feat!: remove EQL v2-only published packages (protect, schema, protect-dynamodb)#760
Conversation
…t-dynamodb) PR 1 of the EQL v2 final removal (#707). Delete the closed v2-only dependency chain — @cipherstash/protect-dynamodb → @cipherstash/protect → @cipherstash/schema — and every reference to it. Nothing outside the three imported them (@cipherstash/stack depends only on the separate @cipherstash/protect-ffi). They are superseded by @cipherstash/stack: - @cipherstash/protect -> @cipherstash/stack - @cipherstash/schema -> @cipherstash/stack/schema - @cipherstash/protect-dynamodb -> @cipherstash/stack/dynamodb (encryptedDynamoDB) Existing EQL v2 ciphertext stays decryptable through @cipherstash/stack; this removes the v2 authoring/emission surface, not the read path. Reference cleanup (dangling refs that would break build/CI): - e2e/package.json @cipherstash/protect dep edge - root package.json build:js turbo filter - tests.yml protect/protect-dynamodb .env steps (would fail `touch` on gone dirs) and the bun-job test loop - rebuild-docs.yml trigger tag (@cipherstash/protect@* -> @cipherstash/stack@*) - integration-{drizzle,prisma-next,supabase}.yml packages/schema/** path filters - lint-no-hardcoded-runners allowlist entry - e2e package-managers BIN fixture (dead) + two stale source comments Changeset / RC housekeeping: - delete schema-stevec-standard-pin.md (only target was the deleted schema) - prune the three from pre.json initialVersions - add deletion-notice changeset on @cipherstash/stack + @cipherstash/nextjs Meta honesty: SECURITY.md package list, AGENTS.md Repository Layout, nextjs package description.
🦋 Changeset detectedLatest commit: 9fc0f39 The changes in this PR will be included in the next version bump. This PR includes changesets to release 12 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThe EQL v2-only ChangesEQL v2 package removal
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/plans/2026-07-22-eql-v2-removal-pr1-plan.md`:
- Around line 49-54: Update the release plan’s “remove-eql-v2-packages.md”
changeset entry to match the actual changeset targets: include the
`@cipherstash/nextjs` patch and its release rationale, or remove that package from
the changeset if the patch is unintended.
- Around line 69-70: Update the stale-reference verification command in the plan
so the `@cipherstash/protect` pattern matches only the exact package name, using
an explicit boundary that excludes packages such as `@cipherstash/protect-ffi`
while preserving the checks for `@cipherstash/schema` and
`@cipherstash/protect-dynamodb`.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 4270a939-b919-4732-b81d-3a3b9cdafa64
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (100)
.changeset/pre.json.changeset/remove-eql-v2-packages.md.changeset/schema-stevec-standard-pin.md.github/workflows/integration-drizzle.yml.github/workflows/integration-prisma-next.yml.github/workflows/integration-supabase.yml.github/workflows/rebuild-docs.yml.github/workflows/tests.ymlAGENTS.mdSECURITY.mddocs/plans/2026-07-22-eql-v2-removal-pr1-plan.mde2e/package.jsone2e/tests/package-managers.e2e.test.tspackage.jsonpackages/nextjs/package.jsonpackages/protect-dynamodb/.npmignorepackages/protect-dynamodb/CHANGELOG.mdpackages/protect-dynamodb/README.mdpackages/protect-dynamodb/__tests__/audit.test.tspackages/protect-dynamodb/__tests__/dynamodb.test.tspackages/protect-dynamodb/__tests__/error-codes.test.tspackages/protect-dynamodb/__tests__/helpers.test.tspackages/protect-dynamodb/package.jsonpackages/protect-dynamodb/src/helpers.tspackages/protect-dynamodb/src/index.tspackages/protect-dynamodb/src/operations/base-operation.tspackages/protect-dynamodb/src/operations/bulk-decrypt-models.tspackages/protect-dynamodb/src/operations/bulk-encrypt-models.tspackages/protect-dynamodb/src/operations/decrypt-model.tspackages/protect-dynamodb/src/operations/encrypt-model.tspackages/protect-dynamodb/src/operations/search-terms.tspackages/protect-dynamodb/src/types.tspackages/protect-dynamodb/tsconfig.jsonpackages/protect-dynamodb/tsup.config.tspackages/protect/.npmignorepackages/protect/CHANGELOG.mdpackages/protect/README.mdpackages/protect/__tests__/audit.test.tspackages/protect/__tests__/basic-protect.test.tspackages/protect/__tests__/bulk-protect.test.tspackages/protect/__tests__/deprecated/search-terms.test.tspackages/protect/__tests__/encrypt-query-searchable-json.test.tspackages/protect/__tests__/encrypt-query-stevec.test.tspackages/protect/__tests__/encrypt-query.test.tspackages/protect/__tests__/error-codes.test.tspackages/protect/__tests__/fixtures/index.tspackages/protect/__tests__/helpers.test.tspackages/protect/__tests__/infer-index-type.test.tspackages/protect/__tests__/json-protect.test.tspackages/protect/__tests__/jsonb-helpers.test.tspackages/protect/__tests__/k-discriminator.test.tspackages/protect/__tests__/keysets.test.tspackages/protect/__tests__/lock-context.test.tspackages/protect/__tests__/nested-models.test.tspackages/protect/__tests__/number-protect.test.tspackages/protect/__tests__/protect-ops.test.tspackages/protect/__tests__/searchable-json-pg.test.tspackages/protect/__tests__/supabase.test.tspackages/protect/package.jsonpackages/protect/src/bin/runner.tspackages/protect/src/bin/stash.tspackages/protect/src/client.tspackages/protect/src/ffi/helpers/error-code.tspackages/protect/src/ffi/helpers/infer-index-type.tspackages/protect/src/ffi/helpers/type-guards.tspackages/protect/src/ffi/helpers/validation.tspackages/protect/src/ffi/index.tspackages/protect/src/ffi/model-helpers.tspackages/protect/src/ffi/operations/base-operation.tspackages/protect/src/ffi/operations/batch-encrypt-query.tspackages/protect/src/ffi/operations/bulk-decrypt-models.tspackages/protect/src/ffi/operations/bulk-decrypt.tspackages/protect/src/ffi/operations/bulk-encrypt-models.tspackages/protect/src/ffi/operations/bulk-encrypt.tspackages/protect/src/ffi/operations/decrypt-model.tspackages/protect/src/ffi/operations/decrypt.tspackages/protect/src/ffi/operations/deprecated/search-terms.tspackages/protect/src/ffi/operations/encrypt-model.tspackages/protect/src/ffi/operations/encrypt-query.tspackages/protect/src/ffi/operations/encrypt.tspackages/protect/src/helpers/index.tspackages/protect/src/helpers/jsonb.tspackages/protect/src/identify/index.tspackages/protect/src/index.tspackages/protect/src/stash/index.tspackages/protect/src/types.tspackages/protect/tsconfig.jsonpackages/protect/tsup.config.tspackages/schema/.npmignorepackages/schema/CHANGELOG.mdpackages/schema/README.mdpackages/schema/__tests__/schema.test.tspackages/schema/__tests__/searchable-json.test.tspackages/schema/package.jsonpackages/schema/src/index.tspackages/schema/tsconfig.jsonpackages/schema/tsup.config.tspackages/stack/src/encryption/helpers/index.tspackages/stack/src/wasm-inline.tsscripts/lint-no-hardcoded-runners.mjs
💤 Files with no reviewable changes (73)
- packages/protect-dynamodb/.npmignore
- packages/protect/src/ffi/helpers/type-guards.ts
- packages/protect-dynamodb/README.md
- packages/protect/tests/basic-protect.test.ts
- packages/protect/tests/protect-ops.test.ts
- packages/protect/src/ffi/operations/bulk-encrypt-models.ts
- packages/protect/src/client.ts
- packages/protect/tests/nested-models.test.ts
- packages/protect/CHANGELOG.md
- e2e/package.json
- packages/protect/.npmignore
- packages/protect/tests/audit.test.ts
- packages/protect-dynamodb/src/operations/search-terms.ts
- packages/protect-dynamodb/tests/audit.test.ts
- packages/protect/tests/deprecated/search-terms.test.ts
- packages/protect/tests/keysets.test.ts
- packages/protect/tests/infer-index-type.test.ts
- packages/protect-dynamodb/tests/error-codes.test.ts
- packages/protect-dynamodb/tsconfig.json
- packages/protect/src/ffi/operations/base-operation.ts
- packages/protect/src/ffi/helpers/infer-index-type.ts
- packages/protect-dynamodb/src/operations/encrypt-model.ts
- packages/protect/tests/jsonb-helpers.test.ts
- packages/protect/src/ffi/operations/encrypt-model.ts
- packages/protect-dynamodb/CHANGELOG.md
- packages/protect-dynamodb/tsup.config.ts
- packages/protect/tests/number-protect.test.ts
- packages/protect/tests/k-discriminator.test.ts
- packages/protect/tests/helpers.test.ts
- packages/protect/tests/encrypt-query.test.ts
- packages/protect/src/ffi/operations/encrypt.ts
- packages/protect/src/ffi/helpers/error-code.ts
- packages/protect/src/bin/stash.ts
- packages/protect/tests/searchable-json-pg.test.ts
- packages/protect-dynamodb/src/operations/base-operation.ts
- packages/protect/tests/encrypt-query-searchable-json.test.ts
- packages/protect-dynamodb/package.json
- packages/protect/tests/lock-context.test.ts
- packages/protect/src/ffi/operations/batch-encrypt-query.ts
- packages/protect/src/ffi/operations/decrypt.ts
- packages/protect/src/bin/runner.ts
- packages/protect/tests/supabase.test.ts
- packages/protect/tests/bulk-protect.test.ts
- packages/protect-dynamodb/src/operations/bulk-encrypt-models.ts
- packages/protect-dynamodb/src/index.ts
- packages/protect-dynamodb/src/types.ts
- packages/protect/tests/json-protect.test.ts
- packages/protect-dynamodb/src/operations/bulk-decrypt-models.ts
- packages/protect-dynamodb/src/operations/decrypt-model.ts
- packages/protect/src/ffi/operations/bulk-encrypt.ts
- .changeset/pre.json
- packages/protect/tests/error-codes.test.ts
- .github/workflows/integration-prisma-next.yml
- packages/protect/src/ffi/index.ts
- packages/protect-dynamodb/tests/dynamodb.test.ts
- packages/protect/src/ffi/operations/decrypt-model.ts
- packages/protect/src/ffi/operations/deprecated/search-terms.ts
- packages/protect/tests/encrypt-query-stevec.test.ts
- scripts/lint-no-hardcoded-runners.mjs
- packages/protect/src/ffi/operations/bulk-decrypt.ts
- packages/protect/tests/fixtures/index.ts
- .changeset/schema-stevec-standard-pin.md
- packages/protect/src/ffi/model-helpers.ts
- SECURITY.md
- .github/workflows/integration-drizzle.yml
- packages/protect/src/ffi/operations/bulk-decrypt-models.ts
- packages/protect/src/ffi/operations/encrypt-query.ts
- packages/protect/package.json
- packages/protect/src/ffi/helpers/validation.ts
- .github/workflows/integration-supabase.yml
- packages/protect/README.md
- packages/protect-dynamodb/src/helpers.ts
- packages/protect-dynamodb/tests/helpers.test.ts
| - Add deletion-notice changeset `.changeset/remove-eql-v2-packages.md`: | ||
| `'@cipherstash/stack': patch` (successor surface for all three; group already major via | ||
| `stack-1-0-0-rc`), prose body naming each removed package and its migration path | ||
| (`@cipherstash/protect` → `@cipherstash/stack`; `@cipherstash/schema` → `@cipherstash/stack/schema`; | ||
| `@cipherstash/protect-dynamodb` → `@cipherstash/stack/dynamodb` `encryptedDynamoDB`). | ||
| Follows the `remove-legacy-drizzle-package.md` precedent. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Keep the release plan’s changeset targets in sync.
The actual changeset also patches @cipherstash/nextjs, but this plan lists only @cipherstash/stack. Add the Next.js release rationale here, or remove it from the changeset if that patch is unintended.
