@cipherstash/stack 0.7.0 → 0.9.0

package/dist/bin/stash.js

@@ -500,7 +500,7 @@ var require_picocolors = __commonJS({
 // src/bin/stash.ts
 var import_dotenv2 = __toESM(require_main(), 1);
 import { readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { dirname as dirname2, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // ../../node_modules/.pnpm/@clack+prompts@0.10.1/node_modules/@clack/prompts/dist/index.mjs
@@ -855,6 +855,41 @@ var dD = class extends x {
 };
 var A;
 A = /* @__PURE__ */ new WeakMap();
+var kD = Object.defineProperty;
+var $D = (e2, u2, t) => u2 in e2 ? kD(e2, u2, { enumerable: true, configurable: true, writable: true, value: t }) : e2[u2] = t;
+var H = (e2, u2, t) => ($D(e2, typeof u2 != "symbol" ? u2 + "" : u2, t), t);
+var SD = class extends x {
+  constructor(u2) {
+    super(u2, false), H(this, "options"), H(this, "cursor", 0), this.options = u2.options, this.value = [...u2.initialValues ?? []], this.cursor = Math.max(this.options.findIndex(({ value: t }) => t === u2.cursorAt), 0), this.on("key", (t) => {
+      t === "a" && this.toggleAll();
+    }), this.on("cursor", (t) => {
+      switch (t) {
+        case "left":
+        case "up":
+          this.cursor = this.cursor === 0 ? this.options.length - 1 : this.cursor - 1;
+          break;
+        case "down":
+        case "right":
+          this.cursor = this.cursor === this.options.length - 1 ? 0 : this.cursor + 1;
+          break;
+        case "space":
+          this.toggleValue();
+          break;
+      }
+    });
+  }
+  get _value() {
+    return this.options[this.cursor].value;
+  }
+  toggleAll() {
+    const u2 = this.value.length === this.options.length;
+    this.value = u2 ? [] : this.options.map((t) => t.value);
+  }
+  toggleValue() {
+    const u2 = this.value.includes(this._value);
+    this.value = u2 ? this.value.filter((t) => t !== this._value) : [...this.value, this._value];
+  }
+};
 var OD = Object.defineProperty;
 var PD = (e2, u2, t) => u2 in e2 ? OD(e2, u2, { enumerable: true, configurable: true, writable: true, value: t }) : e2[u2] = t;
 var J = (e2, u2, t) => (PD(e2, typeof u2 != "symbol" ? u2 + "" : u2, t), t);
@@ -1023,6 +1058,46 @@ ${import_picocolors2.default.cyan(d2)}
     }
   } }).prompt();
 };
+var fe = (t) => {
+  const n = (r, i) => {
+    const s = r.label ?? String(r.value);
+    return i === "active" ? `${import_picocolors2.default.cyan(A2)} ${s} ${r.hint ? import_picocolors2.default.dim(`(${r.hint})`) : ""}` : i === "selected" ? `${import_picocolors2.default.green(T)} ${import_picocolors2.default.dim(s)} ${r.hint ? import_picocolors2.default.dim(`(${r.hint})`) : ""}` : i === "cancelled" ? `${import_picocolors2.default.strikethrough(import_picocolors2.default.dim(s))}` : i === "active-selected" ? `${import_picocolors2.default.green(T)} ${s} ${r.hint ? import_picocolors2.default.dim(`(${r.hint})`) : ""}` : i === "submitted" ? `${import_picocolors2.default.dim(s)}` : `${import_picocolors2.default.dim(F)} ${import_picocolors2.default.dim(s)}`;
+  };
+  return new SD({ options: t.options, initialValues: t.initialValues, required: t.required ?? true, cursorAt: t.cursorAt, validate(r) {
+    if (this.required && r.length === 0) return `Please select at least one option.
