Docs: rewrite the Prisma ORM 8 integration

IA.md

@@ -309,7 +309,7 @@ Two notes:
 - [ ] ⛔ `/integrations/supabase/edge-functions` — pending Deno/FFI answer
 - [ ] ⛔ `/integrations/supabase/realtime` — pending product verification
 - [x] `/integrations/drizzle`
-- [x] `/integrations/prisma-next` — EQL v2 today; revisit when v3 support lands
+- [x] `/integrations/prisma` — Prisma ORM 8 RC, EQL v3, Prisma Postgres, and Prisma Compute
 - [ ] `/integrations/aws/rds-aurora` — Proxy path
 - [ ] `/integrations/aws/dynamodb`
 - [ ] `/integrations/clerk`

content/docs/get-started/choose-your-stack.mdx

@@ -29,6 +29,7 @@ EQL installs into any Postgres you can connect to. It needs no extension, no sup
 | Platform | Works | Notes |
 |---|---|---|
 | Supabase | Yes | [Supabase integration](/integrations/supabase). Expose the `eql_v3` schema in the dashboard. |
+| Prisma Postgres | Yes | [Prisma Postgres integration](/integrations/prisma/prisma-postgres). EQL is installed through the Prisma ORM 8 migration graph. |
 | Neon, RDS, Aurora, Cloud SQL | Yes | `stash eql install` detects a non-superuser role and adapts. |
 | Self-hosted Postgres | Yes | Full operator-class support, so the ORE ordering mechanism is available. |
 | Postgres behind PgBouncer | Yes | Transaction pooling is fine. Proxy has its own pooling. |
@@ -45,7 +46,7 @@ Managed platforms usually block custom operator class creation. That's why the d
 |---|---|---|
 | Drizzle | [Drizzle integration](/stack/cipherstash/encryption/drizzle) | An `encryptedType` column and typed query operators. Your Drizzle code keeps its shape. |
 | Supabase JS | [Supabase integration](/integrations/supabase) | `encryptedSupabase` wraps the client. `.eq()`, `.gt()`, `.order()` keep working. |
-| Prisma | [Prisma integration](/stack/cipherstash/encryption/prisma-next) | Encrypt in the data layer around Prisma calls. |
+| Prisma ORM 8 RC | [Prisma integration](/integrations/prisma) | Encrypted fields and query operators are generated from `schema.prisma`. |
 | Raw SQL | [Quickstart](/get-started/quickstart) | Encrypt the value, insert it, cast the query operand. |
 | An ORM we don't list | The SDK | Encrypt before write, decrypt after read. Every ORM supports that. |
 

content/docs/get-started/quickstart.mdx

@@ -38,7 +38,7 @@ This opens a browser for device-based authentication, so local development needs
 4. Scaffolds an encryption module at `src/encryption/index.ts`.
 5. Writes `.cipherstash/context.json` with what it detected about your project.
 
-See the [CLI reference](/reference/cli/init) for the flags, including `--supabase`, `--drizzle`, and `--prisma-next`.
+Integration-specific initialization flags include `--supabase`, `--drizzle`, and `--prisma`.
 
 EQL v3 is the default, so `init` installs it directly against the database. Confirm what you ended up with:
 

content/docs/guides/migration/encrypt-existing-data.mdx

@@ -10,7 +10,7 @@ Encrypting a populated column is a staged application and database migration. Ci
 
 The safe pattern is to add an encrypted mirror column, dual-write new changes, backfill historical rows, and then move reads to the mirror. The plaintext column remains authoritative until the final cleanup, making every earlier stage reversible.
 
-This guide uses `encryptedSupabase` for its examples. The same sequence applies when the application uses [Drizzle](/integrations/drizzle), [Prisma Next](/integrations/prisma-next), or the [Stack SDK](/reference/stack): change the adapter-specific code, not the rollout order.
+This guide uses `encryptedSupabase` for its examples. The same sequence applies when the application uses [Drizzle](/integrations/drizzle), [Prisma ORM 8](/integrations/prisma), or the [Stack SDK](/reference/stack): change the adapter-specific code, not the rollout order.
 
