ci: arm publishing for @cipherstash/auth and the stack-* crates

[auxesis]

This PR switches publishing on for @cipherstash/auth and its six platform packages on npm, and for the stack-auth and stack-profile crates on crates.io. The title calls this "arming". Each platform package holds the native binary for one platform, such as darwin-arm64.

Until now, the release gate has blocked any new version of the seven auth packages. The release gate, scripts/release-gate.mjs, runs on every push to main before anything publishes to npm. This PR removes the block, which also switches on the crates release job that PR D added.

This is PR E of 6 in the stack crates import. The import moves six Rust crates, their bindings and the Go module here from the private cipherstash/cipherstash-suite repository, with their history. The stack crates import plan in Linear lists every step, and Linear issue CIP-4274 tracks the work.

This PR is stacked on PR D, #1002. Its base branch is PR D's branch, so the diff shows only this PR's own changes. It stays a draft until the freeze on Friday 2 October 2026, Pacific time. The freeze is the window in which the six PRs merge in order: #1000, #1001, #1003, #1002, #1009, then #1010. The steps for that day are in §9.1 of the plan.

Read the five commits in order, and skim the copied changesets

Read commits 1, 2 and 4 in full. Commit 3 copies six files from the suite byte for byte, so you can skim it. In commit 4, the pnpm-lock.yaml changes touch only the @cipherstash/auth entries.

Each commit makes one change

1. 66437857 removes the seven @cipherstash/auth entries from the release gate's two freeze lists, FROZEN_PUBLISHERS and FROZEN_ARTEFACT_DIGESTS. The gate fails if a package on those lists would publish a new version. Both lists end empty, as they are on main. The commit also removes the temporary lint-no-auth-changeset check that PR B added.
2. 0efb59e3 ports the suite's check that a change to what @cipherstash/auth ships comes with a changeset. A changeset is a file in .changeset/ that says which packages a change releases, and how far each version moves. The check, require-auth-npm-changeset.yml, runs on pull requests only.
3. e766c9a8 copies the suite's six pending @cipherstash/auth changesets, byte for byte. The suite history that PR B imports leaves .changeset/ out, so without this commit they would be lost. Each one is a patch, so the first auth release from this repository takes the seven packages to 0.44.1.
4. 931f359d makes @cipherstash/stack, stash, @cipherstash/wizard and the protect-ffi integration tests take @cipherstash/auth from this repository instead of npm. The copy in this repository has no built binary. So a new action, build-auth-binding, builds the native binding in every CI job that loads it. Without that build, 26, 16 and 2 test files fail in @cipherstash/stack, stash and @cipherstash/wizard. A guard test keeps every build-ffi-binding call paired with a build-auth-binding call.
5. ed14d047 adds a seventh @cipherstash/auth patch changeset, for the musl fix in fix(ci): build the musl @cipherstash/auth binary in Alpine, and check every binary's C library #1018. In 0.44.0, the linux-x64-musl binary linked glibc, so the package did not load on musl systems such as Alpine Linux. None of the six copied changesets says so. It lives in this PR because main's lint:auth-changeset refuses any @cipherstash/auth changeset until commit 1 removes that check. freshtonic raised it in review of fix(ci): build the musl @cipherstash/auth binary in Alpine, and check every binary's C library #1018.

The steps before this merge are done

This PR could not merge before two freeze steps. Both are now done:

1. PR D, ci: add the release pipelines for the stack-* crates and @cipherstash/auth, inert #1002, is on main.
2. fix(ci): build the musl @cipherstash/auth binary in Alpine, and check every binary's C library #1018, the musl build fix, merged on 2 October 2026 as 37c23d7b. Then auth-preflight.yml ran against this branch's head, ed14d047, and passed: run 37064086035. That dry run builds all seven auth packages without publishing them. All seven builds passed, and the linux-x64-musl binary links musl and loads inside Alpine Linux.

Trusted publishing is already in place. It lets a registry accept a publish from a named GitHub workflow, with no stored token. On npm, all seven auth packages trust cipherstash/stack. On crates.io, stack-auth and stack-profile trust it too.

Merge this PR with a merge commit, which keeps every commit, and never with a squash or a rebase. The crates release, #1010, is built on these exact commits.

Watch the release-plz run that this merge starts

Merging runs release-plz.yml, because this PR edits that file. release-plz is the tool that publishes the Rust crates to crates.io. Its release-crates job should find version 0.42.3 already published, and publish nothing. Watch that run.

The checks pass locally and in CI

• pnpm test:scripts passes 1,142 tests.
• A mutation is a deliberate break in the new code, made to prove that a test notices. All 20 of 20 mutations make a test fail.
• A test version bump of @cipherstash/auth now passes the release gate, which reports auth=true. On PR D, the same bump makes the gate fail.
• CI: 27 checks pass and 11 are skipped.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PaY5xYydZUWhv8Nex9Sw8a

[changeset-bot]

🦋 Changeset detected

Latest commit: ed14d04

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 19 packages

Name	Type
@cipherstash/auth	Patch
stash	Patch
@cipherstash/stack	Patch
@cipherstash/wizard	Patch
@cipherstash/ffi-integration-tests	Patch
@cipherstash/basic-example	Patch
@cipherstash/e2e	Patch
@cipherstash/bench	Patch
@cipherstash/stack-drizzle	Patch
@cipherstash/stack-prisma	Patch
@cipherstash/stack-supabase	Patch
@cipherstash/test-kit	Patch
@cipherstash/prisma-example	Patch
@cipherstash/auth-darwin-arm64	Patch
@cipherstash/auth-darwin-x64	Patch
@cipherstash/auth-linux-arm64-gnu	Patch
@cipherstash/auth-linux-x64-gnu	Patch
@cipherstash/auth-linux-x64-musl	Patch
@cipherstash/auth-win32-x64-msvc	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[yujiyokoo]

LGTM

Reviewed with GPT-6-Luna medium

[freshtonic]

Non-blocking, possibly inherited from the suite: this set does not include all the inputs to the binary that @cipherstash/auth ships.

languages/typescript/packages/auth/Cargo.toml depends on stack-profile, and stack-auth depends on it too. Both resolve it by path to packages/stack-profile. The root Cargo.toml and Cargo.lock also set the reqwest, jsonwebtoken/aws_lc_rs, tokio and vitaminc versions that are compiled into the napi module.

Failure case: a PR that changes only packages/stack-profile/src/**, or a Dependabot cargo bump that changes only Cargo.lock, changes the shipped .node binary. But this workflow does not start, so no @cipherstash/auth release follows. The change then waits, unreleased, until some other auth change comes.

Suggestion: add packages/stack-profile/Cargo.toml, packages/stack-profile/src/**, Cargo.toml and Cargo.lock here and to the git diff pathspec below. check-auth-npm-changeset.test.mjs keeps the two lists equal. The root-manifest paths will also match changes that affect only the other crates. If that is too noisy, add only stack-profile now.

[freshtonic]

Non-blocking: unlike build-ffi-binding, this action has no cache. build-ffi-binding caches index.node on a hash of its Rust inputs, so a PR that changes no Rust only restores the file. Here, each of the ~11 jobs that use this action does a cold cargo build (debug) of stack-auth-node on every run. That build includes aws-lc-sys through jsonwebtoken, and also the wasm-pack build where the job passes wasm: true.

The result is correct, so this does not block the freeze. For a follow-up, the same actions/cache pattern as build-ffi-binding would apply here, keyed on the root Cargo.lock, the stack-auth/stack-profile sources and this binding crate. The "DO NOT USE FROM A PUBLISHING WORKFLOW" note above already covers the release-cache rule.

[freshtonic]

Approved. I read the four commits against the base ci/stack-crates-release-pipelines.

What I checked:

• Gate (commit 1). FROZEN_PUBLISHERS and FROZEN_ARTEFACT_DIGESTS are now empty, and they change together. The crates switch in eql-pipeline-armed.mjs keys on the @cipherstash/auth entry, so the same deletion arms release-crates. The files and noTreeBytes shapes keep their tests. That is correct, because an empty map is a valid state.
• Publish order. release needs publish-auth, and its if: reads needs.gate.outputs.auth instead of the result of a skipped job. So changeset publish cannot publish @cipherstash/stack, stash or @cipherstash/wizard with an exact @cipherstash/auth@0.44.1 dependency before that version is on npm.
• Workspace switch (commit 4). workspace:* packs the exact version, as the old exact catalog pin did. The changesets fixed group keeps the seven auth packages in lockstep. The lockstep check moved from the catalog to supply-chain.e2e.test.ts, so it is still enforced. Removing the Dependabot ignores and the minimumReleaseAgeExclude entries is correct, because nothing resolves these packages from the registry now.
• Carried changesets (commit 3). All six are @cipherstash/auth: patch only. The cascade to 19 packages in the changeset-bot comment is the expected updateInternalDependencies result.

I left two non-blocking inline notes: the changeset check does not watch packages/stack-profile or the root Cargo.lock, and build-auth-binding has no cache. Each one can be a follow-up after the freeze.

Also, as the description says: confirm that auth-preflight.yml passed on main after #1002 merges, before this PR merges. Then watch the release-plz.yml run that the merge starts.