From 7744caf8fef3234fca7dd28cb59c9a2516a5fdd3 Mon Sep 17 00:00:00 2001 From: Dan Draper Date: Thu, 16 Jul 2026 01:14:54 +1000 Subject: [PATCH] docs(agents): correct the auth-strategy config key name MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit AGENTS.md said the strategy is passed as `config.strategy`; the real ClientConfig key is `authStrategy` (packages/stack/src/types.ts). Caught while re-reviewing #642, whose examples use the correct key — the drift was here, not there. Rule 7 says keep the meta files honest; one wrong key name in the file every agent reads is exactly how a wrong example propagates. Claude-Session: https://claude.ai/code/session_01MxTTPaPP16m6br7Hoab94w --- AGENTS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index 0b0b4a023..f01379bf3 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -157,7 +157,7 @@ Three rules to remember when editing CI or pnpm config: - `bulkEncryptModels(models[], table)` / `bulkDecryptModels(models[])` - `encryptQuery(value, { table, column, queryType?, returnType? })` for searchable queries - `encryptQuery(terms[])` for batch query encryption -- **Identity-aware encryption**: Authenticate the client as the end user with `OidcFederationStrategy` (`config.strategy`, re-exported from `@cipherstash/stack`), then chain `.withLockContext({ identityClaim })` on operations to bind the data key to a claim. The same claim must be used for encrypt and decrypt. (`LockContext.identify()` from `@cipherstash/stack/identity` is deprecated — the strategy now handles token acquisition; `.withLockContext()` also accepts a `LockContext`.) +- **Identity-aware encryption**: Authenticate the client as the end user with `OidcFederationStrategy` (`config.authStrategy`, re-exported from `@cipherstash/stack`), then chain `.withLockContext({ identityClaim })` on operations to bind the data key to a claim. The same claim must be used for encrypt and decrypt. (`LockContext.identify()` from `@cipherstash/stack/identity` is deprecated — the strategy now handles token acquisition; `.withLockContext()` also accepts a `LockContext`.) - **Integrations**: - **Drizzle ORM**: `encryptedType`, `extractEncryptionSchema`, `createEncryptionOperators` from `@cipherstash/stack-drizzle` (EQL v3 factories from `@cipherstash/stack-drizzle/v3`) - **Supabase**: `encryptedSupabase` (v2) / `encryptedSupabaseV3` (v3) from `@cipherstash/stack-supabase`