From 26919a9d77d37afd5f23c0fbaa3eaeeabe1eb424 Mon Sep 17 00:00:00 2001 From: Dan Draper Date: Thu, 30 Jul 2026 20:44:21 +1000 Subject: [PATCH 1/8] docs: reuse credential options across v2 --- content/docs/get-started/choose-your-stack.mdx | 8 ++------ content/docs/get-started/quickstart.mdx | 2 +- content/docs/guides/deployment/index.mdx | 4 +++- .../guides/migration/encrypt-existing-data.mdx | 4 ++-- content/docs/integrations/drizzle.mdx | 6 ++++++ .../integrations/supabase/edge-functions.mdx | 17 ++++++----------- content/docs/integrations/supabase/index.mdx | 1 + .../docs/integrations/supabase/quickstart.mdx | 2 +- .../docs/integrations/supabase/supabase-js.mdx | 6 +++++- content/docs/reference/proxy/configuration.mdx | 2 +- .../docs/reference/workspace/configuration.mdx | 18 ++++-------------- 11 files changed, 32 insertions(+), 38 deletions(-) diff --git a/content/docs/get-started/choose-your-stack.mdx b/content/docs/get-started/choose-your-stack.mdx index c333a60..e2c4963 100644 --- a/content/docs/get-started/choose-your-stack.mdx +++ b/content/docs/get-started/choose-your-stack.mdx @@ -84,13 +84,9 @@ A database breach defeats encryption at rest, because the database decrypts on r ## From development to production -| Stage | Credentials | Setup | -|---|---|---| -| Local development | Device-based | `stash init` per developer. No environment variables. | -| CI and staging | Machine | An application client key, plus `CS_*` environment variables. | -| Production | Machine | Same, with the client key held in your secret manager. | + -Device auth gives each developer their own identity, so local decryptions are attributable. There's no interactive device in CI, hence the switch. See [going to production](/stack/deploy/going-to-production). +Device auth gives each developer their own identity, so local decryptions are attributable. There is no interactive device profile in CI, hence the switch to explicit credentials. See [Deployment](/guides/deployment) for build-time availability, environment separation, and rollout gates. ## Still not sure diff --git a/content/docs/get-started/quickstart.mdx b/content/docs/get-started/quickstart.mdx index 38571ec..086fec5 100644 --- a/content/docs/get-started/quickstart.mdx +++ b/content/docs/get-started/quickstart.mdx @@ -182,4 +182,4 @@ You encrypted a field, stored it, queried it without decrypting, and read it bac - **Using an ORM or Supabase?** The [Drizzle](/stack/cipherstash/encryption/drizzle) and [Supabase](/integrations/supabase) integrations wrap your existing client so queries look normal. - **No app changes possible?** [CipherStash Proxy](/reference/proxy) sits in front of Postgres and does this transparently. - **Bind decryption to a user.** [Provable access control](/solutions/provable-access) ties a value to the identity that encrypted it. -- **Ready to deploy?** [Going to production](/stack/deploy/going-to-production) covers the switch from device auth to machine credentials. +- **Ready to deploy?** [Deployment](/guides/deployment) covers credential choices, environment promotion, and production rollout gates. diff --git a/content/docs/guides/deployment/index.mdx b/content/docs/guides/deployment/index.mdx index c2c6d21..e5ef18e 100644 --- a/content/docs/guides/deployment/index.mdx +++ b/content/docs/guides/deployment/index.mdx @@ -21,7 +21,9 @@ For the detailed dual-write, backfill, and cutover procedure for populated colum ## Credentials at build and runtime -An encryption client constructed at module load may authenticate when a build tool imports that module. In that case, `CS_WORKSPACE_CRN`, `CS_CLIENT_ID`, `CS_CLIENT_KEY`, and `CS_CLIENT_ACCESS_KEY` must be available during both the build and runtime phases. + + +An encryption client constructed at module load may authenticate when a build tool imports that module. In that case, the four `CS_*` variables shown above must be available during both the build and runtime phases. Do not let a local `stash auth login` session mask missing deployment credentials. Reproduce the production build in a clean environment that has only the secrets explicitly supplied by the deployment platform. diff --git a/content/docs/guides/migration/encrypt-existing-data.mdx b/content/docs/guides/migration/encrypt-existing-data.mdx index 7cc9975..69c6b0a 100644 --- a/content/docs/guides/migration/encrypt-existing-data.mdx +++ b/content/docs/guides/migration/encrypt-existing-data.mdx @@ -27,7 +27,7 @@ Do not start the backfill until dual-writes are running in every deployed writer - Install EQL and configure your encryption client. For Supabase, complete the [Quickstart](/integrations/supabase/quickstart) against a development table first. - Inventory every writer of the columns: services, jobs, Edge Functions, imports, seeds, RPC functions, webhooks, and administrative tools. -- Make the same CipherStash machine credentials available to the deployed application and the backfill job. +- Make the same CipherStash deployment credentials available to the application and backfill job; see [Credentials at build and runtime](/guides/deployment#credentials-at-build-and-runtime). - Decide which encrypted capability each column needs by following [EQL core concepts](/reference/eql/core-concepts). The examples migrate `patients.name` and `patients.date_of_birth`: @@ -127,7 +127,7 @@ npx stash encrypt backfill --table patients --column date_of_birth The command pages by primary key, encrypts rows in chunks, and records checkpoints. It is resumable and idempotent. For a non-interactive job, acknowledge the deployment gate with `--confirm-dual-writes-deployed`. -Run the backfill with the same CipherStash workspace and credentials as the deployed application. A local CipherStash profile may point to a different workspace, producing values the production application cannot decrypt. +Run the backfill with the same CipherStash workspace and keyset as the deployed application. A local developer profile may point to a different workspace, producing values the production application cannot decrypt. Use the deployed environment's explicit `CS_*` values for the job. diff --git a/content/docs/integrations/drizzle.mdx b/content/docs/integrations/drizzle.mdx index 9d963c4..e099aca 100644 --- a/content/docs/integrations/drizzle.mdx +++ b/content/docs/integrations/drizzle.mdx @@ -31,6 +31,12 @@ npx stash eql install The v3 install (the default) runs directly against the database and cannot generate a Drizzle migration: `--drizzle` is rejected for a v3 install. EQL is therefore not part of your migration history, so a database rebuilt from migrations will not have it. Re-run the install after a rebuild. +## Credentials + + + +The native Stack client used below discovers the four `CS_*` variables first, then falls back to the developer profile. Use separate credentials for each deployed environment. + ## Declare the table The column type *is* the capability. There are no flags to configure. `TextEq` answers equality and nothing else, `IntegerOrd` answers ranges and ordering, `TextMatch` answers free-text containment, and a bare `Text` or `Bigint` is storage-only. diff --git a/content/docs/integrations/supabase/edge-functions.mdx b/content/docs/integrations/supabase/edge-functions.mdx index 485ff2c..84969c0 100644 --- a/content/docs/integrations/supabase/edge-functions.mdx +++ b/content/docs/integrations/supabase/edge-functions.mdx @@ -35,13 +35,15 @@ Map the `wasm-inline` entries in your function's `deno.json`: Provide the four `CS_*` values explicitly through an env file when serving locally and through Supabase secrets when deployed. -Provide the `CS_*` credentials when you serve the function. Generate them with `stash env` rather than assembling the file by hand — it prints the deployment variables for the workspace you are authenticated against, so redirect it straight to the env file: + + +For an Edge Function, use the CLI or Dashboard option; the developer profile cannot cross into the Deno runtime. To create a dedicated local credential set and write it directly to the function's env file: ```bash example-id="supabase-edge-stash-env" -npx stash env > ./supabase/functions/.env.local +npx stash env --name edge-dev --write ./supabase/functions/.env.local ``` -`--write` writes to a file instead of stdout if you would rather not redirect. The command is marked experimental, so read what it emits before committing to it — and never commit the file itself. The [CLI reference](/reference/cli/env) has the full flag set. +Never commit this file. Each successful `stash env` run creates a new credential with a unique name, and the access key cannot be