fix(prisma-next): wire the v3 ORM surface end-to-end

Gaps surfaced by converting the example app and driving the real CLI +
runtime rather than unit fixtures:

- CodecTypes/QueryOperationTypes cover all 40 v3 codec ids with
  trait-accurate operator visibility (cipherstash:v3-* marker traits;
  cipherstashJsonContains v3-only; storage-only domains surface no
  operator methods at the type level).
- The v3 runtime descriptor presents the pack id ('cipherstash') with
  v3's own version — the runtime matches contract extensionPacks by
  descriptor id, so the old distinct id failed startup with
  RUNTIME.MISSING_EXTENSION_PACK.
- Every v3 codec id registers a control-plane expandNativeType hook
  stripping the public. qualifier (the planner requires the hook for
  typeParams-carrying columns; bare names match introspected udt_name).
  No onFieldEvent — v3 emits zero add_search_config ops.
- The v3 bundle op is reclassified 'data': the integrity checker
  rejects self-edges without a data-class op.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: 2 people

.changeset/eql-v3-prisma-next.md

@@ -15,3 +15,8 @@
 - New `@cipherstash/prisma-next/v3` entry point: `cipherstashFromStackV3({ contractJson })` builds the v3 runtime descriptor, bulk-encrypt middleware, and a stack `EncryptionV3` client from the emitted contract.
 - Query operators (`cipherstashEq`, `cipherstashGt`, `cipherstashBetween`, `cipherstashInArray`, …) lower to `eql_v3.*` functions with operands cast to the domain's query type (`$n::eql_v3.query_<domain>`); `cipherstashIlike` maps to `eql_v3.contains` (bloom-filter token containment, not SQL `LIKE`); ordering uses `eql_v3.ord_term` / `eql_v3.ord_term_ore` by the column's ordering flavour. The domains are `public.eql_v3_*`; the operator functions live in the `eql_v3` schema.
 - A new baseline migration `20260601T0100_install_eql_v3_bundle` (invariant `cipherstash:install-eql-v3-bundle-v1`) installs the `public.eql_v3_*` domains and `eql_v3.*` functions from the pinned `@cipherstash/eql` release. Regenerate contracts and run migrations after changing constructors.
+- **The v3 ORM surface is fully wired end-to-end** (proven by converting `examples/prisma`):
+  - The generated `contract.d.ts` type surface covers every v3 codec id: `CodecTypes` gains all 40 `cipherstash/eql-v3/*@1` entries (envelope outputs — `number`-castAs domains decode to the new `EncryptedNumber` — plus trait-accurate operator visibility), and `QueryOperationTypes` gains `cipherstashJsonContains` and surfaces `cipherstashEq` / `cipherstashIlike` on v3 columns via type-level `cipherstash:v3-*` marker traits. Storage-only domains (including `EncryptedBoolean`) surface no operator methods at the type level, matching the runtime gate.
+  - The v3 runtime descriptor now presents the **pack id** (`cipherstash`) with v3's own version, so `postgres<Contract>({ extensions })` accepts contracts emitted by the cipherstash extension pack instead of failing with `RUNTIME.MISSING_EXTENSION_PACK`.
+  - Every v3 codec id registers a control-plane `expandNativeType` hook that strips the `public.` qualifier — `prisma-next migration plan` now renders `CREATE TABLE` columns as bare domain names (`eql_v3_bigint_ord`), matching what introspection reports, with **no `add_search_config` ops** (v3 domains carry their own index metadata). No `onFieldEvent` is registered for v3.
+  - The v3 bundle baseline migration op is reclassified `data` (it is a contract-shape-neutral self-edge; the aggregate integrity checker rejects self-edges without a data-class op), unblocking `prisma-next migration plan` / `migrate` in consuming apps.

packages/prisma-next/migrations/20260601T0100_install_eql_v3_bundle/migration.json

