build: take @cipherstash/auth from the workspace, not the registry

stack, stash, @cipherstash/wizard and the protect-ffi integration suite
move the wrapper and the six platform packages from `catalog:repo` to
`workspace:*`. The seven catalog entries, the two
minimumReleaseAgeExclude entries and the two npm Dependabot ignores are
dead config and go. The lock changes only the auth importers and
entries, and `pnpm pack` still writes each range as the exact version.

A workspace @cipherstash/auth ships source only, and its index.js loads
the napi module on import, so every CI job that imports the SDK or runs
the CLI now builds it: without a build, the stack, stash and wizard
suites fail 26, 16 and 2 files with `Failed to load native binding`.
.github/actions/build-auth-binding runs build:debug, and build:wasm with
`wasm: 'true'`, then checks both load. It runs after each of the ten
build-ffi-binding calls, with wasm where that call has it, and in
tests-bench.yml, whose unit checks import the SDK and whose globalSetup
runs `stash`. In tests.yml's run-tests it replaces the auth half of the
binding build step. auth-binding-step-order.test.mjs holds the pairing
and the filters.

Every workflow that uses the action filters on it. The three
integration workflows that saw auth bumps through pnpm-workspace.yaml
now filter on the paths require-auth-npm-changeset.yml treats as what
@cipherstash/auth ships.

supply-chain.e2e.test.ts keeps the lockstep invariant in its new shape:
no auth catalog entry, and `workspace:*` in every consumer.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PaY5xYydZUWhv8Nex9Sw8a

Author: auxesis

.github/actions/build-auth-binding/action.yml

@@ -0,0 +1,73 @@
+name: Build the @cipherstash/auth binding
+description: >-
+  Compile `languages/typescript/packages/auth` into what its JS consumers load
+  at runtime — the napi module (cargo, debug) and optionally `wasm/`
+  (wasm-pack) — then prove they load.
+
+  WHY THIS EXISTS: `@cipherstash/stack`, `stash`, `@cipherstash/wizard` and the
+  protect-ffi integration suite take `@cipherstash/auth` from the workspace.
+  It ships source only there, and its `index.js` loads the napi module on
+  import, so every job that imports the SDK or runs the CLI builds it first.
+  From npm, the platform package brought a prebuilt `.node`. Without this, those
+  jobs fail with `Failed to load native binding for linux-x64`. It is the auth
+  half of `.github/actions/build-ffi-binding`, and runs after it;
+  scripts/__tests__/auth-binding-step-order.test.mjs holds the jobs to that.
+
+  DO NOT USE FROM A PUBLISHING WORKFLOW: release builds go through
+  `_build-auth-artifacts.yml`, which compiles every platform from scratch.
+
+inputs:
+  wasm:
+    description: >-
+      Also build `wasm/`, which `@cipherstash/auth/wasm-inline` imports and
+      `@cipherstash/stack/wasm-inline` re-exports. Pass it where the job passes
+      `wasm: true` to build-ffi-binding.
+    required: false
+    default: 'false'
+
+runs:
+  using: composite
+  steps:
+    # The runner's cargo, as build-ffi-binding uses for `index.node`. Writes
+    # the typings to the committed `native.d.ts`, so the tree stays clean.
+    - name: Build the napi module (cargo)
+      shell: bash
+      run: pnpm --filter @cipherstash/auth run build:debug
+
+    # The root mise.toml pins wasm-pack for this build. `install_args` narrows
+    # the install to it: the root also pins Rust, Go and golangci-lint, which
+    # this needs none of. Same action and pin as build-ffi-binding.
+    - name: Install wasm-pack
+      if: inputs.wasm == 'true'
+      uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+      with:
+        install: true
+        install_args: aqua:wasm-bindgen/wasm-pack
+        working_directory: .
+
+    - name: Add the wasm32 target
+      if: inputs.wasm == 'true'
+      shell: bash
+      run: rustup target add wasm32-unknown-unknown
+
+    - name: Build wasm/ (wasm-pack)
+      if: inputs.wasm == 'true'
+      shell: bash
+      run: pnpm --filter @cipherstash/auth run build:wasm
+
+    - name: Verify the binding loads
+      shell: bash
+      working-directory: languages/typescript/packages/auth
+      env:
+        WANT_WASM: ${{ inputs.wasm }}
+      run: |
+        set -euo pipefail
+
+        # index.js loads the napi module when it is required.
+        node -e "require('./index.js')"
+        echo "the napi module loads"
+
+        if [ "$WANT_WASM" = "true" ]; then
+          node --input-type=module -e "await import('./wasm-inline.mjs')"
+          echo "wasm/ loads"
+        fi

