Skip to content

feat!: remove EQL v2-only published packages (protect, schema, protect-dynamodb)#760

Merged
tobyhede merged 2 commits into
remove-v2from
worktree-feat+remove-eql-v2-pr1-delete-packages
Jul 23, 2026
Merged

feat!: remove EQL v2-only published packages (protect, schema, protect-dynamodb)#760
tobyhede merged 2 commits into
remove-v2from
worktree-feat+remove-eql-v2-pr1-delete-packages

Conversation

@tobyhede

@tobyhede tobyhede commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

What

PR 1 of the EQL v2 final removal. Deletes the closed v2-only published dependency chain and removes every reference so the build, lockfile, and changeset state stay consistent:

  • @cipherstash/protect-dynamodb → superseded by @cipherstash/stack/dynamodb (encryptedDynamoDB)
  • @cipherstash/protect → superseded by @cipherstash/stack (carries the encryption client directly)
  • @cipherstash/schema → superseded by @cipherstash/stack/schema

The three formed a closed chain (protect-dynamodbprotectschema); nothing outside them imports them, and @cipherstash/stack depends only on the external @cipherstash/protect-ffi, not on any of the three.

~22k lines deleted across 100 files (packages, tests, READMEs, CHANGELOGs, workflow .env setup steps, lockfile entries).

Compatibility

  • Already-published versions remain installable from npm; git history preserves the source for emergency maintenance.
  • Existing EQL v2 ciphertext stays decryptable through @cipherstash/stack — this removes the v2 authoring/emission surface, not the read path.

Changeset

@cipherstash/stack patch + @cipherstash/nextjs patch (see .changeset/remove-eql-v2-packages.md). Also cleans pending changeset state that referenced the removed packages (schema-stevec-standard-pin.md, pre.json initialVersions).

Review notes

CodeRabbit surfaced one pre-existing item: the experimental "Run Tests (Bun)" job suppresses failures (|| true + continue-on-error: true). This PR only trimmed the deleted packages from that job's loop; the suppression predates it (a200e2ba) and is intentional for the experimental job. Left as-is — out of scope here.

Plan: docs/plans/2026-07-22-eql-v2-removal-pr1-plan.md

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Breaking Changes

    • Retired the EQL v2-only packages for encryption, schema, and DynamoDB integrations.
    • New development and encryption workflows should use @cipherstash/stack and its schema/DynamoDB integrations.
    • Existing published package versions remain available.
  • Compatibility

    • Existing EQL v2 ciphertext remains decryptable through @cipherstash/stack.
    • Existing encrypted JSON columns retain stable queryability and comparability.
  • Documentation

    • Updated package support information, migration guidance, and documentation rebuild triggers.

…t-dynamodb)

PR 1 of the EQL v2 final removal (#707).

Delete the closed v2-only dependency chain — @cipherstash/protect-dynamodb →
@cipherstash/protect → @cipherstash/schema — and every reference to it. Nothing
outside the three imported them (@cipherstash/stack depends only on the separate
@cipherstash/protect-ffi). They are superseded by @cipherstash/stack:

- @cipherstash/protect        -> @cipherstash/stack
- @cipherstash/schema         -> @cipherstash/stack/schema
- @cipherstash/protect-dynamodb -> @cipherstash/stack/dynamodb (encryptedDynamoDB)

Existing EQL v2 ciphertext stays decryptable through @cipherstash/stack; this
removes the v2 authoring/emission surface, not the read path.

Reference cleanup (dangling refs that would break build/CI):
- e2e/package.json @cipherstash/protect dep edge
- root package.json build:js turbo filter
- tests.yml protect/protect-dynamodb .env steps (would fail `touch` on gone dirs)
  and the bun-job test loop
- rebuild-docs.yml trigger tag (@cipherstash/protect@* -> @cipherstash/stack@*)
- integration-{drizzle,prisma-next,supabase}.yml packages/schema/** path filters
- lint-no-hardcoded-runners allowlist entry
- e2e package-managers BIN fixture (dead) + two stale source comments

Changeset / RC housekeeping:
- delete schema-stevec-standard-pin.md (only target was the deleted schema)
- prune the three from pre.json initialVersions
- add deletion-notice changeset on @cipherstash/stack + @cipherstash/nextjs

Meta honesty: SECURITY.md package list, AGENTS.md Repository Layout, nextjs
package description.
@tobyhede
tobyhede requested a review from a team as a code owner July 22, 2026 07:21
@changeset-bot

changeset-bot Bot commented Jul 22, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 9fc0f39

