chore: remove the secrets skill and the leftovers from the secrets removal

[coderdan]

Why

1929c8fe feat: remove secrets and mark as coming soon deleted packages/stack/src/secrets/ but left the export, the build entry, the agent skill, and all the documentation behind. Secrets tooling is a while from ready. None of what this PR removes was functional.

The headline: @cipherstash/stack/secrets is a published, broken subpath export.

$ node -e "import('@cipherstash/stack/secrets')"
ERR_MODULE_NOT_FOUND: Cannot find module '.../packages/stack/dist/secrets/index.js'

package.json exports ./secrets → ./dist/secrets/index.js, and tsup.config.ts still lists src/secrets/index.ts as an entry — but that source doesn't exist, so tsup silently skips it and the file was never in the tarball. This ships in @cipherstash/stack@0.19.0. Anyone following the README and writing import { Secrets } from "@cipherstash/stack/secrets" gets a module-not-found at runtime.

Removing an export that cannot resolve breaks no working code. The failure mode just becomes honest:

before: ERR_MODULE_NOT_FOUND          (looks like a broken install)
after:  ERR_PACKAGE_PATH_NOT_EXPORTED (accurate: this subpath doesn't exist)

What's removed

The dead export. ./secrets from packages/stack/package.json, and the dangling src/secrets/index.ts entry from packages/stack/tsup.config.ts.

The skill. skills/stash-secrets/. It was never installed into a user project — it's absent from SKILL_MAP in init/lib/install-skills.ts, so no handoff ever copied it. Its references in AGENTS.md and the init setup-prompt skill index go with it.

The docs, in both published READMEs:

• packages/stack/README.md — the Secrets Management section, the Secrets API-reference block, the npx stash secrets CLI section, the TOC entry, the feature bullet, the subpath-exports row, and the migration-table row.
• packages/cli/README.md — the npx stash secrets section and the "encrypted secrets management" claim in the opening blurb. stash secrets returns Unknown command.

A bonus correction. skills/stash-encryption/SKILL.md listed both @cipherstash/stack/secrets and a Secrets class re-exported from the main entry. Neither exists — the main entry never exported Secrets. That skill ships into user projects, so the fix belongs here.

Out of scope

• packages/protect keeps its own secrets implementation and stash bin. That code is real; untouched.
• packages/stack/README.md also tells users to run npx stash db setup after init — a command that isn't in the registry. Unrelated staleness, left for a separate fix.

Verification

• import '@cipherstash/stack/secrets' now fails with ERR_PACKAGE_PATH_NOT_EXPORTED instead of ERR_MODULE_NOT_FOUND.
• @cipherstash/stack ESM/CJS entries still build without the secrets entry.
• The EncryptionError / FailureOption dts error surfaced by pnpm --filter @cipherstash/stack build reproduces on a clean main and is unrelated to this change (it looks like the @byteslice/result drift that chore(stack): upgrade @byteslice/result 0.2 → 0.5 #582 addresses).
• pnpm --filter stash test — 406 passing. Biome clean on the changed TS.
• git grep 'stash-secrets' and git grep 'stash secrets' return nothing outside packages/protect.

Summary by CodeRabbit

• Bug Fixes

  • Removed references to an unavailable secrets-management command and related public paths, so the CLI and package docs no longer point to features that don’t exist.

• Documentation

  • Updated repository, CLI, and package documentation to reflect the current set of supported tools and guides.
  • Cleaned up the init prompt skill list and encryption skill docs to match the available functionality.

[changeset-bot]

🦋 Changeset detected

Latest commit: f23f952

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 7 packages

Name	Type
@cipherstash/stack	Patch
stash	Patch
@cipherstash/bench	Patch
@cipherstash/prisma-next	Patch
@cipherstash/basic-example	Patch
@cipherstash/prisma-next-example	Patch
@cipherstash/e2e	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: afee6bd3-4667-4931-851d-e9ac4869b812

📥 Commits

Reviewing files that changed from the base of the PR and between c67169f and f23f952.

📒 Files selected for processing (9)

• .changeset/remove-secrets-leftovers.md
• AGENTS.md
• packages/cli/README.md
• packages/cli/src/commands/init/lib/setup-prompt.ts
• packages/stack/README.md
• packages/stack/package.json
• packages/stack/tsup.config.ts
• skills/stash-encryption/SKILL.md
• skills/stash-secrets/SKILL.md

💤 Files with no reviewable changes (4)

• skills/stash-secrets/SKILL.md
• packages/stack/tsup.config.ts
• packages/stack/package.json
• packages/cli/src/commands/init/lib/setup-prompt.ts

---

📝 Walkthrough

Walkthrough

This PR removes leftover "secrets" functionality that no longer has a working implementation: the unused @cipherstash/stack/secrets subpath export is dropped from build config and package exports, the stash-secrets agent skill is deleted along with its references, and secrets documentation is removed from AGENTS.md, the CLI README, the stack package README, and skill files.

Changes

Removal of secrets leftovers

Layer / File(s)	Summary
Build/export removal of secrets module packages/stack/tsup.config.ts, packages/stack/package.json	Removes src/secrets/index.ts from tsup entry points and cleans a formatting gap near package export entries.
Remove stash-secrets agent skill and references skills/stash-secrets/SKILL.md, skills/stash-encryption/SKILL.md, AGENTS.md, packages/cli/src/commands/init/lib/setup-prompt.ts	Deletes the entire stash-secrets skill file, removes it from AGENTS.md layout/key concepts and the setup-prompt skill purposes map, and drops the Secrets class reference from the stash-encryption skill's subpath export table.
CLI README secrets documentation removal packages/cli/README.md	Removes the encrypted secrets management description and the entire npx stash secrets command reference block.
Stack package README secrets documentation removal packages/stack/README.md	Removes the Secrets Management section, its table-of-contents entry, feature bullet, CLI reference block, logging interface list entry, API usage snippet, subpath exports row, and migration mapping row.
Changeset entry .changeset/remove-secrets-leftovers.md	Adds a changeset describing the removal of the secrets subpath export, skill, and documentation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• cipherstash/stack#311: Related changes to the secrets CLI helper logic that this PR's removal builds upon.
• cipherstash/stack#339: Updates the CLI to dynamically import secrets command and tolerate its removal, aligning with this PR's export drop.
• cipherstash/stack#346: Deletes the actual Secrets module and CLI command that this PR removes remaining references to.

Suggested reviewers: tobyhede

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is clearly related to the PR and captures the main theme of removing the secrets skill and remaining secrets references.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/remove-secrets-skill

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderdan]

Low-impact, docs-only change. AI review.