@barekey/cli 0.1.0 → 0.1.4

package/.github/workflows/publish.yml

@@ -0,0 +1,59 @@
+name: Publish package
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.2.22
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build package
+        run: bun run build
+
+      - name: Check if version is already published
+        id: published
+        shell: bash
+        run: |
+          set -euo pipefail
+          package_name="$(node -p "require('./package.json').name")"
+          package_version="$(node -p "require('./package.json').version")"
+          version_exists="$(node -e "const https = require('node:https'); const url = 'https://registry.npmjs.org/' + encodeURIComponent(require('./package.json').name); https.get(url, (response) => { if (response.statusCode === 404) { console.log('false'); response.resume(); return; } if (response.statusCode !== 200) { console.error('Unexpected registry status:', response.statusCode); process.exit(1); } let data = ''; response.on('data', (chunk) => data += chunk); response.on('end', () => { const metadata = JSON.parse(data); console.log(Boolean(metadata.versions && metadata.versions[require('./package.json').version])); }); }).on('error', (error) => { console.error(error); process.exit(1); });")"
+          echo "package_name=${package_name}" >> "$GITHUB_OUTPUT"
+          echo "package_version=${package_version}" >> "$GITHUB_OUTPUT"
+          echo "version_exists=${version_exists}" >> "$GITHUB_OUTPUT"
+
+      - name: Publish to npm
+        if: steps.published.outputs.version_exists != 'true'
+        run: npm publish --access public --provenance
+
+      - name: Report skipped publish
+        if: steps.published.outputs.version_exists == 'true'
+        run: echo "${{ steps.published.outputs.package_name }}@${{ steps.published.outputs.package_version }} is already published; skipping."

package/AGENTS.md

@@ -0,0 +1,9 @@
+# AGENTS.md — @barekey/cli
+
+## Package Manager
+
+- This repo uses Bun.
+- Use `bun install` for dependency changes.
+- Use `bun run <script>` for project scripts.
+- Use `bun test` for tests.
+- Do not use `npm` or commit `package-lock.json`.

package/README.md

@@ -5,7 +5,7 @@ CLI for logging into Barekey, managing environment variables, and pulling resolv
 ## Install
 
 ```bash
-npm install -g @barekey/cli
+bun add -g @barekey/cli
 ```
 
 ## Quickstart
@@ -30,7 +30,8 @@ barekey env get-many --names DATABASE_URL,FEATURE_FLAG --org acme --project api
 ## Development
 
 ```bash
-npm install
-npm run build
-npm run typecheck
+bun install
+bun run build
+bun run typecheck
+bun test
 ```

package/bun.lock

@@ -0,0 +1,59 @@
+{
+  "lockfileVersion": 1,
+  "configVersion": 1,
+  "workspaces": {
+    "": {
+      "name": "@barekey/cli",
+      "dependencies": {
+        "@barekey/sdk": "^0.1.3",
+        "@clack/prompts": "^0.11.0",
+        "commander": "^14.0.1",
+        "open": "^10.2.0",
+        "picocolors": "^1.1.1",
+      },
+      "devDependencies": {
+        "@types/node": "^24.10.1",
+        "typescript": "^5.9.3",
+      },
+    },
+  },
+  "packages": {
+    "@barekey/sdk": ["@barekey/sdk@0.1.3", "", {}, "sha512-Y5defUYsa6r6GnfR7i0zNnKVI6gXp/GJihVO7+kpijCA61Hnf5hheBTZQyEUma+G1U7MxLcQM/g+FNSHSOXeYQ=="],
+
+    "@clack/core": ["@clack/core@0.5.0", "", { "dependencies": { "picocolors": "^1.0.0", "sisteransi": "^1.0.5" } }, "sha512-p3y0FIOwaYRUPRcMO7+dlmLh8PSRcrjuTndsiA0WAFbWES0mLZlrjVoBRZ9DzkPFJZG6KGkJmoEAY0ZcVWTkow=="],
+
+    "@clack/prompts": ["@clack/prompts@0.11.0", "", { "dependencies": { "@clack/core": "0.5.0", "picocolors": "^1.0.0", "sisteransi": "^1.0.5" } }, "sha512-pMN5FcrEw9hUkZA4f+zLlzivQSeQf5dRGJjSUbvVYDLvpKCdQx5OaknvKzgbtXOizhP+SJJJjqEbOe55uKKfAw=="],
+
+    "@types/node": ["@types/node@24.12.0", "", { "dependencies": { "undici-types": "~7.16.0" } }, "sha512-GYDxsZi3ChgmckRT9HPU0WEhKLP08ev/Yfcq2AstjrDASOYCSXeyjDsHg4v5t4jOj7cyDX3vmprafKlWIG9MXQ=="],
+
+    "bundle-name": ["bundle-name@4.1.0", "", { "dependencies": { "run-applescript": "^7.0.0" } }, "sha512-tjwM5exMg6BGRI+kNmTntNsvdZS1X8BFYS6tnJ2hdH0kVxM6/eVZ2xy+FqStSWvYmtfFMDLIxurorHwDKfDz5Q=="],
+
+    "commander": ["commander@14.0.3", "", {}, "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw=="],
+
+    "default-browser": ["default-browser@5.5.0", "", { "dependencies": { "bundle-name": "^4.1.0", "default-browser-id": "^5.0.0" } }, "sha512-H9LMLr5zwIbSxrmvikGuI/5KGhZ8E2zH3stkMgM5LpOWDutGM2JZaj460Udnf1a+946zc7YBgrqEWwbk7zHvGw=="],
+
+    "default-browser-id": ["default-browser-id@5.0.1", "", {}, "sha512-x1VCxdX4t+8wVfd1so/9w+vQ4vx7lKd2Qp5tDRutErwmR85OgmfX7RlLRMWafRMY7hbEiXIbudNrjOAPa/hL8Q=="],
+
+    "define-lazy-prop": ["define-lazy-prop@3.0.0", "", {}, "sha512-N+MeXYoqr3pOgn8xfyRPREN7gHakLYjhsHhWGT3fWAiL4IkAt0iDw14QiiEm2bE30c5XX5q0FtAA3CK5f9/BUg=="],
+
+    "is-docker": ["is-docker@3.0.0", "", { "bin": { "is-docker": "cli.js" } }, "sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ=="],
+
+    "is-inside-container": ["is-inside-container@1.0.0", "", { "dependencies": { "is-docker": "^3.0.0" }, "bin": { "is-inside-container": "cli.js" } }, "sha512-KIYLCCJghfHZxqjYBE7rEy0OBuTd5xCHS7tHVgvCLkx7StIoaxwNW3hCALgEUjFfeRk+MG/Qxmp/vtETEF3tRA=="],
+
+    "is-wsl": ["is-wsl@3.1.1", "", { "dependencies": { "is-inside-container": "^1.0.0" } }, "sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw=="],
+
+    "open": ["open@10.2.0", "", { "dependencies": { "default-browser": "^5.2.1", "define-lazy-prop": "^3.0.0", "is-inside-container": "^1.0.0", "wsl-utils": "^0.1.0" } }, "sha512-YgBpdJHPyQ2UE5x+hlSXcnejzAvD0b22U2OuAP+8OnlJT+PjWPxtgmGqKKc+RgTM63U9gN0YzrYc71R2WT/hTA=="],
+
+    "picocolors": ["picocolors@1.1.1", "", {}, "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="],
+
+    "run-applescript": ["run-applescript@7.1.0", "", {}, "sha512-DPe5pVFaAsinSaV6QjQ6gdiedWDcRCbUuiQfQa2wmWV7+xC9bGulGI8+TdRmoFkAPaBXk8CrAbnlY2ISniJ47Q=="],
+
+    "sisteransi": ["sisteransi@1.0.5", "", {}, "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg=="],
+
+    "typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
+
+    "undici-types": ["undici-types@7.16.0", "", {}, "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw=="],
+
+    "wsl-utils": ["wsl-utils@0.1.0", "", { "dependencies": { "is-wsl": "^3.1.0" } }, "sha512-h3Fbisa2nKGPxCpm89Hk33lBLsnaGBvctQopaBSOW/uIs6FTe1ATyAnKFJrzVs9vpGdsTe73WF3V4lIsk4Gacw=="],
+  }
+}

package/dist/commands/env-helpers.d.ts

@@ -0,0 +1,10 @@
+export type CliRolloutFunction = "linear" | "step" | "ease_in_out";
+export type CliVisibility = "private" | "public";
+export type CliRolloutMilestone = {
+    at: string;
+    percentage: number;
+};
+export declare function collectOptionValues(value: string, previous?: Array<string>): Array<string>;
+export declare function parseRolloutFunction(value: string | undefined): CliRolloutFunction;
+export declare function parseRolloutMilestones(values: Array<string> | undefined): Array<CliRolloutMilestone>;
+export declare function parseVisibility(value: string | undefined): CliVisibility;

package/dist/commands/env-helpers.js

@@ -0,0 +1,61 @@
+export function collectOptionValues(value, previous = []) {
+    return [...previous, value];
+}
+export function parseRolloutFunction(value) {
+    if (value === undefined) {
+        return "linear";
+    }
+    if (value === "linear" || value === "step" || value === "ease_in_out") {
+        return value;
+    }
+    throw new Error("--function must be one of: linear, step, ease_in_out.");
+}
+export function parseRolloutMilestones(values) {
+    if (values === undefined || values.length === 0) {
+        return [
+            {
+                at: new Date().toISOString(),
+                percentage: 0,
+            },
+        ];
+    }
+    const milestones = values.map((rawValue) => {
+        const separatorIndex = rawValue.lastIndexOf("=");
+        if (separatorIndex <= 0 || separatorIndex >= rawValue.length - 1) {
+            throw new Error(`Invalid --point value "${rawValue}". Use ISO_TIMESTAMP=PERCENTAGE, for example 2026-03-12T18:00:00Z=50.`);
+        }
+        const at = rawValue.slice(0, separatorIndex).trim();
+        const percentageValue = rawValue.slice(separatorIndex + 1).trim();
+        const atMs = Date.parse(at);
+        const percentage = Number(percentageValue);
+        if (!Number.isFinite(atMs)) {
+            throw new Error(`Invalid rollout point time "${at}". Use an ISO 8601 timestamp.`);
+        }
+        if (!Number.isFinite(percentage) || percentage < 0 || percentage > 100) {
+            throw new Error(`Invalid rollout point percentage "${percentageValue}". Use a number between 0 and 100.`);
+        }
+        return {
+            atMs,
+            milestone: {
+                at: new Date(atMs).toISOString(),
+                percentage,
+            },
+        };
+    });
+    milestones.sort((left, right) => left.atMs - right.atMs);
+    for (let index = 1; index < milestones.length; index += 1) {
+        if ((milestones[index]?.atMs ?? 0) <= (milestones[index - 1]?.atMs ?? 0)) {
+            throw new Error("Rollout points must be strictly increasing by time.");
+        }
+    }
+    return milestones.map((entry) => entry.milestone);
+}
+export function parseVisibility(value) {
+    if (value === undefined || value === "private") {
+        return "private";
+    }
+    if (value === "public") {
+        return "public";
+    }
+    throw new Error("--visibility must be one of: private, public.");
+}

package/dist/commands/env.js

@@ -1,10 +1,11 @@
 import { writeFile } from "node:fs/promises";
 import { cancel, confirm, isCancel } from "@clack/prompts";
-import { BarekeyClient } from "@barekey/sdk";
+import { BarekeyClient } from "@barekey/sdk/server";
 import pc from "picocolors";
 import { createCliAuthProvider } from "../auth-provider.js";
 import { addTargetOptions, dotenvEscape, parseChance, requireLocalSession, resolveTarget, toJsonOutput, } from "../command-utils.js";
 import { postJson } from "../http.js";
+import { collectOptionValues, parseRolloutFunction, parseRolloutMilestones, parseVisibility, } from "./env-helpers.js";
 function createEnvClient(input) {
     const organization = input.organization?.trim();
     if (!organization) {
@@ -94,7 +95,7 @@ async function runEnvList(options) {
         const rolloutSuffix = row.kind === "rollout"
             ? ` ${pc.dim(`${row.rolloutFunction ?? "linear"}(${row.rolloutMilestones?.length ?? 0} milestones)`)}`
             : "";
-        console.log(`${row.name}  ${pc.dim(row.kind)}  ${pc.dim(row.declaredType)}${chanceSuffix}${rolloutSuffix}`);
+        console.log(`${row.name}  ${pc.dim(row.visibility)}  ${pc.dim(row.kind)}  ${pc.dim(row.declaredType)}${chanceSuffix}${rolloutSuffix}`);
     }
 }
 async function runEnvWrite(operation, name, value, options) {
@@ -102,21 +103,47 @@ async function runEnvWrite(operation, name, value, options) {
     const target = await resolveTarget(options, local);
     const authProvider = createCliAuthProvider();
     const accessToken = await authProvider.getAccessToken();
-    const entry = options.ab !== undefined
+    if (options.ab !== undefined && options.rollout !== undefined) {
+        throw new Error("Use either --ab or --rollout, not both.");
+    }
+    const hasRolloutPoints = (options.point?.length ?? 0) > 0;
+    if (options.rollout === undefined && (options.function !== undefined || hasRolloutPoints)) {
+        throw new Error("--function and --point can only be used together with --rollout.");
+    }
+    if (options.ab !== undefined && (options.function !== undefined || hasRolloutPoints)) {
+        throw new Error("--function and --point are only supported for --rollout, not --ab.");
+    }
+    if (options.rollout !== undefined && options.chance !== undefined) {
+        throw new Error("--chance only applies to --ab.");
+    }
+    const entry = options.rollout !== undefined
         ? {
             name,
-            kind: "ab_roll",
+            visibility: parseVisibility(options.visibility),
+            kind: "rollout",
             declaredType: options.type ?? "string",
             valueA: value,
-            valueB: options.ab,
-            chance: parseChance(options.chance),
+            valueB: options.rollout,
+            rolloutFunction: parseRolloutFunction(options.function),
+            rolloutMilestones: parseRolloutMilestones(options.point),
         }
-        : {
-            name,
-            kind: "secret",
-            declaredType: options.type ?? "string",
-            value,
-        };
+        : options.ab !== undefined
+            ? {
+                name,
+                visibility: parseVisibility(options.visibility),
+                kind: "ab_roll",
+                declaredType: options.type ?? "string",
+                valueA: value,
+                valueB: options.ab,
+                chance: parseChance(options.chance),
+            }
+            : {
+                name,
+                visibility: parseVisibility(options.visibility),
+                kind: "secret",
+                declaredType: options.type ?? "string",
+                value,
+            };
     const result = await postJson({
         baseUrl: local.baseUrl,
         path: "/v1/env/write",
@@ -257,7 +284,11 @@ export function registerEnvCommands(program) {
         .argument("<name>", "Variable name")
         .argument("<value>", "Variable value")
         .option("--ab <value-b>", "Second value for ab_roll")
+        .option("--rollout <value-b>", "Second value for rollout")
         .option("--chance <number>", "A-branch probability between 0 and 1")
+        .option("--function <name>", "Rollout interpolation function (linear, step, ease_in_out)")
+        .option("--point <at=percentage>", "Rollout milestone, repeatable. Example: 2026-03-12T18:00:00Z=50", collectOptionValues, [])
+        .option("--visibility <visibility>", "Variable visibility: private|public", "private")
         .option("--type <type>", "Declared value type", "string")
         .option("--json", "Machine-readable output", false)).action(async (name, value, options) => {
         await runEnvWrite("create_only", name, value, options);
@@ -268,7 +299,11 @@ export function registerEnvCommands(program) {
         .argument("<name>", "Variable name")
         .argument("<value>", "Variable value")
         .option("--ab <value-b>", "Second value for ab_roll")
+        .option("--rollout <value-b>", "Second value for rollout")
         .option("--chance <number>", "A-branch probability between 0 and 1")
+        .option("--function <name>", "Rollout interpolation function (linear, step, ease_in_out)")
+        .option("--point <at=percentage>", "Rollout milestone, repeatable. Example: 2026-03-12T18:00:00Z=50", collectOptionValues, [])
+        .option("--visibility <visibility>", "Variable visibility: private|public", "private")
         .option("--type <type>", "Declared value type", "string")
         .option("--json", "Machine-readable output", false)).action(async (name, value, options) => {
         await runEnvWrite("upsert", name, value, options);

