feat(workspace): link protect-ffi and build it in the jobs that need it

.github/workflows/integration-drizzle.yml

@@ -59,6 +59,33 @@ on:
       - '.github/workflows/integration-drizzle.yml'
       - '.github/actions/integration-setup/**'
       - '.github/actions/integration-db/**'
+      - '.github/actions/build-ffi-binding/**'
+      # The Rust that produces every EQL payload these suites round-trip.
+      # Absorbing protect-ffi put it in-tree, so a crate change can now
+      # break them in a PR that touches no TypeScript at all.
+      #
+      # The manifests are here for the same reason as the sources: a
+      # dependency bump in Cargo.lock changes the compiled encryption core
+      # without touching a .rs file, and package.json / mise.toml carry the
+      # build scripts and the toolchain pin. Matching the filter in
+      # tests-rust.yml, which already covers all four.
+      - 'packages/protect-ffi/crates/**'
+      - 'packages/protect-ffi/src/**'
+      - 'packages/protect-ffi/Cargo.toml'
+      - 'packages/protect-ffi/Cargo.lock'
+      - 'packages/protect-ffi/package.json'
+      - 'packages/protect-ffi/mise.toml'
+      # The non-cargo half of `build:wasm`, and the reason this job passes
+      # `wasm: 'true'`: `tsc -p tsconfig.wasm-errors.json`, then a
+      # `postbuild:wasm` hook running `scripts/inline-wasm.mjs`, which is what
+      # emits `dist/wasm/protect_ffi_inline.js` — the bundle the
+      # `integration/wasm/**` suites selected below actually load. Both files
+      # are in the WASM cache key of `.github/actions/build-ffi-binding`, so an
+      # edit to either misses that cache and REBUILDS the bundle; without these
+      # two entries it gets rebuilt and the only suite that loads it never runs.
+      # Pinned by scripts/__tests__/wasm-build-inputs-paths-filter.test.mjs.
+      - 'packages/protect-ffi/tsconfig.wasm-errors.json'
+      - 'packages/protect-ffi/scripts/inline-wasm.mjs'
   pull_request:
     branches: ['**']
     # Repeated verbatim: GitHub Actions does not support YAML anchors/aliases.
@@ -106,6 +133,33 @@ on:
       - '.github/workflows/integration-drizzle.yml'
       - '.github/actions/integration-setup/**'
       - '.github/actions/integration-db/**'
+      - '.github/actions/build-ffi-binding/**'
+      # The Rust that produces every EQL payload these suites round-trip.
+      # Absorbing protect-ffi put it in-tree, so a crate change can now
+      # break them in a PR that touches no TypeScript at all.
+      #
+      # The manifests are here for the same reason as the sources: a
+      # dependency bump in Cargo.lock changes the compiled encryption core
+      # without touching a .rs file, and package.json / mise.toml carry the
+      # build scripts and the toolchain pin. Matching the filter in
+      # tests-rust.yml, which already covers all four.
+      - 'packages/protect-ffi/crates/**'
+      - 'packages/protect-ffi/src/**'
+      - 'packages/protect-ffi/Cargo.toml'
+      - 'packages/protect-ffi/Cargo.lock'
+      - 'packages/protect-ffi/package.json'
+      - 'packages/protect-ffi/mise.toml'
+      # The non-cargo half of `build:wasm`, and the reason this job passes
+      # `wasm: 'true'`: `tsc -p tsconfig.wasm-errors.json`, then a
+      # `postbuild:wasm` hook running `scripts/inline-wasm.mjs`, which is what
+      # emits `dist/wasm/protect_ffi_inline.js` — the bundle the
+      # `integration/wasm/**` suites selected below actually load. Both files
+      # are in the WASM cache key of `.github/actions/build-ffi-binding`, so an
+      # edit to either misses that cache and REBUILDS the bundle; without these
+      # two entries it gets rebuilt and the only suite that loads it never runs.
+      # Pinned by scripts/__tests__/wasm-build-inputs-paths-filter.test.mjs.
+      - 'packages/protect-ffi/tsconfig.wasm-errors.json'
+      - 'packages/protect-ffi/scripts/inline-wasm.mjs'
 
 jobs:
   integration:
@@ -181,8 +235,9 @@ jobs:
       - uses: ./.github/actions/integration-setup
 
