feat(prisma-next): EQL v3 bundle baseline migration from @cipherstash/eql

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: 2 people

packages/prisma-next/migrations/20260601T0100_install_eql_v3_bundle/end-contract.d.ts

@@ -0,0 +1,175 @@
+// ⚠️  GENERATED FILE - DO NOT EDIT
+// This file is automatically generated by 'prisma-next contract emit'.
+// To regenerate, run: prisma-next contract emit
+import type { QueryOperationTypes as PgAdapterQueryOps } from '@prisma-next/adapter-postgres/operation-types';
+import type {
+  Bit,
+  Char,
+  CodecTypes as PgTypes,
+  Interval,
+  JsonValue,
+  Numeric,
+  Time,
+  Timestamp,
+  Timestamptz,
+  Timetz,
+  VarBit,
+  Varchar,
+} from '@prisma-next/target-postgres/codec-types';
+
+import type {
+  ContractWithTypeMaps,
+  TypeMaps as TypeMapsType,
+} from '@prisma-next/sql-contract/types';
+import type {
+  Contract as ContractType,
+  ExecutionHashBase,
+  NamespaceId,
+  ProfileHashBase,
+  StorageHashBase,
+} from '@prisma-next/contract/types';
+
+export type StorageHash =
+  StorageHashBase<'sha256:1e86a0160ba305fa74516b6d9449218308b258a51a913c1fc907e629f44568a7'>;
+export type ExecutionHash = ExecutionHashBase<string>;
+export type ProfileHash =
+  ProfileHashBase<'sha256:9c8aa3114e84ed3b7ea2bd57526d9c2e1bf7c5292be694e9d3801f566fda7ccb'>;
+
+export type CodecTypes = PgTypes;
+export type LaneCodecTypes = CodecTypes;
+export type QueryOperationTypes = PgAdapterQueryOps<CodecTypes>;
+type DefaultLiteralValue<CodecId extends string, _Encoded> = CodecId extends keyof CodecTypes
+  ? CodecTypes[CodecId]['output']
+  : _Encoded;
+
+export type FieldOutputTypes = {
+  readonly public: {
+    readonly EqlV2Configuration: {
+      readonly id: CodecTypes['pg/text@1']['output'];
+      readonly state: CodecTypes['pg/text@1']['output'];
+      readonly data: CodecTypes['pg/jsonb@1']['output'];
+    };
+  };
+};
+export type FieldInputTypes = {
+  readonly public: {
+    readonly EqlV2Configuration: {
+      readonly id: CodecTypes['pg/text@1']['input'];
+      readonly state: CodecTypes['pg/text@1']['input'];
+      readonly data: CodecTypes['pg/jsonb@1']['input'];
+    };
+  };
+};
+export type TypeMaps = TypeMapsType<
+  CodecTypes,
+  QueryOperationTypes,
+  FieldOutputTypes,
+  FieldInputTypes
+>;
+
+type ContractBase = Omit<
+  ContractType<{
+    readonly namespaces: {
+      readonly public: {
+        readonly id: 'public';
+        readonly kind: 'sql-namespace';
+        readonly entries: {
+          readonly table: {
+            readonly eql_v2_configuration: {
+              columns: {
+                readonly id: {
+                  readonly nativeType: 'text';
+                  readonly codecId: 'pg/text@1';
+                  readonly nullable: false;
+                };
+                readonly state: {
+                  readonly nativeType: 'text';
+                  readonly codecId: 'pg/text@1';
+                  readonly nullable: false;
+                };
+                readonly data: {
+                  readonly nativeType: 'jsonb';
+                  readonly codecId: 'pg/jsonb@1';
+                  readonly nullable: false;
+                };
+              };
+              primaryKey: { readonly columns: readonly ['id'] };
+              uniques: readonly [];
+              indexes: readonly [];
+              foreignKeys: readonly [];
+            };
+          };
+        };
+      };
+    };
+    readonly storageHash: StorageHash;
+  }>,
+  'roots' | 'domain'
+> & {
+  readonly target: 'postgres';
+  readonly targetFamily: 'sql';
+  readonly roots: {
+    readonly eql_v2_configuration: {
+      readonly namespace: 'public' & NamespaceId;
+      readonly model: 'EqlV2Configuration';
+    };
+  };
+  readonly domain: {
+    readonly namespaces: {
+      readonly public: {
+        readonly models: {
+          readonly EqlV2Configuration: {
+            readonly fields: {
+              readonly id: {
+                readonly nullable: false;
+                readonly type: { readonly kind: 'scalar'; readonly codecId: 'pg/text@1' };
+              };
+              readonly state: {
+                readonly nullable: false;
+                readonly type: { readonly kind: 'scalar'; readonly codecId: 'pg/text@1' };
+              };
+              readonly data: {
+                readonly nullable: false;
+                readonly type: { readonly kind: 'scalar'; readonly codecId: 'pg/jsonb@1' };
+              };
+            };
+            readonly relations: Record<string, never>;
+            readonly storage: {
+              readonly table: 'eql_v2_configuration';
+              readonly namespaceId: 'public';
+              readonly fields: {
+                readonly id: { readonly column: 'id' };
+                readonly state: { readonly column: 'state' };
+                readonly data: { readonly column: 'data' };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+  readonly capabilities: {
+    readonly postgres: {
+      readonly distinctOn: true;
+      readonly jsonAgg: true;
+      readonly lateral: true;
+      readonly limit: true;
+      readonly orderBy: true;
+      readonly returning: true;
+    };
+    readonly sql: {
+      readonly defaultInInsert: true;
+      readonly enums: true;
+      readonly lateral: true;
+      readonly returning: true;
+    };
+  };
+  readonly extensionPacks: {};
+  readonly meta: {};
+
+  readonly profileHash: ProfileHash;
+};
+
+export type Contract = ContractWithTypeMaps<ContractBase, TypeMaps>;
+
+export type Namespaces = Contract['storage']['namespaces'];

