@appfleet-cli/cli 0.1.0

package/dist/local-vault.js

@@ -0,0 +1,1169 @@
+import { spawn } from "node:child_process";
+import { createHmac, randomUUID } from "node:crypto";
+import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { AppFleetCryptoAuthError, decryptCredentialValue, encryptCredentialValue, generateUserHeldRecoveryKey, generateWorkspaceVaultKey, masterPasswordProfiles, packageEncryptedCredentialEnvelopeForCloud, packageKeyWrapperEnvelopeForCloud, unwrapWorkspaceVaultKeyWithMasterPassword, wrapWorkspaceVaultKeyWithMasterPassword, } from "@appfleet/crypto";
+import { appCredentialStatusValues, createAppCredentialMetadata, createAppKeyWrapperMetadata, createDeviceKeyUnlockMetadata, createEmergencyRecoveryKitMetadata, createLocalSensitiveAuditEvent, createCloudSecretEncryptedEnvelopeRecord, createCloudSecretSyncRequest, createOsKeychainIntegrationMetadata, } from "@appfleet/domain";
+class LocalVaultCliError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "LocalVaultCliError";
+    }
+}
+const defaultVaultPath = resolve(".appfleet", "local-vault.json");
+const defaultAuditPath = resolve(".appfleet", "vault-audit.jsonl");
+const defaultSecretSyncPath = resolve(".appfleet", "cloud-secret-sync.json");
+const secretAliasPattern = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export function parseLocalVaultCommand(argv) {
+    const normalizedArgv = argv[0] === "--" ? argv.slice(1) : argv;
+    const namespace = normalizedArgv[0];
+    const action = normalizedArgv[1];
+    if (namespace === "vault" && action === "init") {
+        return {
+            action: "vault-init",
+            workspaceId: readFlag(normalizedArgv, "--workspace") ?? "workspace_local",
+            masterPassword: readFlag(normalizedArgv, "--master-password"),
+        };
+    }
+    if (namespace === "vault" && action === "unlock") {
+        return {
+            action: "vault-unlock",
+            masterPassword: readFlag(normalizedArgv, "--master-password"),
+        };
+    }
+    if (namespace === "vault" && action === "change-password") {
+        return {
+            action: "vault-change-password",
+            masterPassword: readFlag(normalizedArgv, "--master-password"),
+            newMasterPassword: readFlag(normalizedArgv, "--new-master-password"),
+        };
+    }
+    if (namespace === "vault" && action === "recovery") {
+        const recoveryAction = normalizedArgv[2];
+        if (recoveryAction === "generate") {
+            return {
+                action: "vault-recovery-generate",
+                masterPassword: readFlag(normalizedArgv, "--master-password"),
+                recoveryKey: readFlag(normalizedArgv, "--recovery-key"),
+            };
+        }
+        if (recoveryAction === "unlock") {
+            return {
+                action: "vault-recovery-unlock",
+                recoveryKey: readFlag(normalizedArgv, "--recovery-key"),
+            };
+        }
+        if (recoveryAction === "rotate") {
+            return {
+                action: "vault-recovery-rotate",
+                masterPassword: readFlag(normalizedArgv, "--master-password"),
+                recoveryKey: readFlag(normalizedArgv, "--recovery-key"),
+            };
+        }
+        if (recoveryAction === "kit") {
+            return {
+                action: "vault-recovery-kit",
+            };
+        }
+    }
+    if (namespace === "vault" && action === "device-key" && normalizedArgv[2] === "register") {
+        const deviceId = readFlag(normalizedArgv, "--device");
+        const deviceLabel = readFlag(normalizedArgv, "--label") ?? deviceId;
+        if (!deviceId || !deviceLabel) {
+            throw new LocalVaultCliError("InvalidArguments", "usage: vault device-key register --device <device-id> [--label <label>]");
+        }
+        return {
+            action: "vault-device-key-register",
+            deviceId,
+            deviceLabel,
+        };
+    }
+    if (namespace === "vault" && action === "keychain" && normalizedArgv[2] === "status") {
+        return {
+            action: "vault-keychain-status",
+            provider: readKeychainProviderFlag(normalizedArgv),
+        };
+    }
+    if (namespace === "secrets" && action === "set") {
+        const project = normalizedArgv[2];
+        const environment = readFlag(normalizedArgv, "--env");
+        const alias = readFlag(normalizedArgv, "--alias");
+        if (!project || !environment || !alias) {
+            throw new LocalVaultCliError("InvalidArguments", "usage: secrets set <project> --env <env> --alias <NAME> [--value <value>]");
+        }
+        assertValidAlias(alias);
+        const status = readCredentialStatusFlag(normalizedArgv) ?? "active";
+        return {
+            action: "secrets-set",
+            project,
+            environment,
+            alias,
+            label: readFlag(normalizedArgv, "--label"),
+            status,
+            value: readFlag(normalizedArgv, "--value"),
+            masterPassword: readFlag(normalizedArgv, "--master-password"),
+        };
+    }
+    if (namespace === "secrets" && action === "list") {
+        const project = normalizedArgv[2];
+        if (!project) {
+            throw new LocalVaultCliError("InvalidArguments", "usage: secrets list <project> [--env <env>]");
+        }
+        return {
+            action: "secrets-list",
+            project,
+            environment: readFlag(normalizedArgv, "--env"),
+        };
+    }
+    if (namespace === "secrets" && action === "inject") {
+        const project = normalizedArgv[2];
+        const separatorIndex = normalizedArgv.indexOf("--");
+        const appfleetArgs = separatorIndex === -1 ? normalizedArgv : normalizedArgv.slice(0, separatorIndex);
+        const environment = readFlag(appfleetArgs, "--env");
+        if (!project || !environment || separatorIndex === -1) {
+            throw new LocalVaultCliError("InvalidArguments", "usage: secrets inject <project> --env <env> -- <command> [args...]");
+        }
+        const command = normalizedArgv[separatorIndex + 1];
+        if (!command) {
+            throw new LocalVaultCliError("MissingChildCommand", "-- must be followed by a child command");
+        }
+        return {
+            action: "secrets-inject",
+            project,
+            environment,
+            masterPassword: readFlag(appfleetArgs, "--master-password"),
+            command,
+            args: normalizedArgv.slice(separatorIndex + 2),
+        };
+    }
+    if (namespace === "secrets" && (action === "upload" || action === "sync")) {
+        return {
+            action: "secrets-upload",
+            outputPath: readFlag(normalizedArgv, "--output"),
+        };
+    }
+    if (namespace === "secrets" && action === "download") {
+        return {
+            action: "secrets-download",
+            inputPath: readFlag(normalizedArgv, "--input"),
+        };
+    }
+    throw new LocalVaultCliError("UnsupportedCommand", "usage: vault <init|unlock> or secrets <set|list|inject>");
+}
+export async function runLocalVaultCommand(argv, options = {}) {
+    const vaultPath = options.vaultPath ??
+        options.env?.APPFLEET_LOCAL_VAULT_PATH ??
+        process.env.APPFLEET_LOCAL_VAULT_PATH ??
+        defaultVaultPath;
+    const auditPath = options.auditPath ??
+        options.env?.APPFLEET_AUDIT_PATH ??
+        process.env.APPFLEET_AUDIT_PATH ??
+        defaultAuditPath;
+    const env = options.env ?? process.env;
+    const now = options.now ?? (() => new Date());
+    let parsed;
+    try {
+        parsed = parseLocalVaultCommand(argv);
+    }
+    catch (error) {
+        return commandError(error);
+    }
+    try {
+        if (parsed.action === "vault-init") {
+            const existingStore = await tryReadLocalVaultStore(vaultPath);
+            if (existingStore) {
+                return {
+                    exitCode: 0,
+                    stdout: [
+                        "AppFleet local vault already initialized.",
+                        `workspace=${existingStore.workspaceId}`,
+                        `vaultPath=${vaultPath}`,
+                        "cloudPersistence=scaffold-only",
+                    ].join("\n") + "\n",
+                    stderr: "",
+                };
+            }
+            const masterPassword = resolveMasterPassword(parsed.masterPassword, env);
+            const store = await createLocalVaultStore({
+                workspaceId: parsed.workspaceId,
+                masterPassword,
+                now,
+            });
+            await writeLocalVaultStore(vaultPath, store);
+            return {
+                exitCode: 0,
+                stdout: [
+                    "AppFleet local vault initialized.",
+                    `workspace=${store.workspaceId}`,
+                    `vaultPath=${vaultPath}`,
+                    "secrets=0",
+                    "cloudPersistence=scaffold-only",
+                ].join("\n") + "\n",
+                stderr: "",
+            };
+        }
+        if (parsed.action === "vault-unlock") {
+            const store = await readLocalVaultStore(vaultPath);
+            await unwrapLocalVaultKey(store, resolveMasterPassword(parsed.masterPassword, env));
+            return {
+                exitCode: 0,
+                stdout: [
+                    "AppFleet local vault unlocked.",
+                    `workspace=${store.workspaceId}`,
+                    `vaultPath=${vaultPath}`,
+                    `secrets=${store.credentials.length}`,
+                    "plaintextKeyPrinted=false",
+                ].join("\n") + "\n",
+                stderr: "",
+            };
+        }
+        if (parsed.action === "vault-change-password") {
+            const store = await readLocalVaultStore(vaultPath);
+            const workspaceVaultKey = await unwrapLocalVaultKey(store, resolveMasterPassword(parsed.masterPassword, env));
+            const updatedStore = await replaceKeyWrapper({
+                store,
+                workspaceVaultKey,
+                secret: resolveNewMasterPassword(parsed.newMasterPassword, env),
+                unlockMethod: "master_password",
+                now,
+            });
+            await writeLocalVaultStore(vaultPath, updatedStore);
+            return {
+                exitCode: 0,
+                stdout: [
+                    "AppFleet master password changed.",
+                    `workspace=${store.workspaceId}`,
+                    "oldWrapperState=revoked",
+                    "newWrapperState=active",
+                    "plaintextKeyPrinted=false",
+                ].join("\n") + "\n",
+                stderr: "",
+            };
+        }
+        if (parsed.action === "vault-recovery-generate") {
+            const store = await readLocalVaultStore(vaultPath);
+            const recoveryKey = parsed.recoveryKey ?? env.APPFLEET_RECOVERY_KEY;
+            const generatedRecoveryKey = recoveryKey ?? await generateUserHeldRecoveryKey();
+            const workspaceVaultKey = await unwrapLocalVaultKey(store, resolveMasterPassword(parsed.masterPassword, env));
+            const updatedStore = await replaceKeyWrapper({
+                store,
+                workspaceVaultKey,
+                secret: generatedRecoveryKey,
+                unlockMethod: "recovery_key",
+                now,
+            });
+            await writeLocalVaultStore(vaultPath, updatedStore);
+            return {
+                exitCode: 0,
+                stdout: [
+                    "AppFleet recovery key wrapper generated.",
+                    `workspace=${store.workspaceId}`,
+                    "recoveryKeyPrinted=false",
+                    "recoveryKitMetadata=true",
+                    "plaintextKeyPrinted=false",
+                ].join("\n") + "\n",
+                stderr: "",
+            };
+        }
+        if (parsed.action === "vault-recovery-unlock") {
+            const store = await readLocalVaultStore(vaultPath);
+            await unwrapLocalVaultKeyWithSecret(store, "recovery_key", resolveRecoveryKey(parsed.recoveryKey, env));
+            return {
+                exitCode: 0,
+                stdout: [
+                    "AppFleet local vault unlocked by recovery metadata.",
+                    `workspace=${store.workspaceId}`,
+                    "recoveryKeyPrinted=false",
+                    "plaintextKeyPrinted=false",
+                ].join("\n") + "\n",
+                stderr: "",
+            };
+        }
+        if (parsed.action === "vault-recovery-rotate") {
+            const store = await readLocalVaultStore(vaultPath);
+            const workspaceVaultKey = await unwrapLocalVaultKey(store, resolveMasterPassword(parsed.masterPassword, env));
+            const updatedStore = await replaceKeyWrapper({
+                store,
+                workspaceVaultKey,
+                secret: resolveRecoveryKey(parsed.recoveryKey, env),
+                unlockMethod: "recovery_key",
+                now,
+            });
+            await writeLocalVaultStore(vaultPath, updatedStore);
+            return {
+                exitCode: 0,
+                stdout: [
+                    "AppFleet recovery key wrapper rotated.",
+                    `workspace=${store.workspaceId}`,
+                    "oldRecoveryWrapperState=revoked",
+                    "newRecoveryWrapperState=active",
+                    "recoveryKeyPrinted=false",
+                    "plaintextKeyPrinted=false",
+                ].join("\n") + "\n",
+                stderr: "",
+            };
+        }
+        if (parsed.action === "vault-recovery-kit") {
+            const store = await readLocalVaultStore(vaultPath);
+            return {
+                exitCode: 0,
+                stdout: [
+                    "AppFleet emergency recovery kit metadata.",
+                    `workspace=${store.workspaceId}`,
+                    `state=${store.recoveryKit?.state ?? "missing"}`,
+                    `recoveryWrapper=${store.recoveryKit?.recoveryKeyWrapperId ?? "missing"}`,
+                    "userHeldRecoveryKeyRequired=true",
+                    "printableKitIncludesSecretMaterial=false",
+                    "renderedByWeb=false",
+                ].join("\n") + "\n",
+                stderr: "",
+            };
+        }
+        if (parsed.action === "vault-device-key-register") {
+            const store = await readLocalVaultStore(vaultPath);
+            const updatedAt = now().toISOString();
+            const metadata = createDeviceKeyUnlockMetadata({
+                type: "device_key_unlock_metadata",
+                version: 1,
+                workspaceId: store.workspaceId,
+                deviceId: parsed.deviceId,
+                deviceLabel: parsed.deviceLabel,
+                createdAt: updatedAt,
+                updatedAt,
+                unlockImplemented: false,
+                containsPlaintextKeyMaterial: false,
+                containsPlaintextSecret: false,
+                productionCloudPersistenceImplemented: false,
+            });
+            await writeLocalVaultStore(vaultPath, {
+                ...store,
+                deviceKeyUnlocks: upsertDeviceKeyUnlock(store.deviceKeyUnlocks ?? [], metadata),
+            });
+            return {
+                exitCode: 0,
+                stdout: [
+                    "AppFleet device-key unlock metadata recorded.",
+                    `workspace=${store.workspaceId}`,
+                    `device=${metadata.deviceId}`,
+                    "unlockImplemented=false",
+                    "keyMaterialStored=false",
+                ].join("\n") + "\n",
+                stderr: "",
+            };
+        }
+        if (parsed.action === "vault-keychain-status") {
+            const store = await readLocalVaultStore(vaultPath);
+            const updatedAt = now().toISOString();
+            const metadata = createOsKeychainIntegrationMetadata({
+                type: "os_keychain_integration_metadata",
+                version: 1,
+                workspaceId: store.workspaceId,
+                provider: parsed.provider ?? "macos_keychain",
+                createdAt: store.osKeychainIntegration?.createdAt ?? updatedAt,
+                updatedAt,
+                integrationImplemented: false,
+                storesKeyMaterialInAppFleetStore: false,
+                containsPlaintextKeyMaterial: false,
+                containsPlaintextSecret: false,
+                productionCloudPersistenceImplemented: false,
+            });
+            await writeLocalVaultStore(vaultPath, {
+                ...store,
+                osKeychainIntegration: metadata,
+            });
+            return {
+                exitCode: 0,
+                stdout: [
+                    "AppFleet OS keychain integration boundary.",
+                    `workspace=${store.workspaceId}`,
+                    `provider=${metadata.provider}`,
+                    "integrationImplemented=false",
+                    "storesKeyMaterialInAppFleetStore=false",
+                ].join("\n") + "\n",
+                stderr: "",
+            };
+        }
+        if (parsed.action === "secrets-set") {
+            const store = await readLocalVaultStore(vaultPath);
+            const masterPassword = resolveMasterPassword(parsed.masterPassword, env);
+            const secretValue = resolveSecretValue(parsed.value, env);
+            const workspaceVaultKey = await unwrapLocalVaultKey(store, masterPassword);
+            const recordId = credentialRecordId(parsed.project, parsed.environment, parsed.alias);
+            const existing = store.credentials.find((record) => record.id === recordId);
+            const existingMetadata = existing
+                ? credentialMetadataForRecord(existing)
+                : undefined;
+            const createdAt = existing?.createdAt ?? now().toISOString();
+            const updatedAt = now().toISOString();
+            const versionOrdinal = (existingMetadata?.versionHistory?.length ?? 0) + 1;
+            const versionId = `${recordId}.v${versionOrdinal}`;
+            const versionHistory = [
+                ...(existingMetadata?.versionHistory ?? []).map((version) => version.status === "current"
+                    ? {
+                        ...version,
+                        status: "superseded",
+                        supersededAt: updatedAt,
+                    }
+                    : version),
+                {
+                    type: "credential_version_metadata",
+                    version: 1,
+                    versionId,
+                    credentialId: recordId,
+                    ordinal: versionOrdinal,
+                    status: "current",
+                    createdAt: updatedAt,
+                    rotatedAt: existing ? updatedAt : undefined,
+                    valueStoredByAppFleetCloud: false,
+                    containsCredentialValues: false,
+                    storesDecryptedMaterial: false,
+                },
+            ];
+            const envelope = await encryptCredentialValue({
+                plaintext: secretValue,
+                workspaceVaultKey,
+                workspaceId: store.workspaceId,
+                recordId,
+                keyGenerationId: store.keyGenerationId,
+                createdAt: updatedAt,
+            });
+            const record = {
+                id: recordId,
