@cipherstash/stack 0.7.0 → 0.9.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @cipherstash/stack
 
+## 0.9.0
+
+### Minor Changes
+
+- 2b907a1: Improve CLI user experience for developer onboarding.
+
+## 0.8.0
+
+### Minor Changes
+
+- 3414761: Fixed Supabase or wrapper to escape EQL payloads correctly.
+
 ## 0.7.0
 
 ### Minor Changes

package/README.md

@@ -85,7 +85,7 @@ if (decrypted.failure) {
 - **Bulk operations** - Encrypt or decrypt thousands of values in a single ZeroKMS call (`bulkEncrypt`, `bulkDecrypt`, `bulkEncryptModels`, `bulkDecryptModels`).
 - **Identity-aware encryption** - Tie encryption to a user's JWT via `LockContext`, so only that user can decrypt.
 - **Secrets management** - Store, retrieve, list, and delete encrypted secrets with the `Secrets` class.
-- **CLI (`stash`)** - Manage secrets from the terminal without writing code.
+- **CLI (`stash`)** - Initialize projects, manage secrets, and set up encryption from the terminal.
 - **TypeScript-first** - Strongly typed schemas, results, and model operations with full generics support.
 
 ## Schema Definition
@@ -287,6 +287,14 @@ await supabase.from("users").select().eq("email", term.data)
 
 Each term in a batch can have its own `returnType`.
 
+### Ordering Encrypted Data
+
+**`ORDER BY` on encrypted columns requires operator family support in the database.**
+
+On databases without operator families (e.g. Supabase, or when EQL is installed with `--exclude-operator-family`), sorting on encrypted columns is not currently supported — regardless of the client or ORM used. Sort application-side after decrypting the results as a workaround.
+
+Operator family support for Supabase is being developed in collaboration with the Supabase and CipherStash teams and will be available in a future release.
+
 ### PostgreSQL / Drizzle Integration Pattern
 
 Encrypted data is stored as an [EQL](https://github.com/cipherstash/encrypt-query-language) JSON payload. Install the EQL extension in PostgreSQL to enable searchable queries, then store encrypted data in `eql_v2_encrypted` columns.
@@ -422,6 +430,30 @@ await secrets.delete("DATABASE_URL")
 
 The `stash` CLI is bundled with the package and available after install.
 
+### `stash init`
+
+Initialize CipherStash for your project with an interactive wizard.
+
+```bash
+npx stash init
+npx stash init --supabase
+```
+
+The wizard will:
+1. Choose your database connection method (Drizzle ORM, Supabase JS, Prisma, or Raw SQL)
+2. Build an encryption schema interactively or use a placeholder, then generate the encryption client file
+3. Install `@cipherstash/stack-forge` as a dev dependency for database tooling
+
+After `stash init`, create a CipherStash account at [dashboard.cipherstash.com/sign-up](https://dashboard.cipherstash.com/sign-up) to get your credentials, then run `npx stash-forge setup` to configure your database connection.
+
+| Flag | Description |
+|------|-------------|
+| `--supabase` | Use Supabase-specific setup flow |
+
+### `stash secrets`
+
+Manage encrypted secrets from the terminal.
+
 ```bash
 npx stash secrets set  -name DATABASE_URL -value "postgres://..." -environment production
 npx stash secrets get  -name DATABASE_URL -environment production
@@ -429,8 +461,6 @@ npx stash secrets list -environment production
 npx stash secrets delete -name DATABASE_URL -environment production
 ```
 
-### Commands
-
 | Command | Flags | Aliases | Description |
 |-----|----|-----|-------|
 | `stash secrets set` | `-name`, `-value`, `-environment` | `-n`, `-V`, `-e` | Encrypt and store a secret |