Version Packages (rc)

Author: github-actions[bot]

.changeset/pre.json

@@ -24,6 +24,7 @@
   "changesets": [
     "adapter-package-split",
     "adapter-split-skills",
+    "cli-anonymous-telemetry",
     "cli-eql-v3-single-bundle",
     "eql-v3-adapter-type-robustness",
     "eql-v3-bigint-domains",
@@ -34,6 +35,7 @@
     "eql-v3-drizzle",
     "eql-v3-ffi-0-28-concrete-types",
     "eql-v3-ga-rebaseline",
+    "eql-v3-json-selector",
     "eql-v3-json-skills",
     "eql-v3-json",
     "eql-v3-public-domains",
@@ -58,7 +60,9 @@
     "supabase-in-list-operands",
     "supabase-is-null-operands",
     "supabase-or-string-parser",
+    "supabase-v3-json-querying",
     "supabase-v3-order-by-ope-term",
-    "wizard-allow-env-templates"
+    "wizard-allow-env-templates",
+    "wizard-analytics-privacy"
   ]
 }

e2e/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @cipherstash/e2e
 
+## 0.0.3-rc.1
+
+### Patch Changes
+
+- Updated dependencies [134fd43]
+- Updated dependencies [59b994e]
+- Updated dependencies [5fe9a2f]
+- Updated dependencies [d8e0c1d]
+  - stash@1.0.0-rc.1
+  - @cipherstash/stack@1.0.0-rc.1
+  - @cipherstash/wizard@0.5.0-rc.1
+
 ## 0.0.3-rc.0
 
 ### Patch Changes

e2e/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/e2e",
-  "version": "0.0.3-rc.0",
+  "version": "0.0.3-rc.1",
   "private": true,
   "description": "End-to-end tests that exercise built CipherStash binaries and cross-package behaviour.",
   "type": "module",

examples/basic/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @cipherstash/basic-example
 
+## 1.2.14-rc.1
+
+### Patch Changes
+
+- Updated dependencies [59b994e]
+- Updated dependencies [5fe9a2f]
+  - @cipherstash/stack-drizzle@1.0.0-rc.1
+  - @cipherstash/stack-supabase@1.0.0-rc.1
+  - @cipherstash/stack@1.0.0-rc.1
+
 ## 1.2.14-rc.0
 
 ### Patch Changes

examples/basic/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cipherstash/basic-example",
   "private": true,
-  "version": "1.2.14-rc.0",
+  "version": "1.2.14-rc.1",
   "type": "module",
   "scripts": {
     "start": "tsx index.ts"

examples/prisma/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @cipherstash/prisma-next-example
 
+## 0.0.6-rc.1
+
+### Patch Changes
+
+- Updated dependencies [5fe9a2f]
+  - @cipherstash/stack@1.0.0-rc.1
+  - @cipherstash/prisma-next@0.4.0-rc.1
+
 ## 0.0.6-rc.0
 
 ### Patch Changes

examples/prisma/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cipherstash/prisma-next-example",
   "private": true,
-  "version": "0.0.6-rc.0",
+  "version": "0.0.6-rc.1",
   "description": "End-to-end example of @cipherstash/prisma-next: searchable application-layer encryption for Postgres with Prisma Next, using @cipherstash/stack as the SDK.",
   "type": "module",
   "scripts": {

packages/bench/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @cipherstash/bench
 
+## 0.0.5-rc.1
+
+### Patch Changes
+
+- Updated dependencies [59b994e]
+- Updated dependencies [5fe9a2f]
+  - @cipherstash/stack-drizzle@1.0.0-rc.1
+  - @cipherstash/stack@1.0.0-rc.1
+
 ## 0.0.5-rc.0
 
 ### Patch Changes

packages/bench/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/bench",
-  "version": "0.0.5-rc.0",
+  "version": "0.0.5-rc.1",
   "private": true,
   "description": "Performance / index-engagement benchmarks for stack integrations (Drizzle, encryptedSupabase, Prisma).",
   "type": "module",

