feat(cli): make stash env mint real deployment credentials

The command was a gated stub (STASH_EXPERIMENTAL_ENV_CMD) waiting on "the
CTS mint endpoint" — which turned out to already exist. It now mints
working credentials from the device-code session using the same APIs the
dashboard uses, all plain fetch against the session's own service URLs:

1. GET  {cts}/api/workspaces    → server-authoritative region → CS_WORKSPACE_CRN
2. POST {zerokms}/create-client → CS_CLIENT_ID / CS_CLIENT_KEY (hex-transcoded)
3. POST {cts}/api/access-keys   → CS_CLIENT_ACCESS_KEY (member role, always —
   the CLI deliberately cannot mint admin keys; role is omitted so the
   server owns the default)

Design points:
- The ZeroKMS client is created before the access key, so a partial
  failure leaves an inert client record, never an unaccounted-for live
  credential.
- The key name resolves before any profile/network access, so the
  non-interactive missing-name failure is credential-free — that is the
  seam the new pty-less e2e exercises (minting live keys from a dev
  machine's real session in tests is deliberately impossible).
- --write emits .env.production.local with mode 0600 and refuses to
  overwrite non-interactively; --json emits one minted object or the
  shared { status: 'error' } envelope.

Closes #663 (the wasm/edge credential gap, CIP-2997): edge runtimes that
cannot read ~/.cipherstash (containerised supabase functions serve,
Workers) now have a supported path — stash env + --env-file/secret store.

Claude-Session: https://claude.ai/code/session_01MxTTPaPP16m6br7Hoab94w

Author: coderdan

.changeset/stash-env-mint-credentials.md

@@ -0,0 +1,19 @@
+---
+'stash': minor
+---
+
+`stash env` now works: it mints deployment credentials from your device-code
+session and prints them as env vars — no dashboard copy-paste. The command
+creates a fresh ZeroKMS client and a member-role CipherStash access key (named
+via `--name`), then emits `CS_WORKSPACE_CRN`, `CS_CLIENT_ID`, `CS_CLIENT_KEY`,
+and `CS_CLIENT_ACCESS_KEY` to stdout, `--write` (`.env.production.local`, mode
+0600), or `--json`. Creating access keys requires the admin role in the
+workspace; the minted key itself is always member — the CLI deliberately
+cannot mint admin keys.
+
+This is also the supported credential path for WASM/edge local development
+(Supabase Edge Functions, Cloudflare Workers, Deno), where the runtime cannot
+read the `~/.cipherstash` device profile: mint a key and feed it via
+`--env-file` or the platform's secret store.
+
+The `STASH_EXPERIMENTAL_ENV_CMD` gate is removed.

packages/cli/src/bin/main.ts

@@ -125,7 +125,7 @@ Commands:
   encrypt cutover      Rename swap encrypted → primary column (EQL v2 only)
   encrypt drop         Generate a migration to drop the plaintext column
 
-  env                  (experimental) Print production env vars for deployment
+  env                  Mint deployment credentials and print them as env vars
 
 Options:
   --help, -h           Show help
@@ -532,7 +532,11 @@ async function dispatch(
       await runSchemaCommand(subcommand, flags, values)
       break
     case 'env':
-      await envCommand({ write: flags.write })
+      await envCommand({
+        write: flags.write,
+        json: flags.json,
+        name: values.name,
+      })
       break
     case 'manifest':
       // Pure metadata (no native code) — safe to run anywhere, including when

packages/cli/src/cli/registry.ts

@@ -530,15 +530,43 @@ export const registry: CommandGroup[] = [
     ],
   },
   {
-    title: 'Experimental',
+    title: 'Deployment',
     commands: [
       {
         name: 'env',
-        summary: '(experimental) Print production env vars for deployment',
+        summary: 'Mint deployment credentials and print them as env vars',
+        long: [
+          'Mints a fresh ZeroKMS client and a CipherStash access key from your',
+          'device-code session (`stash auth login`), then prints the four env',
+          'vars a deployed app needs: CS_WORKSPACE_CRN, CS_CLIENT_ID,',
+          'CS_CLIENT_KEY, CS_CLIENT_ACCESS_KEY.',
+          '',
+          'The access key is created with the member role (the CLI never mints',
+          'admin keys) and is shown exactly once — pipe the output into your',
+          'deployment secret store. Creating access keys requires your user to',
+          'have the admin role in the workspace.',
+        ].join('\n'),
+        examples: [
+          'env --name my-app-prod',
+          'env --name my-app-prod --write',
+          'env --name edge-dev --json',
+        ],
         flags: [
+          {
+            name: '--name',
+            value: '<name>',
+            description:
+              'Name for the minted access key and ZeroKMS client. Prompted for interactively; required in non-interactive runs.',
+          },
           {
             name: '--write',
-            description: 'Write the vars to a file instead of printing them.',
+            description:
+              'Write the vars to .env.production.local (mode 0600) instead of printing them.',
+          },
+          {
+            name: '--json',
+            description:
+              'Emit a single machine-readable JSON object (or a { status: "error" } envelope) instead of a dotenv block. Implies no prompts.',
           },
         ],
       },