feat!: remove EQL v2 repo-wide (umbrella, #707)

[tobyhede]

Umbrella PR for #707 — the integration branch collecting the EQL v2 removal stack. Still a draft: seven of the planned PRs have landed, packages/cli and packages/stack still carry v2, and the branch is one commit behind main.

Goal

Make EQL v3 the sole generation the workspace authors and emits, while preserving the ability to decrypt existing v2 payloads. "Remove v2" means remove the v2 emission and authoring surface, not the read path.

End state: no eql_v2_* emission or authoring path, one naming convention (v3 takes the unsuffixed name), green suite, v2 ciphertext still readable.

Decisions

Referenced by number from the sub-PRs. Stated here so they resolve.

• 1b — migration scope is a client, not a process. Customers can install both majors side by side; test/live/side-by-side-clients-live-pg.test.ts runs a v2 and a v3 client in one process against one database. No shipped data-migration tooling.
• 5 — v3 takes the unsuffixed name. The *V3 name stays as a @deprecated alias, so people already on v3 don't rewrite imports twice. Exception: stack-drizzle's ./v3 subpath is a hard break, no alias — post-collapse the root names match v2's, so a stale import would type-check while silently binding v3 semantics. Full rationale in Remove EQL v2 repo-wide (umbrella) #707's "Naming — decided".
• 6 — preserve v2 decrypt. Every PR touching an encrypt/decrypt or classification path carries a v2-payload round-trip test. This is the safety property the whole removal hangs on; see "Test-coverage gap" below, which is currently unmet.

Landed

PRs 1–7. All green on a16302fc.

#	Scope	PR
1	Delete the v2-only published packages — protect, schema, protect-dynamodb (~19k lines)	#760
2	migrate — drop EQL v2 from the domain-type classifier	#761
3	stack core — v3 audit-on-decrypt, collapse EncryptionV3 into Encryption	#768
4	stack-supabase — remove v2 authoring surface, de-suffix v3, delete query-builder-v3.ts	#769
5	stack-drizzle — remove v2 root, collapse ./v3 to root (hard break, no alias)	#770
6	wizard — port the migration rewriter to the v3 domain family	#771
7	cli/examples/meta — de-suffix the init scaffold, rewrite examples/basic to v3, sweep the docs	#776

Verified: examples/basic, examples/prisma and e2e typecheck clean; Biome reports 0 errors (196 warnings, CI gates on errors only); all eight SKILL.md files are free of stale references, with every *V3 mention explicitly marked deprecated; EncryptionErrorTypes and the EQL payload keys are untouched; every exports entry keeps both import and require.

@cipherstash/stack/v3, EncryptionV3 and encryptedSupabaseV3 still exist as @deprecated aliases per Decision 5 — they are not stale.

Branch state

One commit behind main, one conflict: packages/stack-drizzle/README.md against #775. The six stack-drizzle conflicts from #763 are already resolved — encryptedIndexes sits at src/indexes.ts and is exported from the root barrel.

Remaining

PR 8 — cli + migrate, the v2 SQL leaf

≈ −25,200 / +300 across ~40 files; ~2,700 lines excluding the vendored SQL.

Delete: src/sql/*.sql (22,512 lines, read only by installer/index.ts and copied by tsup.config.ts:83); encrypt/cutover.ts (306); db/push.ts (177); db/activate.ts (73); db/supabase-migration.ts (133); migrate/src/eql.ts (166 — all eight functions confirmed eql_v2.* mutations, exported at migrate/src/index.ts:44-53); the --eql-version / --latest flags at registry.ts:353-364,426-437; the v2 routing in db/install.ts:269-316,697-727,760-816.

eql upgrade stays — db/upgrade.ts:29 already defaults to v3. Only its flags go.

Deleting cutover.ts leaves no hole. The v3 ladder is complete: backfill.ts:561 → drop.ts:113-123 → dropped, already rendered by quest.ts:95-104. The identically-named plan step (parse-plan.ts:14, rollout-state.ts:26) is v3-valid and survives.

