feat(prisma-example): convert the example app to EQL v3

Schema: every column is a concrete public.eql_v3_* domain
(EncryptedTextSearch / EncryptedDoubleOrd / EncryptedBigIntOrd /
EncryptedDateOrd / EncryptedBoolean / EncryptedJson); wiring via
cipherstashFromStackV3. Migrations regenerated from the v3 contract —
initial app migration carries zero add_search_config ops; the
cipherstash space ships both bundle baselines.

E2E suites adapted to the v3 surface and green from a wiped database
(7 files / 40 tests, live PG + ZeroKMS): equality/range/free-text
tokens, order-term sorting, JSON @> containment (positive, negative,
multi-key, nested, empty-needle rejection), lossless bigint beyond
MAX_SAFE_INTEGER, and eql_v3_boolean's storage-only operator refusal
pinned as a feature. README walkthrough e2e (repo-level) also green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: 2 people

.changeset/prisma-example-eql-v3.md

@@ -0,0 +1,5 @@
+---
+'@cipherstash/prisma-next-example': minor
+---
+
+Convert the example app to EQL v3. Every column is now a concrete `public.eql_v3_*` domain authored with the per-domain constructors (`EncryptedTextSearch`, `EncryptedDoubleOrd`, `EncryptedBigIntOrd`, `EncryptedDateOrd`, `EncryptedBoolean`, `EncryptedJson`), wired through `cipherstashFromStackV3({ contractJson })`. The e2e harness runs the full v3 surface against live Postgres + ZeroKMS with no skips: equality/range/free-text-token operators, `cipherstashV3Asc`/`Desc` order-term sorting, encrypted JSON containment (`cipherstashJsonContains` — the v2 `cipherstashJsonb*` helpers do not exist in v3), lossless `bigint` beyond `Number.MAX_SAFE_INTEGER`, and the storage-only `eql_v3_boolean` refusal (`EncryptionOperatorError`) pinned as a feature. Migrations regenerate from the v3 contract: the initial app migration creates the `users` table against the v3 domains with zero `add_search_config` ops, and the cipherstash space carries both bundle baselines (v2 + v3).

examples/prisma/README.md

@@ -1,8 +1,17 @@
 # @cipherstash/prisma-next example
 
-End-to-end demo of [`@cipherstash/prisma-next`](../../packages/prisma-next/README.md): searchable application-layer encryption for Postgres with [Prisma Next](https://www.npmjs.com/package/@prisma-next/cli), using [`@cipherstash/stack`](../../packages/stack/README.md) as the encryption SDK.
+End-to-end demo of [`@cipherstash/prisma-next`](../../packages/prisma-next/README.md): searchable application-layer encryption for Postgres with [Prisma Next](https://www.npmjs.com/package/@prisma-next/cli), using [`@cipherstash/stack`](../../packages/stack/README.md) as the encryption SDK — on **EQL v3**, where every encrypted column is a concrete `public.eql_v3_*` Postgres domain and the constructor you pick *is* the capability set.
 
-A single `User` model with one column per cipherstash codec (string, double, bigint, date, boolean, JSON), exercised end-to-end: insert, equality, free-text search, range, between, in-array, sort, and `decryptAll`-amortised read.
+A single `User` model with one column per plaintext family, exercised end-to-end: insert, equality, free-text token search, range, between, in-array, encrypted-order-term sort, JSON containment, and `decryptAll`-amortised read.
+
+| Column          | Constructor                       | Domain                | Query surface                          |
+| --------------- | --------------------------------- | --------------------- | -------------------------------------- |
+| `email`         | `cipherstash.EncryptedTextSearch()` | `eql_v3_text_search` | equality + order/range + free-text     |
+| `salary`        | `cipherstash.EncryptedDoubleOrd()`  | `eql_v3_double_ord`  | equality + order/range                 |
+| `accountId`     | `cipherstash.EncryptedBigIntOrd()`  | `eql_v3_bigint_ord`  | equality + order/range (true `bigint`) |
+| `birthday`      | `cipherstash.EncryptedDateOrd()`    | `eql_v3_date_ord`    | equality + order/range                 |
+| `emailVerified` | `cipherstash.EncryptedBoolean()`    | `eql_v3_boolean`     | storage-only (no operators)            |
+| `preferences`   | `cipherstash.EncryptedJson()`       | `eql_v3_json`        | `cipherstashJsonContains` (`@>`)       |
 
 📖 See the [Prisma Next encryption docs](https://cipherstash.com/docs/stack/cipherstash/encryption/prisma-next) for the full operator reference, security model, and known limitations.
 
