cipherstash · coderdan · Jul 16, 2026 · Jul 16, 2026
@@ -45,7 +45,11 @@
     "eql-v3-typed-client",
     "eql-v3-typed-schema",
     "eql-v3-wasm-inline",
+    "init-pins-runtime-versions",
     "prisma-next-0-14",
+    "prisma-next-joins-release-train",
+    "release-train-coupling",
+    "remove-legacy-drizzle-package",
     "remove-secrets-leftovers",
     "rename-db-install-to-eql-install",
     "schema-stevec-standard-pin",
@@ -64,7 +68,9 @@
     "supabase-v3-json-querying",
     "supabase-v3-order-by-ope-term",
     "v3-supabase-needle-lockcontext-errors",
+    "wasm-encrypt-query",
     "wizard-allow-env-templates",
-    "wizard-analytics-privacy"
+    "wizard-analytics-privacy",
+    "wizard-joins-release-train"
   ]
 }
@@ -1,5 +1,18 @@
 # @cipherstash/e2e
 
+## 0.0.3-rc.2
+
+### Patch Changes
+
+- Updated dependencies [6fcb967]
+- Updated dependencies [d803914]
+- Updated dependencies [413ca39]
+- Updated dependencies [b085f66]
+- Updated dependencies [daa25b8]
+  - stash@1.0.0-rc.2
+  - @cipherstash/stack@1.0.0-rc.2
+  - @cipherstash/wizard@1.0.0-rc.2
+
 ## 0.0.3-rc.1
 
 ### Patch Changes

@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/e2e",
-  "version": "0.0.3-rc.1",
+  "version": "0.0.3-rc.2",
   "private": true,
   "description": "End-to-end tests that exercise built CipherStash binaries and cross-package behaviour.",
   "type": "module",

@@ -1,5 +1,15 @@
 # @cipherstash/basic-example
 
+## 1.2.14-rc.2
+
+### Patch Changes
+
+- Updated dependencies [413ca39]
+- Updated dependencies [b085f66]
+  - @cipherstash/stack-drizzle@1.0.0-rc.2
+  - @cipherstash/stack@1.0.0-rc.2
+  - @cipherstash/stack-supabase@1.0.0-rc.2
+
 ## 1.2.14-rc.1
 
 ### Patch Changes

@@ -1,7 +1,7 @@
 {
   "name": "@cipherstash/basic-example",
   "private": true,
-  "version": "1.2.14-rc.1",
+  "version": "1.2.14-rc.2",
   "type": "module",
   "scripts": {
     "start": "tsx index.ts"

@@ -1,5 +1,14 @@
 # @cipherstash/prisma-next-example
 
+## 0.0.6-rc.2
+
+### Patch Changes
+
+- Updated dependencies [daa25b8]
+- Updated dependencies [b085f66]
+  - @cipherstash/prisma-next@1.0.0-rc.2
+  - @cipherstash/stack@1.0.0-rc.2
+
 ## 0.0.6-rc.1
 
 ### Patch Changes

@@ -1,7 +1,7 @@
 {
   "name": "@cipherstash/prisma-next-example",
   "private": true,
-  "version": "0.0.6-rc.1",
+  "version": "0.0.6-rc.2",
   "description": "End-to-end example of @cipherstash/prisma-next: searchable application-layer encryption for Postgres with Prisma Next, using @cipherstash/stack as the SDK.",
   "type": "module",
   "scripts": {

@@ -1,5 +1,14 @@
 # @cipherstash/bench
 
+## 0.0.5-rc.2
+
+### Patch Changes
+
+- Updated dependencies [413ca39]
+- Updated dependencies [b085f66]
+  - @cipherstash/stack-drizzle@1.0.0-rc.2
+  - @cipherstash/stack@1.0.0-rc.2
+
 ## 0.0.5-rc.1
 
 ### Patch Changes

@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/bench",
-  "version": "0.0.5-rc.1",
+  "version": "0.0.5-rc.2",
   "private": true,
   "description": "Performance / index-engagement benchmarks for stack integrations (Drizzle, encryptedSupabase, Prisma).",
   "type": "module",

