CipherStash CLI (stash)

stash is the dev-time CLI for CipherStash. It owns authentication, project setup, the EQL (Encrypted Query Language) Postgres extension, and the machinery that migrates an existing plaintext column to an encrypted one. Its runtime counterpart is @cipherstash/stack, which encrypts and decrypts values in your application.

Think Prisma Migrate or Drizzle Kit: a dev-time tool that prepares the database, while the runtime SDK handles queries.

All setup and migration work is driven through this CLI. Don't hand-write EQL SQL, don't hand-edit .cipherstash/, and don't introspect the database yourself. The CLI owns that state; hand-edits desync it.

Trigger

Use this skill when:

• The user wants to set up CipherStash or install EQL in a PostgreSQL database.
• Any stash command is being run: init, plan, impl, status, auth, eql, db, encrypt, schema, manifest, doctor, telemetry, wizard, env.
• A stash.config.ts file exists or needs to be created.
• A .cipherstash/ directory exists (context.json, plan.md, migrations.json, setup-prompt.md).
• The user mentions "stash CLI", "EQL install", "encryption schema", or an encryption rollout/cutover.

Do not trigger when: