docs(prisma-next): changeset for EQL v3 per-domain authoring surface

Also a stack changeset for the new eql/v3 barrel exports, and the
AGENTS.md repository-layout line updated for the v2/v3 split.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: 2 people

.changeset/eql-v3-prisma-next.md

@@ -0,0 +1,17 @@
+---
+'@cipherstash/prisma-next': minor
+---
+
+**Breaking:** EQL v3 columns are now authored through **concrete per-domain constructors** — the constructor you choose *is* the capability set. The legacy boolean-option surface (`EncryptedString({ equality, freeTextSearch, orderAndRange })`) is not carried into v3.
+
+- New per-domain constructors, one per exposed `public.eql_v3_*` domain:
+  - Text: `EncryptedText` (storage), `EncryptedTextEq`, `EncryptedTextOrd` (eq + order/range), `EncryptedTextMatch` (free-text), `EncryptedTextSearch` (eq + free-text + order/range).
+  - Scalars (Integer, Smallint, BigInt, Numeric, Real, Double, Date, Timestamp): `Encrypted<Fam>` (storage), `Encrypted<Fam>Eq`, `Encrypted<Fam>Ord`.
+  - `EncryptedBoolean` — storage-only (`public.eql_v3_boolean`); there is no boolean equality constructor.
+  - `EncryptedJson` — searchable encrypted JSONB (`public.eql_v3_json`, `ste_vec`), queried with `cipherstashJsonContains` (`@>` containment).
+- **Impossible capability combinations have no constructor** (e.g. text equality + free-text without order/range) — they are unrepresentable, not runtime errors.
+- **BigInt is a first-class v3 family** (`EncryptedBigInt` / `EncryptedBigIntEq` / `EncryptedBigIntOrd`, JS `bigint` plaintext, backed by `public.eql_v3_bigint*`).
+- Use the `*V2` constructors (`EncryptedStringV2`, `EncryptedDoubleV2`, `EncryptedBigIntV2`, `EncryptedDateV2`, `EncryptedBooleanV2`, `EncryptedJsonV2`) to keep EQL v2 columns. A client is v2 or v3 — the two runtime descriptors are never co-registered.
+- New `@cipherstash/prisma-next/v3` entry point: `cipherstashFromStackV3({ contractJson })` builds the v3 runtime descriptor, bulk-encrypt middleware, and a stack `EncryptionV3` client from the emitted contract.
+- Query operators (`cipherstashEq`, `cipherstashGt`, `cipherstashBetween`, `cipherstashInArray`, …) lower to `eql_v3.*` functions with operands cast to the domain's query type (`$n::eql_v3.query_<domain>`); `cipherstashIlike` maps to `eql_v3.contains` (bloom-filter token containment, not SQL `LIKE`); ordering uses `eql_v3.ord_term` / `eql_v3.ord_term_ore` by the column's ordering flavour. The domains are `public.eql_v3_*`; the operator functions live in the `eql_v3` schema.
+- A new baseline migration `20260601T0100_install_eql_v3_bundle` (invariant `cipherstash:install-eql-v3-bundle-v1`) installs the `public.eql_v3_*` domains and `eql_v3.*` functions from the pinned `@cipherstash/eql` release. Regenerate contracts and run migrations after changing constructors.

.changeset/eql-v3-stack-domain-registry-exports.md

@@ -0,0 +1,9 @@
+---
+'@cipherstash/stack': minor
+---
+
+Export `DOMAIN_REGISTRY`, `factoryForDomain`, `stripDomainSchema`, and the
+`V3ColumnFactory` type from `@cipherstash/stack/eql/v3`. These let integration
+adapters (e.g. `@cipherstash/prisma-next`) derive the full EQL v3 domain
+catalog — native types, capabilities, cast kinds, and indexes — from the stack
+instead of hand-maintaining a copy.

AGENTS.md

@@ -81,7 +81,7 @@ If these variables are missing, tests that require live encryption will fail or
 - `packages/cli`: The `stash` CLI — auth, init, encryption schema, and database setup (`stash eql install`). Has its own `AGENTS.md`.
 - `packages/wizard`: AI-powered encryption setup (`@cipherstash/wizard`)
 - `packages/migrate`: Plaintext-to-encrypted column migration (`@cipherstash/migrate`) — resumable backfill, per-column state
-- `packages/prisma-next`: Prisma Next integration (`@cipherstash/prisma-next`) — searchable field-level encryption for Postgres
+- `packages/prisma-next`: Prisma Next integration (`@cipherstash/prisma-next`) — searchable field-level encryption for Postgres. EQL v2 (`*V2` constructors, `cipherstashFromStack`) and EQL v3 (per-domain constructors, `./v3` entry with `cipherstashFromStackV3`)
 - `packages/stack-drizzle`: Drizzle ORM integration (`@cipherstash/stack-drizzle`), depends on `@cipherstash/stack` — EQL v2 (`.`) and EQL v3 (`./v3`). Split out of `@cipherstash/stack`.
 - `packages/stack-supabase`: Supabase integration (`@cipherstash/stack-supabase`), depends on `@cipherstash/stack` — `encryptedSupabase` (v2) and `encryptedSupabaseV3` (v3). Split out of `@cipherstash/stack`.
 - `packages/schema`: Schema builder utilities and types (`encryptedTable`, `encryptedColumn`, `encryptedField`)