Merge pull request #608 from cipherstash/chore/prisma-next-0.14-upgrade

Chore/prisma next 0.14 upgrade

Author: calvinbrewer

.changeset/prisma-next-0-14.md

@@ -0,0 +1,12 @@
+---
+'@cipherstash/prisma-next': minor
+---
+
+Upgrade to Prisma Next 0.14.0 (from 0.8.0). Every `@prisma-next/*` dependency is now pinned at 0.14.0; consuming apps must run Prisma Next 0.14 to use this release.
+
+Highlights of the upgrade:
+
+- The extension contract space is re-emitted in the 0.14 canonical shape: storage is namespace-enveloped (`storage.namespaces.public.entries.table`), the domain plane replaces flat `models`, and the baseline EQL-install migration is re-pinned to the new storage hash. The vendored EQL bundle SQL is unchanged byte-for-byte.
+- `deriveStackSchemas` reads the namespace-enveloped contract shape emitted by Prisma Next 0.10+.
+- The bulk-encrypt middleware accepts the widened insert/update AST value unions introduced through 0.9–0.11.
+- README examples use the namespace-qualified ORM accessors (`db.orm.public.User`) required since Prisma Next 0.14.

docs/superpowers/plans/2026-07-08-eql-v3-prisma-next.md

@@ -20,7 +20,13 @@ const authConfigured = (() => {
   if (process.env.CS_CLIENT_ID && process.env.CS_CLIENT_KEY) return true
   const home = process.env.HOME
   if (!home) return false
-  return existsSync(join(home, '.cipherstash', 'auth.json'))
+  // `stash auth login` stores either an `auth.json` (legacy PKCE flow) or a
+  // `device.json` (device-code flow) under the profile directory; both let
+  // the stack client authenticate without CS_* env vars.
+  return (
+    existsSync(join(home, '.cipherstash', 'auth.json')) ||
+    existsSync(join(home, '.cipherstash', 'device.json'))
+  )
 })()
 
 interface StepResult {
@@ -62,10 +68,15 @@ function runStep(commandLine: string, timeoutMs: number): StepResult {
   }
 }
 
+// `.env` is included so a developer's real credentials file survives the
+// walkthrough: the README's `cp .env.example .env` step overwrites it, and
+// without the snapshot the teardown would delete it outright. The snapshot
+// captures it before the run and the restore puts the original back.
 const TRANSIENT_PATHS = [
   'migrations/app',
   'src/prisma/contract.json',
   'src/prisma/contract.d.ts',
+  '.env',
 ] as const
 
 async function snapshotTransientOutputs(): Promise<string> {
@@ -170,10 +181,11 @@ describe.skipIf(!authConfigured)(
     afterAll(async () => {
       // Teardown the bundled Postgres container regardless of outcome.
       runStep('docker compose down -v', 60_000)
-      // Restore the transient outputs from snapshot so the working tree is clean.
+      // Restore the transient outputs from snapshot so the working tree is
+      // clean. `.env` is part of the snapshot: the walkthrough's
+      // `cp .env.example .env` overwrote it, and the restore brings back the
+      // developer's original (or removes the copy when none existed before).
       await restoreTransientOutputs(snapDir)
-      // Remove the .env we copied in the walkthrough (not tracked anyway).
-      rmSync(join(EXAMPLE_DIR, '.env'), { force: true })
     }, 120_000)
 
     // Per-step exit-zero assertion, registered once per non-skipped README line.

docs/superpowers/specs/2026-07-08-eql-v3-prisma-next-design.md

@@ -4,8 +4,8 @@
 #
 # Defaults match the bundled `docker-compose.yml`. Run
 # `docker compose up -d` from this directory to start a Postgres on
-# port 5544 with these credentials.
-DATABASE_URL=postgres://postgres:postgres@localhost:5544/cipherstash_prisma_example
+# port 54338 with these credentials.
+DATABASE_URL=postgres://postgres:postgres@localhost:54338/cipherstash_prisma_example
 
 # CipherStash workspace credentials — **deployment only**.
 #

e2e/tests/prisma-example-readme.e2e.test.ts

@@ -10,7 +10,7 @@ A single `User` model with one column per cipherstash codec (string, double, big
 
 | Path                       | Purpose                                                                                       |
 | -------------------------- | --------------------------------------------------------------------------------------------- |
-| `docker-compose.yml`       | Local Postgres 16 on port 5544.                                                               |
+| `docker-compose.yml`       | Local Postgres 16 on port 54338.                                                               |
 | `prisma/schema.prisma`     | Application schema (one `User` model exercising all six cipherstash codecs).                  |
 | `prisma-next.config.ts`    | Wires `cipherstash` into `extensionPacks`.                                                    |
 | `src/db.ts`                | One-call setup via `cipherstashFromStack({ contractJson })`.                                  |
@@ -20,7 +20,7 @@ A single `User` model with one column per cipherstash codec (string, double, big
 
 ## Prerequisites
 
-1. **Docker** for the bundled Postgres on port 5544 (or any Postgres 16+).
+1. **Docker** for the bundled Postgres on port 54338 (or any Postgres 16+).
 2. **A CipherStash workspace** — sign up at [cipherstash.com](https://cipherstash.com), then run `stash auth login` (PKCE; caches credentials in your OS keychain — no `CS_*` env vars needed in local dev).
 
 ## Run it
@@ -33,7 +33,7 @@ docker compose up -d
 pnpm install
 pnpm emit                  # PSL → contract.{json,d.ts}
 pnpm migration:plan --name initial
-pnpm migration:apply       # installs EQL bundle + your app schema in one sweep
+pnpm migration:apply       # installs EQL bundle + your app schema in one sweep (runs `prisma-next migrate`)
 pnpm start                 # runs the demo
 ```
 

examples/prisma/.env.example

@@ -5,9 +5,9 @@
 #   docker compose down -v      # stop + delete volume (fresh state)
 #
 # The DATABASE_URL in .env.example matches the values below:
-#   postgres://postgres:postgres@localhost:5544/cipherstash_prisma_example
+#   postgres://postgres:postgres@localhost:54338/cipherstash_prisma_example
 #
-# Port 5544 (not 5432) is used to avoid colliding with any host-side
+# Port 54338 (not 5432) is used to avoid colliding with any host-side
 # Postgres / other example containers.
 
 services:
@@ -20,7 +20,7 @@ services:
       POSTGRES_PASSWORD: postgres
       POSTGRES_DB: cipherstash_prisma_example
     ports:
-      - "5544:5432"
+      - "54338:5432"
     volumes:
       - cipherstash-prisma-example-pg-data:/var/lib/postgresql/data
     healthcheck: