feat!: remove EQL v2-only published packages (protect, schema, protect-dynamodb)#760
Open
tobyhede wants to merge 1 commit into
Open
feat!: remove EQL v2-only published packages (protect, schema, protect-dynamodb)#760tobyhede wants to merge 1 commit into
tobyhede wants to merge 1 commit into
Conversation
…t-dynamodb) PR 1 of the EQL v2 final removal (#707). Delete the closed v2-only dependency chain — @cipherstash/protect-dynamodb → @cipherstash/protect → @cipherstash/schema — and every reference to it. Nothing outside the three imported them (@cipherstash/stack depends only on the separate @cipherstash/protect-ffi). They are superseded by @cipherstash/stack: - @cipherstash/protect -> @cipherstash/stack - @cipherstash/schema -> @cipherstash/stack/schema - @cipherstash/protect-dynamodb -> @cipherstash/stack/dynamodb (encryptedDynamoDB) Existing EQL v2 ciphertext stays decryptable through @cipherstash/stack; this removes the v2 authoring/emission surface, not the read path. Reference cleanup (dangling refs that would break build/CI): - e2e/package.json @cipherstash/protect dep edge - root package.json build:js turbo filter - tests.yml protect/protect-dynamodb .env steps (would fail `touch` on gone dirs) and the bun-job test loop - rebuild-docs.yml trigger tag (@cipherstash/protect@* -> @cipherstash/stack@*) - integration-{drizzle,prisma-next,supabase}.yml packages/schema/** path filters - lint-no-hardcoded-runners allowlist entry - e2e package-managers BIN fixture (dead) + two stale source comments Changeset / RC housekeeping: - delete schema-stevec-standard-pin.md (only target was the deleted schema) - prune the three from pre.json initialVersions - add deletion-notice changeset on @cipherstash/stack + @cipherstash/nextjs Meta honesty: SECURITY.md package list, AGENTS.md Repository Layout, nextjs package description.
🦋 Changeset detectedLatest commit: 994e5b2 The changes in this PR will be included in the next version bump. This PR includes changesets to release 12 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThe EQL v2-only ChangesEQL v2 package removal
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/plans/2026-07-22-eql-v2-removal-pr1-plan.md`:
- Around line 49-54: Update the release plan’s “remove-eql-v2-packages.md”
changeset entry to match the actual changeset targets: include the
`@cipherstash/nextjs` patch and its release rationale, or remove that package from
the changeset if the patch is unintended.
- Around line 69-70: Update the stale-reference verification command in the plan
so the `@cipherstash/protect` pattern matches only the exact package name, using
an explicit boundary that excludes packages such as `@cipherstash/protect-ffi`
while preserving the checks for `@cipherstash/schema` and
`@cipherstash/protect-dynamodb`.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 4270a939-b919-4732-b81d-3a3b9cdafa64
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (100)
.changeset/pre.json.changeset/remove-eql-v2-packages.md.changeset/schema-stevec-standard-pin.md.github/workflows/integration-drizzle.yml.github/workflows/integration-prisma-next.yml.github/workflows/integration-supabase.yml.github/workflows/rebuild-docs.yml.github/workflows/tests.ymlAGENTS.mdSECURITY.mddocs/plans/2026-07-22-eql-v2-removal-pr1-plan.mde2e/package.jsone2e/tests/package-managers.e2e.test.tspackage.jsonpackages/nextjs/package.jsonpackages/protect-dynamodb/.npmignorepackages/protect-dynamodb/CHANGELOG.mdpackages/protect-dynamodb/README.mdpackages/protect-dynamodb/__tests__/audit.test.tspackages/protect-dynamodb/__tests__/dynamodb.test.tspackages/protect-dynamodb/__tests__/error-codes.test.tspackages/protect-dynamodb/__tests__/helpers.test.tspackages/protect-dynamodb/package.jsonpackages/protect-dynamodb/src/helpers.tspackages/protect-dynamodb/src/index.tspackages/protect-dynamodb/src/operations/base-operation.tspackages/protect-dynamodb/src/operations/bulk-decrypt-models.tspackages/protect-dynamodb/src/operations/bulk-encrypt-models.tspackages/protect-dynamodb/src/operations/decrypt-model.tspackages/protect-dynamodb/src/operations/encrypt-model.tspackages/protect-dynamodb/src/operations/search-terms.tspackages/protect-dynamodb/src/types.tspackages/protect-dynamodb/tsconfig.jsonpackages/protect-dynamodb/tsup.config.tspackages/protect/.npmignorepackages/protect/CHANGELOG.mdpackages/protect/README.mdpackages/protect/__tests__/audit.test.tspackages/protect/__tests__/basic-protect.test.tspackages/protect/__tests__/bulk-protect.test.tspackages/protect/__tests__/deprecated/search-terms.test.tspackages/protect/__tests__/encrypt-query-searchable-json.test.tspackages/protect/__tests__/encrypt-query-stevec.test.tspackages/protect/__tests__/encrypt-query.test.tspackages/protect/__tests__/error-codes.test.tspackages/protect/__tests__/fixtures/index.tspackages/protect/__tests__/helpers.test.tspackages/protect/__tests__/infer-index-type.test.tspackages/protect/__tests__/json-protect.test.tspackages/protect/__tests__/jsonb-helpers.test.tspackages/protect/__tests__/k-discriminator.test.tspackages/protect/__tests__/keysets.test.tspackages/protect/__tests__/lock-context.test.tspackages/protect/__tests__/nested-models.test.tspackages/protect/__tests__/number-protect.test.tspackages/protect/__tests__/protect-ops.test.tspackages/protect/__tests__/searchable-json-pg.test.tspackages/protect/__tests__/supabase.test.tspackages/protect/package.jsonpackages/protect/src/bin/runner.tspackages/protect/src/bin/stash.tspackages/protect/src/client.tspackages/protect/src/ffi/helpers/error-code.tspackages/protect/src/ffi/helpers/infer-index-type.tspackages/protect/src/ffi/helpers/type-guards.tspackages/protect/src/ffi/helpers/validation.tspackages/protect/src/ffi/index.tspackages/protect/src/ffi/model-helpers.tspackages/protect/src/ffi/operations/base-operation.tspackages/protect/src/ffi/operations/batch-encrypt-query.tspackages/protect/src/ffi/operations/bulk-decrypt-models.tspackages/protect/src/ffi/operations/bulk-decrypt.tspackages/protect/src/ffi/operations/bulk-encrypt-models.tspackages/protect/src/ffi/operations/bulk-encrypt.tspackages/protect/src/ffi/operations/decrypt-model.tspackages/protect/src/ffi/operations/decrypt.tspackages/protect/src/ffi/operations/deprecated/search-terms.tspackages/protect/src/ffi/operations/encrypt-model.tspackages/protect/src/ffi/operations/encrypt-query.tspackages/protect/src/ffi/operations/encrypt.tspackages/protect/src/helpers/index.tspackages/protect/src/helpers/jsonb.tspackages/protect/src/identify/index.tspackages/protect/src/index.tspackages/protect/src/stash/index.tspackages/protect/src/types.tspackages/protect/tsconfig.jsonpackages/protect/tsup.config.tspackages/schema/.npmignorepackages/schema/CHANGELOG.mdpackages/schema/README.mdpackages/schema/__tests__/schema.test.tspackages/schema/__tests__/searchable-json.test.tspackages/schema/package.jsonpackages/schema/src/index.tspackages/schema/tsconfig.jsonpackages/schema/tsup.config.tspackages/stack/src/encryption/helpers/index.tspackages/stack/src/wasm-inline.tsscripts/lint-no-hardcoded-runners.mjs
💤 Files with no reviewable changes (73)
- packages/protect-dynamodb/.npmignore
- packages/protect/src/ffi/helpers/type-guards.ts
- packages/protect-dynamodb/README.md
- packages/protect/tests/basic-protect.test.ts
- packages/protect/tests/protect-ops.test.ts
- packages/protect/src/ffi/operations/bulk-encrypt-models.ts
- packages/protect/src/client.ts
- packages/protect/tests/nested-models.test.ts
- packages/protect/CHANGELOG.md
- e2e/package.json
- packages/protect/.npmignore
- packages/protect/tests/audit.test.ts
- packages/protect-dynamodb/src/operations/search-terms.ts
- packages/protect-dynamodb/tests/audit.test.ts
- packages/protect/tests/deprecated/search-terms.test.ts
- packages/protect/tests/keysets.test.ts
- packages/protect/tests/infer-index-type.test.ts
- packages/protect-dynamodb/tests/error-codes.test.ts
- packages/protect-dynamodb/tsconfig.json
- packages/protect/src/ffi/operations/base-operation.ts
- packages/protect/src/ffi/helpers/infer-index-type.ts
- packages/protect-dynamodb/src/operations/encrypt-model.ts
- packages/protect/tests/jsonb-helpers.test.ts
- packages/protect/src/ffi/operations/encrypt-model.ts
- packages/protect-dynamodb/CHANGELOG.md
- packages/protect-dynamodb/tsup.config.ts
- packages/protect/tests/number-protect.test.ts
- packages/protect/tests/k-discriminator.test.ts
- packages/protect/tests/helpers.test.ts
- packages/protect/tests/encrypt-query.test.ts
- packages/protect/src/ffi/operations/encrypt.ts
- packages/protect/src/ffi/helpers/error-code.ts
- packages/protect/src/bin/stash.ts
- packages/protect/tests/searchable-json-pg.test.ts
- packages/protect-dynamodb/src/operations/base-operation.ts
- packages/protect/tests/encrypt-query-searchable-json.test.ts
- packages/protect-dynamodb/package.json
- packages/protect/tests/lock-context.test.ts
- packages/protect/src/ffi/operations/batch-encrypt-query.ts
- packages/protect/src/ffi/operations/decrypt.ts
- packages/protect/src/bin/runner.ts
- packages/protect/tests/supabase.test.ts
- packages/protect/tests/bulk-protect.test.ts
