Type: bytes (inline binary — hashes, signatures, key material)

[rrrodzilla]

Workstream: Type system · Part of #89

Context

CEL has a distinct bytes type. SchemaForge has File (out-of-band S3 blob) and Text, but no inline binary type. For this platform — PASETO, schema signing, trust bundles, ed25519 — inline binary (hashes, signatures, key material, nonces) is first-class data that today must be base64'd into Text, losing the type.

Scope

• New FieldType + DynamicValue variant for inline bytes with a max-size constraint.
• DSL literal (b"..."), size(), concat, base64 encode/decode in rules.

Acceptance

• A bytes field round-trips; rules can operate on it (size/compare/base64).

---

Dependencies: Parallelizable now — independent of the substrate decision. Soft.

[rrrodzilla]

Landed in e4d1f8e — feat(types): add first-class bytes field type (#97).

End-to-end inline bytes type (hashes, signatures, key material, nonces — first-class for PASETO/signing/ed25519), modeled on the #96 precedent:

• core: FieldType::Bytes(BytesConstraints { max_size }) + DynamicValue::Bytes(Vec<u8>); shared types/base64.rs codec (standard-padded + a cel-spec padding-indifferent decoder), single source reused everywhere.
• DSL: bytes / bytes(max: N) + round-trip.
• cel: real bidirectional bridge (replaced Unsupported("bytes")); Integration: apply-time type-checking of rule expressions against schema field types #104 infers/accepts CelType::Bytes; new base64.encode/base64.decode stdlib (cel-spec encoders extension — decode is fail-closed, errors not panics; encoders conformance 4/4; total 1083→1146).
• storage: Postgres BYTEA + CHECK (octet_length <= N); SurrealDB native bytes. Oversize is rejected fail-closed (422) on both backends — never truncated or silently stored.
• acton REST: standard base64 (padded) JSON wire form both directions; invalid base64 or oversize → 422.

base64 = "0.22.1" added to schema-forge-cel and schema-forge-core (pure-Rust, FIPS/airgap-clean). Verified: clippy -D warnings clean; full workspace 2094 tests pass under --features surrealdb.