Must survive: db/status.ts:32-62,104-131 (legacy v2 detection — without it a v2 customer is told "EQL is not installed"); the manifest eqlVersion fallbacks in encrypt/status.ts:127-129,154-183 and status/index.ts:41,55,136-147 (the only remaining v2 signal since #761); eql_v2_encrypted in rewrite-migrations.ts:11 (that sweep runs on the v3 path over repos whose history carries v2 tokens); encrypt/lib/db-readers.ts:46-82; the empty-candidate guard in encrypt/lib/resolve-eql.ts.

Decrypt-path risk, must be mitigated in the same PR: deleting the vendored SQL removes the only offline way to recreate public.eql_v2_encrypted when restoring a v2 dump into a fresh Postgres. Surface installer/index.ts:38-40's upstream eql-2.3.1 release URL in the --eql-version 2 rejection message.

Sequencing: tsup.config.ts:83's cpSync('src/sql', …) throws on a missing directory, so it moves in the same commit. Confirm eql/migration.ts:229's ALTER COLUMN sweep is complete before deleting install.ts:638-680, or the CLI ships broken Drizzle migrations.

Open: whether --eql-version 3 stays accepted (8 doc/skill sites plus test-kit/src/install.ts:64 pass it; parseArgs is lenient, so leaving it silently ignored is dishonest). skills/stash-encryption/SKILL.md:1057 becomes false on merge.

PRs 9–12 — packages/stack, the v2 authoring and emission surface

Not previously tracked as outstanding, and the largest remaining piece. src/schema/index.ts is 754 lines, of which ~511 (68%) are v2-only authoring: EncryptedColumn (269-452), EncryptedTable (459-548), EncryptedField (214-267), encryptedTable/encryptedColumn/encryptedField (599-716). All three root re-exports at src/index.ts:9 are v2-only — the package root exposes no v3 authoring.

The emission path is live. resolveEqlVersion (encryption/index.ts:97-131) detects v3 by hasBuildColumnKeyMap, and :130 returns undefined when no v3 table is present. protect-ffi 0.30.0 documents undefined as defaulting to 2. So Encryption({ schemas: [v2Table] }) still writes v2 wire, and there is no runtime rejection of a v2 schema (encryption/index.ts:879-947 checks only non-empty schemas, keyset UUID, mixed sets and v2 ste_vec). Only the WASM entry rejects, at wasm-inline.ts:1359-1366 — the pattern to lift.

Removing the DSL does not remove the undefined branch: the loose BuildableTable path (types.ts:271) would keep writing v2 silently.

Test-coverage gap — Decision 6 is currently unmet. No test anywhere has a v3-configured client decrypt v2 ciphertext, which is the actual invariant customers depend on. All v2 coverage is same-client v2→v2 round-trip. Worse, integration/shared/v2-decrypt-compat.integration.test.ts:29-45 mints its fixture through the emission path being removed — it dies with the code it guards, and passes falsely until then. A purely static fixture is not viable as the sole replacement: ZeroKMS ciphertexts are keyset-bound, and test-kit/src/env.ts:30-67 lets credentials come from a developer's own profile, so a fixture minted against CI's workspace won't decrypt locally.

Suggested split:

• 9 (coverage only, lands first and alone) — v3-client-decrypts-v2 for core and DynamoDB; a static credential-free payload driving the envelope/parsing helpers; rewrite the live half to mint from a raw EncryptConfig rather than the DSL.
• 10 (wire contract) — decide the no-v3-marker case: throw, or default to 3 deliberately. Lift the wasm-inline rejection into the native entry.
• 11 (mechanical) — one buildEncryptConfig (encryption/index.ts:910 currently uses the v2 copy for both generations); de-couple dynamodb/types.ts:11,29,266,280. No public surface change.
• 12 (breaking) — delete the ~511 DSL lines and the root re-exports, resolve the encryptedTable/Infer* name collisions, port or drop ~30 v2-authored test files.

Keep the eqlVersion: 2 hatch — it outlives the builders and the read-compat test needs it.

Fix before merge

• .changeset/ carries 29 stale references across 12 files, and these render into the shipped 1.0.0 CHANGELOG. adapter-package-split.md:14,15,22-24 and eql-v3-drizzle.md:5,8,12,13 name encryptedType, @cipherstash/stack/eql/v3/drizzle and the *V3 drizzle symbols as migration targets; six further files point at @cipherstash/stack-drizzle/v3; drizzle-encrypted-indexes.md:5 advertises the deleted /v3 entry; eql-v3-sole-docs.md:10-13 contradicts stack-dynamodb-v2-write-removal.md on DynamoDB.
• packages/stack/README.md:446-451 headlines the Supabase section with the deprecated encryptedSupabaseV3, contradicting :766 of the same file and three other sources.
• init/lib/introspect.ts:88 matches only eql_v2_encrypted, so stash init pre-selects nothing on a v3 database and :233 announces the wrong domain. Pre-existing on main, fixed in PR 8.
• examples/* and e2e/* typecheck in no CI job — turbo filters to ./packages/*. That is why examples/basic could sit broken here. Add a job.

Release mechanics

Mid-RC, fixed group: stash, stack, stack-drizzle, stack-supabase, prisma-next, wizard (all at 1.0.0-rc.4). Six major-bearing changesets land inside it — stack-1-0-0-rc, stack-audit-on-decrypt, stack-dynamodb-v2-write-removal, remove-eql-v2-drizzle-root, remove-eql-v2-supabase-authoring, supabase-single-row-typing — so the whole group goes to 1.0.0-rc.5. migrate → 1.0.0-rc.2; nextjs → 4.1.2.

Two corrections wanted:

• remove-eql-v2-packages.md's @cipherstash/nextjs: patch is a phantom bump. packages/nextjs depends only on jose and references no @cipherstash/* package; it would ship a changelog entry about three packages it never used. Drop the line.
• remove-eql-v2-migrate-classifier.md at patch under-communicates. migrate/src/version.ts:47-51 dropped the eql_v2_encrypted → 2 arm, so listEncryptedColumns silently omits v2 columns under an unchanged signature, and resolveEncryptedColumn/detectColumnEqlVersion inherit it. minor at minimum (moot inside migrate's own major, but the changelog should say it).

Out of scope

#708 (Supabase v3 in Workers/browser), #654 (v3 Supabase full-ciphertext scalar operand), #637, and customer data-migration tooling.

Closes

Closes #707
Closes #752
Closes #198

#198 closes as obsoleted, not implemented — encryptedType no longer exists in the Drizzle public API, so the duplicative-generic complaint has no referent. #752's last item was the stash init scaffold, delivered by #776.

Already closed as NOT_PLANNED on 2026-07-21, carried by this work: #409, #599, #423, #426, #421, #422.

[changeset-bot]

🦋 Changeset detected

Latest commit: f7b8220

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 13 packages

Name	Type
stash	Major
@cipherstash/stack-drizzle	Major
@cipherstash/stack	Major
@cipherstash/migrate	Patch
@cipherstash/prisma-next	Major
@cipherstash/nextjs	Patch
@cipherstash/stack-supabase	Major
@cipherstash/wizard	Major
@cipherstash/basic-example	Patch
@cipherstash/e2e	Patch
@cipherstash/bench	Patch
@cipherstash/test-kit	Patch
@cipherstash/prisma-next-example	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a302201b-366a-44cb-b2ee-794e285beba6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch remove-v2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderdan]

Code review of #780's content, retargeted here

This review ran against fix/remove-v2-review-remediation before it merged. Since #780 landed first, the findings are retargeted to this umbrella — all of them are now in remove-v2 at 972a8a85. Every finding below was re-verified against that merged commit with a clean packages/stack rebuild, because the original pass used dist/ artefacts built on another branch.

One finding changed materially on re-verification — see the correction under Type surface below. Two candidates were dropped before this list as pre-existing on main and untouched by the diff (not(col,'like') bypassing the likeNeedle shim; the core client's Record<string, unknown> constraint rejecting interface row types — the latter fixed only for stack-supabase by 3c33c127).

The headline is a cluster, not a list

Findings 1–4 are all rewrite-migrations.ts, and they all end the same way: a commented-out or already-encrypted ALTER is rewritten into a live DROP COLUMN. This branch already hand-applied fixes to that rewriter four times (7eb47ed9, ae2fedd8, 05b7bf07, 383d3c2b) — twice each, because the 545-line file is duplicated between packages/wizard and packages/cli. That duplication is arguably the root finding: it's the reason partial fixes keep landing. Every fix below needs applying in both copies.

1. Quote-parity drift makes a commented ALTER execute as a DROP — wizard/src/lib/rewrite-migrations.ts:215 (mirror cli/src/commands/db/rewrite-migrations.ts:207)

endOfQuoted treats only '' as an escape. A Postgres E'..\'..' string, or a dollar-quoted body with an odd apostrophe count, shifts quote parity for the rest of the file, so isInsideCommentOrString reports a commented-out ALTER as live.

Reproduced end-to-end against the real rewriteEncryptedAlterColumns:

CREATE FUNCTION note() RETURNS text AS $$ don't $$ LANGUAGE sql;
--> statement-breakpoint
-- it's ALTER TABLE "users" ALTER COLUMN "email" SET DATA TYPE eql_v3_text_search;

Result: rewritten=1, skipped=0, and the file now contains a bare ALTER TABLE "users" DROP COLUMN "email"; between two breakpoint markers — drizzle-kit runs it as its own chunk and destroys the column. A second repro with INSERT INTO t VALUES (E'a\'b', 'c'); before the commented ALTER does the same. The 137-test wizard suite is green on both.

2. CREATE_TABLE_RE is comment- and literal-blind — rewrite-migrations.ts:251 (mirror :243)

The lazy body ([\s\S]*?)\)\s*; stops at the first );, including one inside a -- comment or a DEFAULT string, so every encrypted column after it is missed by indexEncryptedColumns.

CREATE TABLE "users" (
  "id" text, -- pk (uuid);
  "email" eql_v3_text_search
);

captures only "id" text, -- pk (uuid. A later ALTER … SET DATA TYPE eql_v3_text_eq; then fails the already-encrypted check and is rewritten into ADD+DROP+RENAME — dropping a column full of ciphertext with no plaintext anywhere to backfill from, the exact irrecoverable outcome the function's own docblock warns about.

3. Chained SET DATA TYPE ALTERs are both rewritten — rewrite-migrations.ts:298 (mirror :290)

indexEncryptedColumns indexes CREATE TABLE, ADD COLUMN and RENAME, but never the strict matcher's own target: ALTER … SET DATA TYPE <encrypted domain>. Corpus 0001 CREATE TABLE "users" ("email" text); / 0002 ALTER … SET DATA TYPE eql_v2_encrypted; / 0003 … SET DATA TYPE eql_v3_text_search; — realistic for a directory where an older stack version generated 0002 before the sweep existed — returns rewritten=['0002','0003'], skipped=[]. After 0002 the column holds v2 ciphertext; 0003 then drops it, unflagged. Indexing the strict matcher's target (or re-indexing after each file) closes it.

4. columnKey is schema-sensitive but Postgres is not — rewrite-migrations.ts:275 (mirror :267)

JSON.stringify([schema ?? '', table, column]) keys "users" and "public"."users" differently. A column created unqualified (the drizzle-kit default) and later altered schema-qualified — which this diff's widened TABLE_REF now matches — misses the new already-encrypted guard and gets ADD+DROP+RENAME applied to a ciphertext column. The existing test scopes the check to the table varies the table name but never the qualification.