+${import_picocolors2.default.reset(import_picocolors2.default.dim(`Press ${import_picocolors2.default.gray(import_picocolors2.default.bgWhite(import_picocolors2.default.inverse(" space ")))} to select, ${import_picocolors2.default.gray(import_picocolors2.default.bgWhite(import_picocolors2.default.inverse(" enter ")))} to submit`))}`;
+  }, render() {
+    const r = `${import_picocolors2.default.gray(o)}
+${b2(this.state)}  ${t.message}
+`, i = (s, c) => {
+      const a = this.value.includes(s.value);
+      return c && a ? n(s, "active-selected") : a ? n(s, "selected") : n(s, c ? "active" : "inactive");
+    };
+    switch (this.state) {
+      case "submit":
+        return `${r}${import_picocolors2.default.gray(o)}  ${this.options.filter(({ value: s }) => this.value.includes(s)).map((s) => n(s, "submitted")).join(import_picocolors2.default.dim(", ")) || import_picocolors2.default.dim("none")}`;
+      case "cancel": {
+        const s = this.options.filter(({ value: c }) => this.value.includes(c)).map((c) => n(c, "cancelled")).join(import_picocolors2.default.dim(", "));
+        return `${r}${import_picocolors2.default.gray(o)}  ${s.trim() ? `${s}
+${import_picocolors2.default.gray(o)}` : ""}`;
+      }
+      case "error": {
+        const s = this.error.split(`
+`).map((c, a) => a === 0 ? `${import_picocolors2.default.yellow(d2)}  ${import_picocolors2.default.yellow(c)}` : `   ${c}`).join(`
+`);
+        return `${r + import_picocolors2.default.yellow(o)}  ${G2({ options: this.options, cursor: this.cursor, maxItems: t.maxItems, style: i }).join(`
+${import_picocolors2.default.yellow(o)}  `)}
+${s}
+`;
+      }
+      default:
+        return `${r}${import_picocolors2.default.cyan(o)}  ${G2({ options: this.options, cursor: this.cursor, maxItems: t.maxItems, style: i }).join(`
+${import_picocolors2.default.cyan(o)}  `)}
+${import_picocolors2.default.cyan(d2)}
+`;
+    }
+  } }).prompt();
+};
 var Me = (t = "", n = "") => {
   const r = `
 ${t}
@@ -1097,7 +1172,7 @@ var Y2 = ({ indicator: t = "dots" } = {}) => {
   }, R2 = (m2) => m2.replace(/\.+$/, ""), O2 = (m2) => {
     const h2 = (performance.now() - m2) / 1e3, w2 = Math.floor(h2 / 60), I2 = Math.floor(h2 % 60);
     return w2 > 0 ? `[${w2}m ${I2}s]` : `[${I2}s]`;
-  }, H = (m2 = "") => {
+  }, H2 = (m2 = "") => {
     a = true, s = fD(), l2 = R2(m2), g2 = performance.now(), process.stdout.write(`${import_picocolors2.default.gray(o)}
 `);
     let h2 = 0, w2 = 0;
@@ -1120,7 +1195,7 @@ var Y2 = ({ indicator: t = "dots" } = {}) => {
 `) : process.stdout.write(`${w2}  ${l2}
 `), E(), s();
   };
-  return { start: H, stop: N2, message: (m2 = "") => {
+  return { start: H2, stop: N2, message: (m2 = "") => {
     l2 = R2(m2 ?? l2);
   } };
 };
@@ -1131,23 +1206,20 @@ function createBaseProvider() {
     name: "base",
     introMessage: "Setting up CipherStash for your project...",
     connectionOptions: [
-      { value: "drizzle", label: "Drizzle ORM", hint: "recommended" },
+      { value: "drizzle", label: "Drizzle ORM" },
+      { value: "supabase-js", label: "Supabase JS Client" },
       { value: "prisma", label: "Prisma" },
       { value: "raw-sql", label: "Raw SQL / pg" }
     ],
     getNextSteps(state) {
       const steps = [
-        "Install @cipherstash/stack: npm install @cipherstash/stack"
+        "Create a CipherStash account and get your credentials:\n   https://dashboard.cipherstash.com/sign-up\n   Then set: CS_WORKSPACE_CRN, CS_CLIENT_ID, CS_CLIENT_KEY, CS_CLIENT_ACCESS_KEY",
+        "Set up your database: npx stash-forge setup"
       ];
-      if (state.connectionMethod === "drizzle") {