@@ -11,12 +20,12 @@ A single `User` model with one column per cipherstash codec (string, double, big
 | Path                       | Purpose                                                                                       |
 | -------------------------- | --------------------------------------------------------------------------------------------- |
 | `docker-compose.yml`       | Local Postgres 16 on port 54338.                                                               |
-| `prisma/schema.prisma`     | Application schema (one `User` model exercising all six cipherstash codecs).                  |
+| `prisma/schema.prisma`     | Application schema (one `User` model exercising six cipherstash v3 domains).                  |
 | `prisma-next.config.ts`    | Wires `cipherstash` into `extensionPacks`.                                                    |
-| `src/db.ts`                | One-call setup via `cipherstashFromStack({ contractJson })`.                                  |
+| `src/db.ts`                | One-call setup via `cipherstashFromStackV3({ contractJson })`.                                |
 | `src/index.ts`             | The demo flow.                                                                                |
 | `src/prisma/contract.*`    | Emitted by `pnpm emit`.                                                                       |
-| `migrations/`              | Emitted by `pnpm migration:plan`.                                                             |
+| `migrations/`              | Emitted by `pnpm migration:plan` (app space + the cipherstash EQL bundle baselines).          |
 
 ## Prerequisites
 
@@ -33,7 +42,7 @@ docker compose up -d
 pnpm install
 pnpm emit                  # PSL → contract.{json,d.ts}
 pnpm migration:plan --name initial
-pnpm migration:apply       # installs EQL bundle + your app schema in one sweep (runs `prisma-next migrate`)
+pnpm migration:apply       # installs the EQL bundles + your app schema in one sweep (runs `prisma-next migrate`)
 pnpm start                 # runs the demo
 ```
 
@@ -52,40 +61,50 @@ pnpm install && pnpm emit && pnpm typecheck
 ## Expected output
 
 ```text
---- Insert (mixed-codec round-trip) ---
-Inserted 4 rows across six cipherstash codecs.
+--- Insert (mixed-domain round-trip) ---
+Inserted 4 rows across six cipherstash v3 domains.
 
---- cipherstashEq (string equality) ---
+--- cipherstashEq (text_search equality) ---
 Found 1 row(s) for alice@example.com.
   user-0: alice@example.com
 
---- cipherstashIlike (string free-text-search) ---
-Found 3 row(s) matching %@example.com.
+--- cipherstashIlike (text_search free-text tokens) ---
+Found 3 row(s) whose email contains example.com.
   user-0: alice@example.com
   user-1: bob@example.com
   user-2: carol@example.com
 
---- cipherstashGt (double order-and-range) ---
+--- cipherstashGt (double_ord order-and-range) ---
 Found 2 user(s) with salary > 100,000.
   user-1: salary=110000
   user-3: salary=145000
 
---- cipherstashBetween (date order-and-range) ---
+--- cipherstashBetween (date_ord order-and-range) ---
 Found 3 user(s) born between 1985 and 1995.
 
---- cipherstashInArray (bigint equality) ---
+--- cipherstashInArray (bigint_ord equality) ---
 Found 2 user(s) whose accountId is in the supplied array.
 
---- cipherstashInArray (boolean equality-only) ---
-Found 3 user(s) with emailVerified = true.
+--- eql_v3_boolean (storage-only round-trip) ---
+  user-2: emailVerified=false
+
+--- cipherstashJsonContains (encrypted jsonb @>) ---
+Found 2 user(s) with a dark-theme preference.
+  user-0: {"theme":"dark","notifications":true}
+  user-2: {"theme":"dark","notifications":true}
 
---- cipherstashAsc (bare-column ORDER BY) ---
+--- cipherstashV3Asc (encrypted order-term ORDER BY) ---
   user-0: email=alice@example.com
   user-1: email=bob@example.com
   user-2: email=carol@example.com
   user-3: email=dave@otherorg.test
 ```
 
+Two v3 behaviours worth noticing in that output:
+
+- **`cipherstashIlike` is bloom-filter token containment** (`eql_v3.contains`), not SQL `ILIKE` — the needle's tokens must appear in the ciphertext's index. Plain substrings like `example.com` are the idiomatic needle; `%` wildcards are not part of the model.
+- **`eql_v3_boolean` is storage-only.** It round-trips `true`/`false` losslessly but surfaces no search operators — calling one throws `EncryptionOperatorError`. Filter on a searchable column and decrypt the boolean from the result set.
+
 ## References
 
 - 📖 [Prisma Next encryption docs](https://cipherstash.com/docs/stack/cipherstash/encryption/prisma-next) — the canonical reference.