feat(cli,wizard)!: remove the --proxy / --no-proxy choice

.changeset/cli-near-miss-statement-trim.md

@@ -0,0 +1,15 @@
+---
+'stash': patch
+---
+
+Trim the leading comment block from near-miss statements reported by the Drizzle
+migration rewriter (`stash eql migration --drizzle`, `stash eql install`).
+
+The broad near-miss scan is anchored on the previous `;`, so a
+`SET DATA TYPE … USING …` it could not safely repair was quoted back to the user
+with every preceding comment and blank line glued to its front — in a file
+opening with a comment block, that meant the whole header. The reported
+statement is now the offending statement alone. Detection is unchanged; only the
+text shown to the user is affected.
+
+Keeps this rewriter in sync with its sibling in `@cipherstash/wizard`.

.changeset/drizzle-encrypted-indexes.md

@@ -2,7 +2,7 @@
 '@cipherstash/stack-drizzle': minor
 ---
 
-New `encryptedIndexes` helper on the `/v3` entry: spread
+New `encryptedIndexes` helper on the package root: spread
 `...encryptedIndexes(t)` in `pgTable`'s third-argument callback and it derives
 the recommended functional indexes for every encrypted column in the table —
 named `<table>_<column>_<capability>`, tracked by `drizzle-kit generate` like

.changeset/dynamodb-v2-read-table-forwarding.md

@@ -0,0 +1,27 @@
+---
+'@cipherstash/stack': patch
+---
+
+Fix `encryptedDynamoDB`'s EQL v2 read path, which failed against a v3-configured
+client — the case the v2 read support exists for.
+
+`decryptModel` and `bulkDecryptModels` forwarded the table to the encryption
+client unconditionally. The second argument is only meaningful to the typed EQL
+v3 client, which resolves it against its own reconstructor map; a legacy v2
+table is not in that map, so the call failed with:
+
+```
+[eql/v3]: decryptModel received a table this client was not initialized with
+```
+
+That contradicted the adapter's documented contract — writes are EQL v3 only,
+but decrypt keeps accepting a v2 table so previously stored items stay readable.
+In practice the failure hit exactly the customers the compatibility promise was
+written for: upgraded to a v3 schema, with v2 items still in the table.
+
+The table is now forwarded only when it is an EQL v3 table. A v2 table takes the
+table-less form, and the client derives the table from the payloads themselves.
+
+Both paths are covered by a credential-free test asserting what the adapter
+forwards, so a regression no longer depends on a live-credential integration run
+to surface.

.changeset/eql-v3-sole-docs.md

@@ -5,12 +5,22 @@
 
 Docs: EQL v3 is now the sole documented approach. The `stash-encryption`,
 `stash-drizzle`, and `stash-supabase` skills and the `@cipherstash/stack`
-README teach only the v3 typed surface (`EncryptionV3`, `types.*` concrete
-domains, `@cipherstash/stack-drizzle/v3`, `encryptedSupabaseV3`); EQL v2
-shrinks to one short Legacy section per document. Two explicit exceptions are
-called out: DynamoDB still requires the v2 schema surface (#657), and the
-encrypt rollout tooling (`stash encrypt backfill`/`cutover`,
-`@cipherstash/migrate`) currently targets v2 columns (#648) — its guidance is
-kept under a version callout. Also corrects the legacy `@cipherstash/drizzle`
-README's pointer to the removed `@cipherstash/stack/drizzle` subpath (now the
-separate `@cipherstash/stack-drizzle` package).
+README teach only the v3 typed surface (`Encryption`, the `types.*` concrete
+domains, the `@cipherstash/stack-drizzle` package root, `encryptedSupabase`);
+EQL v2 shrinks to one short Legacy section per document. Two places keep more
+than a Legacy section, because EQL v2 is still reachable there:
+
+- **DynamoDB reads.** `encryptedDynamoDB` writes EQL v3 only, but `decryptModel`
+  / `bulkDecryptModels` still accept an EQL v2 table so previously stored v2
+  items stay readable, so the `stash-dynamodb` skill keeps the v2 schema shape
+  documented for that read path (#657).
+- **The encrypt rollout lifecycle.** `stash encrypt *` and `@cipherstash/migrate`
+  detect a column's generation from its Postgres domain type, with EQL v3 as the
+  recognised and default generation; a legacy `eql_v2_encrypted` column does not
+  classify and falls through to the v2 lifecycle, which ends in
+  `stash encrypt cutover` rather than the v3 `stash encrypt drop`. That
+  difference is kept under a version callout (#648).
+
+Also corrects the legacy `@cipherstash/drizzle` README's pointer to the removed
+`@cipherstash/stack/drizzle` subpath (now the separate `@cipherstash/stack-drizzle`
+package).