Proposed documentation update
- `'`@cipherstash/stack`': patch` (successor surface for all three; group already major via
+ `'`@cipherstash/stack`': patch` and `'`@cipherstash/nextjs`': patch` (the latter reflects
+ the package metadata update; stack is the successor surface for all three; group already major via📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - Add deletion-notice changeset `.changeset/remove-eql-v2-packages.md`: | |
| `'@cipherstash/stack': patch` (successor surface for all three; group already major via | |
| `stack-1-0-0-rc`), prose body naming each removed package and its migration path | |
| (`@cipherstash/protect` → `@cipherstash/stack`; `@cipherstash/schema` → `@cipherstash/stack/schema`; | |
| `@cipherstash/protect-dynamodb` → `@cipherstash/stack/dynamodb` `encryptedDynamoDB`). | |
| Follows the `remove-legacy-drizzle-package.md` precedent. | |
| - Add deletion-notice changeset `.changeset/remove-eql-v2-packages.md`: | |
| - `'`@cipherstash/stack`': patch` (successor surface for all three; group already major via | |
| - `stack-1-0-0-rc`), prose body naming each removed package and its migration path | |
| - (`@cipherstash/protect` → `@cipherstash/stack`; `@cipherstash/schema` → `@cipherstash/stack/schema`; | |
| - `@cipherstash/protect-dynamodb` → `@cipherstash/stack/dynamodb` `encryptedDynamoDB`). | |
| Add deletion-notice changeset `.changeset/remove-eql-v2-packages.md`: | |
| `'`@cipherstash/stack`': patch` and `'`@cipherstash/nextjs`': patch` (the latter reflects | |
| the package metadata update; stack is the successor surface for all three; group already major via | |
| `stack-1-0-0-rc`), prose body naming each removed package and its migration path | |
| (`@cipherstash/protect` → `@cipherstash/stack`; `@cipherstash/schema` → `@cipherstash/stack/schema`; | |
| `@cipherstash/protect-dynamodb` → `@cipherstash/stack/dynamodb` `encryptedDynamoDB`). | |
| Follows the `remove-legacy-drizzle-package.md` precedent. |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/plans/2026-07-22-eql-v2-removal-pr1-plan.md` around lines 49 - 54,
Update the release plan’s “remove-eql-v2-packages.md” changeset entry to match
the actual changeset targets: include the `@cipherstash/nextjs` patch and its
release rationale, or remove that package from the changeset if the patch is
unintended.
| - `git grep -n "@cipherstash/protect\b\|@cipherstash/schema\|@cipherstash/protect-dynamodb"` — | ||
| only intentional survivors (e.g. migration-path prose, `protect-ffi` which is unrelated). |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Make the stale-reference check match package names exactly.
Line 69’s @cipherstash/protect\b also matches the prefix of @cipherstash/protect-ffi, so the verification command reports the unrelated package as stale. Use an explicit package-name boundary.
Proposed verification command
- git grep -n "`@cipherstash/protect`\b\|`@cipherstash/schema`\|`@cipherstash/protect-dynamodb`"
+ git grep -n -E '`@cipherstash/`(protect-dynamodb|protect|schema)([^[:alnum:]_-]|$)'📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - `git grep -n "@cipherstash/protect\b\|@cipherstash/schema\|@cipherstash/protect-dynamodb"` — | |
| only intentional survivors (e.g. migration-path prose, `protect-ffi` which is unrelated). | |
| - `git grep -n -E '`@cipherstash/`(protect-dynamodb|protect|schema)([^[:alnum:]_-]|$)'` — | |
| only intentional survivors (e.g. migration-path prose, `protect-ffi` which is unrelated). |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/plans/2026-07-22-eql-v2-removal-pr1-plan.md` around lines 69 - 70,
Update the stale-reference verification command in the plan so the
`@cipherstash/protect` pattern matches only the exact package name, using an
explicit boundary that excludes packages such as `@cipherstash/protect-ffi` while
preserving the checks for `@cipherstash/schema` and `@cipherstash/protect-dynamodb`.
27a0915 to
994e5b2
Compare
freshtonic
left a comment
There was a problem hiding this comment.
Reviewed by Claude Code on behalf of James Sadler.
Verdict: APPROVE
Clean, well-scoped breaking removal of the three EQL v2-only published packages (@cipherstash/protect, @cipherstash/schema, @cipherstash/protect-dynamodb). I verified the removal is complete and does not break the build, the workspace/lockfile state, the changeset/release state, or the v2 read path. No blocking issues.
What I verified (against head 994e5b2)
- No dangling code/config references. No leftover
packages/{protect,schema,protect-dynamodb}dirs. Grep across.ts/.tsx/.json/.mjs/.js/.yml/.yamlfinds zero imports or dependency entries for the three removed names anywhere (the external@cipherstash/protect-fficorrectly remains). The only surviving mentions are prose: this PR's changeset, historicaldocs/plans/*, onedocs/query-api-walkthrough.mdpointer, and adependabot.ymlcomment (see nits). - Workspace + lockfile consistent.