+                project: parsed.project,
+                environment: parsed.environment,
+                alias: parsed.alias,
+                metadata: createAppCredentialMetadata({
+                    type: "credential_metadata",
+                    version: 1,
+                    credentialId: recordId,
+                    projectId: parsed.project,
+                    environment: parsed.environment,
+                    label: parsed.label ?? existingMetadata?.label ?? parsed.alias,
+                    envAliases: [parsed.alias],
+                    status: parsed.status,
+                    createdAt,
+                    updatedAt,
+                    currentVersionId: versionId,
+                    versionHistory,
+                    bindings: [
+                        {
+                            type: "credential_binding",
+                            version: 1,
+                            bindingId: `${recordId}.binding.${parsed.alias}`,
+                            credentialId: recordId,
+                            projectId: parsed.project,
+                            environment: parsed.environment,
+                            envAlias: parsed.alias,
+                            purpose: "Local encrypted vault alias binding.",
+                            status: "active",
+                            createdAt,
+                            updatedAt,
+                            valueStoredByAppFleetCloud: false,
+                            containsCredentialValues: false,
+                            storesDecryptedMaterial: false,
+                        },
+                    ],
+                    rotatedAt: existing ? updatedAt : undefined,
+                    keyedFingerprint: createCredentialFingerprint({
+                        workspaceVaultKey,
+                        workspaceId: store.workspaceId,
+                        keyId: store.keyGenerationId,
+                        project: parsed.project,
+                        environment: parsed.environment,
+                        alias: parsed.alias,
+                        secretValue,
+                        createdAt: updatedAt,
+                    }),
+                    valueStoredByAppFleetCloud: false,
+                }),
+                createdAt,
+                updatedAt,
+                envelope,
+            };
+            const nextCredentials = existing
+                ? store.credentials.map((candidate) => candidate.id === recordId ? record : candidate)
+                : [...store.credentials, record];
+            await writeLocalVaultStore(vaultPath, {
+                ...store,
+                credentials: nextCredentials,
+            });
+            return {
+                exitCode: 0,
+                stdout: [
+                    "AppFleet secret stored.",
+                    `project=${parsed.project}`,
+                    `env=${parsed.environment}`,
+                    `alias=${parsed.alias}`,
+                    `label=${credentialMetadataForRecord(record).label}`,
+                    `status=${credentialMetadataForRecord(record).status}`,
+                    "encrypted=true",
+                    "valuePrinted=false",
+                ].join("\n") + "\n",
+                stderr: "",
+            };
+        }
+        if (parsed.action === "secrets-list") {
+            const store = await readLocalVaultStore(vaultPath);
+            const credentials = store.credentials.filter((record) => record.project === parsed.project &&
+                (!parsed.environment || record.environment === parsed.environment));
+            if (credentials.length === 0) {
+                return {
+                    exitCode: 0,
+                    stdout: [
+                        "No AppFleet secrets recorded for this project.",
+                        `project=${parsed.project}`,
+                        parsed.environment ? `env=${parsed.environment}` : undefined,
+                    ]
+                        .filter(Boolean)
+                        .join("\n") + "\n",
+                    stderr: "",
+                };
+            }
+            return {
+                exitCode: 0,
+                stdout: [
+                    `AppFleet secrets for ${parsed.project}:`,
+                    ...credentials
+                        .slice()
+                        .sort(compareCredentialRecords)
+                        .map((record) => {
+                        const metadata = credentialMetadataForRecord(record);
+                        return `- env=${record.environment} alias=${record.alias} label=${metadata.label} status=${metadata.status} version=${metadata.currentVersionId ?? "unknown"} rotatedAt=${metadata.rotatedAt ?? "never"} fingerprint=${metadata.keyedFingerprint?.fingerprint ?? "not-recorded"} updatedAt=${record.updatedAt}`;
+                    }),
+                    "valuesPrinted=false",
+                ].join("\n") + "\n",
+                stderr: "",
+            };
+        }
+        if (parsed.action === "secrets-upload") {
+            const store = await readLocalVaultStore(vaultPath);
+            const exportedAt = now().toISOString();
+            const syncRequest = createCloudSecretSyncRequest({
+                type: "cloud_secret_sync_request",
+                version: 1,
+                workspaceId: store.workspaceId,
+                createdAt: exportedAt,
+                encryptedEnvelopes: cloudSecretRecordsForStore(store, exportedAt),
+                plaintextSecretValuesIncluded: false,
+                plaintextKeyMaterialIncluded: false,
+                zeroKnowledge: true,
+            });
+            const outputPath = parsed.outputPath ?? defaultSecretSyncPath;
+            await writeJsonFile(outputPath, syncRequest);
+            return {
+                exitCode: 0,
+                stdout: [
+                    "AppFleet encrypted secret sync package written.",
+                    `workspace=${store.workspaceId}`,
+                    `outputPath=${outputPath}`,
+                    `credentialEnvelopeCount=${store.credentials.length}`,