@@ -5,5 +5,5 @@
     "cipherstash:install-eql-v3-bundle-v1"
   ],
   "createdAt": "2026-07-14T20:10:24.325Z",
-  "migrationHash": "sha256:49917bcf99c88546e4edef9a6323a56045ea522313ee460674e0cc90d747b2c3"
+  "migrationHash": "sha256:d1ca5a987ab10eb85c2fe05700134b31f17f694d2d5b3df3969e902610b1d9cf"
 }

packages/prisma-next/migrations/20260601T0100_install_eql_v3_bundle/migration.ts

@@ -51,7 +51,19 @@ export default class M extends Migration {
       rawSql({
         id: 'cipherstash.install-eql-v3-bundle',
         label: INSTALL_LABEL,
-        operationClass: 'additive',
+        // `data`, not `additive`: this edge is a SELF-EDGE (`from ===
+        // to` — the bundle declares no contract-space storage), and the
+        // aggregate integrity checker (`migration-tools`
+        // `check-integrity.ts`) rejects a self-edge unless it carries a
+        // `data`-class op. Along the axis the checker classifies —
+        // does the op move the modeled contract shape? — `data` is the
+        // truthful answer: the bundle creates `public.eql_v3_*` domains
+        // and `eql_v3.*` functions the space contract deliberately does
+        // not model. (Contrast the v2 bundle op: `additive`, because
+        // its edge really moves the hash by adding the
+        // `eql_v2_configuration` table.) The `migrate` policy allows
+        // all four classes, so apply behaviour is unchanged.
+        operationClass: 'data',
         invariantId: CIPHERSTASH_V3_INVARIANTS.installBundle,
         target: { id: 'postgres' },
         precheck: [],

packages/prisma-next/migrations/20260601T0100_install_eql_v3_bundle/ops.json

@@ -2,7 +2,7 @@
   {
     "id": "cipherstash.install-eql-v3-bundle",
     "label": "Install EQL v3 bundle (eql-3.0.0: public.eql_v3_* domains + eql_v3.* functions)",
-    "operationClass": "additive",
+    "operationClass": "data",
     "invariantId": "cipherstash:install-eql-v3-bundle-v1",
     "target": {
       "id": "postgres"

packages/prisma-next/src/exports/control.ts

@@ -65,6 +65,7 @@ import {
   cipherstashJsonCodecHooks,
   cipherstashStringCodecHooks,
 } from '../migration/cipherstash-codec'
+import { cipherstashV3CodecControlHooks } from '../migration/cipherstash-codec-v3'
 
 const cipherstashContractSpace = contractSpaceFromJson<Contract<SqlStorage>>({
   contractJson,
@@ -76,9 +77,11 @@ const cipherstashContractSpace = contractSpaceFromJson<Contract<SqlStorage>>({
     },
     // The v3 bundle baseline — an invariant-only edge (`from === to`;
     // the bundle creates `public.eql_v3_*` domains + `eql_v3.*`
-    // functions but no contract-space storage). NO v3 codec id is
-    // registered in `controlPlaneHooks` below: that omission is what
-    // guarantees v3 columns emit no `add_search_config` /
+    // functions but no contract-space storage). The v3 codec ids ARE
+    // registered in `controlPlaneHooks` below, but with the identity
+    // `expandNativeType` ONLY (the planner requires the hook to exist
+    // for `typeParams`-carrying columns) — no `onFieldEvent`, which is
+    // what guarantees v3 columns emit no `add_search_config` /
     // `remove_search_config` ops.
     {
       dirName: CIPHERSTASH_V3_BASELINE_MIGRATION_NAME,
@@ -111,6 +114,9 @@ const cipherstashExtensionDescriptor: SqlControlExtensionDescriptor<'postgres'>
       codecTypes: {
         ...cipherstashPackMeta.types.codecTypes,
         controlPlaneHooks: {
+          // v3: identity expandNativeType only, no onFieldEvent — see
+          // `../migration/cipherstash-codec-v3.ts`.
+          ...cipherstashV3CodecControlHooks,
           [CIPHERSTASH_STRING_CODEC_ID]: cipherstashStringCodecHooks,
           [CIPHERSTASH_DOUBLE_CODEC_ID]: cipherstashDoubleCodecHooks,
           [CIPHERSTASH_BIGINT_CODEC_ID]: cipherstashBigIntCodecHooks,

