Version Packages (rc)

.changeset/pre.json

@@ -26,6 +26,7 @@
     "auth-binding-lockstep",
     "cli-anonymous-telemetry",
     "cli-eql-v3-single-bundle",
+    "codex-skills-eperm",
     "drizzle-kit-eql-v3-ddl",
     "eql-migration-command",
     "eql-v3-adapter-type-robustness",
@@ -51,26 +52,34 @@
     "eql-v3-typed-schema",
     "eql-v3-wasm-inline",
     "honest-noninteractive-init",
+    "hungry-spoons-shake",
+    "init-drizzle-eql-v3",
     "init-pins-runtime-versions",
+    "init-placeholder-eql-v3",
+    "khaki-pugs-play",
     "migrate-eql-v3",
     "plan-complete-rollout-yes",
     "prisma-example-eql-v3",
     "prisma-next-0-14",
     "prisma-next-drop-encrypted-prefix",
     "prisma-next-eql-runtime-source",
     "prisma-next-joins-release-train",
+    "prisma-next-v3-only-install",
+    "protect-ffi-030-json-selectors",
     "release-train-coupling",
     "remove-legacy-drizzle-package",
     "remove-secrets-leftovers",
     "rename-db-install-to-eql-install",
     "schema-stevec-standard-pin",
+    "skills-eql-v3-accuracy",
     "skills-identity-docs-refresh",
     "stack-1-0-0-rc",
     "stack-adapter-kit",
     "stash-cli-eql-v3-default",
     "stash-cli-skill-refresh",
     "stash-drizzle-skill-encrypt-query",
     "stash-env-mint-credentials",
+    "stash-prisma-next-skill-v3-only",
     "stash-prisma-next-skill",
     "stash-skills-contains-to-matches",
     "stash-supabase-contains-substrings",
@@ -82,6 +91,7 @@
     "supabase-v3-order-by-ope-term",
     "v3-supabase-needle-lockcontext-errors",
     "wasm-encrypt-query",
+    "wasm-inline-bulk-ops",
     "wizard-allow-env-templates",
     "wizard-analytics-privacy",
     "wizard-joins-release-train"

e2e/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @cipherstash/e2e
 
+## 0.0.3-rc.4
+
+### Patch Changes
+
+- Updated dependencies [98156ac]
+- Updated dependencies [0e2ce93]
+- Updated dependencies [c8726cd]
+- Updated dependencies [04f5a13]
+- Updated dependencies [46dde37]
+- Updated dependencies [cf2c57c]
+- Updated dependencies [524903c]
+- Updated dependencies [2e6f032]
+- Updated dependencies [508f1d5]
+  - stash@1.0.0-rc.4
+  - @cipherstash/wizard@1.0.0-rc.4
+  - @cipherstash/stack@1.0.0-rc.4
+
 ## 0.0.3-rc.3
 
 ### Patch Changes

e2e/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/e2e",
-  "version": "0.0.3-rc.3",
+  "version": "0.0.3-rc.4",
   "private": true,
   "description": "End-to-end tests that exercise built CipherStash binaries and cross-package behaviour.",
   "type": "module",

examples/basic/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @cipherstash/basic-example
 
+## 1.2.14-rc.4
+
+### Patch Changes
+
+- Updated dependencies [cf2c57c]
+- Updated dependencies [508f1d5]
+  - @cipherstash/stack@1.0.0-rc.4
+  - @cipherstash/stack-drizzle@1.0.0-rc.4
+  - @cipherstash/stack-supabase@1.0.0-rc.4
+
 ## 1.2.14-rc.3
 
 ### Patch Changes

examples/basic/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cipherstash/basic-example",
   "private": true,
-  "version": "1.2.14-rc.3",
+  "version": "1.2.14-rc.4",
   "type": "module",
   "scripts": {
     "start": "tsx index.ts"

examples/prisma/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @cipherstash/prisma-next-example
 
+## 0.1.0-rc.4
+
+### Patch Changes
+
+- Updated dependencies [2e6f032]
+- Updated dependencies [cf2c57c]
+- Updated dependencies [508f1d5]
+  - @cipherstash/prisma-next@1.0.0-rc.4
+  - @cipherstash/stack@1.0.0-rc.4
+
 ## 0.1.0-rc.3
 
 ### Minor Changes

examples/prisma/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cipherstash/prisma-next-example",
   "private": true,
-  "version": "0.1.0-rc.3",
+  "version": "0.1.0-rc.4",
   "description": "End-to-end example of @cipherstash/prisma-next: searchable application-layer encryption for Postgres with Prisma Next, using @cipherstash/stack as the SDK.",
   "type": "module",
   "scripts": {

packages/bench/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @cipherstash/bench
 
