From 05e0e8a82cb93f835f57700a59a1270bb7253333 Mon Sep 17 00:00:00 2001
From: CJ Brewer <brewercalvinj@gmail.com>
Date: Tue, 27 Jan 2026 16:04:42 -0700
Subject: [PATCH 1/2] =?UTF-8?q?fix:=20=F0=9F=90=9B=20make=20dotenv=20work?=
 =?UTF-8?q?=20in=20ESM=20CLI=20executable?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Externalize dotenv in tsup config to avoid bundling issues
- Use ESM-compatible dotenv import instead of dotenv/config
- Move dotenv from devDependencies to dependencies (runtime dependency)
- Pin dotenv version to 16.4.7 for consistency
---
 packages/protect/package.json     |  2 +-
 packages/protect/src/bin/stash.ts |  5 +++--
 packages/protect/tsup.config.ts   |  2 ++
 pnpm-lock.yaml                    | 12 +++++++++---
 4 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/packages/protect/package.json b/packages/protect/package.json
index 02c6458f..762b0066 100644
--- a/packages/protect/package.json
+++ b/packages/protect/package.json
@@ -56,7 +56,6 @@
 	},
 	"devDependencies": {
 		"@supabase/supabase-js": "^2.47.10",
-		"dotenv": "^16.4.7",
 		"execa": "^9.5.2",
 		"json-schema-to-typescript": "^15.0.2",
 		"tsup": "catalog:repo",
@@ -72,6 +71,7 @@
 		"@cipherstash/protect-ffi": "0.19.0",
 		"@cipherstash/schema": "workspace:*",
 		"@stricli/core": "^1.2.5",
+		"dotenv": "16.4.7",
 		"zod": "^3.24.2"
 	},
 	"optionalDependencies": {
diff --git a/packages/protect/src/bin/stash.ts b/packages/protect/src/bin/stash.ts
index 87833527..0293f013 100644
--- a/packages/protect/src/bin/stash.ts
+++ b/packages/protect/src/bin/stash.ts
@@ -1,11 +1,12 @@
+import { config } from 'dotenv'
+config()
+import readline from 'node:readline'
 import {
-  type CommandContext,
   buildApplication,
   buildCommand,
   buildRouteMap,
   run,
 } from '@stricli/core'
-import readline from 'node:readline'
 import { Stash } from '../stash/index.js'
 
 // ANSI color codes for beautiful terminal output
diff --git a/packages/protect/tsup.config.ts b/packages/protect/tsup.config.ts
index 59390bbe..8fdee46c 100644
--- a/packages/protect/tsup.config.ts
+++ b/packages/protect/tsup.config.ts
@@ -24,5 +24,7 @@ export default defineConfig([
     },
     dts: false,
     sourcemap: true,
+    external: ['dotenv'],
+    noExternal: [],
   },
 ])
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 3912a3b7..904f13a4 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -520,6 +520,9 @@ importers:
       '@stricli/core':
         specifier: ^1.2.5
         version: 1.2.5
+      dotenv:
+        specifier: 16.4.7
+        version: 16.4.7
       zod:
         specifier: ^3.24.2
         version: 3.25.76
@@ -527,9 +530,6 @@ importers:
       '@supabase/supabase-js':
         specifier: ^2.47.10
         version: 2.89.0
-      dotenv:
-        specifier: ^16.4.7
-        version: 16.6.1
       execa:
         specifier: ^9.5.2
         version: 9.6.1
@@ -3930,6 +3930,10 @@ packages:
     resolution: {integrity: sha512-ZmdL2rui+eB2YwhsWzjInR8LldtZHGDoQ1ugH85ppHKwpUHL7j7rN0Ti9NCnGiQbhaZ11FpR+7ao1dNsmduNUg==}
     engines: {node: '>=12'}
 
+  dotenv@16.4.7:
+    resolution: {integrity: sha512-47qPchRCykZC03FhkYAhrvwU4xDBFIj1QPqaarj6mdM/hgUzfPHcpkHJOn3mJAufFeeAxAzeGsr5X0M4k6fLZQ==}
+    engines: {node: '>=12'}
+
   dotenv@16.6.1:
     resolution: {integrity: sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==}
     engines: {node: '>=12'}
@@ -10205,6 +10209,8 @@ snapshots:
 
   dotenv@16.4.5: {}
 
+  dotenv@16.4.7: {}
+
   dotenv@16.6.1: {}
 
   drizzle-kit@0.30.6:

From 9ccaf6809fd927d00bef6ae9612097a9e5de6547 Mon Sep 17 00:00:00 2001
From: CJ Brewer <brewercalvinj@gmail.com>
Date: Tue, 27 Jan 2026 16:17:43 -0700
Subject: [PATCH 2/2] chore: changeset

---
 .changeset/clear-paths-exist.md | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 .changeset/clear-paths-exist.md

diff --git a/.changeset/clear-paths-exist.md b/.changeset/clear-paths-exist.md
new file mode 100644
index 00000000..a786c8b1
--- /dev/null
+++ b/.changeset/clear-paths-exist.md
@@ -0,0 +1,5 @@
+---
+"@cipherstash/protect": minor
+---
+
+Allow stash cli tool to read env files from .env.\*.