shown again. Then serve the function against that file: @@ -49,14 +51,7 @@ Then serve the function against that file: supabase functions serve --env-file ./supabase/functions/.env.local ``` -```sh title="supabase/functions/.env.local" -CS_WORKSPACE_CRN=crn:ap-southeast-2.aws: -CS_CLIENT_ID=... -CS_CLIENT_KEY=... -CS_CLIENT_ACCESS_KEY=... -``` - -For deployed functions, set the same values as [Edge Function secrets](https://supabase.com/dashboard/project/_/settings/functions). +For deployed functions, add the same four values as [Edge Function secrets](https://supabase.com/dashboard/project/_/settings/functions). Use a separate credential set for production rather than copying the local values. ## Encrypt and decrypt in a function diff --git a/content/docs/integrations/supabase/index.mdx b/content/docs/integrations/supabase/index.mdx index f9efeec..c26fce0 100644 --- a/content/docs/integrations/supabase/index.mdx +++ b/content/docs/integrations/supabase/index.mdx @@ -37,6 +37,7 @@ With EQL 3.0.4, the Supabase wrapper supports encrypted equality, range, and ord | Look up the complete wrapper API | [`encryptedSupabase` reference](/reference/stack/supabase) | | Bind decryption to the signed-in user | [Supabase Auth](/integrations/supabase/auth) | | Encrypt inside Supabase Edge Functions | [Edge Functions](/integrations/supabase/edge-functions) | +| Choose local or deployment credentials | [Workspace credentials](/reference/workspace/configuration#credentials) | | Use an ORM against Supabase Postgres | [Drizzle](/integrations/drizzle) or [Prisma ORM 8](/integrations/prisma) | | Encrypt columns that already contain data | [Encrypt existing data](/guides/migration/encrypt-existing-data) | | Plan a production rollout or rollback | [Deployment guide](/guides/deployment) | diff --git a/content/docs/integrations/supabase/quickstart.mdx b/content/docs/integrations/supabase/quickstart.mdx index f7dd3d4..da64681 100644 --- a/content/docs/integrations/supabase/quickstart.mdx +++ b/content/docs/integrations/supabase/quickstart.mdx @@ -58,7 +58,7 @@ If the command generates a Supabase migration instead of applying EQL directly, npx stash eql status ``` -The native Stack client automatically uses the developer profile created by this login. You do not need `CS_*` machine credentials for local development; those are for deployed environments. +The native Stack client automatically uses the developer profile created by this login. You do not need the four deployment environment variables for local development. When you deploy, [choose a deployment credential source](/guides/deployment#credentials-at-build-and-runtime). **Using an agent?** An agent can drive the same setup. If no developer profile exists, it should start `npx stash auth login --json --region --supabase`, show you the returned verification URL, and leave the command running until authorization completes. It can then run `npx stash init --supabase --region `. diff --git a/content/docs/integrations/supabase/supabase-js.mdx b/content/docs/integrations/supabase/supabase-js.mdx index 246919d..e198479 100644 --- a/content/docs/integrations/supabase/supabase-js.mdx +++ b/content/docs/integrations/supabase/supabase-js.mdx @@ -46,7 +46,11 @@ SUPABASE_ANON_KEY=... DATABASE_URL=postgresql://... ``` -The encryption client also needs a local developer profile created by `stash auth login`, or `CS_*` machine credentials in a deployed environment. The [Quickstart setup](/integrations/supabase/quickstart#initialize-cipherstash) creates and uses the developer profile. +## Credentials + + + +The [Quickstart setup](/integrations/supabase/quickstart#initialize-cipherstash) creates and uses the developer profile. In CI or a deployed application, add the four `CS_*` variables to the same server environment as the Supabase settings above. ## Create the client diff --git a/content/docs/reference/proxy/configuration.mdx b/content/docs/reference/proxy/configuration.mdx index e98b04a..2eac736 100644 --- a/content/docs/reference/proxy/configuration.mdx +++ b/content/docs/reference/proxy/configuration.mdx @@ -48,7 +48,7 @@ docker compose up Unlike the Stack SDK, Proxy **always requires credentials to be supplied explicitly**, because it runs as a separate process or container and cannot use the host's device-based authentication. -For