5. The sweep widened the blast radius, and writes land before the prompt — wizard/src/lib/post-agent.ts:163

rewriteEncryptedMigrations changed from "rewrite the first candidate directory that exists, then return" to sweepMigrationDirs(cwd, ['drizzle','migrations','src/db/migrations']). The docblock justifies this only against double-transformation ("the rewrite is idempotent"), but the dropped early return also bounded the blast radius to one directory. migrations/ and src/db/migrations/ are generic names owned by Knex, node-pg-migrate, Flyway, raw psql. In a project whose drizzle-kit out is drizzle/ but which also keeps a hand-maintained migrations/, stash wizard now rewrites any ALTER TABLE … SET DATA TYPE <eql domain>; there into the destructive sequence — in a directory it was never pointed at, with no dry run. writeFile commits at line 83; the confirm is at line 112.

Correctness

6. stash init scaffolds a file that does not compile — cli/src/commands/init/utils.ts:434 and :488

Both placeholders emit export const encryptionClient = await Encryption({ schemas: [] }), but this branch tightened both Encryption overloads to require a non-empty schema tuple. Re-verified against a fresh packages/stack build on 972a8a85:

TS2769: No overload matches this call.
  Overload 1 of 2 … Type '[]' is not assignable to type 'readonly [AnyV3Table, ...AnyV3Table[]]'.
    Source has 0 element(s) but target requires 1.

The old scaffold used EncryptionV3, whose readonly AnyV3Table[] bound accepted []. So every stash init now leaves a project whose first tsc / next build fails, in a file the CLI just wrote and told the user not to hand-edit. encryption-overloads.test-d.ts:49 asserts this call is a type error on purpose; the codegen tests only string-match the template, so nothing connects the two.

7. encrypt cutover picks an unrelated v3 column on a mixed table and exits 0 — cli/src/commands/encrypt/cutover.ts:97

Removing v2 from classifyEqlDomain drops v2 columns out of listEncryptedColumns, so pickEncryptedColumn falls through to the via: 'sole' rule — and cutover branches on info?.version === 3 without ever checking info.via. stash encrypt cutover --table users --column ssn, where ssn/ssn_encrypted are v2 at phase backfilled and the table also carries one v3 column email_enc: the <col>_encrypted convention no longer matches, others.length === 1 picks email_enc, and the command prints "Cut-over is not applicable to EQL v3 columns … point your application at email_enc" and returns 0. The v2 rename never runs and a scripted rollout reads success. drop.ts:106 does gate on via === 'sole', but its prescribed remedy is unreachable — pickEncryptedColumn returns null for a hint that isn't among the candidates, so --encrypted-column ssn_encrypted re-resolves via 'sole' and reprints the same error forever.

8. EncryptionV3 lost the invariant it existed to enforce — stack/src/encryption/index.ts:127

It is now a bare alias of Encryption. The old implementation forced config: { ...config, eqlVersion: 3 }; resolveEqlVersion returns explicit unchanged and never rejects explicit === 2 against an all-v3 schema set. A caller upgrading from EncryptionV3({ schemas: [v3Table], config: { eqlVersion: 2 } }) — previously auto-corrected and working — now builds a v2-wire FFI client over v3 concrete domains, the isV3Only && eqlVersion === 3 gate at line 947 also fails so they silently get the nominal client, and every subsequent encrypt dies inside protect-ffi with Cannot convert undefined or null to object — the opaque error the deleted override's comment says it existed to prevent. resolveEqlVersion already throws for mixed sets and for v2 SteVec; this is the one case it lets through.

