chore(stack-encrypt)!: move to vitaminc 0.8, clww-ore 0.6 and ore-rs 0.10

.cargo/mutants.toml

@@ -85,9 +85,10 @@ exclude_re = [
   # the empty list (`dynamic::target::NoTargets`), which a test asserts on
   # and `resolve` turns into `TargetError::NoTargets`; `vec![]` is the body.
   'stack-encrypt/src/dynamic/target\.rs:\d+:\d+: replace <impl TargetResolver for NoTargets>::targets -> Vec<TargetDescriptor> with vec!\[\]$',
-  # A passthrough has no kind: `KindOf::passthrough` returns `Ok(None)`,
-  # which is `Ok(Default::default())`. `a_frame_names_its_kind` asserts it.
-  'stack-encrypt/src/dynamic/value_frame\.rs:\d+:\d+: replace <impl Sink for KindOf>::passthrough -> Result<Self::Ok, DecodeError> with Ok\(Default::default\(\)\)$',
+  # A passthrough, and a typed null as any null, has no kind:
+  # `KindOf::passthrough` and `KindOf::typed_null` return `Ok(None)`, which
+  # is `Ok(Default::default())`. `a_frame_names_its_kind` asserts the first.
+  'stack-encrypt/src/dynamic/value_frame\.rs:\d+:\d+: replace <impl Sink for KindOf>::(passthrough|typed_null) -> Result<Self::Ok, DecodeError> with Ok\(Default::default\(\)\)$',
   # `model`'s `admits` guard on a date, decimal or undefined value is checked
   # again by vitaminc on every path that reaches it: the frame writer behind
   # `Modeled` and `ModelOnly` refuses an inadmissible logical value

.github/dependabot.yml

@@ -226,8 +226,8 @@ updates:
       # stack-encrypt behind its optional `stack-encrypt` feature. Those crates
       # declare these `{ workspace = true }`, so their requirements come from
       # the root Cargo.toml even when built here. The root entry below ignores
-      # them because they move by hand with cipherstash-suite: the root
-      # manifest pins recipher and cllw-ore with `=`, and so does the Go guest.
+      # them because they move by hand: the root manifest pins recipher,
+      # clww-ore and ore-rs with `=`, and the Go guest pins recipher with `=`.
       # Without these lines this entry bumped them in this lockfile and, to
       # satisfy the exact pins, rewrote the root Cargo.toml without touching
       # the root Cargo.lock or the guest's pin, breaking every root `--locked`
@@ -238,7 +238,8 @@ updates:
       # scripts/__tests__/dependabot-eql-inherited-ignores.test.mjs fails when
       # the root entry ignores a crate this entry does not.
       - dependency-name: "recipher"
-      - dependency-name: "cllw-ore"
+      - dependency-name: "clww-ore"
+      - dependency-name: "ore-rs"
       - dependency-name: "zerokms-protocol"
       - dependency-name: "vitaminc*"
       # Major bumps are reviewed and applied manually, not by Dependabot.
@@ -292,14 +293,18 @@ updates:
     ignore:
       # Released from cipherstash-suite: stack-auth's API carries their types,
       # so they move in lockstep with the suite, by hand. The guests pin them
-      # with `=`; the root Cargo.toml pins recipher and cllw-ore with `=`, and
-      # gives cts-common and zerokms-protocol caret requirements.
+      # with `=`; the root Cargo.toml pins recipher with `=`, and gives
+      # cts-common and zerokms-protocol caret requirements.
       - dependency-name: "cts-common"
       - dependency-name: "zerokms-protocol"
       - dependency-name: "recipher"
-      - dependency-name: "cllw-ore"
-      # vitaminc is pinned at 0.5.0 across the crates and the guests; the
-      # guests' `ValueFrame: Decrypt` bound fails if two versions resolve.
+      # The order schemes, from cipherstash/ore.rs, moved by hand with
+      # vitaminc: a new release can change every stored order term.
+      - dependency-name: "clww-ore"
+      - dependency-name: "ore-rs"
+      # vitaminc is pinned at 0.8.0 across the crates. The encrypt guest
+      # takes it only through stack-encrypt's re-exports, so it cannot
+      # resolve a second version; one would fail at `ValueFrame: Decrypt`.
       - dependency-name: "vitaminc*"
       # Major bumps are reviewed and applied manually, not by Dependabot.
       - dependency-name: "*"

AGENTS.md

@@ -685,10 +685,12 @@ monorepo, which is where the silent failures are.
 ## Working on the Rust crates
 
 The stack-* crates came from `cipherstash/cipherstash-suite`, which still owns
-`cipherstash-client`, `cts-common`, `zerokms-protocol`, `recipher` and
-`cllw-ore`. Here those come from crates.io, and `Cargo.lock` holds their
-exact versions. In the root `Cargo.toml`, `recipher` and `cllw-ore` are
-pinned with `=`. `cts-common` and `zerokms-protocol` take caret
+`cipherstash-client`, `cts-common`, `zerokms-protocol` and `recipher`. Here
+those come from crates.io, and `Cargo.lock` holds their exact versions. In the
+root `Cargo.toml`, `recipher` is pinned with `=`, and so are the order
+schemes `clww-ore` (formerly `cllw-ore`) and `ore-rs`, which live in
+`cipherstash/ore.rs`: a new release of either can change every stored order
+term. `cts-common` and `zerokms-protocol` take caret
 requirements, because the published `stack-auth` inherits them, and an
 exact pin would stop the suite sharing one `cts-common` with it.