feat: migrate @cipherstash/cli to stash

.changeset/breezy-cloths-wave.md

@@ -0,0 +1,28 @@
+---
+"stash": minor
+"@cipherstash/wizard": patch
+---
+
+Rename the CLI package from `@cipherstash/cli` to `stash`. The published code, commands, and flags are unchanged — this is a pure rename so the day-to-day invocation drops from `npx @cipherstash/cli ...` to `npx stash ...`.
+
+**Migration**
+
+1. Update your `package.json` devDependencies:
+
+   ```diff
+   -  "@cipherstash/cli": "^0.10.0"
+   +  "stash": "^0.10.1"
+   ```
+
+2. Update the `defineConfig` import in `stash.config.ts`:
+
+   ```diff
+   - import { defineConfig } from '@cipherstash/cli'
+   + import { defineConfig } from 'stash'
+   ```
+
+3. Update any `npx @cipherstash/cli ...` / `bunx @cipherstash/cli ...` / `pnpm dlx @cipherstash/cli ...` / `yarn dlx @cipherstash/cli ...` invocations in scripts, CI, READMEs, and team docs to use `stash` instead. Programmatic exports (`defineConfig`, `loadStashConfig`, `EQLInstaller`, `loadBundledEqlSql`, `downloadEqlSql`, `PermissionCheckResult`) are re-exported from `stash` with the same shapes.
+
+**Wizard impact (`@cipherstash/wizard`)**
+
+The wizard's post-agent step and its prerequisite / agent-error hints now reference `stash` (e.g. `Run: bunx stash auth login`, `Running bunx stash db install...`) rather than `@cipherstash/cli`. The wizard package name and `stash-wizard` binary are unchanged — only the strings the wizard prints and the commands it shells out to are affected.

.changeset/cli-database-url-resolution.md

@@ -1,5 +1,5 @@
 ---
-'@cipherstash/cli': minor
+'stash': minor
 ---
 
 Layered `DATABASE_URL` resolution for DB / schema commands.
@@ -16,7 +16,7 @@ if `DATABASE_URL` wasn't already in the environment. The CLI auto-loaded `.env.l
 The scaffolded `stash.config.ts` now calls a resolver directly:
 
 ```ts
-import { defineConfig, resolveDatabaseUrl } from '@cipherstash/cli'
+import { defineConfig, resolveDatabaseUrl } from 'stash'
 
 export default defineConfig({
   databaseUrl: await resolveDatabaseUrl(),

.github/workflows/tests.yml

@@ -86,7 +86,7 @@ jobs:
       # pseudo-terminal via node-pty. Run via turbo so the `^build` + `build`
       # deps declared on the `test:e2e` task are honored.
       - name: Run CLI E2E tests
-        run: pnpm exec turbo run test:e2e --filter @cipherstash/cli
+        run: pnpm exec turbo run test:e2e --filter stash
 
   e2e-tests:
     name: Run E2E Tests

AGENTS.md

@@ -142,7 +142,7 @@ pnpm changeset:publish
 - Prefer testing via the public API. Avoid reaching into private internals.
 - Some tests have larger timeouts (e.g., 30s) to accommodate network calls.
 - `packages/cli` has a second suite — pty-driven E2E tests under
-  `packages/cli/tests/e2e/**` run via `pnpm --filter @cipherstash/cli
+  `packages/cli/tests/e2e/**` run via `pnpm --filter stash
   test:e2e` (requires a build). See `packages/cli/AGENTS.md` for when to
   add or update them.
 

docs/plans/cli-pty-integration-tests.md

@@ -1,4 +1,4 @@
-# Plan: node-pty Integration Tests for `@cipherstash/cli`
+# Plan: node-pty Integration Tests for `stash`
 
 ## Goal
 
@@ -75,7 +75,7 @@ harness is proven.
 7. `turbo.json` task `test:e2e` with `dependsOn: ["^build", "build"]` so
    the CLI is rebuilt before E2E runs. Keep `cache: false`.
 8. CI: extend the existing test workflow to also run `pnpm --filter
-   @cipherstash/cli test:e2e`. Confirm the prebuilt binary resolves on
+   stash test:e2e`. Confirm the prebuilt binary resolves on
    the GH runners (Linux x64, macOS arm64). If it doesn't, fall back to
    upstream `node-pty` and add `python3` / build tools to the workflow.
 
@@ -182,7 +182,7 @@ export const messages = {
   },
   db: {
     migrateNotImplemented:
-      '"npx @cipherstash/cli db migrate" is not yet implemented.',
+      '"npx stash db migrate" is not yet implemented.',
   },
 } as const
 ```

e2e/package.json

@@ -8,7 +8,7 @@
     "test:e2e": "vitest run"
   },
   "dependencies": {
-    "@cipherstash/cli": "workspace:*",
+    "stash": "workspace:*",
     "@cipherstash/wizard": "workspace:*"
   },
   "devDependencies": {

e2e/tests/package-managers.e2e.test.ts

@@ -35,19 +35,19 @@ describe('CLI init providers — package-manager-aware Next Steps', () => {
       label: 'base',
       create: createBaseProvider,
       firstStep: (r) =>
-        `Set up your database: ${r} @cipherstash/cli db install`,
+        `Set up your database: ${r} stash db install`,
     },
     {
       label: 'drizzle',
       create: createDrizzleProvider,
       firstStep: (r) =>
-        `Set up your database: ${r} @cipherstash/cli db install --drizzle`,
+        `Set up your database: ${r} stash db install --drizzle`,
     },
     {
       label: 'supabase',
       create: createSupabaseProvider,
       firstStep: (r) =>
-        `Install EQL: ${r} @cipherstash/cli db install --supabase (prompts for migration vs direct)`,
+        `Install EQL: ${r} stash db install --supabase (prompts for migration vs direct)`,
     },
   ]
 
@@ -141,12 +141,12 @@ describe.skipIf(!authConfigured)(
         { pm: 'yarn' as const, lockfile: 'yarn.lock' },
       ])('uses $pm runner when $lockfile is present', ({ pm, lockfile }) => {
         const out = runWizard({ lockfile })
-        expect(out).toContain(`Run: ${RUNNER[pm]} @cipherstash/cli db install`)
+        expect(out).toContain(`Run: ${RUNNER[pm]} stash db install`)
       })
 
       it('falls back to npx when no lockfile and no user agent', () => {
         const out = runWizard({})
-        expect(out).toContain('Run: npx @cipherstash/cli db install')
+        expect(out).toContain('Run: npx stash db install')
       })
     })
 
@@ -157,7 +157,7 @@ describe.skipIf(!authConfigured)(
         { pm: 'yarn' as const, userAgent: 'yarn/4.0.0 npm/? node/v20.0.0' },
       ])('uses $pm runner when UA is $userAgent', ({ pm, userAgent }) => {
         const out = runWizard({ userAgent })
-        expect(out).toContain(`Run: ${RUNNER[pm]} @cipherstash/cli db install`)
+        expect(out).toContain(`Run: ${RUNNER[pm]} stash db install`)
       })
     })
 
@@ -167,15 +167,15 @@ describe.skipIf(!authConfigured)(
           lockfile: 'pnpm-lock.yaml',
           userAgent: 'bun/1.1.40 npm/? node/v22.3.0',
         })
-        expect(out).toContain('Run: bunx @cipherstash/cli db install')
+        expect(out).toContain('Run: bunx stash db install')
       })
 
       it('npm user agent is ignored in favour of a lockfile', () => {
         const out = runWizard({
           lockfile: 'bun.lock',
           userAgent: 'npm/10.2.4 node/v20.0.0',
         })
-        expect(out).toContain('Run: bunx @cipherstash/cli db install')
+        expect(out).toContain('Run: bunx stash db install')
       })
     })
   },

examples/basic/package.json

@@ -16,7 +16,7 @@
     "pg": "8.13.1"
   },
   "devDependencies": {
-    "@cipherstash/cli": "workspace:*",
+    "stash": "workspace:*",
     "tsx": "catalog:repo",
     "typescript": "catalog:repo"
   }

examples/basic/stash.config.ts

@@ -1,4 +1,4 @@
-import { defineConfig } from '@cipherstash/cli'
+import { defineConfig } from 'stash'
 
 export default defineConfig({
   databaseUrl: process.env.DATABASE_URL!,

packages/cli/AGENTS.md

@@ -1,13 +1,13 @@
-# `@cipherstash/cli` — agent notes
+# `stash` — agent notes
 
 ## Two test suites
 
 This package has **two** Vitest configs. Run the right one for the change.
 
 | Command | Config | Scope | Needs build? |
 | --- | --- | --- | --- |
-| `pnpm --filter @cipherstash/cli test` | `vitest.config.ts` | Unit tests under `src/__tests__/**` and `src/**/__tests__/**` | No |
-| `pnpm --filter @cipherstash/cli test:e2e` | `vitest.integration.config.ts` | E2E tests under `tests/e2e/**.e2e.test.ts` driving the built `dist/bin/stash.js` through a real pty (`node-pty`) | **Yes** — run `pnpm --filter @cipherstash/cli build` first, or use the turbo `test:e2e` task which depends on `build`. |
+| `pnpm --filter stash test` | `vitest.config.ts` | Unit tests under `src/__tests__/**` and `src/**/__tests__/**` | No |
+| `pnpm --filter stash test:e2e` | `vitest.integration.config.ts` | E2E tests under `tests/e2e/**.e2e.test.ts` driving the built `dist/bin/stash.js` through a real pty (`node-pty`) | **Yes** — run `pnpm --filter stash build` first, or use the turbo `test:e2e` task which depends on `build`. |
 
 The unit config explicitly excludes `tests/e2e/**` so the default `pnpm test`
 stays fast and self-contained.