package/dist/commands/typegen.js

@@ -1,4 +1,4 @@
-import { BarekeyClient } from "@barekey/sdk";
+import { BarekeyClient } from "@barekey/sdk/server";
 import { addTargetOptions, requireLocalSession, resolveTarget, } from "../command-utils.js";
 async function runTypegen(options) {
     const local = await requireLocalSession();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@barekey/cli",
-  "version": "0.1.0",
+  "version": "0.1.4",
   "description": "Barekey command line interface",
   "type": "module",
   "bin": {
@@ -9,11 +9,13 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "bun test test",
     "start": "node dist/index.js"
   },
+  "packageManager": "bun@1.2.22",
   "dependencies": {
     "@clack/prompts": "^0.11.0",
-    "@barekey/sdk": "^0.1.0",
+    "@barekey/sdk": "^0.1.3",
     "commander": "^14.0.1",
     "open": "^10.2.0",
     "picocolors": "^1.1.1"

package/src/commands/env-helpers.ts

@@ -0,0 +1,87 @@
+export type CliRolloutFunction = "linear" | "step" | "ease_in_out";
+
+export type CliVisibility = "private" | "public";
+
+export type CliRolloutMilestone = {
+  at: string;
+  percentage: number;
+};
+
+export function collectOptionValues(
+  value: string,
+  previous: Array<string> = [],
+): Array<string> {
+  return [...previous, value];
+}
+
+export function parseRolloutFunction(value: string | undefined): CliRolloutFunction {
+  if (value === undefined) {
+    return "linear";
+  }
+  if (value === "linear" || value === "step" || value === "ease_in_out") {
+    return value;
+  }
+  throw new Error("--function must be one of: linear, step, ease_in_out.");
+}
+
+export function parseRolloutMilestones(
+  values: Array<string> | undefined,
+): Array<CliRolloutMilestone> {
+  if (values === undefined || values.length === 0) {
+    return [
+      {
+        at: new Date().toISOString(),
+        percentage: 0,
+      },
+    ];
+  }
+
+  const milestones = values.map((rawValue) => {
+    const separatorIndex = rawValue.lastIndexOf("=");
+    if (separatorIndex <= 0 || separatorIndex >= rawValue.length - 1) {
+      throw new Error(
+        `Invalid --point value "${rawValue}". Use ISO_TIMESTAMP=PERCENTAGE, for example 2026-03-12T18:00:00Z=50.`,
+      );
+    }
+
+    const at = rawValue.slice(0, separatorIndex).trim();
+    const percentageValue = rawValue.slice(separatorIndex + 1).trim();
+    const atMs = Date.parse(at);
+    const percentage = Number(percentageValue);
+    if (!Number.isFinite(atMs)) {
+      throw new Error(`Invalid rollout point time "${at}". Use an ISO 8601 timestamp.`);
+    }
+    if (!Number.isFinite(percentage) || percentage < 0 || percentage > 100) {
+      throw new Error(
+        `Invalid rollout point percentage "${percentageValue}". Use a number between 0 and 100.`,
+      );
+    }
+
+    return {
+      atMs,
+      milestone: {
+        at: new Date(atMs).toISOString(),
+        percentage,
+      },
+    };
+  });
+
+  milestones.sort((left, right) => left.atMs - right.atMs);
+  for (let index = 1; index < milestones.length; index += 1) {
+    if ((milestones[index]?.atMs ?? 0) <= (milestones[index - 1]?.atMs ?? 0)) {
+      throw new Error("Rollout points must be strictly increasing by time.");
+    }
+  }
+
+  return milestones.map((entry) => entry.milestone);
+}
+
+export function parseVisibility(value: string | undefined): CliVisibility {
+  if (value === undefined || value === "private") {
+    return "private";
+  }
+  if (value === "public") {
+    return "public";
+  }
+  throw new Error("--visibility must be one of: private, public.");
+}

