fix: final sweep — comments, env vars, db names, migration guide (round 4)

Comments:
- "protected table schema" → "encrypted table schema" in 6 dynamo example files + dynamodb README
- "protectjs" → "CipherStash" in nextjs-clerk schema comment
- eql_payload_created_by_protect → eql_payload_created_by_encryption in docs

Environment variables:
- PROTECT_LOG_LEVEL → CS_LOG_LEVEL in .env files and nest module
- AGENTS.md env var reference updated

Database/infrastructure:
- protect_example → encryption_example in next-drizzle-mysql (docker-compose, drizzle config, .env.example)
- protectNestedJson → encryptedNestedJson in dynamodb test

Documentation:
- protect-example → encryption-example in getting-started.md
- jsprotect.git → protectjs.git in hono-supabase README
- Updated product URLs in next-drizzle-mysql README
- MIGRATION.md: updated "after" examples with new function names
- Nest README: fixed src/protect/ → src/encryption/ path

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: calvinbrewer

AGENTS.md

@@ -64,7 +64,7 @@ USER_JWT=
 USER_2_JWT=
 
 # Logging (plaintext is never logged by design)
-PROTECT_LOG_LEVEL=debug|info|error
+CS_LOG_LEVEL=debug|info|error
 ```
 
 If these variables are missing, tests that require live encryption will fail or be skipped; prefer filtering to specific packages and tests while developing.

MIGRATION.md

@@ -17,8 +17,8 @@ npm install @cipherstash/stack
 If you use the DynamoDB helpers, update the peer dependency:
 
 ```bash
-# @cipherstash/protect-dynamodb now expects @cipherstash/stack
-npm install @cipherstash/stack @cipherstash/protect-dynamodb
+# @cipherstash/dynamodb now expects @cipherstash/stack
+npm install @cipherstash/stack @cipherstash/dynamodb
 ```
 
 If you use the Drizzle integration, update the peer dependency:
@@ -118,22 +118,24 @@ npm install @cipherstash/stack @cipherstash/drizzle
 ```diff
 -import { protect } from '@cipherstash/protect'
 +import { Encryption } from '@cipherstash/stack'
- import { extractProtectSchema, createProtectOperators } from '@cipherstash/drizzle/pg'
+-import { extractProtectSchema, createProtectOperators } from '@cipherstash/drizzle/pg'
++import { extractEncryptionSchema, createEncryptionOperators } from '@cipherstash/drizzle/pg'
 
- const users = extractProtectSchema(usersTable)
+-const users = extractProtectSchema(usersTable)
++const users = extractEncryptionSchema(usersTable)
 -const client = await protect({ schemas: [users] })
 +const client = await Encryption({ schemas: [users] })
- const ops = createProtectOperators(client)
+-const ops = createProtectOperators(client)
++const ops = createEncryptionOperators(client)
 ```
 
-> Note: `extractProtectSchema` and `createProtectOperators` retain their names in the Drizzle package.
-
 ### DynamoDB integration
 
 ```diff
 -import { protect, csTable, csColumn } from '@cipherstash/protect'
 +import { Encryption, encryptedTable, encryptedColumn } from '@cipherstash/stack'
- import { protectDynamoDB } from '@cipherstash/protect-dynamodb'
+-import { protectDynamoDB } from '@cipherstash/protect-dynamodb'
++import { encryptedDynamoDB } from '@cipherstash/dynamodb'
 
 -const users = csTable('users', {
 -  email: csColumn('email').equality(),
@@ -143,7 +145,8 @@ npm install @cipherstash/stack @cipherstash/drizzle
 
 -const client = await protect({ schemas: [users] })
 +const client = await Encryption({ schemas: [users] })
- const dynamo = protectDynamoDB({ protectClient: client })
+-const dynamo = protectDynamoDB({ protectClient: client })
++const dynamo = encryptedDynamoDB({ encryptionClient: client })
 ```
 
 ## 4. Deprecated aliases
@@ -183,6 +186,11 @@ ProtectColumn                  →  EncryptedColumn
 ProtectValue                   →  EncryptedValue
 ProtectTableColumn             →  EncryptedTableColumn
 ProtectOperation               →  EncryptionOperation
+extractProtectSchema           →  extractEncryptionSchema
+createProtectOperators         →  createEncryptionOperators
+@cipherstash/protect-dynamodb  →  @cipherstash/dynamodb
+protectDynamoDB                →  encryptedDynamoDB
+protectClient                  →  encryptionClient
 ```
 
 > **Important**: Run the more specific replacements first (e.g., `@cipherstash/protect/identify` before `@cipherstash/protect`) to avoid partial matches.

docs/concepts/searchable-encryption.md

@@ -98,7 +98,7 @@ Using the above approach, Stash Encryption is generating the EQL payloads and wh
 So does this solve the original problem of searching on encrypted data?
 
 ```sql
-# SELECT * FROM users WHERE WHERE cs_unique_v2(email) = cs_unique_v2(eql_payload_created_by_protect);
+# SELECT * FROM users WHERE WHERE cs_unique_v2(email) = cs_unique_v2(eql_payload_created_by_encryption);
  id |      name      |           email
 ----+----------------+----------------------------
   1 | Alice Johnson  | mBbKmsMMkbKBSN...

docs/getting-started.md

@@ -47,8 +47,8 @@ If you're following this getting started guide with an existing app, skip to [th
 If you're following this getting started guide with a clean slate, create a basic structure by running:
 
 ```bash
-mkdir -p protect-example/src/encryption
-cd protect-example
+mkdir -p encryption-example/src/encryption
+cd encryption-example
 git init
 npm init -y
 ```

examples/dynamo/src/bulk-operations.ts

@@ -34,9 +34,9 @@ const main = async () => {
 
   const items = [
     {
-      // `pk` won't be encrypted because it's not included in the `users` protected table schema.
+      // `pk` won't be encrypted because it's not included in the `users` encrypted table schema.
       pk: 'user#1',
-      // `email` will be encrypted because it's included in the `users` protected table schema.
+      // `email` will be encrypted because it's included in the `users` encrypted table schema.
       email: 'abc@example.com',
     },
     {

examples/dynamo/src/encrypted-key-in-gsi.ts

@@ -49,9 +49,9 @@ const main = async () => {
   })
 
   const user = {
-    // `pk` won't be encrypted because it's not included in the `users` protected table schema.
+    // `pk` won't be encrypted because it's not included in the `users` encrypted table schema.
     pk: 'user#1',
-    // `email` will be encrypted because it's included in the `users` protected table schema.
+    // `email` will be encrypted because it's included in the `users` encrypted table schema.
     email: 'abc@example.com',
   }
 

examples/dynamo/src/encrypted-partition-key.ts

@@ -32,9 +32,9 @@ const main = async () => {
   })
 
   const user = {
-    // `email` will be encrypted because it's included in the `users` protected table schema.
+    // `email` will be encrypted because it's included in the `users` encrypted table schema.
     email: 'abc@example.com',
-    // `somePlaintextAttr` won't be encrypted because it's not in the protected table schema.
+    // `somePlaintextAttr` won't be encrypted because it's not in the encrypted table schema.
     somePlaintextAttr: 'abc',
   }
 

examples/dynamo/src/encrypted-sort-key.ts

@@ -41,9 +41,9 @@ const main = async () => {
   })
 
   const user = {
-    // `pk` won't be encrypted because it's not in the protected table schema.
+    // `pk` won't be encrypted because it's not in the encrypted table schema.
     pk: 'user#1',
-    // `email` will be encrypted because it's included in the `users` protected table schema.
+    // `email` will be encrypted because it's included in the `users` encrypted table schema.
     email: 'abc@example.com',
   }
 

examples/dynamo/src/export-to-pg.ts

@@ -36,9 +36,9 @@ const main = async () => {
   })
 
   const user = {
-    // `pk` won't be encrypted because it's not included in the `users` protected table schema.
+    // `pk` won't be encrypted because it's not included in the `users` encrypted table schema.
     pk: 'user#1',
-    // `email` will be encrypted because it's included in the `users` protected table schema.
+    // `email` will be encrypted because it's included in the `users` encrypted table schema.
     email: 'abc@example.com',
   }
 

examples/dynamo/src/simple.ts

@@ -33,9 +33,9 @@ const main = async () => {
   })
 
   const user = {
-    // `pk` won't be encrypted because it's not included in the `users` protected table schema.
+    // `pk` won't be encrypted because it's not included in the `users` encrypted table schema.
     pk: 'user#1',
-    // `email` will be encrypted because it's included in the `users` protected table schema.
+    // `email` will be encrypted because it's included in the `users` encrypted table schema.
     email: 'abc@example.com',
   }