+                    `keyWrapperEnvelopeCount=${keyWrapperRecords(store).length}`,
+                    "plaintextValuesPrinted=false",
+                    "encryptedBlobIdsPrinted=false",
+                    "keyWrapperIdsPrinted=false",
+                ].join("\n") + "\n",
+                stderr: "",
+            };
+        }
+        if (parsed.action === "secrets-download") {
+            const store = await readLocalVaultStore(vaultPath);
+            const inputPath = parsed.inputPath ?? defaultSecretSyncPath;
+            const syncRequest = createCloudSecretSyncRequest(JSON.parse(await readFile(inputPath, "utf8")));
+            if (syncRequest.workspaceId !== store.workspaceId) {
+                throw new LocalVaultCliError("WorkspaceMismatch", "encrypted secret sync package workspace does not match local vault");
+            }
+            const mergedStore = importCloudSecretRecords(store, syncRequest.encryptedEnvelopes);
+            await writeLocalVaultStore(vaultPath, mergedStore);
+            return {
+                exitCode: 0,
+                stdout: [
+                    "AppFleet encrypted secret sync package imported.",
+                    `workspace=${store.workspaceId}`,
+                    `inputPath=${inputPath}`,
+                    `importedEnvelopeCount=${syncRequest.encryptedEnvelopes.length}`,
+                    "plaintextValuesPrinted=false",
+                    "encryptedBlobIdsPrinted=false",
+                    "keyWrapperIdsPrinted=false",
+                ].join("\n") + "\n",
+                stderr: "",
+            };
+        }
+        const store = await readLocalVaultStore(vaultPath);
+        const credentials = store.credentials.filter((record) => record.project === parsed.project &&
+            record.environment === parsed.environment);
+        if (credentials.length === 0) {
+            throw new LocalVaultCliError("NoSecretsForEnvironment", "no encrypted secrets recorded for requested project/environment");
+        }
+        const workspaceVaultKey = await unwrapLocalVaultKey(store, resolveMasterPassword(parsed.masterPassword, env));
+        const decryptedSecrets = await decryptCredentials(credentials, workspaceVaultKey);
+        const auditEvent = createAuditEvent(parsed, credentials, store.workspaceId, now);
+        try {
+            await writeAuditEvent(auditPath, auditEvent);
+        }
+        catch {
+            return {
+                exitCode: 1,
+                stdout: "",
+                stderr: "AppFleet local vault failed: AuditWriteFailed\n",
+                childStarted: false,
+                auditId: auditEvent.id,
+            };
+        }
+        let child;
+        try {
+            child = await runChildProcess(parsed.command, parsed.args, {
+                ...process.env,
+                ...Object.fromEntries(decryptedSecrets.map((secret) => [secret.alias, secret.value])),
+            });
+        }
+        catch {
+            return {
+                exitCode: 1,
+                stdout: redactSecrets([
+                    `AppFleet secrets inject: project=${parsed.project} env=${parsed.environment} aliases=${credentials.map((record) => record.alias).join(",")} auditId=${auditEvent.id}`,
+                    "AppFleet secrets inject failed: ChildSpawnFailed",
+                ].join("\n") + "\n", decryptedSecrets.map((secret) => secret.value)),
+                stderr: "",
+                childStarted: false,
+                auditId: auditEvent.id,
+            };
+        }
+        return {
+            exitCode: child.exitCode,
+            stdout: redactSecrets([
+                `AppFleet secrets inject: project=${parsed.project} env=${parsed.environment} aliases=${credentials.map((record) => record.alias).join(",")} auditId=${auditEvent.id}`,
+                child.stdout.trimEnd(),
+                `AppFleet secrets inject: childExitCode=${child.exitCode}`,
+            ]
+                .filter(Boolean)
+                .join("\n") + "\n", decryptedSecrets.map((secret) => secret.value)),
+            stderr: redactSecrets(child.stderr, decryptedSecrets.map((secret) => secret.value)),
+            childStarted: true,
+            auditId: auditEvent.id,
+        };
+    }
+    catch (error) {
+        return commandError(error);
+    }
+}
+async function createLocalVaultStore(input) {
+    const workspaceVaultKey = await generateWorkspaceVaultKey();
+    const keyGenerationId = `keygen_${randomUUID()}`;
+    const wrappedKeyId = `wrapped_${randomUUID()}`;
+    const wrapperId = `wrapper_${randomUUID()}`;
+    const createdAt = input.now().toISOString();
+    const { envelope } = await wrapWorkspaceVaultKeyWithMasterPassword({
+        workspaceVaultKey,
+        masterPassword: input.masterPassword,
+        workspaceId: input.workspaceId,
+        wrapperId,
+        wrappedKeyId,
+        keyGenerationId,
+        profile: masterPasswordProfiles.interactivePrototype,
+        createdAt,
+    });
+    const metadata = createKeyWrapperMetadata({
+        envelope,
+        unlockMethod: "master_password",
+        lifecycleState: "active",
+        createdAt,
+        updatedAt: createdAt,
+    });
+    return {
+        type: "appfleet_local_vault",
+        version: 1,
+        workspaceId: input.workspaceId,
+        keyGenerationId,
+        createdAt,
+        keyWrapper: envelope,
+        keyWrappers: [{ envelope, metadata }],
+        deviceKeyUnlocks: [],
+        credentials: [],
+        productionCloudPersistenceImplemented: false,
+    };
+}
+async function readLocalVaultStore(path) {
+    const store = await tryReadLocalVaultStore(path);
+    if (!store) {
+        throw new LocalVaultCliError("VaultNotInitialized", "run vault init before storing or injecting secrets");
+    }
+    return store;
+}
+async function replaceKeyWrapper(input) {
+    const updatedAt = input.now().toISOString();
+    const wrapperId = `wrapper_${randomUUID()}`;
+    const wrappedKeyId = `wrapped_${randomUUID()}`;
+    const { envelope } = await wrapWorkspaceVaultKeyWithMasterPassword({
+        workspaceVaultKey: input.workspaceVaultKey,
+        masterPassword: input.secret,