-        steps.push("Import encryptedType from @cipherstash/stack/drizzle");
-      } else if (state.connectionMethod === "prisma") {
-        steps.push("Set up Prisma with @cipherstash/stack");
+      if (state.clientFilePath) {
+        steps.push(`Edit your encryption schema: ${state.clientFilePath}`);
       }
-      steps.push(
-        "Define your encrypted schema",
-        "Read the docs: https://docs.cipherstash.com"
-      );
+      steps.push("Read the docs: https://cipherstash.com/docs");
       return steps;
     }
   };
@@ -1170,20 +1242,14 @@ function createSupabaseProvider() {
     ],
     getNextSteps(state) {
       const steps = [
-        "Install @cipherstash/stack: npm install @cipherstash/stack"
+        "Create a CipherStash account and get your credentials:\n   https://dashboard.cipherstash.com/sign-up\n   Then set: CS_WORKSPACE_CRN, CS_CLIENT_ID, CS_CLIENT_KEY, CS_CLIENT_ACCESS_KEY",
+        "Set up your database: npx stash-forge setup"
       ];
-      if (state.connectionMethod === "supabase-js") {
-        steps.push("Import encryptedSupabase from @cipherstash/stack/supabase");
-      } else if (state.connectionMethod === "drizzle") {
-        steps.push("Import encryptedType from @cipherstash/stack/drizzle");
-      } else if (state.connectionMethod === "prisma") {
-        steps.push("Set up Prisma with @cipherstash/stack");
+      if (state.clientFilePath) {
+        steps.push(`Edit your encryption schema: ${state.clientFilePath}`);
       }
       steps.push(
-        "Define your encrypted schema",
-        "Supabase guides: https://cipherstash.com/docs/supabase/encrypt-user-data",
-        "Multi-tenant encryption: https://docs.cipherstash.com/docs/multi-tenant",
-        "Migrating existing data: https://docs.cipherstash.com/docs/migration",
+        "Supabase guides: https://cipherstash.com/docs/stack/encryption/supabase",
         "Need help? #supabase in Discord or support@cipherstash.com"
       );
       return steps;
@@ -1191,46 +1257,9 @@ function createSupabaseProvider() {
   };
 }
 
-// src/bin/commands/init/stubs.ts
-function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-async function startDeviceCodeAuth() {
-  await delay(500);
-  return {
-    verificationUrl: "https://cipherstash.com/activate",
-    userCode: "ABCD-1234",
-    deviceCode: "device_code_placeholder",
-    expiresIn: 900,
-    interval: 5
-  };
-}
-async function pollForToken(deviceCode) {
-  void deviceCode;
-  await delay(2e3);
-  return {
-    accessToken: "stub_access_token",
-    refreshToken: "stub_refresh_token",
-    expiresIn: 3600
-  };
-}
-async function fetchWorkspaces(accessToken) {
-  void accessToken;
-  await delay(300);
-  return [
-    { id: "ws_1", name: "My First Workspace" },
-    { id: "ws_2", name: "Production" }
-  ];
-}
-async function createWorkspace(accessToken, name) {
-  void accessToken;
-  await delay(500);
-  return { id: `ws_${Date.now()}`, name };
-}
-async function installEqlExtension(databaseUrl) {
-  void databaseUrl;
-  await delay(1500);
-}
+// src/bin/commands/init/steps/build-schema.ts
+import { existsSync as existsSync2, mkdirSync, writeFileSync } from "node:fs";
+import { dirname, resolve as resolve2 } from "node:path";
 
 // src/bin/commands/init/types.ts
 var CancelledError = class extends Error {
@@ -1239,104 +1268,343 @@ var CancelledError = class extends Error {
     this.name = "CancelledError";
   }
 };
+function toIntegration(method) {
+  switch (method) {
+    case "drizzle":
+      return "drizzle";
+    case "supabase-js":
+      return "supabase";
+    case "prisma":
+    case "raw-sql":
+      return "postgresql";
+  }
+}
 
-// src/bin/commands/init/steps/authenticate.ts
-var authenticateStep = {
-  id: "authenticate",
-  name: "Authenticate",
-  async run(state, _provider) {
-    const s = Y2();
-    s.start("Starting authentication...");
-    const { verificationUrl, userCode, deviceCode } = await startDeviceCodeAuth();
-    s.stop("Authentication started");
-    Me(
-      `Open:  ${verificationUrl}
-Code:  ${userCode}`,
-      "Authenticate with CipherStash"
-    );
-    s.start("Waiting for authentication...");
-    const token = await pollForToken(deviceCode);
-    s.stop("Authenticated successfully");
-    return { ...state, accessToken: token.accessToken };
+// src/bin/commands/init/utils.ts
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+function isPackageInstalled(packageName) {
+  const modulePath = resolve(process.cwd(), "node_modules", packageName);
+  return existsSync(modulePath);
+}
+function detectPackageManager() {
+  const cwd = process.cwd();
+  if (existsSync(resolve(cwd, "bun.lockb")) || existsSync(resolve(cwd, "bun.lock")))
+    return "bun";
+  if (existsSync(resolve(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync(resolve(cwd, "yarn.lock"))) return "yarn";
+  return "npm";
+}
+function devInstallCommand(pm, packageName) {
+  switch (pm) {
+    case "bun":
+      return `bun add -D ${packageName}`;
+    case "pnpm":
+      return `pnpm add -D ${packageName}`;
+    case "yarn":
+      return `yarn add -D ${packageName}`;
+    case "npm":
+      return `npm install -D ${packageName}`;
   }
-};
+}
+function toCamelCase(str) {
+  return str.replace(/_([a-z])/g, (_3, c) => c.toUpperCase());
+}
+function drizzleTsType(dataType) {
+  switch (dataType) {
+    case "number":
+      return "number";
+    case "boolean":
+      return "boolean";
+    case "date":
+      return "Date";
+    case "json":
+      return "Record<string, unknown>";
+    default:
+      return "string";
+  }
+}
+function generateDrizzleFromSchema(schema) {
+  const varName = `${toCamelCase(schema.tableName)}Table`;
+  const schemaVarName = `${toCamelCase(schema.tableName)}Schema`;
+  const columnDefs = schema.columns.map((col) => {
+    const opts = [];
+    if (col.dataType !== "string") {
+      opts.push(`dataType: '${col.dataType}'`);
+    }
+    if (col.searchOps.includes("equality")) {
+      opts.push("equality: true");
+    }
+    if (col.searchOps.includes("orderAndRange")) {
+      opts.push("orderAndRange: true");
+    }
+    if (col.searchOps.includes("freeTextSearch")) {
+      opts.push("freeTextSearch: true");
+    }
+    const tsType = drizzleTsType(col.dataType);
+    const optsStr = opts.length > 0 ? `, {
+    ${opts.join(",\n    ")},
+  }` : "";
+    return `  ${col.name}: encryptedType<${tsType}>('${col.name}'${optsStr}),`;
+  });
+  return `import { pgTable, integer, timestamp } from 'drizzle-orm/pg-core'
+import { encryptedType, extractEncryptionSchema } from '@cipherstash/stack/drizzle'
+import { Encryption } from '@cipherstash/stack'
+
+export const ${varName} = pgTable('${schema.tableName}', {
+  id: integer('id').primaryKey().generatedAlwaysAsIdentity(),
+${columnDefs.join("\n")}
+  createdAt: timestamp('created_at').defaultNow(),
+})
 
-// src/bin/commands/init/steps/detect-database-url.ts
-function maskUrl(url) {
-  return url.replace(/:\/\/([^:]+):([^@]+)@/, "://***@");
+const ${schemaVarName} = extractEncryptionSchema(${varName})
+
+export const encryptionClient = await Encryption({
+  schemas: [${schemaVarName}],
+})
+`;
+}
+function generateSchemaFromDef(schema) {
+  const varName = `${toCamelCase(schema.tableName)}Table`;
+  const columnDefs = schema.columns.map((col) => {
+    const parts = [`  ${col.name}: encryptedColumn('${col.name}')`];
+    if (col.dataType !== "string") {
+      parts.push(`.dataType('${col.dataType}')`);
+    }
+    for (const op of col.searchOps) {
+      parts.push(`.${op}()`);
+    }
+    return `${parts.join("\n    ")},`;
+  });
+  return `import { encryptedTable, encryptedColumn } from '@cipherstash/stack/schema'
+import { Encryption } from '@cipherstash/stack'
+
+export const ${varName} = encryptedTable('${schema.tableName}', {
+${columnDefs.join("\n")}
+})
+
+export const encryptionClient = await Encryption({
+  schemas: [${varName}],
+})
+`;
+}
+function generateClientFromSchema(integration, schema) {
+  switch (integration) {
+    case "drizzle":
+      return generateDrizzleFromSchema(schema);
+    case "supabase":
+    case "postgresql":
+      return generateSchemaFromDef(schema);
+  }
+}
+function generatePlaceholderClient(integration) {
+  const placeholder = {
+    tableName: "users",
+    columns: [
+      {
+        name: "email",
+        dataType: "string",
+        searchOps: ["equality", "freeTextSearch"]
+      },
+      {
+        name: "name",
+        dataType: "string",
+        searchOps: ["equality", "freeTextSearch"]
+      }
+    ]
+  };
+  return generateClientFromSchema(integration, placeholder);
+}
+
+// src/bin/commands/init/steps/build-schema.ts
+var DEFAULT_CLIENT_PATH = "./src/encryption/index.ts";
+async function addColumn(index) {
+  const name = await he({
+    message: `Column ${index} name:`,
+    placeholder: index === 1 ? "email" : "name",
+    validate(value) {
+      if (!value || value.trim().length === 0) {
+        return "Column name is required.";
+      }
+      if (!/^[a-z_][a-z0-9_]*$/i.test(value)) {
+        return "Column name must be a valid identifier.";
+      }
+    }
+  });
+  if (pD(name)) return void 0;
+  const dataType = await ve({
+    message: `Data type for "${name}":`,
+    options: [
+      { value: "string", label: "string", hint: "text, email, name, etc." },
+      { value: "number", label: "number", hint: "integer or decimal" },
+      { value: "boolean", label: "boolean" },
+      { value: "date", label: "date", hint: "Date object" },
+      { value: "json", label: "json", hint: "structured JSON data" }
+    ]
+  });
+  if (pD(dataType)) return void 0;
+  const searchOptions = [
+    { value: "equality", label: "Exact match", hint: "eq, neq, in" },
+    {
+      value: "orderAndRange",
+      label: "Order and range",
+      hint: "gt, gte, lt, lte, between, sorting"
+    }
+  ];
+  if (dataType === "string") {
+    searchOptions.push({
+      value: "freeTextSearch",
+      label: "Free-text search",
+      hint: "like, ilike, substring matching"
+    });
+  }
+  const searchOps = await fe({
+    message: `Search operations for "${name}":`,
+    options: searchOptions,
+    required: false
+  });
+  if (pD(searchOps)) return void 0;
+  return { name, dataType, searchOps };
 }
-var detectDatabaseUrlStep = {
-  id: "detect-database-url",
-  name: "Detect database URL",
+async function buildSchema() {
+  const tableName = await he({
+    message: "What is the name of your table?",
+    placeholder: "users",
+    validate(value) {
+      if (!value || value.trim().length === 0) {
+        return "Table name is required.";
+      }
+      if (!/^[a-z_][a-z0-9_]*$/i.test(value)) {
+        return "Table name must be a valid identifier (letters, numbers, underscores).";
+      }
+    }
+  });
+  if (pD(tableName)) return void 0;
