feat(prisma-example): adopt the eql* operator surface, regenerate the contract

Rename every v3 operator call to the EQL-derived vocabulary (eqlEq,
eqlMatch, eqlAsc/eqlDesc, …), fully qualify the README's domain table
(public.eql_v3_*), describe free-text search as fuzzy bloom token
matching under its real needle semantics, drop the removed
cipherstashNotIlike coverage, add a direct dotenv/config import to the
str-range suite, and remove the type-erasing probe assertions in the
bool suite. pnpm emit regenerates contract.{json,d.ts} — the
extensionPacks.cipherstash block now carries the 40 v3 codec instances
and storage rows.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: 2 people

.changeset/prisma-example-eql-v3.md

@@ -2,4 +2,4 @@
 '@cipherstash/prisma-next-example': minor
 ---
 
-Convert the example app to EQL v3. Every column is now a concrete `public.eql_v3_*` domain authored with the per-domain constructors (`EncryptedTextSearch`, `EncryptedDoubleOrd`, `EncryptedBigIntOrd`, `EncryptedDateOrd`, `EncryptedBoolean`, `EncryptedJson`), wired through `cipherstashFromStackV3({ contractJson })`. The e2e harness runs the full v3 surface against live Postgres + ZeroKMS with no skips: equality/range/free-text-token operators, `cipherstashV3Asc`/`Desc` order-term sorting, encrypted JSON containment (`cipherstashJsonContains` — the v2 `cipherstashJsonb*` helpers do not exist in v3), lossless `bigint` beyond `Number.MAX_SAFE_INTEGER`, and the storage-only `eql_v3_boolean` refusal (`EncryptionOperatorError`) pinned as a feature. Migrations regenerate from the v3 contract: the initial app migration creates the `users` table against the v3 domains with zero `add_search_config` ops, and the cipherstash space carries both bundle baselines (v2 + v3).
+Convert the example app to EQL v3. Every column is now a concrete `public.eql_v3_*` domain authored with the per-domain constructors (`EncryptedTextSearch`, `EncryptedDoubleOrd`, `EncryptedBigIntOrd`, `EncryptedDateOrd`, `EncryptedBoolean`, `EncryptedJson`), wired through `cipherstashFromStackV3({ contractJson })`. The e2e harness runs the full v3 surface against live Postgres + ZeroKMS with no skips: the `eql*` operator vocabulary (equality/range plus `eqlMatch` free-text token search), `eqlAsc`/`eqlDesc` order-term sorting, encrypted JSON containment (`eqlJsonContains` — the v2 `cipherstashJsonb*` helpers do not exist in v3), lossless `bigint` beyond `Number.MAX_SAFE_INTEGER`, and the storage-only `eql_v3_boolean` refusal (`EncryptionOperatorError`) pinned as a feature. Migrations regenerate from the v3 contract: the initial app migration creates the `users` table against the v3 domains with zero `add_search_config` ops, and the cipherstash space carries both bundle baselines (v2 + v3).

examples/prisma/README.md

@@ -4,14 +4,14 @@ End-to-end demo of [`@cipherstash/prisma-next`](../../packages/prisma-next/READM
 
 A single `User` model with one column per plaintext family, exercised end-to-end: insert, equality, free-text token search, range, between, in-array, encrypted-order-term sort, JSON containment, and `decryptAll`-amortised read.
 
