chore!: remove the legacy @cipherstash/drizzle package

.changeset/pre.json

@@ -8,7 +8,6 @@
     "@cipherstash/supabase-worker-example": "0.0.0",
     "@cipherstash/bench": "0.0.4",
     "stash": "0.17.1",
-    "@cipherstash/drizzle": "3.0.3",
     "@cipherstash/migrate": "0.2.0",
     "@cipherstash/nextjs": "4.1.1",
     "@cipherstash/prisma-next": "0.3.2",
@@ -26,7 +25,6 @@
     "adapter-split-skills",
     "cli-anonymous-telemetry",
     "cli-eql-v3-single-bundle",
-    "drizzle-legacy-readme-pointer",
     "eql-v3-adapter-type-robustness",
     "eql-v3-bigint-domains",
     "eql-v3-bundle-from-package",

.changeset/remove-legacy-drizzle-package.md

@@ -0,0 +1,13 @@
+---
+'stash': patch
+'@cipherstash/stack-drizzle': patch
+---
+
+The legacy `@cipherstash/drizzle` package (the `@cipherstash/protect`-based
+Drizzle integration) is removed from the repository and the release train —
+`@cipherstash/protect` is sunsetting at Stack 1.0, and the package's successor
+is `@cipherstash/stack-drizzle`. Already-published versions remain installable
+from npm (deprecated, pointing here); the git history preserves the source for
+any emergency maintenance. The `stash-drizzle` skill and the
+`@cipherstash/stack-drizzle` README now state the deprecation explicitly so
+nobody (human or agent) installs the legacy package by mistake.

.github/workflows/rebuild-docs.yml

@@ -4,7 +4,6 @@ on:
   push:
     tags:
       - '@cipherstash/protect@*'
-      - '@cipherstash/drizzle@*'
 
 jobs:
   trigger-docs-rebuild:

.github/workflows/tests.yml

@@ -168,15 +168,6 @@ jobs:
           echo "CS_CLIENT_KEY=${{ secrets.CS_CLIENT_KEY }}" >> ./packages/protect-dynamodb/.env
           echo "CS_CLIENT_ACCESS_KEY=${{ secrets.CS_CLIENT_ACCESS_KEY }}" >> ./packages/protect-dynamodb/.env
 
-      - name: Create .env file in ./packages/drizzle/
-        run: |
-          touch ./packages/drizzle/.env
-          echo "CS_WORKSPACE_CRN=${{ vars.CS_WORKSPACE_CRN }}" >> ./packages/drizzle/.env
-          echo "CS_CLIENT_ID=${{ vars.CS_CLIENT_ID }}" >> ./packages/drizzle/.env
-          echo "CS_CLIENT_KEY=${{ secrets.CS_CLIENT_KEY }}" >> ./packages/drizzle/.env
-          echo "CS_CLIENT_ACCESS_KEY=${{ secrets.CS_CLIENT_ACCESS_KEY }}" >> ./packages/drizzle/.env
-          echo "DATABASE_URL=postgres://cipherstash:password@localhost:5432/cipherstash" >> ./packages/drizzle/.env
-
       # Run TurboRepo tests
       - name: Run tests
         run: pnpm run test
@@ -388,22 +379,13 @@ jobs:
           echo "CS_CLIENT_KEY=${{ secrets.CS_CLIENT_KEY }}" >> ./packages/protect-dynamodb/.env
           echo "CS_CLIENT_ACCESS_KEY=${{ secrets.CS_CLIENT_ACCESS_KEY }}" >> ./packages/protect-dynamodb/.env
 
