@blinkk/root 3.0.3 → 3.0.4

package/dist/{chunk-JTZWI4MH.js → chunk-URG2INLL.js}

@@ -1107,11 +1107,11 @@ async function bundleTsFile(srcPath, outPath) {
 }
 
 // src/cli/dev.ts
-import path8 from "node:path";
+import path12 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import cookieParser from "cookie-parser";
 import { default as express } from "express";
-import { dim as dim4 } from "kleur/colors";
+import { dim as dim5 } from "kleur/colors";
 import sirv from "sirv";
 import glob4 from "tiny-glob";
 
@@ -1391,12 +1391,1196 @@ function getSessionCookieSecret(rootConfig, rootDir) {
   return randString(36);
 }
 
+// src/cli/secrets.ts
+import { spawn as spawn3 } from "node:child_process";
+import fs8 from "node:fs";
+import path10 from "node:path";
+import * as readline from "node:readline";
+import { dim as dim3, green, red, yellow } from "kleur/colors";
+
+// src/secrets/manifest.ts
+import fs5 from "node:fs";
+import path7 from "node:path";
+var MANIFEST_FILENAME = ".root.secrets.json";
+var GSM_KEY_RE = /^[A-Za-z0-9_-]{1,255}$/;
+var ENV_NAME_RE = /^[A-Za-z0-9_]+$/;
+function manifestPath(dir) {
+  return path7.join(dir, MANIFEST_FILENAME);
+}
+function isValidEnvName(name) {
+  return ENV_NAME_RE.test(name);
+}
+async function readManifest(filePath) {
+  let raw;
+  try {
+    raw = await fs5.promises.readFile(filePath, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return null;
+    }
+    throw err;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`invalid JSON in ${filePath}`);
+  }
+  return validateManifest(parsed, filePath);
+}
+async function writeManifest(filePath, manifest) {
+  const sortedSecrets = {};
+  for (const name of Object.keys(manifest.secrets).sort()) {
+    sortedSecrets[name] = manifest.secrets[name];
+  }
+  const ordered = {
+    version: manifest.version,
+    gcpProjectId: manifest.gcpProjectId,
+    gsmKey: manifest.gsmKey,
+    ...manifest.import ? { import: manifest.import } : {},
+    secrets: sortedSecrets
+  };
+  await fs5.promises.mkdir(path7.dirname(filePath), { recursive: true });
+  await fs5.promises.writeFile(
+    filePath,
+    JSON.stringify(ordered, null, 2) + "\n",
+    "utf8"
+  );
+}
+function emptyManifest(gcpProjectId, gsmKey) {
+  return { version: 1, gcpProjectId, gsmKey, secrets: {} };
+}
+async function resolveManagedKeys(rootDir) {
+  const sitePath = manifestPath(rootDir);
+  const site = await readManifest(sitePath);
+  if (!site) {
+    return null;
+  }
+  const keys = [];
+  const siteNames = /* @__PURE__ */ new Set();
+  for (const [name, entry] of Object.entries(site.secrets)) {
+    siteNames.add(name);
+    keys.push({
+      name,
+      gsmKey: site.gsmKey,
+      gcpProjectId: site.gcpProjectId,
+      updatedAt: entry.updatedAt
+    });
+  }
+  let shared;
+  if (site.import) {
+    const sharedPath = path7.resolve(rootDir, site.import.manifest);
+    const loaded = await readManifest(sharedPath);
+    if (!loaded) {
+      throw new Error(`imported manifest not found: ${sharedPath}`);
+    }
+    shared = loaded;
+    if (shared.gcpProjectId !== site.gcpProjectId) {
+      throw new Error(
+        `imported manifest ${sharedPath} uses gcpProjectId "${shared.gcpProjectId}" but the site uses "${site.gcpProjectId}"`
+      );
+    }
+    const requested = resolveImportedNames(site.import, shared, sharedPath);
+    for (const name of requested) {
+      if (siteNames.has(name)) {
+        throw new Error(
+          `"${name}" is declared in both the site manifest and the imported shared manifest; remove it from one`
+        );
+      }
+      const entry = shared.secrets[name];
+      keys.push({
+        name,
+        gsmKey: shared.gsmKey,
+        gcpProjectId: shared.gcpProjectId,
+        updatedAt: entry.updatedAt
+      });
+    }
+  }
+  return { rootDir, site, shared, keys };
+}
+function resolveImportedNames(config, shared, sharedPath) {
+  if (!config.keys || config.keys === "*") {
