@@ -181,9 +181,10 @@ jobs:
   # FROZEN_PUBLISHERS (an npm map), so the switch keys on the
   # `@cipherstash/auth` entry, which that PR deleted when crates.io and npm
   # trusted publishing moved here together. crates.io needs a Trusted
-  # Publishing entry for both crates naming cipherstash/stack + release-plz.yml.
+  # Publishing entry for every published crate naming cipherstash/stack +
+  # release-plz.yml.
   #
-  # Publish-only: nothing here opens a release PR, so a version bump of the two
+  # Publish-only: nothing here opens a release PR, so a version bump of these
   # crates is a hand-made pull request. `release-plz update` cannot version
   # this workspace yet: it walks back to the commit that matches crates.io
   # 0.42.3, and the imported history has no root Cargo.toml there. A
@@ -209,29 +210,28 @@ jobs:
         run: node scripts/eql-pipeline-armed.mjs crates
 
   release-crates:
-    name: "Release stack-auth and stack-profile"
+    name: "Release the stack-* crates"
     needs: [crates-armed]
     if: needs.crates-armed.outputs.armed == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
-      contents: write # the stack-auth-v<V> / stack-profile-v<V> tags and releases
+      contents: write # the <crate>-v<V> tags and releases
       pull-requests: write # release-plz links PRs in release notes
       id-token: write # crates.io Trusted Publishing
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
 
-      - name: Is either crate version unpublished?
-        # The EQL preflight's crates.io question, per crate of the version
-        # group. It decides whether the GPG import runs; an API failure reads
+      - name: Is any crate version unpublished?
+        # The EQL preflight's crates.io question, per published crate. It decides whether the GPG import runs; an API failure reads
         # as "unpublished", which fails towards importing the key.
         id: preflight
         run: |
           set -euo pipefail
           publish_needed=false
-          for crate in stack-auth stack-profile; do
+          for crate in stack-auth stack-profile stack-kms stack-encrypt stack-encrypt-derive; do
             version="$(grep -m1 '^version = ' "packages/${crate}/Cargo.toml" | cut -d'"' -f2)"
             # crates.io 403s curl's default User-Agent.
             published="$(curl -fsSL --retry 3 -H "User-Agent: cipherstash-stack-release (https://github.com/cipherstash/stack)" "https://crates.io/api/v1/crates/${crate}/versions" | jq -r '.versions[].num' | grep -Fx "$version" || true)"
 
@@ -139,6 +139,17 @@ jobs:
       - name: Build the stack-encrypt examples
         run: cargo build --locked -p stack-encrypt --examples
 
+      # The crates release-plz publishes from 0.1.0. `--dry-run` packages and
+      # compiles each the way crates.io would (the three together, so
+      # stack-encrypt resolves the other two from cargo's temporary local
+      # registry), catching a publish-blocker on the PR instead of in
+      # release-crates on main: missing metadata, or a runtime path dependency
+      # with no `version`. No token. `--allow-dirty` tolerates files earlier
+      # steps leave in the tree. Once a version is on crates.io, cargo warns
+      # rather than fails on a dry run of it.
+      - name: Verify the stack-encrypt crates package cleanly for crates.io
+        run: cargo publish --locked --dry-run --allow-dirty -p stack-kms -p stack-encrypt-derive -p stack-encrypt
+
   node-bindings:
     name: node bindings, napi typings, stack-auth-wasm
     runs-on: blacksmith-16vcpu-ubuntu-2204
 
@@ -90,7 +90,7 @@ Every npm package except EQL lives under `languages/typescript/`: packages in `l
   EQL issues in this repository, never in the historical
   `cipherstash/encrypt-query-language` repository. Old upstream issue and PR
   links are provenance only.
-- `packages/stack-auth`, `packages/stack-profile`, `packages/stack-kms`, `packages/stack-encrypt`, `packages/stack-encrypt-derive`, `packages/stack-guest-abi`: The Rust crates imported from `cipherstash/cipherstash-suite` with their history — `stack-auth` and `stack-profile` (published to crates.io), and `stack-kms`, `stack-encrypt`, `stack-encrypt-derive` and `stack-guest-abi` (`publish = false`). They are the members of the **root Cargo workspace**, with the three node binding crates below. See "Working on the Rust crates".
+- `packages/stack-auth`, `packages/stack-profile`, `packages/stack-kms`, `packages/stack-encrypt`, `packages/stack-encrypt-derive`, `packages/stack-guest-abi`: The Rust crates imported from `cipherstash/cipherstash-suite` with their history — `stack-auth` and `stack-profile` (published to crates.io, one version group), `stack-kms` (published to crates.io from 0.1.0, its own version group, re-exported by `stack-encrypt` as `stack_encrypt::kms`), `stack-encrypt` and `stack-encrypt-derive` (published to crates.io from 0.1.0, one version group; `eql-bindings`' `stack-encrypt` feature depends on them from the registry), and `stack-guest-abi` (`publish = false`). They are the members of the **root Cargo workspace**, with the three node binding crates below. See "Working on the Rust crates".
 - `languages/typescript/packages/auth`, `languages/typescript/packages/profile`, `languages/typescript/packages/stack-auth-wasm`: The node bindings of those crates. `@cipherstash/auth` (napi-rs v2) and its six `platforms/*` packages are published to npm from this repository by `release.yml` (`auth-artifacts`, `publish-auth`); a change to what it ships, the `stack-auth` crate included, needs an `@cipherstash/auth` changeset (`require-auth-npm-changeset.yml`). `@cipherstash/profile` and its platforms are private and never published; `@cipherstash/stack-auth-wasm` is private and builds the wasm that `@cipherstash/auth` ships. Their `build` and `test` scripts never invoke cargo; `build:native`, `build:debug` and `test:cargo` do.
 - `languages/golang`: The Go module (`stackencrypt`, `stackauth`, `internal`), a wazero host with no cgo. Its two WASI guests (`*/guest`) are detached Cargo workspaces built by `mise run wasm:guest:build` and `mise run wasm:auth-guest:build`; the `.wasm` files they embed are gitignored. There is no Go release process yet.
 - `e2e/*`: Cross-package end-to-end tests (package managers, supply chain, Prisma example README)
 
@@ -33,7 +33,8 @@ exclude = [
 
 [workspace.package]
 # Used by the node binding crates, which take `version.workspace`. The
-# published crates (stack-auth, stack-profile) carry their own version.
+# published crates (stack-auth, stack-profile, stack-kms, stack-encrypt,
+# stack-encrypt-derive) carry their own version.
 version = "0.35.0"
 edition = "2021"
 authors = [
@@ -62,8 +63,8 @@ lto = true   # same as "fat"
 incremental = true
 
 [workspace.dependencies]
-# The two published crates of this workspace. Members take them with
-# `workspace = true`.
+# stack-auth and stack-profile, two of this workspace's published crates.
+# Members take them with `workspace = true`.
 # `default-features = false`: a member can add features to a workspace dep
 # but cannot subtract them, and `stack-kms` / `stack-encrypt` need stack-auth
 # without `http`. Consumers that want the default transport re-enable it with
 
@@ -28,19 +28,30 @@ This repository also carries the source of the **`eql-bindings`** Rust crate
 lockstep with `@cipherstash/eql`. It is in scope for security reports on the
 same terms as the npm packages above.
 