 ## Migration sequence
 

content/docs/integrations/drizzle.mdx

@@ -7,7 +7,7 @@ audience: [developer]
 integration:
   category: orm
   setup: code-only
-  pairsWith: [supabase, prisma-next]
+  pairsWith: [supabase, prisma]
 verifiedAgainst:
   stack: "1.0.0-rc.0"
   eql: "3.0.0"

content/docs/integrations/index.mdx

@@ -16,8 +16,8 @@ Where the encrypted data lives. EQL installs into any Postgres you can connect t
   <Card title="Supabase" href="/integrations/supabase">
     Install EQL with the `stash` CLI, then query encrypted columns through PostgREST. Row Level Security, Supabase Auth, and Edge Functions all apply unchanged.
   </Card>
-  <Card title="Prisma Postgres" href="/integrations/prisma-next">
-    Prisma's hosted Postgres. EQL is installed by the Prisma Next migration system, in the same sweep that creates your tables.
+  <Card title="Prisma Postgres" href="/integrations/prisma/prisma-postgres">
+    Prisma's managed Postgres, with EQL installed through the Prisma ORM 8 migration graph.
   </Card>
 </Cards>
 
@@ -29,8 +29,8 @@ How your application queries it.
   <Card title="supabase-js" href="/integrations/supabase/supabase-js">
     `encryptedSupabase` wraps your existing client so `.eq()`, `.in()`, `.gt()`, and `.order()` keep working on encrypted columns.
   </Card>
-  <Card title="Prisma Next" href="/integrations/prisma-next">
-    Encrypted columns declared in `schema.prisma`. Targets EQL v2. Not classic Prisma.
+  <Card title="Prisma ORM 8" href="/integrations/prisma">
+    Encrypted EQL v3 columns declared in `schema.prisma`, with typed encrypted query operators.
   </Card>
   <Card title="Drizzle" href="/integrations/drizzle">
     Concrete encrypted column types and capability-checked operators. Targets EQL v3.

content/docs/integrations/meta.json

@@ -1,5 +1,5 @@
 {
   "title": "Integrations",
   "icon": "Blocks",
-  "pages": ["!index", "supabase", "..."]
+  "pages": ["!index", "supabase", "prisma", "..."]
 }

content/docs/integrations/prisma/deployment.mdx

@@ -0,0 +1,65 @@
+---
+title: Deployment
+description: "Deploy CipherStash schema changes, backfills, indexes, and credentials safely with Prisma ORM 8."
+type: guide
+components: [encryption, eql]
+audience: [developer, cto]
+integration:
+  category: orm
+  setup: code-only
+verifiedAgainst:
+  prismaNext: "0.16.0"
+  eql: "3.0.4"
+  stack: "1.0.0"
+---
+
+Prisma owns the complete database migration graph for this integration, including the EQL bundle, encrypted columns, and their functional indexes. Application releases still need to be staged carefully when a plaintext column already contains data.
+
+For the reasoning, rollback rules, and adapter-independent sequence, read [Encrypt existing data](/guides/migration/encrypt-existing-data) and the [deployment guide](/guides/deployment). This page maps that process to Prisma ORM 8.
+
+## New tables and empty columns
+
+For a new table or an empty column:
+
+```bash
+npx prisma-next contract emit
+npx prisma-next migration plan --name add-encrypted-fields
+npx prisma-next migrate
+```
+
+The CipherStash extension pack contributes EQL to the same graph. Do not run `stash eql install`.
+
+## Populated columns
+
+Move a populated plaintext column to encryption across separate application releases:
+
+| Release | Prisma and application change | Gate |
+| --- | --- | --- |
+| 1. Add and dual-write | Add a nullable encrypted twin; write plaintext and ciphertext on every path; keep plaintext reads | Confirm dual-writes are live |
+| Backfill | Run `stash encrypt backfill` against the target database with the deployed app's keyset | Confirm zero uncovered rows |
+| Index | Add EQL functional indexes as a Prisma raw-SQL migration operation and run `ANALYZE` | Verify plans with `EXPLAIN` |
+| 2. Cut over reads | Query and decrypt the encrypted twin; keep dual-writes | Soak under real traffic |
+| 3. Stop dual-writing | Write only the encrypted field; retain the plaintext column | Confirm every instance is updated |
+| 4. Remove plaintext | Apply a guarded destructive migration, then remove the old field from the contract | Irreversible |
+
+Do not combine these boundaries. In particular, a backfill is safe only after every production write path dual-writes, and the plaintext column must remain until encrypted reads have soaked successfully.
+
+## Index migrations
+
+Prisma schemas cannot express functional indexes. Keep their DDL as `rawSql` operations from `@prisma-next/postgres/migration` in the Prisma migration history; never apply them ad hoc to production.
+
+Use the recipes in [EQL indexes](/reference/eql/indexes). Build indexes after the bulk backfill and before encrypted reads go live, then run `ANALYZE` and verify the actual query plan.
+
+## Credentials
+
+<CipherStashCredentials />
+
+Create separate credentials for each deployed environment. A backfill must use credentials bound to the same keyset as the deployed application; otherwise decryption or encrypted search can fail after a seemingly successful write.
+
+The encryption client is commonly constructed during module import, so make the four `CS_*` variables available at build time as well as runtime.
+
+## Runtime packaging
+
+The Prisma adapter uses the native Stack client. Keep `@cipherstash/stack`, `@cipherstash/protect-ffi`, and `@cipherstash/auth` external to server bundles, and deploy to a runtime that can load native packages. This adapter is not supported on edge runtimes.
+
+For Prisma's hosted deployment behavior, including additive-only push-to-deploy and preview databases, continue with [Prisma Compute](/integrations/prisma/prisma-compute).