+## 0.0.5-rc.4
+
+### Patch Changes
+
+- Updated dependencies [cf2c57c]
+- Updated dependencies [508f1d5]
+  - @cipherstash/stack@1.0.0-rc.4
+  - @cipherstash/stack-drizzle@1.0.0-rc.4
+
 ## 0.0.5-rc.3
 
 ### Patch Changes

packages/bench/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/bench",
-  "version": "0.0.5-rc.3",
+  "version": "0.0.5-rc.4",
   "private": true,
   "description": "Performance / index-engagement benchmarks for stack integrations (Drizzle, encryptedSupabase, Prisma).",
   "type": "module",

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "stash",
-	"version": "1.0.0-rc.3",
+	"version": "1.0.0-rc.4",
 	"description": "CipherStash CLI — the one stash command for auth, init, encryption schema, database setup, and secrets.",
 	"repository": {
 		"type": "git",

packages/prisma-next/CHANGELOG.md

@@ -1,5 +1,102 @@
 # @cipherstash/prisma-next
 
+## 1.0.0-rc.4
+
+### Minor Changes
+
+- 2e6f032: Make `@cipherstash/prisma-next` **EQL v3 only**. The EQL v2 surface is removed
+  entirely — install path, authoring constructors, runtime codecs, and the v2
+  subpath exports.
+
+  **Why:** the v2 and v3 baselines were chained — the v3 migration edge started
+  from the v2 baseline's `to` state and the head ref required both invariants — so
+  the only path to head ran the v2 install first. The v2 bundle's install fails on
+  managed Postgres (e.g. Supabase) where the connecting role is **not a
+  superuser**, which made the adapter unusable there even for v3-only apps.
+  Installing only EQL v3 (which applies fine as a non-superuser) fixes this.
+
+  **Breaking — install path:** the EQL v2 baseline migration
+  (`20260601T0000_install_eql_bundle`) is removed, and the contract now models no
+  storage (the retired `eql_v2_configuration` table is gone). The v3 baseline
+  (`20260601T0100_install_eql_v3_bundle`) is re-rooted as the sole invariant-only
+  **genesis** edge (`from: null`); the head ref requires only
+  `cipherstash:install-eql-v3-bundle-v1`. `prisma-next migration apply` now
+  installs EQL v3 exclusively and works on Supabase as a non-superuser.
+
+  **Breaking — API:** the EQL v2 authoring/runtime surface is removed:
+
+  - `cipherstashFromStackV2`, `deriveStackSchemas`, and `createCipherstashSdk`
+    (from `./stack`) — use `cipherstashFromStack` (v3).
+  - The `encrypted*V2` TS column factories and the `cipherstash.Encrypted*V2` PSL
+    constructors (from `./column-types`) — use the v3 domain factories/constructors
+    (`text`/`textSearch`/`bigIntOrd`/… and `cipherstash.TextSearch()` etc.).
+  - The v2 runtime codecs, `createCipherstashRuntimeDescriptor`, the `cipherstash*`
+    query operators/helpers, and the `EncryptedDouble` envelope (from `./runtime`)
+    — use the v3 runtime (`createCipherstashV3RuntimeDescriptor`,
+    `bulkEncryptMiddlewareV3`, the `eql*` operators, `EncryptedNumber`). The
+    version-neutral envelopes (`EncryptedString`/`BigInt`/`Boolean`/`Date`/`Json`)
+    and `decryptAll` are unchanged.
+  - The `./middleware` and `./migration` subpath exports are removed (the v2
+    bulk-encrypt middleware and call-classes). Use `bulkEncryptMiddlewareV3` from
+    `./runtime` / `./v3`.
+
+  Apps still on the v2 surface must move to the v3 constructors and regenerate
+  their contract (`prisma-next contract emit`); there is no supported EQL v2 path
+  in this package anymore.
+
+  **Also:** the "bulk-encrypt middleware not wired" diagnostic is now raised on the
+  v3 write path. Encoding an unencrypted value with an SDK that has no
+  `bulkEncryptMiddlewareV3(sdk)` registered against it fails fast with
+  `RUNTIME.ENCODE_FAILED` and a copy-pasteable wiring snippet, instead of surfacing
+  as an opaque pg-level serialise error. (The guard existed on the v2 codec; the v3
+  codec had never wired it up.)
+
+- cf2c57c: Upgrade Stack to `@cipherstash/protect-ffi` 0.30 and EQL 3.0.2.
+
+  Prisma Next includes a versioned EQL 3.0.2 upgrade migration, so databases
+  that have already recorded the original EQL v3 baseline still install the new
+  domains and functions.
+
+  Encrypted JSON now uses the `public.eql_v3_json_search` storage domain and
+  `eql_v3.query_json` query domain. Drizzle selector equality uses exact,
+  GIN-indexable value-selector containment, while selector range comparisons use
+  a ciphertext-free path selector plus string/number query term. Prisma Next gains
+  the equivalent `eqlJsonPathEq`, `eqlJsonPathNeq`, `eqlJsonPathGt`,
+  `eqlJsonPathGte`, `eqlJsonPathLt`, and `eqlJsonPathLte` operators. Selector
+  Selector-based `ORDER BY` is available as
+  `ops.selector(column, path).asc()/desc()` in Drizzle
+  and `eqlJsonPathAsc(column, path)` / `eqlJsonPathDesc(column, path)` in Prisma
+  Next; both lower to `ORDER BY eql_v3.ord_term` over the selected entry.
+
+  If you call `encryptQuery` with an explicit `queryType`, note that
+  `steVecTerm` now produces a scalar JSON ordering term. It no longer means
+  structural containment; use the recommended `searchableJson` query type with
+  an object or array for containment, or `steVecValueSelector` with
+  `{ path, value }` for exact equality at a path.
+
+  The FFI now rejects free-text needles shorter than the configured n-gram size
+  at the core query-encryption boundary, including callers that bypass adapter
+  guards.
+
+  This EQL release changes the SteVec storage format. Existing EQL v3 encrypted
+  JSON rows must be re-encrypted before they can be queried with the new domain.
+  Legacy EQL v2 `searchableJson()` schemas are rejected during client setup
+  because the old selector envelope can no longer be emitted; migrate them to the
+  v3 `types.Json` domain.
+
+  EQL 3.0.2 requires typed query-domain operands for encrypted free-text and JSON
+  operators. PostgREST cannot express those casts, so Supabase v3 fails fast for
+  `matches()`, encrypted `contains()`, and `selectorEq()`/`selectorNe()` instead
+  of placing a decryptable storage envelope in a GET query string that the new
+  SQL surface will reject. Use the Drizzle or Prisma Next adapter, or a carefully
+  scoped direct SQL/RPC path.
+
+### Patch Changes
+
+- Updated dependencies [cf2c57c]
+- Updated dependencies [508f1d5]
+  - @cipherstash/stack@1.0.0-rc.4
+
 ## 1.0.0-rc.3
 
 ### Minor Changes

packages/prisma-next/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/prisma-next",
-	"version": "1.0.0-rc.3",
+	"version": "1.0.0-rc.4",
 	"license": "MIT",
 	"author": "CipherStash <support@cipherstash.com>",
 	"description": "CipherStash extension for Prisma Next: searchable application-layer field-level encryption for Postgres (EQL v3), with domain-typed encrypted columns, the eql* query operators, bulk encrypt/decrypt middleware, and a baseline migration that installs the EQL v3 bundle.",

packages/stack-drizzle/CHANGELOG.md

@@ -1,5 +1,55 @@
 # @cipherstash/stack-drizzle
 
+## 1.0.0-rc.4
+
+### Minor Changes
+
+- cf2c57c: Upgrade Stack to `@cipherstash/protect-ffi` 0.30 and EQL 3.0.2.
+
+  Prisma Next includes a versioned EQL 3.0.2 upgrade migration, so databases
+  that have already recorded the original EQL v3 baseline still install the new
+  domains and functions.
+
+  Encrypted JSON now uses the `public.eql_v3_json_search` storage domain and
+  `eql_v3.query_json` query domain. Drizzle selector equality uses exact,
+  GIN-indexable value-selector containment, while selector range comparisons use
+  a ciphertext-free path selector plus string/number query term. Prisma Next gains
+  the equivalent `eqlJsonPathEq`, `eqlJsonPathNeq`, `eqlJsonPathGt`,
+  `eqlJsonPathGte`, `eqlJsonPathLt`, and `eqlJsonPathLte` operators. Selector
+  Selector-based `ORDER BY` is available as
+  `ops.selector(column, path).asc()/desc()` in Drizzle
+  and `eqlJsonPathAsc(column, path)` / `eqlJsonPathDesc(column, path)` in Prisma
+  Next; both lower to `ORDER BY eql_v3.ord_term` over the selected entry.
+
+  If you call `encryptQuery` with an explicit `queryType`, note that
+  `steVecTerm` now produces a scalar JSON ordering term. It no longer means
+  structural containment; use the recommended `searchableJson` query type with
+  an object or array for containment, or `steVecValueSelector` with
+  `{ path, value }` for exact equality at a path.
+
+  The FFI now rejects free-text needles shorter than the configured n-gram size
+  at the core query-encryption boundary, including callers that bypass adapter
+  guards.
+
+  This EQL release changes the SteVec storage format. Existing EQL v3 encrypted
+  JSON rows must be re-encrypted before they can be queried with the new domain.
+  Legacy EQL v2 `searchableJson()` schemas are rejected during client setup
+  because the old selector envelope can no longer be emitted; migrate them to the
+  v3 `types.Json` domain.
+
+  EQL 3.0.2 requires typed query-domain operands for encrypted free-text and JSON
+  operators. PostgREST cannot express those casts, so Supabase v3 fails fast for
+  `matches()`, encrypted `contains()`, and `selectorEq()`/`selectorNe()` instead
+  of placing a decryptable storage envelope in a GET query string that the new
+  SQL surface will reject. Use the Drizzle or Prisma Next adapter, or a carefully
+  scoped direct SQL/RPC path.
+
+### Patch Changes
+
+- Updated dependencies [cf2c57c]
+- Updated dependencies [508f1d5]
+  - @cipherstash/stack@1.0.0-rc.4
+
 ## 1.0.0-rc.3
 
