stash CLI: standalone `npx stash eql install` scaffolds a stash.config.ts that can't load (Cannot find module 'stash')

[coderdan]

Problem

Running npx stash eql install in a project that hasn't been through stash init scaffolds a stash.config.ts, then immediately crashes trying to load it:

$ npx stash eql install
●  No stash.config.ts found — let's create one.
◇  Where is your encryption client file?
│  ./src/encryption/index.ts
◆  Created stash.config.ts
│
Error: Failed to load stash.config.ts at /…/stash.config.ts

Error: Cannot find module 'stash'
Require stack:
- /…/stash.config.ts
    at Module._resolveFilename …
  code: 'MODULE_NOT_FOUND',
■  Canceled

The user is dropped a raw jiti/Node stack trace with no guidance.

Root cause

installCommand (packages/cli/src/commands/db/install.ts:96-107):

1. ensureStashConfig() writes a stash.config.ts whose first line is import { defineConfig, resolveDatabaseUrl } from 'stash' (db/config-scaffold.ts:76).
2. loadStashConfig() jiti-loads that file → the import … from 'stash' can't resolve → Cannot find module 'stash'.

stash (and @cipherstash/stack) are only added as project dependencies by stash init (init/steps/install-deps.ts:11-13). Run standalone via npx, they live in the npx cache, not the project's node_modules, so the scaffolded config's import fails. eql install has a safety net for the encryption client file (ensureEncryptionClient) but none for the stash dependency the config itself imports.

Why no test caught it

db/config-scaffold.ts has zero tests, and the install-command tests run inside the monorepo where stash resolves via the workspace — so the npx-standalone failure mode is never exercised.

Suggested fix

• Harden loadStashConfig()'s catch: detect a missing-module error for stash / @cipherstash/stack and print actionable, runner-aware guidance instead of the raw stack trace.
• Add a proactive dependency guard to eql install: after scaffolding a config, if stash / @cipherstash/stack aren't installed, offer to install them (TTY) or print guidance and exit cleanly (non-TTY) — before the load attempt.
• Add the missing test coverage for the scaffold + missing-dependency path.

Related

Sibling issue: missing-config read commands dead-end. A fix PR will address both.