packages/prisma-next/migrations/20260601T0100_install_eql_v3_bundle/end-contract.json

@@ -0,0 +1,124 @@
+{
+  "schemaVersion": "1",
+  "targetFamily": "sql",
+  "target": "postgres",
+  "profileHash": "sha256:9c8aa3114e84ed3b7ea2bd57526d9c2e1bf7c5292be694e9d3801f566fda7ccb",
+  "roots": {
+    "eql_v2_configuration": {
+      "model": "EqlV2Configuration",
+      "namespace": "public"
+    }
+  },
+  "domain": {
+    "namespaces": {
+      "public": {
+        "models": {
+          "EqlV2Configuration": {
+            "fields": {
+              "data": {
+                "nullable": false,
+                "type": {
+                  "codecId": "pg/jsonb@1",
+                  "kind": "scalar"
+                }
+              },
+              "id": {
+                "nullable": false,
+                "type": {
+                  "codecId": "pg/text@1",
+                  "kind": "scalar"
+                }
+              },
+              "state": {
+                "nullable": false,
+                "type": {
+                  "codecId": "pg/text@1",
+                  "kind": "scalar"
+                }
+              }
+            },
+            "relations": {},
+            "storage": {
+              "fields": {
+                "data": {
+                  "column": "data"
+                },
+                "id": {
+                  "column": "id"
+                },
+                "state": {
+                  "column": "state"
+                }
+              },
+              "namespaceId": "public",
+              "table": "eql_v2_configuration"
+            }
+          }
+        }
+      }
+    }
+  },
+  "storage": {
+    "namespaces": {
+      "public": {
+        "entries": {
+          "table": {
+            "eql_v2_configuration": {
+              "columns": {
+                "data": {
+                  "codecId": "pg/jsonb@1",
+                  "nativeType": "jsonb",
+                  "nullable": false
+                },
+                "id": {
+                  "codecId": "pg/text@1",
+                  "nativeType": "text",
+                  "nullable": false
+                },
+                "state": {
+                  "codecId": "pg/text@1",
+                  "nativeType": "text",
+                  "nullable": false
+                }
+              },
+              "foreignKeys": [],
+              "indexes": [],
+              "primaryKey": {
+                "columns": [
+                  "id"
+                ]
+              },
+              "uniques": []
+            }
+          }
+        },
+        "id": "public",
+        "kind": "postgres-schema"
+      }
+    },
+    "storageHash": "sha256:1e86a0160ba305fa74516b6d9449218308b258a51a913c1fc907e629f44568a7"
+  },
+  "capabilities": {
+    "postgres": {
+      "distinctOn": true,
+      "jsonAgg": true,
+      "lateral": true,
+      "limit": true,
+      "orderBy": true,
+      "returning": true
+    },
+    "sql": {
+      "defaultInInsert": true,
+      "enums": true,
+      "lateral": true,
+      "returning": true
+    }
+  },
+  "extensionPacks": {},
+  "meta": {},
+  "_generated": {
+    "warning": "⚠️  GENERATED FILE - DO NOT EDIT",
+    "message": "This file is automatically generated by \"prisma-next contract emit\".",
+    "regenerate": "To regenerate, run: prisma-next contract emit"
+  }
+}

packages/prisma-next/migrations/20260601T0100_install_eql_v3_bundle/migration.json

