cipherstash · github-actions · Jul 9, 2026
@@ -1,5 +1,16 @@
 # @cipherstash/e2e
 
+## 0.0.3
+
+### Patch Changes
+
+- Updated dependencies [f23f952]
+- Updated dependencies [1a9d190]
+- Updated dependencies [9c673bb]
+  - @cipherstash/stack@0.19.1
+  - stash@0.17.2
+  - @cipherstash/wizard@0.4.1
+
 ## 0.0.2
 
 ### Patch Changes

@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/e2e",
-  "version": "0.0.2",
+  "version": "0.0.3",
   "private": true,
   "description": "End-to-end tests that exercise built CipherStash binaries and cross-package behaviour.",
   "type": "module",

@@ -1,5 +1,12 @@
 # @cipherstash/basic-example
 
+## 1.2.14
+
+### Patch Changes
+
+- Updated dependencies [f23f952]
+  - @cipherstash/stack@0.19.1
+
 ## 1.2.13
 
 ### Patch Changes

@@ -1,7 +1,7 @@
 {
   "name": "@cipherstash/basic-example",
   "private": true,
-  "version": "1.2.13",
+  "version": "1.2.14",
   "type": "module",
   "scripts": {
     "start": "tsx index.ts"

@@ -1,5 +1,14 @@
 # @cipherstash/prisma-next-example
 
+## 0.0.6
+
+### Patch Changes
+
+- Updated dependencies [d6d23be]
+- Updated dependencies [f23f952]
+  - @cipherstash/prisma-next@0.4.0
+  - @cipherstash/stack@0.19.1
+
 ## 0.0.5
 
 ### Patch Changes

@@ -1,7 +1,7 @@
 {
   "name": "@cipherstash/prisma-next-example",
   "private": true,
-  "version": "0.0.5",
+  "version": "0.0.6",
   "description": "End-to-end example of @cipherstash/prisma-next: searchable application-layer encryption for Postgres with Prisma Next, using @cipherstash/stack as the SDK.",
   "type": "module",
   "scripts": {

@@ -1,5 +1,12 @@
 # @cipherstash/bench
 
+## 0.0.5
+
+### Patch Changes
+
+- Updated dependencies [f23f952]
+  - @cipherstash/stack@0.19.1
+
 ## 0.0.4
 
 ### Patch Changes

@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/bench",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "private": true,
   "description": "Performance / index-engagement benchmarks for stack integrations (Drizzle, encryptedSupabase, Prisma).",
   "type": "module",

@@ -1,5 +1,56 @@
 # @cipherstash/cli
 
+## 0.17.2
+
+### Patch Changes
+
+- f23f952: Remove the leftovers from the secrets removal (`1929c8fe`), which deleted
+  `packages/stack/src/secrets/` but left its export, build entry, skill, and docs
+  behind. Secrets tooling is not ready; nothing here was functional.
+
+  - **Drop the dead `@cipherstash/stack/secrets` subpath export.** It pointed at
+    `./dist/secrets/index.js`, which has no source and is not in the tarball, so
+    `import '@cipherstash/stack/secrets'` has been throwing `ERR_MODULE_NOT_FOUND`
+    for every consumer since the source was removed. Also drops the dangling
+    `src/secrets/index.ts` entry from `tsup.config.ts`. Removing an export that
+    cannot resolve breaks nothing.
+  - **Remove the `stash-secrets` agent skill** and its references in `AGENTS.md`
+    and the init setup-prompt skill index. It was never installed by `stash init`
+    (it is absent from `SKILL_MAP`), so no user project ever received it.
+  - **Remove the secrets documentation** from both published READMEs: the
+    `Secrets` class API and the `npx stash secrets` command reference in
+    `@cipherstash/stack`, and the `npx stash secrets` section in `stash`. The CLI
+    command does not exist — `stash secrets` returns `Unknown command`.
+
+- 1a9d190: Refresh the bundled `stash-cli` agent skill and the CLI README against the current
+  command surface. The skills directory ships inside the `stash` tarball and is copied
+  into the user's `.claude/skills/` / `.codex/skills/` (or inlined into `AGENTS.md`) at
+  handoff time, so a stale skill becomes stale guidance in the user's project.
+
+  - **New `Start here` and `Authentication` sections.** Setup is driven through the CLI:
+    agents read `stash manifest --json` first, then trigger `stash auth login --json` and
+    surface the verification URL for a human to approve, then run `stash init`. Authenticating
+    before `init` matters — `init`'s auth step is interactive and would otherwise try to open
+    a browser on the agent's host.
+  - **New `Never read these` invariant**, mirrored into the `AGENTS.md` doctrine: agents must
+    never read `~/.cipherstash/secretkey.json`, `~/.cipherstash/auth.json`, anything under
+    `~/.cipherstash/workspaces/`, or `.env*`. The wizard already blocks these paths in code;
+    the other handoff targets had no written rule.
+  - **Documents `manifest`, `doctor`, `wizard`, and `auth regions`**, which the skill omitted
+    entirely, plus the non-interactive interface (per-command escape hatches, exit codes, the
+    `DATABASE_URL` resolution order, the `auth login --json` NDJSON event contract).
+  - **Corrects the `db` → `eql` move.** `db install`, `db upgrade`, and `db status` are
+    deprecated aliases that warn and forward; `db push`, `db activate`, `db validate`,
+    `db test-connection`, and `db migrate` remain in the `db` group.
+  - **Scopes `db push` / `db activate` as EQL v2 + CipherStash Proxy only**, in both the skill
+    and the README's recommended flow. SDK users hold their encryption config in application
+    code and don't need them.
+  - Adds the missing `--database-url`, `--eql-version`, `--prisma-next`, `--proxy`/`--no-proxy`,
+    and `--region` flags; corrects six programmatic API signatures; fixes the README's claim
+    that `stash init` ends in an agent-handoff menu (that belongs to `stash plan` / `stash impl`);
+    and marks `stash env` as the non-functional stub it currently is.
+  - @cipherstash/migrate@0.2.0
+
 ## 0.17.1
 
 ### Patch Changes

@@ -1,6 +1,6 @@
 {
 	"name": "stash",
-	"version": "0.17.1",
+	"version": "0.17.2",
 	"description": "CipherStash CLI — the one stash command for auth, init, encryption schema, database setup, and secrets.",
 	"repository": {
 		"type": "git",

@@ -1,5 +1,23 @@
 # @cipherstash/prisma-next
 
+## 0.4.0
+
+### Minor Changes
+
+- d6d23be: Upgrade to Prisma Next 0.14.0 (from 0.8.0). Every `@prisma-next/*` dependency is now pinned at 0.14.0; consuming apps must run Prisma Next 0.14 to use this release.
+
+  Highlights of the upgrade:
+
+  - The extension contract space is re-emitted in the 0.14 canonical shape: storage is namespace-enveloped (`storage.namespaces.public.entries.table`), the domain plane replaces flat `models`, and the baseline EQL-install migration is re-pinned to the new storage hash. The vendored EQL bundle SQL is unchanged byte-for-byte.
+  - `deriveStackSchemas` reads the namespace-enveloped contract shape emitted by Prisma Next 0.10+.
+  - The bulk-encrypt middleware accepts the widened insert/update AST value unions introduced through 0.9–0.11.
+  - README examples use the namespace-qualified ORM accessors (`db.orm.public.User`) required since Prisma Next 0.14.
+
+### Patch Changes
+
+- Updated dependencies [f23f952]
+  - @cipherstash/stack@0.19.1
+
 ## 0.3.2
 
 ### Patch Changes

@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/prisma-next",
-	"version": "0.3.2",
+	"version": "0.4.0",
 	"license": "MIT",
 	"author": "CipherStash <support@cipherstash.com>",
 	"description": "CipherStash extension for Prisma Next: searchable application-layer field-level encryption for Postgres, with six encrypted column types, 17 query operators, bulk encrypt/decrypt middleware, and a baseline migration that installs the vendored EQL bundle SQL byte-for-byte.",

@@ -1,5 +1,27 @@
 # @cipherstash/stack
 
+## 0.19.1
+
+### Patch Changes
+
+- f23f952: Remove the leftovers from the secrets removal (`1929c8fe`), which deleted
+  `packages/stack/src/secrets/` but left its export, build entry, skill, and docs
+  behind. Secrets tooling is not ready; nothing here was functional.
+
+  - **Drop the dead `@cipherstash/stack/secrets` subpath export.** It pointed at
+    `./dist/secrets/index.js`, which has no source and is not in the tarball, so
+    `import '@cipherstash/stack/secrets'` has been throwing `ERR_MODULE_NOT_FOUND`
+    for every consumer since the source was removed. Also drops the dangling
+    `src/secrets/index.ts` entry from `tsup.config.ts`. Removing an export that
+    cannot resolve breaks nothing.
+  - **Remove the `stash-secrets` agent skill** and its references in `AGENTS.md`
+    and the init setup-prompt skill index. It was never installed by `stash init`
+    (it is absent from `SKILL_MAP`), so no user project ever received it.
+  - **Remove the secrets documentation** from both published READMEs: the
+    `Secrets` class API and the `npx stash secrets` command reference in
+    `@cipherstash/stack`, and the `npx stash secrets` section in `stash`. The CLI
+    command does not exist — `stash secrets` returns `Unknown command`.
+
 ## 0.19.0
 
 ### Minor Changes

@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/stack",
-	"version": "0.19.0",
+	"version": "0.19.1",
 	"description": "CipherStash Stack for TypeScript and JavaScript",
 	"keywords": [
 		"encrypted",

@@ -1,5 +1,24 @@
 # @cipherstash/wizard
 
+## 0.4.1
+
+### Patch Changes
+
+- 9c673bb: Stop the agent guard from blocking `.env.example`.
+
+  `SENSITIVE_FILE_PATTERNS` matched `/\.env($|\.)/`, which tests true against
+  `.env.example`. Because the guard covers `Edit` and `Write` as well as `Read`,
+  the wizard's agent was blocked from creating or editing the very file the
+  CipherStash doctrine tells it to write ("New env keys go in `.env.example` with
+  placeholders"). Committed env templates carry placeholder key names, not values.
+
+  `.env.example`, `.env.sample` and `.env.template` are now readable and writable.
+  Everything else is unchanged: `.env`, `.env.local`, `.env.production`, and
+  value-bearing files that merely start with a template name
+  (`.env.example.local`, `.env.example.bak`) stay blocked, as do `auth.json`,
+  `secretkey.json` and credential files. Bash access to any env file — including
+  the templates — remains blocked; `Read`/`Write` is the sanctioned path.
+
 ## 0.4.0
 
 ### Minor Changes

@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/wizard",
-	"version": "0.4.0",
+	"version": "0.4.1",
 	"description": "AI-powered encryption setup for CipherStash. Reads your codebase, picks columns to encrypt, and wires everything up.",
 	"repository": {
 		"type": "git",