packages/cli/CHANGELOG.md

@@ -1,5 +1,83 @@
 # @cipherstash/cli
 
+## 1.0.0-rc.1
+
+### Minor Changes
+
+- 134fd43: Add anonymous, opt-out usage analytics to the `stash` CLI, plus a
+  `stash telemetry [status|enable|disable]` command to manage it.
+
+  Only coarse events are collected — command name, CLI version, OS/arch, Node
+  version, success/failure, duration, and a coarse caller class (e.g.
+  `claude-code`, `cursor`, `interactive`) derived from environment markers so we
+  can gauge agent- vs human-driven usage. Events carry a random install
+  identifier (a locally generated UUID, not derived from any machine or user
+  attribute) used only to de-duplicate events in aggregate. Plaintext, schema,
+  table/column names,
+  connection strings, argument values, and any session/trace identifier are never
+  collected — enforced by a property-key allowlist at the emitter boundary plus
+  closed-vocabulary coercion of every argv- or error-derived value (unrecognised
+  commands, subcommands, and error class names all collapse to `<other>`). A
+  one-time notice is shown on first run, and nothing is sent on that run.
+
+  Telemetry is off by default in CI and can be disabled with `DO_NOT_TRACK=1`
+  (the cross-tool standard), `STASH_TELEMETRY_DISABLED=1`, or
+  `stash telemetry disable` (persisted to `~/.cipherstash/telemetry.json`).
+
+  Events are sent via a first-party proxy and never block or slow the CLI. The
+  feature ships dormant — no events are sent until a PostHog project key is
+  embedded at release. Updates the `stash-cli` skill to document the command and
+  opt-out controls.
+
+### Patch Changes
+
+- 59b994e: Add EQL v3 JSON **selector-with-constraint** querying to the Drizzle integration
+  (#623). `ops.selector(col, '$.path')` returns comparison methods bound to a
+  JSONPath into a `types.Json` column — `eq`/`ne`/`gt`/`gte`/`lt`/`lte` — emitting
+  `col->'<selector>' <op> <value>` over the encrypted document. Its unique power
+  over `contains` is **ordering at a path** (`col->'$.age' > 21`), which
+  containment cannot express.
+
+  Complements the existing `contains` (JSONB `@>`) containment operator. Core
+  `@cipherstash/stack` needs no change — the selector hash and comparison entry are
+  produced by `encryptQuery`/`encrypt` on the existing `types.Json` surface. v1
+  supports dot-notation object paths; array-index/wildcard paths are rejected with
+  a clear error. The Supabase adapter is tracked separately.
+
+  The right-hand comparison operand is currently a storage-encrypted needle (its
+  ste_vec entry carries the ordering term), pending a ciphertext-free ordering
+  query needle from protect-ffi (cipherstash/protectjs-ffi#137); until then the
+  value's ciphertext appears in the WHERE clause.
+
+  The bundled `stash-encryption` and `stash-drizzle` skills document the new
+  `ops.selector(...)` surface (they previously said JSONPath selector queries were
+  not yet implemented).
+
+- 5fe9a2f: Encrypted-JSON querying on the v3 Supabase surface (#650). A `types.Json`
+  column now supports exact encrypted containment — `contains(col, subDocument)`
+  (ste_vec `@>` via PostgREST `cs`, with the sub-document storage-encrypted
+  against the column) — and JSONPath selector predicates: `selectorEq(col, path,
+value)` and `selectorNe(col, path, value)` (dot-notation paths; `ne` includes
+  rows where the path is absent, mirroring the Drizzle selector's semantics).
+  Raw `.filter(col, 'cs', subDocument)` and `not(col, 'contains', …)` route
+  through the same encrypted path. Selector ordering is not expressible over
+  PostgREST yet (needs an EQL-bundle overload — see
+  cipherstash/encrypt-query-language#407); the Drizzle integration's
+  `ops.selector()` covers ordering today.
+
+  In core, `QueryTypesForColumn` gains the `searchableJson` arm (a `types.Json`
+  column no longer resolves to `never`, so typed adapter key sets can include
+  it), and the JSONPath selector-path helpers the Drizzle adapter introduced in
+  #651 moved to `@cipherstash/stack/adapter-kit` so both adapters share one
+  validation surface (`@cipherstash/stack-drizzle` re-exports them unchanged).
+
+  The bundled `stash-supabase` and `stash-encryption` skills are updated to
+  document the new querying surface (including the array-leaf and SQL-NULL
+  semantics, and the operand-exposure caveat) — skills ship inside the `stash`
+  tarball, hence the patch.
+
+  - @cipherstash/migrate@1.0.0-rc.0
+
 ## 1.0.0-rc.0
 
 ### Major Changes