+    return Object.keys(shared.secrets);
+  }
+  for (const name of config.keys) {
+    if (!Object.prototype.hasOwnProperty.call(shared.secrets, name)) {
+      throw new Error(`imported key "${name}" is not defined in ${sharedPath}`);
+    }
+  }
+  return config.keys;
+}
+function validateManifest(value, filePath) {
+  if (typeof value !== "object" || value === null) {
+    throw new Error(`invalid manifest ${filePath}: expected an object`);
+  }
+  const obj = value;
+  if (typeof obj.gcpProjectId !== "string" || !obj.gcpProjectId) {
+    throw new Error(`invalid manifest ${filePath}: missing "gcpProjectId"`);
+  }
+  if (typeof obj.gsmKey !== "string" || !GSM_KEY_RE.test(obj.gsmKey)) {
+    throw new Error(
+      `invalid manifest ${filePath}: "gsmKey" must match ${GSM_KEY_RE}`
+    );
+  }
+  const secretsValue = obj.secrets ?? {};
+  if (typeof secretsValue !== "object" || secretsValue === null) {
+    throw new Error(
+      `invalid manifest ${filePath}: "secrets" must be an object`
+    );
+  }
+  const secrets = {};
+  for (const [name, entry] of Object.entries(
+    secretsValue
+  )) {
+    if (!ENV_NAME_RE.test(name)) {
+      throw new Error(
+        `invalid manifest ${filePath}: secret name "${name}" must match ${ENV_NAME_RE}`
+      );
+    }
+    if (typeof entry !== "object" || entry === null) {
+      throw new Error(
+        `invalid manifest ${filePath}: secret "${name}" must be an object`
+      );
+    }
+    const e = entry;
+    if (typeof e.updatedAt !== "string" || !e.updatedAt) {
+      throw new Error(
+        `invalid manifest ${filePath}: secret "${name}" missing "updatedAt"`
+      );
+    }
+    secrets[name] = {
+      updatedAt: e.updatedAt,
+      ...typeof e.updatedBy === "string" ? { updatedBy: e.updatedBy } : {}
+    };
+  }
+  let importConfig;
+  if (obj.import !== void 0) {
+    if (typeof obj.import !== "object" || obj.import === null) {
+      throw new Error(
+        `invalid manifest ${filePath}: "import" must be an object`
+      );
+    }
+    const imp = obj.import;
+    if (typeof imp.manifest !== "string" || !imp.manifest) {
+      throw new Error(
+        `invalid manifest ${filePath}: "import.manifest" must be a path`
+      );
+    }
+    let keys;
+    if (imp.keys === "*" || imp.keys === void 0) {
+      keys = imp.keys;
+    } else if (Array.isArray(imp.keys)) {
+      keys = imp.keys.map((k) => {
+        if (typeof k !== "string" || !ENV_NAME_RE.test(k)) {
+          throw new Error(
+            `invalid manifest ${filePath}: "import.keys" entries must match ${ENV_NAME_RE}`
+          );
+        }
+        return k;
+      });
+    } else {
+      throw new Error(
+        `invalid manifest ${filePath}: "import.keys" must be an array or "*"`
+      );
+    }
+    importConfig = { manifest: imp.manifest, ...keys ? { keys } : {} };
+  }
+  return {
+    version: typeof obj.version === "number" ? obj.version : 1,
+    gcpProjectId: obj.gcpProjectId,
+    gsmKey: obj.gsmKey,
+    ...importConfig ? { import: importConfig } : {},
+    secrets
+  };
+}
+
+// src/secrets/secrets.ts
+import { spawn as spawn2 } from "node:child_process";
+import fs7 from "node:fs";
+import path9 from "node:path";
+
+// src/secrets/env-file.ts
+import fs6 from "node:fs";
+import path8 from "node:path";
+import dotenv from "dotenv";
+async function readEnvFile(envPath2) {
+  try {
+    return await fs6.promises.readFile(envPath2, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return "";
+    }
+    throw err;
+  }
+}
+async function writeEnvFile(envPath2, content) {
+  const dir = path8.dirname(envPath2);
+  await fs6.promises.mkdir(dir, { recursive: true });
+  const tmp = path8.join(dir, `.env.tmp-${process.pid}-${Date.now()}`);
+  await fs6.promises.writeFile(tmp, content, "utf8");
+  await fs6.promises.rename(tmp, envPath2);
+}
+function parseEnv(content) {
+  return dotenv.parse(content);
