[freshtonic]

A separate PR on #1531 (the CIP-5203 stack). Implements CIP-5312.

• stash keyset create and stash keyset rewrap add --out (written with mode 0600), --json and --in. Static keys are taken from an env variable by name, never as a flag value.
• The CLI calls Rust through two new napi functions in @cipherstash/auth (keysetCreate and keysetRewrap). The vendor crates are linked by path. The binary grows 11% on darwin-arm64. The GCP path has no RSA code.
• require-auth-npm-changeset.yml and the related workflow paths now include the vendor crates.
• skills/stash-cli is updated and checked against stash manifest --json.
• Changesets: stash minor and @cipherstash/auth minor.

Decisions are in docs/plans/2026-11-05-key-vendor-backends-decisions.md (CIP-5312 sections).

[changeset-bot]

🦋 Changeset detected

Latest commit: e2869f2

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 19 packages

Name	Type
@cipherstash/auth	Minor
stash	Minor
@cipherstash/stack	Minor
@cipherstash/wizard	Minor
@cipherstash/ffi-integration-tests	Patch
@cipherstash/basic-example	Patch
@cipherstash/e2e	Patch
@cipherstash/bench	Patch
@cipherstash/stack-drizzle	Minor
@cipherstash/stack-prisma	Minor
@cipherstash/stack-supabase	Minor
@cipherstash/test-kit	Patch
@cipherstash/prisma-example	Patch
@cipherstash/auth-darwin-arm64	Minor
@cipherstash/auth-darwin-x64	Minor
@cipherstash/auth-linux-arm64-gnu	Minor
@cipherstash/auth-linux-x64-gnu	Minor
@cipherstash/auth-linux-x64-musl	Minor
@cipherstash/auth-win32-x64-msvc	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

[github-actions]

Mutation testing (cargo-mutants, --in-diff, stack-auth + stack-encrypt)

No mutants were generated for the changed lines.

[freshtonic]

Scope reduced (2026-11-12). This branch was rebuilt from one final tree by path, and the follow-up PRs #1555 to #1563 were folded in. The plan is docs/plans/2026-11-12-key-vendor-backends-scope-reduction.md; the decision log's "Scope reduction" section records each change. Decisions: no stack-encrypt change, no v2 leaf, and the wrapped data key mode deferred.

In this PR: --mode is optional, defaults to derived, and refuses wrapped (mode_unsupported); REWRAP_REFUSED and rewrap_refused are gone. The ten changesets are now two. Folded in: #1559 and the auth parts of #1560 and #1561. The base is now #1531, not #1532: this PR does not depend on the Go work, and it is not part of GitHub stack #1623.

[freshtonic]

Replaced by #1631, in the new stack #1633. The code is the same, rebased onto the latest next. The ADRs are now ADR-0013 and ADR-0014, and the text about the wrapped data key mode is removed.