Version Packages

e2e/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @cipherstash/e2e
 
+## 0.0.5
+
+### Patch Changes
+
+- Updated dependencies [44e2921]
+- Updated dependencies [67b137a]
+- Updated dependencies [ec0c5a7]
+  - stash@1.1.1
+  - @cipherstash/stack@1.1.1
+  - @cipherstash/wizard@1.1.1
+
 ## 0.0.4
 
 ### Patch Changes

e2e/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/e2e",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "private": true,
   "description": "End-to-end tests that exercise built CipherStash binaries and cross-package behaviour.",
   "type": "module",

examples/basic/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @cipherstash/basic-example
 
+## 1.2.16
+
+### Patch Changes
+
+- @cipherstash/stack@1.1.1
+- @cipherstash/stack-drizzle@1.1.1
+
 ## 1.2.15
 
 ### Patch Changes

examples/basic/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cipherstash/basic-example",
   "private": true,
-  "version": "1.2.15",
+  "version": "1.2.16",
   "type": "module",
   "scripts": {
     "start": "tsx index.ts",

examples/prisma/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @cipherstash/prisma-next-example
 
+## 0.1.2
+
+### Patch Changes
+
+- @cipherstash/stack@1.1.1
+- @cipherstash/stack-prisma@1.1.1
+
 ## 0.1.1
 
 ### Patch Changes

examples/prisma/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cipherstash/prisma-example",
   "private": true,
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "End-to-end example of @cipherstash/stack-prisma: searchable application-layer encryption for Postgres with Prisma Next, using @cipherstash/stack as the SDK.",
   "type": "module",
   "scripts": {

packages/bench/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @cipherstash/bench
 
+## 0.0.7
+
+### Patch Changes
+
+- @cipherstash/stack@1.1.1
+- @cipherstash/stack-drizzle@1.1.1
+
 ## 0.0.6
 
 ### Patch Changes

packages/bench/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/bench",
-  "version": "0.0.6",
+  "version": "0.0.7",
   "private": true,
   "description": "Performance / index-engagement benchmarks for stack integrations (Drizzle, encryptedSupabase, Prisma).",
   "type": "module",