- packages/protect-dynamodb/src/operations/bulk-encrypt-models.ts
- packages/protect-dynamodb/src/index.ts
- packages/protect-dynamodb/src/types.ts
- packages/protect/tests/json-protect.test.ts
- packages/protect-dynamodb/src/operations/bulk-decrypt-models.ts
- packages/protect-dynamodb/src/operations/decrypt-model.ts
- packages/protect/src/ffi/operations/bulk-encrypt.ts
- .changeset/pre.json
- packages/protect/tests/error-codes.test.ts
- .github/workflows/integration-prisma-next.yml
- packages/protect/src/ffi/index.ts
- packages/protect-dynamodb/tests/dynamodb.test.ts
- packages/protect/src/ffi/operations/decrypt-model.ts
- packages/protect/src/ffi/operations/deprecated/search-terms.ts
- packages/protect/tests/encrypt-query-stevec.test.ts
- scripts/lint-no-hardcoded-runners.mjs
- packages/protect/src/ffi/operations/bulk-decrypt.ts
- packages/protect/tests/fixtures/index.ts
- .changeset/schema-stevec-standard-pin.md
- packages/protect/src/ffi/model-helpers.ts
- SECURITY.md
- .github/workflows/integration-drizzle.yml
- packages/protect/src/ffi/operations/bulk-decrypt-models.ts
- packages/protect/src/ffi/operations/encrypt-query.ts
- packages/protect/package.json
- packages/protect/src/ffi/helpers/validation.ts
- .github/workflows/integration-supabase.yml
- packages/protect/README.md
- packages/protect-dynamodb/src/helpers.ts
- packages/protect-dynamodb/tests/helpers.test.ts
Comment on lines
+49
to
+54
| - Add deletion-notice changeset `.changeset/remove-eql-v2-packages.md`: | ||
| `'@cipherstash/stack': patch` (successor surface for all three; group already major via | ||
| `stack-1-0-0-rc`), prose body naming each removed package and its migration path | ||
| (`@cipherstash/protect` → `@cipherstash/stack`; `@cipherstash/schema` → `@cipherstash/stack/schema`; | ||
| `@cipherstash/protect-dynamodb` → `@cipherstash/stack/dynamodb` `encryptedDynamoDB`). | ||
| Follows the `remove-legacy-drizzle-package.md` precedent. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Keep the release plan’s changeset targets in sync.
The actual changeset also patches @cipherstash/nextjs, but this plan lists only @cipherstash/stack. Add the Next.js release rationale here, or remove it from the changeset if that patch is unintended.
Proposed documentation update
- `'`@cipherstash/stack`': patch` (successor surface for all three; group already major via
+ `'`@cipherstash/stack`': patch` and `'`@cipherstash/nextjs`': patch` (the latter reflects
+ the package metadata update; stack is the successor surface for all three; group already major via📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - Add deletion-notice changeset `.changeset/remove-eql-v2-packages.md`: | |
| `'@cipherstash/stack': patch` (successor surface for all three; group already major via | |
| `stack-1-0-0-rc`), prose body naming each removed package and its migration path | |
| (`@cipherstash/protect` → `@cipherstash/stack`; `@cipherstash/schema` → `@cipherstash/stack/schema`; | |
| `@cipherstash/protect-dynamodb` → `@cipherstash/stack/dynamodb` `encryptedDynamoDB`). | |
| Follows the `remove-legacy-drizzle-package.md` precedent. | |
| - Add deletion-notice changeset `.changeset/remove-eql-v2-packages.md`: | |
| - `'`@cipherstash/stack`': patch` (successor surface for all three; group already major via | |
| - `stack-1-0-0-rc`), prose body naming each removed package and its migration path | |
| - (`@cipherstash/protect` → `@cipherstash/stack`; `@cipherstash/schema` → `@cipherstash/stack/schema`; | |
| - `@cipherstash/protect-dynamodb` → `@cipherstash/stack/dynamodb` `encryptedDynamoDB`). | |
| Add deletion-notice changeset `.changeset/remove-eql-v2-packages.md`: | |
| `'`@cipherstash/stack`': patch` and `'`@cipherstash/nextjs`': patch` (the latter reflects | |
| the package metadata update; stack is the successor surface for all three; group already major via | |
| `stack-1-0-0-rc`), prose body naming each removed package and its migration path | |
| (`@cipherstash/protect` → `@cipherstash/stack`; `@cipherstash/schema` → `@cipherstash/stack/schema`; | |
| `@cipherstash/protect-dynamodb` → `@cipherstash/stack/dynamodb` `encryptedDynamoDB`). | |
| Follows the `remove-legacy-drizzle-package.md` precedent. |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/plans/2026-07-22-eql-v2-removal-pr1-plan.md` around lines 49 - 54,
Update the release plan’s “remove-eql-v2-packages.md” changeset entry to match
the actual changeset targets: include the `@cipherstash/nextjs` patch and its
release rationale, or remove that package from the changeset if the patch is
unintended.
Comment on lines
+69
to
+70
| - `git grep -n "@cipherstash/protect\b\|@cipherstash/schema\|@cipherstash/protect-dynamodb"` — | ||
| only intentional survivors (e.g. migration-path prose, `protect-ffi` which is unrelated). |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Make the stale-reference check match package names exactly.
Line 69’s @cipherstash/protect\b also matches the prefix of @cipherstash/protect-ffi, so the verification command reports the unrelated package as stale. Use an explicit package-name boundary.
Proposed verification command
- git grep -n "`@cipherstash/protect`\b\|`@cipherstash/schema`\|`@cipherstash/protect-dynamodb`"
+ git grep -n -E '`@cipherstash/`(protect-dynamodb|protect|schema)([^[:alnum:]_-]|$)'📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - `git grep -n "@cipherstash/protect\b\|@cipherstash/schema\|@cipherstash/protect-dynamodb"` — | |
| only intentional survivors (e.g. migration-path prose, `protect-ffi` which is unrelated). | |
| - `git grep -n -E '`@cipherstash/`(protect-dynamodb|protect|schema)([^[:alnum:]_-]|$)'` — | |
| only intentional survivors (e.g. migration-path prose, `protect-ffi` which is unrelated). |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/plans/2026-07-22-eql-v2-removal-pr1-plan.md` around lines 69 - 70,
Update the stale-reference verification command in the plan so the
`@cipherstash/protect` pattern matches only the exact package name, using an
explicit boundary that excludes packages such as `@cipherstash/protect-ffi` while
preserving the checks for `@cipherstash/schema` and `@cipherstash/protect-dynamodb`.
tobyhede
force-pushed
the
worktree-feat+remove-eql-v2-pr1-delete-packages
branch
from
July 22, 2026 08:11
27a0915 to
994e5b2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
PR 1 of the EQL v2 final removal. Deletes the closed v2-only published dependency chain and removes every reference so the build, lockfile, and changeset state stay consistent:
@cipherstash/protect-dynamodb→ superseded by@cipherstash/stack/dynamodb(encryptedDynamoDB)@cipherstash/protect→ superseded by@cipherstash/stack(carries the encryption client directly)@cipherstash/schema→ superseded by@cipherstash/stack/schemaThe three formed a closed chain (
protect-dynamodb→protect→schema); nothing outside them imports them, and@cipherstash/stackdepends only on the external@cipherstash/protect-ffi, not on any of the three.~22k lines deleted across 100 files (packages, tests, READMEs, CHANGELOGs, workflow
.envsetup steps, lockfile entries).Compatibility
@cipherstash/stack— this removes the v2 authoring/emission surface, not the read path.Changeset
@cipherstash/stackpatch +@cipherstash/nextjspatch (see.changeset/remove-eql-v2-packages.md). Also cleans pending changeset state that referenced the removed packages (schema-stevec-standard-pin.md,pre.jsoninitialVersions).Review notes
CodeRabbit surfaced one pre-existing item: the experimental "Run Tests (Bun)" job suppresses failures (
|| true+continue-on-error: true). This PR only trimmed the deleted packages from that job's loop; the suppression predates it (a200e2ba) and is intentional for the experimental job. Left as-is — out of scope here.Plan:
docs/plans/2026-07-22-eql-v2-removal-pr1-plan.md🤖 Generated with Claude Code
Summary by CodeRabbit
Breaking Changes
@cipherstash/stackand its schema/DynamoDB integrations.Compatibility
@cipherstash/stack.Documentation