feat(cli): stash keyset create and rewrap for key vendor backends (CIP-5312)

.changeset/auth-keyset-records.md

@@ -0,0 +1,13 @@
+---
+'@cipherstash/auth': minor
+---
+
+Add `keysetCreate` and `keysetRewrap` (Node only). They create and rewrap keyset records for the key vendor backends (AWS KMS, Google Cloud KMS, Azure Managed HSM, HashiCorp Vault Transit and the static key backend), through the same Rust vendor clients that the Rust and Go SDKs use. ZeroKMS users do not need them. `stash keyset create` and `stash keyset rewrap` call them.
+
+- Each vendor's credentials come from its environment chain.
+- `backend` takes the short names (`aws`, `gcp`, `azure`, `vault`, `static`) and the full names that the result gives (`aws-kms`, `gcp-kms`, `azure-managed-hsm`, `vault-transit`).
+- `mode` is `derived`, the only key mode in this release. Another mode is refused with `INVALID_OPTIONS`.
+- `keysetRewrap` wraps the record's root key under another vendor key of the same backend. It does not re-key stored values, and every stored value still opens.
+- Both return a `Result`; a failure is a `KeysetFailure`.
+
+For Google Cloud KMS, set `GOOGLE_OAUTH_ACCESS_TOKEN` (for example from `gcloud auth print-access-token`) or run on Google Cloud. Service account key files are not read, so the binary has no RSA signing code.

.changeset/stash-keyset-commands.md

@@ -0,0 +1,13 @@
+---
+'stash': minor
+---
+
+Add `stash keyset create` and `stash keyset rewrap`, for keysets held by a key vendor backend (AWS KMS, Google Cloud KMS, Azure Managed HSM, HashiCorp Vault Transit, or the static key backend). ZeroKMS users never need them.
+
+- `stash keyset create --backend <aws|gcp|azure|vault|static> --vendor-key <ref> [--name <name>]` makes a keyset record and prints it as `CS_KEYSET_RECORD` (or `CS_KEYSET_RECORD_<NAME>`). `--backend` also takes the full names that the output gives (`aws-kms`, `gcp-kms`, `azure-managed-hsm`, `vault-transit`). The record is not secret. Pass its value to `encrypt.WithKeysetRecords` (Go) or `KeysetRecord::parse` (Rust).
+- `--mode` is optional. `derived` is the default and the only key mode in this release.
+- `stash keyset rewrap <record | --in file> [--vendor-key <ref>]` wraps a record's root key again, after a key rotation in the vendor or to move to another vendor key of the same backend. The keyset id does not change. Stored data is not re-keyed, and every stored value still opens.
+- Credentials come from each vendor's environment chain, never from a flag. A static key is named by its environment variable (`--key-env`); without one, a new key is generated and printed as `CS_STATIC_KEY`.
+- `--out <file>` writes the block with mode 0600 (`--force` to overwrite), and `--json` emits one NDJSON event.
+
+The `stash-cli` skill documents both commands, and the `stash-zerokms` skill says that key vendor backends exist for the Rust crates and the Go SDK, and that TypeScript does not support them yet.