packages/cli/CHANGELOG.md

@@ -1,5 +1,79 @@
 # stash
 
+## 1.1.1
+
+### Patch Changes
+
+- 44e2921: Fix `stash eql migration --drizzle`, which aborted for every project with a `drizzle.config.ts` (#924).
+
+  - **Stop passing `--out` to `drizzle-kit generate`.** drizzle-kit reads its config file _or_ its command-line options, never both: any of `--schema`/`--out`/`--dialect` switches it into CLI mode, where it then aborts demanding the two we cannot supply (`Please provide required params: [x] schema [x] dialect`). Verified against drizzle-kit 0.28.5, 0.30.6 and 0.31.4 — this was never version-specific. Your `drizzle.config.ts` now decides the output directory and stash follows the path drizzle-kit reports, warning when it differs from a `--out` you passed. `--out` remains the fallback directory to search.
+  - **Pass the resolved `DATABASE_URL` into the drizzle-kit child process.** A `drizzle.config.ts` that reads `process.env.DATABASE_URL` (and often throws when it is missing) previously saw nothing, because the project's usual `dotenv -e .env.local -- drizzle-kit …` wrapper never runs when stash invokes drizzle-kit directly. stash already loads `.env`/`.env.local` at startup; it now also threads down a URL only the CLI can find, such as a running local Supabase.
+  - **Report the actual failure.** drizzle-kit writes its errors to stdout, not stderr, so the abort printed nothing but "Make sure drizzle-kit is installed and configured" — the one thing that was never wrong. Both streams are now surfaced, and a config that could not read `DATABASE_URL` gets a follow-up naming that instead.
+
+- 67b137a: `stash init` installs the agent skills again, and does it first.
+
+  Since 1.0.0-rc.4 the only callers of the skills installer were the `plan` and
+  `impl` handoff steps, which `stash init` never reaches — so `stash@1.1.0`
+  installed no `stash-*` skills for anyone, in any mode. The most common flow, a
+  coding agent running `npx stash init --supabase` inside a project, completed
+  with a green summary, a plausible-looking `.cipherstash/context.json`, and zero
+  guidance: the skills sat unread in `node_modules/stash/dist/skills/` unless the
+  agent thought to go digging. Fixes #923.
+
+  Init now copies the per-integration skills into `.claude/skills/` (Claude Code
+  detected via the `claude` binary or a `.claude/` directory) and `.codex/skills/`
+  (Codex), installing to both when both are detected, and records them in
+  `context.json`.
+
+  It runs as init's **first** step, ahead of authentication. Installing skills
+  needs no network, no credentials and no database, while authenticate,
+  resolve-database and install-eql each need one and each can exit non-zero —
+  so the guidance now survives a run that fails partway, which is when it is
+  needed most. One behaviour change falls out of that: a run cancelled at the
+  first prompt leaves the skills directory behind where previously it wrote
+  nothing.
+
+  Also:
+
+  - **New optional `stash init --target <claude-code|codex>`** names the skills
+    destination and skips detection. Unlike `plan --target` / `impl --target` it
+    selects the destination only — `init` still performs no handoff. Existing
+    invocations are unaffected.
+  - **The summary reports the outcome either way.** A run that installs nothing
+    now says so, and prints the command that will install them, instead of a
+    silent `installedSkills: []`.
+  - **`--target` is validated properly on `init`, `plan` and `impl`.** A
+    trailing `--target` with no value, and `--target=`, were both treated as
+    "flag absent" — so the command silently did whatever it does with no flag at
+    all, rather than telling you the value was missing. All three commands share
+    one validator now.
+  - **A later handoff no longer erases the record.** `stash plan --target
+agents-md` installs no skill directories of its own and used to overwrite
+    `installedSkills` with an empty list, dropping skills that were on disk.
+    Deliveries are merged across hops now.
+
+- ec0c5a7: `stash-managed-platforms` skill: fold in what a live Lovable Cloud integration actually hit.
+
+  Four additions, each from a verified failure in the 2026-08-19 skilltester run
+  (cipherstash/skilltester branch `20260819-01-lovable`):
+
+  - **Command-time ceilings.** Replaying the ~2.6 MB EQL bundle with `psql -f` sends one statement
+    per round trip and dies partway under Lovable's 600 s ceiling, leaving a half-installed schema.
+    The skill now says to prefer `stash eql install` / the generated migration, gives the
+    chunk-and-apply recipe for when raw SQL is unavoidable, and covers the ownership trap when
+    cleaning up a half-install.
+  - **Data API grants.** The EQL install grants nothing to `authenticated` / `anon` /
+    `service_role`, so every PostgREST function-form call fails until an explicit
+    `GRANT USAGE / EXECUTE` — now stated with the exact SQL.
+  - **Install cooldowns.** Lovable's `bunfig.toml` `minimumReleaseAge` and Deno's
+    `--minimum-dependency-age` both refuse a same-day CipherStash release; the skill names the
+    exclude-list workaround and says to disclose it.
+  - **Lovable secrets.** Who sets them depends on where the agent runs: Lovable's in-product agent
+    can store project secrets itself, while the external Lovable MCP surface has no secrets tool —
+    there the values are handed to the human (they run `stash env` themselves, or copy from the
+    agent-written 0600 file and delete it), never through chat or logs.
+  - @cipherstash/migrate@1.0.0
+
 ## 1.1.0
 
 ### Minor Changes

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "stash",
-	"version": "1.1.0",
+	"version": "1.1.1",
 	"description": "CipherStash CLI — the one stash command for auth, init, encryption schema, database setup, and secrets.",
 	"repository": {
 		"type": "git",

packages/stack-drizzle/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @cipherstash/stack-drizzle
 
+## 1.1.1
+
+### Patch Changes
+
+- @cipherstash/stack@1.1.1
+
 ## 1.1.0
 
 ### Minor Changes

packages/stack-drizzle/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/stack-drizzle",
-	"version": "1.1.0",
+	"version": "1.1.1",
 	"description": "CipherStash Stack Drizzle ORM integration: searchable, application-layer field-level encryption for PostgreSQL.",
 	"keywords": [
 		"encrypted",

packages/stack-prisma/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @cipherstash/stack-prisma
 
+## 1.1.1
+
+### Patch Changes
+
+- @cipherstash/stack@1.1.1
+
 ## 1.1.0
 
 ### Minor Changes

packages/stack-prisma/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/stack-prisma",
-	"version": "1.1.0",
+	"version": "1.1.1",
 	"license": "MIT",
 	"author": "CipherStash <support@cipherstash.com>",
 	"description": "CipherStash extension for Prisma Next: searchable application-layer field-level encryption for Postgres (EQL v3), with domain-typed encrypted columns, the eql* query operators, bulk encrypt/decrypt middleware, and a baseline migration that installs the EQL v3 bundle.",

packages/stack-supabase/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @cipherstash/stack-supabase
 
+## 1.1.1
+
+### Patch Changes
+
+- @cipherstash/stack@1.1.1
+
 ## 1.1.0
 
 ### Minor Changes

packages/stack-supabase/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/stack-supabase",
-	"version": "1.1.0",
+	"version": "1.1.1",
 	"description": "CipherStash Stack Supabase integration: transparent, searchable field-level encryption for Supabase.",
 	"keywords": [
 		"encrypted",

packages/stack/CHANGELOG.md

@@ -1,5 +1,7 @@
 # @cipherstash/stack
 
+## 1.1.1
+
 ## 1.1.0
 
 ### Minor Changes

packages/stack/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/stack",
-	"version": "1.1.0",
+	"version": "1.1.1",
 	"description": "CipherStash Stack for TypeScript and JavaScript",
 	"keywords": [
 		"encrypted",

packages/test-kit/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @cipherstash/test-kit
 
+## 0.0.3
+
+### Patch Changes
+
+- @cipherstash/stack@1.1.1
+
 ## 0.0.2
 
 ### Patch Changes

packages/test-kit/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/test-kit",
-	"version": "0.0.2",
+	"version": "0.0.3",
 	"private": true,
 	"description": "Shared EQL v3 test harness: the domain catalog, the plaintext oracle, and the integration-suite driver. Consumed as TypeScript source — no build step.",
 	"type": "module",

packages/wizard/CHANGELOG.md

@@ -1,5 +1,7 @@
 # @cipherstash/wizard
 
+## 1.1.1
+
 ## 1.1.0
 
 ### Minor Changes

packages/wizard/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@cipherstash/wizard",
-	"version": "1.1.0",
+	"version": "1.1.1",
 	"description": "AI-powered encryption setup for CipherStash. Reads your codebase, picks columns to encrypt, and wires everything up.",
 	"repository": {
 		"type": "git",

skills/stash-cli/SKILL.md

@@ -396,7 +396,7 @@ Gets a project from zero to a direct EQL v3 install. It loads an existing `stash
 
 The removed `--eql-version`, `--latest`, `--drizzle`, `--migration`, `--direct`, `--migrations-dir`, and `--exclude-operator-family` options fail clearly instead of being ignored. A request for EQL v2 points dump-recovery users to the upstream EQL 2.3.1 SQL release. New installs are EQL v3 only; its pinned bundle self-adapts when a database role cannot create the optional operator family.
 
-**`--database-url` is a one-shot.** It installs against that database and leaves the project untouched — no config is loaded, and none is scaffolded, nor is an encryption client. This lets `npx --package=stash@1.1.0 stash eql install --database-url 'postgres://...'` run in a bare project with no CipherStash dependencies while pinning the CLI to this skill's release. It also means the flag always wins: loading a config could pick up a parent-directory `databaseUrl` literal and install against the wrong database.
+**`--database-url` is a one-shot.** It installs against that database and leaves the project untouched — no config is loaded, and none is scaffolded, nor is an encryption client. This lets `npx --package=stash@1.1.1 stash eql install --database-url 'postgres://...'` run in a bare project with no CipherStash dependencies while pinning the CLI to this skill's release. It also means the flag always wins: loading a config could pick up a parent-directory `databaseUrl` literal and install against the wrong database.
 
 **The install verifies itself.** `eql install` ends by running the same surface check as `eql verify` (below) — on the fresh-install path *and* on the already-installed early exit, so a plain re-run over a damaged database fails rather than printing "Nothing to do." It exits 1 if the surface is incomplete; if the check itself cannot run (connection dropped mid-verify), it warns and points at `stash eql verify` instead of failing the committed install. A version mismatch with the pinned bundle also warns rather than fails there — nothing was actually checked, and a no-op re-run over an older EQL must stay exit 0 for idempotent provisioning scripts. (`eql verify` itself stays strict and exits 1 on a mismatch.)
 

skills/stash-edge/SKILL.md

@@ -73,7 +73,7 @@ build step.
 ```ts
 import {
   Encryption, encryptedTable, types, isEncrypted,
-} from 'npm:@cipherstash/stack@1.1.0/wasm-inline'
+} from 'npm:@cipherstash/stack@1.1.1/wasm-inline'
 ```
 
 **Pin an exact version.** Deno caches by specifier, so an unpinned import
@@ -88,7 +88,7 @@ name everywhere:
 ```jsonc
 {
   "imports": {
-    "@cipherstash/stack/wasm-inline": "npm:@cipherstash/stack@1.1.0/wasm-inline"
+    "@cipherstash/stack/wasm-inline": "npm:@cipherstash/stack@1.1.1/wasm-inline"
   }
 }
 ```