9. Encryption only accepts an inline array literal — stack/src/encryption/index.ts:947 (corrected on re-verification)

The original finding claimed a silent type/runtime divergence — that a non-tuple schema list resolves to overload 2 and is typed EncryptionClient while the runtime returns typedClient's object. That is not what happens, and I'm correcting it here. What actually happens is a hard compile error on both overloads:

const schemas: AnyV3Table[] = [t]
await Encryption({ schemas })
// TS2769: No overload matches this call.
//   Overload 1 … Type 'AnyV3Table[]' is not assignable to 'readonly [AnyV3Table, ...AnyV3Table[]]'
//   Overload 2 … Type 'AnyV3Table[]' is not assignable to 'AtLeastOneCsTable<BuildableTable>'

Hoisting the config is enough to trigger it — const cfg = { schemas: [t] }; await Encryption(cfg) fails identically, because schemas widens to an array type. Only an inline literal at the call site compiles. The runtime accepts every one of these forms (schemas.every(hasBuildColumnKeyMap)), so this is a pure type-surface regression, and it's why stack-supabase casts through Parameters<typeof Encryption>[0]['schemas']. Less alarming than originally written, but it rejects a very ordinary way to build config, and it's the same Encryption-signature defect this PR's own Not in this PR section defers.

10. The table-less decrypt branch breaks the wasm-inline client — stack/src/dynamodb/operations/decrypt-model.ts:57 (same at bulk-decrypt-models.ts:61)

isV3Table(this.table) ? client.decryptModel(x, table) : client.decryptModel(x) assumes every client accepts a table-less decrypt, but WasmEncryptionClient.decryptModel(model, table) (wasm-inline.ts:1148) requires the table and returns a bare promise with no .audit(). A @cipherstash/stack/wasm-inline client — the documented path for Deno / Workers / Supabase Edge — structurally satisfies DynamoDBEncryptionClient, so encryptedDynamoDB({ encryptionClient }) accepts it. Reading a legacy v2 item takes the else-branch with table === undefined. The same commit's rewritten comments in helpers.ts:105 and types.ts ("Every client this package ships carries .audit() on decrypt") are false for that client, and the debug message it prints describes exactly what the user already did.

11. .or() corrupts nested and(…) / or(…) groups — stack-supabase/src/query-filters.ts:341

The rebuild path is taken whenever any condition names an encrypted column, but parseOrString/rebuildOrString cannot round-trip a nested group — the verbatim fallback's own comment admits this. Reproduced against the real helpers: parseOrString('and(age.gte.18,age.lte.30),email.eq.a@b.com') yields [{column:'and(age', op:'gte', value:'18,age.lte.30)'}, …], and rebuildOrString emits and(age.gte."18,age.lte.30)",email.eq."a@b.com" — unbalanced and(, group swallowed into a quoted operand, PGRST100. The identical call with only plaintext columns takes the verbatim branch and works, so adding one encrypted column to a working .or() breaks it. The 93-test supabase-v3-builder suite is green.

12. The bench seeds plaintext into encrypted columns — bench/src/harness/seed.ts:51

The v2→v3 port left the seed keying models by DB column name while v3 model operations key by JS property name. drizzle/setup.ts:20 declares encText: types.TextSearch('enc_text'); BenchPlaintextRow at :31 is keyed enc_text. So buildColumnKeyMap() is {encText:'enc_text', …}, no field is recognised as encrypted, the comment at seed.ts:66-68 ("returns rows keyed by the encryptedTable column names (snake_case here)") is now false, and r.enc_text at line 70 is undefined. Any credentialed run (test:local, bench:local, operators.explain.test.ts) then inserts raw plaintext into eql_v3_text_search / eql_v3_integer_ord / eql_v3_json_search — failing the domain CHECK, or storing plaintext in a column typed as encrypted. The new turbo run build --filter @cipherstash/bench gate is tsc --noEmit and passes because BenchPlaintextRow is hand-written and agrees with itself; the tests-bench CI job only runs the credential-free db-only filter, which never seeds.