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 12 packages
Name Type
@cipherstash/stack Patch
@cipherstash/nextjs Patch
@cipherstash/bench Patch
stash Patch
@cipherstash/prisma-next Patch
@cipherstash/stack-drizzle Patch
@cipherstash/stack-supabase Patch
@cipherstash/test-kit Patch
@cipherstash/basic-example Patch
@cipherstash/prisma-next-example Patch
@cipherstash/e2e Patch
@cipherstash/wizard Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@coderabbitai

coderabbitai Bot commented Jul 22, 2026

Copy link
Copy Markdown

Review Change Stack

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 07cb7af6-a9cd-4399-b916-8257ef48fcd8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

The EQL v2-only @cipherstash/protect, @cipherstash/schema, and @cipherstash/protect-dynamodb packages are removed, with release metadata, workspace references, CI workflows, tests, documentation, and successor references updated for @cipherstash/stack.

Changes

EQL v2 package removal

Layer / File(s) Summary
Package implementations and tests
packages/protect/**, packages/protect-dynamodb/**
Removes the published package metadata, source implementations, CLI, schemas, operations, documentation, and associated test suites.
Release and removal metadata
.changeset/*, docs/plans/*
Removes obsolete changeset state and adds the EQL v2 package removal notice with @cipherstash/stack successor mappings.
Repository dependency and build cleanup
e2e/package.json, e2e/tests/*, package.json, packages/nextjs/package.json, scripts/*
Removes workspace and legacy binary references and limits the JavaScript build to the remaining workspace.
CI and test workflow updates
.github/workflows/*
Removes obsolete schema triggers and package environment setup, limits Bun tests to stack packages, and switches documentation rebuild tags to @cipherstash/stack.
Repository documentation and references
AGENTS.md, SECURITY.md, packages/stack/src/*
Updates documented supported packages, package layout guidance, checklist references, and stale stack comments.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related issues

  • Issue 707 — Covers the repo-wide removal of the same EQL v2 package chain and transition to @cipherstash/stack.

Possibly related PRs

  • cipherstash/stack#473: Overlaps with the removed DynamoDB helper logic and its encrypted-payload handling.
  • cipherstash/stack#676: Touches the same WasmEncryptionClient.encryptQueryBulk area referenced by this change.

Suggested reviewers: auxesis

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main change: removing the EQL v2-only published packages.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch worktree-feat+remove-eql-v2-pr1-delete-packages

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/plans/2026-07-22-eql-v2-removal-pr1-plan.md`:
- Around line 49-54: Update the release plan’s “remove-eql-v2-packages.md”
changeset entry to match the actual changeset targets: include the
`@cipherstash/nextjs` patch and its release rationale, or remove that package from
the changeset if the patch is unintended.
- Around line 69-70: Update the stale-reference verification command in the plan
so the `@cipherstash/protect` pattern matches only the exact package name, using
an explicit boundary that excludes packages such as `@cipherstash/protect-ffi`
while preserving the checks for `@cipherstash/schema` and
`@cipherstash/protect-dynamodb`.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 4270a939-b919-4732-b81d-3a3b9cdafa64

📥 Commits

Reviewing files that changed from the base of the PR and between 2aeba94 and 689021e.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (100)
  • .changeset/pre.json
  • .changeset/remove-eql-v2-packages.md
  • .changeset/schema-stevec-standard-pin.md
  • .github/workflows/integration-drizzle.yml
  • .github/workflows/integration-prisma-next.yml
  • .github/workflows/integration-supabase.yml
  • .github/workflows/rebuild-docs.yml
  • .github/workflows/tests.yml
  • AGENTS.md
  • SECURITY.md
  • docs/plans/2026-07-22-eql-v2-removal-pr1-plan.md
  • e2e/package.json
  • e2e/tests/package-managers.e2e.test.ts
  • package.json
  • packages/nextjs/package.json
  • packages/protect-dynamodb/.npmignore
  • packages/protect-dynamodb/CHANGELOG.md
  • packages/protect-dynamodb/README.md
  • packages/protect-dynamodb/__tests__/audit.test.ts
  • packages/protect-dynamodb/__tests__/dynamodb.test.ts
  • packages/protect-dynamodb/__tests__/error-codes.test.ts
  • packages/protect-dynamodb/__tests__/helpers.test.ts
  • packages/protect-dynamodb/package.json
  • packages/protect-dynamodb/src/helpers.ts
  • packages/protect-dynamodb/src/index.ts
  • packages/protect-dynamodb/src/operations/base-operation.ts
  • packages/protect-dynamodb/src/operations/bulk-decrypt-models.ts
  • packages/protect-dynamodb/src/operations/bulk-encrypt-models.ts
  • packages/protect-dynamodb/src/operations/decrypt-model.ts
  • packages/protect-dynamodb/src/operations/encrypt-model.ts
  • packages/protect-dynamodb/src/operations/search-terms.ts
  • packages/protect-dynamodb/src/types.ts
  • packages/protect-dynamodb/tsconfig.json
  • packages/protect-dynamodb/tsup.config.ts
  • packages/protect/.npmignore
  • packages/protect/CHANGELOG.md
  • packages/protect/README.md
  • packages/protect/__tests__/audit.test.ts
  • packages/protect/__tests__/basic-protect.test.ts
  • packages/protect/__tests__/bulk-protect.test.ts
  • packages/protect/__tests__/deprecated/search-terms.test.ts
  • packages/protect/__tests__/encrypt-query-searchable-json.test.ts
  • packages/protect/__tests__/encrypt-query-stevec.test.ts
  • packages/protect/__tests__/encrypt-query.test.ts
  • packages/protect/__tests__/error-codes.test.ts
  • packages/protect/__tests__/fixtures/index.ts
  • packages/protect/__tests__/helpers.test.ts
  • packages/protect/__tests__/infer-index-type.test.ts
  • packages/protect/__tests__/json-protect.test.ts
  • packages/protect/__tests__/jsonb-helpers.test.ts
  • packages/protect/__tests__/k-discriminator.test.ts
  • packages/protect/__tests__/keysets.test.ts
  • packages/protect/__tests__/lock-context.test.ts
  • packages/protect/__tests__/nested-models.test.ts
  • packages/protect/__tests__/number-protect.test.ts
  • packages/protect/__tests__/protect-ops.test.ts
  • packages/protect/__tests__/searchable-json-pg.test.ts
  • packages/protect/__tests__/supabase.test.ts
  • packages/protect/package.json
  • packages/protect/src/bin/runner.ts
  • packages/protect/src/bin/stash.ts
  • packages/protect/src/client.ts
  • packages/protect/src/ffi/helpers/error-code.ts
  • packages/protect/src/ffi/helpers/infer-index-type.ts
  • packages/protect/src/ffi/helpers/type-guards.ts
  • packages/protect/src/ffi/helpers/validation.ts
  • packages/protect/src/ffi/index.ts
  • packages/protect/src/ffi/model-helpers.ts
  • packages/protect/src/ffi/operations/base-operation.ts
  • packages/protect/src/ffi/operations/batch-encrypt-query.ts
  • packages/protect/src/ffi/operations/bulk-decrypt-models.ts
  • packages/protect/src/ffi/operations/bulk-decrypt.ts
  • packages/protect/src/ffi/operations/bulk-encrypt-models.ts
  • packages/protect/src/ffi/operations/bulk-encrypt.ts
  • packages/protect/src/ffi/operations/decrypt-model.ts
  • packages/protect/src/ffi/operations/decrypt.ts
  • packages/protect/src/ffi/operations/deprecated/search-terms.ts
  • packages/protect/src/ffi/operations/encrypt-model.ts
  • packages/protect/src/ffi/operations/encrypt-query.ts
  • packages/protect/src/ffi/operations/encrypt.ts
  • packages/protect/src/helpers/index.ts
  • packages/protect/src/helpers/jsonb.ts
  • packages/protect/src/identify/index.ts
  • packages/protect/src/index.ts
  • packages/protect/src/stash/index.ts
  • packages/protect/src/types.ts
  • packages/protect/tsconfig.json
  • packages/protect/tsup.config.ts
  • packages/schema/.npmignore
  • packages/schema/CHANGELOG.md
  • packages/schema/README.md
  • packages/schema/__tests__/schema.test.ts
  • packages/schema/__tests__/searchable-json.test.ts
  • packages/schema/package.json
  • packages/schema/src/index.ts
  • packages/schema/tsconfig.json
  • packages/schema/tsup.config.ts
  • packages/stack/src/encryption/helpers/index.ts
  • packages/stack/src/wasm-inline.ts
  • scripts/lint-no-hardcoded-runners.mjs
💤 Files with no reviewable changes (73)
  • packages/protect-dynamodb/.npmignore
  • packages/protect/src/ffi/helpers/type-guards.ts
  • packages/protect-dynamodb/README.md
  • packages/protect/tests/basic-protect.test.ts
  • packages/protect/tests/protect-ops.test.ts
  • packages/protect/src/ffi/operations/bulk-encrypt-models.ts
  • packages/protect/src/client.ts
  • packages/protect/tests/nested-models.test.ts
  • packages/protect/CHANGELOG.md
  • e2e/package.json
  • packages/protect/.npmignore
  • packages/protect/tests/audit.test.ts
  • packages/protect-dynamodb/src/operations/search-terms.ts
  • packages/protect-dynamodb/tests/audit.test.ts
  • packages/protect/tests/deprecated/search-terms.test.ts
  • packages/protect/tests/keysets.test.ts
  • packages/protect/tests/infer-index-type.test.ts
  • packages/protect-dynamodb/tests/error-codes.test.ts
  • packages/protect-dynamodb/tsconfig.json
  • packages/protect/src/ffi/operations/base-operation.ts
  • packages/protect/src/ffi/helpers/infer-index-type.ts
  • packages/protect-dynamodb/src/operations/encrypt-model.ts
  • packages/protect/tests/jsonb-helpers.test.ts
  • packages/protect/src/ffi/operations/encrypt-model.ts
  • packages/protect-dynamodb/CHANGELOG.md
  • packages/protect-dynamodb/tsup.config.ts
  • packages/protect/tests/number-protect.test.ts
  • packages/protect/tests/k-discriminator.test.ts
  • packages/protect/tests/helpers.test.ts
  • packages/protect/tests/encrypt-query.test.ts
  • packages/protect/src/ffi/operations/encrypt.ts
  • packages/protect/src/ffi/helpers/error-code.ts
  • packages/protect/src/bin/stash.ts
  • packages/protect/tests/searchable-json-pg.test.ts
  • packages/protect-dynamodb/src/operations/base-operation.ts
  • packages/protect/tests/encrypt-query-searchable-json.test.ts
  • packages/protect-dynamodb/package.json
  • packages/protect/tests/lock-context.test.ts
  • packages/protect/src/ffi/operations/batch-encrypt-query.ts
  • packages/protect/src/ffi/operations/decrypt.ts
  • packages/protect/src/bin/runner.ts
  • packages/protect/tests/supabase.test.ts
  • packages/protect/tests/bulk-protect.test.ts
  • packages/protect-dynamodb/src/operations/bulk-encrypt-models.ts
  • packages/protect-dynamodb/src/index.ts
  • packages/protect-dynamodb/src/types.ts
  • packages/protect/tests/json-protect.test.ts
  • packages/protect-dynamodb/src/operations/bulk-decrypt-models.ts
  • packages/protect-dynamodb/src/operations/decrypt-model.ts
  • packages/protect/src/ffi/operations/bulk-encrypt.ts
  • .changeset/pre.json
  • packages/protect/tests/error-codes.test.ts
  • .github/workflows/integration-prisma-next.yml
  • packages/protect/src/ffi/index.ts
  • packages/protect-dynamodb/tests/dynamodb.test.ts
  • packages/protect/src/ffi/operations/decrypt-model.ts
  • packages/protect/src/ffi/operations/deprecated/search-terms.ts
  • packages/protect/tests/encrypt-query-stevec.test.ts
  • scripts/lint-no-hardcoded-runners.mjs
  • packages/protect/src/ffi/operations/bulk-decrypt.ts
  • packages/protect/tests/fixtures/index.ts
  • .changeset/schema-stevec-standard-pin.md
  • packages/protect/src/ffi/model-helpers.ts
  • SECURITY.md
  • .github/workflows/integration-drizzle.yml
  • packages/protect/src/ffi/operations/bulk-decrypt-models.ts
  • packages/protect/src/ffi/operations/encrypt-query.ts
  • packages/protect/package.json
  • packages/protect/src/ffi/helpers/validation.ts
  • .github/workflows/integration-supabase.yml
  • packages/protect/README.md
  • packages/protect-dynamodb/src/helpers.ts
  • packages/protect-dynamodb/tests/helpers.test.ts

Comment on lines +49 to +54
- Add deletion-notice changeset `.changeset/remove-eql-v2-packages.md`:
`'@cipherstash/stack': patch` (successor surface for all three; group already major via
`stack-1-0-0-rc`), prose body naming each removed package and its migration path
(`@cipherstash/protect` → `@cipherstash/stack`; `@cipherstash/schema` → `@cipherstash/stack/schema`;
`@cipherstash/protect-dynamodb` → `@cipherstash/stack/dynamodb` `encryptedDynamoDB`).
Follows the `remove-legacy-drizzle-package.md` precedent.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Keep the release plan’s changeset targets in sync.

The actual changeset also patches @cipherstash/nextjs, but this plan lists only @cipherstash/stack. Add the Next.js release rationale here, or remove it from the changeset if that patch is unintended.

Proposed documentation update
-  `'`@cipherstash/stack`': patch` (successor surface for all three; group already major via
+  `'`@cipherstash/stack`': patch` and `'`@cipherstash/nextjs`': patch` (the latter reflects
+  the package metadata update; stack is the successor surface for all three; group already major via
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- Add deletion-notice changeset `.changeset/remove-eql-v2-packages.md`:
`'@cipherstash/stack': patch` (successor surface for all three; group already major via
`stack-1-0-0-rc`), prose body naming each removed package and its migration path
(`@cipherstash/protect``@cipherstash/stack`; `@cipherstash/schema``@cipherstash/stack/schema`;
`@cipherstash/protect-dynamodb``@cipherstash/stack/dynamodb` `encryptedDynamoDB`).
Follows the `remove-legacy-drizzle-package.md` precedent.
- Add deletion-notice changeset `.changeset/remove-eql-v2-packages.md`:
- `'`@cipherstash/stack`': patch` (successor surface for all three; group already major via
- `stack-1-0-0-rc`), prose body naming each removed package and its migration path
- (`@cipherstash/protect``@cipherstash/stack`; `@cipherstash/schema``@cipherstash/stack/schema`;
- `@cipherstash/protect-dynamodb``@cipherstash/stack/dynamodb` `encryptedDynamoDB`).
Add deletion-notice changeset `.changeset/remove-eql-v2-packages.md`:
`'`@cipherstash/stack`': patch` and `'`@cipherstash/nextjs`': patch` (the latter reflects
the package metadata update; stack is the successor surface for all three; group already major via
`stack-1-0-0-rc`), prose body naming each removed package and its migration path
(`@cipherstash/protect``@cipherstash/stack`; `@cipherstash/schema``@cipherstash/stack/schema`;
`@cipherstash/protect-dynamodb``@cipherstash/stack/dynamodb` `encryptedDynamoDB`).
Follows the `remove-legacy-drizzle-package.md` precedent.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/plans/2026-07-22-eql-v2-removal-pr1-plan.md` around lines 49 - 54,
Update the release plan’s “remove-eql-v2-packages.md” changeset entry to match
the actual changeset targets: include the `@cipherstash/nextjs` patch and its
release rationale, or remove that package from the changeset if the patch is
unintended.

Comment on lines +69 to +70
- `git grep -n "@cipherstash/protect\b\|@cipherstash/schema\|@cipherstash/protect-dynamodb"` —
only intentional survivors (e.g. migration-path prose, `protect-ffi` which is unrelated).

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Make the stale-reference check match package names exactly.

Line 69’s @cipherstash/protect\b also matches the prefix of @cipherstash/protect-ffi, so the verification command reports the unrelated package as stale. Use an explicit package-name boundary.

Proposed verification command
- git grep -n "`@cipherstash/protect`\b\|`@cipherstash/schema`\|`@cipherstash/protect-dynamodb`"
+ git grep -n -E '`@cipherstash/`(protect-dynamodb|protect|schema)([^[:alnum:]_-]|$)'
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- `git grep -n "@cipherstash/protect\b\|@cipherstash/schema\|@cipherstash/protect-dynamodb"`
only intentional survivors (e.g. migration-path prose, `protect-ffi` which is unrelated).
- `git grep -n -E '`@cipherstash/`(protect-dynamodb|protect|schema)([^[:alnum:]_-]|$)'`
only intentional survivors (e.g. migration-path prose, `protect-ffi` which is unrelated).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/plans/2026-07-22-eql-v2-removal-pr1-plan.md` around lines 69 - 70,
Update the stale-reference verification command in the plan so the
`@cipherstash/protect` pattern matches only the exact package name, using an
explicit boundary that excludes packages such as `@cipherstash/protect-ffi` while
preserving the checks for `@cipherstash/schema` and `@cipherstash/protect-dynamodb`.

