stash encrypt backfill cannot run in a Prisma Next project

[coderdan]

Found while dogfooding stash@1.0.0-rc.4 with the Prisma Next adapter at rc.4 on a Next.js 16 app.

stash encrypt backfill cannot run against a Prisma Next project at all. Two independent causes, either of which alone is fatal.

1. The encryption context hard-fails on a client file that must not exist

Prisma Next integrations deliberately have no src/encryption/index.ts. Encrypted columns are declared in the PSL contract; the schema lives in the emitted contract.json and the runtime derives it via cipherstashFromStack.

But loadEncryptionContext treats the client file as the only schema source, so a correctly set-up project dies before doing any work:

$ stash encrypt backfill --table transaction --column description --encrypted-column descriptionEncrypted
Error: Encrypt client file not found at /app/src/encryption/index.ts

Check the "client" path in your stash.config.ts.

The message is actively misleading — it points at a file the integration's own docs tell you not to author. There is no stash.config.ts value that fixes it.

2. cipherstash.cs_migrations never exists

That schema is created by stash eql install. The Prisma Next flow never runs it: EQL installs through the prisma-next migration graph, which doesn't carry the tracking schema. (stash eql install even refuses in a Prisma Next project without --force, by design — see #819's discussion of the standalone installer.)

So even with a hand-written bridge client file working around cause 1, the first checkpoint write fails:

$ stash encrypt backfill --table transaction --column description --encrypted-column descriptionEncrypted --confirm-dual-writes-deployed
└ Backfill failed (error)

The generic backfill handler prints only Backfill failed (…) because its message path can carry plaintext — so the underlying relation "cipherstash.cs_migrations" does not exist never reaches the user.

Expected

stash encrypt backfill works in a Prisma Next project with no client file and no prior stash eql install, deriving its schemas from the same emitted contract the application runtime uses.

Reproduction

1. Scaffold a Prisma Next app with @cipherstash/stack-prisma, declaring at least one cipherstash.*() column in the contract.
2. prisma-next contract emit && prisma-next migrate.
3. stash encrypt backfill --table <t> --column <c> --encrypted-column <c>Encrypted --confirm-dual-writes-deployed.

Fails at step 3 with cause 1. Add a hand-written client file and it fails with cause 2.

Notes

Only encrypt backfill is affected — it is the sole caller of loadEncryptionContext. encrypt status and encrypt drop load stash.config.ts alone and resolve against the database, so they already worked.

Fixed by #819. Related: #820 (db init additive-policy fix, same dogfooding run).