@cipherstash/stack 0.11.0 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @cipherstash/stack
 
+## 0.12.0
+
+### Minor Changes
+
+- 15764a8: Implement stack auth into stash cli flow.
+
 ## 0.11.0
 
 ### Minor Changes

package/README.md

@@ -44,19 +44,29 @@ pnpm add @cipherstash/stack
 
 ## Quick Start
 
+### 1. Initialize and authenticate your project
+
+```bash
+npx stash init
+```
+
+The wizard will authenticate you, walk you through choosing a database connection method, build an encryption schema, and install the required dependencies.
+
+### 2. Encrypt and decrypt
+
 ```typescript
 import { Encryption } from "@cipherstash/stack"
 import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
 
-// 1. Define a schema
+// Define a schema
 const users = encryptedTable("users", {
   email: encryptedColumn("email").equality().freeTextSearch(),
 })
 
-// 2. Create a client (reads CS_* env vars automatically)
+// Create a client
 const client = await Encryption({ schemas: [users] })
 
-// 3. Encrypt a value
+// Encrypt a value
 const encrypted = await client.encrypt("hello@example.com", {
   column: users.email,
   table: users,
@@ -68,7 +78,7 @@ if (encrypted.failure) {
   console.log("Encrypted payload:", encrypted.data)
 }
 
-// 4. Decrypt the value
+// Decrypt the value
 const decrypted = await client.decrypt(encrypted.data)
 
 if (decrypted.failure) {
@@ -430,6 +440,16 @@ await secrets.delete("DATABASE_URL")
 
 The `stash` CLI is bundled with the package and available after install.
 
+### `stash auth`
+
+Authenticate with CipherStash.
+
+```bash
+npx stash auth login
+```
+
+This runs the device code flow: it opens your browser, you confirm the code, and a token is saved to `~/.cipherstash/auth.json`. No environment variables or credentials files are needed for local development.
+
 ### `stash init`
 
 Initialize CipherStash for your project with an interactive wizard.
@@ -440,11 +460,13 @@ npx stash init --supabase
 ```
 
 The wizard will:
-1. Choose your database connection method (Drizzle ORM, Supabase JS, Prisma, or Raw SQL)
-2. Build an encryption schema interactively or use a placeholder, then generate the encryption client file
-3. Install `@cipherstash/stack-forge` as a dev dependency for database tooling
+1. Authenticate with CipherStash (device code flow)
+2. Bind your device to the default Keyset
+3. Choose your database connection method (Drizzle ORM, Supabase JS, Prisma, or Raw SQL)
+4. Build an encryption schema interactively or use a placeholder, then generate the encryption client file
+5. Install `@cipherstash/stack-forge` as a dev dependency for database tooling
 
-After `stash init`, create a CipherStash account at [dashboard.cipherstash.com/sign-up](https://dashboard.cipherstash.com/sign-up) to get your credentials, then run `npx stash-forge setup` to configure your database connection.
+After `stash init`, run `npx stash-forge setup` to configure your database.
 
 | Flag | Description |
 |------|-------------|
@@ -468,11 +490,15 @@ npx stash secrets delete -name DATABASE_URL -environment production
 | `stash secrets list` | `-environment` | `-e` | List all secret names in an environment |
 | `stash secrets delete` | `-name`, `-environment`, `-yes` | `-n`, `-e`, `-y` | Delete a secret (prompts for confirmation unless `-yes`) |
 
-The CLI reads credentials from the same `CS_*` environment variables described in [Configuration](#configuration).
-
 ## Configuration
 
-### Environment Variables
+### Local Development
+
+No environment variables or credentials are needed for local development. Run `npx @cipherstash/stack auth login` to authenticate via the device code flow, and the SDK and CLI will use the token saved to `~/.cipherstash/auth.json`.
+
+### Going to Production
+
+For production, CI/CD, and deployed environments, you'll need to set up machine credentials via environment variables:
 
 | Variable | Description |
 |-----|-------|
@@ -481,13 +507,7 @@ The CLI reads credentials from the same `CS_*` environment variables described i
 | `CS_CLIENT_KEY` | Client key material used with ZeroKMS for encryption |
 | `CS_CLIENT_ACCESS_KEY` | API key for authenticating with the CipherStash API |
 
-Store these in a `.env` file or set them in your hosting platform.
-
-Sign up at [cipherstash.com/signup](https://cipherstash.com/signup) and follow the onboarding to generate credentials.
-
-### TOML Config
-
-You can also configure credentials via `cipherstash.toml` and `cipherstash.secret.toml` files in your project root. See the [CipherStash docs](https://cipherstash.com/docs) for format details.
+See the [Going to Production](https://cipherstash.com/docs/stack/going-to-production) guide for full details on creating machine clients, setting up access keys, and configuring CI/CD pipelines.
 