-It also carries the source of two Rust crates published to crates.io,
+It also carries the source of five Rust crates published to crates.io,
 **`stack-auth`** and **`stack-profile`** (`packages/stack-auth`,
-`packages/stack-profile`), and of the **Go module** at `languages/golang`
-(`stackencrypt` and `stackauth`, over WASI guests built from the stack-*
-crates), which has no release yet. All three are in scope for security reports
-on the same terms as the npm packages above.
+`packages/stack-profile`) and **`stack-kms`**, **`stack-encrypt`** and
+**`stack-encrypt-derive`** (`packages/stack-kms`, `packages/stack-encrypt`,
+`packages/stack-encrypt-derive`), and of the **Go module** at
+`languages/golang` (`stackencrypt` and `stackauth`, over WASI guests built
+from the stack-* crates), which has no release yet. All of these are in scope
+for security reports on the same terms as the npm packages above.
+
+The five stack-* crates are licensed under the PolyForm Internal Use License
+1.0.0 (each crate's `LICENSE`), not the repository's MIT licence: they may be
+used for internal business operations only, and not redistributed. That
+includes the optional `stack-encrypt` feature of the MIT-licensed
+`eql-bindings` crate, which depends on `stack-encrypt` and so is usable only
+under the same terms.
 
 > **Note on publishing.** Every package in the table above, including all
 > seven `@cipherstash/protect-ffi*` packages, all seven `@cipherstash/auth*`
 > packages and `@cipherstash/eql`, is published from this repository by
-> `.github/workflows/release.yml`; the `eql-bindings`, `stack-auth` and
-> `stack-profile` crates are published from here by
-> `.github/workflows/release-plz.yml`. EQL moved here at the Phase 5 cutover in
+> `.github/workflows/release.yml`; the `eql-bindings`, `stack-auth`,
+> `stack-profile`, `stack-kms`, `stack-encrypt` and `stack-encrypt-derive`
+> crates are published from here by `.github/workflows/release-plz.yml` (the
+> first version of each of the last three was published by hand, because
+> crates.io configures Trusted Publishing on an existing crate). EQL moved here at the Phase 5 cutover in
 > `docs/plans/2026-08-13-eql-monorepo-absorption.md`, and the auth packages and
 > the two crates at the arming PR of the stack-* crates import. Releases made
 > before those moves were built elsewhere: `@cipherstash/eql@3.0.5` and earlier
@@ -168,8 +179,9 @@ CI. See `skills/stash-supply-chain-security/SKILL.md` for the full guide.
 The `release.yml` workflow publishes packages to npm using OIDC trusted
 publishing (`id-token: write`). There is no long-lived `NPM_TOKEN` — the
 workflow deliberately avoids one, and setting one would bypass trusted
-publishing. `release-plz.yml` publishes the `eql-bindings` crate to crates.io
-over the same token exchange, and likewise carries no `CARGO_REGISTRY_TOKEN`.
+publishing. `release-plz.yml` publishes the `eql-bindings` crate and the stack-* crates to
+crates.io over the same token exchange, and likewise carries no
+`CARGO_REGISTRY_TOKEN`.
 Both bind to a *workflow filename* at the registry, so renaming either file
 silently invalidates its publisher configuration.
 
 
@@ -9,9 +9,9 @@ homepage.workspace = true
 keywords.workspace = true
 categories.workspace = true
 license-file = "LICENSE"
-# Not yet released, like stack-encrypt (which is the only crate that should
-# depend on this one: the macros are re-exported from there).
-publish = false
+# Published to crates.io by release-plz.yml, in the `stack-encrypt` version
+# group: stack-encrypt is the only crate that should depend on this one (the
+# macros are re-exported from there), and the two release together.
 
 [lib]
 proc-macro = true
@@ -24,12 +24,13 @@ syn = { version = "3", features = ["full", "extra-traits"] }
 # The dev-dependencies below are used only by the crate-level doctests.
 # `cargo-udeps` cannot see into rustdoc, so it reports them as unused.
 [package.metadata.cargo-udeps.ignore]
-development = ["stack-encrypt", "stack-kms", "tokio"]
+development = ["stack-encrypt", "tokio"]
 
