docs(release): explain the 2.0.0 alignment and the FFI publishing-repository change

.changeset/ffi-platform-packages-publishing-repository.md

@@ -0,0 +1,34 @@
+---
+'@cipherstash/protect-ffi-darwin-x64': patch
+'@cipherstash/protect-ffi-darwin-arm64': patch
+'@cipherstash/protect-ffi-win32-x64-msvc': patch
+'@cipherstash/protect-ffi-linux-x64-gnu': patch
+'@cipherstash/protect-ffi-linux-arm64-gnu': patch
+'@cipherstash/protect-ffi-linux-x64-musl': patch
+---
+
+**This is the first release of these packages published from
+`cipherstash/stack`.** Every version up to and including 0.31.0 was published
+from `cipherstash/protectjs-ffi`, which is archived once this release is out.
+
+If you verify npm provenance, the attested source repository changes with this
+release:
+
+```
+0.31.0   github.com/cipherstash/protectjs-ffi   .github/workflows/release.yml
+0.32.0   github.com/cipherstash/stack           .github/workflows/release.yml
+```
+
+A verification policy that pins the source repository will reject 0.32.0 until
+it is updated. The packages, their contents and their maintainers are otherwise
+unchanged: the Rust source moved into the monorepo at
+`packages/protect-ffi/crates/protect-ffi`, and each of these packages'
+`repository.url` now names `cipherstash/stack`, with `repository.directory`
+pointing at its own stub under `packages/protect-ffi/platforms/`.
+
+`CHANGELOG.md` is also added to each package's published files, so this note and
+later ones are readable in the package you install rather than only on GitHub.
+
+The binaries themselves differ from 0.31.0 in one user-visible way: the Rust
+core's `InvariantViolation` message asks the reader to file an issue, and the
+repository it names has moved with the rest.

.changeset/ship-changelogs-in-tarballs.md

@@ -0,0 +1,12 @@
+---
+'@cipherstash/stack-prisma': patch
+'@cipherstash/protect-ffi': patch
+---
+
+Ship `CHANGELOG.md` inside the published tarball. It was missing from `files`,
+so the release notes for these packages were readable on GitHub and on the npm
+web page but not in the package you actually install — which is the copy you
+have when something breaks offline, or when the repository has moved.
+
+`@cipherstash/stack-drizzle` and `@cipherstash/stack-supabase` gain it in the
+same release, as do the six `@cipherstash/protect-ffi-<platform>` packages.

.changeset/stack-2-0-0-version-alignment.md

@@ -0,0 +1,47 @@
+---
+'stash': major
+'@cipherstash/stack': major
+'@cipherstash/stack-drizzle': major
+'@cipherstash/stack-supabase': major
+'@cipherstash/wizard': major
+---
+
+**Why this package went to 2.0.0.** The major version number comes from
+`@cipherstash/stack-prisma`, which moves to Prisma Next 0.17 — a breaking change
+for its consumers, with the upgrade steps in its own Major Changes entry. These
+six packages share one version line, so a major in any of them takes all six to
+the same number:
+
+- `stash`
+- `@cipherstash/stack`
+- `@cipherstash/stack-drizzle`
+- `@cipherstash/stack-supabase`
+- `@cipherstash/stack-prisma`
+- `@cipherstash/wizard`
+
+They are versioned together on purpose. `stash init` pins the versions of the
+packages it installs and the CLI embeds that map at build time, so a package
+shipping alone would leave the CLI recommending versions that no longer match
+what is published, and warning about a skew it had itself created.
+
+**This does not mean every package in the release is drop-in.** The version
+number is shared; the changes are not. Two changes elsewhere in this release
+need action from some users, and neither is filed under Major Changes — each is
+recorded at the level its own author judged correct. They are named here so you
+do not have to read six changelogs to find them:
+
+- **`@cipherstash/stack` — `clientKey` is hex-only.** A decoder fallback that
+  also accepted standard padded base64 is gone, and such a key is now rejected
+  at client construction with `invalid clientKey: expected a hex-encoded key`.
+  Hex is what `stash env` emits and what the docs have always specified, so most
+  callers are unaffected; a key pasted out of `~/.cipherstash/secretkey.json`
+  (which stores base64) is not. The full entry is "Adopt protect-ffi 0.31.0" in
+  the **`@cipherstash/stack`** changelog; it also narrows which `error.code`
+  values DynamoDB operations report.
+- **`stash` — `stash eql validate` lost `--exclude-operator-family`,** and two
+  checks that used to exit 1 no longer do. A script passing that flag, or a CI
+  gate relying on those exit codes, needs updating. The full entry is under
+  `eql validate` in the **`stash`** changelog.
+
+If you use neither `@cipherstash/stack-prisma` nor either of those, upgrading
+1.x → 2.0.0 needs no code changes.

