@cipherstash/stack 0.10.0 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @cipherstash/stack
 
+## 0.12.0
+
+### Minor Changes
+
+- 15764a8: Implement stack auth into stash cli flow.
+
+## 0.11.0
+
+### Minor Changes
+
+- b0e56b8: Upgrade protect-ffi to 0.21.0 and enable array_index_mode for searchable JSON
+
+  - Upgrade `@cipherstash/protect-ffi` to 0.21.0 across all packages
+  - Enable `array_index_mode: 'all'` on STE vec indexes so JSON array operations
+    (jsonb_array_elements, jsonb_array_length, array containment) work correctly
+  - Delegate credential resolution entirely to protect-ffi's `withEnvCredentials`
+  - Download latest EQL at build/runtime instead of bundling hardcoded SQL files
+
 ## 0.10.0
 
 ### Minor Changes

package/README.md

@@ -44,19 +44,29 @@ pnpm add @cipherstash/stack
 
 ## Quick Start
 
+### 1. Initialize and authenticate your project
+
+```bash
+npx stash init
+```
+
+The wizard will authenticate you, walk you through choosing a database connection method, build an encryption schema, and install the required dependencies.
+
+### 2. Encrypt and decrypt
+
 ```typescript
 import { Encryption } from "@cipherstash/stack"
 import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
 
-// 1. Define a schema
+// Define a schema
 const users = encryptedTable("users", {
   email: encryptedColumn("email").equality().freeTextSearch(),
 })
 
-// 2. Create a client (reads CS_* env vars automatically)
+// Create a client
 const client = await Encryption({ schemas: [users] })
 
-// 3. Encrypt a value
+// Encrypt a value
 const encrypted = await client.encrypt("hello@example.com", {
   column: users.email,
   table: users,
@@ -68,7 +78,7 @@ if (encrypted.failure) {
   console.log("Encrypted payload:", encrypted.data)
 }
 
-// 4. Decrypt the value
+// Decrypt the value
 const decrypted = await client.decrypt(encrypted.data)
 
 if (decrypted.failure) {
@@ -430,6 +440,16 @@ await secrets.delete("DATABASE_URL")
 
 The `stash` CLI is bundled with the package and available after install.
 
+### `stash auth`
+
+Authenticate with CipherStash.
+
+```bash
+npx stash auth login
+```
+
+This runs the device code flow: it opens your browser, you confirm the code, and a token is saved to `~/.cipherstash/auth.json`. No environment variables or credentials files are needed for local development.
+
 ### `stash init`
 
 Initialize CipherStash for your project with an interactive wizard.
@@ -440,11 +460,13 @@ npx stash init --supabase
 ```
 
 The wizard will:
-1. Choose your database connection method (Drizzle ORM, Supabase JS, Prisma, or Raw SQL)
-2. Build an encryption schema interactively or use a placeholder, then generate the encryption client file
-3. Install `@cipherstash/stack-forge` as a dev dependency for database tooling
+1. Authenticate with CipherStash (device code flow)
+2. Bind your device to the default Keyset
+3. Choose your database connection method (Drizzle ORM, Supabase JS, Prisma, or Raw SQL)
+4. Build an encryption schema interactively or use a placeholder, then generate the encryption client file
+5. Install `@cipherstash/stack-forge` as a dev dependency for database tooling
 
-After `stash init`, create a CipherStash account at [dashboard.cipherstash.com/sign-up](https://dashboard.cipherstash.com/sign-up) to get your credentials, then run `npx stash-forge setup` to configure your database connection.
+After `stash init`, run `npx stash-forge setup` to configure your database.
 
 | Flag | Description |
 |------|-------------|
@@ -468,11 +490,15 @@ npx stash secrets delete -name DATABASE_URL -environment production
 | `stash secrets list` | `-environment` | `-e` | List all secret names in an environment |
 | `stash secrets delete` | `-name`, `-environment`, `-yes` | `-n`, `-e`, `-y` | Delete a secret (prompts for confirmation unless `-yes`) |
 
-The CLI reads credentials from the same `CS_*` environment variables described in [Configuration](#configuration).
-
 ## Configuration
 
