxy/src/proxy/zerokms/zerokms.rs
+++ b/packages/cipherstash-proxy/src/proxy/zerokms/zerokms.rs
@@ -1,6 +1,5 @@
 use crate::{
     config::TandemConfig,
-    eql,
     error::{EncryptError, Error, ZeroKMSError},
     log::{ENCRYPT, PROXY},
     postgresql::{Column, KeysetIdentifier},
@@ -10,6 +9,7 @@ use crate::{
 use cipherstash_client::{
     encryption::QueryOp,
     encryption::{Plaintext, PlaintextTarget, Queryable, ReferencedPendingPipeline},
+    eql,
 };
 use metrics::counter;
 use moka::future::Cache;