You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Extract the Drizzle and Supabase integrations out of @cipherstash/stack into
their own packages, each depending on @cipherstash/stack and imported directly
— the shape @cipherstash/prisma-next already proves in production. This is
"PR3" of the original EQL v3 work plan; PR1 (the integration harness, #616) is
now merged, which is exactly the safety net this refactor wanted behind it.
stack does not re-export the new packages, so no build cycle arises.
Why now
The two adapters are currently bolted into stack, inflating its bundle. Splitting
them mirrors prisma-next and lets the adapters version independently. Doing it after the integration suite (#616) means the nine-module API promotion and the
two-package extraction land against tests that prove query correctness end to end.
Work involved
Promote the internal stack modules the adapters consume to public API.
Per the plan: Supabase needs ~six (@/encryption/helpers, @/encryption/operations/base-operation, @/eql/v3/columns, @/eql/v3/domain-registry, @/types, @/utils/logger); Drizzle v3 needs
~three (@/types, @/schema/match-defaults, @/encryption/operations/base-operation). Note @/types is the internal src/types.ts, distinct from the published ./types (types-public). Re-verify this list at implementation time — it predates refactor(stack): restore erased EQL v3 envelope + Result types #618/test(stack): federate a Clerk M2M JWT for the identity suites; wire into CI #620/feat(stack): EQL v3 JSON support — types.Json + containment #621,
which moved envelope/Result types around. If a module is judged too internal to
expose, relocate the shared piece (e.g. into @cipherstash/schema or the test
kit) rather than widening the surface.
Drop ./drizzle, ./supabase, and ./eql/v3/drizzle from stack's exports, typesVersions, and tsup.config.ts. The first two are published
subpaths; the third is not. stack is on 0.x, so a minor bump carries the break
under 0.x semver.
Move the integration suites from packages/stack/integration/{drizzle-v3,supabase}
into the new packages. Because @cipherstash/test-kit is already a workspace
package, this is a path change, not a rewrite.
Update the doc/skill references (~13 for @cipherstash/stack/drizzle, plus
the Supabase reference docs and skills/stash-supabase / skills/stash-drizzle).
These ship in the stash tarball — update in the same PR.
Complexity gate:fta-v3.yml's analyze:complexity scans src/eql/v3;
update its path filter and add an equivalent gate in stack-drizzle so the
moved code doesn't silently lose it.
Changesets for the removed subpaths (breaking) and the two new packages.
Risks / notes
Blast radius: promoting ~nine internal modules to public API + removing
three subpaths + rewriting ~15 doc references. Make the "expose vs relocate"
call per module before coding.
Two Drizzle implementations stay forked until @cipherstash/protect
sunsets: @cipherstash/drizzle@3.x (peer-deps @cipherstash/protect@12,
exports createProtectOperators) is a separate, diverged implementation from
stack's in-tree src/drizzle (createEncryptionOperators). This split does not merge them. A comment at the top of both operator files noting the fork
is worth adding.
Future (do not do now): once protect sunsets, @cipherstash/stack-drizzle
could reclaim the @cipherstash/drizzle name in a major. Don't couple this work
to that deprecation timeline.
Context: the original plan's "PR3: the adapter package split" section, and the
now-merged PR1 harness (#616) on the 1.0 candidate (#535).
Extract the Drizzle and Supabase integrations out of
@cipherstash/stackintotheir own packages, each depending on
@cipherstash/stackand imported directly— the shape
@cipherstash/prisma-nextalready proves in production. This is"PR3" of the original EQL v3 work plan; PR1 (the integration harness, #616) is
now merged, which is exactly the safety net this refactor wanted behind it.
Target shape
stack does not re-export the new packages, so no build cycle arises.
Why now
The two adapters are currently bolted into stack, inflating its bundle. Splitting
them mirrors
prisma-nextand lets the adapters version independently. Doing itafter the integration suite (#616) means the nine-module API promotion and the
two-package extraction land against tests that prove query correctness end to end.
Work involved
Per the plan: Supabase needs ~six (
@/encryption/helpers,@/encryption/operations/base-operation,@/eql/v3/columns,@/eql/v3/domain-registry,@/types,@/utils/logger); Drizzle v3 needs~three (
@/types,@/schema/match-defaults,@/encryption/operations/base-operation). Note@/typesis the internalsrc/types.ts, distinct from the published./types(types-public).Re-verify this list at implementation time — it predates refactor(stack): restore erased EQL v3 envelope + Result types #618/test(stack): federate a Clerk M2M JWT for the identity suites; wire into CI #620/feat(stack): EQL v3 JSON support — types.Json + containment #621,
which moved envelope/Result types around. If a module is judged too internal to
expose, relocate the shared piece (e.g. into
@cipherstash/schemaor the testkit) rather than widening the surface.
./drizzle,./supabase, and./eql/v3/drizzlefrom stack'sexports,typesVersions, andtsup.config.ts. The first two are publishedsubpaths; the third is not. stack is on 0.x, so a minor bump carries the break
under 0.x semver.
packages/stack/integration/{drizzle-v3,supabase}into the new packages. Because
@cipherstash/test-kitis already a workspacepackage, this is a path change, not a rewrite.
@cipherstash/stack/drizzle, plusthe Supabase reference docs and
skills/stash-supabase/skills/stash-drizzle).These ship in the
stashtarball — update in the same PR.fta-v3.yml'sanalyze:complexityscanssrc/eql/v3;update its path filter and add an equivalent gate in
stack-drizzleso themoved code doesn't silently lose it.
Risks / notes
three subpaths + rewriting ~15 doc references. Make the "expose vs relocate"
call per module before coding.
@cipherstash/protectsunsets:
@cipherstash/drizzle@3.x(peer-deps@cipherstash/protect@12,exports
createProtectOperators) is a separate, diverged implementation fromstack's in-tree
src/drizzle(createEncryptionOperators). This split doesnot merge them. A comment at the top of both operator files noting the fork
is worth adding.
@cipherstash/stack-drizzlecould reclaim the
@cipherstash/drizzlename in a major. Don't couple this workto that deprecation timeline.
Context: the original plan's "PR3: the adapter package split" section, and the
now-merged PR1 harness (#616) on the 1.0 candidate (#535).