+}
+function serializeEnvValue(value) {
+  if (!value.includes("'") && !value.includes("\n") && !value.includes("\r")) {
+    return `'${value}'`;
+  }
+  const escaped = value.replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/"/g, '\\"');
+  return `"${escaped}"`;
+}
+function upsertEnvVars(content, updates, removals = []) {
+  const eol = detectEol(content);
+  const removeSet = new Set(removals);
+  const written = /* @__PURE__ */ new Set();
+  const lines = content.length ? content.split(/\r?\n/) : [];
+  if (lines.length > 0 && lines[lines.length - 1] === "" && /\r?\n$/.test(content)) {
+    lines.pop();
+  }
+  const out = [];
+  for (const line of lines) {
+    const key = parseAssignmentKey(line);
+    if (key && removeSet.has(key)) {
+      continue;
+    }
+    if (key && Object.prototype.hasOwnProperty.call(updates, key)) {
+      if (!written.has(key)) {
+        out.push(`${key}=${serializeEnvValue(updates[key])}`);
+        written.add(key);
+      }
+      continue;
+    }
+    out.push(line);
+  }
+  for (const key of Object.keys(updates)) {
+    if (!written.has(key)) {
+      out.push(`${key}=${serializeEnvValue(updates[key])}`);
+      written.add(key);
+    }
+  }
+  while (out.length > 0 && out[out.length - 1].trim() === "") {
+    out.pop();
+  }
+  if (out.length === 0) {
+    return "";
+  }
+  return out.join(eol) + eol;
+}
+function parseAssignmentKey(line) {
+  const match = line.match(/^\s*(?:export\s+)?([\w.-]+)\s*=/);
+  return match ? match[1] : null;
+}
+function detectEol(content) {
+  const crlf = (content.match(/\r\n/g) || []).length;
+  const lf = (content.match(/\n/g) || []).length - crlf;
+  return crlf > lf ? "\r\n" : "\n";
+}
+
+// src/secrets/gcloud.ts
+import { spawn } from "node:child_process";
+var GcloudError = class extends Error {
+  code;
+  stderr;
+  constructor(code, message, stderr = "") {
+    super(message);
+    this.name = "GcloudError";
+    this.code = code;
+    this.stderr = stderr;
+  }
+};
+function runGcloud(args, options = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn("gcloud", args, {
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.on("error", (err) => {
+      if (err.code === "ENOENT") {
+        reject(
+          new GcloudError(
+            "ENOENT",
+            "The Google Cloud CLI (gcloud) was not found. Install it: https://cloud.google.com/sdk/docs/install"
+          )
+        );
+        return;
+      }
+      reject(err);
+    });
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve(stdout);
+        return;
+      }
+      reject(classifyError(stderr));
+    });
+    if (options.input !== void 0) {
+      child.stdin.end(options.input);
+    } else {
+      child.stdin.end();
+    }
+  });
+}
+async function accessSecretJson(gsmKey, project) {
+  let stdout;
+  try {
+    stdout = await runGcloud([
+      "secrets",
+      "versions",
+      "access",
+      "latest",
+      "--secret",
+      gsmKey,
+      "--project",
+      project
+    ]);
+  } catch (err) {
+    if (err instanceof GcloudError && err.code === "NOT_FOUND") {
+      return {};
+    }
+    throw err;
+  }
+  const trimmed = stdout.trim();
+  if (!trimmed) {
+    return {};
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    throw new Error(
+      `secret "${gsmKey}" does not contain valid JSON (expected an object of env-name to value)`
+    );
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`secret "${gsmKey}" must be a JSON object`);
+  }
+  return parsed;
+}
+async function writeSecretJson(gsmKey, project, data) {
+  await ensureSecret(gsmKey, project);
+  await runGcloud(
+    [
+      "secrets",
+      "versions",
+      "add",
+      gsmKey,
+      "--project",
+      project,
+      "--data-file=-"
+    ],
+    { input: JSON.stringify(data, null, 2) }
+  );
+}
+async function ensureSecret(gsmKey, project) {
+  try {
+    await runGcloud([
+      "secrets",
+      "create",