package/src/commands/env.ts

@@ -1,7 +1,7 @@
 import { writeFile } from "node:fs/promises";
 
 import { cancel, confirm, isCancel } from "@clack/prompts";
-import { BarekeyClient } from "@barekey/sdk";
+import { BarekeyClient } from "@barekey/sdk/server";
 import { Command } from "commander";
 import pc from "picocolors";
 
@@ -16,6 +16,14 @@ import {
   type EnvTargetOptions,
 } from "../command-utils.js";
 import { postJson } from "../http.js";
+import {
+  collectOptionValues,
+  parseRolloutFunction,
+  parseRolloutMilestones,
+  parseVisibility,
+  type CliRolloutFunction,
+  type CliVisibility,
+} from "./env-helpers.js";
 
 function createEnvClient(input: {
   organization: string | undefined;
@@ -117,12 +125,13 @@ async function runEnvList(options: EnvTargetOptions & { json?: boolean }): Promi
   const response = await postJson<{
     variables: Array<{
       name: string;
+      visibility: CliVisibility;
       kind: "secret" | "ab_roll" | "rollout";
       declaredType: "string" | "boolean" | "int64" | "float" | "date" | "json";
       createdAtMs: number;
       updatedAtMs: number;
       chance: number | null;
-      rolloutFunction: "linear" | null;
+      rolloutFunction: CliRolloutFunction | null;
       rolloutMilestones: Array<{ at: string; percentage: number }> | null;
     }>;
   }>({
@@ -155,7 +164,7 @@ async function runEnvList(options: EnvTargetOptions & { json?: boolean }): Promi
           )}`
         : "";
     console.log(
-      `${row.name}  ${pc.dim(row.kind)}  ${pc.dim(row.declaredType)}${chanceSuffix}${rolloutSuffix}`,
+      `${row.name}  ${pc.dim(row.visibility)}  ${pc.dim(row.kind)}  ${pc.dim(row.declaredType)}${chanceSuffix}${rolloutSuffix}`,
     );
   }
 }
@@ -166,7 +175,11 @@ async function runEnvWrite(
   value: string,
   options: EnvTargetOptions & {
     ab?: string;
+    rollout?: string;
+    function?: string;
+    point?: Array<string>;
     chance?: string;
+    visibility?: CliVisibility;
     type?: "string" | "boolean" | "int64" | "float" | "date" | "json";
     json?: boolean;
   },
@@ -176,22 +189,49 @@ async function runEnvWrite(
   const authProvider = createCliAuthProvider();
   const accessToken = await authProvider.getAccessToken();
 
+  if (options.ab !== undefined && options.rollout !== undefined) {
+    throw new Error("Use either --ab or --rollout, not both.");
+  }
+  const hasRolloutPoints = (options.point?.length ?? 0) > 0;
+  if (options.rollout === undefined && (options.function !== undefined || hasRolloutPoints)) {
+    throw new Error("--function and --point can only be used together with --rollout.");
+  }
+  if (options.ab !== undefined && (options.function !== undefined || hasRolloutPoints)) {
+    throw new Error("--function and --point are only supported for --rollout, not --ab.");
+  }
+  if (options.rollout !== undefined && options.chance !== undefined) {
+    throw new Error("--chance only applies to --ab.");
+  }
+
   const entry =
-    options.ab !== undefined
+    options.rollout !== undefined
       ? {
           name,
-          kind: "ab_roll" as const,
+          visibility: parseVisibility(options.visibility),
+          kind: "rollout" as const,
           declaredType: options.type ?? "string",
           valueA: value,
-          valueB: options.ab,
-          chance: parseChance(options.chance),
+          valueB: options.rollout,
+          rolloutFunction: parseRolloutFunction(options.function),
+          rolloutMilestones: parseRolloutMilestones(options.point),
         }
-      : {
-          name,
-          kind: "secret" as const,
-          declaredType: options.type ?? "string",
-          value,
-        };
+      : options.ab !== undefined
+        ? {
+            name,
+            visibility: parseVisibility(options.visibility),
+            kind: "ab_roll" as const,
+            declaredType: options.type ?? "string",
+            valueA: value,
+            valueB: options.ab,
+            chance: parseChance(options.chance),
+          }
+        : {
+            name,
+            visibility: parseVisibility(options.visibility),
+            kind: "secret" as const,
+            declaredType: options.type ?? "string",
+            value,
+          };
 
   const result = await postJson<{
     createdCount: number;
@@ -315,7 +355,7 @@ async function runEnvPull(
   const response = await postJson<{
     values: Array<{
       name: string;
-      kind: "secret" | "ab_roll";
+      kind: "secret" | "ab_roll" | "rollout";
       declaredType: "string" | "boolean" | "int64" | "float" | "date" | "json";
       value: string;
     }>;
@@ -411,7 +451,19 @@ export function registerEnvCommands(program: Command): void {
       .argument("<name>", "Variable name")
       .argument("<value>", "Variable value")
       .option("--ab <value-b>", "Second value for ab_roll")
+      .option("--rollout <value-b>", "Second value for rollout")
       .option("--chance <number>", "A-branch probability between 0 and 1")
+      .option(
+        "--function <name>",
+        "Rollout interpolation function (linear, step, ease_in_out)",
+      )
+      .option(
+        "--point <at=percentage>",
+        "Rollout milestone, repeatable. Example: 2026-03-12T18:00:00Z=50",
+        collectOptionValues,
+        [],
+      )
+      .option("--visibility <visibility>", "Variable visibility: private|public", "private")
       .option("--type <type>", "Declared value type", "string")
       .option("--json", "Machine-readable output", false),
   ).action(
@@ -420,7 +472,11 @@ export function registerEnvCommands(program: Command): void {
       value: string,
       options: EnvTargetOptions & {
         ab?: string;
+        rollout?: string;
+        function?: string;
+        point?: Array<string>;
         chance?: string;
+        visibility?: CliVisibility;
         type?: "string" | "boolean" | "int64" | "float" | "date" | "json";
         json?: boolean;
       },
@@ -436,7 +492,19 @@ export function registerEnvCommands(program: Command): void {
       .argument("<name>", "Variable name")
       .argument("<value>", "Variable value")
       .option("--ab <value-b>", "Second value for ab_roll")
+      .option("--rollout <value-b>", "Second value for rollout")
       .option("--chance <number>", "A-branch probability between 0 and 1")
+      .option(
+        "--function <name>",
+        "Rollout interpolation function (linear, step, ease_in_out)",
+      )
+      .option(
+        "--point <at=percentage>",
+        "Rollout milestone, repeatable. Example: 2026-03-12T18:00:00Z=50",
+        collectOptionValues,
+        [],
+      )
+      .option("--visibility <visibility>", "Variable visibility: private|public", "private")
       .option("--type <type>", "Declared value type", "string")
       .option("--json", "Machine-readable output", false),
   ).action(
@@ -445,7 +513,11 @@ export function registerEnvCommands(program: Command): void {
       value: string,
       options: EnvTargetOptions & {
         ab?: string;
+        rollout?: string;
+        function?: string;
+        point?: Array<string>;
         chance?: string;
+        visibility?: CliVisibility;
         type?: "string" | "boolean" | "int64" | "float" | "date" | "json";
         json?: boolean;
       },

package/src/commands/typegen.ts

@@ -1,4 +1,4 @@
-import { BarekeyClient } from "@barekey/sdk";
+import { BarekeyClient } from "@barekey/sdk/server";
 import { Command } from "commander";
 
 import {

package/test/env-helpers.test.ts

@@ -0,0 +1,64 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  parseRolloutFunction,
+  parseRolloutMilestones,
+  parseVisibility,
+} from "../src/commands/env-helpers";
+
+describe("parseVisibility", () => {
+  test("defaults to private when missing", () => {
+    expect(parseVisibility(undefined)).toBe("private");
+  });
+
+  test("accepts public visibility", () => {
+    expect(parseVisibility("public")).toBe("public");
+  });
+
+  test("rejects unsupported visibility values", () => {
+    expect(() => parseVisibility("internal")).toThrow(
+      "--visibility must be one of: private, public.",
+    );
+  });
+});
+
+describe("parseRolloutFunction", () => {
+  test("defaults to linear", () => {
+    expect(parseRolloutFunction(undefined)).toBe("linear");
+  });
+
+  test("rejects unsupported rollout functions", () => {
+    expect(() => parseRolloutFunction("curve")).toThrow(
+      "--function must be one of: linear, step, ease_in_out.",
+    );
+  });
+});
+
+describe("parseRolloutMilestones", () => {
+  test("sorts valid rollout milestones chronologically", () => {
+    expect(
+      parseRolloutMilestones([
+        "2026-03-12T19:00:00Z=100",
+        "2026-03-12T18:00:00Z=50",
+      ]),
+    ).toEqual([
+      {
+        at: "2026-03-12T18:00:00.000Z",
+        percentage: 50,
+      },
+      {
+        at: "2026-03-12T19:00:00.000Z",
+        percentage: 100,
+      },
+    ]);
+  });
+
+  test("rejects duplicate rollout milestone times", () => {
+    expect(() =>
+      parseRolloutMilestones([
+        "2026-03-12T18:00:00Z=25",
+        "2026-03-12T18:00:00Z=50",
+      ]),
+    ).toThrow("Rollout points must be strictly increasing by time.");
+  });
+});

package/dist/typegen.d.ts

@@ -1,20 +0,0 @@
-export type TypegenManifest = {
-    orgId: string;
-    orgSlug: string;
-    projectSlug: string;
-    stageSlug: string;
-    generatedAtMs: number;
-    manifestVersion: string;
-    variables: Array<{
-        name: string;
-        kind: "secret" | "ab_roll" | "rollout";
-        declaredType: "string" | "boolean" | "int64" | "float" | "date" | "json";
-        required: boolean;
-        updatedAtMs: number;
-        typeScriptType: string;
-    }>;
-};
-export declare function writeTypegenFile(input: {
-    manifest: TypegenManifest;
-    outPath: string;
-}): Promise<void>;

package/dist/typegen.js

@@ -1,14 +0,0 @@
-import { writeFile } from "node:fs/promises";
-export async function writeTypegenFile(input) {
-    const keys = input.manifest.variables
-        .map((row) => row.name)
-        .sort((left, right) => left.localeCompare(right));
-    const unionLines = keys.map((key) => `  | ${JSON.stringify(key)}`).join("\n");
-    const mapLines = input.manifest.variables
-        .slice()
-        .sort((left, right) => left.name.localeCompare(right.name))
-        .map((row) => `    ${JSON.stringify(row.name)}: ${row.typeScriptType};`)
-        .join("\n");
-    const contents = `/* eslint-disable */\n/* This file is generated by barekey typegen. */\n\nimport type { BarekeyTemporalInstant } from "@barekey/sdk";\nimport "@barekey/sdk";\n\ndeclare module "@barekey/sdk" {\n  interface BarekeyGeneratedTypeMap {\n${mapLines}\n  }\n}\n\nexport type BarekeyKnownKey =\n${unionLines.length > 0 ? unionLines : "  never"};\n\nexport const barekeyManifestVersion = ${JSON.stringify(input.manifest.manifestVersion)};\n`;
-    await writeFile(input.outPath, contents, "utf8");
-}