+        workspaceId: input.store.workspaceId,
+        wrapperId,
+        wrappedKeyId,
+        keyGenerationId: input.store.keyGenerationId,
+        profile: masterPasswordProfiles.interactivePrototype,
+        createdAt: updatedAt,
+    });
+    const activeMetadata = createKeyWrapperMetadata({
+        envelope,
+        unlockMethod: input.unlockMethod,
+        lifecycleState: "active",
+        createdAt: updatedAt,
+        updatedAt,
+    });
+    const currentRecords = keyWrapperRecords(input.store).map((record) => {
+        if (record.metadata.unlockMethod !== input.unlockMethod ||
+            record.metadata.lifecycleState !== "active") {
+            return record;
+        }
+        return {
+            envelope: record.envelope,
+            metadata: createKeyWrapperMetadata({
+                envelope: record.envelope,
+                unlockMethod: record.metadata.unlockMethod,
+                lifecycleState: "revoked",
+                createdAt: record.metadata.createdAt,
+                updatedAt,
+                revokedAt: updatedAt,
+                rotatedAt: updatedAt,
+                replacedByWrapperId: wrapperId,
+                recoveryKitId: record.metadata.recoveryKitId,
+            }),
+        };
+    });
+    const keyWrappers = [...currentRecords, { envelope, metadata: activeMetadata }];
+    const recoveryKit = input.unlockMethod === "recovery_key"
+        ? createEmergencyRecoveryKitMetadata({
+            type: "emergency_recovery_kit_metadata",
+            version: 1,
+            id: input.store.recoveryKit?.id ?? `recovery_kit_${randomUUID()}`,
+            workspaceId: input.store.workspaceId,
+            recoveryKeyWrapperId: wrapperId,
+            createdAt: input.store.recoveryKit?.createdAt ?? updatedAt,
+            updatedAt,
+            rotatedAt: input.store.recoveryKit ? updatedAt : undefined,
+            state: "active",
+            userHeldRecoveryKeyRequired: true,
+            printableKitIncludesSecretMaterial: false,
+            renderedByWeb: false,
+            containsPlaintextKeyMaterial: false,
+            containsPlaintextSecret: false,
+            productionCloudPersistenceImplemented: false,
+        })
+        : input.store.recoveryKit;
+    return {
+        ...input.store,
+        keyWrapper: input.unlockMethod === "master_password" ? envelope : input.store.keyWrapper,
+        keyWrappers,
+        recoveryKit,
+    };
+}
+async function tryReadLocalVaultStore(path) {
+    let raw;
+    try {
+        raw = await readFile(path, "utf8");
+    }
+    catch (error) {
+        if (isFileNotFound(error)) {
+            return undefined;
+        }
+        throw error;
+    }
+    const parsed = JSON.parse(raw);
+    assertLocalVaultStore(parsed);
+    return parsed;
+}
+async function writeLocalVaultStore(path, store) {
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, `${JSON.stringify(store, null, 2)}\n`, { mode: 0o600 });
+}
+async function unwrapLocalVaultKey(store, masterPassword) {
+    return await unwrapLocalVaultKeyWithSecret(store, "master_password", masterPassword);
+}
+async function unwrapLocalVaultKeyWithSecret(store, unlockMethod, secret) {
+    const wrapper = activeKeyWrapperRecord(store, unlockMethod);
+    return await unwrapWorkspaceVaultKeyWithMasterPassword({
+        envelope: wrapper.envelope,
+        masterPassword: secret,
+    });
+}
+async function decryptCredentials(credentials, workspaceVaultKey) {
+    const decrypted = [];
+    for (const credential of credentials) {
+        decrypted.push({
+            alias: credential.alias,
+            value: await decryptCredentialValue({
+                envelope: credential.envelope,
+                workspaceVaultKey,
+            }),
+        });
+    }
+    return decrypted;
+}
+async function runChildProcess(command, args, env) {
+    return await new Promise((resolvePromise, reject) => {
+        const child = spawn(command, args, {
+            env,
+            shell: false,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        const stdoutChunks = [];
+        const stderrChunks = [];
+        child.stdout.on("data", (chunk) => stdoutChunks.push(chunk));
+        child.stderr.on("data", (chunk) => stderrChunks.push(chunk));
+        child.on("error", reject);
+        child.on("close", (code) => {
+            resolvePromise({
+                exitCode: code ?? 1,
+                stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+                stderr: Buffer.concat(stderrChunks).toString("utf8"),
+            });
+        });
+    });
+}
+function createAuditEvent(parsed, credentials, workspaceId, now) {
+    return createLocalSensitiveAuditEvent({
+        type: "local_sensitive_audit_event",
+        version: 1,
+        id: randomUUID(),
+        action: "secret_injection_attempted",
+        workspaceId,
+        projectId: parsed.project,
+        environment: parsed.environment,
+        credentialLabels: credentials
+            .map((record) => credentialMetadataForRecord(record).label)
+            .sort(),
+        envAliases: credentials.map((record) => record.alias).sort(),
+        command: parsed.command,
+        createdAt: now().toISOString(),
+        durability: "local_jsonl",
+        containsPlaintextSecret: false,
+        containsEncryptedBlobId: false,
+        productionCloudPersistenceImplemented: false,
+    });
+}
+async function writeAuditEvent(path, event) {
+    await mkdir(dirname(path), { recursive: true });
+    await appendFile(path, `${JSON.stringify(event)}\n`, { mode: 0o600 });
+}
+function resolveMasterPassword(explicitPassword, env) {
+    const masterPassword = explicitPassword ?? env.APPFLEET_MASTER_PASSWORD ?? env.APPFLEET_VAULT_PASSWORD;
+    if (!masterPassword) {
+        throw new LocalVaultCliError("MissingMasterPassword", "provide --master-password or APPFLEET_MASTER_PASSWORD");
+    }
+    return masterPassword;
+}
+function resolveNewMasterPassword(explicitPassword, env) {
+    const newMasterPassword = explicitPassword ?? env.APPFLEET_NEW_MASTER_PASSWORD;
+    if (!newMasterPassword) {
+        throw new LocalVaultCliError("MissingNewMasterPassword", "provide --new-master-password or APPFLEET_NEW_MASTER_PASSWORD");
+    }
+    return newMasterPassword;
+}
+function resolveRecoveryKey(explicitRecoveryKey, env) {
+    const recoveryKey = explicitRecoveryKey ?? env.APPFLEET_RECOVERY_KEY;
+    if (!recoveryKey) {
+        throw new LocalVaultCliError("MissingRecoveryKey", "provide --recovery-key or APPFLEET_RECOVERY_KEY");
+    }
+    return recoveryKey;
+}
+function resolveSecretValue(explicitValue, env) {
+    const secretValue = explicitValue ?? env.APPFLEET_SECRET_VALUE;
+    if (secretValue === undefined) {
+        throw new LocalVaultCliError("MissingSecretValue", "provide --value or APPFLEET_SECRET_VALUE");
+    }
+    return secretValue;
+}
+function credentialRecordId(project, environment, alias) {
+    return `${slugPart(project)}:${slugPart(environment)}:${alias}`;
+}
+function createCredentialFingerprint(input) {
+    const fingerprint = createHmac("sha256", Buffer.from(input.workspaceVaultKey))
+        .update(input.workspaceId)
+        .update("\0")
+        .update(input.project)
+        .update("\0")
+        .update(input.environment)
+        .update("\0")
+        .update(input.alias)
+        .update("\0")
+        .update(input.secretValue)
+        .digest("hex");
+    return {
+        type: "keyed_secret_fingerprint",
+        version: 1,
+        fingerprint,
+        algorithm: "hmac_sha256",
+        keyDerivation: "workspace_vault_key",
+        scope: "workspace_project_environment_alias",
+        keyId: input.keyId,
+        createdAt: input.createdAt,
+        containsPlaintextSecret: false,
+        reversible: false,
+        storesDecryptedMaterial: false,
+    };
+}
+function slugPart(value) {
+    return value.trim().toLowerCase().replace(/[^a-z0-9._-]+/g, "-");
+}
+function assertValidAlias(alias) {
+    if (!secretAliasPattern.test(alias)) {
+        throw new LocalVaultCliError("InvalidAlias", "secret alias must be a valid environment variable name");
+    }
+}
+function credentialMetadataForRecord(record) {
+    return createAppCredentialMetadata(record.metadata ?? {
+        type: "credential_metadata",
+        version: 1,
+        credentialId: record.id,
+        projectId: record.project,
+        environment: record.environment,
+        label: record.alias,
+        envAliases: [record.alias],
+        status: "active",
+        createdAt: record.createdAt,
+        updatedAt: record.updatedAt,
+        valueStoredByAppFleetCloud: false,
+    });
+}
+function createKeyWrapperMetadata(input) {
+    return createAppKeyWrapperMetadata({
+        type: "key_wrapper_metadata",
+        version: 1,
+        wrapperId: input.envelope.wrapperId,
+        workspaceId: input.envelope.workspaceId,
+        wrappedKeyId: input.envelope.wrappedKeyId,
+        keyGenerationId: input.envelope.keyGenerationId,
+        unlockMethod: input.unlockMethod,
+        lifecycleState: input.lifecycleState,
+        createdAt: input.createdAt,
+        updatedAt: input.updatedAt,
+        rotatedAt: input.rotatedAt,
+        revokedAt: input.revokedAt,
+        replacedByWrapperId: input.replacedByWrapperId,
+        recoveryKitId: input.recoveryKitId,
+        containsPlaintextKeyMaterial: false,
+        containsPlaintextSecret: false,
+        productionCloudPersistenceImplemented: false,
+    });
+}
+function keyWrapperRecords(store) {
+    if (store.keyWrappers?.length) {
+        return store.keyWrappers.map((record) => ({
+            envelope: record.envelope,
+            metadata: createAppKeyWrapperMetadata(record.metadata),
+        }));
+    }
+    return [
+        {
+            envelope: store.keyWrapper,
+            metadata: createKeyWrapperMetadata({
+                envelope: store.keyWrapper,
+                unlockMethod: "master_password",
+                lifecycleState: "active",
+                createdAt: store.keyWrapper.createdAt,
+                updatedAt: store.keyWrapper.createdAt,
+            }),
+        },
+    ];
+}
+function cloudSecretRecordsForStore(store, exportedAt) {
+    return [
+        ...store.credentials.map((record) => {
+            const packaged = packageEncryptedCredentialEnvelopeForCloud(record.envelope);
+            return createCloudSecretEncryptedEnvelopeRecord({
+                type: "cloud_secret_encrypted_envelope",
+                version: 1,
+                workspaceId: store.workspaceId,
+                envelopeKind: "encrypted_credential_blob",
+                envelopeId: record.id,
+                keyGenerationId: record.envelope.keyGenerationId,
+                encryptedPayload: packaged.encryptedPayload,
+                payloadSha256: packaged.payloadSha256,
+                createdAt: record.createdAt,
+                updatedAt: exportedAt,
+                status: "uploaded",
+                productionReady: true,
+                zeroKnowledge: true,
+                containsPlaintextSecret: false,
+                containsPlaintextKeyMaterial: false,
+                storesDecryptedMaterial: false,
+            });
+        }),
+        ...keyWrapperRecords(store).map((record) => {
+            const packaged = packageKeyWrapperEnvelopeForCloud(record.envelope);
+            return createCloudSecretEncryptedEnvelopeRecord({
+                type: "cloud_secret_encrypted_envelope",
+                version: 1,
+                workspaceId: store.workspaceId,
+                envelopeKind: "encrypted_key_wrapper",
+                envelopeId: record.envelope.wrapperId,
+                keyGenerationId: record.envelope.keyGenerationId,
+                encryptedPayload: packaged.encryptedPayload,
+                payloadSha256: packaged.payloadSha256,
+                createdAt: record.metadata.createdAt,
+                updatedAt: exportedAt,
+                status: "uploaded",
+                productionReady: true,
+                zeroKnowledge: true,
+                containsPlaintextSecret: false,
+                containsPlaintextKeyMaterial: false,
+                storesDecryptedMaterial: false,
+            });
+        }),
+    ];
+}
+function importCloudSecretRecords(store, records) {
+    let credentials = [...store.credentials];
+    let wrappers = keyWrapperRecords(store);
+    for (const record of records) {
+        const safeRecord = createCloudSecretEncryptedEnvelopeRecord(record);
+        const envelope = JSON.parse(Buffer.from(safeRecord.encryptedPayload, "base64url").toString("utf8"));
+        if (safeRecord.envelopeKind === "encrypted_credential_blob") {
+            if (envelope.type !== "credential_blob" || envelope.workspaceId !== store.workspaceId) {
+                throw new LocalVaultCliError("InvalidCloudSecretEnvelope", "invalid encrypted credential envelope");
+            }
+            const parts = safeRecord.envelopeId.split(":");
+            const imported = {
+                id: safeRecord.envelopeId,
+                project: parts[0] ?? "imported",
+                environment: parts[1] ?? "imported",
+                alias: parts[2] ?? "IMPORTED_SECRET",
+                createdAt: safeRecord.createdAt,
+                updatedAt: safeRecord.updatedAt,
+                envelope,
+            };
+            credentials = credentials.some((candidate) => candidate.id === imported.id)
+                ? credentials.map((candidate) => candidate.id === imported.id ? { ...candidate, envelope, updatedAt: imported.updatedAt } : candidate)
+                : [...credentials, imported];
+            continue;
+        }
+        if (envelope.type !== "key_wrapper" || envelope.workspaceId !== store.workspaceId) {
+            throw new LocalVaultCliError("InvalidCloudSecretEnvelope", "invalid encrypted key wrapper envelope");
+        }
+        const existing = wrappers.some((candidate) => candidate.envelope.wrapperId === envelope.wrapperId);
+        if (!existing) {
+            wrappers = [
+                ...wrappers,
+                {
+                    envelope,
+                    metadata: createKeyWrapperMetadata({
+                        envelope,
+                        unlockMethod: "master_password",
+                        lifecycleState: "active",
+                        createdAt: safeRecord.createdAt,
+                        updatedAt: safeRecord.updatedAt,
+                    }),
+                },
+            ];
+        }
+    }
+    return {
+        ...store,
+        credentials,
+        keyWrappers: wrappers,
+        keyWrapper: wrappers.find((record) => record.metadata.unlockMethod === "master_password" &&
+            record.metadata.lifecycleState === "active")?.envelope ?? store.keyWrapper,
+    };
+}
+async function writeJsonFile(path, value) {
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+}
+function activeKeyWrapperRecord(store, unlockMethod) {
+    const record = keyWrapperRecords(store).find((candidate) => candidate.metadata.unlockMethod === unlockMethod &&
+        candidate.metadata.lifecycleState === "active");
+    if (!record) {
+        throw new LocalVaultCliError("MissingActiveKeyWrapper", `no active ${unlockMethod} key wrapper is recorded`);
+    }
+    return record;
+}
+function upsertDeviceKeyUnlock(records, next) {
+    const existing = records.some((record) => record.deviceId === next.deviceId);
+    return existing
+        ? records.map((record) => record.deviceId === next.deviceId ? next : record)
+        : [...records, next];
+}
+function assertLocalVaultStore(value) {
+    if (value.type !== "appfleet_local_vault" ||
+        value.version !== 1 ||
+        value.productionCloudPersistenceImplemented !== false ||
+        !Array.isArray(value.credentials)) {
+        throw new LocalVaultCliError("InvalidVaultStore", "invalid local vault store");
+    }
+    keyWrapperRecords(value);
+    if (value.recoveryKit) {
+        createEmergencyRecoveryKitMetadata(value.recoveryKit);
+    }
+    for (const deviceKeyUnlock of value.deviceKeyUnlocks ?? []) {
+        createDeviceKeyUnlockMetadata(deviceKeyUnlock);
+    }
+    if (value.osKeychainIntegration) {
+        createOsKeychainIntegrationMetadata(value.osKeychainIntegration);
+    }
+    for (const credential of value.credentials) {
+        credentialMetadataForRecord(credential);
+    }
+}
+function readKeychainProviderFlag(argv) {
+    const provider = readFlag(argv, "--provider");
+    if (!provider) {
+        return undefined;
+    }
+    if (provider !== "macos_keychain" &&
+        provider !== "windows_credential_manager" &&
+        provider !== "linux_secret_service") {
+        throw new LocalVaultCliError("InvalidKeychainProvider", "keychain provider must be macos_keychain, windows_credential_manager, or linux_secret_service");
+    }
+    return provider;
+}
+function compareCredentialRecords(left, right) {
+    return (left.environment.localeCompare(right.environment) ||
+        left.alias.localeCompare(right.alias));
+}
+function redactSecrets(value, secrets) {
+    return secrets.reduce((redacted, secret) => secret ? redacted.split(secret).join("[REDACTED_SECRET]") : redacted, value);
+}
+function readFlag(argv, flag) {
+    const index = argv.indexOf(flag);
+    if (index === -1) {
+        return undefined;
+    }
+    return argv[index + 1];
+}
+function readCredentialStatusFlag(argv) {
+    const status = readFlag(argv, "--status");
+    if (!status) {
+        return undefined;
+    }
+    if (!appCredentialStatusValues.includes(status)) {
+        throw new LocalVaultCliError("InvalidCredentialStatus", `credential status must be one of ${appCredentialStatusValues.join(",")}`);
+    }
+    return status;
+}
+function isFileNotFound(error) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === "ENOENT");
+}
+function commandError(error) {
+    const code = error instanceof LocalVaultCliError
+        ? error.code
+        : error instanceof AppFleetCryptoAuthError
+            ? "DecryptFailed"
+            : "LocalVaultFailed";
+    return {
+        exitCode: 1,
+        stdout: "",
+        stderr: `AppFleet local vault failed: ${code}\n`,
+        childStarted: false,
+    };
+}
+if (import.meta.url === `file://${process.argv[1]}`) {
+    const result = await runLocalVaultCommand(process.argv.slice(2));
+    process.stdout.write(result.stdout);
+    process.stderr.write(result.stderr);
+    process.exitCode = result.exitCode;
+}