From db66bcd39d12d9d42c7f26102436820d7372bcaa Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 20 Aug 2026 06:39:54 +0000
Subject: [PATCH 1/2] Version Packages

---
 .changeset/eql-migration-drizzle-kit-spawn.md |  9 ---
 .changeset/init-installs-agent-skills.md      | 45 -----------
 .../managed-platforms-lovable-findings.md     | 24 ------
 e2e/CHANGELOG.md                              | 11 +++
 e2e/package.json                              |  2 +-
 examples/basic/CHANGELOG.md                   |  7 ++
 examples/basic/package.json                   |  2 +-
 examples/prisma/CHANGELOG.md                  |  7 ++
 examples/prisma/package.json                  |  2 +-
 packages/bench/CHANGELOG.md                   |  7 ++
 packages/bench/package.json                   |  2 +-
 packages/cli/CHANGELOG.md                     | 74 +++++++++++++++++++
 packages/cli/package.json                     |  2 +-
 packages/stack-drizzle/CHANGELOG.md           |  6 ++
 packages/stack-drizzle/package.json           |  2 +-
 packages/stack-prisma/CHANGELOG.md            |  6 ++
 packages/stack-prisma/package.json            |  2 +-
 packages/stack-supabase/CHANGELOG.md          |  6 ++
 packages/stack-supabase/package.json          |  2 +-
 packages/stack/CHANGELOG.md                   |  2 +
 packages/stack/package.json                   |  2 +-
 packages/test-kit/CHANGELOG.md                |  6 ++
 packages/test-kit/package.json                |  2 +-
 packages/wizard/CHANGELOG.md                  |  2 +
 packages/wizard/package.json                  |  2 +-
 25 files changed, 145 insertions(+), 89 deletions(-)
 delete mode 100644 .changeset/eql-migration-drizzle-kit-spawn.md
 delete mode 100644 .changeset/init-installs-agent-skills.md
 delete mode 100644 .changeset/managed-platforms-lovable-findings.md