.github/workflows/integration-drizzle.yml

@@ -67,6 +67,17 @@ on:
       # require-auth-npm-changeset.yml.
       - 'packages/stack-auth/Cargo.toml'
       - 'packages/stack-auth/src/**'
+      # The key vendor crates the auth binding compiles in (stash keyset).
+      - 'packages/stack-kms-vendor/Cargo.toml'
+      - 'packages/stack-kms-vendor/src/**'
+      - 'packages/stack-kms-aws/Cargo.toml'
+      - 'packages/stack-kms-aws/src/**'
+      - 'packages/stack-kms-vault/Cargo.toml'
+      - 'packages/stack-kms-vault/src/**'
+      - 'packages/stack-kms-gcp/Cargo.toml'
+      - 'packages/stack-kms-gcp/src/**'
+      - 'packages/stack-kms-azure/Cargo.toml'
+      - 'packages/stack-kms-azure/src/**'
       - 'languages/typescript/packages/auth/**'
       - 'languages/typescript/packages/stack-auth-wasm/**'
       # The Rust that produces every EQL payload these suites round-trip.
@@ -175,6 +186,17 @@ on:
       # require-auth-npm-changeset.yml.
       - 'packages/stack-auth/Cargo.toml'
       - 'packages/stack-auth/src/**'
+      # The key vendor crates the auth binding compiles in (stash keyset).
+      - 'packages/stack-kms-vendor/Cargo.toml'
+      - 'packages/stack-kms-vendor/src/**'
+      - 'packages/stack-kms-aws/Cargo.toml'
+      - 'packages/stack-kms-aws/src/**'
+      - 'packages/stack-kms-vault/Cargo.toml'
+      - 'packages/stack-kms-vault/src/**'
+      - 'packages/stack-kms-gcp/Cargo.toml'
+      - 'packages/stack-kms-gcp/src/**'
+      - 'packages/stack-kms-azure/Cargo.toml'
+      - 'packages/stack-kms-azure/src/**'
       - 'languages/typescript/packages/auth/**'
       - 'languages/typescript/packages/stack-auth-wasm/**'
       # The Rust that produces every EQL payload these suites round-trip.

.github/workflows/integration-protect-ffi.yml

@@ -106,6 +106,17 @@ on:
       # require-auth-npm-changeset.yml.
       - 'packages/stack-auth/Cargo.toml'
       - 'packages/stack-auth/src/**'
+      # The key vendor crates the auth binding compiles in (stash keyset).
+      - 'packages/stack-kms-vendor/Cargo.toml'
+      - 'packages/stack-kms-vendor/src/**'
+      - 'packages/stack-kms-aws/Cargo.toml'
+      - 'packages/stack-kms-aws/src/**'
+      - 'packages/stack-kms-vault/Cargo.toml'
+      - 'packages/stack-kms-vault/src/**'
+      - 'packages/stack-kms-gcp/Cargo.toml'
+      - 'packages/stack-kms-gcp/src/**'
+      - 'packages/stack-kms-azure/Cargo.toml'
+      - 'packages/stack-kms-azure/src/**'
       - 'languages/typescript/packages/auth/**'
       - 'languages/typescript/packages/stack-auth-wasm/**'
       - '.github/actions/require-cs-secrets/**'
@@ -155,6 +166,17 @@ on:
       # require-auth-npm-changeset.yml.
       - 'packages/stack-auth/Cargo.toml'
       - 'packages/stack-auth/src/**'
+      # The key vendor crates the auth binding compiles in (stash keyset).
+      - 'packages/stack-kms-vendor/Cargo.toml'
+      - 'packages/stack-kms-vendor/src/**'
+      - 'packages/stack-kms-aws/Cargo.toml'
+      - 'packages/stack-kms-aws/src/**'
+      - 'packages/stack-kms-vault/Cargo.toml'
+      - 'packages/stack-kms-vault/src/**'
+      - 'packages/stack-kms-gcp/Cargo.toml'
+      - 'packages/stack-kms-gcp/src/**'
+      - 'packages/stack-kms-azure/Cargo.toml'
+      - 'packages/stack-kms-azure/src/**'
       - 'languages/typescript/packages/auth/**'
       - 'languages/typescript/packages/stack-auth-wasm/**'
       - '.github/actions/require-cs-secrets/**'

.github/workflows/integration-supabase.yml

@@ -60,6 +60,17 @@ on:
       # require-auth-npm-changeset.yml.
       - 'packages/stack-auth/Cargo.toml'
       - 'packages/stack-auth/src/**'
+      # The key vendor crates the auth binding compiles in (stash keyset).
+      - 'packages/stack-kms-vendor/Cargo.toml'
+      - 'packages/stack-kms-vendor/src/**'
+      - 'packages/stack-kms-aws/Cargo.toml'
+      - 'packages/stack-kms-aws/src/**'
+      - 'packages/stack-kms-vault/Cargo.toml'
+      - 'packages/stack-kms-vault/src/**'
+      - 'packages/stack-kms-gcp/Cargo.toml'
+      - 'packages/stack-kms-gcp/src/**'
+      - 'packages/stack-kms-azure/Cargo.toml'
+      - 'packages/stack-kms-azure/src/**'
       - 'languages/typescript/packages/auth/**'
       - 'languages/typescript/packages/stack-auth-wasm/**'
       # The Rust that produces every EQL payload these suites round-trip.
@@ -154,6 +165,17 @@ on:
       # require-auth-npm-changeset.yml.
       - 'packages/stack-auth/Cargo.toml'
       - 'packages/stack-auth/src/**'
+      # The key vendor crates the auth binding compiles in (stash keyset).
+      - 'packages/stack-kms-vendor/Cargo.toml'
+      - 'packages/stack-kms-vendor/src/**'
+      - 'packages/stack-kms-aws/Cargo.toml'
+      - 'packages/stack-kms-aws/src/**'
+      - 'packages/stack-kms-vault/Cargo.toml'
+      - 'packages/stack-kms-vault/src/**'
+      - 'packages/stack-kms-gcp/Cargo.toml'
+      - 'packages/stack-kms-gcp/src/**'
+      - 'packages/stack-kms-azure/Cargo.toml'
+      - 'packages/stack-kms-azure/src/**'
       - 'languages/typescript/packages/auth/**'
       - 'languages/typescript/packages/stack-auth-wasm/**'
       # The Rust that produces every EQL payload these suites round-trip.

.github/workflows/require-auth-npm-changeset.yml

@@ -6,6 +6,9 @@ name: "Require @cipherstash/auth changeset"
 # and the npm API does not move: the npm binary is built from that crate, and
 # nothing else would release it.
 #
+# The key vendor crates are listed too: the binding compiles them in for
+# `stash keyset` (CIP-5312), so a change to one changes the npm binary.
+#
 # Changes that never ship (tests, examples, devDependencies) are filtered out
 # by `check-auth-npm-changeset.mjs --shipped`.
 #
@@ -18,6 +21,16 @@ on:
     paths:
       - packages/stack-auth/Cargo.toml
       - packages/stack-auth/src/**
+      - packages/stack-kms-vendor/Cargo.toml
+      - packages/stack-kms-vendor/src/**
+      - packages/stack-kms-aws/Cargo.toml
+      - packages/stack-kms-aws/src/**
+      - packages/stack-kms-vault/Cargo.toml
+      - packages/stack-kms-vault/src/**
+      - packages/stack-kms-gcp/Cargo.toml
+      - packages/stack-kms-gcp/src/**
+      - packages/stack-kms-azure/Cargo.toml
+      - packages/stack-kms-azure/src/**
       - languages/typescript/packages/auth/**
       - languages/typescript/packages/stack-auth-wasm/**
       - scripts/check-auth-npm-changeset.mjs
@@ -84,6 +97,16 @@ jobs:
             git diff --name-only --no-renames "${BASE_SHA}...HEAD" -- \
               packages/stack-auth/Cargo.toml \
               packages/stack-auth/src \
+              packages/stack-kms-vendor/Cargo.toml \
+              packages/stack-kms-vendor/src \
+              packages/stack-kms-aws/Cargo.toml \
+              packages/stack-kms-aws/src \
+              packages/stack-kms-vault/Cargo.toml \
+              packages/stack-kms-vault/src \
+              packages/stack-kms-gcp/Cargo.toml \
+              packages/stack-kms-gcp/src \
+              packages/stack-kms-azure/Cargo.toml \
+              packages/stack-kms-azure/src \
               languages/typescript/packages/auth \
               languages/typescript/packages/stack-auth-wasm
           )"; then

.github/workflows/tests.yml

@@ -98,11 +98,10 @@ jobs:
               - '!docs/**'
               # The Go module, and the Rust crates no binding these jobs build
               # depends on. The auth and profile bindings compile stack-auth and
-              # stack-profile, which stay in.
+              # stack-profile, and the auth binding compiles the key vendor
+              # crates for `stash keyset` and, through them, stack-kms,
+              # stack-encrypt and stack-encrypt-derive; all of those stay in.
               - '!languages/golang/**'
-              - '!packages/stack-encrypt/**'
-              - '!packages/stack-encrypt-derive/**'
-              - '!packages/stack-kms/**'
               - '!packages/stack-guest-abi/**'
               - '!packages/stack-auth/fuzz/**'
               # EQL's SQL sources, test suites, codegen and tasks. What the