[coderdan]

Summary

Fixes for the open review threads on #1229, the release candidate that merges next into main. Most are small: a Go limit that could produce a value the SQL driver refuses, a Go error path that left a bearer token in memory, and an EQL type check that let a payload with "v": null through. One is a release blocker: merging next into main would start a crates.io publish of stack-encrypt 0.3.0 that fails, because the crates it depends on changed without a version bump.

Changes

• Go Limit.FetchOr (languages/golang/encrypt/query.go): when no finite fetch can be promised, the caller's page size is now cut to math.MaxInt64, the largest LIMIT PostgreSQL and database/sql take. A larger page used to reach the driver as a uint64 it refuses. Rust's Limit::fetch_or already does this.
• Go Stats.Rows doc: it suggested greatest(reltuples, 0). PostgreSQL reports reltuples = -1 for a table it has never analysed, and treating that as 0 rows sizes the fetch too small. The doc now says to read reltuples only when it is >= 0 and to page otherwise, as the Rust Stats::declared doc says. The PostgreSQL test runs ANALYZE and reads the count that way.
• Go step decoding (languages/golang/encrypt/step.go): a request with no method or URL is refused, and it now also wipes the headers (which carry the bearer token) and the body, as every other refusal there does. New test TestARefusedRequestIsWiped.
• EQL domains (packages/eql/crates/eql-codegen/templates/{types,query_types}.sql.j2): the CHECK compared v with the bundle version. A comparison with JSON null is NULL, and PostgreSQL lets a NULL CHECK pass, so a "v": null payload fitted both the v3 and the v4 types. They now use the COALESCE form the range types already use. The v3/v4 coexistence SQLx test casts a null-version payload to a stored and a query type of each version. The range templates now cite "Stack Encrypt ADR-0009", since packages/eql/docs/adr has no 0009.
• Crate versions (release blocker): stack-encrypt 0.3.0 uses stack_kms::diagnostic and ErrorPayload, which the only published stack-kms (0.1.0) lacks. The same gap exists one level down: stack-kms needs things added to stack-auth after 0.43.0, and stack-auth needs things added to stack-profile after 0.43.0. This PR bumps stack-auth and stack-profile to 0.44.0 (the OIDC token cache change in stack-auth is breaking) and stack-kms to 0.2.0, makes stack-encrypt require them, adds CHANGELOG sections for all three (a new CHANGELOG for stack-kms), and renames stack-encrypt's ## [Unreleased] to ## [0.3.0]. The lockfiles that record these crates move with them; in the two fuzz lockfiles, which were already behind on other dependencies, only the version lines of these crates change.
• Nits: a stale vitaminc version in a stack-encrypt/Cargo.toml comment is removed; a use in stack-guest-abi's tests moves to the top of the module.
• Changesets: @cipherstash/eql patch (the null-version CHECK) and @cipherstash/auth patch (its binaries are built from stack-auth, whose version moved).

Verification

Run locally on this branch (macOS, mise toolchain):

• Rust: cargo fmt --all --check passed; cargo clippy --locked -p stack-guest-abi -p stack-kms -p stack-encrypt --all-features --all-targets -- -D warnings passed; mise x --env test -- cargo nextest run --locked -p stack-guest-abi -p stack-kms --all-features passed (172 tests).
• Crate publish: before the bump, cargo publish --dry-run -p stack-auth failed (stack_profile::diagnostic unresolved) and -p stack-kms failed (stack_auth::diagnostic, stack_auth::tls unresolved), building against crates.io. After it, cargo publish --dry-run -p stack-profile -p stack-auth -p stack-kms -p stack-encrypt-derive -p stack-encrypt packages and verifies all five. cargo metadata --locked passes in every workspace whose lockfile moved.
• Go: all five guests built (wasm:guest:build, wasm:auth-guest:build, wasm:guest:build:deterministic, wasm:guest:build:eql, wasm:guest:build:eql:deterministic); mise run go:test passed; mise run go:lint reported 0 issues; go generate ./... left no diff; mise run go:test:postgres passed against a PostgreSQL 17 container, including TestQueriesRunAgainstPostgres with the ANALYZE change.
• EQL (from packages/eql): cargo fmt --check (workspace and SQLx crate) passed; cargo test -p eql-codegen passed; mise run build passed, including the v4 isolation gate, and its regenerated src/v3/scalars SQL is committed; mise run types:check passed; mise run test:encryption:postgres passed against the same container.
• By hand, in fresh databases with each built bundle: a "v": null payload cast to public.eql_v3_integer_eq, eql_v3.query_integer_eq, public.eql_v4_integer_eq and eql_v4.query_integer_eq fails with a check violation; a payload with the right version and a NULL value still pass.
• Not run locally: the SQLx suite, whose fixtures need ZeroKMS credentials. The extended wrong_version_insert_fails_the_domain_check test runs in CI.

Related

• chore: release candidate for EQL v4 and Stack Encrypt Rust and Go support #1229 (the review threads this answers)

Review notes

• The crate version bumps are the part to check. The dates in the new CHANGELOG headings say 2026-10-27; adjust them if next merges into main on another day.
• The branch merges next at ffeed7a (after feat(stack-encrypt): make two-letter words such as "Ng" searchable in the match index #1397 and docs(go): typed JSON walkthrough and accurate EQL reference #1402). feat(stack-encrypt): make two-letter words such as "Ng" searchable in the match index #1397's stack-encrypt CHANGELOG entry now sits under ## [0.3.0], and mise run build and the lockfile checks were re-run on the merged tree with no change.
• The EQL change alters the v3 CHECK too, not only v4. The committed release bundles under packages/eql/crates/eql-bindings/sql and packages/eql/packages/eql/sql are not regenerated here: they move at the lockstep version bump.

https://claude.ai/code/session_01N7bCqa3ZVJMcEE99RzVqEu

[changeset-bot]

🦋 Changeset detected

Latest commit: 9c39897

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 20 packages

Name	Type
@cipherstash/eql	Patch
@cipherstash/auth	Patch
stash	Patch
@cipherstash/stack-prisma	Patch
@cipherstash/stack	Patch
@cipherstash/wizard	Patch
@cipherstash/ffi-integration-tests	Patch
@cipherstash/basic-example	Patch
@cipherstash/e2e	Patch
@cipherstash/prisma-example	Patch
@cipherstash/bench	Patch
@cipherstash/stack-drizzle	Patch
@cipherstash/stack-supabase	Patch
@cipherstash/test-kit	Patch
@cipherstash/auth-darwin-arm64	Patch
@cipherstash/auth-darwin-x64	Patch
@cipherstash/auth-linux-arm64-gnu	Patch
@cipherstash/auth-linux-x64-gnu	Patch
@cipherstash/auth-linux-x64-musl	Patch
@cipherstash/auth-win32-x64-msvc	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Advanced
• Run ID: d5180460-d0ff-4506-ba5a-82e302bfd0e8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

[github-actions]

Mutation testing (cargo-mutants, --in-diff, stack-auth + stack-encrypt)

No mutants were generated for the changed lines.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-31T07:42:10.595317Z	9c39897	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-31T07:42:31.494612Z	9c39897	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cipherstash-agent]

Review attestation

Source: automated Claude Code review (/code-review medium plus cross-check against existing PR feedback), run on head 9c39897.

Result: no findings. No critical or blocking issues.

What was checked:

• Go FetchOr and decodeRequest: the min(page, math.MaxInt64) cap and the new wipe of headers and body on a refused request are correct. The new tests cover both, and query_test.go already imports math.
• EQL CHECK: COALESCE(VALUE->>'v' = '<ver>', VALUE IS NULL) refuses "v": null, because VALUE->>'v' is SQL NULL there. It still lets a SQL-NULL value through. The extended coexistence test covers stored and query domains for both versions.
• Crate bumps: the stack-auth and stack-profile 0.44.0 and stack-kms 0.2.0 versions, the stack-encrypt requirement, the CHANGELOGs and the lockfile edits are consistent. The protect-ffi crate pins =0.42.3 from the registry, so it is unaffected.
• Changesets: present for @cipherstash/eql and @cipherstash/auth.
• Existing feedback: there were no review threads. The only comments were bot status comments (changeset-bot, CodeRabbit skipped, mutants, Codex running), so nothing was duplicated.

Not verified:

• CI was still in progress at review time. The Rust, Go, SQLx and cargo publish --dry-run jobs had not finished. The release-blocker claim rests on the author's local dry-run. Please confirm those jobs go green before merging.
• The 2026-10-27 CHANGELOG dates are already flagged in the PR description.

---

Generated by Claude Code