packages/prisma-next/src/migration/cipherstash-codec-v3.ts

@@ -0,0 +1,71 @@
+/**
+ * Control-plane hooks for the EQL v3 codecs — a schema-stripping
+ * `expandNativeType` only, NO `onFieldEvent`.
+ *
+ * ## Why the hook must exist
+ *
+ * The Postgres planner requires an `expandNativeType` hook to EXIST for
+ * any column that carries `typeParams` (`expandParameterizedTypeSql` in
+ * target-postgres's `planner-ddl-builders.ts` throws otherwise), and
+ * every v3 column carries the static `{ castAs, capabilities }`
+ * typeParams block that v3 authoring emits.
+ *
+ * ## Why it strips `public.` instead of the v2 identity expansion
+ *
+ * The v3 contract `nativeType` is the schema-qualified domain
+ * (`public.eql_v3_bigint_ord`), and BOTH downstream consumers of this
+ * hook want the bare name:
+ *
+ *   - **DDL** (`buildColumnTypeSql`): an identity return means "no
+ *     expansion" and falls through to `assertSafeNativeType`, whose
+ *     `/^[a-zA-Z][a-zA-Z0-9_ ]*(\[\])?$/` pattern rejects the dot. The
+ *     stripped name renders `CREATE TABLE ... "x" eql_v3_bigint_ord`,
+ *     which resolves to the `public` schema via the search path — the
+ *     bundle creates every v3 domain in `public` by design.
+ *   - **Schema verify** (`renderExpectedNativeType`): the expected type
+ *     is compared against the introspected column's `udt_name`, which
+ *     Postgres reports UNQUALIFIED (`eql_v3_bigint_ord`). The stripped
+ *     name is exactly that spelling, so post-apply verification and
+ *     re-plan diffs see the column as clean.
+ *
+ * ## Deliberately NO `onFieldEvent`
+ *
+ * v3 needs no per-column search configuration (no
+ * `eql_v2.add_search_config` analogue exists — the domain itself
+ * carries the index metadata), so added/dropped/altered v3 columns
+ * contribute zero extra migration ops. `test/v3/migration-v3.test.ts`
+ * and the example app's e2e suite pin the absence of search-config ops
+ * end-to-end.
+ */
+
+import type { CodecControlHooks } from '@prisma-next/family-sql/control'
+import {
+  CIPHERSTASH_V3_CODEC_IDS,
+  type CipherstashV3CodecId,
+} from '../extension-metadata/constants-v3'
+
+const PUBLIC_SCHEMA_PREFIX = 'public.'
+
+const stripPublicSchema: NonNullable<CodecControlHooks['expandNativeType']> = ({
+  nativeType,
+}) =>
+  nativeType.startsWith(PUBLIC_SCHEMA_PREFIX)
+    ? nativeType.slice(PUBLIC_SCHEMA_PREFIX.length)
+    : nativeType
+
+const v3Hooks: CodecControlHooks = { expandNativeType: stripPublicSchema }
+
+/**
+ * One hooks entry per pinned v3 codec id, all sharing the
+ * schema-stripping `expandNativeType`. Spread into the control
+ * descriptor's `types.codecTypes.controlPlaneHooks` alongside the six
+ * v2 entries.
+ */
+export const cipherstashV3CodecControlHooks: Readonly<
+  Record<CipherstashV3CodecId, CodecControlHooks>
+> = Object.fromEntries(
+  CIPHERSTASH_V3_CODEC_IDS.map((codecId) => [codecId, v3Hooks]),
+  // Object.fromEntries widens keys to `string`; the entries are exactly
+  // the pinned `CIPHERSTASH_V3_CODEC_IDS` tuple, so the record type
+  // holds by construction.
+) as Record<CipherstashV3CodecId, CodecControlHooks>