-### Environment Variables
+### Local Development
+
+No environment variables or credentials are needed for local development. Run `npx @cipherstash/stack auth login` to authenticate via the device code flow, and the SDK and CLI will use the token saved to `~/.cipherstash/auth.json`.
+
+### Going to Production
+
+For production, CI/CD, and deployed environments, you'll need to set up machine credentials via environment variables:
 
 | Variable | Description |
 |-----|-------|
@@ -481,13 +507,7 @@ The CLI reads credentials from the same `CS_*` environment variables described i
 | `CS_CLIENT_KEY` | Client key material used with ZeroKMS for encryption |
 | `CS_CLIENT_ACCESS_KEY` | API key for authenticating with the CipherStash API |
 
-Store these in a `.env` file or set them in your hosting platform.
-
-Sign up at [cipherstash.com/signup](https://cipherstash.com/signup) and follow the onboarding to generate credentials.
-
-### TOML Config
-
-You can also configure credentials via `cipherstash.toml` and `cipherstash.secret.toml` files in your project root. See the [CipherStash docs](https://cipherstash.com/docs) for format details.
+See the [Going to Production](https://cipherstash.com/docs/stack/going-to-production) guide for full details on creating machine clients, setting up access keys, and configuring CI/CD pipelines.
 
 ### Programmatic Config
 

package/dist/bin/stash.js

@@ -104,8 +104,8 @@ var require_package = __commonJS({
 var require_main = __commonJS({
   "../../node_modules/.pnpm/dotenv@16.4.7/node_modules/dotenv/lib/main.js"(exports, module) {
     "use strict";
-    var fs2 = __require("fs");
-    var path2 = __require("path");
+    var fs = __require("fs");
+    var path = __require("path");
     var os = __require("os");
     var crypto = __require("crypto");
     var packageJson = require_package();
@@ -211,7 +211,7 @@ var require_main = __commonJS({
       if (options && options.path && options.path.length > 0) {
         if (Array.isArray(options.path)) {
           for (const filepath of options.path) {
-            if (fs2.existsSync(filepath)) {
+            if (fs.existsSync(filepath)) {
               possibleVaultPath = filepath.endsWith(".vault") ? filepath : `${filepath}.vault`;
             }
           }
@@ -219,15 +219,15 @@ var require_main = __commonJS({
           possibleVaultPath = options.path.endsWith(".vault") ? options.path : `${options.path}.vault`;
         }
       } else {
-        possibleVaultPath = path2.resolve(process.cwd(), ".env.vault");
+        possibleVaultPath = path.resolve(process.cwd(), ".env.vault");
       }
-      if (fs2.existsSync(possibleVaultPath)) {
+      if (fs.existsSync(possibleVaultPath)) {
         return possibleVaultPath;
       }
       return null;
     }
     function _resolveHome(envPath) {
-      return envPath[0] === "~" ? path2.join(os.homedir(), envPath.slice(1)) : envPath;
+      return envPath[0] === "~" ? path.join(os.homedir(), envPath.slice(1)) : envPath;
     }
     function _configVault(options) {
       _log("Loading env from encrypted .env.vault");
@@ -240,7 +240,7 @@ var require_main = __commonJS({
       return { parsed };
     }
     function configDotenv(options) {
-      const dotenvPath = path2.resolve(process.cwd(), ".env");
+      const dotenvPath = path.resolve(process.cwd(), ".env");
       let encoding = "utf8";
       const debug = Boolean(options && options.debug);
       if (options && options.encoding) {
@@ -263,13 +263,13 @@ var require_main = __commonJS({
       }
       let lastError;
       const parsedAll = {};
-      for (const path3 of optionPaths) {
+      for (const path2 of optionPaths) {
         try {
-          const parsed = DotenvModule.parse(fs2.readFileSync(path3, { encoding }));
+          const parsed = DotenvModule.parse(fs.readFileSync(path2, { encoding }));
           DotenvModule.populate(parsedAll, parsed, options);
         } catch (e2) {
           if (debug) {
-            _debug(`Failed to load ${path3} ${e2.message}`);
+            _debug(`Failed to load ${path2} ${e2.message}`);
           }
           lastError = e2;
         }
@@ -1200,6 +1200,91 @@ var Y2 = ({ indicator: t = "dots" } = {}) => {
   } };
 };
 