+      gsmKey,
+      "--project",
+      project,
+      "--replication-policy",
+      "automatic",
+      "--labels",
+      "managed-by=root"
+    ]);
+  } catch (err) {
+    if (err instanceof GcloudError && (err.code === "ALREADY_EXISTS" || /already exists/i.test(err.stderr))) {
+      return;
+    }
+    throw err;
+  }
+}
+function classifyError(stderr) {
+  const text = stderr.trim();
+  if (/NOT_FOUND|was not found|does not exist/i.test(text)) {
+    return new GcloudError("NOT_FOUND", text || "not found", stderr);
+  }
+  if (/ALREADY_EXISTS|already exists/i.test(text)) {
+    return new GcloudError("ALREADY_EXISTS", text || "already exists", stderr);
+  }
+  if (/PERMISSION_DENIED|permission|forbidden|403/i.test(text)) {
+    return new GcloudError(
+      "PERMISSION_DENIED",
+      "Permission denied by Google Cloud. Ensure your account has the right IAM roles (roles/secretmanager.admin to write, roles/secretmanager.secretAccessor to read).\n" + text,
+      stderr
+    );
+  }
+  if (/UNAUTHENTICATED|not authenticated|reauth|login/i.test(text)) {
+    return new GcloudError(
+      "UNAUTHENTICATED",
+      "Not authenticated with Google Cloud. Run `gcloud auth login`.\n" + text,
+      stderr
+    );
+  }
+  return new GcloudError("UNKNOWN", text || "gcloud command failed", stderr);
+}
+
+// src/secrets/hash.ts
+import crypto2 from "node:crypto";
+function randomSalt() {
+  return crypto2.randomBytes(16).toString("hex");
+}
+function hashValue(salt, value) {
+  return crypto2.createHash("sha256").update(salt).update("\0").update(value, "utf8").digest("hex");
+}
+
+// src/secrets/secrets.ts
+var STATE_FILENAME = "secrets-sync.json";
+function localStatePath(rootDir) {
+  return path9.join(rootDir, ".root", STATE_FILENAME);
+}
+function envPath(rootDir) {
+  return path9.join(rootDir, ".env");
+}
+var inFlight = /* @__PURE__ */ new Map();
+function syncSecrets(options) {
+  const { rootDir, apply, force = false } = options;
+  if (apply && !force) {
+    const existing = inFlight.get(rootDir);
+    if (existing) {
+      return existing;
+    }
+    const promise = doSync(options).finally(() => inFlight.delete(rootDir));
+    inFlight.set(rootDir, promise);
+    return promise;
+  }
+  return doSync(options);
+}
+async function doSync(options) {
+  const { rootDir, apply, force = false } = options;
+  const result = {
+    changed: [],
+    kept: [],
+    conflicts: [],
+    overwritten: [],
+    removed: [],
+    errors: [],
+    ranNetwork: false
+  };
+  const resolved = await resolveManagedKeys(rootDir);
+  if (!resolved) {
+    return result;
+  }
+  const envFilePath = envPath(rootDir);
+  const content = await readEnvFile(envFilePath);
+  const parsed = parseEnv(content);
+  const state = await readLocalState(rootDir);
+  const plans = resolved.keys.map((key) => {
+    const synced = state.secrets[key.name];
+    const envVal = parsed[key.name];
+    const remoteChanged = force || !synced || key.updatedAt !== synced.updatedAt;
+    const localChanged = synced ? hashValue(state.salt, envVal ?? "") !== synced.hash : envVal !== void 0;
+    return { key, synced, envVal, remoteChanged, localChanged };
+  });
+  const needsTheirs = (plan) => force || !plan.synced || plan.remoteChanged && !plan.localChanged;
+  const blobs = /* @__PURE__ */ new Map();
+  const toFetch = /* @__PURE__ */ new Map();
+  for (const plan of plans) {
+    if (needsTheirs(plan)) {
+      toFetch.set(plan.key.gsmKey, plan.key.gcpProjectId);
+    }
+  }
+  for (const [gsmKey, project] of toFetch) {
+    try {
+      blobs.set(gsmKey, await accessSecretJson(gsmKey, project));
+      result.ranNetwork = true;
+    } catch (err) {
+      result.errors.push({ gsmKey, message: err?.message || String(err) });
+    }
+  }
+  const updates = {};
+  const nextState = { salt: state.salt, secrets: { ...state.secrets } };
+  for (const plan of plans) {
+    const name = plan.key.name;
+    if (!needsTheirs(plan)) {
+      if (plan.remoteChanged && plan.localChanged) {
+        result.conflicts.push(name);
+      } else if (!plan.remoteChanged && plan.localChanged) {
+        result.kept.push(name);
+      }
+      continue;
+    }
+    if (!blobs.has(plan.key.gsmKey)) {
+      continue;
+    }
+    const theirs = blobs.get(plan.key.gsmKey)[name];
+    if (theirs === void 0) {
+      continue;
+    }
+    if (!plan.synced && plan.envVal !== void 0 && plan.envVal !== theirs) {
+      result.overwritten.push(name);
+    }
+    updates[name] = theirs;
+    nextState.secrets[name] = {
+      updatedAt: plan.key.updatedAt,
+      hash: hashValue(state.salt, theirs)
+    };
+    result.changed.push(name);
+  }
+  const managed = new Set(resolved.keys.map((key) => key.name));
+  const removals = [];
+  for (const name of Object.keys(state.secrets)) {
+    if (!managed.has(name)) {
+      removals.push(name);
+      delete nextState.secrets[name];
+      result.removed.push(name);
+    }
+  }
+  if (apply) {
+    if (Object.keys(updates).length > 0 || removals.length > 0) {
+      const next = upsertEnvVars(content, updates, removals);
+      if (next !== content) {
+        await writeEnvFile(envFilePath, next);
+      }
+      for (const [name, value] of Object.entries(updates)) {
+        process.env[name] = value;
+      }
+      for (const name of removals) {
+        delete process.env[name];
+      }
+    }
+    await writeLocalState(rootDir, nextState);
+  }
+  return result;
+}
+async function setSecret(options) {
+  const { rootDir, manifestFilePath, name, value } = options;
+  if (!isValidEnvName(name)) {
+    throw new Error(`invalid secret name "${name}" (must match [A-Za-z0-9_]+)`);
+  }
+  const manifest = await readManifest(manifestFilePath);
+  if (!manifest) {
+    throw new Error(
+      `no manifest at ${manifestFilePath}; run \`root secrets init\` first`
+    );
+  }
+  const blob = await accessSecretJson(manifest.gsmKey, manifest.gcpProjectId);
+  blob[name] = value;
+  await writeSecretJson(manifest.gsmKey, manifest.gcpProjectId, blob);
+  const updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const updatedBy = options.updatedBy ?? await getGitEmail();
+  manifest.secrets[name] = { updatedAt, ...updatedBy ? { updatedBy } : {} };
+  await writeManifest(manifestFilePath, manifest);
+  const envFilePath = envPath(rootDir);
+  const content = await readEnvFile(envFilePath);
+  const next = upsertEnvVars(content, { [name]: value });
+  if (next !== content) {
+    await writeEnvFile(envFilePath, next);
+  }
+  const state = await readLocalState(rootDir);
+  state.secrets[name] = { updatedAt, hash: hashValue(state.salt, value) };
+  await writeLocalState(rootDir, state);
+}
+async function removeSecret(options) {
+  const { rootDir, manifestFilePath, name } = options;
+  const manifest = await readManifest(manifestFilePath);
+  if (!manifest) {
+    throw new Error(`no manifest at ${manifestFilePath}`);
+  }
+  if (Object.prototype.hasOwnProperty.call(manifest.secrets, name)) {
+    delete manifest.secrets[name];
+    await writeManifest(manifestFilePath, manifest);
+  }
+  const blob = await accessSecretJson(manifest.gsmKey, manifest.gcpProjectId);
+  if (Object.prototype.hasOwnProperty.call(blob, name)) {
+    delete blob[name];
+    await writeSecretJson(manifest.gsmKey, manifest.gcpProjectId, blob);
+  }
+  const envFilePath = envPath(rootDir);
+  const content = await readEnvFile(envFilePath);
+  const next = upsertEnvVars(content, {}, [name]);
+  if (next !== content) {
+    await writeEnvFile(envFilePath, next);
+  }
+  const state = await readLocalState(rootDir);
+  if (state.secrets[name]) {
+    delete state.secrets[name];
+    await writeLocalState(rootDir, state);
+  }
+}
+async function pushEnvToSecrets(options) {
+  const { rootDir, manifestFilePath, only } = options;
+  const manifest = await readManifest(manifestFilePath);
+  if (!manifest) {
+    throw new Error(
+      `no manifest at ${manifestFilePath}; run \`root secrets init\` first`
+    );
+  }
+  const content = await readEnvFile(envPath(rootDir));
+  const parsed = parseEnv(content);
+  const skipped = [];
+  const sharedNames = await sharedImportedNames(rootDir, manifestFilePath);
+  const requested = only && only.length > 0 ? only : Object.keys(parsed);
+  const candidates = [];
+  for (const name of requested) {
+    if (!Object.prototype.hasOwnProperty.call(parsed, name)) {
+      skipped.push({ name, reason: "not found in .env" });
+    } else if (!isValidEnvName(name)) {
+      skipped.push({ name, reason: "invalid name" });
+    } else if (sharedNames.has(name)) {
+      skipped.push({ name, reason: "provided by shared manifest" });
+    } else {
+      candidates.push(name);
+    }
+  }
+  if (candidates.length === 0) {
+    return { pushed: [], skipped, aborted: false, gsmKey: manifest.gsmKey };
+  }
+  if (options.confirm && !await options.confirm(candidates, manifest.gsmKey)) {
+    return { pushed: [], skipped, aborted: true, gsmKey: manifest.gsmKey };
+  }
+  const blob = await accessSecretJson(manifest.gsmKey, manifest.gcpProjectId);
+  for (const name of candidates) {
+    blob[name] = parsed[name];
+  }
+  await writeSecretJson(manifest.gsmKey, manifest.gcpProjectId, blob);
+  const updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const updatedBy = options.updatedBy ?? await getGitEmail();
+  for (const name of candidates) {
+    manifest.secrets[name] = { updatedAt, ...updatedBy ? { updatedBy } : {} };
+  }
+  await writeManifest(manifestFilePath, manifest);
+  const state = await readLocalState(rootDir);
+  for (const name of candidates) {
+    state.secrets[name] = {
+      updatedAt,
+      hash: hashValue(state.salt, parsed[name])
+    };
+  }
+  await writeLocalState(rootDir, state);
+  return {
+    pushed: candidates,
+    skipped,
+    aborted: false,
+    gsmKey: manifest.gsmKey
+  };
+}
+async function sharedImportedNames(rootDir, manifestFilePath) {
+  if (path9.resolve(manifestFilePath) !== path9.resolve(manifestPath(rootDir))) {
+    return /* @__PURE__ */ new Set();
+  }
+  try {
+    const resolved = await resolveManagedKeys(rootDir);
+    if (!resolved || !resolved.shared) {
+      return /* @__PURE__ */ new Set();
+    }
+    const sharedGsmKey = resolved.shared.gsmKey;
+    return new Set(
+      resolved.keys.filter((key) => key.gsmKey === sharedGsmKey).map((key) => key.name)
+    );
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+async function getSecretsStatus(rootDir) {
+  const resolved = await resolveManagedKeys(rootDir);
+  if (!resolved) {
+    return { resolved: null, keys: [] };
+  }
+  const content = await readEnvFile(envPath(rootDir));
+  const parsed = parseEnv(content);
+  const state = await readLocalState(rootDir);
+  const keys = resolved.keys.map((key) => {
+    const synced = state.secrets[key.name];
+    const envVal = parsed[key.name];
+    const remoteChanged = !synced || key.updatedAt !== synced.updatedAt;
+    const localChanged = synced ? hashValue(state.salt, envVal ?? "") !== synced.hash : envVal !== void 0;
+    let kind;
+    if (!synced) {
+      kind = "not-pulled";
+    } else if (remoteChanged && localChanged) {
+      kind = "conflict";
+    } else if (remoteChanged) {
+      kind = "remote-newer";
+    } else if (localChanged) {
+      kind = "locally-edited";
+    } else {
+      kind = "in-sync";
+    }
+    return {
+      name: key.name,
+      gsmKey: key.gsmKey,
+      updatedAt: key.updatedAt,
+      kind,
+      inEnv: envVal !== void 0
+    };
+  });
+  return { resolved, keys };
+}
+async function isSecretsSyncEnabled(rootDir) {
+  if (isSyncDisabledByEnv()) {
+    return false;
+  }
+  return fileExists(manifestPath(rootDir));
+}
+function isSyncDisabledByEnv() {
+  const value = (process.env.ROOT_DISABLE_SECRETS_SYNC || "").trim().toLowerCase();
+  return value !== "" && value !== "0" && value !== "false";
+}
+async function readLocalState(rootDir) {
+  try {
+    const raw = await fs7.promises.readFile(localStatePath(rootDir), "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object" && typeof parsed.salt === "string" && parsed.secrets && typeof parsed.secrets === "object") {
+      return {
+        salt: parsed.salt,
+        secrets: parsed.secrets
+      };
+    }
+  } catch {
+  }
+  return { salt: randomSalt(), secrets: {} };
+}
+async function writeLocalState(rootDir, state) {
+  const file = localStatePath(rootDir);
+  await fs7.promises.mkdir(path9.dirname(file), { recursive: true });
+  await fs7.promises.writeFile(
+    file,
+    JSON.stringify(state, null, 2) + "\n",
+    "utf8"
+  );
+}
+function getGitEmail() {
+  return new Promise((resolve) => {
+    try {
+      const child = spawn2("git", ["config", "user.email"]);
+      let out = "";
+      child.stdout.on("data", (chunk) => {
+        out += chunk.toString();
+      });
+      child.on("error", () => resolve(void 0));
+      child.on("close", (code) => {
+        resolve(code === 0 && out.trim() ? out.trim() : void 0);
+      });
+      child.stdin.end();
+    } catch {
+      resolve(void 0);
+    }
+  });
+}
+
+// src/cli/secrets.ts
+var BAR = dim3("\u2503");
+var DEV_SYNC_TIMEOUT_MS = 1e4;
+function registerSecretsCommands(program) {
+  const secrets = program.command("secrets").description(
+    "manage shared secrets backed by Google Cloud Secret Manager (requires the gcloud CLI)"
+  );
+  secrets.command("init").description("create a secrets manifest").requiredOption("--gcp-project <id>", "GCP project id").requiredOption("--gsm-key <key>", "Secret Manager key for this manifest").option(
+    "--manifest <path>",
+    "manifest path (defaults to ./.root.secrets.json)"
+  ).option("--import <path>", "path to a shared manifest to import keys from").option(
+    "--import-keys <names>",
+    "comma-separated subset of shared keys to import"
+  ).action(action(secretsInit));
+  secrets.command("set <name>").description(
+    "store a secret value, read from a prompt (TTY) or piped stdin"
+  ).option(
+    "--manifest <path>",
+    "target manifest (defaults to ./.root.secrets.json)"
+  ).action(action(secretsSet));
+  secrets.command("rm <name>").description("remove a secret").option(
+    "--manifest <path>",
+    "target manifest (defaults to ./.root.secrets.json)"
+  ).action(action(secretsRm));
+  secrets.command("sync").description("three-way merge managed secrets into .env").action(action(secretsSync));
+  secrets.command("pull").description(
+    "force-download managed secrets into .env (overwrites local edits)"
+  ).action(action(secretsPull));
+  secrets.command("push").description(
+    "push .env values up to Secret Manager and record them in the manifest"
+  ).option(
+    "--manifest <path>",
+    "target manifest (defaults to ./.root.secrets.json)"
+  ).option(
+    "--keys <names>",
+    "comma-separated subset of .env keys (default: all)"
+  ).option("--yes", "skip the confirmation prompt").action(action(secretsPush));
+  secrets.command("status").description("show managed secrets and their sync status (no network)").action(action(secretsStatus));
+}
+async function secretsInit(opts) {
+  const rootDir = process.cwd();
+  const target = opts.manifest ? path10.resolve(rootDir, opts.manifest) : manifestPath(rootDir);
+  if (await readManifest(target)) {
+    console.log(
+      `${BAR} ${yellow("secrets:")} manifest already exists at ${rel(rootDir, target)}`
+    );
+    return;
+  }
+  const manifest = emptyManifest(opts.gcpProject, opts.gsmKey);
+  if (opts.import) {
+    const importConfig = { manifest: opts.import };
+    if (opts.importKeys) {
+      const keys = opts.importKeys.split(",").map((k) => k.trim()).filter(Boolean);
+      if (keys.length > 0) {