Test coverage and shipped docs

13. ReturnType reads the last overload, making the M1 guard vacuous — stack-drizzle/__tests__/operators.test-d.ts:24

type V3Client = Awaited<ReturnType<typeof EncryptionV3>> now resolves to the nominal EncryptionClient, because EncryptionV3 = Encryption is overloaded — the exact trap this branch's own EncryptionClientFor docblock documents. Re-verified on 972a8a85: (c: V3Client) => c.init compiles, which it would not for the typed client. So "accepts the client EncryptionV3 returns with no cast" is now a byte-for-byte duplicate of the next test and the typed-client half of the contract is covered by nothing, while test:types stays green. The same annotation is a hard error in five files nothing type-checks — tsc in packages/stack-drizzle reports integration/adapter.ts(160,7): TS2739: Type 'TypedEncryptionClient<readonly [never]>' is missing … client, encryptConfig, init, plus identical errors at integration/json-adapter.ts:75 and integration/lock-context.integration.test.ts:158. The package has no typecheck script and its vitest typecheck scope is limited to *.test-d.ts.

14. The shipped stash-encryption skill now contradicts itself — skills/stash-encryption/SKILL.md:378

:378 ("return a plain Promise<Result<...>> (not a chainable operation)"), :686 ("so there is no .withLockContext() to chain") and :735 are contradicted by this branch's own MappedDecryptOperation — and by :1077 of the same file, which now says the opposite. Per AGENTS.md, these are copied verbatim into .claude/skills/ in every project by installSkills(), so the file steers agents away from the .audit() chain .changeset/stack-audit-on-decrypt.md advertises. packages/stack/README.md:710, :712, :717 and :531-532 publish the same stale return type inside the npm tarball, in a file this diff already edited.

15. The new required CI gate has both a false positive and a false negative — scripts/lint-no-dead-package-paths.mjs:43

PACKAGE_REF = /packages\/([a-z0-9][a-z0-9._-]*)/g greedily swallows sentence punctuation: The client lives in packages/stack. is reported as "packages/stack. does not exist" and the script exits 1 — so the next docs edit ending a sentence with a bare package path breaks the build with a message naming a live package. (The character class also excludes uppercase, so packages/Foo is never checked.) Conversely livePackages comes from readdirSync('packages') — the working tree, not tracked files — so packages/protect/src/ffi/index.ts, one of the references this script was commissioned to catch, is not flagged: packages/protect, packages/schema, packages/protect-dynamodb and packages/drizzle all survive as untracked dist/ + node_modules/ shells with 0 tracked files. Consequently pnpm run test:scripts is red on any checkout that has built main — 5 of its 10 self-tests fail. Related: this diff removes the dead packages/protect/src/bin/runner.ts allowlist entry from lint-no-hardcoded-runners.mjs:13 but leaves the equally dead packages/drizzle/src/bin/runner.ts directly beneath it, and scripts/ is not in the new linter's TARGETS.

Verified but cut for length

The ~98% duplication of the destructive rewriter across wizard and cli (root cause of 1–4); postprocessDecryptedRow rebuilding its key map per row, and its divergent second date-reconstruction implementation; DynamoDB v3 nested (dotted) date columns never being Date-reconstructed because buildColumnKeyMap is flat while toItemWithEqlPayloads rebuilds nested objects; or()'s structured branch dropping options.referencedTable; v2 columns backfilled from now on recording no eqlVersion; classifyEqlDomain no longer being able to return 2, making EncryptedColumnInfo.version and the isV3 checks vacuous; protectOps.eq (a nonexistent API) in the shipped implement prompt at setup-prompt.ts:283; dead v2-only bulkModelsToEncryptedPgComposites exports still on the audited adapter-kit seam; un-cleaned temp dirs and an unrestored sweepMigrationDirs mock in the new post-agent.test.ts; .changeset/dynamodb-eql-v3.md contradicted by same-release changesets; and the default @cipherstash/stack entry now statically importing the EQL v3 authoring DSL via encryption/index.ts -> ./v3.