From 1e8be06731e29bb0f927a9b9c76e3f29cb2c1be6 Mon Sep 17 00:00:00 2001 From: Dan Draper Date: Sat, 29 Aug 2026 13:16:38 +1000 Subject: [PATCH] fix(skills): make stash-managed-platforms frontmatter valid YAML MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The description was an unquoted YAML scalar containing ": " ("...guards that break installs: command-time ceilings..."), which is invalid — a plain scalar can't hold a colon-space. Every consumer that parses the frontmatter throws on it. cipherstash.com mirrors these skills at build time via the marketing app's prebuild step, so this took down that site's deploys on every branch, not just the one that touched skills. Rewrites the value as a folded block scalar, which handles both the colons and the embedded double quotes. The parsed string is byte-for-byte what it was. Closes CIP-3900 Claude-Session: https://claude.ai/code/session_01HnNBVu5xeEQ8AdVgLxkKWL --- skills/stash-managed-platforms/SKILL.md | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/skills/stash-managed-platforms/SKILL.md b/skills/stash-managed-platforms/SKILL.md index 2e10e1647..13a0b60d4 100644 --- a/skills/stash-managed-platforms/SKILL.md +++ b/skills/stash-managed-platforms/SKILL.md @@ -1,6 +1,26 @@ --- name: stash-managed-platforms -description: Implement CipherStash encryption on a managed AI app platform — Lovable, v0, Bolt, Replit, and anything else with no developer-controlled shell, an edge/Workers runtime, a database role that is not `postgres`, and schema changes only through the platform's own migration tool. Covers the one fact that decides whether the product works there at all (use `@cipherstash/stack` with the `wasm-inline` entry — `@cipherstash/protect` is the deprecated predecessor and its native module will not load), running `stash auth login --json` headlessly in an ephemeral sandbox, minting deployment credentials with `stash env`, installing EQL as a role that is not `postgres`, which query predicates survive PostgREST, and how to construct `encryptedSupabase` inside a Worker by declaring your schemas. Also covers the platform guards that break installs: command-time ceilings that kill the EQL bundle partway (half-installed schema after a 600s limit), the PostgREST grants the installer never emits, minimum-release-age cooldowns refusing a fresh release ("version too new"), and secrets handoff when there is no secrets API. Use when the project is hosted on one of these platforms, when there is no terminal you control, when a native module fails to load in the deployed runtime, when an EQL install times out or PostgREST calls fail with permission errors, when a freshly published package refuses to install, or when you are about to conclude CipherStash cannot be used here. +description: >- + Implement CipherStash encryption on a managed AI app platform — Lovable, v0, + Bolt, Replit, and anything else with no developer-controlled shell, an + edge/Workers runtime, a database role that is not `postgres`, and schema + changes only through the platform's own migration tool. Covers the one fact + that decides whether the product works there at all (use `@cipherstash/stack` + with the `wasm-inline` entry — `@cipherstash/protect` is the deprecated + predecessor and its native module will not load), running `stash auth login + --json` headlessly in an ephemeral sandbox, minting deployment credentials + with `stash env`, installing EQL as a role that is not `postgres`, which query + predicates survive PostgREST, and how to construct `encryptedSupabase` inside + a Worker by declaring your schemas. Also covers the platform guards that break + installs: command-time ceilings that kill the EQL bundle partway + (half-installed schema after a 600s limit), the PostgREST grants the installer + never emits, minimum-release-age cooldowns refusing a fresh release ("version + too new"), and secrets handoff when there is no secrets API. Use when the + project is hosted on one of these platforms, when there is no terminal you + control, when a native module fails to load in the deployed runtime, when an + EQL install times out or PostgREST calls fail with permission errors, when a + freshly published package refuses to install, or when you are about to + conclude CipherStash cannot be used here. --- # CipherStash on Managed AI App Platforms