diff --git a/.changeset/ffi-platform-packages-publishing-repository.md b/.changeset/ffi-platform-packages-publishing-repository.md new file mode 100644 index 000000000..fd6ebddc9 --- /dev/null +++ b/.changeset/ffi-platform-packages-publishing-repository.md @@ -0,0 +1,34 @@ +--- +'@cipherstash/protect-ffi-darwin-x64': patch +'@cipherstash/protect-ffi-darwin-arm64': patch +'@cipherstash/protect-ffi-win32-x64-msvc': patch +'@cipherstash/protect-ffi-linux-x64-gnu': patch +'@cipherstash/protect-ffi-linux-arm64-gnu': patch +'@cipherstash/protect-ffi-linux-x64-musl': patch +--- + +**This is the first release of these packages published from +`cipherstash/stack`.** Every version up to and including 0.31.0 was published +from `cipherstash/protectjs-ffi`, which is archived once this release is out. + +If you verify npm provenance, the attested source repository changes with this +release: + +``` +0.31.0 github.com/cipherstash/protectjs-ffi .github/workflows/release.yml +0.32.0 github.com/cipherstash/stack .github/workflows/release.yml +``` + +A verification policy that pins the source repository will reject 0.32.0 until +it is updated. The packages, their contents and their maintainers are otherwise +unchanged: the Rust source moved into the monorepo at +`packages/protect-ffi/crates/protect-ffi`, and each of these packages' +`repository.url` now names `cipherstash/stack`, with `repository.directory` +pointing at its own stub under `packages/protect-ffi/platforms/`. + +`CHANGELOG.md` is also added to each package's published files, so this note and +later ones are readable in the package you install rather than only on GitHub. + +The binaries themselves differ from 0.31.0 in one user-visible way: the Rust +core's `InvariantViolation` message asks the reader to file an issue, and the +repository it names has moved with the rest. diff --git a/.changeset/ship-changelogs-in-tarballs.md b/.changeset/ship-changelogs-in-tarballs.md new file mode 100644 index 000000000..5e574d85e --- /dev/null +++ b/.changeset/ship-changelogs-in-tarballs.md @@ -0,0 +1,12 @@ +--- +'@cipherstash/stack-prisma': patch +'@cipherstash/protect-ffi': patch +--- + +Ship `CHANGELOG.md` inside the published tarball. It was missing from `files`, +so the release notes for these packages were readable on GitHub and on the npm +web page but not in the package you actually install — which is the copy you +have when something breaks offline, or when the repository has moved. + +`@cipherstash/stack-drizzle` and `@cipherstash/stack-supabase` gain it in the +same release, as do the six `@cipherstash/protect-ffi-` packages. diff --git a/.changeset/stack-2-0-0-version-alignment.md b/.changeset/stack-2-0-0-version-alignment.md new file mode 100644 index 000000000..2c7064bfc --- /dev/null +++ b/.changeset/stack-2-0-0-version-alignment.md @@ -0,0 +1,47 @@ +--- +'stash': major +'@cipherstash/stack': major +'@cipherstash/stack-drizzle': major +'@cipherstash/stack-supabase': major +'@cipherstash/wizard': major +--- + +**Why this package went to 2.0.0.** The major version number comes from +`@cipherstash/stack-prisma`, which moves to Prisma Next 0.17 — a breaking change +for its consumers, with the upgrade steps in its own Major Changes entry. These +six packages share one version line, so a major in any of them takes all six to +the same number: + +- `stash` +- `@cipherstash/stack` +- `@cipherstash/stack-drizzle` +- `@cipherstash/stack-supabase` +- `@cipherstash/stack-prisma` +- `@cipherstash/wizard` + +They are versioned together on purpose. `stash init` pins the versions of the +packages it installs and the CLI embeds that map at build time, so a package +shipping alone would leave the CLI recommending versions that no longer match +what is published, and warning about a skew it had itself created. + +**This does not mean every package in the release is drop-in.** The version +number is shared; the changes are not. Two changes elsewhere in this release +need action from some users, and neither is filed under Major Changes — each is +recorded at the level its own author judged correct. They are named here so you +do not have to read six changelogs to find them: + +- **`@cipherstash/stack` — `clientKey` is hex-only.** A decoder fallback that + also accepted standard padded base64 is gone, and such a key is now rejected + at client construction with `invalid clientKey: expected a hex-encoded key`. + Hex is what `stash env` emits and what the docs have always specified, so most + callers are unaffected; a key pasted out of `~/.cipherstash/secretkey.json` + (which stores base64) is not. The full entry is "Adopt protect-ffi 0.31.0" in + the **`@cipherstash/stack`** changelog; it also narrows which `error.code` + values DynamoDB operations report. +- **`stash` — `stash eql validate` lost `--exclude-operator-family`,** and two + checks that used to exit 1 no longer do. A script passing that flag, or a CI + gate relying on those exit codes, needs updating. The full entry is under + `eql validate` in the **`stash`** changelog. + +If you use neither `@cipherstash/stack-prisma` nor either of those, upgrading +1.x → 2.0.0 needs no code changes. diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index 488315751..0bd312d24 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,4 +1,4 @@ -# @cipherstash/cli +# stash ## 1.0.0 diff --git a/packages/protect-ffi/CHANGELOG.md b/packages/protect-ffi/CHANGELOG.md index 11be50ed5..ebfe25a1a 100644 --- a/packages/protect-ffi/CHANGELOG.md +++ b/packages/protect-ffi/CHANGELOG.md @@ -1,18 +1,32 @@ # Changelog -All notable changes to this project are documented in this file. - -The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), -and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). -While the project is pre-1.0, breaking changes are released as minor version -bumps and called out under a `Breaking` heading — an addition to the standard -Keep a Changelog categories (Added/Changed/Deprecated/Removed/Fixed/Security). - -Entries from 0.31.0 down were written by hand under an `[Unreleased]` heading -and promoted on release by an npm `version` lifecycle hook. That hook is gone: -since this package moved into the `cipherstash/stack` monorepo, Changesets -generates each entry from the changesets in a release, and appends it below in -its own format. Write a changeset, not a section here. +## About 0.31.0 and earlier + +Every entry from `[0.31.0]` down was written by hand, under an `[Unreleased]` +heading that an npm `version` lifecycle hook promoted on release. Those entries +follow [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), with a +`Breaking` heading added for the pre-1.0 convention of shipping breaking changes +as minor bumps. + +That hook is gone. Since this package moved into the `cipherstash/stack` +monorepo, Changesets generates every entry above this heading from the +changesets in a release, in its own format. + + ## [0.31.0] - 2026-07-27 diff --git a/packages/protect-ffi/package.json b/packages/protect-ffi/package.json index e24b2ced8..6b97a427c 100644 --- a/packages/protect-ffi/package.json +++ b/packages/protect-ffi/package.json @@ -73,7 +73,8 @@ "dist/wasm/protect_ffi_bg.wasm.d.ts", "dist/wasm/protect_ffi_inline.js", "dist/wasm/errors.js", - "dist/wasm/errors.d.ts" + "dist/wasm/errors.d.ts", + "CHANGELOG.md" ], "neon": { "type": "library", diff --git a/packages/protect-ffi/platforms/darwin-arm64/package.json b/packages/protect-ffi/platforms/darwin-arm64/package.json index 2dfa7aff0..d911e246d 100644 --- a/packages/protect-ffi/platforms/darwin-arm64/package.json +++ b/packages/protect-ffi/platforms/darwin-arm64/package.json @@ -15,7 +15,8 @@ ], "main": "index.node", "files": [ - "index.node" + "index.node", + "CHANGELOG.md" ], "neon": { "type": "binary", diff --git a/packages/protect-ffi/platforms/darwin-x64/package.json b/packages/protect-ffi/platforms/darwin-x64/package.json index 9f288cdcd..29be22966 100644 --- a/packages/protect-ffi/platforms/darwin-x64/package.json +++ b/packages/protect-ffi/platforms/darwin-x64/package.json @@ -15,7 +15,8 @@ ], "main": "index.node", "files": [ - "index.node" + "index.node", + "CHANGELOG.md" ], "neon": { "type": "binary", diff --git a/packages/protect-ffi/platforms/linux-arm64-gnu/package.json b/packages/protect-ffi/platforms/linux-arm64-gnu/package.json index 3b4933598..c5f7771f5 100644 --- a/packages/protect-ffi/platforms/linux-arm64-gnu/package.json +++ b/packages/protect-ffi/platforms/linux-arm64-gnu/package.json @@ -15,7 +15,8 @@ ], "main": "index.node", "files": [ - "index.node" + "index.node", + "CHANGELOG.md" ], "neon": { "type": "binary", diff --git a/packages/protect-ffi/platforms/linux-x64-gnu/package.json b/packages/protect-ffi/platforms/linux-x64-gnu/package.json index 44c695c09..e6635b39c 100644 --- a/packages/protect-ffi/platforms/linux-x64-gnu/package.json +++ b/packages/protect-ffi/platforms/linux-x64-gnu/package.json @@ -15,7 +15,8 @@ ], "main": "index.node", "files": [ - "index.node" + "index.node", + "CHANGELOG.md" ], "neon": { "type": "binary", diff --git a/packages/protect-ffi/platforms/linux-x64-musl/package.json b/packages/protect-ffi/platforms/linux-x64-musl/package.json index 0c427e61d..833f0374e 100644 --- a/packages/protect-ffi/platforms/linux-x64-musl/package.json +++ b/packages/protect-ffi/platforms/linux-x64-musl/package.json @@ -15,7 +15,8 @@ ], "main": "index.node", "files": [ - "index.node" + "index.node", + "CHANGELOG.md" ], "neon": { "type": "binary", diff --git a/packages/protect-ffi/platforms/win32-x64-msvc/package.json b/packages/protect-ffi/platforms/win32-x64-msvc/package.json index 37116ed34..3a80a838d 100644 --- a/packages/protect-ffi/platforms/win32-x64-msvc/package.json +++ b/packages/protect-ffi/platforms/win32-x64-msvc/package.json @@ -15,7 +15,8 @@ ], "main": "index.node", "files": [ - "index.node" + "index.node", + "CHANGELOG.md" ], "neon": { "type": "binary", diff --git a/packages/stack-drizzle/package.json b/packages/stack-drizzle/package.json index b67ee7bf7..ec60d110a 100644 --- a/packages/stack-drizzle/package.json +++ b/packages/stack-drizzle/package.json @@ -30,7 +30,8 @@ "sideEffects": false, "files": [ "dist", - "README.md" + "README.md", + "CHANGELOG.md" ], "exports": { ".": { diff --git a/packages/stack-prisma/CHANGELOG.md b/packages/stack-prisma/CHANGELOG.md index 6a06cbe06..bae13f9f5 100644 --- a/packages/stack-prisma/CHANGELOG.md +++ b/packages/stack-prisma/CHANGELOG.md @@ -1,4 +1,4 @@ -# @cipherstash/prisma-next +# @cipherstash/stack-prisma ## 1.0.0 diff --git a/packages/stack-prisma/package.json b/packages/stack-prisma/package.json index f7114280f..18f59369c 100644 --- a/packages/stack-prisma/package.json +++ b/packages/stack-prisma/package.json @@ -62,7 +62,8 @@ "files": [ "dist", "src", - "README.md" + "README.md", + "CHANGELOG.md" ], "scripts": { "build": "tsup", diff --git a/packages/stack-supabase/package.json b/packages/stack-supabase/package.json index 5520ba9d7..3b5092cf6 100644 --- a/packages/stack-supabase/package.json +++ b/packages/stack-supabase/package.json @@ -29,7 +29,8 @@ "sideEffects": false, "files": [ "dist", - "README.md" + "README.md", + "CHANGELOG.md" ], "exports": { ".": {