       # Fast pre-flight: fail in seconds if a secret was rotated or cleared,
-      # before the docker pull. The in-test `requireIntegrationEnv` is the
-      # correctness guarantee; this is the cheap one.
+      # before the binding build and the docker pull. The in-test
+      # `requireIntegrationEnv` is the correctness guarantee; this is the cheap
+      # one, so nothing expensive may be ordered ahead of it.
       - name: Require CipherStash secrets
         uses: ./.github/actions/require-cs-secrets
         with:
@@ -191,6 +246,14 @@ jobs:
           client-key: ${{ secrets.CS_CLIENT_KEY }}
           client-access-key: ${{ secrets.CS_CLIENT_ACCESS_KEY }}
 
+      # `wasm: true` because CS_IT_SUITE below includes `integration/wasm/**`
+      # — the `@cipherstash/stack/wasm-inline` adapter over the shared v3
+      # matrix — which loads the real WASM, unlike the mocked unit tests.
+      - name: Build the protect-ffi binding
+        uses: ./.github/actions/build-ffi-binding
+        with:
+          wasm: 'true'
+
       # No pre-`up` cleanup step any more: the project name is unique per job, so
       # a container leaked by a hard-killed prior run cannot hold this job's
       # name or its (ephemeral) port. Blanket-pruning would now be actively

.github/workflows/integration-prisma-next.yml

@@ -33,6 +33,22 @@ on:
       - '.github/workflows/integration-prisma-next.yml'
       - '.github/actions/integration-setup/**'
       - '.github/actions/integration-db/**'
+      - '.github/actions/build-ffi-binding/**'
+      # The Rust that produces every EQL payload these suites round-trip.
+      # Absorbing protect-ffi put it in-tree, so a crate change can now
+      # break them in a PR that touches no TypeScript at all.
+      #
+      # The manifests are here for the same reason as the sources: a
+      # dependency bump in Cargo.lock changes the compiled encryption core
+      # without touching a .rs file, and package.json / mise.toml carry the
+      # build scripts and the toolchain pin. Matching the filter in
+      # tests-rust.yml, which already covers all four.
+      - 'packages/protect-ffi/crates/**'
+      - 'packages/protect-ffi/src/**'
+      - 'packages/protect-ffi/Cargo.toml'
+      - 'packages/protect-ffi/Cargo.lock'
+      - 'packages/protect-ffi/package.json'
+      - 'packages/protect-ffi/mise.toml'
   pull_request:
     branches: ['**']
     # Repeated verbatim: GitHub Actions does not support YAML anchors/aliases.
@@ -52,6 +68,22 @@ on:
       - '.github/workflows/integration-prisma-next.yml'
       - '.github/actions/integration-setup/**'
       - '.github/actions/integration-db/**'
+      - '.github/actions/build-ffi-binding/**'
+      # The Rust that produces every EQL payload these suites round-trip.
+      # Absorbing protect-ffi put it in-tree, so a crate change can now
+      # break them in a PR that touches no TypeScript at all.
+      #
+      # The manifests are here for the same reason as the sources: a
+      # dependency bump in Cargo.lock changes the compiled encryption core
+      # without touching a .rs file, and package.json / mise.toml carry the
+      # build scripts and the toolchain pin. Matching the filter in
+      # tests-rust.yml, which already covers all four.
+      - 'packages/protect-ffi/crates/**'
+      - 'packages/protect-ffi/src/**'
+      - 'packages/protect-ffi/Cargo.toml'
+      - 'packages/protect-ffi/Cargo.lock'
+      - 'packages/protect-ffi/package.json'
+      - 'packages/protect-ffi/mise.toml'
 
 jobs:
   integration:
@@ -94,8 +126,9 @@ jobs:
       - uses: ./.github/actions/integration-setup
 
