@cipherstash/stack 0.11.0 → 0.13.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @cipherstash/stack
 
+## 0.13.0
+
+### Minor Changes
+
+- 068f820: Release the consolidated CipherStash CLI npm package.
+
+## 0.12.0
+
+### Minor Changes
+
+- 15764a8: Implement stack auth into stash cli flow.
+
 ## 0.11.0
 
 ### Minor Changes

package/README.md

@@ -44,19 +44,29 @@ pnpm add @cipherstash/stack
 
 ## Quick Start
 
+### 1. Initialize and authenticate your project
+
+```bash
+npx @cipherstash/cli init
+```
+
+The wizard will authenticate you, walk you through choosing a database connection method, build an encryption schema, and install the required dependencies.
+
+### 2. Encrypt and decrypt
+
 ```typescript
 import { Encryption } from "@cipherstash/stack"
 import { encryptedTable, encryptedColumn } from "@cipherstash/stack/schema"
 
-// 1. Define a schema
+// Define a schema
 const users = encryptedTable("users", {
   email: encryptedColumn("email").equality().freeTextSearch(),
 })
 
-// 2. Create a client (reads CS_* env vars automatically)
+// Create a client
 const client = await Encryption({ schemas: [users] })
 
-// 3. Encrypt a value
+// Encrypt a value
 const encrypted = await client.encrypt("hello@example.com", {
   column: users.email,
   table: users,
@@ -68,7 +78,7 @@ if (encrypted.failure) {
   console.log("Encrypted payload:", encrypted.data)
 }
 
-// 4. Decrypt the value
+// Decrypt the value
 const decrypted = await client.decrypt(encrypted.data)
 
 if (decrypted.failure) {
@@ -428,51 +438,67 @@ await secrets.delete("DATABASE_URL")
 
 ## CLI Reference
 
-The `stash` CLI is bundled with the package and available after install.
+The CLI is available via `npx @cipherstash/cli` after install.
+
+### `npx @cipherstash/cli auth`
+
+Authenticate with CipherStash.
 
-### `stash init`
+```bash
+npx @cipherstash/cli auth login
+```
+
+This runs the device code flow: it opens your browser, you confirm the code, and a token is saved to `~/.cipherstash/auth.json`. No environment variables or credentials files are needed for local development.
+
+### `npx @cipherstash/cli init`
 
 Initialize CipherStash for your project with an interactive wizard.
 
 ```bash
-npx stash init
-npx stash init --supabase
+npx @cipherstash/cli init
+npx @cipherstash/cli init --supabase
 ```
 
 The wizard will:
-1. Choose your database connection method (Drizzle ORM, Supabase JS, Prisma, or Raw SQL)
-2. Build an encryption schema interactively or use a placeholder, then generate the encryption client file
-3. Install `@cipherstash/stack-forge` as a dev dependency for database tooling
+1. Authenticate with CipherStash (device code flow)
+2. Bind your device to the default Keyset
+3. Choose your database connection method (Drizzle ORM, Supabase JS, Prisma, or Raw SQL)
+4. Build an encryption schema interactively or use a placeholder, then generate the encryption client file
+5. Install `@cipherstash/cli` as a dev dependency for database tooling
 
-After `stash init`, create a CipherStash account at [dashboard.cipherstash.com/sign-up](https://dashboard.cipherstash.com/sign-up) to get your credentials, then run `npx stash-forge setup` to configure your database connection.
+After init, run `npx @cipherstash/cli db setup` to configure your database.
 
 | Flag | Description |
 |------|-------------|
 | `--supabase` | Use Supabase-specific setup flow |
 
-### `stash secrets`
+### `npx @cipherstash/cli secrets`
 
 Manage encrypted secrets from the terminal.
 
 ```bash
-npx stash secrets set  -name DATABASE_URL -value "postgres://..." -environment production
-npx stash secrets get  -name DATABASE_URL -environment production
-npx stash secrets list -environment production
-npx stash secrets delete -name DATABASE_URL -environment production
+npx @cipherstash/cli secrets set  -name DATABASE_URL -value "postgres://..." -environment production
+npx @cipherstash/cli secrets get  -name DATABASE_URL -environment production
+npx @cipherstash/cli secrets list -environment production
+npx @cipherstash/cli secrets delete -name DATABASE_URL -environment production
 ```
 
 | Command | Flags | Aliases | Description |
 |-----|----|-----|-------|
-| `stash secrets set` | `-name`, `-value`, `-environment` | `-n`, `-V`, `-e` | Encrypt and store a secret |
-| `stash secrets get` | `-name`, `-environment` | `-n`, `-e` | Retrieve and decrypt a secret |
-| `stash secrets list` | `-environment` | `-e` | List all secret names in an environment |
-| `stash secrets delete` | `-name`, `-environment`, `-yes` | `-n`, `-e`, `-y` | Delete a secret (prompts for confirmation unless `-yes`) |
-
-The CLI reads credentials from the same `CS_*` environment variables described in [Configuration](#configuration).
+| `npx @cipherstash/cli secrets set` | `-name`, `-value`, `-environment` | `-n`, `-V`, `-e` | Encrypt and store a secret |
+| `npx @cipherstash/cli secrets get` | `-name`, `-environment` | `-n`, `-e` | Retrieve and decrypt a secret |
+| `npx @cipherstash/cli secrets list` | `-environment` | `-e` | List all secret names in an environment |
+| `npx @cipherstash/cli secrets delete` | `-name`, `-environment`, `-yes` | `-n`, `-e`, `-y` | Delete a secret (prompts for confirmation unless `-yes`) |
 
 ## Configuration
 
-### Environment Variables
+### Local Development
+
+No environment variables or credentials are needed for local development. Run `npx @cipherstash/stack auth login` to authenticate via the device code flow, and the SDK and CLI will use the token saved to `~/.cipherstash/auth.json`.
+
+### Going to Production
+
+For production, CI/CD, and deployed environments, you'll need to set up machine credentials via environment variables:
 
 | Variable | Description |
 |-----|-------|
@@ -481,13 +507,7 @@ The CLI reads credentials from the same `CS_*` environment variables described i
 | `CS_CLIENT_KEY` | Client key material used with ZeroKMS for encryption |
 | `CS_CLIENT_ACCESS_KEY` | API key for authenticating with the CipherStash API |
 
-Store these in a `.env` file or set them in your hosting platform.
-
-Sign up at [cipherstash.com/signup](https://cipherstash.com/signup) and follow the onboarding to generate credentials.
-
-### TOML Config
-
-You can also configure credentials via `cipherstash.toml` and `cipherstash.secret.toml` files in your project root. See the [CipherStash docs](https://cipherstash.com/docs) for format details.
+See the [Going to Production](https://cipherstash.com/docs/stack/going-to-production) guide for full details on creating machine clients, setting up access keys, and configuring CI/CD pipelines.
 
 ### Programmatic Config
 
@@ -656,7 +676,7 @@ If you are migrating from `@cipherstash/protect`, the following table maps the o
 | `csColumn(name)` | `encryptedColumn(name)` | `@cipherstash/stack/schema` |
 | `import { LockContext } from "@cipherstash/protect/identify"` | `import { LockContext } from "@cipherstash/stack/identity"` | `@cipherstash/stack/identity` |
 | N/A | `Secrets` class | `@cipherstash/stack/secrets` |
-| N/A | `stash` CLI | `npx stash` |
+| N/A | CLI | `npx @cipherstash/cli` |
 
 All method signatures on the encryption client (`encrypt`, `decrypt`, `encryptModel`, etc.) remain the same. The `Result` pattern (`data` / `failure`) is unchanged.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cipherstash/stack",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "CipherStash Stack for TypeScript and JavaScript",
   "keywords": [
     "encrypted",
@@ -27,9 +27,6 @@
     "CHANGELOG.md"
   ],
   "type": "module",
-  "bin": {
-    "stash": "./dist/bin/stash.js"
-  },
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "sideEffects": false,
@@ -199,10 +196,10 @@
     "access": "public"
   },
   "dependencies": {
-    "@byteslice/result": "^0.2.0",
-    "@cipherstash/protect-ffi": "0.21.0",
-    "evlog": "^1.9.0",
-    "uuid": "^13.0.0",
+    "@byteslice/result": "0.2.0",
+    "@cipherstash/protect-ffi": "0.21.2",
+    "evlog": "1.9.0",
+    "uuid": "13.0.0",
     "zod": "3.24.2"
   },
   "peerDependencies": {
@@ -222,7 +219,6 @@
   },
   "scripts": {
     "build": "tsup",
-    "postbuild": "chmod +x ./dist/bin/stash.js",
     "dev": "tsup --watch",
     "test": "vitest run",
     "release": "tsup"