[freshtonic]

A separate PR on #1629 (the CIP-5203 stack). Implements CIP-5312.

• stash keyset create and stash keyset rewrap add --out (written with mode 0600), --json and --in. Static keys are taken from an env variable by name, never as a flag value.
• The CLI calls Rust through two new napi functions in @cipherstash/auth (keysetCreate and keysetRewrap). The vendor crates are linked by path. The binary grows 11% on darwin-arm64. The GCP path has no RSA code.
• require-auth-npm-changeset.yml and the related workflow paths now include the vendor crates.
• skills/stash-cli is updated and checked against stash manifest --json.
• Changesets: stash minor and @cipherstash/auth minor.

Decisions are in docs/plans/2026-11-05-key-vendor-backends-decisions.md (CIP-5312 sections).

[changeset-bot]

🦋 Changeset detected

Latest commit: e2869f2

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 19 packages

Name	Type
@cipherstash/auth	Minor
stash	Minor
@cipherstash/stack	Minor
@cipherstash/wizard	Minor
@cipherstash/ffi-integration-tests	Patch
@cipherstash/basic-example	Patch
@cipherstash/e2e	Patch
@cipherstash/bench	Patch
@cipherstash/stack-drizzle	Minor
@cipherstash/stack-prisma	Minor
@cipherstash/stack-supabase	Minor
@cipherstash/test-kit	Patch
@cipherstash/prisma-example	Patch
@cipherstash/auth-darwin-arm64	Minor
@cipherstash/auth-darwin-x64	Minor
@cipherstash/auth-linux-arm64-gnu	Minor
@cipherstash/auth-linux-x64-gnu	Minor
@cipherstash/auth-linux-x64-musl	Minor
@cipherstash/auth-win32-x64-msvc	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

[github-actions]

Mutation testing (cargo-mutants, --in-diff, stack-auth + stack-encrypt)

No mutants were generated for the changed lines.