 ### Patch Changes

packages/stack-drizzle/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/stack-drizzle",
-	"version": "1.0.0-rc.3",
+	"version": "1.0.0-rc.4",
 	"description": "CipherStash Stack Drizzle ORM integration: searchable, application-layer field-level encryption for PostgreSQL.",
 	"keywords": [
 		"encrypted",

packages/stack-supabase/CHANGELOG.md

@@ -1,5 +1,53 @@
 # @cipherstash/stack-supabase
 
+## 1.0.0-rc.4
+
+### Patch Changes
+
+- cf2c57c: Upgrade Stack to `@cipherstash/protect-ffi` 0.30 and EQL 3.0.2.
+
+  Prisma Next includes a versioned EQL 3.0.2 upgrade migration, so databases
+  that have already recorded the original EQL v3 baseline still install the new
+  domains and functions.
+
+  Encrypted JSON now uses the `public.eql_v3_json_search` storage domain and
+  `eql_v3.query_json` query domain. Drizzle selector equality uses exact,
+  GIN-indexable value-selector containment, while selector range comparisons use
+  a ciphertext-free path selector plus string/number query term. Prisma Next gains
+  the equivalent `eqlJsonPathEq`, `eqlJsonPathNeq`, `eqlJsonPathGt`,
+  `eqlJsonPathGte`, `eqlJsonPathLt`, and `eqlJsonPathLte` operators. Selector
+  Selector-based `ORDER BY` is available as
+  `ops.selector(column, path).asc()/desc()` in Drizzle
+  and `eqlJsonPathAsc(column, path)` / `eqlJsonPathDesc(column, path)` in Prisma
+  Next; both lower to `ORDER BY eql_v3.ord_term` over the selected entry.
+
+  If you call `encryptQuery` with an explicit `queryType`, note that
+  `steVecTerm` now produces a scalar JSON ordering term. It no longer means
+  structural containment; use the recommended `searchableJson` query type with
+  an object or array for containment, or `steVecValueSelector` with
+  `{ path, value }` for exact equality at a path.
+
+  The FFI now rejects free-text needles shorter than the configured n-gram size
+  at the core query-encryption boundary, including callers that bypass adapter
+  guards.
+
+  This EQL release changes the SteVec storage format. Existing EQL v3 encrypted
+  JSON rows must be re-encrypted before they can be queried with the new domain.
+  Legacy EQL v2 `searchableJson()` schemas are rejected during client setup
+  because the old selector envelope can no longer be emitted; migrate them to the
+  v3 `types.Json` domain.
+
+  EQL 3.0.2 requires typed query-domain operands for encrypted free-text and JSON
+  operators. PostgREST cannot express those casts, so Supabase v3 fails fast for
+  `matches()`, encrypted `contains()`, and `selectorEq()`/`selectorNe()` instead
+  of placing a decryptable storage envelope in a GET query string that the new
+  SQL surface will reject. Use the Drizzle or Prisma Next adapter, or a carefully
+  scoped direct SQL/RPC path.
+
+- Updated dependencies [cf2c57c]
+- Updated dependencies [508f1d5]
+  - @cipherstash/stack@1.0.0-rc.4
+
 ## 1.0.0-rc.3
 
 ### Patch Changes

packages/stack-supabase/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/stack-supabase",
-	"version": "1.0.0-rc.3",
+	"version": "1.0.0-rc.4",
 	"description": "CipherStash Stack Supabase integration: transparent, searchable field-level encryption for Supabase.",
 	"keywords": [
 		"encrypted",