-      - name: Create .env file in ./packages/drizzle/
-        run: |
-          touch ./packages/drizzle/.env
-          echo "CS_WORKSPACE_CRN=${{ vars.CS_WORKSPACE_CRN }}" >> ./packages/drizzle/.env
-          echo "CS_CLIENT_ID=${{ vars.CS_CLIENT_ID }}" >> ./packages/drizzle/.env
-          echo "CS_CLIENT_KEY=${{ secrets.CS_CLIENT_KEY }}" >> ./packages/drizzle/.env
-          echo "CS_CLIENT_ACCESS_KEY=${{ secrets.CS_CLIENT_ACCESS_KEY }}" >> ./packages/drizzle/.env
-          echo "DATABASE_URL=postgres://cipherstash:password@localhost:5432/cipherstash" >> ./packages/drizzle/.env
-
       # Build with Node (turbo/tsup need Node), then run tests with Bun
       - name: Build packages
         run: pnpm turbo build --filter './packages/*'
 
       - name: Run tests with Bun
         run: |
-          for dir in packages/schema packages/protect packages/stack packages/protect-dynamodb packages/drizzle packages/stack-forge; do
+          for dir in packages/schema packages/protect packages/stack packages/protect-dynamodb packages/stack-forge; do
             if [ -f "$dir/vitest.config.ts" ] || [ -f "$dir/package.json" ]; then
               echo "--- Testing $dir ---"
               (cd "$dir" && bunx --bun vitest run) || true

AGENTS.md

@@ -85,7 +85,6 @@ If these variables are missing, tests that require live encryption will fail or
 - `packages/stack-drizzle`: Drizzle ORM integration (`@cipherstash/stack-drizzle`), depends on `@cipherstash/stack` — EQL v2 (`.`) and EQL v3 (`./v3`). Split out of `@cipherstash/stack`.
 - `packages/stack-supabase`: Supabase integration (`@cipherstash/stack-supabase`), depends on `@cipherstash/stack` — `encryptedSupabase` (v2) and `encryptedSupabaseV3` (v3). Split out of `@cipherstash/stack`.
 - `packages/schema`: Schema builder utilities and types (`encryptedTable`, `encryptedColumn`, `encryptedField`)
-- `packages/drizzle`: Drizzle ORM integration (`encryptedType`, `extractEncryptionSchema`, `createEncryptionOperators`)
 - `packages/nextjs`: Next.js helpers and Clerk integration (`./clerk` export)
 - `packages/protect-dynamodb`: DynamoDB helpers (`encryptedDynamoDB`)
 - `packages/utils`: Shared config (`utils/config`) and logger (`utils/logger`)

SECURITY.md

@@ -13,7 +13,6 @@ This repository is the CipherStash Stack monorepo for JavaScript/TypeScript. It
 | `stash` | CipherStash CLI |
 | `@cipherstash/protect` | Core encryption library (re-exported via `@cipherstash/stack`) |
 | `@cipherstash/schema` | Schema builder utilities |
-| `@cipherstash/drizzle` | Drizzle ORM integration |
 | `@cipherstash/nextjs` | Next.js helpers |
 | `@cipherstash/protect-dynamodb` | DynamoDB helpers |
 | `@cipherstash/migrate` | Plaintext-to-encrypted column migration tooling |

e2e/package.json

@@ -9,7 +9,6 @@
   },
   "dependencies": {
     "stash": "workspace:*",
-    "@cipherstash/drizzle": "workspace:*",
     "@cipherstash/protect": "workspace:*",
     "@cipherstash/stack": "workspace:*",
     "@cipherstash/wizard": "workspace:*"

e2e/tests/package-managers.e2e.test.ts

@@ -26,10 +26,9 @@ const BIN = {
   cli: resolve(REPO_ROOT, 'packages/cli/dist/bin/stash.js'),
   wizard: resolve(REPO_ROOT, 'packages/wizard/dist/bin/wizard.js'),
   protect: resolve(REPO_ROOT, 'packages/protect/dist/bin/stash.js'),
-  drizzleGen: resolve(
-    REPO_ROOT,
-    'packages/drizzle/dist/bin/generate-eql-migration.js',
-  ),
+  // The legacy @cipherstash/drizzle `generate-eql-migration` bin is gone with
+  // the package (protect sunsets at 1.0; @cipherstash/stack-drizzle is the
+  // successor).
 } as const
 
 const UA: Record<PackageManager, string> = {