.github/dependabot.yml

@@ -43,17 +43,6 @@ updates:
         patterns:
           - "@types/*"
     ignore:
-      # Catalog-managed; bump manually via pnpm-workspace.yaml + changeset.
-      - dependency-name: "@cipherstash/auth"
-      # The platform bindings MUST move in lockstep with @cipherstash/auth:
-      # auth pins them as exact-version optional peer deps, so a skewed set
-      # makes npm nest per-consumer binding copies the hoisted auth package
-      # cannot resolve, and every project-local install of the CLI/SDK dies
-      # with "Failed to load native binding". Dependabot once bumped these
-      # six to 0.42.0 while the ignored auth stayed 0.41.0 (the rc.2 B1
-      # bug). Bump all seven catalog entries together, manually. Lockstep is
-      # enforced by e2e/tests/supply-chain.e2e.test.ts.
-      - dependency-name: "@cipherstash/auth-*"
       # 0.x bumps ship breaking type changes (e.g. 0.2 → 0.3 tightened the
       # FailureOption constraint). Review and apply manually.
       - dependency-name: "@byteslice/result"
@@ -126,13 +115,12 @@ updates:
           - patch
     ignore:
       # The CipherStash crates are pinned with EXACT `=` requirements in
-      # crates/protect-ffi/Cargo.toml and are the same release train as the
-      # @cipherstash/auth catalog entries above — cipherstash-client,
-      # cts-common, stack-auth and stack-profile all sit at =0.42.0, matching
-      # the catalog's 0.42.0. Dependabot bumping a subset is the Rust version
-      # of the rc.2 B1 bug recorded above: it would rewrite one `=` pin and
-      # leave the rest, and the crates do not tolerate skew. Bump them
-      # together, manually, in step with the npm catalog.
+      # crates/protect-ffi/Cargo.toml and are one release train —
+      # cipherstash-client, cts-common, stack-auth and stack-profile all sit at
+      # the same `=` version. Dependabot bumping a subset would rewrite one `=`
+      # pin and leave the rest, and the crates do not tolerate skew (a skewed
+      # @cipherstash/auth platform set was the npm form of this, the rc.2 B1
+      # bug). Bump them together, manually.
       #
       # Caveat worth knowing: `ignore` suppresses Dependabot SECURITY PRs too,
       # not just version updates. osv-scanner is the compensating control —

.github/workflows/integration-drizzle.yml

@@ -41,14 +41,14 @@ on:
       # directory, so without these two entries the only suites that would catch
       # it never start. They are the files a bump actually edits: exact pins
       # (`protect-ffi`, `@cipherstash/eql`) live in the package manifest,
-      # `catalog:` ones (`@cipherstash/auth`, which moves in lockstep with
-      # protect-ffi for the WASM entry) in the workspace catalog.
+      # `catalog:` ones in the workspace catalog.
       #
       # `pnpm-lock.yaml` is deliberately NOT listed. It changes on roughly every
       # dependency bump in the monorepo — far more often than either file here —
       # and these are credentialed, database-backed jobs. Nothing is lost: a
-      # protect-ffi or auth version change cannot reach the lockfile without
-      # editing one of the two manifests below first.
+      # protect-ffi version change cannot reach the lockfile without editing
+      # one of the two manifests below first, and an auth one edits its own
+      # manifest, under the auth paths below.
       - 'languages/typescript/packages/stack/package.json'
       - 'pnpm-workspace.yaml'
       - 'languages/typescript/packages/test-kit/**'
@@ -60,6 +60,15 @@ on:
       - '.github/actions/integration-setup/**'
       - '.github/actions/integration-db/**'
       - '.github/actions/build-ffi-binding/**'
+      - '.github/actions/build-auth-binding/**'
+      # `@cipherstash/auth` is a workspace package, and the SDK loads its napi
+      # module (and, for `wasm-inline`, its wasm) on import, so a change to what
+      # it ships arrives here rather than in `pnpm-workspace.yaml`. The paths of
+      # require-auth-npm-changeset.yml.
+      - 'packages/stack-auth/Cargo.toml'
+      - 'packages/stack-auth/src/**'
+      - 'languages/typescript/packages/auth/**'
+      - 'languages/typescript/packages/stack-auth-wasm/**'
       # The Rust that produces every EQL payload these suites round-trip.
       # Absorbing protect-ffi put it in-tree, so a crate change can now
       # break them in a PR that touches no TypeScript at all.
@@ -126,14 +135,14 @@ on:
       # directory, so without these two entries the only suites that would catch
       # it never start. They are the files a bump actually edits: exact pins
       # (`protect-ffi`, `@cipherstash/eql`) live in the package manifest,
-      # `catalog:` ones (`@cipherstash/auth`, which moves in lockstep with
-      # protect-ffi for the WASM entry) in the workspace catalog.
+      # `catalog:` ones in the workspace catalog.
       #
       # `pnpm-lock.yaml` is deliberately NOT listed. It changes on roughly every
       # dependency bump in the monorepo — far more often than either file here —
       # and these are credentialed, database-backed jobs. Nothing is lost: a
-      # protect-ffi or auth version change cannot reach the lockfile without
-      # editing one of the two manifests below first.
+      # protect-ffi version change cannot reach the lockfile without editing
+      # one of the two manifests below first, and an auth one edits its own
+      # manifest, under the auth paths below.
       - 'languages/typescript/packages/stack/package.json'
       - 'pnpm-workspace.yaml'
       - 'languages/typescript/packages/test-kit/**'
@@ -145,6 +154,15 @@ on:
       - '.github/actions/integration-setup/**'
       - '.github/actions/integration-db/**'
       - '.github/actions/build-ffi-binding/**'
+      - '.github/actions/build-auth-binding/**'
+      # `@cipherstash/auth` is a workspace package, and the SDK loads its napi
+      # module (and, for `wasm-inline`, its wasm) on import, so a change to what
+      # it ships arrives here rather than in `pnpm-workspace.yaml`. The paths of
+      # require-auth-npm-changeset.yml.
+      - 'packages/stack-auth/Cargo.toml'
+      - 'packages/stack-auth/src/**'
+      - 'languages/typescript/packages/auth/**'
+      - 'languages/typescript/packages/stack-auth-wasm/**'
       # The Rust that produces every EQL payload these suites round-trip.
       # Absorbing protect-ffi put it in-tree, so a crate change can now
       # break them in a PR that touches no TypeScript at all.
@@ -276,6 +294,11 @@ jobs:
         with:
           wasm: 'true'
 
+      - name: Build the @cipherstash/auth binding
+        uses: ./.github/actions/build-auth-binding
+        with:
+          wasm: 'true'
+
       # No pre-`up` cleanup step any more: the project name is unique per job, so
       # a container leaked by a hard-killed prior run cannot hold this job's
       # name or its (ephemeral) port. Blanket-pruning would now be actively

.github/workflows/integration-prisma-next.yml

@@ -34,6 +34,7 @@ on:
       - '.github/actions/integration-setup/**'
       - '.github/actions/integration-db/**'
       - '.github/actions/build-ffi-binding/**'
+      - '.github/actions/build-auth-binding/**'
       # The Rust that produces every EQL payload these suites round-trip.
       # Absorbing protect-ffi put it in-tree, so a crate change can now
       # break them in a PR that touches no TypeScript at all.
@@ -81,6 +82,7 @@ on:
       - '.github/actions/integration-setup/**'
       - '.github/actions/integration-db/**'
       - '.github/actions/build-ffi-binding/**'
+      - '.github/actions/build-auth-binding/**'
       # The Rust that produces every EQL payload these suites round-trip.
       # Absorbing protect-ffi put it in-tree, so a crate change can now
       # break them in a PR that touches no TypeScript at all.
@@ -166,6 +168,9 @@ jobs:
       - name: Build the protect-ffi binding
         uses: ./.github/actions/build-ffi-binding
 
+      - name: Build the @cipherstash/auth binding
+        uses: ./.github/actions/build-auth-binding
+
       # No pre-`up` cleanup step any more: the project name is unique per job, so
       # a container leaked by a hard-killed prior run cannot hold this job's
       # name or its (ephemeral) port. Blanket-pruning would now be actively

.github/workflows/integration-protect-ffi.yml

@@ -23,7 +23,7 @@ name: Integration — protect-ffi (native + WASM)
 # queried SQL installed from the PUBLISHED EQL bundle while the payloads under
 # test were emitted by the in-tree `eql-bindings`, so the two halves of EQL could
 # disagree — and would have disagreed in a database, not in CI. `@cipherstash/eql`
-# now resolves `workspace:^`, and `@cipherstash/auth` and `vitest` take
+# now resolves `workspace:^`, `@cipherstash/auth` `workspace:*`, and `vitest`
 # `catalog:repo`.
 #
 # Separate from `tests.yml` on purpose, and separate from `tests-rust.yml`: this
@@ -39,7 +39,7 @@ on:
       # and its manifest.
       - 'languages/typescript/packages/protect-ffi/integration-tests/**'
       # The suite's dependency versions, now that it is a pnpm workspace member:
-      # `@cipherstash/auth`, `vitest` and `typescript` reach it through
+      # `vitest` and `typescript` reach it through
       # `catalog:repo`, so a catalog bump changes what this job runs while
       # editing no file under the suite. Same entry, same reason, as the other
       # integration workflows — and like them, `pnpm-lock.yaml` is deliberately
@@ -89,6 +89,15 @@ on:
       - 'packages/eql/Cargo.toml'
       - '.github/workflows/integration-protect-ffi.yml'
       - '.github/actions/build-ffi-binding/**'
+      - '.github/actions/build-auth-binding/**'
+      # `@cipherstash/auth` is a workspace package, and the SDK loads its napi
+      # module (and, for `wasm-inline`, its wasm) on import, so a change to what
+      # it ships arrives here rather than in `pnpm-workspace.yaml`. The paths of
+      # require-auth-npm-changeset.yml.
+      - 'packages/stack-auth/Cargo.toml'
+      - 'packages/stack-auth/src/**'
+      - 'languages/typescript/packages/auth/**'
+      - 'languages/typescript/packages/stack-auth-wasm/**'
       - '.github/actions/require-cs-secrets/**'
   pull_request:
     branches: ['**']
@@ -119,6 +128,15 @@ on:
       - 'packages/eql/Cargo.toml'
       - '.github/workflows/integration-protect-ffi.yml'
       - '.github/actions/build-ffi-binding/**'
+      - '.github/actions/build-auth-binding/**'
+      # `@cipherstash/auth` is a workspace package, and the SDK loads its napi
+      # module (and, for `wasm-inline`, its wasm) on import, so a change to what
+      # it ships arrives here rather than in `pnpm-workspace.yaml`. The paths of
+      # require-auth-npm-changeset.yml.
+      - 'packages/stack-auth/Cargo.toml'
+      - 'packages/stack-auth/src/**'
+      - 'languages/typescript/packages/auth/**'
+      - 'languages/typescript/packages/stack-auth-wasm/**'
       - '.github/actions/require-cs-secrets/**'
   workflow_dispatch: {}
 
@@ -292,6 +310,11 @@ jobs:
         with:
           wasm: 'true'
 
+      - name: Build the @cipherstash/auth binding
+        uses: ./.github/actions/build-auth-binding
+        with:
+          wasm: 'true'
+
       # `working_directory` is load-bearing, not tidiness. mise reads config
       # from the current directory and its PARENTS, so an action running at the
       # repo root never sees languages/typescript/packages/protect-ffi/mise.toml — it would install