@tobyhede
tobyhede changed the base branch from main to remove-v2 July 22, 2026 07:30
@tobyhede
tobyhede force-pushed the worktree-feat+remove-eql-v2-pr1-delete-packages branch from 27a0915 to 994e5b2 Compare July 22, 2026 08:11
@tobyhede
tobyhede requested a review from freshtonic July 23, 2026 03:30

@freshtonic freshtonic left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed by Claude Code on behalf of James Sadler.

Verdict: APPROVE

Clean, well-scoped breaking removal of the three EQL v2-only published packages (@cipherstash/protect, @cipherstash/schema, @cipherstash/protect-dynamodb). I verified the removal is complete and does not break the build, the workspace/lockfile state, the changeset/release state, or the v2 read path. No blocking issues.

What I verified (against head 994e5b2)

  • No dangling code/config references. No leftover packages/{protect,schema,protect-dynamodb} dirs. Grep across .ts/.tsx/.json/.mjs/.js/.yml/.yaml finds zero imports or dependency entries for the three removed names anywhere (the external @cipherstash/protect-ffi correctly remains). The only surviving mentions are prose: this PR's changeset, historical docs/plans/*, one docs/query-api-walkthrough.md pointer, and a dependabot.yml comment (see nits).
  • Workspace + lockfile consistent. pnpm-workspace.yaml uses globs (packages/*), so no explicit entries to prune. pnpm-lock.yaml has no importer blocks or dependency refs for the removed packages, and the e2e: importer no longer lists @cipherstash/protect (matching the e2e/package.json edit). package.json build:js filter and the three integration workflows' path triggers were updated accordingly.
  • Changeset/release state correct. The deleted .changeset/schema-stevec-standard-pin.md targeted only @cipherstash/schema (a removed package), so no surviving package loses a pending release note. .changeset/pre.json remains valid JSON (mode: pre), with the three packages dropped from initialVersions and schema-stevec-standard-pin dropped from the changesets array. New changeset bumps @cipherstash/stack + @cipherstash/nextjs (nextjs only had a description edit — a patch is reasonable).
  • Security-relevant behavior preserved — the key check. The deleted schema changeset documented a load-bearing fix: searchableJson() pins the SteVec encoding to mode: 'standard' so existing EQL v2 JSON columns stay queryable/comparable (protect-ffi 0.29 flipped the default to compat). I confirmed the successor @cipherstash/stack carries the identical pin at packages/stack/src/schema/index.ts:428 (with the same rationale in comments), and that v2 searchable-JSON authoring is now explicitly rejected with a migration steer (packages/stack/src/encryption/index.ts:113). This matches the PR's claim: v2 read/query path preserved, v2 emission surface removed. No crypto regression.

Non-blocking nits (documentation only)

  • docs/query-api-walkthrough.md:77 still points at packages/protect/src/ffi/*, now a dead path. Worth a one-line repoint to packages/stack/src/encryption/* in a follow-up.
  • .github/dependabot.yml:51 comment references packages/protect historically. Harmless — the ignore rule it documents is for the surviving external @cipherstash/protect-ffi — but slightly stale.
  • docs/plans/* references to the removed packages are acceptable as historical records.

The || true / continue-on-error suppression in the experimental Bun job is pre-existing and correctly left untouched.

Addresses PR #760 review feedback.

- `docs/query-api-walkthrough.md` pointed at `packages/protect/src/ffi/*`,
  deleted by this PR. Replaced with a note rooting the doc's relative paths,
  and corrected the two other stale facts in the same block: the protect-ffi
  pin (0.24.0/0.23.0 → the actual 0.30.0) and row 1a's query-builder paths,
  which moved to stack-drizzle/stack-supabase in the #627 split.
- `.github/dependabot.yml`'s ignore-rule comment narrated the #673 incident
  in the present tense against a package that no longer exists. Kept the
  lesson, marked the package as removed, and stated why the rule still holds
  for the surviving consumers.
- `.github/workflows/tests.yml` looped over `packages/stack-forge`, which has
  never existed. The `[ -f ]` guard made it a no-op; dropped it.

`scripts/lint-no-dead-package-paths.mjs` fails CI on any `packages/<name>`
reference that doesn't resolve to a directory, across docs, .github, skills and
the root meta files. Design archives (docs/plans, docs/superpowers) and
CHANGELOGs are exempt — they record history, not the current tree. It catches
all three of the above; self-tests follow the existing scripts/__tests__
pattern.
@tobyhede
tobyhede merged commit 8bb0270 into remove-v2 Jul 23, 2026
13 checks passed
@tobyhede
tobyhede deleted the worktree-feat+remove-eql-v2-pr1-delete-packages branch July 23, 2026 05:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants