Version Packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

stash@0.11.0

Minor Changes

• de9c02c: Rename the CLI package from @cipherstash/cli to stash. The published code, commands, and flags are unchanged — this is a pure rename so the day-to-day invocation drops from npx @cipherstash/cli ... to npx stash ....

  Migration

  1. Update your package.json devDependencies:

     -  "@cipherstash/cli": "^0.10.0"
     +  "stash": "^0.10.1"

  2. Update the defineConfig import in stash.config.ts:

     - import { defineConfig } from '@cipherstash/cli'
     + import { defineConfig } from 'stash'

  3. Update any npx @cipherstash/cli ... / bunx @cipherstash/cli ... / pnpm dlx @cipherstash/cli ... / yarn dlx @cipherstash/cli ... invocations in scripts, CI, READMEs, and team docs to use stash instead. Programmatic exports (defineConfig, loadStashConfig, EQLInstaller, loadBundledEqlSql, downloadEqlSql, PermissionCheckResult) are re-exported from stash with the same shapes.

  Wizard impact (@cipherstash/wizard)

  The wizard's post-agent step and its prerequisite / agent-error hints now reference stash (e.g. Run: bunx stash auth login, Running bunx stash db install...) rather than @cipherstash/cli. The wizard package name and stash-wizard binary are unchanged — only the strings the wizard prints and the commands it shells out to are affected.

• 8ee11fd: Layered DATABASE_URL resolution for DB / schema commands.

  Previously, any DB-touching command (db install, db push, db upgrade, db status, db validate, db test-connection, schema build) failed with the cryptic Zod error:

  Error: Invalid stash.config.ts
    - databaseUrl: Invalid input: expected nonoptional, received undefined
  

  if DATABASE_URL wasn't already in the environment. The CLI auto-loaded .env.local / .env.development.local / .env.development / .env, but had no story for --database-url flags, local Supabase, or pasted-once values.

  The scaffolded stash.config.ts now calls a resolver directly:

  import { defineConfig, resolveDatabaseUrl } from "stash";
  
  export default defineConfig({
    databaseUrl: await resolveDatabaseUrl(),
    client: "./src/encryption/index.ts",
  });

  resolveDatabaseUrl() walks sources in order; first hit wins:

  1. --database-url <url> flag — new, accepted on all seven DB / schema commands. Used for this run only; never written to disk.
  2. process.env.DATABASE_URL — covers shell exports, mise, direnv, dotenv-cli, the existing dotenv loads.
  3. supabase status --output env → DB_URL — auto-engaged when --supabase is set or a supabase/config.toml is detected. Useful for local Supabase users who haven't exported the URL yet.
  4. Interactive prompt — opens with a tip listing the alternatives (flag, env, the user's actual dotenv file). Skipped under CI=true or non-TTY stdin.
  5. Hard fail with a source-naming error message.

  The connection string is never persisted to disk — stash.config.ts only contains the await resolveDatabaseUrl() call, never a literal URL. The resolver also doesn't mutate process.env; CLI flag context is threaded into the config evaluation via AsyncLocalStorage so concurrent loads stay isolated. Source labels are logged on non-env paths (Using DATABASE_URL from --database-url flag / from supabase status / from prompt) but the URL itself is never echoed.

  db test-connection's connection-failure hint is now source-aware: it points users at --database-url, the env var, and the actual dotenv file in their project (.env.local if present, .env otherwise) — not the misleading stash.config.ts it used to suggest.

@cipherstash/protect@11.1.1

Patch Changes

• afe6810: Bump protect-ffi version

@cipherstash/protect-dynamodb@11.0.1

Patch Changes

• Updated dependencies [afe6810]
  • @cipherstash/protect@11.1.1

@cipherstash/stack@0.15.3

Patch Changes

• afe6810: Bump protect-ffi version

@cipherstash/wizard@0.1.2

Patch Changes

• de9c02c: Rename the CLI package from @cipherstash/cli to stash. The published code, commands, and flags are unchanged — this is a pure rename so the day-to-day invocation drops from npx @cipherstash/cli ... to npx stash ....

  Migration

  1. Update your package.json devDependencies:

     -  "@cipherstash/cli": "^0.10.0"
     +  "stash": "^0.10.1"

  2. Update the defineConfig import in stash.config.ts:

     - import { defineConfig } from '@cipherstash/cli'
     + import { defineConfig } from 'stash'

  3. Update any npx @cipherstash/cli ... / bunx @cipherstash/cli ... / pnpm dlx @cipherstash/cli ... / yarn dlx @cipherstash/cli ... invocations in scripts, CI, READMEs, and team docs to use stash instead. Programmatic exports (defineConfig, loadStashConfig, EQLInstaller, loadBundledEqlSql, downloadEqlSql, PermissionCheckResult) are re-exported from stash with the same shapes.

  Wizard impact (@cipherstash/wizard)

  The wizard's post-agent step and its prerequisite / agent-error hints now reference stash (e.g. Run: bunx stash auth login, Running bunx stash db install...) rather than @cipherstash/cli. The wizard package name and stash-wizard binary are unchanged — only the strings the wizard prints and the commands it shells out to are affected.

@cipherstash/basic-example@1.2.9

Patch Changes

• Updated dependencies [afe6810]
  • @cipherstash/stack@0.15.3