@cipherstash/cli

0.10.1 verified Fri May 01 auth: no javascript

CipherStash CLI (v0.10.1) — single command for authentication, project initialization, EQL database lifecycle (install, upgrade, validate, push, migrate), encryption schema building, and secrets management. Requires Node >=22 and peer dependency @cipherstash/stack >=0.6.0. Ships TypeScript types. Differentiators: unified CLI replacing separate tools, auto-detects and scaffolds stash.config.ts, supports Supabase and Drizzle providers. Release cadence: minor updates monthly.

Common errors

error ERR_REQUIRE_ESM ↓

cause Using require() on an ESM-only package.

fix

Replace const x = require('@cipherstash/cli') with import { defineConfig } from '@cipherstash/cli' and ensure "type": "module" in package.json.

error Error: Cannot find module '@cipherstash/stack' ↓

cause Missing peer dependency @cipherstash/stack.

fix

Run npm install @cipherstash/stack to install the peer dependency.

error Error: stash.config.ts not found ↓

cause Cannot find the configuration file. CLI walks up directories from CWD.

fix

Run npx @cipherstash/cli db install first to scaffold the config, or create stash.config.ts manually with defineConfig.

error Error: The `databaseUrl` option is required ↓

cause Missing databaseUrl in stash.config.ts or environment variable.

fix

Set DATABASE_URL in .env or define databaseUrl in your stash.config.ts.

Warnings

breaking Package is ESM-only since v0.10.0. CommonJS require() will throw ERR_REQUIRE_ESM. ↓

fix Use import statements and set "type": "module" in package.json.

deprecated The --supabase and --drizzle flags may be deprecated in future releases in favor of auto-detection. ↓

fix Check documentation for current recommended approach.

gotcha The CLI reads .env files automatically but does not override existing environment variables. This can cause confusion if you expect .env to override. ↓

fix Ensure .env values are set correctly and not shadowed by shell environment.

gotcha The auth token is saved to ~/.cipherstash/auth.json in plaintext. Ensure file permissions are restrictive. ↓

fix Set umask or chmod 600 on the file after login.

Install

npm install stash

yarn add stash

pnpm add stash

Imports

defineConfig

wrong

const { defineConfig } = require('@cipherstash/cli')

correct

import { defineConfig } from '@cipherstash/cli'

ESM-only package since v0.10.0. CommonJS require() will fail.

default import
wrong
```
const cli = require('@cipherstash/cli')
```
correct
```
import cli from '@cipherstash/cli'
```
Default export is not documented; prefer named imports like defineConfig.

StashConfig type

import type { StashConfig } from '@cipherstash/cli'

Type import for TypeScript projects.

Quickstart

Install CLI, authenticate, scaffold encryption client and schema, install EQL extensions.

npm install -D @cipherstash/cli
npx @cipherstash/cli auth login
npx @cipherstash/cli init
npx @cipherstash/cli db install