 [dev-dependencies]
 # The crate-level examples are real doctests, run against the fake key
 # source. A dev-dependency cycle back to `stack-encrypt` is the usual shape
-# for a derive crate (cf. serde_derive -> serde).
-stack-encrypt = { path = "../stack-encrypt" }
-stack-kms = { path = "../stack-kms", features = ["test-support"] }
+# for a derive crate (cf. serde_derive -> serde). The fake key source comes
+# through stack-encrypt's `test-support` feature, as a user's tests take it, so
+# these doctests are what exercises that forwarding.
+stack-encrypt = { path = "../stack-encrypt", features = ["test-support"] }
 tokio = { workspace = true, features = ["rt", "macros"] }
@@ -6,7 +6,7 @@
 //! ```
 //! use stack_encrypt::{EncryptFrom, DecryptInto, StackCipher, StackCipherText, nonempty};
 //! use stack_encrypt::sem::EqualityTerm;
-//! use stack_kms::FakeDataKeySource;
+//! use stack_encrypt::kms::FakeDataKeySource;
 //!
 //! #[derive(EncryptFrom, DecryptInto)]
 //! #[stash(plaintext = String)]
@@ -63,7 +63,7 @@
 //!     CipherText, Decryptable, Encrypt, EncryptFrom, Encryption, Error, SealedValue, StackCipher,
 //!     nonempty,
 //! };
-//! use stack_kms::FakeDataKeySource;
+//! use stack_encrypt::kms::FakeDataKeySource;
 //!
 //! /// A column that stores one sealed leaf as bytes.
 //! struct LeafBytes(Vec<u8>);
 
@@ -9,21 +9,20 @@ homepage.workspace = true
 keywords.workspace = true
 categories.workspace = true
 license-file = "LICENSE"
-# Not yet released: keep release-plz from picking this crate up (it processes
-# any workspace crate whose Cargo.toml lacks `publish = false`).
-publish = false
+# Published to crates.io by release-plz.yml; release-plz.toml puts it in the
+# `stack-encrypt` version group.
 
 [dependencies]
 # `profile` (native only; stack-kms gates it off wasm32 itself) lets
 # `StackCipher::new()` fall back to the client key `stash auth login` writes
 # to the profile directory (`secretkey.json`) when CS_CLIENT_ID /
 # CS_CLIENT_KEY are not set — the same place `AutoStrategy` finds the token.
-stack-kms = { path = "../stack-kms", default-features = false, features = ["profile"] }
+stack-kms = { path = "../stack-kms", version = "0.1.0", default-features = false, features = ["profile"] }
 # `StackCipher::new()` builds a ZeroKMS client from the environment, so its
 # return type names the auto-detected auth strategy. Only needed with `http`.
 stack-auth = { workspace = true, optional = true }
 # `#[derive(EncryptFrom)]` / `#[derive(DecryptInto)]`, re-exported from `target`.
-stack-encrypt-derive = { path = "../stack-encrypt-derive" }
+stack-encrypt-derive = { path = "../stack-encrypt-derive", version = "0.1.0" }
 
 # The workspace vitaminc (0.5.0): one canonical context encoding shared by
 # the AEAD and PRF derivations (`IntoContext`, cipherstash/vitaminc#339),
@@ -58,6 +57,10 @@ http = ["dep:stack-auth", "stack-auth/http", "stack-kms/http"]
 # only at runtime, as an FFI binding's are. Off by default — it is only of
 # use to a binding author, and it pulls `vitaminc-aead-value` in.
 dynamic = ["dep:vitaminc-aead-value"]
+# `stack_encrypt::kms::FakeDataKeySource`: the in-memory key source for tests
+# with no ZeroKMS, so a caller's dev-dependency on stack-encrypt is enough and
+# no direct stack-kms dependency has to agree with this crate's.
+test-support = ["stack-kms/test-support"]
 
 [dev-dependencies]
 serde_json = { workspace = true }
 
@@ -14,8 +14,8 @@
 //! anywhere, and CI builds it either way.
 
 use stack_auth::{AuthError, AuthStrategyFn, SecretToken, ServiceToken};
+use stack_encrypt::kms::{EnvKeyProvider, StackKmsBuilder};
 use stack_encrypt::StackCipher;
-use stack_kms::{EnvKeyProvider, StackKmsBuilder};
 
 #[tokio::main(flavor = "current_thread")]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {