chore: merge main into next

.changeset/auth-rustls-0-23-45.md

@@ -0,0 +1,6 @@
+---
+"@cipherstash/auth": patch
+---
+
+The native binaries now use rustls 0.23.45, which fixes GHSA-2mjx-qc3c-rqvc
+(affecting rustls 0.23.13 up to 0.23.44). The package's API is unchanged.

.changeset/protect-ffi-rustls-0-23-45.md

@@ -0,0 +1,12 @@
+---
+"@cipherstash/protect-ffi": patch
+"@cipherstash/protect-ffi-darwin-arm64": patch
+"@cipherstash/protect-ffi-darwin-x64": patch
+"@cipherstash/protect-ffi-linux-arm64-gnu": patch
+"@cipherstash/protect-ffi-linux-x64-gnu": patch
+"@cipherstash/protect-ffi-linux-x64-musl": patch
+"@cipherstash/protect-ffi-win32-x64-msvc": patch
+---
+
+The native binaries now use rustls 0.23.45, which fixes GHSA-2mjx-qc3c-rqvc
+(affecting rustls 0.23.13 up to 0.23.44). The package's API is unchanged.

AGENTS.md

@@ -570,17 +570,33 @@ monorepo, which is where the silent failures are.
   `fixtures::v3_doc_integer::field_op_selector` and
   `fixtures::v3_ste_vec::hello_op_selector`, which apply a written rule to the
   loaded fixture and fail, listing every candidate, when zero or several
-  selectors match. `tests/sqlx/tests/selector_literal_guard.rs` fails on a
-  random-looking standalone 32-hex run anywhere in the crate's source, SQL and
-  escaped JSON strings included, and runs DB-free in `mise run test:schema` so
-  fork PRs get it too; a forged selector must be
-  visibly fake (`"00000000000000000000000000000001"`). The suite passes against
-  any workspace. That a keyset and path still produce the same selector bytes is
-  pinned separately, in the encryption test crate
+  selectors match. The jsonb_entry matrix resolves the selector at runtime and
+  queries the literal `payload -> '<sel>'::text` customers write.
+  `tests/sqlx/tests/selector_literal_guard.rs` fails on a random-looking
+  standalone 32-hex run, in any case, in any `.rs` file under the crate's `src/`
+  and `tests/`, SQL and escaped JSON inside Rust strings included, and counts a
+  string escape (`\n`, `\x`), a `0x` prefix or an integer suffix (`0x…u128`)
+  as a boundary. It does not catch a selector split into pieces, such as a
+  `[u8; 16]` array of `0x..` bytes; the generated
+  `fixtures/*.sql` files hold real selectors and are not scanned. It runs
+  DB-free in `mise run test:schema` so fork PRs get it too; a forged selector
+  must be visibly fake (`"00000000000000000000000000000001"`). The suite passes
+  against any workspace. That a keyset and path still produce the same selector
+  bytes is pinned separately, in the encryption test crate
   (`packages/eql/tests/encryption/tests/ste_vec_selectors.rs`, regenerated only
-  with `EQL_UPDATE_STE_VEC_SELECTORS=1`). It pins the cipherstash-client version
-  the EQL workspace resolves; protect-ffi resolves its own from its own
-  lockfile, so the pin covers protect-ffi's only while the two versions agree.
+  with `EQL_UPDATE_STE_VEC_SELECTORS=1`, exactly `1`). It pins the index config
+  production really sends for an EQL v3 JSON column, the unrewritten
+  `prefix: "enabled"` sentinel included (#1203: a fix there changes every stored
+  v3 JSON selector and is meant to fail the pin). It also records the fake index
+  key it derives under: a changed key fails first, with a message naming it a
+  stack-kms test-infrastructure change rather than a stored-data break. It pins
+  the cipherstash-client and cipherstash-config (the crates that compute the
+  selectors) the EQL workspace resolves; protect-ffi resolves its own from its
+  own lockfile, and `scripts/__tests__/cipherstash-client-parity.test.mjs`
+  (`pnpm run test:scripts`, every PR) fails when the two lockfiles disagree on
+  the version, source or checksum of either, so a protect-ffi bump has to move the EQL pins with it. Primitive
+  dependencies such as blake3 are not compared, and already differ at patch
+  level.
 - **`FROZEN_PUBLISHERS` is what stops this repo publishing a package whose
   publisher lives elsewhere, and it is a mechanism, not a status.** `scripts/release-gate.mjs` carries a map of every
   package that lives here but is published from another repository. For each,