chore(release): stack-auth and stack-profile 0.43.0

The first crates release from this repository, bumped by hand:
release-plz cannot version the root workspace yet, because its history
walks back to the suite's 0.42.3 release commit, which has no root
Cargo.toml here.

Both `[package]` versions and their two root `[workspace.dependencies]`
entries move to 0.43.0. The root Cargo.lock and the five detached locks
(the two Go guests and the three fuzz crates) each record the two path
packages, so each fails `cargo metadata --locked` until refreshed; each
lock changes those two versions only.

0.43.0 because three commits since 0.42.3 break stack-auth's API:
085b7f7 (`RequestError` boxes its error), 856f34b
(`DeviceClientError::Request` carries a `RequestError`) and 505eb4e
(`From<reqwest::Error> for AuthError` is gone). It also moves to
cts-common 0.43, whose `Crn` this crate re-exports. stack-profile has no
breaking change and follows the version group. Both CHANGELOG entries
are written by hand in cliff.toml's layout.

Merging this is the release: release-plz.yml's release-crates job is
armed, sees 0.43.0 missing from crates.io, and publishes both.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PaY5xYydZUWhv8Nex9Sw8a

Author: auxesis

Cargo.lock

@@ -68,8 +68,8 @@ incremental = true
 # but cannot subtract them, and `stack-kms` / `stack-encrypt` need stack-auth
 # without `http`. Consumers that want the default transport re-enable it with
 # `features = ["http"]`.
-stack-auth = { path = "./packages/stack-auth", version = "0.42.3", default-features = false }
-stack-profile = { path = "./packages/stack-profile", version = "0.42.3" }
+stack-auth = { path = "./packages/stack-auth", version = "0.43.0", default-features = false }
+stack-profile = { path = "./packages/stack-profile", version = "0.43.0" }
 
 # Suite crates, from crates.io; Cargo.lock holds the exact versions.
 # cts-common and zerokms-protocol take caret requirements because the

Cargo.toml

@@ -1,4 +1,58 @@
 
+## [0.43.0] - 2026-10-02
+
+
+### ⚠ Breaking changes
+
+- `RequestError`'s tuple payload is now `Box<dyn std::error::Error + Send + Sync + 'static>` instead of `reqwest::Error`. Construct it with `RequestError::from(reqwest_error)` (or box the error yourself) instead of `RequestError(reqwest_error)`, and recover the concrete error with `.0.downcast_ref::<reqwest::Error>()` instead of using `.0` as a `reqwest::Error` directly. `source()` is unchanged; the `Display` message is now "Request to the auth server failed" (it was "HTTP request failed").
+- `DeviceClientError::Request` now carries a `RequestError` rather than a `reqwest::Error`; a match on that variant's payload changes type.
+- `From<reqwest::Error> for AuthError` is removed. Every reqwest failure enters the crate through `ReqwestTransport` as a `RequestError`; a caller that lifted a `reqwest::Error` into `AuthError` directly should wrap it in `RequestError` (`AuthError::Request(RequestError(Box::new(e)))`) or, better, send through the transport.
+- Depends on `cts-common` 0.43 (vitaminc 0.5) and `zerokms-protocol` 0.12.31, from crates.io. `Crn` (re-exported here), `Region`, `WorkspaceId` and the `cts-common` errors in this crate's API are `cts-common` 0.43 types, so a caller that passes them in needs `cts-common` 0.43 too.
+
+### CI
+
+- mutation-testing gate for stack-auth and stack-encrypt (cargo-mutants --in-diff)
+
+### Documentation
+
+- correct stale StaticTokenStrategy comments in Cargo manifests
+
+### Features
+
+- build stack-auth, stack-kms and stack-encrypt for WASI without reqwest
+- classify credential rejections where the variants live
+- a workspace CRN is reachable without reaching for cts-common
+- an HTTP transport trait mirroring the guest's host import, reqwest behind `http`
+- add Go credential strategies
+
+### Fixes
+
+- address review findings on the http feature split
+- address Copilot review on error Display strings
+- test modules keep a literal `cfg(test)` so the CRAP gate skips them; add the npm changeset
+- the wire types print nothing secret, wipe their headers, and lend reqwest the body
+- satisfy credential guest CI
+- lock only device refresh
+- never replay a spent refresh token after a failed save
+- identify every auth request with a user-agent
+
+### Miscellaneous
+
+- per-crate rustdoc gates for the stack crates, fanned out by `doc`
+- move to cipherstash/stack with its history: the first release from that repository's `release-plz.yml`, in a version group with stack-profile alone
+
+### Refactoring
+
+- replace crate-wide no-http allow(dead_code) with item-level http gates
+
+### Testing
+
+- pin mutation regression behavior
+- cover remaining mutation paths
+- address PR review findings
+- keep browser launcher mutable
+- address review notes on assertion messages
+
 ## [0.42.3] - 2026-08-26
 
 

languages/golang/stackauth/guest/Cargo.lock

@@ -1,7 +1,7 @@
 [package]
 name = "stack-auth"
 description = "Authentication library for CipherStash services"
-version = "0.42.3"
+version = "0.43.0"
 edition.workspace = true
 authors.workspace = true
 repository.workspace = true

languages/golang/stackencrypt/guest/Cargo.lock

@@ -37,6 +37,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 
 
+## [0.43.0] - 2026-10-02
+
+
+### Features
+
+- the crate builds for wasm32-wasip1, and names the lock file's path
+
+### Miscellaneous
+
+- per-crate rustdoc gates for the stack crates, fanned out by `doc`
+- move to cipherstash/stack with its history: the first release from that repository's `release-plz.yml`, in a version group with stack-auth alone. No change to the API; the version follows stack-auth's breaking release
+
 ## [0.42.3] - 2026-08-26