       # Fast pre-flight: fail in seconds if a secret was rotated or cleared,
-      # before the docker pull. The in-test `requireIntegrationEnv` is the
-      # correctness guarantee; this is the cheap one.
+      # before the binding build and the docker pull. The in-test
+      # `requireIntegrationEnv` is the correctness guarantee; this is the cheap
+      # one, so nothing expensive may be ordered ahead of it.
       - name: Require CipherStash secrets
         uses: ./.github/actions/require-cs-secrets
         with:
@@ -104,6 +137,11 @@ jobs:
           client-key: ${{ secrets.CS_CLIENT_KEY }}
           client-access-key: ${{ secrets.CS_CLIENT_ACCESS_KEY }}
 
+      # No `wasm: true` — the prisma-next family suites go through the native
+      # binding only.
+      - name: Build the protect-ffi binding
+        uses: ./.github/actions/build-ffi-binding
+
       # No pre-`up` cleanup step any more: the project name is unique per job, so
       # a container leaked by a hard-killed prior run cannot hold this job's
       # name or its (ephemeral) port. Blanket-pruning would now be actively

.github/workflows/integration-protect-ffi.yml

@@ -51,6 +51,11 @@ on:
       # `tests/wasm-round-trip.test.ts` loads at module-graph time. An edit
       # there breaks that suite while touching no Rust and no `src/`.
       - 'packages/protect-ffi/scripts/**'
+      # The other half of the same build: `build:wasm` ends in `tsc -p
+      # tsconfig.wasm-errors.json`, and the inliner re-exports what it emits.
+      # `scripts/**` above does not reach a root tsconfig, so without this an
+      # edit to it rebuilds the bundle that suite loads and starts no job.
+      - 'packages/protect-ffi/tsconfig.wasm-errors.json'
       # package.json carries the build scripts and the exports map the suite
       # resolves through; mise.toml carries the `tasks.toml` include, the
       # toolchain pins, and the PG* connection env.
@@ -71,6 +76,7 @@ on:
       - 'packages/protect-ffi/Cargo.lock'
       - 'packages/protect-ffi/src/**'
       - 'packages/protect-ffi/scripts/**'
+      - 'packages/protect-ffi/tsconfig.wasm-errors.json'
       - 'packages/protect-ffi/package.json'
       - 'packages/protect-ffi/mise.toml'
       - '.github/workflows/integration-protect-ffi.yml'

.github/workflows/integration-supabase.yml

@@ -51,6 +51,22 @@ on:
       - '.github/workflows/integration-supabase.yml'
       - '.github/actions/integration-setup/**'
       - '.github/actions/integration-db/**'
+      - '.github/actions/build-ffi-binding/**'
+      # The Rust that produces every EQL payload these suites round-trip.
+      # Absorbing protect-ffi put it in-tree, so a crate change can now
+      # break them in a PR that touches no TypeScript at all.
+      #
+      # The manifests are here for the same reason as the sources: a
+      # dependency bump in Cargo.lock changes the compiled encryption core
+      # without touching a .rs file, and package.json / mise.toml carry the
+      # build scripts and the toolchain pin. Matching the filter in
+      # tests-rust.yml, which already covers all four.
+      - 'packages/protect-ffi/crates/**'
+      - 'packages/protect-ffi/src/**'
+      - 'packages/protect-ffi/Cargo.toml'
+      - 'packages/protect-ffi/Cargo.lock'
+      - 'packages/protect-ffi/package.json'
+      - 'packages/protect-ffi/mise.toml'
   pull_request:
     branches: ['**']
     paths:
@@ -93,6 +109,22 @@ on:
       - '.github/workflows/integration-supabase.yml'
       - '.github/actions/integration-setup/**'
       - '.github/actions/integration-db/**'
+      - '.github/actions/build-ffi-binding/**'
+      # The Rust that produces every EQL payload these suites round-trip.
+      # Absorbing protect-ffi put it in-tree, so a crate change can now
+      # break them in a PR that touches no TypeScript at all.
+      #
+      # The manifests are here for the same reason as the sources: a
+      # dependency bump in Cargo.lock changes the compiled encryption core
+      # without touching a .rs file, and package.json / mise.toml carry the
+      # build scripts and the toolchain pin. Matching the filter in
+      # tests-rust.yml, which already covers all four.
+      - 'packages/protect-ffi/crates/**'
+      - 'packages/protect-ffi/src/**'
+      - 'packages/protect-ffi/Cargo.toml'
+      - 'packages/protect-ffi/Cargo.lock'
+      - 'packages/protect-ffi/package.json'
+      - 'packages/protect-ffi/mise.toml'
 
 jobs:
   integration:
@@ -154,8 +186,10 @@ jobs:
       - uses: ./.github/actions/integration-setup
 
       # Fast pre-flight: fail in seconds if a secret was rotated or cleared,
-      # before paying for the ~2 GB supabase/postgres pull. The in-test
-      # `requireIntegrationEnv` is the correctness guarantee; this is the cheap one.
+      # before the binding build and before paying for the ~2 GB
+      # supabase/postgres pull. The in-test `requireIntegrationEnv` is the
+      # correctness guarantee; this is the cheap one, so nothing expensive may
+      # be ordered ahead of it.
       - name: Require CipherStash secrets
         uses: ./.github/actions/require-cs-secrets
         with:
@@ -164,6 +198,11 @@ jobs:
           client-key: ${{ secrets.CS_CLIENT_KEY }}
           client-access-key: ${{ secrets.CS_CLIENT_ACCESS_KEY }}
 
+      # No `wasm: true` — this job's CS_IT_SUITE is `integration/shared/**`
+      # only, which goes through the native binding.
+      - name: Build the protect-ffi binding
+        uses: ./.github/actions/build-ffi-binding
+
       # No pre-`up` cleanup step any more: the project name is unique per job, so
       # a container leaked by a hard-killed prior run cannot hold this job's
       # name or its (ephemeral) port. Blanket-pruning would now be actively

.github/workflows/prisma-example-readme-e2e.yml

@@ -18,12 +18,40 @@ on:
     paths:
       - 'examples/prisma/**'
       - '.github/workflows/prisma-example-readme-e2e.yml'
+      # The walkthrough encrypts against the live service, so the native
+      # binding and the action that builds it are inputs to this suite. Added
+      # with that build step: without them a protect-ffi change would reach main
+      # having never run the walkthrough. They are repeated verbatim under
+      # `pull_request` below, which is what makes that a gate rather than a
+      # report — a PR touching any of these runs the walkthrough before the
+      # change lands, not after.
+      - '.github/actions/build-ffi-binding/**'
+      - 'packages/protect-ffi/crates/**'
+      - 'packages/protect-ffi/src/**'
+      - 'packages/protect-ffi/Cargo.toml'
+      - 'packages/protect-ffi/Cargo.lock'
+      - 'packages/protect-ffi/package.json'
+      - 'packages/protect-ffi/mise.toml'
   pull_request:
     branches:
       - '**'
     paths:
       - 'examples/prisma/**'
       - '.github/workflows/prisma-example-readme-e2e.yml'
+      # The same entries as under `push` above, and the copy that does the
+      # work: a PR touching the native binding or the action that builds it
+      # runs the walkthrough on the PR, so a protect-ffi change is gated by
+      # this suite rather than reaching main unexercised. (GitHub Actions has
+      # no YAML anchors, so the list is written twice;
+      # scripts/__tests__/workflow-paths-filter-parity.test.mjs compares the
+      # two copies.)
+      - '.github/actions/build-ffi-binding/**'
+      - 'packages/protect-ffi/crates/**'
+      - 'packages/protect-ffi/src/**'
+      - 'packages/protect-ffi/Cargo.toml'
+      - 'packages/protect-ffi/Cargo.lock'
+      - 'packages/protect-ffi/package.json'
+      - 'packages/protect-ffi/mise.toml'
 
 jobs:
   walkthrough:
@@ -72,6 +100,8 @@ jobs:
 
       # A missing / rotated / fork-PR-absent secret makes the walkthrough skip
       # its live steps silently, hiding regressions behind a green job. Fail loud.
+      # First, ahead of the binding build: this costs seconds and that costs
+      # minutes on a cold cache.
       - name: Require CipherStash secrets
         uses: ./.github/actions/require-cs-secrets
         with:
@@ -80,6 +110,17 @@ jobs:
           client-key: ${{ secrets.CS_CLIENT_KEY }}
           client-access-key: ${{ secrets.CS_CLIENT_ACCESS_KEY }}
 