content/docs/integrations/prisma/index.mdx

@@ -0,0 +1,59 @@
+---
+title: Overview
+description: "Searchable field-level encryption for Prisma ORM 8: declare encrypted columns in schema.prisma and query them with the Prisma ORM."
+type: concept
+components: [encryption, eql]
+audience: [developer]
+integration:
+  category: orm
+  setup: code-only
+  pairsWith: [supabase, drizzle]
+verifiedAgainst:
+  prismaNext: "0.16.0"
+  eql: "3.0.4"
+  stack: "1.0.0"
+---
+
+CipherStash adds searchable, field-level encryption to Prisma ORM 8. Encrypted columns are declared in `schema.prisma`, EQL is installed through Prisma's migration graph, and the generated query API encrypts operands and values before they reach Postgres.
+
+<Callout type="info">
+This integration targets the **Prisma ORM 8 release candidate**, formerly known as **Prisma Next**. The prerelease CLI, package names, and configuration file still use `prisma-next` or `@prisma-next/*`; the examples preserve those names exactly. CipherStash setup uses `stash init --prisma`.
+
+It does not extend the classic `@prisma/client` API. For earlier Prisma releases, use the [Stack SDK](/reference/stack) around your existing reads and writes.
+</Callout>
+
+## Choose your path
+
+| What you want to do | Start here |
+| --- | --- |
+| Encrypt and query your first Prisma field | [Prisma ORM Quickstart](/integrations/prisma/quickstart) |
+| Choose column types or look up query operators | [Schema and queries](/integrations/prisma/schema-and-queries) |
+| Encrypt data already in production | [Prisma deployment guide](/integrations/prisma/deployment) |
+| Use Prisma's managed database | [Prisma Postgres](/integrations/prisma/prisma-postgres) |
+| Deploy the application with Prisma | [Prisma Compute](/integrations/prisma/prisma-compute) |
+| Design and verify encrypted indexes | [EQL indexes](/reference/eql/indexes) |
+| Look up the Prisma 8 prerelease itself | [Prisma ORM 8 documentation](https://www.prisma.io/docs/orm/next) |
+
+## How it works
+
+The [`@cipherstash/stack-prisma`](https://www.npmjs.com/package/@cipherstash/stack-prisma) extension has three integration points:
+
+1. Domain-named constructors such as `cipherstash.TextSearch()` declare encrypted EQL v3 columns in `schema.prisma`.
+2. The CipherStash extension pack adds EQL and those columns to Prisma's contract and migration graph.
+3. `cipherstashFromStack` connects the generated Prisma runtime to the Stack encryption client.
+
+The column type fixes which encrypted queries are possible. For example, `TextEq()` supports equality, while `TextSearch()` also supports ranges, ordering, and token matching. Choosing the narrowest useful type minimizes the information disclosed by searchable encryption. [Schema and queries](/integrations/prisma/schema-and-queries) contains the complete type and operator tables.
+
+## EQL and migration ownership
+
+This integration targets EQL v3 only. Prisma owns the EQL installation: `npx prisma-next migrate` installs the EQL bundle alongside your application schema. Do not run `stash eql install` in a Prisma ORM 8 project.
+
+Encrypted functional indexes also belong in the Prisma migration graph. `schema.prisma` cannot express expression indexes, so add their SQL as a Prisma raw-SQL migration operation. The canonical recipes and `EXPLAIN` checks live in [EQL indexes](/reference/eql/indexes).
+
+## Runtime and authentication
+
+Local development uses the CipherStash developer profile created by `stash init`. CI and deployed applications use credentials created with the CLI or Dashboard. [Credentials](/integrations/prisma/deployment#credentials) lists all three options and the four deployment environment variables.
+
+The Prisma adapter currently uses the native Stack client, so deploy it to a server runtime that can load native packages; it is not an edge-runtime adapter.
+
+For a new project, continue with the [Quickstart](/integrations/prisma/quickstart).

content/docs/integrations/prisma/meta.json

@@ -0,0 +1,12 @@
+{
+  "title": "Prisma ORM",
+  "icon": "Prisma",
+  "pages": [
+    "index",
+    "quickstart",
+    "schema-and-queries",
+    "deployment",
+    "prisma-postgres",
+    "prisma-compute"
+  ]
+}