packages/cli/CHANGELOG.md

@@ -1,4 +1,4 @@
-# @cipherstash/cli
+# stash
 
 ## 1.0.0
 

packages/protect-ffi/CHANGELOG.md

@@ -1,18 +1,32 @@
 # Changelog
 
-All notable changes to this project are documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-While the project is pre-1.0, breaking changes are released as minor version
-bumps and called out under a `Breaking` heading — an addition to the standard
-Keep a Changelog categories (Added/Changed/Deprecated/Removed/Fixed/Security).
-
-Entries from 0.31.0 down were written by hand under an `[Unreleased]` heading
-and promoted on release by an npm `version` lifecycle hook. That hook is gone:
-since this package moved into the `cipherstash/stack` monorepo, Changesets
-generates each entry from the changesets in a release, and appends it below in
-its own format. Write a changeset, not a section here.
+## About 0.31.0 and earlier
+
+Every entry from `[0.31.0]` down was written by hand, under an `[Unreleased]`
+heading that an npm `version` lifecycle hook promoted on release. Those entries
+follow [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), with a
+`Breaking` heading added for the pre-1.0 convention of shipping breaking changes
+as minor bumps.
+
+That hook is gone. Since this package moved into the `cipherstash/stack`
+monorepo, Changesets generates every entry above this heading from the
+changesets in a release, in its own format.
+
+<!--
+This section is deliberately BELOW the generated entries, and any prose added
+between `# Changelog` and the first release heading must carry its own `##`
+heading — otherwise it is absorbed into the newest release.
+
+`changeset version` splices each release in directly after the `# Changelog`
+line. Headingless prose there is not a preamble: it lands inside that release's
+section, beneath its heading, and reads as part of those notes. This section
+used to be there and shipped as thirteen lines of the 0.32.0 entry, ending with
+an instruction addressed to contributors — see PR #913. A heading is what stops
+that, because it terminates the preceding section.
+
+Since 0.32.0 this file is in the package's `files` list, so anything here also
+ships inside the npm tarball. Guidance for contributors belongs in AGENTS.md.
+-->
 
 ## [0.31.0] - 2026-07-27
 

packages/protect-ffi/package.json

@@ -73,7 +73,8 @@
     "dist/wasm/protect_ffi_bg.wasm.d.ts",
     "dist/wasm/protect_ffi_inline.js",
     "dist/wasm/errors.js",
-    "dist/wasm/errors.d.ts"
+    "dist/wasm/errors.d.ts",
+    "CHANGELOG.md"
   ],
   "neon": {
     "type": "library",

packages/protect-ffi/platforms/darwin-arm64/package.json

@@ -15,7 +15,8 @@
   ],
   "main": "index.node",
   "files": [
-    "index.node"
+    "index.node",
+    "CHANGELOG.md"
   ],
   "neon": {
     "type": "binary",

packages/protect-ffi/platforms/darwin-x64/package.json

@@ -15,7 +15,8 @@
   ],
   "main": "index.node",
   "files": [
-    "index.node"
+    "index.node",
+    "CHANGELOG.md"
   ],
   "neon": {
     "type": "binary",

packages/protect-ffi/platforms/linux-arm64-gnu/package.json

@@ -15,7 +15,8 @@
   ],
   "main": "index.node",
   "files": [
-    "index.node"
+    "index.node",
+    "CHANGELOG.md"
   ],
   "neon": {
     "type": "binary",

packages/protect-ffi/platforms/linux-x64-gnu/package.json

@@ -15,7 +15,8 @@
   ],
   "main": "index.node",
   "files": [
-    "index.node"
+    "index.node",
+    "CHANGELOG.md"
   ],
   "neon": {
     "type": "binary",

packages/protect-ffi/platforms/linux-x64-musl/package.json

@@ -15,7 +15,8 @@
   ],
   "main": "index.node",
   "files": [
-    "index.node"
+    "index.node",
+    "CHANGELOG.md"
   ],
   "neon": {
     "type": "binary",

packages/protect-ffi/platforms/win32-x64-msvc/package.json

@@ -15,7 +15,8 @@
   ],
   "main": "index.node",
   "files": [
-    "index.node"
+    "index.node",
+    "CHANGELOG.md"
   ],
   "neon": {
     "type": "binary",

packages/stack-drizzle/package.json

@@ -30,7 +30,8 @@
 	"sideEffects": false,
 	"files": [
 		"dist",
-		"README.md"
+		"README.md",
+		"CHANGELOG.md"
 	],
 	"exports": {
 		".": {

packages/stack-prisma/CHANGELOG.md

@@ -1,4 +1,4 @@
-# @cipherstash/prisma-next
+# @cipherstash/stack-prisma
 
 ## 1.0.0
 

packages/stack-prisma/package.json

@@ -62,7 +62,8 @@
 	"files": [
 		"dist",
 		"src",
-		"README.md"
+		"README.md",
+		"CHANGELOG.md"
 	],
 	"scripts": {
 		"build": "tsup",

packages/stack-supabase/package.json

@@ -29,7 +29,8 @@
 	"sideEffects": false,
 	"files": [
 		"dist",
-		"README.md"
+		"README.md",
+		"CHANGELOG.md"
 	],
 	"exports": {
 		".": {