.github/workflows/integration-supabase.yml

@@ -34,14 +34,15 @@ on:
       # payload deserialization and it touches NO source directory, so without
       # these two entries the only suites that would catch it never start. They
       # are the files a bump actually edits: exact pins (`protect-ffi`,
-      # `@cipherstash/eql`) live in the package manifest, `catalog:` ones
-      # (`@cipherstash/auth`) in the workspace catalog.
+      # `@cipherstash/eql`) live in the package manifest, `catalog:` ones in
+      # the workspace catalog.
       #
       # `pnpm-lock.yaml` is deliberately NOT listed. It changes on roughly every
       # dependency bump in the monorepo — far more often than either file here —
       # and these are credentialed, database-backed jobs. Nothing is lost: a
-      # protect-ffi or auth version change cannot reach the lockfile without
-      # editing one of the two manifests below first.
+      # protect-ffi version change cannot reach the lockfile without editing
+      # one of the two manifests below first, and an auth one edits its own
+      # manifest, under the auth paths below.
       - 'languages/typescript/packages/stack/package.json'
       - 'pnpm-workspace.yaml'
       - 'languages/typescript/packages/test-kit/**'
@@ -52,6 +53,15 @@ on:
       - '.github/actions/integration-setup/**'
       - '.github/actions/integration-db/**'
       - '.github/actions/build-ffi-binding/**'
+      - '.github/actions/build-auth-binding/**'
+      # `@cipherstash/auth` is a workspace package, and the SDK loads its napi
+      # module (and, for `wasm-inline`, its wasm) on import, so a change to what
+      # it ships arrives here rather than in `pnpm-workspace.yaml`. The paths of
+      # require-auth-npm-changeset.yml.
+      - 'packages/stack-auth/Cargo.toml'
+      - 'packages/stack-auth/src/**'
+      - 'languages/typescript/packages/auth/**'
+      - 'languages/typescript/packages/stack-auth-wasm/**'
       # The Rust that produces every EQL payload these suites round-trip.
       # Absorbing protect-ffi put it in-tree, so a crate change can now
       # break them in a PR that touches no TypeScript at all.
@@ -104,14 +114,15 @@ on:
       # payload deserialization and it touches NO source directory, so without
       # these two entries the only suites that would catch it never start. They
       # are the files a bump actually edits: exact pins (`protect-ffi`,
-      # `@cipherstash/eql`) live in the package manifest, `catalog:` ones
-      # (`@cipherstash/auth`) in the workspace catalog.
+      # `@cipherstash/eql`) live in the package manifest, `catalog:` ones in
+      # the workspace catalog.
       #
       # `pnpm-lock.yaml` is deliberately NOT listed. It changes on roughly every
       # dependency bump in the monorepo — far more often than either file here —
       # and these are credentialed, database-backed jobs. Nothing is lost: a
-      # protect-ffi or auth version change cannot reach the lockfile without
-      # editing one of the two manifests below first.
+      # protect-ffi version change cannot reach the lockfile without editing
+      # one of the two manifests below first, and an auth one edits its own
+      # manifest, under the auth paths below.
       - 'languages/typescript/packages/stack/package.json'
       - 'pnpm-workspace.yaml'
       - 'languages/typescript/packages/test-kit/**'
@@ -122,6 +133,15 @@ on:
       - '.github/actions/integration-setup/**'
       - '.github/actions/integration-db/**'
       - '.github/actions/build-ffi-binding/**'
+      - '.github/actions/build-auth-binding/**'
+      # `@cipherstash/auth` is a workspace package, and the SDK loads its napi
+      # module (and, for `wasm-inline`, its wasm) on import, so a change to what
+      # it ships arrives here rather than in `pnpm-workspace.yaml`. The paths of
+      # require-auth-npm-changeset.yml.
+      - 'packages/stack-auth/Cargo.toml'
+      - 'packages/stack-auth/src/**'
+      - 'languages/typescript/packages/auth/**'
+      - 'languages/typescript/packages/stack-auth-wasm/**'
       # The Rust that produces every EQL payload these suites round-trip.
       # Absorbing protect-ffi put it in-tree, so a crate change can now
       # break them in a PR that touches no TypeScript at all.
@@ -227,6 +247,9 @@ jobs:
       - name: Build the protect-ffi binding
         uses: ./.github/actions/build-ffi-binding
 
+      - name: Build the @cipherstash/auth binding
+        uses: ./.github/actions/build-auth-binding
+
       # No pre-`up` cleanup step any more: the project name is unique per job, so
       # a container leaked by a hard-killed prior run cannot hold this job's
       # name or its (ephemeral) port. Blanket-pruning would now be actively

.github/workflows/prisma-example-readme-e2e.yml

@@ -26,6 +26,7 @@ on:
       # report — a PR touching any of these runs the walkthrough before the
       # change lands, not after.
       - '.github/actions/build-ffi-binding/**'
+      - '.github/actions/build-auth-binding/**'
       - 'languages/typescript/packages/protect-ffi/crates/**'
       - 'languages/typescript/packages/protect-ffi/src/**'
       - 'languages/typescript/packages/protect-ffi/Cargo.toml'
@@ -58,6 +59,7 @@ on:
       # scripts/__tests__/workflow-paths-filter-parity.test.mjs compares the
       # two copies.)
       - '.github/actions/build-ffi-binding/**'
+      - '.github/actions/build-auth-binding/**'
       - 'languages/typescript/packages/protect-ffi/crates/**'
       - 'languages/typescript/packages/protect-ffi/src/**'
       - 'languages/typescript/packages/protect-ffi/Cargo.toml'
@@ -145,6 +147,9 @@ jobs:
       - name: Build the protect-ffi binding
         uses: ./.github/actions/build-ffi-binding
 
+      - name: Build the @cipherstash/auth binding
+        uses: ./.github/actions/build-auth-binding
+
       # Build via turbo so `^build` on `@cipherstash/stack-prisma` and
       # its `@cipherstash/stack` peer is honoured. The test's
       # `pnpm install` subprocess inside `languages/typescript/examples/prisma/` is a no-op