+  const columns = [];
+  M2.info("Add encrypted columns to your table. You can add more later.");
+  while (true) {
+    const column = await addColumn(columns.length + 1);
+    if (!column) return void 0;
+    columns.push(column);
+    const addMore = await ye({
+      message: "Add another encrypted column?",
+      initialValue: false
+    });
+    if (pD(addMore)) return void 0;
+    if (!addMore) break;
+  }
+  M2.success(
+    `Schema defined: ${tableName} with ${columns.length} encrypted column${columns.length !== 1 ? "s" : ""}`
+  );
+  return { tableName, columns };
+}
+var buildSchemaStep = {
+  id: "build-schema",
+  name: "Build encryption schema",
   async run(state, _provider) {
-    const envUrl = process.env.DATABASE_URL;
-    if (envUrl) {
-      M2.success(`Detected DATABASE_URL in .env
-  ${maskUrl(envUrl)}`);
-      return { ...state, databaseUrl: envUrl };
+    if (!state.connectionMethod) {
+      M2.warn("Skipping schema generation (no connection method selected)");
+      return { ...state, schemaGenerated: false };
     }
-    M2.warn("No DATABASE_URL found in .env");
-    const action = await ve({
-      message: "How would you like to proceed?",
+    const integration = toIntegration(state.connectionMethod);
+    const clientFilePath = await he({
+      message: "Where should we create your encryption client?",
+      placeholder: DEFAULT_CLIENT_PATH,
+      defaultValue: DEFAULT_CLIENT_PATH
+    });
+    if (pD(clientFilePath)) throw new CancelledError();
+    const resolvedPath = resolve2(process.cwd(), clientFilePath);
+    if (existsSync2(resolvedPath)) {
+      const action = await ve({
+        message: `${clientFilePath} already exists. What would you like to do?`,
+        options: [
+          {
+            value: "keep",
+            label: "Keep existing file",
+            hint: "skip code generation"
+          },
+          { value: "overwrite", label: "Overwrite with new schema" }
+        ]
+      });
+      if (pD(action)) throw new CancelledError();
+      if (action === "keep") {
+        M2.info("Keeping existing encryption client file.");
+        return { ...state, clientFilePath, schemaGenerated: false };
+      }
+    }
+    const schemaChoice = await ve({
+      message: "How would you like to set up your encryption schema?",
       options: [
-        { value: "enter", label: "Enter database URL now" },
-        { value: "skip", label: "Skip for now (I'll add it later)" }
+        {
+          value: "build",
+          label: "Build schema now",
+          hint: "interactive wizard"
+        },
+        {
+          value: "placeholder",
+          label: "Use placeholder schema",
+          hint: "edit later"
+        }
       ]
     });
-    if (pD(action)) throw new CancelledError();
-    if (action === "enter") {
-      const url = await he({
-        message: "Enter your database URL:",
-        placeholder: "postgresql://user:password@host:5432/database",
-        validate: (val) => {
-          if (!val.trim()) return "Database URL is required";
-          if (!val.startsWith("postgres"))
-            return "Must be a PostgreSQL connection string";
-        }
-      });
-      if (pD(url)) throw new CancelledError();
-      return { ...state, databaseUrl: url };
+    if (pD(schemaChoice)) throw new CancelledError();
+    let fileContents;
+    if (schemaChoice === "build") {
+      const schema = await buildSchema();
+      if (!schema) throw new CancelledError();
+      fileContents = generateClientFromSchema(integration, schema);
+    } else {
+      fileContents = generatePlaceholderClient(integration);
     }
-    return state;
+    const dir = dirname(resolvedPath);
+    if (!existsSync2(dir)) {
+      mkdirSync(dir, { recursive: true });
+    }
+    writeFileSync(resolvedPath, fileContents, "utf-8");
+    M2.success(`Encryption client written to ${clientFilePath}`);
+    return { ...state, clientFilePath, schemaGenerated: true };
   }
 };
 
-// src/bin/commands/init/steps/install-eql.ts
-var installEqlStep = {
-  id: "install-eql",
-  name: "Install EQL extension",
+// src/bin/commands/init/steps/install-forge.ts
+import { execSync } from "node:child_process";
+var FORGE_PACKAGE = "@cipherstash/stack-forge";
+var installForgeStep = {
+  id: "install-forge",
+  name: "Install stack-forge",
   async run(state, _provider) {
-    if (!state.databaseUrl) {
-      M2.warn("Skipping EQL extension installation (no database URL)");
-      return { ...state, eqlInstalled: false };
+    if (isPackageInstalled(FORGE_PACKAGE)) {
+      M2.success(`${FORGE_PACKAGE} is already installed.`);
+      return { ...state, forgeInstalled: true };
     }
+    const pm = detectPackageManager();
+    const cmd = devInstallCommand(pm, FORGE_PACKAGE);
     const install = await ye({
-      message: "Install the EQL encryption extension in your database?"
+      message: `Install ${FORGE_PACKAGE} as a dev dependency? (${cmd})`
     });
     if (pD(install)) throw new CancelledError();
     if (!install) {
-      M2.info("Skipping EQL extension installation");
+      M2.info(`Skipping ${FORGE_PACKAGE} installation.`);
       Me(
-        "You can install it manually later:\n  CREATE EXTENSION IF NOT EXISTS eql_v2;\n\nOr re-run this command:\n  npx @cipherstash/stack init",
+        `You can install it manually later:
+  ${cmd}`,
         "Manual Installation"
       );
-      return { ...state, eqlInstalled: false };
+      return { ...state, forgeInstalled: false };
     }
     const s = Y2();
-    s.start("Installing EQL extension...");
+    s.start(`Installing ${FORGE_PACKAGE}...`);
     try {
-      await installEqlExtension(state.databaseUrl);
-      s.stop("EQL extension installed successfully");
-      return { ...state, eqlInstalled: true };
+      execSync(cmd, { cwd: process.cwd(), stdio: "pipe" });
+      s.stop(`${FORGE_PACKAGE} installed successfully`);
+      return { ...state, forgeInstalled: true };
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      s.stop("EQL extension installation failed");
+      s.stop(`${FORGE_PACKAGE} installation failed`);
       M2.error(message);
-      Me(
-        "You can install it manually:\n  CREATE EXTENSION IF NOT EXISTS eql_v2;\n\nOr install via Database.dev:\n  https://database.dev/cipherstash/eql",
-        "Manual Installation"
-      );
-      return { ...state, eqlInstalled: false };
+      Me(`You can install it manually:
+  ${cmd}`, "Manual Installation");
+      return { ...state, forgeInstalled: false };
     }
   }
 };
@@ -1367,75 +1635,14 @@ var selectConnectionStep = {
   }
 };
 
-// src/bin/commands/init/steps/select-region.ts
-var REGIONS = [
-  { value: "ap-southeast-2", label: "Asia Pacific (Sydney)" },
-  { value: "us-east-1", label: "US East (N. Virginia)" },
-  { value: "us-west-2", label: "US West (Oregon)" },
-  { value: "eu-west-1", label: "Europe (Ireland)" }
-];
-var selectRegionStep = {
-  id: "select-region",
-  name: "Select region",
-  async run(state, _provider) {
-    const region = await ve({
-      message: "Where should we create your workspace?",
-      options: REGIONS
-    });
-    if (pD(region)) throw new CancelledError();
-    return { ...state, region };
-  }
-};
-
-// src/bin/commands/init/steps/select-workspace.ts
-var selectWorkspaceStep = {
-  id: "select-workspace",
-  name: "Select workspace",
-  async run(state, _provider) {
-    const s = Y2();
-    s.start("Loading workspaces...");
-    const workspaces = await fetchWorkspaces(state.accessToken);
-    s.stop("Workspaces loaded");
-    const options = [
-      ...workspaces.map((ws2) => ({ value: ws2.id, label: ws2.name })),
-      { value: "__create__", label: "Create new workspace" }
-    ];
-    const selected = await ve({
-      message: "Select a workspace",
-      options
-    });
-    if (pD(selected)) throw new CancelledError();
-    if (selected === "__create__") {
-      const name = await he({
-        message: "What should we call your new workspace?",
-        placeholder: "my-project",
-        validate: (val) => {
-          if (!val.trim()) return "Workspace name is required";
-        }
-      });
-      if (pD(name)) throw new CancelledError();
-      const s2 = Y2();
-      s2.start("Creating workspace...");
-      const ws2 = await createWorkspace(state.accessToken, name);
-      s2.stop(`Workspace created: ${ws2.name}`);
-      return { ...state, workspaceId: ws2.id, workspaceName: ws2.name };
-    }
-    const ws = workspaces.find((w2) => w2.id === selected);
-    return { ...state, workspaceId: ws.id, workspaceName: ws.name };
-  }
-};
-
 // src/bin/commands/init/index.ts
 var PROVIDER_MAP = {
   supabase: createSupabaseProvider
 };
 var STEPS = [
-  authenticateStep,
-  selectWorkspaceStep,
-  selectRegionStep,
   selectConnectionStep,
-  detectDatabaseUrlStep,
-  installEqlStep,
+  buildSchemaStep,
+  installForgeStep,
   nextStepsStep
 ];
 function resolveProvider(flags) {
@@ -1449,9 +1656,6 @@ function resolveProvider(flags) {
 async function initCommand(flags) {
   const provider = resolveProvider(flags);
   Ie("CipherStash Stack Setup");
-  M2.warn(
-    "This command is a prototype and a sneak peek at what's next. It doesn't perform any actual setup yet."
-  );
   M2.info(provider.introMessage);
   let state = {};
   try {
@@ -1511,6 +1715,17 @@ function isEncryptedPayload(value) {
 
 // src/schema/index.ts
 import { z as z2 } from "zod";
+var eqlCastAsEnum = z2.enum([
+  "text",
+  "int",
+  "small_int",
+  "big_int",
+  "real",
+  "double",
+  "boolean",
+  "date",
+  "jsonb"
+]).default("text");
 var castAsEnum = z2.enum(["bigint", "boolean", "date", "number", "string", "json", "text"]).default("text");
 var tokenFilterSchema = z2.object({
   kind: z2.literal("downcase")
@@ -1559,7 +1774,7 @@ var EncryptedField = class {
   castAsValue;
   constructor(valueName) {
     this.valueName = valueName;
-    this.castAsValue = "text";
+    this.castAsValue = "string";
   }
   /**
    * Set or override the plaintext data type for this field.
@@ -1584,7 +1799,7 @@ var EncryptedField = class {
   }
   build() {
     return {
-      cast_as: this.castAsValue === "string" ? "text" : this.castAsValue,
+      cast_as: this.castAsValue,
       indexes: {}
     };
   }
@@ -1738,7 +1953,7 @@ var EncryptedColumn = class {
   }
   build() {
     return {
-      cast_as: this.castAsValue === "string" ? "text" : this.castAsValue,
+      cast_as: this.castAsValue,
       indexes: this.indexesValue
     };
   }
@@ -4955,7 +5170,7 @@ async function secretsCommand(args) {
 
 // src/bin/stash.ts
 (0, import_dotenv2.config)();
-var __dirname = dirname(fileURLToPath(import.meta.url));
+var __dirname = dirname2(fileURLToPath(import.meta.url));
 var pkg = JSON.parse(
   readFileSync(join(__dirname, "../../package.json"), "utf-8")
 );