@@ -1,5 +1,67 @@
 # @cipherstash/cli
 
+## 1.0.0-rc.2
+
+### Patch Changes
+
+- 6fcb967: `stash init` now pins the packages it installs (`@cipherstash/stack`, the
+  integration adapter, and `stash` itself) to the exact versions this CLI
+  release was built alongside, instead of installing bare package names that
+  resolve through npm dist-tags (#661). During a pre-release window dist-tags
+  lag or point at placeholders, so an unpinned `init` could silently deliver a
+  different release than the CLI driving the setup — stale `@cipherstash/stack`,
+  or an empty placeholder adapter — breaking `/v3` imports out of the box. The
+  versions are embedded at build time from the release train itself
+  (`src/release-train.ts`, the single source both the build and the runtime
+  check against), so they can never disagree with what was published together.
+
+  Init also now surfaces **version skew** on already-installed packages —
+  unconditionally, before any prompt or early exit, including when the install
+  is declined or partially fails. Interactively it offers to align the skewed
+  packages in the same confirm as the missing installs (keeping `stash` a dev
+  dependency); non-interactively it never mutates an existing install — it
+  warns and prints the exact align commands. A package whose manifest exists
+  but can't be read (an aborted install) is reported as skew, not treated as
+  matching. All other install guidance is pinned the same way: the
+  missing-package hints, `.cipherstash/context.json`'s `installCommand`, the
+  `install-eql` manual note, the native-module recovery hint (previously
+  `stash@latest`), and the `stash wizard` one-shot spawn (previously an
+  unpinned `npx @cipherstash/wizard`). The `stash-cli` skill documents the
+  behaviour, and the other bundled skills' manual install commands now carry a
+  verify-what-resolved note.
+
+- d803914: Two guards for the release-train version embed (#661 follow-up):
+
+  **Direction-aware version skew.** `stash init` now distinguishes an installed
+  package that is _behind_ this CLI release (offered alignment / the pinned
+  install command, as before) from one that is _newer_ than the release expects.
+  A newer install no longer produces a downgrade command — init prints the exact
+  `stash` update command instead (release-train lockstep guarantees that version
+  exists), and when missing packages are about to be installed alongside newer
+  ones it says the pairing may not match and to update `stash` first. Unreadable
+  or malformed manifest versions always count as behind (a broken install should
+  be offered the reinstall fix, never "looks newer, leave it").
+
+  **Version lockstep.** The release-train packages (`stash`,
+  `@cipherstash/stack`, `@cipherstash/stack-drizzle`,
+  `@cipherstash/stack-supabase`, `@cipherstash/prisma-next`,
+  `@cipherstash/wizard`) are now a Changesets `fixed` group: a release of any of
+  them republishes all of them at the same version, so the CLI's embedded
+  version map can never go stale against the packages it pins (previously a
+  runtime-package-only release would have left the published CLI embedding —
+  and recommending — outdated versions). A test now asserts the fixed group
+  stays exactly equal to the release train.
+
+- 413ca39: The legacy `@cipherstash/drizzle` package (the `@cipherstash/protect`-based
+  Drizzle integration) is removed from the repository and the release train —
+  `@cipherstash/protect` is sunsetting at Stack 1.0, and the package's successor
+  is `@cipherstash/stack-drizzle`. Already-published versions remain installable
+  from npm (deprecated, pointing here); the git history preserves the source for
+  any emergency maintenance. The `stash-drizzle` skill and the
+  `@cipherstash/stack-drizzle` README now state the deprecation explicitly so
+  nobody (human or agent) installs the legacy package by mistake.
+  - @cipherstash/migrate@1.0.0-rc.0
+
 ## 1.0.0-rc.1
 
 ### Minor Changes

@@ -1,6 +1,6 @@
 {
 	"name": "stash",
-	"version": "1.0.0-rc.1",
+	"version": "1.0.0-rc.2",
 	"description": "CipherStash CLI — the one stash command for auth, init, encryption schema, database setup, and secrets.",
 	"repository": {
 		"type": "git",

@@ -1,5 +1,17 @@
 # @cipherstash/prisma-next
 
+## 1.0.0-rc.2
+
+### Patch Changes
+
+- daa25b8: `@cipherstash/prisma-next` now versions in lockstep with the Stack release
+  train (`stash`, `@cipherstash/stack`, and the other adapters) via a Changesets
+  `fixed` group — `stash init` installs it pinned by exact version, so the two
+  must always release together. This moves the package from its previous `0.4.x`
+  line onto the shared train version; no API changes.
+- Updated dependencies [b085f66]
+  - @cipherstash/stack@1.0.0-rc.2
+
 ## 0.4.0-rc.1
 
 ### Patch Changes

@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/prisma-next",
-	"version": "0.4.0-rc.1",
+	"version": "1.0.0-rc.2",
 	"license": "MIT",
 	"author": "CipherStash <support@cipherstash.com>",
 	"description": "CipherStash extension for Prisma Next: searchable application-layer field-level encryption for Postgres, with six encrypted column types, 17 query operators, bulk encrypt/decrypt middleware, and a baseline migration that installs the vendored EQL bundle SQL byte-for-byte.",

@@ -1,5 +1,20 @@
 # @cipherstash/stack-drizzle
 
+## 1.0.0-rc.2
+
+### Patch Changes
+
+- 413ca39: The legacy `@cipherstash/drizzle` package (the `@cipherstash/protect`-based
+  Drizzle integration) is removed from the repository and the release train —
+  `@cipherstash/protect` is sunsetting at Stack 1.0, and the package's successor
+  is `@cipherstash/stack-drizzle`. Already-published versions remain installable
+  from npm (deprecated, pointing here); the git history preserves the source for
+  any emergency maintenance. The `stash-drizzle` skill and the
+  `@cipherstash/stack-drizzle` README now state the deprecation explicitly so
+  nobody (human or agent) installs the legacy package by mistake.
+- Updated dependencies [b085f66]
+  - @cipherstash/stack@1.0.0-rc.2
+
 ## 1.0.0-rc.1
 
 ### Minor Changes

@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/stack-drizzle",
-	"version": "1.0.0-rc.1",
+	"version": "1.0.0-rc.2",
 	"description": "CipherStash Stack Drizzle ORM integration: searchable, application-layer field-level encryption for PostgreSQL.",
 	"keywords": [
 		"encrypted",

@@ -1,5 +1,12 @@
 # @cipherstash/stack-supabase
 
+## 1.0.0-rc.2
+
+### Patch Changes
+
+- Updated dependencies [b085f66]
+  - @cipherstash/stack@1.0.0-rc.2
+
 ## 1.0.0-rc.1
 
 ### Minor Changes

@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/stack-supabase",
-	"version": "1.0.0-rc.1",
+	"version": "1.0.0-rc.2",
 	"description": "CipherStash Stack Supabase integration: transparent, searchable field-level encryption for Supabase.",
 	"keywords": [
 		"encrypted",

@@ -1,5 +1,24 @@
 # @cipherstash/stack
 
+## 1.0.0-rc.2
+
+### Minor Changes
+
+- b085f66: `@cipherstash/stack/wasm-inline` now exposes `encryptQuery` and
+  `encryptQueryBulk` on `WasmEncryptionClient` (#662) — searchable encryption
+  is reachable on Deno/edge runtimes. Previously the WASM entry exposed only
+  `encrypt`/`decrypt`/`isEncrypted`, so encrypted WHERE-clause search was
+  architecturally impossible on the edge even though the underlying protect-ffi
+  WASM build carries the capability.
+
+  The new methods mint ciphertext-free EQL v3 query terms — equality,
+  free-text match, ORE range, and JSON containment/selector — with the same
+  index-type resolution as the native client (explicit `queryType`, or
+  inference from the column's configured indexes). Cast the term to the
+  column's `eql_v3.query_<domain>` type in SQL to reach the indexed operators.
+  Errors throw, consistent with the WASM surface's `encrypt`/`decrypt`; the
+  bulk form is position-stable (`null` values pass through as `null`).
+
 ## 1.0.0-rc.1
 
 ### Minor Changes

@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/stack",
-	"version": "1.0.0-rc.1",
+	"version": "1.0.0-rc.2",
 	"description": "CipherStash Stack for TypeScript and JavaScript",
 	"keywords": [
 		"encrypted",

@@ -1,5 +1,12 @@
 # @cipherstash/test-kit
 
+## 0.0.1-rc.2
+
+### Patch Changes
+
+- Updated dependencies [b085f66]
+  - @cipherstash/stack@1.0.0-rc.2
+
 ## 0.0.1-rc.1
 
 ### Patch Changes

@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/test-kit",
-	"version": "0.0.1-rc.1",
+	"version": "0.0.1-rc.2",
 	"private": true,
 	"description": "Shared EQL v3 test harness: the domain catalog, the plaintext oracle, and the integration-suite driver. Consumed as TypeScript source — no build step.",
 	"type": "module",

@@ -1,5 +1,15 @@
 # @cipherstash/wizard
 
+## 1.0.0-rc.2
+
+### Patch Changes
+
+- daa25b8: `@cipherstash/wizard` now versions in lockstep with the Stack release train
+  (`stash`, `@cipherstash/stack`, and the adapters) via a Changesets `fixed`
+  group — the `stash` CLI executes the wizard by exact version, so the two must
+  always release together. This moves the package from its previous `0.5.x`
+  line onto the shared train version; no API changes.
+
 ## 0.5.0-rc.1
 
 ### Patch Changes

@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/wizard",
-	"version": "0.5.0-rc.1",
+	"version": "1.0.0-rc.2",
 	"description": "AI-powered encryption setup for CipherStash. Reads your codebase, picks columns to encrypt, and wires everything up.",
 	"repository": {
 		"type": "git",