local development, create a client key and access key in the [Dashboard](https://dashboard.cipherstash.com). For production, see [Going to production](/stack/deploy/going-to-production). +Create the four variables with `stash env` or the Dashboard, then supply them to the Proxy container. [Workspace credentials](/reference/workspace/configuration#credentials) shows both options and the complete environment block. ## Setting up the database schema diff --git a/content/docs/reference/workspace/configuration.mdx b/content/docs/reference/workspace/configuration.mdx index 87d6622..74fa37d 100644 --- a/content/docs/reference/workspace/configuration.mdx +++ b/content/docs/reference/workspace/configuration.mdx @@ -7,19 +7,11 @@ components: [platform, encryption] A workspace is identified by its **CRN** and accessed with a **client key** and an **access key**. How those credentials reach your application differs between local development and production. -## Local development +## Credentials -For local development, credentials are handled automatically by device-based authentication. Run `stash init` to set up your device: + -```bash cta cta-type="quickstart" example-id="stash-init-workspace" -npx stash init -``` - -This creates a device-backed client key with access to the workspace's default keyset. No environment variables are needed. - -## Production credentials - -In production and CI/CD, a workspace is configured with explicit credentials: +## What the deployment variables mean | Credential | Description | |---|---| @@ -28,9 +20,7 @@ In production and CI/CD, a workspace is configured with explicit credentials: | Client key | Your half of the dual-party key split | | Access key | Authenticates API calls to CipherStash | -These are the same credentials the [Stack SDK](/reference/stack) and [Proxy](/reference/proxy/configuration) consume. For the full set of environment variables and programmatic options, see the [Stack SDK configuration reference](/reference/stack). - -See [going to production](/stack/deploy/going-to-production) for a step-by-step guide to generating them. +These are the same credentials the [Stack SDK](/reference/stack) and [Proxy](/reference/proxy/configuration) consume. For build-time availability, environment separation, and production rollout gates, see [Deployment](/guides/deployment). ## Keysets From 0f957a3662b1f2be25fd5ea3330df9fcc4108de9 Mon Sep 17 00:00:00 2001 From: Dan Draper Date: Thu, 30 Jul 2026 20:51:19 +1000 Subject: [PATCH 2/8] docs: refine credential option hierarchy --- src/components/cipherstash-credentials.tsx | 69 ++++++++++++---------- 1 file changed, 37 insertions(+), 32 deletions(-) diff --git a/src/components/cipherstash-credentials.tsx b/src/components/cipherstash-credentials.tsx index 5fa5c4b..fe7bb48 100644 --- a/src/components/cipherstash-credentials.tsx +++ b/src/components/cipherstash-credentials.tsx @@ -12,31 +12,31 @@ const options = [ title: "Developer profile", useFor: "Local development", icon: Laptop, - content: ( + action: ( <> - Run npx stash auth login. The native Stack client finds the - resulting developer profile automatically, so you do not need - environment variables on your development machine. + Run npx stash auth login. ), + description: + "The native Stack client uses the developer profile automatically.", }, { title: "stash env", - useFor: "CI and deployed environments", + useFor: "CI and Deployment", icon: Terminal, - content: ( + action: ( <> - Run npx stash env --name <app-env> while logged in. - It creates a client and prints the four environment variables below. The - access key is shown only once. + Run npx stash env --name <app-env>. ), + description: + "Creates a client and prints the four variables below. The access key is shown once.", }, { title: "Dashboard", - useFor: "CI and deployed environments", + useFor: "CI and Deployment", icon: LayoutDashboard, - content: ( + action: ( <> Open your{" "} {" "} - and create deployment credentials there. Add the resulting values to - your platform's secret store. + and create deployment credentials. ), + description: "Save the values in your platform’s secret store.", }, ] as const; @@ -77,26 +77,31 @@ export function CipherStashCredentials() {
    - {options.map(({ title, useFor, icon: Icon, content }, index) => ( -
  1. -
    - - -
    -

    - {index + 1}. {title} -

    -

    - {useFor} -

    + {options.map( + ({ title, useFor, icon: Icon, action, description }, index) => ( +
  2. +
    + + +
    +

    + {index + 1}. {title} +

    +

    + {useFor} +

    +
    - -

    - {content} -

    -
    3. - ))} +

    + {action} +

    +

    + {description} +

    + + ), + )}
From 81ba1bead01a7d3bc85ad7aaf692c9e158c9b357 Mon Sep 17 00:00:00 2001 From: Dan Draper Date: Thu, 30 Jul 2026 21:01:03 +1000 Subject: [PATCH 3/8] docs: add copyable credential commands --- src/components/cipherstash-credentials.tsx | 59 ++++++++++++++++------ 1 file changed, 44 insertions(+), 15 deletions(-) diff --git a/src/components/cipherstash-credentials.tsx b/src/components/cipherstash-credentials.tsx index fe7bb48..5517efe 100644 --- a/src/components/cipherstash-credentials.tsx +++ b/src/components/cipherstash-credentials.tsx @@ -1,5 +1,9 @@ +"use client"; + +import type { CodeBlockProps } from "fumadocs-ui/components/codeblock"; import { DynamicCodeBlock } from "fumadocs-ui/components/dynamic-codeblock"; import { ExternalLink, Laptop, LayoutDashboard, Terminal } from "lucide-react"; +import { TrackedCodeBlock } from "@/components/code-block"; import { cipherstashDark, cipherstashLight } from "@/lib/shiki-themes"; const ENVIRONMENT_VARIABLES = `CS_WORKSPACE_CRN=crn:.: @@ -12,11 +16,8 @@ const options = [ title: "Developer profile", useFor: "Local development", icon: Laptop, - action: ( - <> - Run npx stash auth login. - - ), + command: "npx stash auth login", + action: null, description: "The native Stack client uses the developer profile automatically.", }, @@ -24,11 +25,8 @@ const options = [ title: "stash env", useFor: "CI and Deployment", icon: Terminal, - action: ( - <> - Run npx stash env --name <app-env>. - - ), + command: "npx stash env --name ", + action: null, description: "Creates a client and prints the four variables below. The access key is shown once.", }, @@ -36,6 +34,7 @@ const options = [ title: "Dashboard", useFor: "CI and Deployment", icon: LayoutDashboard, + command: null, action: ( <> Open your{" "} @@ -58,6 +57,16 @@ const options = [ }, ] as const; +function TrackedBashCodeBlock(props: CodeBlockProps) { + return ( + + ); +} + /** * The canonical credential-source chooser for integration and deployment * guides. Keep the discovery order and environment-variable names aligned @@ -78,7 +87,10 @@ export function CipherStashCredentials() {
    {options.map( - ({ title, useFor, icon: Icon, action, description }, index) => ( + ( + { title, useFor, icon: Icon, command, action, description }, + index, + ) => (
  1. @@ -93,10 +105,27 @@ export function CipherStashCredentials() {

-

- {action} -

-

+ {command ? ( +

+

Run:

+ +
+ ) : ( +

+ {action} +

+ )} +

{description}

From f3c033c128e69c36fa2036e7f8111ccb6b0878a6 Mon Sep 17 00:00:00 2001 From: Dan Draper Date: Thu, 30 Jul 2026 21:07:47 +1000 Subject: [PATCH 4/8] docs: present credential options as tabs --- src/components/cipherstash-credentials.tsx | 110 ++++++++++++--------- 1 file changed, 65 insertions(+), 45 deletions(-) diff --git a/src/components/cipherstash-credentials.tsx b/src/components/cipherstash-credentials.tsx index 5517efe..eb9996e 100644 --- a/src/components/cipherstash-credentials.tsx +++ b/src/components/cipherstash-credentials.tsx @@ -2,6 +2,12 @@ import type { CodeBlockProps } from "fumadocs-ui/components/codeblock"; import { DynamicCodeBlock } from "fumadocs-ui/components/dynamic-codeblock"; +import { + Tabs, + TabsContent, + TabsList, + TabsTrigger, +} from "fumadocs-ui/components/tabs"; import { ExternalLink, Laptop, LayoutDashboard, Terminal } from "lucide-react"; import { TrackedCodeBlock } from "@/components/code-block"; import { cipherstashDark, cipherstashLight } from "@/lib/shiki-themes"; @@ -13,6 +19,7 @@ CS_CLIENT_ACCESS_KEY=CSAK...`; const options = [ { + value: "developer-profile", title: "Developer profile", useFor: "Local development", icon: Laptop, @@ -22,6 +29,7 @@ const options = [ "The native Stack client uses the developer profile automatically.", }, { + value: "stash-env", title: "stash env", useFor: "CI and Deployment", icon: Terminal, @@ -31,6 +39,7 @@ const options = [ "Creates a client and prints the four variables below. The access key is shown once.", }, { + value: "dashboard", title: "Dashboard", useFor: "CI and Deployment", icon: LayoutDashboard, @@ -85,53 +94,64 @@ export function CipherStashCredentials() {

-
    - {options.map( - ( - { title, useFor, icon: Icon, command, action, description }, - index, - ) => ( -
  1. -
    - -
    - {command ? ( -
    -

    Run:

    - -
    - ) : ( -

    - {action} -

    - )} -

    - {description} + + {useFor} + + + + ))} + + + {options.map(({ value, command, action, description }) => ( + + {command ? ( + <> +

    Run:

    + + + ) : ( +

    + {action}

    -
    2. - ), - )} -
+ )} +

+ {description} +

+ + ))} +

From 40325086b18cc822fc1d8a91990eebcdd40212e1 Mon Sep 17 00:00:00 2001 From: Dan Draper Date: Thu, 30 Jul 2026 21:10:20 +1000 Subject: [PATCH 5/8] docs: scope deployment variables to deployment tabs --- src/components/cipherstash-credentials.tsx | 45 +++++++++++++--------- 1 file changed, 26 insertions(+), 19 deletions(-) diff --git a/src/components/cipherstash-credentials.tsx b/src/components/cipherstash-credentials.tsx index eb9996e..c59c3b4 100644 --- a/src/components/cipherstash-credentials.tsx +++ b/src/components/cipherstash-credentials.tsx @@ -76,6 +76,29 @@ function TrackedBashCodeBlock(props: CodeBlockProps) { ); } +function DeploymentEnvironmentVariables() { + return ( +

+

+ Deployment environment variables +

+

+ Both deployment methods produce the same values. Treat{" "} + CS_CLIENT_KEY and CS_CLIENT_ACCESS_KEY as + secrets. +

+ +
+ ); +} + /** * The canonical credential-source chooser for integration and deployment * guides. Keep the discovery order and environment-variable names aligned @@ -149,28 +172,12 @@ export function CipherStashCredentials() {

{description}

+ {value !== "developer-profile" && ( + + )} ))} - -
-

- Deployment environment variables -

-

- Both deployment methods produce the same values. Treat{" "} - CS_CLIENT_KEY and CS_CLIENT_ACCESS_KEY as - secrets. -

- -
); } From 14f328eb48ba28cd5ddcd3f13b0f8599bbbcda5a Mon Sep 17 00:00:00 2001 From: Dan Draper Date: Thu, 30 Jul 2026 21:15:57 +1000 Subject: [PATCH 6/8] docs: polish credential variable styling --- src/components/cipherstash-credentials.tsx | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/components/cipherstash-credentials.tsx b/src/components/cipherstash-credentials.tsx index c59c3b4..655eaa9 100644 --- a/src/components/cipherstash-credentials.tsx +++ b/src/components/cipherstash-credentials.tsx @@ -82,10 +82,11 @@ function DeploymentEnvironmentVariables() {

Deployment environment variables

-

- Both deployment methods produce the same values. Treat{" "} - CS_CLIENT_KEY and CS_CLIENT_ACCESS_KEY as - secrets. +

+ Both deployment methods produce the same values. +
+ Treat CS_CLIENT_KEY and CS_CLIENT_ACCESS_KEY{" "} + as secrets.

Date: Thu, 30 Jul 2026 21:18:18 +1000 Subject: [PATCH 7/8] fix: use credential dropdown on narrow screens --- src/components/cipherstash-credentials.tsx | 55 +++++++++++++++++++--- 1 file changed, 49 insertions(+), 6 deletions(-) diff --git a/src/components/cipherstash-credentials.tsx b/src/components/cipherstash-credentials.tsx index 655eaa9..af5ad63 100644 --- a/src/components/cipherstash-credentials.tsx +++ b/src/components/cipherstash-credentials.tsx @@ -7,8 +7,15 @@ import { TabsContent, TabsList, TabsTrigger, -} from "fumadocs-ui/components/tabs"; -import { ExternalLink, Laptop, LayoutDashboard, Terminal } from "lucide-react"; +} from "fumadocs-ui/components/ui/tabs"; +import { + ChevronDown, + ExternalLink, + Laptop, + LayoutDashboard, + Terminal, +} from "lucide-react"; +import { useId, useState } from "react"; import { TrackedCodeBlock } from "@/components/code-block"; import { cipherstashDark, cipherstashLight } from "@/lib/shiki-themes"; @@ -66,6 +73,8 @@ const options = [ }, ] as const; +type CredentialOptionValue = (typeof options)[number]["value"]; + function TrackedBashCodeBlock(props: CodeBlockProps) { return ( ( + options[0].value, + ); + return (
@@ -119,15 +133,44 @@ export function CipherStashCredentials() {
+ setSelectedOption(value as CredentialOptionValue) + } className="my-0 gap-0 overflow-visible rounded-none border-0 bg-transparent" > - +
+ +
+ +
+
+ + {options.map(({ value, title, useFor, icon: Icon }, index) => (