@@ -0,0 +1,9 @@
+{
+  "from": "sha256:1e86a0160ba305fa74516b6d9449218308b258a51a913c1fc907e629f44568a7",
+  "to": "sha256:1e86a0160ba305fa74516b6d9449218308b258a51a913c1fc907e629f44568a7",
+  "providedInvariants": [
+    "cipherstash:install-eql-v3-bundle-v1"
+  ],
+  "createdAt": "2026-07-14T20:10:24.325Z",
+  "migrationHash": "sha256:49917bcf99c88546e4edef9a6323a56045ea522313ee460674e0cc90d747b2c3"
+}

packages/prisma-next/migrations/20260601T0100_install_eql_v3_bundle/migration.ts

@@ -0,0 +1,85 @@
+#!/usr/bin/env -S node
+/**
+ * CipherStash v3 baseline migration — install the EQL v3 bundle.
+ *
+ * The install SQL is sourced at EMIT time from `@cipherstash/eql/sql`
+ * (see `../../src/migration/eql-bundle-v3.ts` — the same source the
+ * stack's `installEqlV3IfNeeded` uses) and baked into `ops.json`
+ * byte-for-byte. The bundle creates the 40 `public.eql_v3_*` storage
+ * domains, the `eql_v3` operator-function schema (`eql_v3.eq`,
+ * `eql_v3.ord_term`, …), the `eql_v3.query_*` operand domains, and the
+ * `eql_v3_internal` helper schema.
+ *
+ * This is the SECOND migration in the cipherstash contract space, and
+ * it is an **invariant-only edge**: the v3 bundle declares no
+ * contract-space storage (no config table — unlike the v2 bundle's
+ * `eql_v2_configuration`), so the storage hash does not move and
+ * `describe()` returns `from === to === <the v2 baseline's to>`. The
+ * edge exists to carry the `cipherstash:install-eql-v3-bundle-v1`
+ * invariant: the apply-path planner (`findPathWithInvariants`) walks it
+ * when the head ref requires that invariant.
+ *
+ * Authoring loop: this file is hand-edited (see
+ * `docs/architecture docs/adrs/ADR 212 - Contract spaces.md`'s
+ * contract-space package layout section). Re-emit `ops.json` /
+ * `migration.json` after edits via
+ * `pnpm exec tsx migrations/20260601T0100_install_eql_v3_bundle/migration.ts`.
+ */
+import {
+  Migration,
+  MigrationCLI,
+  rawSql,
+} from '@prisma-next/target-postgres/migration'
+import { CIPHERSTASH_V3_INVARIANTS } from '../../src/extension-metadata/constants-v3'
+import {
+  readInstallSql,
+  releaseManifest,
+} from '../../src/migration/eql-bundle-v3'
+
+const INSTALL_LABEL = `Install EQL v3 bundle (eql-${releaseManifest.eqlVersion}: public.eql_v3_* domains + eql_v3.* functions)`
+
+export default class M extends Migration {
+  override describe() {
+    return {
+      from: 'sha256:1e86a0160ba305fa74516b6d9449218308b258a51a913c1fc907e629f44568a7',
+      to: 'sha256:1e86a0160ba305fa74516b6d9449218308b258a51a913c1fc907e629f44568a7',
+    }
+  }
+
+  override get operations() {
+    return [
+      rawSql({
+        id: 'cipherstash.install-eql-v3-bundle',
+        label: INSTALL_LABEL,
+        operationClass: 'additive',
+        invariantId: CIPHERSTASH_V3_INVARIANTS.installBundle,
+        target: { id: 'postgres' },
+        precheck: [],
+        execute: [{ description: INSTALL_LABEL, sql: readInstallSql() }],
+        postcheck: [
+          {
+            description: 'verify the "eql_v3" operator schema exists',
+            sql: "SELECT EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'eql_v3')",
+          },
+          {
+            // The storage domains live in `public` (not `eql_v3`) — by
+            // design, mirroring the v2 `public.eql_v2_encrypted`
+            // rationale: customer data columns declared against the
+            // domains must survive a `DROP SCHEMA eql_v3 CASCADE`
+            // re-install of the operator functions without losing the
+            // columns.
+            description:
+              'verify the concrete domain "public.eql_v3_text_search" exists',
+            sql: "SELECT to_regtype('public.eql_v3_text_search') IS NOT NULL",
+          },
+          {
+            description: 'verify the eql_v3.eq operator function exists',
+            sql: "SELECT EXISTS (SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace WHERE n.nspname = 'eql_v3' AND p.proname = 'eq')",
+          },
+        ],
+      }),
+    ]
+  }
+}
+
+MigrationCLI.run(import.meta.url, M)