test(prisma-next): v3 live-PG integration + bundling isolation pins

Bundling isolation (test/bundling-isolation.test.ts):
- v3.js joins the entry existence check and is pinned against both the
  contract-space artefacts (RUNTIME_FORBIDDEN) and the v2 wire plane
- content-fingerprinted wire markers (encodeEqlV2EncryptedWire /
  makeCipherstashCellCodec vs CipherstashV3CellCodec /
  createV3CodecDescriptors / bulkEncryptMiddlewareV3): no code-split
  chunk may reference both wire planes, the v3 entry graph never
  reaches the v2 codec-runtime chunk, and middleware.js (v2-only
  entry) never loads the v3 wire

Live-PG suites (test/live/, self-skipping via describeLivePg when
CS creds — env vars or ~/.cipherstash profile — or DATABASE_URL are
absent; `pnpm test:live` convenience script added):
- helpers: live-gate (skip posture), eql-v3 (advisory-locked
  installEqlV3IfNeeded over the Task-8 migration source SQL), harness
  (real cipherstashFromStackV3 + real bulkEncryptMiddlewareV3 driven
  through real execution plans, operator SELECTs lowered by the real
  postgres adapter, envelope fromInternal().decrypt() read path)
- operators-live-pg: eq/ne/inArray, contains (ilike), gt/lte/between,
  date + timestamp ranges, ord_term ordering, JSON containment
  (@> with eql_v3.query_jsonb — ruled decision 2), per-family decrypt
- operators-null-live-pg: NULL cells round-trip, null operands rejected
- boolean-storage-live-pg: storage-only round-trip, operators refuse
- bigint-live-pg: lossless bigint beyond MAX_SAFE_INTEGER, eq/range/order
- migration-apply-live-pg: applied SQL is byte-identical to the shipped
  ops.json, invariant id, domains + eql_v3 schema, op postchecks, no
  add_search_config
- bulk-encrypt-live-pg: real EncryptionV3 through the real middleware,
  JSONB cells, ciphertext stamping, decrypt round-trip
- side-by-side-clients-live-pg: v2 and v3 clients coexisting in-process
  against one database, distinct extension identities and wires

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: calvinbrewer

packages/prisma-next/package.json

@@ -77,6 +77,7 @@
 		"dev": "tsup --watch",
 		"test": "vitest run",
 		"test:coverage": "vitest run --coverage",
+		"test:live": "vitest run test/live",
 		"typecheck": "tsc --project tsconfig.json --noEmit",
 		"lint": "biome check . --error-on-warnings",
 		"lint:fix": "biome check --write .",
@@ -109,6 +110,7 @@
 		"@prisma-next/target-postgres": "0.14.0",
 		"fast-check": "^4.8.0",
 		"pathe": "^2.0.3",
+		"postgres": "^3.4.8",
 		"tsup": "catalog:repo",
 		"typescript": "catalog:repo",
 		"vitest": "catalog:repo"

packages/prisma-next/test/bundling-isolation.test.ts

@@ -36,15 +36,20 @@
  * the current source.
  */
 
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync, readdirSync, readFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 import { dirname, join } from 'pathe'
 import { describe, expect, it } from 'vitest'
 
 const PACKAGE_ROOT = dirname(dirname(fileURLToPath(import.meta.url)))
 const DIST = join(PACKAGE_ROOT, 'dist')
 
-const ENTRY_FILES = ['control.js', 'runtime.js', 'middleware.js'] as const
+const ENTRY_FILES = [
+  'control.js',
+  'runtime.js',
+  'middleware.js',
+  'v3.js',
+] as const
 
 /**
  * Forbidden in `control.js` and its transitive chunk graph.
@@ -154,6 +159,35 @@ const ALLOWED_SHARED_CHUNK_MARKER_SETS: ReadonlyArray<readonly string[]> = [
   ['V3_DOMAIN_META_BY_CODEC_ID', 'V3_FACTORY_BY_NATIVE_TYPE', 'toV3CodecId'],
 ] as const
 
+/**
+ * Fingerprints of the v2 WIRE plane — the composite-literal codec
+ * (`encodeEqlV2EncryptedWire` produces the `("...")` wire) and the v2
+ * cell-codec factory built on it. A v3 consumer must never load either:
+ * the v3 wire is plain JSONB (`v3ToDriver`), and mixing the two wire
+ * planes in one module graph is exactly the confusion decision 1b
+ * (a client is v2 or v3, never both) exists to prevent.
+ *
+ * Marker choice notes: `bulkEncryptMiddleware` and `cipherstashFromStack`
+ * are NOT usable as v2 markers — they are substrings of their v3
+ * siblings (`bulkEncryptMiddlewareV3`, `cipherstashFromStackV3`), so a
+ * substring scan would false-positive on every v3 chunk.
+ */
+const V2_WIRE_MARKERS = [
+  'encodeEqlV2EncryptedWire',
+  'makeCipherstashCellCodec',
+] as const
+
+/**
+ * Fingerprints of the v3 WIRE plane — the plain-JSONB cell codec, the
+ * per-domain descriptor factory, and the v3 bulk-encrypt middleware.
+ * A v2-only consumer (the `./middleware` entry) must never load these.
+ */
+const V3_WIRE_MARKERS = [
+  'CipherstashV3CellCodec',
+  'createV3CodecDescriptors',
+  'bulkEncryptMiddlewareV3',
+] as const
+
 interface ChunkFile {
   readonly file: string
   readonly body: string
@@ -258,6 +292,92 @@ describe('bundling isolation', () => {
     ).toEqual([])
   })
 
+  it('v3.js does not pull contract-space artefacts', () => {
+    const entry = readChunk('v3.js')
+    const leaks = findLeaksInEntry(entry, RUNTIME_FORBIDDEN)
+    expect(leaks, `v3 entry leaks: ${leaks.join(', ')}`).toEqual([])
+  })
+
+  it('v3.js does not pull the v2 composite-literal wire', () => {
+    const entry = readChunk('v3.js')
+    const leaks = findLeaksInEntry(entry, V2_WIRE_MARKERS)
+    expect(leaks, `v3 entry leaks v2 wire: ${leaks.join(', ')}`).toEqual([])
+  })
+
+  it('the v3 entry graph never reaches the v2 codec-runtime chunk', () => {
+    // `v3.js` legitimately shares the version-neutral execution chunk
+    // (envelope base/classes, routing, abort, `stampRoutingKeysFromAst`)
+    // with the v2 entries — that chunk currently also DEFINES the v2
+    // wire encoder, which the per-chunk disjointness test below pins.
+    // What must never happen is the v3 graph importing the v2
+    // codec-RUNTIME chunk (the six `createCipherstash*Codec` factories
+    // built on the composite wire).
+    const v3Chunks = collectGraph('v3.js')
+    const offenders = [...v3Chunks.entries()]
+      .filter(([file]) => file !== 'v3.js')
+      .filter(([, chunk]) =>
+        chunk.body.includes('createCipherstashStringCodec'),
+      )
+      .map(([file]) => file)
+    expect(
+      offenders,
+      `v3 graph reaches v2 codec-runtime chunk(s): ${offenders.join(', ')}`,
+    ).toEqual([])
+  })
+
+  it('middleware.js (v2 bulk-encrypt entry) does not pull the v3 wire plane', () => {
+    const entry = readChunk('middleware.js')
+    const leaks = findLeaksInEntry(entry, V3_WIRE_MARKERS)
+    expect(
+      leaks,
+      `middleware entry leaks v3 wire: ${leaks.join(', ')}`,
+    ).toEqual([])
+  })
+
+  it('no code-split chunk mixes the v2 composite wire with the v3 JSONB wire', () => {
+    // Chunk-level two-wires-never-co-located pin. A chunk "references a
+    // wire plane" when any of that plane's marker identifiers appears in
+    // its body — which covers both defining the symbol and importing it
+    // by name from another chunk (`import { encodeEqlV2EncryptedWire }
+    // from "./chunk-*.js"`). Entry files are exempt: `runtime.js` and
+    // `stack.js` deliberately aggregate the v2 AND v3 public API (each
+    // client picks one at construction time); the invariant is that no
+    // shared IMPLEMENTATION chunk fuses the two wire codecs, which is
+    // what would let one wire's encode path silently reach the other's
+    // consumers.
+    const chunkFiles = readdirSync(DIST).filter((f) =>
+      SHARED_CHUNK_PATTERN.test(f),
+    )
+    expect(chunkFiles.length).toBeGreaterThan(0)
+    const mixed = chunkFiles.filter((file) => {
+      const body = readChunk(file).body
+      const referencesV2Wire = V2_WIRE_MARKERS.some((m) => body.includes(m))
+      const referencesV3Wire = V3_WIRE_MARKERS.some((m) => body.includes(m))
+      return referencesV2Wire && referencesV3Wire
+    })
+    expect(
+      mixed,
+      `chunk(s) mix v2 and v3 wire planes: ${mixed.join(', ')}`,
+    ).toEqual([])
+  })
+
+  it('v3-wire chunks reachable from runtime.js never reference the v2 composite encoder', () => {
+    // The plan's original Task-10 assertion, made chunk-name-agnostic:
+    // identify v3 chunks by CONTENT (they carry a v3 wire marker), not
+    // by tsup's hash-named files.
+    const runtimeChunks = collectGraph('runtime.js')
+    for (const [file, chunk] of runtimeChunks) {
+      if (file === 'runtime.js') continue
+      const isV3WireChunk = V3_WIRE_MARKERS.some((m) => chunk.body.includes(m))
+      if (!isV3WireChunk) continue
+      const leaks = V2_WIRE_MARKERS.filter((m) => chunk.body.includes(m))
+      expect(
+        leaks,
+        `v3 chunk ${file} references v2 wire: ${leaks.join(', ')}`,
+      ).toEqual([])
+    }
+  })
+
   it('control vs middleware chunk graphs are disjoint (modulo shared constants chunk)', () => {
     const controlChunks = new Set(collectGraph('control.js').keys())
     const middlewareChunks = new Set(collectGraph('middleware.js').keys())

packages/prisma-next/test/live/bigint-live-pg.test.ts

@@ -0,0 +1,179 @@
+/**
+ * Live-PG bigint family: `public.eql_v3_bigint` (storage-only),
+ * `eql_v3_bigint_eq` (equality), `eql_v3_bigint_ord` (equality +
+ * order/range). Proves a JS `bigint` plaintext survives losslessly —
+ * including a value ABOVE `Number.MAX_SAFE_INTEGER`, which a
+ * number-typed pipeline would corrupt — and that the encrypted
+ * ordering terms order the real domain correctly.
+ */
+
+import type postgres from 'postgres'
+import { afterAll, beforeAll, expect, it } from 'vitest'
+import { EncryptedBigInt } from '../../src/execution/envelope-bigint'
+import { cipherstashV3Asc } from '../../src/v3/operators-v3'
+import {
+  callOperator,
+  columnAccessorV3,
+  getOperator,
+} from '../v3/operator-lowering-v3.helpers'
+import { installEqlV3IfNeeded } from './helpers/eql-v3'
+import {
+  BIGINT_EQ,
+  BIGINT_ORD,
+  BIGINT_STORAGE,
+  createLiveTable,
+  decryptCell,
+  insertEncryptedRows,
+  type LiveV3Client,
+  liveConnection,
+  liveV3Contract,
+  runLoweredSelect,
+  selectCell,
+  selectIdsOrderBy,
+  selectIdsWhere,
+  setupLiveV3,
+} from './helpers/harness'
+import { describeLivePg } from './helpers/live-gate'
+
+const TABLE = 'pn_v3_live_bigint'
+const COLUMNS = {
+  balance: BIGINT_STORAGE,
+  balance_eq: BIGINT_EQ,
+  balance_ord: BIGINT_ORD,
+} as const
+const contract = liveV3Contract(TABLE, COLUMNS)
+
+// 2^53 + 1: NOT representable as a JS number. Losslessness here proves
+// the pipeline is bigint end-to-end (protect-ffi's eqlVersion-3 int8).
+const UNSAFE_BIG = 9_007_199_254_740_993n
+
+const SEED = [
+  { id: 'small', value: 42n },
+  { id: 'negative', value: -7n },
+  { id: 'huge', value: UNSAFE_BIG },
+] as const
+
+describeLivePg('v3 bigint domains against live Postgres', () => {
+  let sql: postgres.Sql
+  let live: LiveV3Client
+
+  beforeAll(async () => {
+    sql = liveConnection()
+    await installEqlV3IfNeeded(sql)
+    await createLiveTable(sql, TABLE, COLUMNS)
+    live = await setupLiveV3(contract)
+    await insertEncryptedRows(
+      sql,
+      live.middleware,
+      TABLE,
+      SEED.map((row) => ({
+        id: row.id,
+        cells: {
+          balance: {
+            codecId: BIGINT_STORAGE,
+            value: EncryptedBigInt.from(row.value),
+          },
+          balance_eq: {
+            codecId: BIGINT_EQ,
+            value: EncryptedBigInt.from(row.value),
+          },
+          balance_ord: {
+            codecId: BIGINT_ORD,
+            value: EncryptedBigInt.from(row.value),
+          },
+        },
+      })),
+    )
+  }, 240_000)
+
+  afterAll(async () => {
+    if (sql) await sql.end()
+  })
+
+  it('decrypts to a JS bigint, losslessly, beyond Number.MAX_SAFE_INTEGER', async () => {
+    for (const column of ['balance', 'balance_eq', 'balance_ord'] as const) {
+      const decrypted = await decryptCell(live.sdk, EncryptedBigInt, {
+        cell: await selectCell(sql, TABLE, column, 'huge'),
+        table: TABLE,
+        column,
+      })
+      expect(typeof decrypted, `${column} must decrypt to bigint`).toBe(
+        'bigint',
+      )
+      expect(decrypted).toBe(UNSAFE_BIG)
+    }
+
+    const negative = await decryptCell(live.sdk, EncryptedBigInt, {
+      cell: await selectCell(sql, TABLE, 'balance', 'negative'),
+      table: TABLE,
+      column: 'balance',
+    })
+    expect(negative).toBe(-7n)
+  }, 60_000)
+
+  it('cipherstashEq on bigint_eq selects exactly the matching row', async () => {
+    const result = await runLoweredSelect(
+      sql,
+      live.middleware,
+      contract,
+      selectIdsWhere(
+        TABLE,
+        callOperator(
+          getOperator('cipherstashEq'),
+          columnAccessorV3(TABLE, 'balance_eq', BIGINT_EQ),
+          UNSAFE_BIG,
+        ),
+      ),
+    )
+    expect(result.sql).toContain('::eql_v3.query_bigint_eq')
+    expect(result.ids).toEqual(['huge'])
+  }, 60_000)
+
+  it('range predicates on bigint_ord respect numeric order across the huge value', async () => {
+    const ord = () => columnAccessorV3(TABLE, 'balance_ord', BIGINT_ORD)
+    const gt = await runLoweredSelect(
+      sql,
+      live.middleware,
+      contract,
+      selectIdsWhere(
+        TABLE,
+        callOperator(getOperator('cipherstashGt'), ord(), 42n),
+      ),
+    )
+    expect(gt.ids).toEqual(['huge'])
+
+    const between = await runLoweredSelect(
+      sql,
+      live.middleware,
+      contract,
+      selectIdsWhere(
+        TABLE,
+        callOperator(getOperator('cipherstashBetween'), ord(), -100n, 100n),
+      ),
+    )
+    expect(between.ids.sort()).toEqual(['negative', 'small'])
+  }, 60_000)
+
+  it('orders by the encrypted order term in numeric order', async () => {
+    const asc = await runLoweredSelect(
+      sql,
+      live.middleware,
+      contract,
+      selectIdsOrderBy(TABLE, [
+        cipherstashV3Asc(columnAccessorV3(TABLE, 'balance_ord', BIGINT_ORD)),
+      ]),
+    )
+    expect(asc.sql).toContain('eql_v3.ord_term')
+    expect(asc.ids).toEqual(['negative', 'small', 'huge'])
+  }, 60_000)
+
+  it('the storage-only bigint domain refuses search operators', () => {
+    expect(() =>
+      callOperator(
+        getOperator('cipherstashEq'),
+        columnAccessorV3(TABLE, 'balance', BIGINT_STORAGE),
+        42n,
+      ),
+    ).toThrow(/equality/)
+  })
+})