CipherStash Forge

@cipherstash/cli is a dev-time CLI and library for managing CipherStash EQL (Encrypted Query Language) in PostgreSQL.

@cipherstash/stack is the runtime encryption SDK. It stays lean with no heavy dependencies like pg. @cipherstash/cli is a devDependency that handles database tooling: installing EQL extensions, checking permissions, validating schemas, and managing schema lifecycle.

Think of it like Prisma CLI or Drizzle Kit. It sets up the database while the main SDK handles runtime operations.

Quick start

Interactive (recommended)

npx @cipherstash/cli init

npx @cipherstash/cli db setup

npx @cipherstash/cli wizard

Manual setup

npm install -D @cipherstash/cli

import { defineConfig } from '@cipherstash/cli'

export default defineConfig({
  databaseUrl: process.env.DATABASE_URL!,
})

DATABASE_URL=postgresql://user:password@localhost:5432/mydb

npx @cipherstash/cli db setup

Configuration

The stash.config.ts file is the single source of truth for Forge. Use defineConfig for type safety.

import { defineConfig } from '@cipherstash/cli'

export default defineConfig({
  databaseUrl: process.env.DATABASE_URL!,
  client: './src/encryption/index.ts',
})

The CLI automatically loads .env before evaluating the config, so process.env references work without any extra setup. The config file is resolved by walking up from the current working directory, similar to how tsconfig.json resolution works.

Next steps