.changeset/init-placeholder-eql-v3.md

@@ -17,3 +17,7 @@ the concrete-domain `types.*` factories (`types.TextSearch`, `types.IntegerOrd`,
 `types.Text`, `types.Json`, …), and the `@cipherstash/stack-drizzle/v3` entry
 (`extractEncryptionSchemaV3`) for Drizzle. The `encryptionClient` export shape
 and the empty-schema "no schemas yet" error path are unchanged.
+
+**Superseded later in this release** by the `@cipherstash/stack-drizzle` EQL v2
+removal: the scaffolds now emit `Encryption` from `@cipherstash/stack/v3` and
+`extractEncryptionSchema` from the collapsed `@cipherstash/stack-drizzle` root.

.changeset/one-sided-eql-detection-docs.md

@@ -0,0 +1,31 @@
+---
+'stash': patch
+'@cipherstash/migrate': patch
+'@cipherstash/stack': patch
+---
+
+Correct shipped documentation that claimed the tooling detects a column's EQL
+**v2** generation. It does not, and has not since `classifyEqlDomain` dropped v2:
+detection is one-sided — a `public.eql_v3_*` Postgres domain classifies as **v3**,
+and anything else (a plaintext column, or a legacy `eql_v2_encrypted` one)
+classifies as *unknown* and falls through to the **v2** lifecycle. The v2 path is
+reached by fallback, not by detection, and a v2 column records no `eqlVersion` in
+`.cipherstash/migrations.json`, so `stash encrypt status` reports no version for
+it.
+
+- `skills/stash-supabase/SKILL.md` said the CLI "still auto-detects a v2 column"
+  (twice, once inside the "Stay on v2 for now" bullet — exactly the case it got
+  wrong) and that `stash encrypt drop` picks its target from a version the CLI
+  "auto-detects". All three now describe the one-sided rule, matching the correct
+  wording already in the same file's EQL version note. This skill is copied into
+  customer repos by `stash init`, so the wrong version of it was being installed
+  as guidance.
+- `packages/migrate/README.md` documented `detectColumnEqlVersion(client, table,
+  column)` as returning `2`, `3`, or `null`. It cannot return `2` — the return
+  type is now stated as `3` or `null`, with what a `null` means for the caller.
+  The lifecycle intro no longer presents the v2 ladder as a detection result.
+- `packages/stack/README.md`'s Supabase example imported and called
+  `encryptedSupabaseV3`, the `@deprecated` alias, contradicting the same file's
+  package table and v3-only note. It now uses `encryptedSupabase`.
+
+Documentation only — no behaviour change.

.changeset/pre.json

@@ -11,9 +11,6 @@
     "@cipherstash/migrate": "0.2.0",
     "@cipherstash/nextjs": "4.1.1",
     "@cipherstash/prisma-next": "0.3.2",
-    "@cipherstash/protect": "12.0.1",
-    "@cipherstash/protect-dynamodb": "12.0.1",
-    "@cipherstash/schema": "3.0.1",
     "@cipherstash/stack": "0.19.0",
     "@cipherstash/stack-drizzle": "0.0.0",
     "@cipherstash/stack-supabase": "0.0.0",
@@ -70,7 +67,6 @@
     "remove-legacy-drizzle-package",
     "remove-secrets-leftovers",
     "rename-db-install-to-eql-install",
-    "schema-stevec-standard-pin",
     "skills-eql-v3-accuracy",
     "skills-identity-docs-refresh",
     "stack-1-0-0-rc",

.changeset/prisma-next-v3-client-config.md

@@ -0,0 +1,32 @@
+---
+'@cipherstash/prisma-next': major
+---
+
+**Breaking:** `CipherstashFromStackV3Options.encryptionConfig` — the config
+passed through to the encryption client by `cipherstashFromStack` — is narrowed
+from `ClientConfig` to `V3ClientConfig` (`ClientConfig` without the legacy
+`eqlVersion: 2` escape hatch). Forcing EQL v2 no longer type-checks:
+
+```ts
+const cipherstash = await cipherstashFromStack({
+  contractJson,
+  encryptionConfig: { eqlVersion: 2 },
+  //                  ^^^^^^^^^^ error TS2322: Type '2' is not assignable to type '3'.
+})
+```
+
+The option never did what it looked like it did. This package is EQL v3 only,
+and `eqlVersion: 2` selects `Encryption`'s nominal (untyped) overload at
+runtime — not the `TypedEncryptionClient` that `cipherstashFromStack` returns as
+`encryptionClient`. The field disagreed with the client you got back.
+
+**Migration:** drop the `eqlVersion` field. Every other `ClientConfig` option
+(`workspaceCrn`, `clientId`, `clientKey`, `accessKey`, `authStrategy`, logging,
+…) is unchanged and still accepted.
+
+To read legacy EQL v2 rows, decrypt through `@cipherstash/stack` rather than
+asking this adapter for a v2 client: the decrypt path is generation-agnostic and
+reads both v2 and v3 payloads. Use the returned `encryptionClient` — `decrypt(…)`
+for a single value, or the no-table `decryptModel(row)` / `bulkDecryptModels(rows)`
+form for whole models, which is the supported path for models written before the
+v3 upgrade.

.changeset/remove-eql-v2-drizzle-root.md

@@ -0,0 +1,27 @@
+---
+'@cipherstash/stack-drizzle': major
+'@cipherstash/stack': patch
+'stash': patch
+---
+
+Remove the EQL v2 authoring surface from `@cipherstash/stack-drizzle` and collapse the EQL v3 `./v3` subpath into the package root.
+
+**Breaking (`@cipherstash/stack-drizzle`):**
+
+- The EQL v2 root exports are gone: `encryptedType`, the v2 `extractEncryptionSchema`, the v2 `createEncryptionOperators` (including the `like` / `ilike` operators), and `EncryptionConfigError`. Authoring or querying `eql_v2_encrypted` columns through Drizzle is no longer supported.
+- The `./v3` subpath is **removed** from the package `exports` map and `typesVersions`. The EQL v3 implementation is now the package root, and the `*V3` names are de-suffixed (`createEncryptionOperatorsV3` → `createEncryptionOperators`, `extractEncryptionSchemaV3` → `extractEncryptionSchema`). This is a **hard break with no alias**: post-collapse the root names would collide with the removed v2 names, and keeping an alias would silently type-check v2 call sites against v3 semantics.
+
+**Migration** — import the v3 surface from the package root instead of `./v3`, and drop the `V3` suffix:
+
+```diff
+- import { types, extractEncryptionSchemaV3, createEncryptionOperatorsV3 } from '@cipherstash/stack-drizzle/v3'
++ import { types, extractEncryptionSchema, createEncryptionOperators } from '@cipherstash/stack-drizzle'
+```
+
+The `types.*` column factories, `makeEqlV3Column` / `getEqlV3Column` / `isEqlV3Column`, the codec helpers (`v3ToDriver` / `v3FromDriver` / `EqlV3CodecError`), and `EncryptionOperatorError` are unchanged apart from moving to the root.
+
+Existing EQL v2 ciphertext remains decryptable via `@cipherstash/stack` — only the Drizzle-side v2 authoring and query-building is removed.
+
+**`stash` (patch):** `stash init --drizzle` scaffolded the removed surface — the generated encryption-client file and the Drizzle placeholder both imported `extractEncryptionSchemaV3` from `@cipherstash/stack-drizzle/v3`, so a freshly-initialised project would not resolve against this release. Both now emit the collapsed root import. The bundled `stash-drizzle` and `stash-encryption` skills are updated to match.
+
+**`@cipherstash/stack` (patch):** README only — its Drizzle section documented the removed `./v3` subpath and the `*V3` export names.

.changeset/remove-eql-v2-migrate-classifier.md

@@ -0,0 +1,20 @@
+---
+'@cipherstash/migrate': patch
+---
+
+Drop EQL v2 from the domain-type classifier. `classifyEqlDomain` (and the
+`detectColumnEqlVersion` / `listEncryptedColumns` / `resolveEncryptedColumn`
+resolution built on it) no longer recognise the legacy `eql_v2_encrypted`
+domain — v3 is the sole generation this workspace authors and backfills, so a
+column's version is now determined solely from its self-describing `eql_v3_*`
+domain type. A legacy v2 column's version is carried by the manifest's recorded
+`eqlVersion` instead (the CLI's `encrypt status` / `status` renderers already
+fall back to it), so status output is unchanged for v2 columns already recorded
+in `.cipherstash/migrations.json`. A v2 column backfilled from here on records
+no `eqlVersion` and so reports no version in `stash encrypt status` — the v2
+lifecycle itself (cut-over, then dropping `<column>_plaintext`) is unaffected.
+
+This removes v2 *classification*, not the v2 read path: existing v2 ciphertext
+remains decryptable through `@cipherstash/stack`. `EqlVersion` keeps its `2`
+member for manifest-sourced legacy values; the exported function signatures are
+unchanged.

.changeset/remove-eql-v2-packages.md

@@ -0,0 +1,22 @@
+---
+'@cipherstash/stack': patch
+'@cipherstash/nextjs': patch
+---
+
+Remove the EQL v2-only published packages `@cipherstash/protect`,
+`@cipherstash/schema`, and `@cipherstash/protect-dynamodb` from the repository
+and the release train. They formed a closed dependency chain
+(`@cipherstash/protect-dynamodb` → `@cipherstash/protect` → `@cipherstash/schema`)
+and are superseded by `@cipherstash/stack`:
+
+- `@cipherstash/protect` (core encryption) → `@cipherstash/stack`, which now
+  carries the encryption client directly.
+- `@cipherstash/schema` (schema builders) → `@cipherstash/stack/schema`.
+- `@cipherstash/protect-dynamodb` (standalone DynamoDB adapter) →
+  `@cipherstash/stack/dynamodb` (`encryptedDynamoDB`), the maintained
+  implementation.
+
+Already-published versions remain installable from npm; the git history
+preserves the source for any emergency maintenance. Existing EQL v2 ciphertext
+stays decryptable through `@cipherstash/stack` — this removes the v2 authoring
+and emission surface, not the read path.

.changeset/remove-eql-v2-scaffold-examples-meta.md

@@ -0,0 +1,22 @@
+---
+'stash': patch
+'@cipherstash/stack': patch
+---
+
+De-suffix the v3 client name in generated code and shipped guidance.
+
+`stash init` scaffolded `import { EncryptionV3 } from '@cipherstash/stack/v3'`
+into the client file it writes. `EncryptionV3` is a deprecated alias of
+`Encryption`, so new projects were started on the deprecated name. The
+scaffold now emits `Encryption`.
+
+`@cipherstash/stack/v3` now re-exports `Encryption` alongside the deprecated
+`EncryptionV3` alias, so a v3 schema and its client come from one import
+specifier — the deprecation notice already documented this import, but it did
+not resolve.
+
+Corrects the bundled agent skills and package docs, which described
+`encryptedSupabase` as the legacy EQL v2 wrapper. It is the EQL v3 factory;
+the v2 wrapper was removed. Also drops the stale "DynamoDB still requires v2"
+note from the `@cipherstash/stack` README — DynamoDB writes EQL v3 and reads
+existing v2 items.

.changeset/remove-eql-v2-supabase-authoring.md

@@ -0,0 +1,45 @@
+---
+'@cipherstash/stack-supabase': major
+---
+
+Remove the EQL v2 authoring surface and de-suffix the v3 API to the canonical
+unsuffixed names (part of the EQL v2 removal, #707).
+
+- **`encryptedSupabase` is now the connect-time-introspecting EQL v3 factory**
+  (formerly `encryptedSupabaseV3`). `encryptedSupabaseV3` remains as a
+  type-identical `@deprecated` alias, so existing imports keep working.
+- **The legacy v2 `encryptedSupabase({ encryptionClient, supabaseClient })`
+  wrapper is removed** — with it the two-argument `from(tableName, schema)` form
+  and the hand-written client-side v2 schema. Its `EncryptedSupabaseConfig` and
+  the v2 `EncryptedSupabaseInstance`/`EncryptedQueryBuilder` type shapes are gone;
+  the unsuffixed type names now denote the v3 surface.
+- **The `*V3` type exports are de-suffixed** to their canonical names —
+  `EncryptedSupabaseV3Options` → `EncryptedSupabaseOptions`,
+  `EncryptedSupabaseV3Instance` → `EncryptedSupabaseInstance`,
+  `TypedEncryptedSupabaseV3Instance` → `TypedEncryptedSupabaseInstance`,
+  `EncryptedQueryBuilderV3` → `EncryptedQueryBuilder`,
+  `EncryptedQueryBuilderV3Untyped` → `EncryptedQueryBuilderUntyped`,
+  `V3FilterableKeys` → `FilterableKeys`, `V3OrderableKeys` → `OrderableKeys`, and
+  the rest of the `*V3` key-helper types. Each keeps a type-identical
+  `@deprecated` `*V3` alias.
+
+**Reading existing v2 data.** Only the v2 *authoring/emission* surface is removed
+— no v2 ciphertext is stranded. Decryption in `@cipherstash/stack` is
+generation-agnostic, so EQL v2 payloads still decrypt through the core client
+(`decrypt` / `decryptModel`). This adapter, however, is now EQL v3 only and will
+not auto-read an `eql_v2_encrypted` column: to read legacy v2 data during
+migration, decrypt fetched rows with `@cipherstash/stack` directly, or run a
+v2-configured setup alongside the v3 one and route per column. Mixed-generation
+handling is a customer-side concern (install both and handle it explicitly), not
+adapter auto-detection.
+
+Internally the v3 query builder (`query-builder-v3.ts`) was folded into the base
+`EncryptedQueryBuilderImpl`, which is now natively EQL v3; no runtime behaviour or
+wire encoding changed.
+
+**Migration:** rename `encryptedSupabaseV3` → `encryptedSupabase` (or keep using
+the alias). If you still use the v2 `encryptedSupabase({ encryptionClient,
+supabaseClient }).from(table, schema)` wrapper, migrate the table to an
+`eql_v3_*` column domain and switch to the introspecting factory —
+`await encryptedSupabase(supabaseUrl, supabaseKey)` — see the `stash-supabase`
+skill and https://cipherstash.com/docs.

.changeset/remove-eql-v2-supabase-skill.md

@@ -0,0 +1,11 @@
+---
+'stash': patch
+---
+
+Update the bundled `stash-supabase` agent skill for the EQL v2 removal (#707):
+`encryptedSupabase` is now the connect-time-introspecting EQL v3 factory (with
+`encryptedSupabaseV3` kept as a `@deprecated` alias), and the legacy v2
+`encryptedSupabase({ encryptionClient, supabaseClient })` authoring wrapper has
+been removed. The skill's examples, exported-type list, and migration/cutover
+guidance are corrected accordingly. Skills ship inside the `stash` tarball, so
+the stale v2 guidance would otherwise land in a user's project.

.changeset/remove-proxy-choice-flags.md

@@ -0,0 +1,20 @@
+---
+'stash': major
+'@cipherstash/wizard': major
+---
+
+Remove the `--proxy` / `--no-proxy` choice from `stash init`, and the wizard step that depended on it.
+
+`--proxy` never configured a connection to CipherStash Proxy. It recorded a declaration of intent: the flag (or an interactive prompt) set `usesProxy` in `.cipherstash/context.json`, and exactly one piece of code acted on it — the wizard's post-agent step, which ran `stash db push` when it was true and logged a skip notice when it was false. `stash plan` and `stash impl` read the field into state and never branched on it.
+
+`stash db push` writes `eql_v2_configuration`, which only ever applied to EQL v2 with Proxy. With the v2 surface going away there is no condition under which that step should run, so the flag it gated goes with it.
+
+Removed:
+
+- `--proxy` / `--no-proxy` on `stash init`, and the interactive "Proxy or SDK?" prompt (`init` is now six steps, not seven)
+- `usesProxy` from `.cipherstash/context.json`, from `InitState`, and from the wizard's gathered context
+- The wizard post-agent `stash db push` step and its skip notice
+
+**Upgrading:** drop `--proxy` / `--no-proxy` from any scripted `stash init` invocation. The CLI's argument parser is permissive, so a leftover flag is ignored rather than rejected — it will not fail your pipeline, but it will not do anything either. A `context.json` written by an older CLI may still carry `usesProxy`; it is now an ignored extra property and needs no migration.
+
+`stash db push` itself is unchanged here and is being retired separately with the rest of the EQL v2 surface. `--proxy-url` on `stash encrypt cutover` is a different flag — a real Proxy connection URL used to call `eql_v2.reload_config()` — and is also untouched.