-| Column          | Constructor                       | Domain                | Query surface                          |
-| --------------- | --------------------------------- | --------------------- | -------------------------------------- |
-| `email`         | `cipherstash.EncryptedTextSearch()` | `eql_v3_text_search` | equality + order/range + free-text     |
-| `salary`        | `cipherstash.EncryptedDoubleOrd()`  | `eql_v3_double_ord`  | equality + order/range                 |
-| `accountId`     | `cipherstash.EncryptedBigIntOrd()`  | `eql_v3_bigint_ord`  | equality + order/range (true `bigint`) |
-| `birthday`      | `cipherstash.EncryptedDateOrd()`    | `eql_v3_date_ord`    | equality + order/range                 |
-| `emailVerified` | `cipherstash.EncryptedBoolean()`    | `eql_v3_boolean`     | storage-only (no operators)            |
-| `preferences`   | `cipherstash.EncryptedJson()`       | `eql_v3_json`        | `cipherstashJsonContains` (`@>`)       |
+| Column          | Constructor                       | Domain                      | Query surface                          |
+| --------------- | --------------------------------- | --------------------------- | -------------------------------------- |
+| `email`         | `cipherstash.EncryptedTextSearch()` | `public.eql_v3_text_search` | equality + order/range + free-text (`eqlMatch`) |
+| `salary`        | `cipherstash.EncryptedDoubleOrd()`  | `public.eql_v3_double_ord`  | equality + order/range                 |
+| `accountId`     | `cipherstash.EncryptedBigIntOrd()`  | `public.eql_v3_bigint_ord`  | equality + order/range (true `bigint`) |
+| `birthday`      | `cipherstash.EncryptedDateOrd()`    | `public.eql_v3_date_ord`    | equality + order/range                 |
+| `emailVerified` | `cipherstash.EncryptedBoolean()`    | `public.eql_v3_boolean`     | storage-only (no operators)            |
+| `preferences`   | `cipherstash.EncryptedJson()`       | `public.eql_v3_json`        | `eqlJsonContains` (`@>`)               |
 
 📖 See the [Prisma Next encryption docs](https://cipherstash.com/docs/stack/cipherstash/encryption/prisma-next) for the full operator reference, security model, and known limitations.
 
@@ -64,36 +64,36 @@ pnpm install && pnpm emit && pnpm typecheck
 --- Insert (mixed-domain round-trip) ---
 Inserted 4 rows across six cipherstash v3 domains.
 
---- cipherstashEq (text_search equality) ---
+--- eqlEq (text_search equality) ---
 Found 1 row(s) for alice@example.com.
   user-0: alice@example.com
 
---- cipherstashIlike (text_search free-text tokens) ---
+--- eqlMatch (text_search free-text tokens) ---
 Found 3 row(s) whose email contains example.com.
   user-0: alice@example.com
   user-1: bob@example.com
   user-2: carol@example.com
 
---- cipherstashGt (double_ord order-and-range) ---
+--- eqlGt (double_ord order-and-range) ---
 Found 2 user(s) with salary > 100,000.
   user-1: salary=110000
   user-3: salary=145000
 
---- cipherstashBetween (date_ord order-and-range) ---
+--- eqlBetween (date_ord order-and-range) ---
 Found 3 user(s) born between 1985 and 1995.
 
---- cipherstashInArray (bigint_ord equality) ---
+--- eqlIn (bigint_ord equality) ---
 Found 2 user(s) whose accountId is in the supplied array.
 
 --- eql_v3_boolean (storage-only round-trip) ---
   user-2: emailVerified=false
 
---- cipherstashJsonContains (encrypted jsonb @>) ---
+--- eqlJsonContains (encrypted jsonb @>) ---
 Found 2 user(s) with a dark-theme preference.
   user-0: {"theme":"dark","notifications":true}
   user-2: {"theme":"dark","notifications":true}
 
---- cipherstashV3Asc (encrypted order-term ORDER BY) ---
+--- eqlAsc (encrypted order-term ORDER BY) ---
   user-0: email=alice@example.com
   user-1: email=bob@example.com
   user-2: email=carol@example.com
@@ -102,7 +102,7 @@ Found 2 user(s) with a dark-theme preference.
 
 Two v3 behaviours worth noticing in that output:
 
-- **`cipherstashIlike` is bloom-filter token containment** (`eql_v3.contains`), not SQL `ILIKE` — the needle's tokens must appear in the ciphertext's index. Plain substrings like `example.com` are the idiomatic needle; `%` wildcards are not part of the model.
+- **`eqlMatch` is fuzzy bloom-filter token matching** (`eql_v3.contains`), not SQL `ILIKE` — the needle's tokens must appear in the ciphertext's index. Plain literal terms like `example.com` are the idiomatic needle: leading/trailing `%` are stripped for compatibility, while an interior `%` or any `_` throws (the tokenizer would treat them as ordinary characters), as do needles shorter than the match tokenizer length.
 - **`eql_v3_boolean` is storage-only.** It round-trips `true`/`false` losslessly but surfaces no search operators — calling one throws `EncryptionOperatorError`. Filter on a searchable column and decrypt the boolean from the result set.
 