 ### Programmatic Config
 

package/dist/bin/stash.js

@@ -1200,6 +1200,91 @@ var Y2 = ({ indicator: t = "dots" } = {}) => {
   } };
 };
 
+// src/bin/commands/auth/login.ts
+import auth from "@cipherstash/auth";
+var { beginDeviceCodeFlow, bindClientDevice } = auth;
+var regions = [
+  { value: "ap-southeast-2.aws", label: "Asia Pacific (Sydney)" },
+  { value: "eu-central-1.aws", label: "Europe (Frankfurt)" },
+  { value: "eu-west-1.aws", label: "Europe (Ireland)" },
+  { value: "us-east-1.aws", label: "US East (N. Virginia)" },
+  { value: "us-east-2.aws", label: "US East (Ohio)" },
+  { value: "us-west-1.aws", label: "US West (N. California)" },
+  { value: "us-west-2.aws", label: "US West (Oregon)" }
+];
+async function selectRegion() {
+  const region = await ve({
+    message: "Select a region",
+    options: regions
+  });
+  if (pD(region)) {
+    xe("Cancelled.");
+    process.exit(0);
+  }
+  return region;
+}
+async function login(region) {
+  const s = Y2();
+  const pending = await beginDeviceCodeFlow(region, "cli");
+  M2.info(`Your code is: ${pending.userCode}`);
+  M2.info(`Visit: ${pending.verificationUriComplete}`);
+  M2.info(`Code expires in: ${pending.expiresIn}s`);
+  const opened = pending.openInBrowser();
+  if (!opened) {
+    M2.warn("Could not open browser \u2014 please visit the URL above manually.");
+  }
+  s.start("Waiting for authorization...");
+  const auth2 = await pending.pollForToken();
+  s.stop("Authenticated! Token saved to ~/.cipherstash/auth.json");
+  M2.info(
+    `Token expires at: ${new Date(auth2.expiresAt * 1e3).toISOString()}`
+  );
+}
+async function bindDevice() {
+  const s = Y2();
+  s.start("Binding device to the default Keyset...");
+  try {
+    await bindClientDevice();
+    s.stop("Your device has been bound to the default Keyset!");
+  } catch (error) {
+    s.stop("Failed to bind your device to the default Keyset!");
+    M2.error(error instanceof Error ? error.message : "Unknown error");
+    process.exit(1);
+  }
+}
+
+// src/bin/commands/auth/index.ts
+var HELP = `
+Usage: stash auth <command>
+
+Commands:
+  login     Authenticate with CipherStash
+
+Examples:
+  stash auth login
+`.trim();
+async function authCommand(args) {
+  const subcommand = args[0];
+  if (!subcommand || subcommand === "--help" || subcommand === "-h") {
+    console.log(HELP);
+    return;
+  }
+  switch (subcommand) {
+    case "login":
+      {
+        const region = await selectRegion();
+        await login(region);
+        await bindDevice();
+      }
+      break;
+    default:
+      console.error(`Unknown auth command: ${subcommand}
+`);
+      console.log(HELP);
+      process.exit(1);
+  }
+}
+
 // src/bin/commands/init/providers/base.ts
 function createBaseProvider() {
   return {
@@ -1212,10 +1297,7 @@ function createBaseProvider() {
       { value: "raw-sql", label: "Raw SQL / pg" }
     ],
     getNextSteps(state) {
-      const steps = [
-        "Create a CipherStash account and get your credentials:\n   https://dashboard.cipherstash.com/sign-up\n   Then set: CS_WORKSPACE_CRN, CS_CLIENT_ID, CS_CLIENT_KEY, CS_CLIENT_ACCESS_KEY",
-        "Set up your database: npx stash-forge setup"
-      ];
+      const steps = ["Set up your database: npx stash-forge setup"];
       if (state.clientFilePath) {
         steps.push(`Edit your encryption schema: ${state.clientFilePath}`);
       }
@@ -1241,10 +1323,7 @@ function createSupabaseProvider() {
       { value: "raw-sql", label: "Raw SQL / pg" }
     ],
     getNextSteps(state) {
-      const steps = [
-        "Create a CipherStash account and get your credentials:\n   https://dashboard.cipherstash.com/sign-up\n   Then set: CS_WORKSPACE_CRN, CS_CLIENT_ID, CS_CLIENT_KEY, CS_CLIENT_ACCESS_KEY",
-        "Set up your database: npx stash-forge setup"
-      ];
+      const steps = ["Set up your database: npx stash-forge setup"];
       if (state.clientFilePath) {
         steps.push(`Edit your encryption schema: ${state.clientFilePath}`);
       }
@@ -1257,6 +1336,18 @@ function createSupabaseProvider() {
   };
 }
 
+// src/bin/commands/init/steps/authenticate.ts
+var authenticateStep = {
+  id: "authenticate",
+  name: "Authenticate with CipherStash",
+  async run(state, _provider) {
+    const region = await selectRegion();
+    await login(region);
+    await bindDevice();
+    return { ...state, authenticated: true };
+  }
+};
+
 // src/bin/commands/init/steps/build-schema.ts
 import { existsSync as existsSync2, mkdirSync, writeFileSync } from "node:fs";
 import { dirname, resolve as resolve2 } from "node:path";
@@ -1658,6 +1749,7 @@ var PROVIDER_MAP = {
   supabase: createSupabaseProvider
 };
 var STEPS = [
+  authenticateStep,
   selectConnectionStep,
   buildSchemaStep,
   installForgeStep,
@@ -5050,7 +5142,7 @@ function requireFlag(flags, name) {
   }
   return val;
 }
-var HELP = `
+var HELP2 = `
 ${style.title("Usage:")} stash secrets <command> [options]
 
 ${style.title("Commands:")}
@@ -5077,7 +5169,7 @@ async function secretsCommand(args) {
   const subcommand = args[0];
   const rest = args.slice(1);
   if (!subcommand || subcommand === "--help" || subcommand === "-h") {
-    console.log(HELP);
+    console.log(HELP2);
     return;
   }
   const flags = parseFlags(rest);
@@ -5127,7 +5219,7 @@ async function secretsCommand(args) {
     }
     default:
       console.error(style.error(`Unknown secrets command: ${subcommand}`));
-      console.log(HELP);
+      console.log(HELP2);
       process.exit(1);
   }
 }
@@ -5138,13 +5230,14 @@ var __dirname = dirname2(fileURLToPath(import.meta.url));
 var pkg = JSON.parse(
   readFileSync(join(__dirname, "../../package.json"), "utf-8")
 );
-var HELP2 = `
+var HELP3 = `
 CipherStash Stack CLI v${pkg.version}
 
 Usage: stash <command> [options]
 
 Commands:
   init       Initialize CipherStash for your project
+  auth       Authenticate with CipherStash
   secrets    Manage encrypted secrets
 
 Options:
@@ -5157,6 +5250,7 @@ Init Flags:
 Examples:
   stash init
   stash init --supabase
+  stash auth login
   stash secrets set -n DATABASE_URL -V "postgres://..." -e production
   stash secrets get -n DATABASE_URL -e production
   stash secrets get-many -n DATABASE_URL,API_KEY -e production
@@ -5181,7 +5275,7 @@ function parseArgs(argv) {
 async function main() {
   const { command, rest, booleanFlags } = parseArgs(process.argv);
   if (!command || command === "--help" || command === "-h") {
-    console.log(HELP2);
+    console.log(HELP3);
     return;
   }
   if (command === "--version" || command === "-v") {
@@ -5192,13 +5286,16 @@ async function main() {
     case "init":
       await initCommand(booleanFlags);
       break;
+    case "auth":
+      await authCommand(rest);
+      break;
     case "secrets":
       await secretsCommand(rest);
       break;
     default:
       console.error(`Unknown command: ${command}
 `);
-      console.log(HELP2);
+      console.log(HELP3);
       process.exit(1);
   }
 }