Merge remote-tracking branch 'origin/main' into feat/prisma-next-eql-v3

Author: calvinbrewer

.changeset/cli-anonymous-telemetry.md

@@ -0,0 +1,28 @@
+---
+'stash': minor
+---
+
+Add anonymous, opt-out usage analytics to the `stash` CLI, plus a
+`stash telemetry [status|enable|disable]` command to manage it.
+
+Only coarse events are collected — command name, CLI version, OS/arch, Node
+version, success/failure, duration, and a coarse caller class (e.g.
+`claude-code`, `cursor`, `interactive`) derived from environment markers so we
+can gauge agent- vs human-driven usage. Events carry a random install
+identifier (a locally generated UUID, not derived from any machine or user
+attribute) used only to de-duplicate events in aggregate. Plaintext, schema,
+table/column names,
+connection strings, argument values, and any session/trace identifier are never
+collected — enforced by a property-key allowlist at the emitter boundary plus
+closed-vocabulary coercion of every argv- or error-derived value (unrecognised
+commands, subcommands, and error class names all collapse to `<other>`). A
+one-time notice is shown on first run, and nothing is sent on that run.
+
+Telemetry is off by default in CI and can be disabled with `DO_NOT_TRACK=1`
+(the cross-tool standard), `STASH_TELEMETRY_DISABLED=1`, or
+`stash telemetry disable` (persisted to `~/.cipherstash/telemetry.json`).
+
+Events are sent via a first-party proxy and never block or slow the CLI. The
+feature ships dormant — no events are sent until a PostHog project key is
+embedded at release. Updates the `stash-cli` skill to document the command and
+opt-out controls.

.changeset/config.json

@@ -2,7 +2,16 @@
   "$schema": "https://unpkg.com/@changesets/config@3.0.3/schema.json",
   "changelog": "@changesets/cli/changelog",
   "commit": false,
-  "fixed": [],
+  "fixed": [
+    [
+      "stash",
+      "@cipherstash/stack",
+      "@cipherstash/stack-drizzle",
+      "@cipherstash/stack-supabase",
+      "@cipherstash/prisma-next",
+      "@cipherstash/wizard"
+    ]
+  ],
   "linked": [],
   "access": "restricted",
   "baseBranch": "main",

.changeset/eql-v3-json-selector.md

@@ -0,0 +1,26 @@
+---
+'@cipherstash/stack-drizzle': minor
+'stash': patch
+---
+
+Add EQL v3 JSON **selector-with-constraint** querying to the Drizzle integration
+(#623). `ops.selector(col, '$.path')` returns comparison methods bound to a
+JSONPath into a `types.Json` column — `eq`/`ne`/`gt`/`gte`/`lt`/`lte` — emitting
+`col->'<selector>' <op> <value>` over the encrypted document. Its unique power
+over `contains` is **ordering at a path** (`col->'$.age' > 21`), which
+containment cannot express.
+
+Complements the existing `contains` (JSONB `@>`) containment operator. Core
+`@cipherstash/stack` needs no change — the selector hash and comparison entry are
+produced by `encryptQuery`/`encrypt` on the existing `types.Json` surface. v1
+supports dot-notation object paths; array-index/wildcard paths are rejected with
+a clear error. The Supabase adapter is tracked separately.
+
+The right-hand comparison operand is currently a storage-encrypted needle (its
+ste_vec entry carries the ordering term), pending a ciphertext-free ordering
+query needle from protect-ffi (cipherstash/protectjs-ffi#137); until then the
+value's ciphertext appears in the WHERE clause.
+
+The bundled `stash-encryption` and `stash-drizzle` skills document the new
+`ops.selector(...)` surface (they previously said JSONPath selector queries were
+not yet implemented).

.changeset/eql-v3-sole-docs.md

@@ -0,0 +1,16 @@
+---
+'stash': patch
+'@cipherstash/stack': patch
+---
+
+Docs: EQL v3 is now the sole documented approach. The `stash-encryption`,
+`stash-drizzle`, and `stash-supabase` skills and the `@cipherstash/stack`
+README teach only the v3 typed surface (`EncryptionV3`, `types.*` concrete
+domains, `@cipherstash/stack-drizzle/v3`, `encryptedSupabaseV3`); EQL v2
+shrinks to one short Legacy section per document. Two explicit exceptions are
+called out: DynamoDB still requires the v2 schema surface (#657), and the
+encrypt rollout tooling (`stash encrypt backfill`/`cutover`,
+`@cipherstash/migrate`) currently targets v2 columns (#648) — its guidance is
+kept under a version callout. Also corrects the legacy `@cipherstash/drizzle`
+README's pointer to the removed `@cipherstash/stack/drizzle` subpath (now the
+separate `@cipherstash/stack-drizzle` package).

.changeset/init-pins-runtime-versions.md

@@ -0,0 +1,29 @@
+---
+'stash': patch
+---
+
+`stash init` now pins the packages it installs (`@cipherstash/stack`, the
+integration adapter, and `stash` itself) to the exact versions this CLI
+release was built alongside, instead of installing bare package names that
+resolve through npm dist-tags (#661). During a pre-release window dist-tags
+lag or point at placeholders, so an unpinned `init` could silently deliver a
+different release than the CLI driving the setup — stale `@cipherstash/stack`,
+or an empty placeholder adapter — breaking `/v3` imports out of the box. The
+versions are embedded at build time from the release train itself
+(`src/release-train.ts`, the single source both the build and the runtime
+check against), so they can never disagree with what was published together.
+
+Init also now surfaces **version skew** on already-installed packages —
+unconditionally, before any prompt or early exit, including when the install
+is declined or partially fails. Interactively it offers to align the skewed
+packages in the same confirm as the missing installs (keeping `stash` a dev
+dependency); non-interactively it never mutates an existing install — it
+warns and prints the exact align commands. A package whose manifest exists
+but can't be read (an aborted install) is reported as skew, not treated as
+matching. All other install guidance is pinned the same way: the
+missing-package hints, `.cipherstash/context.json`'s `installCommand`, the
+`install-eql` manual note, the native-module recovery hint (previously
+`stash@latest`), and the `stash wizard` one-shot spawn (previously an
+unpinned `npx @cipherstash/wizard`). The `stash-cli` skill documents the
+behaviour, and the other bundled skills' manual install commands now carry a
+verify-what-resolved note.

.changeset/pre.json

@@ -8,7 +8,6 @@
     "@cipherstash/supabase-worker-example": "0.0.0",
     "@cipherstash/bench": "0.0.4",
     "stash": "0.17.1",
-    "@cipherstash/drizzle": "3.0.3",
     "@cipherstash/migrate": "0.2.0",
     "@cipherstash/nextjs": "4.1.1",
     "@cipherstash/prisma-next": "0.3.2",
@@ -24,6 +23,7 @@
   "changesets": [
     "adapter-package-split",
     "adapter-split-skills",
+    "cli-anonymous-telemetry",
     "cli-eql-v3-single-bundle",
     "eql-v3-adapter-type-robustness",
     "eql-v3-bigint-domains",
@@ -34,19 +34,26 @@
     "eql-v3-drizzle",
     "eql-v3-ffi-0-28-concrete-types",
     "eql-v3-ga-rebaseline",
+    "eql-v3-json-selector",
     "eql-v3-json-skills",
     "eql-v3-json",
     "eql-v3-public-domains",
     "eql-v3-rename-contains-to-matches",
+    "eql-v3-sole-docs",
     "eql-v3-supabase-adapter",
     "eql-v3-text-search",
     "eql-v3-typed-client",
     "eql-v3-typed-schema",
     "eql-v3-wasm-inline",
+    "init-pins-runtime-versions",
     "prisma-next-0-14",
+    "prisma-next-joins-release-train",
+    "release-train-coupling",
+    "remove-legacy-drizzle-package",
     "remove-secrets-leftovers",
     "rename-db-install-to-eql-install",
     "schema-stevec-standard-pin",
+    "skills-identity-docs-refresh",
     "stack-1-0-0-rc",
     "stack-adapter-kit",
     "stash-cli-eql-v3-default",
@@ -58,7 +65,12 @@
     "supabase-in-list-operands",
     "supabase-is-null-operands",
     "supabase-or-string-parser",
+    "supabase-v3-json-querying",
     "supabase-v3-order-by-ope-term",
-    "wizard-allow-env-templates"
+    "v3-supabase-needle-lockcontext-errors",
+    "wasm-encrypt-query",
+    "wizard-allow-env-templates",
+    "wizard-analytics-privacy",
+    "wizard-joins-release-train"
   ]
 }

.changeset/prisma-next-joins-release-train.md

@@ -0,0 +1,9 @@
+---
+'@cipherstash/prisma-next': patch
+---
+
+`@cipherstash/prisma-next` now versions in lockstep with the Stack release
+train (`stash`, `@cipherstash/stack`, and the other adapters) via a Changesets
+`fixed` group — `stash init` installs it pinned by exact version, so the two
+must always release together. This moves the package from its previous `0.4.x`
+line onto the shared train version; no API changes.

.changeset/release-train-coupling.md

@@ -0,0 +1,25 @@
+---
+'stash': patch
+---
+
+Two guards for the release-train version embed (#661 follow-up):
+
+**Direction-aware version skew.** `stash init` now distinguishes an installed
+package that is *behind* this CLI release (offered alignment / the pinned
+install command, as before) from one that is *newer* than the release expects.
+A newer install no longer produces a downgrade command — init prints the exact
+`stash` update command instead (release-train lockstep guarantees that version
+exists), and when missing packages are about to be installed alongside newer
+ones it says the pairing may not match and to update `stash` first. Unreadable
+or malformed manifest versions always count as behind (a broken install should
+be offered the reinstall fix, never "looks newer, leave it").
+
+**Version lockstep.** The release-train packages (`stash`,
+`@cipherstash/stack`, `@cipherstash/stack-drizzle`,
+`@cipherstash/stack-supabase`, `@cipherstash/prisma-next`,
+`@cipherstash/wizard`) are now a Changesets `fixed` group: a release of any of
+them republishes all of them at the same version, so the CLI's embedded
+version map can never go stale against the packages it pins (previously a
+runtime-package-only release would have left the published CLI embedding —
+and recommending — outdated versions). A test now asserts the fixed group
+stays exactly equal to the release train.

.changeset/remove-legacy-drizzle-package.md

@@ -0,0 +1,13 @@
+---
+'stash': patch
+'@cipherstash/stack-drizzle': patch
+---
+
+The legacy `@cipherstash/drizzle` package (the `@cipherstash/protect`-based
+Drizzle integration) is removed from the repository and the release train —
+`@cipherstash/protect` is sunsetting at Stack 1.0, and the package's successor
+is `@cipherstash/stack-drizzle`. Already-published versions remain installable
+from npm (deprecated, pointing here); the git history preserves the source for
+any emergency maintenance. The `stash-drizzle` skill and the
+`@cipherstash/stack-drizzle` README now state the deprecation explicitly so
+nobody (human or agent) installs the legacy package by mistake.

.changeset/skills-identity-docs-refresh.md

@@ -0,0 +1,13 @@
+---
+'stash': patch
+'@cipherstash/stack': patch
+---
+
+Docs: stop teaching the deprecated `LockContext.identify()` as the primary
+identity-aware-encryption path (#591). The `stash-encryption` and `stash-supabase`
+skills and the `@cipherstash/stack` README now lead with the current pattern —
+authenticate the client with `OidcFederationStrategy`, then bind the claim per
+operation with `.withLockContext({ identityClaim })` — and demote
+`LockContext.identify()` to a clearly-marked deprecated note (per-operation CTS
+tokens were removed in protect-ffi 0.25). Skills ship in the `stash` tarball, so
+this keeps the bundled guidance correct for the 1.0 surface.