pnpm-workspace.yamluses globs (packages/*), so no explicit entries to prune.pnpm-lock.yamlhas no importer blocks or dependency refs for the removed packages, and thee2e:importer no longer lists@cipherstash/protect(matching thee2e/package.jsonedit).package.jsonbuild:jsfilter and the three integration workflows' path triggers were updated accordingly. - Changeset/release state correct. The deleted
.changeset/schema-stevec-standard-pin.mdtargeted only@cipherstash/schema(a removed package), so no surviving package loses a pending release note..changeset/pre.jsonremains valid JSON (mode: pre), with the three packages dropped frominitialVersionsandschema-stevec-standard-pindropped from the changesets array. New changeset bumps@cipherstash/stack+@cipherstash/nextjs(nextjs only had a description edit — a patch is reasonable). - Security-relevant behavior preserved — the key check. The deleted schema changeset documented a load-bearing fix:
searchableJson()pins the SteVec encoding tomode: 'standard'so existing EQL v2 JSON columns stay queryable/comparable (protect-ffi 0.29 flipped the default tocompat). I confirmed the successor@cipherstash/stackcarries the identical pin atpackages/stack/src/schema/index.ts:428(with the same rationale in comments), and that v2 searchable-JSON authoring is now explicitly rejected with a migration steer (packages/stack/src/encryption/index.ts:113). This matches the PR's claim: v2 read/query path preserved, v2 emission surface removed. No crypto regression.
Non-blocking nits (documentation only)
docs/query-api-walkthrough.md:77still points atpackages/protect/src/ffi/*, now a dead path. Worth a one-line repoint topackages/stack/src/encryption/*in a follow-up..github/dependabot.yml:51comment referencespackages/protecthistorically. Harmless — the ignore rule it documents is for the surviving external@cipherstash/protect-ffi— but slightly stale.docs/plans/*references to the removed packages are acceptable as historical records.
The || true / continue-on-error suppression in the experimental Bun job is pre-existing and correctly left untouched.
Addresses PR #760 review feedback. - `docs/query-api-walkthrough.md` pointed at `packages/protect/src/ffi/*`, deleted by this PR. Replaced with a note rooting the doc's relative paths, and corrected the two other stale facts in the same block: the protect-ffi pin (0.24.0/0.23.0 → the actual 0.30.0) and row 1a's query-builder paths, which moved to stack-drizzle/stack-supabase in the #627 split. - `.github/dependabot.yml`'s ignore-rule comment narrated the #673 incident in the present tense against a package that no longer exists. Kept the lesson, marked the package as removed, and stated why the rule still holds for the surviving consumers. - `.github/workflows/tests.yml` looped over `packages/stack-forge`, which has never existed. The `[ -f ]` guard made it a no-op; dropped it. `scripts/lint-no-dead-package-paths.mjs` fails CI on any `packages/<name>` reference that doesn't resolve to a directory, across docs, .github, skills and the root meta files. Design archives (docs/plans, docs/superpowers) and CHANGELOGs are exempt — they record history, not the current tree. It catches all three of the above; self-tests follow the existing scripts/__tests__ pattern.
What
PR 1 of the EQL v2 final removal. Deletes the closed v2-only published dependency chain and removes every reference so the build, lockfile, and changeset state stay consistent:
@cipherstash/protect-dynamodb→ superseded by@cipherstash/stack/dynamodb(encryptedDynamoDB)@cipherstash/protect→ superseded by@cipherstash/stack(carries the encryption client directly)@cipherstash/schema→ superseded by@cipherstash/stack/schemaThe three formed a closed chain (
protect-dynamodb→protect→schema); nothing outside them imports them, and@cipherstash/stackdepends only on the external@cipherstash/protect-ffi, not on any of the three.~22k lines deleted across 100 files (packages, tests, READMEs, CHANGELOGs, workflow
.envsetup steps, lockfile entries).Compatibility
@cipherstash/stack— this removes the v2 authoring/emission surface, not the read path.Changeset
@cipherstash/stackpatch +@cipherstash/nextjspatch (see.changeset/remove-eql-v2-packages.md). Also cleans pending changeset state that referenced the removed packages (schema-stevec-standard-pin.md,pre.jsoninitialVersions).Review notes
CodeRabbit surfaced one pre-existing item: the experimental "Run Tests (Bun)" job suppresses failures (
|| true+continue-on-error: true). This PR only trimmed the deleted packages from that job's loop; the suppression predates it (a200e2ba) and is intentional for the experimental job. Left as-is — out of scope here.Plan:
docs/plans/2026-07-22-eql-v2-removal-pr1-plan.md🤖 Generated with Claude Code
Summary by CodeRabbit
Breaking Changes
@cipherstash/stackand its schema/DynamoDB integrations.Compatibility
@cipherstash/stack.Documentation