+      # The walkthrough encrypts against the live service, so it needs the
+      # native binding — `packages/protect-ffi` is a workspace package now, so
+      # `index.node` is a build output rather than tarball contents. This step
+      # runs on push to main and on any PR whose diff matches the paths filter
+      # above, the absorption PR that introduced the need included: that PR
+      # edits this workflow, the build action, and the package itself, and all
+      # three are in the filter. The exception is a fork PR — it triggers the
+      # workflow, but the job's `if` skips it for want of CS_* credentials.
+      - name: Build the protect-ffi binding
+        uses: ./.github/actions/build-ffi-binding
+
       # Build via turbo so `^build` on `@cipherstash/stack-prisma` and
       # its `@cipherstash/stack` peer is honoured. The test's
       # `pnpm install` subprocess inside `examples/prisma/` is a no-op

.github/workflows/prisma-next-e2e.yml

@@ -18,13 +18,40 @@ on:
       - 'packages/stack-prisma/**'
       - 'examples/prisma/**'
       - '.github/workflows/prisma-next-e2e.yml'
+      # This suite encrypts against the live service, so the native binding and
+      # the action that builds it are inputs to it. Added with that build step:
+      # without them a protect-ffi change would reach main having never run this
+      # suite. They are repeated verbatim under `pull_request` below, which is
+      # what makes that a gate rather than a report — a PR touching any of these
+      # runs the suite before the change lands, not after.
+      - '.github/actions/build-ffi-binding/**'
+      - 'packages/protect-ffi/crates/**'
+      - 'packages/protect-ffi/src/**'
+      - 'packages/protect-ffi/Cargo.toml'
+      - 'packages/protect-ffi/Cargo.lock'
+      - 'packages/protect-ffi/package.json'
+      - 'packages/protect-ffi/mise.toml'
   pull_request:
     branches:
       - '**'
     paths:
       - 'packages/stack-prisma/**'
       - 'examples/prisma/**'
       - '.github/workflows/prisma-next-e2e.yml'
+      # The same entries as under `push` above, and the copy that does the
+      # work: a PR touching the native binding or the action that builds it
+      # runs this suite on the PR, so a protect-ffi change is gated by it
+      # rather than reaching main unexercised. (GitHub Actions has no YAML
+      # anchors, so the list is written twice;
+      # scripts/__tests__/workflow-paths-filter-parity.test.mjs compares the
+      # two copies.)
+      - '.github/actions/build-ffi-binding/**'
+      - 'packages/protect-ffi/crates/**'
+      - 'packages/protect-ffi/src/**'
+      - 'packages/protect-ffi/Cargo.toml'
+      - 'packages/protect-ffi/Cargo.lock'
+      - 'packages/protect-ffi/package.json'
+      - 'packages/protect-ffi/mise.toml'
 
 jobs:
   e2e:
@@ -75,6 +102,8 @@ jobs:
       # The global-setup hook hard-errors without CS_WORKSPACE_CRN, but a
       # missing sibling secret could still degrade coverage silently — assert
       # all four up front so a rotated / fork-PR-absent secret fails loudly.
+      # First, ahead of the binding build: this costs seconds and that costs
+      # minutes on a cold cache.
       - name: Require CipherStash secrets
         uses: ./.github/actions/require-cs-secrets
         with:
@@ -83,6 +112,17 @@ jobs:
           client-key: ${{ secrets.CS_CLIENT_KEY }}
           client-access-key: ${{ secrets.CS_CLIENT_ACCESS_KEY }}
 
+      # This suite encrypts against the live service, so it needs the native
+      # binding — `packages/protect-ffi` is a workspace package now, so
+      # `index.node` is a build output rather than tarball contents. This step
+      # runs on push to main and on any PR whose diff matches the paths filter
+      # above, the absorption PR that introduced the need included: that PR
+      # edits this workflow, the build action, and the package itself, and all
+      # three are in the filter. The exception is a fork PR — it triggers the
+      # workflow, but the job's `if` skips it for want of CS_* credentials.
+      - name: Build the protect-ffi binding
+        uses: ./.github/actions/build-ffi-binding
+
       # Write the CS_* credentials and the harness DATABASE_URL into the
       # example app's .env so the runtime + the `prisma-next migration
       # apply` invocation in global-setup both pick them up. The harness