Repository navigation
Finish adapter correctness and release verification for the v2 removal #816
Description
Part of #778 and the EQL v2 removal. This combines independent adapter correctness fixes with the release gates that prove the removed surface has no surviving consumer.
Acceptance criteria:
- Preserve nested PostgREST OR structure and
referencedTablefor encrypted string and structuredorfilters; no plaintext operand may reach the wire. Reject or deliberately handle nullishmatches()operands instead of degrading them to plaintext filters. - Define safe behavior for non-row result modes such as
.csv()so CSV text is never passed tobulkDecryptModels. - Honor SQL LIKE escaping when adapting encrypted
like/ilikecalls: escaped%and_are literals, not wildcard controls. - Detect the removed legacy
encryptedSupabase({ encryptionClient, supabaseClient })call shape (or otherwise validate the supplied client) and fail with an actionable migration error before the first query. - Align native, WASM, and Supabase Date reconstruction, including invalid values, nested paths, aliases, and bulk behavior. Relates to decrypt / bulkDecrypt hand back date columns as ISO strings while the model helpers return Date — silently, and not for the stated reason #779; do not widen decrypt or bulkDecrypt plaintext input types here.
- Typecheck examples, e2e consumers, and stack-drizzle integration sources in CI. The e2e package must declare the repository-pinned TypeScript dependency rather than resolving an ambient/global
tsc. - Correct the
stash initSupabase handoff to name the concretepublic.eql_v3_*domain family (with a valid example), and update its unit test and changeset together;eql_v3_encrypteddoes not exist. - Reconcile pending changesets, skills, READMEs, and the feat!: remove EQL v2 repo-wide (umbrella, #707) #772/EQL v2 removal: review remediation for #772 #778 tracking text after the removal work lands. Do not rewrite already-published historical changesets. The audit must specifically ensure:
- migration guidance names only the final 1.0 imports and symbols (no removed
/v3subpaths or*V3adapter names, and no superseded Supabase behavior); - adapter behavior changes target the final owning adapter package in changeset frontmatter, not
@cipherstash/stackby default; - the DynamoDB entry reflects decrypt audit support on the typed
Encryptionclient; and @cipherstash/nextjsreceives only package-specific release notes, not the unrelated deleted-package narrative.
- migration guidance names only the final 1.0 imports and symbols (no removed
- Make CLI and wizard integration skill selection share one source of truth, or add a parity test that covers every integration and verifies
SKILL.mdavailability, including Prisma Next.
The adapter fixes may be separate commits, but share one release-readiness outcome and final verification pass.
Activity
tobyhede commentedon Jul 29, 2026
Status (2026-07-30): 8 of 9 criteria delivered — criterion 8 blocks closure
Completed by #828, merged as
ee33ac3b, an ancestor oforigin/main(c8b1325a), reachingmaininside the #772 umbrella merge.Note the tracking failure: #828's body ends with
Closes cipherstash/stack#816, but it targeted theremove-v2branch. GitHub only honours closing keywords on merge into the default branch, so it never fired andclosingIssuesReferencesis empty. Same mechanism left #814 stale-open (now closed).Verified delivered against
origin/main:referencedTablepreserved, no plaintext operand on the wire —packages/stack-supabase/src/query-filters.ts:334-360matches()rejected —query-builder.ts:317-321.csv()made safe —query-builder.ts:496-499,types.ts:602-603like-pattern.ts:18-46, rejection atquery-builder.ts:871-877encryptedSupabase({ encryptionClient, supabaseClient })shape diagnosed —stack-supabase/src/index.ts:149-152packages/stack/src/eql/v3/date-reconstruction.ts:12-22, 26-70, consumed atclient-v3.ts:298,wasm-inline.ts:1412,dynamodb/operations/decrypt-model.ts:81,bulk-decrypt-models.ts:85,stack-supabase/src/query-results.ts:80-83.github/workflows/tests.yml:161,184,187and:124-128;e2e/package.jsondevDeptypescript: catalog:repostash initSupabase handoff names the concrete domain —init/lib/setup-prompt.ts:103, asserted atsetup-prompt.test.ts:196-197includingnot.toContain('eql_v3_encrypted')e2e/tests/skill-map-parity.e2e.test.ts:37(the criterion allowed a parity test as an alternative to one source of truth)Outstanding: criterion 8, the README half
The changeset and tracking-text work is done. Two published READMEs still describe removed tooling:
packages/stack/README.md:576— table row|--proxy/--no-proxy| Opt in/out of the CipherStash Proxy path |. The flags were removed in feat(cli): remove the EQL v2 migration leaf #825;packages/cli/README.md,skills/stash-cli/SKILL.mdandregistry.tsare all clean, andv2-retirement.test.ts:11,31-32asserts their absence. This one line was missed.packages/wizard/README.md:22-24and:35-36— still say the wizard "shells out tostash eql install/db push". Only thedb pushhalf is wrong;stash eql installis still live (registry.ts:307).packages/wizard/src/lib/post-agent.ts:58now states the retired command "must never run", so the README contradicts the shipped code.Do not close this by merging #790. #790 does remove the
--proxyrow, but it isCONFLICTING, based 158 commits behindmain, and its two-dot diff againstmainis 389 files / ~19,300 deletions — merging it unrebased would revert large amounts of already-merged work. The one line needs doing directly.Wizard source and test
db pushresidue is out of scope here (it is not a README) and is tracked in #837.