diff --git a/.changeset/eql-migration-drizzle-kit-spawn.md b/.changeset/eql-migration-drizzle-kit-spawn.md
deleted file mode 100644
index a29b63cca..000000000
--- a/.changeset/eql-migration-drizzle-kit-spawn.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-'stash': patch
----
-
-Fix `stash eql migration --drizzle`, which aborted for every project with a `drizzle.config.ts` (#924).
-
-- **Stop passing `--out` to `drizzle-kit generate`.** drizzle-kit reads its config file *or* its command-line options, never both: any of `--schema`/`--out`/`--dialect` switches it into CLI mode, where it then aborts demanding the two we cannot supply (`Please provide required params: [x] schema [x] dialect`). Verified against drizzle-kit 0.28.5, 0.30.6 and 0.31.4 — this was never version-specific. Your `drizzle.config.ts` now decides the output directory and stash follows the path drizzle-kit reports, warning when it differs from a `--out` you passed. `--out` remains the fallback directory to search.
-- **Pass the resolved `DATABASE_URL` into the drizzle-kit child process.** A `drizzle.config.ts` that reads `process.env.DATABASE_URL` (and often throws when it is missing) previously saw nothing, because the project's usual `dotenv -e .env.local -- drizzle-kit …` wrapper never runs when stash invokes drizzle-kit directly. stash already loads `.env`/`.env.local` at startup; it now also threads down a URL only the CLI can find, such as a running local Supabase.
-- **Report the actual failure.** drizzle-kit writes its errors to stdout, not stderr, so the abort printed nothing but "Make sure drizzle-kit is installed and configured" — the one thing that was never wrong. Both streams are now surfaced, and a config that could not read `DATABASE_URL` gets a follow-up naming that instead.
diff --git a/.changeset/init-installs-agent-skills.md b/.changeset/init-installs-agent-skills.md
deleted file mode 100644
index d5b571ed1..000000000
--- a/.changeset/init-installs-agent-skills.md
+++ /dev/null
@@ -1,45 +0,0 @@
----
-'stash': patch
----
-
-`stash init` installs the agent skills again, and does it first.
-
-Since 1.0.0-rc.4 the only callers of the skills installer were the `plan` and
-`impl` handoff steps, which `stash init` never reaches — so `stash@1.1.0`
-installed no `stash-*` skills for anyone, in any mode. The most common flow, a
-coding agent running `npx stash init --supabase` inside a project, completed
-with a green summary, a plausible-looking `.cipherstash/context.json`, and zero
-guidance: the skills sat unread in `node_modules/stash/dist/skills/` unless the
-agent thought to go digging. Fixes #923.
-
-Init now copies the per-integration skills into `.claude/skills/` (Claude Code
-detected via the `claude` binary or a `.claude/` directory) and `.codex/skills/`
-(Codex), installing to both when both are detected, and records them in
-`context.json`.
-
-It runs as init's **first** step, ahead of authentication. Installing skills
-needs no network, no credentials and no database, while authenticate,
-resolve-database and install-eql each need one and each can exit non-zero —
-so the guidance now survives a run that fails partway, which is when it is
-needed most. One behaviour change falls out of that: a run cancelled at the
-first prompt leaves the skills directory behind where previously it wrote
-nothing.
-
-Also:
-
-- **New optional `stash init --target <claude-code|codex>`** names the skills
-  destination and skips detection. Unlike `plan --target` / `impl --target` it
-  selects the destination only — `init` still performs no handoff. Existing
-  invocations are unaffected.
-- **The summary reports the outcome either way.** A run that installs nothing
-  now says so, and prints the command that will install them, instead of a
-  silent `installedSkills: []`.
-- **`--target` is validated properly on `init`, `plan` and `impl`.** A
-  trailing `--target` with no value, and `--target=`, were both treated as
-  "flag absent" — so the command silently did whatever it does with no flag at
-  all, rather than telling you the value was missing. All three commands share
-  one validator now.
-- **A later handoff no longer erases the record.** `stash plan --target
-  agents-md` installs no skill directories of its own and used to overwrite
-  `installedSkills` with an empty list, dropping skills that were on disk.
-  Deliveries are merged across hops now.
diff --git a/.changeset/managed-platforms-lovable-findings.md b/.changeset/managed-platforms-lovable-findings.md
deleted file mode 100644
index e775f270c..000000000
--- a/.changeset/managed-platforms-lovable-findings.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-'stash': patch
----
-
-`stash-managed-platforms` skill: fold in what a live Lovable Cloud integration actually hit.
-
-Four additions, each from a verified failure in the 2026-08-19 skilltester run
-(cipherstash/skilltester branch `20260819-01-lovable`):
-
-- **Command-time ceilings.** Replaying the ~2.6 MB EQL bundle with `psql -f` sends one statement
-  per round trip and dies partway under Lovable's 600 s ceiling, leaving a half-installed schema.
-  The skill now says to prefer `stash eql install` / the generated migration, gives the
-  chunk-and-apply recipe for when raw SQL is unavoidable, and covers the ownership trap when
-  cleaning up a half-install.
-- **Data API grants.** The EQL install grants nothing to `authenticated` / `anon` /
-  `service_role`, so every PostgREST function-form call fails until an explicit
-  `GRANT USAGE / EXECUTE` — now stated with the exact SQL.
-- **Install cooldowns.** Lovable's `bunfig.toml` `minimumReleaseAge` and Deno's
-  `--minimum-dependency-age` both refuse a same-day CipherStash release; the skill names the
-  exclude-list workaround and says to disclose it.
-- **Lovable secrets.** Who sets them depends on where the agent runs: Lovable's in-product agent
-  can store project secrets itself, while the external Lovable MCP surface has no secrets tool —
-  there the values are handed to the human (they run `stash env` themselves, or copy from the
-  agent-written 0600 file and delete it), never through chat or logs.
diff --git a/e2e/CHANGELOG.md b/e2e/CHANGELOG.md
index 4311424b9..099fe996c 100644
--- a/e2e/CHANGELOG.md
+++ b/e2e/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @cipherstash/e2e
 
+## 0.0.5
+
+### Patch Changes
+
+- Updated dependencies [44e2921]
+- Updated dependencies [67b137a]
+- Updated dependencies [ec0c5a7]
+  - stash@1.1.1
+  - @cipherstash/stack@1.1.1
+  - @cipherstash/wizard@1.1.1
+
 ## 0.0.4
 
 ### Patch Changes
diff --git a/e2e/package.json b/e2e/package.json
index fe2bfc891..bf5f0577c 100644
--- a/e2e/package.json
+++ b/e2e/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/e2e",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "private": true,
   "description": "End-to-end tests that exercise built CipherStash binaries and cross-package behaviour.",
   "type": "module",
diff --git a/examples/basic/CHANGELOG.md b/examples/basic/CHANGELOG.md
index bc97360db..0f978233b 100644
--- a/examples/basic/CHANGELOG.md
+++ b/examples/basic/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @cipherstash/basic-example
 
+## 1.2.16
+
+### Patch Changes
+
+- @cipherstash/stack@1.1.1
+- @cipherstash/stack-drizzle@1.1.1
+
 ## 1.2.15
 
 ### Patch Changes
diff --git a/examples/basic/package.json b/examples/basic/package.json
index f03c21406..eae3b9678 100644
--- a/examples/basic/package.json
+++ b/examples/basic/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@cipherstash/basic-example",
   "private": true,
-  "version": "1.2.15",
+  "version": "1.2.16",
   "type": "module",
   "scripts": {
     "start": "tsx index.ts",
diff --git a/examples/prisma/CHANGELOG.md b/examples/prisma/CHANGELOG.md
index e6642a0a6..e1f8a9ca6 100644
--- a/examples/prisma/CHANGELOG.md
+++ b/examples/prisma/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @cipherstash/prisma-next-example
 
+## 0.1.2
+
+### Patch Changes
+
+- @cipherstash/stack@1.1.1
+- @cipherstash/stack-prisma@1.1.1
+
 ## 0.1.1
 
 ### Patch Changes
diff --git a/examples/prisma/package.json b/examples/prisma/package.json
index d294aa36f..53e28833b 100644
--- a/examples/prisma/package.json
+++ b/examples/prisma/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@cipherstash/prisma-example",
   "private": true,
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "End-to-end example of @cipherstash/stack-prisma: searchable application-layer encryption for Postgres with Prisma Next, using @cipherstash/stack as the SDK.",
   "type": "module",
   "scripts": {
diff --git a/packages/bench/CHANGELOG.md b/packages/bench/CHANGELOG.md
index 9dd7403fc..87d5b7a4b 100644
--- a/packages/bench/CHANGELOG.md
+++ b/packages/bench/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @cipherstash/bench
 
+## 0.0.7
+
+### Patch Changes
+
+- @cipherstash/stack@1.1.1
+- @cipherstash/stack-drizzle@1.1.1
+
 ## 0.0.6
 
 ### Patch Changes
diff --git a/packages/bench/package.json b/packages/bench/package.json
index 2bd33ba3b..586ccf3af 100644
--- a/packages/bench/package.json
+++ b/packages/bench/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/bench",
-  "version": "0.0.6",
+  "version": "0.0.7",
   "private": true,
   "description": "Performance / index-engagement benchmarks for stack integrations (Drizzle, encryptedSupabase, Prisma).",
   "type": "module",
diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
index 83f0e6b04..1401bdda2 100644
--- a/packages/cli/CHANGELOG.md
+++ b/packages/cli/CHANGELOG.md
@@ -1,5 +1,79 @@
 # stash
 
+## 1.1.1
+
+### Patch Changes
+
+- 44e2921: Fix `stash eql migration --drizzle`, which aborted for every project with a `drizzle.config.ts` (#924).
+
+  - **Stop passing `--out` to `drizzle-kit generate`.** drizzle-kit reads its config file _or_ its command-line options, never both: any of `--schema`/`--out`/`--dialect` switches it into CLI mode, where it then aborts demanding the two we cannot supply (`Please provide required params: [x] schema [x] dialect`). Verified against drizzle-kit 0.28.5, 0.30.6 and 0.31.4 — this was never version-specific. Your `drizzle.config.ts` now decides the output directory and stash follows the path drizzle-kit reports, warning when it differs from a `--out` you passed. `--out` remains the fallback directory to search.
+  - **Pass the resolved `DATABASE_URL` into the drizzle-kit child process.** A `drizzle.config.ts` that reads `process.env.DATABASE_URL` (and often throws when it is missing) previously saw nothing, because the project's usual `dotenv -e .env.local -- drizzle-kit …` wrapper never runs when stash invokes drizzle-kit directly. stash already loads `.env`/`.env.local` at startup; it now also threads down a URL only the CLI can find, such as a running local Supabase.
+  - **Report the actual failure.** drizzle-kit writes its errors to stdout, not stderr, so the abort printed nothing but "Make sure drizzle-kit is installed and configured" — the one thing that was never wrong. Both streams are now surfaced, and a config that could not read `DATABASE_URL` gets a follow-up naming that instead.
+
+- 67b137a: `stash init` installs the agent skills again, and does it first.
+
+  Since 1.0.0-rc.4 the only callers of the skills installer were the `plan` and
+  `impl` handoff steps, which `stash init` never reaches — so `stash@1.1.0`
+  installed no `stash-*` skills for anyone, in any mode. The most common flow, a
+  coding agent running `npx stash init --supabase` inside a project, completed
+  with a green summary, a plausible-looking `.cipherstash/context.json`, and zero
+  guidance: the skills sat unread in `node_modules/stash/dist/skills/` unless the
+  agent thought to go digging. Fixes #923.
+
+  Init now copies the per-integration skills into `.claude/skills/` (Claude Code
+  detected via the `claude` binary or a `.claude/` directory) and `.codex/skills/`
+  (Codex), installing to both when both are detected, and records them in
+  `context.json`.
+
+  It runs as init's **first** step, ahead of authentication. Installing skills
+  needs no network, no credentials and no database, while authenticate,
+  resolve-database and install-eql each need one and each can exit non-zero —
+  so the guidance now survives a run that fails partway, which is when it is
+  needed most. One behaviour change falls out of that: a run cancelled at the
+  first prompt leaves the skills directory behind where previously it wrote
+  nothing.
+
+  Also:
+
+  - **New optional `stash init --target <claude-code|codex>`** names the skills
+    destination and skips detection. Unlike `plan --target` / `impl --target` it
+    selects the destination only — `init` still performs no handoff. Existing
+    invocations are unaffected.
+  - **The summary reports the outcome either way.** A run that installs nothing
+    now says so, and prints the command that will install them, instead of a
+    silent `installedSkills: []`.
+  - **`--target` is validated properly on `init`, `plan` and `impl`.** A
+    trailing `--target` with no value, and `--target=`, were both treated as
+    "flag absent" — so the command silently did whatever it does with no flag at
+    all, rather than telling you the value was missing. All three commands share
+    one validator now.
+  - **A later handoff no longer erases the record.** `stash plan --target
+agents-md` installs no skill directories of its own and used to overwrite
+    `installedSkills` with an empty list, dropping skills that were on disk.
+    Deliveries are merged across hops now.
+
+- ec0c5a7: `stash-managed-platforms` skill: fold in what a live Lovable Cloud integration actually hit.
+
+  Four additions, each from a verified failure in the 2026-08-19 skilltester run
+  (cipherstash/skilltester branch `20260819-01-lovable`):
+
+  - **Command-time ceilings.** Replaying the ~2.6 MB EQL bundle with `psql -f` sends one statement
+    per round trip and dies partway under Lovable's 600 s ceiling, leaving a half-installed schema.
+    The skill now says to prefer `stash eql install` / the generated migration, gives the
+    chunk-and-apply recipe for when raw SQL is unavoidable, and covers the ownership trap when
+    cleaning up a half-install.
+  - **Data API grants.** The EQL install grants nothing to `authenticated` / `anon` /
+    `service_role`, so every PostgREST function-form call fails until an explicit
+    `GRANT USAGE / EXECUTE` — now stated with the exact SQL.
+  - **Install cooldowns.** Lovable's `bunfig.toml` `minimumReleaseAge` and Deno's
+    `--minimum-dependency-age` both refuse a same-day CipherStash release; the skill names the
+    exclude-list workaround and says to disclose it.
+  - **Lovable secrets.** Who sets them depends on where the agent runs: Lovable's in-product agent
+    can store project secrets itself, while the external Lovable MCP surface has no secrets tool —
+    there the values are handed to the human (they run `stash env` themselves, or copy from the
+    agent-written 0600 file and delete it), never through chat or logs.
+  - @cipherstash/migrate@1.0.0
+
 ## 1.1.0
 
 ### Minor Changes
diff --git a/packages/cli/package.json b/packages/cli/package.json
index c4343aabf..e34ce3b4e 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "stash",
-	"version": "1.1.0",
+	"version": "1.1.1",
 	"description": "CipherStash CLI — the one stash command for auth, init, encryption schema, database setup, and secrets.",
 	"repository": {
 		"type": "git",
diff --git a/packages/stack-drizzle/CHANGELOG.md b/packages/stack-drizzle/CHANGELOG.md
index 25e7311e5..62ccaa572 100644
--- a/packages/stack-drizzle/CHANGELOG.md
+++ b/packages/stack-drizzle/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @cipherstash/stack-drizzle
 
+## 1.1.1
+
+### Patch Changes
+
+- @cipherstash/stack@1.1.1
+
 ## 1.1.0
 
 ### Minor Changes
diff --git a/packages/stack-drizzle/package.json b/packages/stack-drizzle/package.json
index e38af4c06..3684ab1c1 100644
--- a/packages/stack-drizzle/package.json
+++ b/packages/stack-drizzle/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/stack-drizzle",
-	"version": "1.1.0",
+	"version": "1.1.1",
 	"description": "CipherStash Stack Drizzle ORM integration: searchable, application-layer field-level encryption for PostgreSQL.",
 	"keywords": [
 		"encrypted",
diff --git a/packages/stack-prisma/CHANGELOG.md b/packages/stack-prisma/CHANGELOG.md
index 5277fe12d..deb7af322 100644
--- a/packages/stack-prisma/CHANGELOG.md
+++ b/packages/stack-prisma/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @cipherstash/stack-prisma
 
+## 1.1.1
+
+### Patch Changes
+
+- @cipherstash/stack@1.1.1
+
 ## 1.1.0
 
 ### Minor Changes
diff --git a/packages/stack-prisma/package.json b/packages/stack-prisma/package.json
index e643464db..67ae12133 100644
--- a/packages/stack-prisma/package.json
+++ b/packages/stack-prisma/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/stack-prisma",
-	"version": "1.1.0",
+	"version": "1.1.1",
 	"license": "MIT",
 	"author": "CipherStash <support@cipherstash.com>",
 	"description": "CipherStash extension for Prisma Next: searchable application-layer field-level encryption for Postgres (EQL v3), with domain-typed encrypted columns, the eql* query operators, bulk encrypt/decrypt middleware, and a baseline migration that installs the EQL v3 bundle.",
diff --git a/packages/stack-supabase/CHANGELOG.md b/packages/stack-supabase/CHANGELOG.md
index e302be579..5b0f13b27 100644
--- a/packages/stack-supabase/CHANGELOG.md
+++ b/packages/stack-supabase/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @cipherstash/stack-supabase
 
+## 1.1.1
+
+### Patch Changes
+
+- @cipherstash/stack@1.1.1
+
 ## 1.1.0
 
 ### Minor Changes
diff --git a/packages/stack-supabase/package.json b/packages/stack-supabase/package.json
index 71bcad395..de6455cb5 100644
--- a/packages/stack-supabase/package.json
+++ b/packages/stack-supabase/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/stack-supabase",
-	"version": "1.1.0",
+	"version": "1.1.1",
 	"description": "CipherStash Stack Supabase integration: transparent, searchable field-level encryption for Supabase.",
 	"keywords": [
 		"encrypted",
diff --git a/packages/stack/CHANGELOG.md b/packages/stack/CHANGELOG.md
index c5a44e966..419a7e088 100644
--- a/packages/stack/CHANGELOG.md
+++ b/packages/stack/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @cipherstash/stack
 
+## 1.1.1
+
 ## 1.1.0
 
 ### Minor Changes
diff --git a/packages/stack/package.json b/packages/stack/package.json
index dd3ddd9dd..595eb4c02 100644
--- a/packages/stack/package.json
+++ b/packages/stack/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/stack",
-	"version": "1.1.0",
+	"version": "1.1.1",
 	"description": "CipherStash Stack for TypeScript and JavaScript",
 	"keywords": [
 		"encrypted",
diff --git a/packages/test-kit/CHANGELOG.md b/packages/test-kit/CHANGELOG.md
index 86c33c632..5fa2eda70 100644
--- a/packages/test-kit/CHANGELOG.md
+++ b/packages/test-kit/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @cipherstash/test-kit
 
+## 0.0.3
+
+### Patch Changes
+
+- @cipherstash/stack@1.1.1
+
 ## 0.0.2
 
 ### Patch Changes
diff --git a/packages/test-kit/package.json b/packages/test-kit/package.json
index b3de43358..60b273a40 100644
--- a/packages/test-kit/package.json
+++ b/packages/test-kit/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/test-kit",
-	"version": "0.0.2",
+	"version": "0.0.3",
 	"private": true,
 	"description": "Shared EQL v3 test harness: the domain catalog, the plaintext oracle, and the integration-suite driver. Consumed as TypeScript source — no build step.",
 	"type": "module",
diff --git a/packages/wizard/CHANGELOG.md b/packages/wizard/CHANGELOG.md
index 0df1ae19a..5793aa069 100644
--- a/packages/wizard/CHANGELOG.md
+++ b/packages/wizard/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @cipherstash/wizard
 
+## 1.1.1
+
 ## 1.1.0
 
 ### Minor Changes
diff --git a/packages/wizard/package.json b/packages/wizard/package.json
index 477b546b3..452aa90ce 100644
--- a/packages/wizard/package.json
+++ b/packages/wizard/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/wizard",
-	"version": "1.1.0",
+	"version": "1.1.1",
 	"description": "AI-powered encryption setup for CipherStash. Reads your codebase, picks columns to encrypt, and wires everything up.",
 	"repository": {
 		"type": "git",

From 1fcf72232ca527e7914dd15d9bd543ad3936e6b3 Mon Sep 17 00:00:00 2001
From: Dan Draper <dan@cipherstash.com>
Date: Thu, 20 Aug 2026 16:20:59 +0930
Subject: [PATCH 2/2] docs(skills): pin stash-cli and stash-edge at 1.1.1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The version-bump PR is where the skill pins get updated: `skills/` ships
inside the `stash` tarball verbatim — nothing in the build rewrites the
version literals — so a stale pin keeps telling customers to install the
previous release long after this one is published.

- `skills/stash-cli`: the bare-project `npx --package=stash@… stash eql
  install` one-shot.
- `skills/stash-edge`: both `npm:@cipherstash/stack@…/wasm-inline`
  specifiers (the Deno import and the import map).

`release-train.test.ts` asserts the first of these against the workspace
manifest, which is what failed CI on this branch.

Claude-Session: https://claude.ai/code/session_01EaWCG4KhZQXpfH7qDHnf2E
---
 skills/stash-cli/SKILL.md  | 2 +-
 skills/stash-edge/SKILL.md | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/skills/stash-cli/SKILL.md b/skills/stash-cli/SKILL.md
index 96c7b85cb..7b69c8f6f 100644
--- a/skills/stash-cli/SKILL.md
+++ b/skills/stash-cli/SKILL.md
@@ -396,7 +396,7 @@ Gets a project from zero to a direct EQL v3 install. It loads an existing `stash
 
 The removed `--eql-version`, `--latest`, `--drizzle`, `--migration`, `--direct`, `--migrations-dir`, and `--exclude-operator-family` options fail clearly instead of being ignored. A request for EQL v2 points dump-recovery users to the upstream EQL 2.3.1 SQL release. New installs are EQL v3 only; its pinned bundle self-adapts when a database role cannot create the optional operator family.
 
-**`--database-url` is a one-shot.** It installs against that database and leaves the project untouched — no config is loaded, and none is scaffolded, nor is an encryption client. This lets `npx --package=stash@1.1.0 stash eql install --database-url 'postgres://...'` run in a bare project with no CipherStash dependencies while pinning the CLI to this skill's release. It also means the flag always wins: loading a config could pick up a parent-directory `databaseUrl` literal and install against the wrong database.
+**`--database-url` is a one-shot.** It installs against that database and leaves the project untouched — no config is loaded, and none is scaffolded, nor is an encryption client. This lets `npx --package=stash@1.1.1 stash eql install --database-url 'postgres://...'` run in a bare project with no CipherStash dependencies while pinning the CLI to this skill's release. It also means the flag always wins: loading a config could pick up a parent-directory `databaseUrl` literal and install against the wrong database.
 
 **The install verifies itself.** `eql install` ends by running the same surface check as `eql verify` (below) — on the fresh-install path *and* on the already-installed early exit, so a plain re-run over a damaged database fails rather than printing "Nothing to do." It exits 1 if the surface is incomplete; if the check itself cannot run (connection dropped mid-verify), it warns and points at `stash eql verify` instead of failing the committed install. A version mismatch with the pinned bundle also warns rather than fails there — nothing was actually checked, and a no-op re-run over an older EQL must stay exit 0 for idempotent provisioning scripts. (`eql verify` itself stays strict and exits 1 on a mismatch.)
 
diff --git a/skills/stash-edge/SKILL.md b/skills/stash-edge/SKILL.md
index 244d25b6e..6964af2a1 100644
--- a/skills/stash-edge/SKILL.md
+++ b/skills/stash-edge/SKILL.md
@@ -73,7 +73,7 @@ build step.
 ```ts
 import {
   Encryption, encryptedTable, types, isEncrypted,
-} from 'npm:@cipherstash/stack@1.1.0/wasm-inline'
+} from 'npm:@cipherstash/stack@1.1.1/wasm-inline'
 ```
 
 **Pin an exact version.** Deno caches by specifier, so an unpinned import
@@ -88,7 +88,7 @@ name everywhere:
 ```jsonc
 {
   "imports": {
-    "@cipherstash/stack/wasm-inline": "npm:@cipherstash/stack@1.1.0/wasm-inline"
+    "@cipherstash/stack/wasm-inline": "npm:@cipherstash/stack@1.1.1/wasm-inline"
   }
 }
 ```