 ## References

examples/prisma/prisma/schema.prisma

@@ -10,9 +10,9 @@
 //
 //   - email         (EncryptedTextSearch → eql_v3_text_search)
 //                     equality + order/range + free-text search:
-//                     cipherstashEq / Ne / InArray / NotInArray /
+//                     eqlEq / Neq / In / NotIn /
 //                     Gt / Gte / Lt / Lte / Between / NotBetween /
-//                     Ilike / NotIlike, cipherstashV3Asc / Desc.
+//                     Match, eqlAsc / Desc.
 //   - salary        (EncryptedDoubleOrd → eql_v3_double_ord)
 //                     equality + order/range.
 //   - accountId     (EncryptedBigIntOrd → eql_v3_bigint_ord)
@@ -21,10 +21,10 @@
 //                     equality + order/range.
 //   - emailVerified (EncryptedBoolean → eql_v3_boolean)
 //                     STORAGE-ONLY: no search operators at all — every
-//                     cipherstash* predicate throws
+//                     eql* predicate throws
 //                     EncryptionOperatorError on this column.
 //   - preferences   (EncryptedJson → eql_v3_json)
-//                     searchable JSON: cipherstashJsonContains
+//                     searchable JSON: eqlJsonContains
 //                     (encrypted jsonb `@>` containment).
 //
 // v3 emits NO search configs: the domain carries its own index

examples/prisma/src/index.ts

@@ -20,7 +20,7 @@
  *   - accountId     eql_v3_bigint_ord  — eq + range + ORDER BY
  *   - birthday      eql_v3_date_ord    — eq + range + ORDER BY
  *   - emailVerified eql_v3_boolean     — STORAGE-ONLY (no operators)
- *   - preferences   eql_v3_json        — cipherstashJsonContains (@>)
+ *   - preferences   eql_v3_json        — eqlJsonContains (@>)
  *
  * Prerequisites:
  *
@@ -39,14 +39,14 @@
 import 'dotenv/config'
 
 import {
-  cipherstashV3Asc,
   decryptAll,
   EncryptedBigInt,
   EncryptedBoolean,
   EncryptedDate,
   EncryptedJson,
   EncryptedNumber,
   EncryptedString,
+  eqlAsc,
 } from '@cipherstash/prisma-next/runtime'
 
 import { db } from './db'
@@ -117,7 +117,7 @@ async function main() {
     await clearUsers()
     await insertUsers()
     await searchByEq()
-    await searchByIlikeAndDecrypt()
+    await searchByMatchAndDecrypt()
     await rangeQueryOnSalary()
     await betweenQueryOnBirthday()
     await inArrayQueryOnAccountId()
@@ -159,9 +159,9 @@ async function insertUsers(): Promise<void> {
 }
 
 async function searchByEq(): Promise<void> {
-  console.log('\n--- cipherstashEq (text_search equality) ---')
+  console.log('\n--- eqlEq (text_search equality) ---')
   const rows = await db.orm.public.User.where((u) =>
-    u.email.cipherstashEq('alice@example.com'),
+    u.email.eqlEq('alice@example.com'),
   ).all()
   console.log(`Found ${rows.length} row(s) for alice@example.com.`)
   await decryptAll(rows)
@@ -170,13 +170,13 @@ async function searchByEq(): Promise<void> {
   }
 }
 
-async function searchByIlikeAndDecrypt(): Promise<void> {
-  console.log('\n--- cipherstashIlike (text_search free-text tokens) ---')
+async function searchByMatchAndDecrypt(): Promise<void> {
+  console.log('\n--- eqlMatch (text_search free-text tokens) ---')
   // v3 free-text search is bloom-filter TOKEN matching (eql_v3.contains),
   // not SQL ILIKE: the needle's tokens must appear in the ciphertext's
   // index. 'example.com' matches the three @example.com addresses.
   const rows = await db.orm.public.User.where((u) =>
-    u.email.cipherstashIlike('example.com'),
+    u.email.eqlMatch('example.com'),
   ).all()
   console.log(`Found ${rows.length} row(s) whose email contains example.com.`)
   await decryptAll(rows)
@@ -186,9 +186,9 @@ async function searchByIlikeAndDecrypt(): Promise<void> {
 }
 
 async function rangeQueryOnSalary(): Promise<void> {
-  console.log('\n--- cipherstashGt (double_ord order-and-range) ---')
+  console.log('\n--- eqlGt (double_ord order-and-range) ---')
   const rows = await db.orm.public.User.where((u) =>
-    u.salary.cipherstashGt(100_000),
+    u.salary.eqlGt(100_000),
   ).all()
   console.log(`Found ${rows.length} user(s) with salary > 100,000.`)
   await decryptAll(rows)
@@ -198,19 +198,19 @@ async function rangeQueryOnSalary(): Promise<void> {
 }
 
 async function betweenQueryOnBirthday(): Promise<void> {
-  console.log('\n--- cipherstashBetween (date_ord order-and-range) ---')
+  console.log('\n--- eqlBetween (date_ord order-and-range) ---')
   const lower = new Date('1985-01-01')
   const upper = new Date('1995-12-31')
   const rows = await db.orm.public.User.where((u) =>
-    u.birthday.cipherstashBetween(lower, upper),
+    u.birthday.eqlBetween(lower, upper),
   ).all()
   console.log(`Found ${rows.length} user(s) born between 1985 and 1995.`)
 }
 
 async function inArrayQueryOnAccountId(): Promise<void> {
-  console.log('\n--- cipherstashInArray (bigint_ord equality) ---')
+  console.log('\n--- eqlIn (bigint_ord equality) ---')
   const rows = await db.orm.public.User.where((u) =>
-    u.accountId.cipherstashInArray([100_000_000_001n, 100_000_000_004n]),
+    u.accountId.eqlIn([100_000_000_001n, 100_000_000_004n]),
   ).all()
   console.log(
     `Found ${rows.length} user(s) whose accountId is in the supplied array.`,
@@ -224,7 +224,7 @@ async function decryptStorageOnlyBoolean(): Promise<void> {
   // calling one would throw EncryptionOperatorError. Filter on a
   // searchable column and decrypt the boolean from the result set.
   const rows = await db.orm.public.User.where((u) =>
-    u.email.cipherstashEq('carol@example.com'),
+    u.email.eqlEq('carol@example.com'),
   ).all()
   await decryptAll(rows)
   for (const row of rows) {
@@ -235,9 +235,9 @@ async function decryptStorageOnlyBoolean(): Promise<void> {
 }
 
 async function jsonContainmentOnPreferences(): Promise<void> {
-  console.log('\n--- cipherstashJsonContains (encrypted jsonb @>) ---')
+  console.log('\n--- eqlJsonContains (encrypted jsonb @>) ---')
   const rows = await db.orm.public.User.where((u) =>
-    u.preferences.cipherstashJsonContains({ theme: 'dark' }),
+    u.preferences.eqlJsonContains({ theme: 'dark' }),
   ).all()
   console.log(`Found ${rows.length} user(s) with a dark-theme preference.`)
   await decryptAll(rows)
@@ -249,10 +249,8 @@ async function jsonContainmentOnPreferences(): Promise<void> {
 }
 
 async function sortByEmailAsc(): Promise<void> {
-  console.log('\n--- cipherstashV3Asc (encrypted order-term ORDER BY) ---')
-  const rows = await db.orm.public.User.orderBy((u) =>
-    cipherstashV3Asc(u.email),
-  ).all()
+  console.log('\n--- eqlAsc (encrypted order-term ORDER BY) ---')
+  const rows = await db.orm.public.User.orderBy((u) => eqlAsc(u.email)).all()
   await decryptAll(rows)
   for (const row of rows) {
     console.log(`  ${row.id}: email=${await row.email.decrypt()}`)