+// src/bin/commands/auth/login.ts
+import auth from "@cipherstash/auth";
+var { beginDeviceCodeFlow, bindClientDevice } = auth;
+var regions = [
+  { value: "ap-southeast-2.aws", label: "Asia Pacific (Sydney)" },
+  { value: "eu-central-1.aws", label: "Europe (Frankfurt)" },
+  { value: "eu-west-1.aws", label: "Europe (Ireland)" },
+  { value: "us-east-1.aws", label: "US East (N. Virginia)" },
+  { value: "us-east-2.aws", label: "US East (Ohio)" },
+  { value: "us-west-1.aws", label: "US West (N. California)" },
+  { value: "us-west-2.aws", label: "US West (Oregon)" }
+];
+async function selectRegion() {
+  const region = await ve({
+    message: "Select a region",
+    options: regions
+  });
+  if (pD(region)) {
+    xe("Cancelled.");
+    process.exit(0);
+  }
+  return region;
+}
+async function login(region) {
+  const s = Y2();
+  const pending = await beginDeviceCodeFlow(region, "cli");
+  M2.info(`Your code is: ${pending.userCode}`);
+  M2.info(`Visit: ${pending.verificationUriComplete}`);
+  M2.info(`Code expires in: ${pending.expiresIn}s`);
+  const opened = pending.openInBrowser();
+  if (!opened) {
+    M2.warn("Could not open browser \u2014 please visit the URL above manually.");
+  }
+  s.start("Waiting for authorization...");
+  const auth2 = await pending.pollForToken();
+  s.stop("Authenticated! Token saved to ~/.cipherstash/auth.json");
+  M2.info(
+    `Token expires at: ${new Date(auth2.expiresAt * 1e3).toISOString()}`
+  );
+}
+async function bindDevice() {
+  const s = Y2();
+  s.start("Binding device to the default Keyset...");
+  try {
+    await bindClientDevice();
+    s.stop("Your device has been bound to the default Keyset!");
+  } catch (error) {
+    s.stop("Failed to bind your device to the default Keyset!");
+    M2.error(error instanceof Error ? error.message : "Unknown error");
+    process.exit(1);
+  }
+}
+
+// src/bin/commands/auth/index.ts
+var HELP = `
+Usage: stash auth <command>
+
+Commands:
+  login     Authenticate with CipherStash
+
+Examples:
+  stash auth login
+`.trim();
+async function authCommand(args) {
+  const subcommand = args[0];
+  if (!subcommand || subcommand === "--help" || subcommand === "-h") {
+    console.log(HELP);
+    return;
+  }
+  switch (subcommand) {
+    case "login":
+      {
+        const region = await selectRegion();
+        await login(region);
+        await bindDevice();
+      }
+      break;
+    default:
+      console.error(`Unknown auth command: ${subcommand}
+`);
+      console.log(HELP);
+      process.exit(1);
+  }
+}
+
 // src/bin/commands/init/providers/base.ts
 function createBaseProvider() {
   return {
@@ -1212,10 +1297,7 @@ function createBaseProvider() {
       { value: "raw-sql", label: "Raw SQL / pg" }
     ],
     getNextSteps(state) {
-      const steps = [
-        "Create a CipherStash account and get your credentials:\n   https://dashboard.cipherstash.com/sign-up\n   Then set: CS_WORKSPACE_CRN, CS_CLIENT_ID, CS_CLIENT_KEY, CS_CLIENT_ACCESS_KEY",
-        "Set up your database: npx stash-forge setup"
-      ];
+      const steps = ["Set up your database: npx stash-forge setup"];
       if (state.clientFilePath) {
         steps.push(`Edit your encryption schema: ${state.clientFilePath}`);
       }
@@ -1241,10 +1323,7 @@ function createSupabaseProvider() {
       { value: "raw-sql", label: "Raw SQL / pg" }
     ],
     getNextSteps(state) {
-      const steps = [
-        "Create a CipherStash account and get your credentials:\n   https://dashboard.cipherstash.com/sign-up\n   Then set: CS_WORKSPACE_CRN, CS_CLIENT_ID, CS_CLIENT_KEY, CS_CLIENT_ACCESS_KEY",
-        "Set up your database: npx stash-forge setup"
-      ];
+      const steps = ["Set up your database: npx stash-forge setup"];
       if (state.clientFilePath) {
         steps.push(`Edit your encryption schema: ${state.clientFilePath}`);
       }
@@ -1257,6 +1336,18 @@ function createSupabaseProvider() {
   };
 }
 
+// src/bin/commands/init/steps/authenticate.ts
+var authenticateStep = {
+  id: "authenticate",
+  name: "Authenticate with CipherStash",
+  async run(state, _provider) {
+    const region = await selectRegion();
+    await login(region);
+    await bindDevice();
+    return { ...state, authenticated: true };
+  }
+};
+
 // src/bin/commands/init/steps/build-schema.ts
 import { existsSync as existsSync2, mkdirSync, writeFileSync } from "node:fs";
 import { dirname, resolve as resolve2 } from "node:path";
@@ -1658,6 +1749,7 @@ var PROVIDER_MAP = {
   supabase: createSupabaseProvider
 };
 var STEPS = [
+  authenticateStep,
   selectConnectionStep,
   buildSchemaStep,
   installForgeStep,
@@ -1768,8 +1860,18 @@ var matchIndexOptsSchema = z2.object({
   m: z2.number().default(2048).optional(),
   include_original: z2.boolean().default(false).optional()
 });
+var arrayIndexModeSchema = z2.union([
+  z2.literal("all"),
+  z2.literal("none"),
+  z2.object({
+    item: z2.boolean().optional(),
+    wildcard: z2.boolean().optional(),
+    position: z2.boolean().optional()
+  })
+]);
 var steVecIndexOptsSchema = z2.object({
-  prefix: z2.string()
+  prefix: z2.string(),
+  array_index_mode: arrayIndexModeSchema.optional()
 });
 var indexesSchema = z2.object({
   ore: oreIndexOptsSchema.optional(),
@@ -1966,7 +2068,7 @@ var EncryptedColumn = class {
    */
   searchableJson() {
     this.castAsValue = "json";
-    this.indexesValue.ste_vec = { prefix: "enabled" };
+    this.indexesValue.ste_vec = { prefix: "enabled", array_index_mode: "all" };
     return this;
   }
   build() {
@@ -2014,6 +2116,7 @@ var EncryptedTable = class {
             indexes: {
               ...builtColumn.indexes,
               ste_vec: {
+                ...builtColumn.indexes.ste_vec,
                 prefix: `${this.tableName}/${colName}`
               }
             }
@@ -2075,69 +2178,6 @@ var EncryptionErrorTypes = {
   CtsTokenError: "CtsTokenError"
 };
 
-// src/utils/config/index.ts
-import fs from "node:fs";
-import path from "node:path";
-function getWorkspaceCrn(tomlString) {
-  let currentSection = "";
-  let workspaceCrn;
-  const lines = tomlString.split(/\r?\n/);
-  for (const line of lines) {
-    const trimmedLine = line.trim();
-    if (!trimmedLine || trimmedLine.startsWith("#")) {
-      continue;
-    }
-    const sectionMatch = trimmedLine.match(/^\[([^\]]+)\]$/);
-    if (sectionMatch) {
-      currentSection = sectionMatch[1];
-      continue;
-    }
-    const kvMatch = trimmedLine.match(/^(\w+)\s*=\s*"([^"]+)"$/);
-    if (kvMatch) {
-      const [_3, key, value] = kvMatch;
-      if (currentSection === "auth" && key === "workspace_crn") {
-        workspaceCrn = value;
-        break;
-      }
-    }
-  }
-  return workspaceCrn;
-}
-function extractWorkspaceIdFromCrn(crn) {
-  const match = crn.match(/crn:[^:]+:([^:]+)$/);
-  if (!match) {
-    throw new Error("Invalid CRN format");
-  }
-  return match[1];
-}
-function loadWorkSpaceId(suppliedCrn) {
-  const configPath = path.join(process.cwd(), "cipherstash.toml");
-  if (suppliedCrn) {
-    return extractWorkspaceIdFromCrn(suppliedCrn);
-  }
-  if (!fs.existsSync(configPath) && !process.env.CS_WORKSPACE_CRN) {
-    throw new Error(
-      "You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable."
-    );
-  }
-  if (process.env.CS_WORKSPACE_CRN) {
-    return extractWorkspaceIdFromCrn(process.env.CS_WORKSPACE_CRN);
-  }
-  if (!fs.existsSync(configPath)) {
-    throw new Error(
-      "You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable."
-    );
-  }
-  const tomlString = fs.readFileSync(configPath, "utf8");
-  const workspaceCrn = getWorkspaceCrn(tomlString);
-  if (!workspaceCrn) {
-    throw new Error(
-      "You have not defined a workspace CRN in your config file, or the CS_WORKSPACE_CRN environment variable."
-    );
-  }
-  return extractWorkspaceIdFromCrn(workspaceCrn);
-}
-
 // src/utils/logger/index.ts
 import { createRequestLogger, initLogger } from "evlog";
 var validLevels = ["debug", "info", "error"];
@@ -2631,11 +2671,11 @@ import {
   decryptBulk,
   encryptBulk
 } from "@cipherstash/protect-ffi";
-function setNestedValue(obj, path2, value) {
+function setNestedValue(obj, path, value) {
   const FORBIDDEN_KEYS = ["__proto__", "prototype", "constructor"];
   let current = obj;
-  for (let i = 0; i < path2.length - 1; i++) {
-    const part = path2[i];
+  for (let i = 0; i < path.length - 1; i++) {
+    const part = path[i];
     if (FORBIDDEN_KEYS.includes(part)) {
       throw new Error(`[encryption]: Forbidden key "${part}" in field path`);
     }
@@ -2644,7 +2684,7 @@ function setNestedValue(obj, path2, value) {
     }
     current = current[part];
   }
-  const lastKey = path2[path2.length - 1];
+  const lastKey = path[path.length - 1];
   if (FORBIDDEN_KEYS.includes(lastKey)) {
     throw new Error(`[encryption]: Forbidden key "${lastKey}" in field path`);
   }
@@ -2721,7 +2761,7 @@ function prepareFieldsForEncryption(model, table) {
         continue;
       }
       if (typeof value === "object" && !isEncryptedPayload(value) && !columnPaths2.includes(fullKey)) {
-        if (columnPaths2.some((path2) => path2.startsWith(fullKey))) {
+        if (columnPaths2.some((path) => path.startsWith(fullKey))) {
           processNestedFields(
             value,
             fullKey,
@@ -2899,7 +2939,7 @@ function prepareBulkModelsForOperation(models, table) {
           continue;
         }
         if (typeof value === "object" && !isEncryptedPayload(value) && !columnPaths.includes(fullKey)) {
-          if (columnPaths.some((path2) => path2.startsWith(fullKey))) {
+          if (columnPaths.some((path) => path.startsWith(fullKey))) {
             processNestedFields(
               value,
               fullKey,
@@ -4074,11 +4114,6 @@ var noClientError = () => new Error(
 var EncryptionClient = class {
   client;
   encryptConfig;
-  workspaceId;
-  constructor(workspaceCrn) {
-    const workspaceId = loadWorkSpaceId(workspaceCrn);
-    this.workspaceId = workspaceId;
-  }
   /**
    * Initializes the EncryptionClient with the provided configuration.
    * @internal
@@ -4100,10 +4135,10 @@ var EncryptionClient = class {
         this.client = await newClient({
           encryptConfig: validated,
           clientOpts: {
-            workspaceCrn: config3.workspaceCrn ?? process.env.CS_WORKSPACE_CRN,
-            accessKey: config3.accessKey ?? process.env.CS_CLIENT_ACCESS_KEY,
-            clientId: config3.clientId ?? process.env.CS_CLIENT_ID,
-            clientKey: config3.clientKey ?? process.env.CS_CLIENT_KEY,
+            workspaceCrn: config3.workspaceCrn,
+            accessKey: config3.accessKey,
+            clientId: config3.clientId,
+            clientKey: config3.clientKey,
             keyset: toFfiKeysetIdentifier(config3.keyset)
           }
         });
@@ -4488,12 +4523,6 @@ var EncryptionClient = class {
   bulkDecrypt(encryptedPayloads) {
     return new BulkDecryptOperation(this.client, encryptedPayloads);
   }
-  /** e.g., debugging or environment info */
-  clientInfo() {
-    return {
-      workspaceId: this.workspaceId
-    };
-  }
   /**
    * Get the encrypt config object.
    *
@@ -4515,7 +4544,7 @@ var Encryption = async (config3) => {
       "[encryption]: Invalid UUID provided for keyset id. Must be a valid UUID."
     );
   }
-  const client = new EncryptionClient(clientConfig?.workspaceCrn);
+  const client = new EncryptionClient();
   const encryptConfig = buildEncryptConfig(...schemas);
   const result = await client.init({
     encryptConfig,
@@ -4527,6 +4556,15 @@ var Encryption = async (config3) => {
   return result.data;
 };
 
+// src/utils/config/index.ts
+function extractWorkspaceIdFromCrn(crn) {
+  const match = crn.match(/crn:[^:]+:([^:]+)$/);
+  if (!match) {
+    throw new Error("Invalid CRN format");
+  }
+  return match[1];
+}
+
 // src/secrets/index.ts
 var Secrets = class {
   encryptionClient = null;
@@ -4589,14 +4627,14 @@ var Secrets = class {
    * For GET requests, `params` are appended as URL query parameters.
    * For POST requests, `body` is sent as JSON in the request body.
    */
-  async apiRequest(method, path2, options) {
+  async apiRequest(method, path, options) {
     try {
-      let url = `${this.apiBaseUrl}${path2}`;
+      let url = `${this.apiBaseUrl}${path}`;
       if (options?.params) {
         const searchParams = new URLSearchParams(options.params);
         url = `${url}?${searchParams.toString()}`;
       }
-      logger.debug(`Secrets API request: ${method} ${path2}`);
+      logger.debug(`Secrets API request: ${method} ${path}`);
       const headers = {
         "Content-Type": "application/json",
         Authorization: this.getAuthHeader()
@@ -4615,7 +4653,7 @@ var Secrets = class {
         } catch {
           errorMessage = errorText || errorMessage;
         }
-        logger.error(`Secrets API error on ${method} ${path2}: ${errorMessage}`);
+        logger.error(`Secrets API error on ${method} ${path}: ${errorMessage}`);
         return {
           failure: {
             type: "ApiError",
@@ -4623,12 +4661,12 @@ var Secrets = class {
           }
         };
       }
-      logger.debug(`Secrets API request successful: ${method} ${path2}`);
+      logger.debug(`Secrets API request successful: ${method} ${path}`);
       const data = await response.json();
       return { data };
     } catch (error) {
       const message = error instanceof Error ? error.message : "Unknown network error occurred";
-      logger.error(`Secrets network error on ${method} ${path2}: ${message}`);
+      logger.error(`Secrets network error on ${method} ${path}: ${message}`);
       return {
         failure: {
           type: "NetworkError",
@@ -5104,7 +5142,7 @@ function requireFlag(flags, name) {
   }
   return val;
 }
-var HELP = `
+var HELP2 = `
 ${style.title("Usage:")} stash secrets <command> [options]
 
 ${style.title("Commands:")}
@@ -5131,7 +5169,7 @@ async function secretsCommand(args) {
   const subcommand = args[0];
   const rest = args.slice(1);
   if (!subcommand || subcommand === "--help" || subcommand === "-h") {
-    console.log(HELP);
+    console.log(HELP2);
     return;
   }
   const flags = parseFlags(rest);
@@ -5181,7 +5219,7 @@ async function secretsCommand(args) {
     }
     default:
       console.error(style.error(`Unknown secrets command: ${subcommand}`));
-      console.log(HELP);
+      console.log(HELP2);
       process.exit(1);
   }
 }
@@ -5192,13 +5230,14 @@ var __dirname = dirname2(fileURLToPath(import.meta.url));
 var pkg = JSON.parse(
   readFileSync(join(__dirname, "../../package.json"), "utf-8")
 );
-var HELP2 = `
+var HELP3 = `
 CipherStash Stack CLI v${pkg.version}
 
 Usage: stash <command> [options]
 
 Commands:
   init       Initialize CipherStash for your project
+  auth       Authenticate with CipherStash
   secrets    Manage encrypted secrets
 
 Options:
@@ -5211,6 +5250,7 @@ Init Flags:
 Examples:
   stash init
   stash init --supabase
+  stash auth login
   stash secrets set -n DATABASE_URL -V "postgres://..." -e production
   stash secrets get -n DATABASE_URL -e production
   stash secrets get-many -n DATABASE_URL,API_KEY -e production
@@ -5235,7 +5275,7 @@ function parseArgs(argv) {
 async function main() {
   const { command, rest, booleanFlags } = parseArgs(process.argv);
   if (!command || command === "--help" || command === "-h") {
-    console.log(HELP2);
+    console.log(HELP3);
     return;
   }
   if (command === "--version" || command === "-v") {
@@ -5246,13 +5286,16 @@ async function main() {
     case "init":
       await initCommand(booleanFlags);
       break;
+    case "auth":
+      await authCommand(rest);
+      break;
     case "secrets":
       await secretsCommand(rest);
       break;
     default:
       console.error(`Unknown command: ${command}
 `);
-      console.log(HELP2);
+      console.log(HELP3);
       process.exit(1);
   }
 }