+        importConfig.keys = keys;
+      }
+    }
+    manifest.import = importConfig;
+  }
+  await writeManifest(target, manifest);
+  const addedGitignore = await ensureRootGitignored(rootDir);
+  console.log();
+  console.log(`${BAR} ${green("secrets:")} created ${rel(rootDir, target)}`);
+  if (addedGitignore) {
+    console.log(`${BAR}   added ${dim3(".root/")} to .gitignore`);
+  }
+  await warnIfEnvNotIgnored(rootDir);
+  console.log(
+    `${BAR}   ${dim3("next: `root secrets set <NAME>` to store a value")}`
+  );
+  console.log();
+}
+async function secretsSet(name, opts) {
+  const rootDir = process.cwd();
+  const manifestFilePath = opts.manifest ? path10.resolve(rootDir, opts.manifest) : manifestPath(rootDir);
+  const secretValue = await readSecretValue(name);
+  if (!secretValue) {
+    throw new Error("no value provided on stdin");
+  }
+  await setSecret({ rootDir, manifestFilePath, name, value: secretValue });
+  console.log(`${BAR} ${green("secrets:")} set ${name}`);
+  console.log(
+    `${BAR}   ${dim3(`commit ${rel(rootDir, manifestFilePath)} to share this change`)}`
+  );
+}
+async function secretsRm(name, opts) {
+  const rootDir = process.cwd();
+  const manifestFilePath = opts.manifest ? path10.resolve(rootDir, opts.manifest) : manifestPath(rootDir);
+  await removeSecret({ rootDir, manifestFilePath, name });
+  console.log(`${BAR} ${green("secrets:")} removed ${name}`);
+  console.log(
+    `${BAR}   ${dim3(`commit ${rel(rootDir, manifestFilePath)} to share this change`)}`
+  );
+}
+async function secretsPush(opts) {
+  const rootDir = process.cwd();
+  const manifestFilePath = opts.manifest ? path10.resolve(rootDir, opts.manifest) : manifestPath(rootDir);
+  const only = opts.keys ? opts.keys.split(",").map((k) => k.trim()).filter(Boolean) : void 0;
+  const confirm = opts.yes ? void 0 : async (names, gsmKey) => {
+    if (!process.stdin.isTTY) {
+      throw new Error(
+        "refusing to import without --yes on a non-interactive shell"
+      );
+    }
+    console.log();
+    console.log(
+      `${BAR} ${green("secrets:")} push ${names.length} value(s) from .env to "${gsmKey}":`
+    );
+    for (const name of names) {
+      console.log(`${BAR}   ${name}`);
+    }
+    return promptYesNo(`${BAR} continue? [y/N] `);
+  };
+  const result = await pushEnvToSecrets({
+    rootDir,
+    manifestFilePath,
+    only,
+    confirm
+  });
+  printPushResult(result, rootDir, manifestFilePath);
+}
+async function secretsSync() {
+  const rootDir = process.cwd();
+  const result = await syncSecrets({ rootDir, apply: true });
+  printSyncSummary(result);
+  failOnSyncErrors(result);
+}
+async function secretsPull() {
+  const rootDir = process.cwd();
+  const result = await syncSecrets({ rootDir, apply: true, force: true });
+  printSyncSummary(result, { pull: true });
+  failOnSyncErrors(result);
+}
+function failOnSyncErrors(result) {
+  if (result.errors.length > 0) {
+    process.exitCode = 1;
+  }
+}
+async function secretsStatus() {
+  const rootDir = process.cwd();
+  const { resolved, keys } = await getSecretsStatus(rootDir);
+  if (!resolved) {
+    console.log(
+      `${BAR} ${yellow("secrets:")} no ${MANIFEST_FILENAME} here; run \`root secrets init\``
+    );
+    return;
+  }
+  console.log();
+  console.log(
+    `${BAR} ${green("secrets:")} ${resolved.site.gsmKey} ${dim3(`(${resolved.site.gcpProjectId})`)}`
+  );
+  if (resolved.shared) {
+    console.log(`${BAR}   imports ${dim3(resolved.shared.gsmKey)}`);
+  }
+  if (keys.length === 0) {
+    console.log(`${BAR}   ${dim3("no managed keys yet")}`);
+  }
+  for (const key of keys) {
+    console.log(`${BAR}   ${formatStatus(key)}`);
+  }
+  console.log();
+}
+async function syncSecretsOnDev(rootDir) {
+  if (!await isSecretsSyncEnabled(rootDir)) {
+    return;
+  }
+  try {
+    const result = await withTimeout(
+      syncSecrets({ rootDir, apply: true }),
+      DEV_SYNC_TIMEOUT_MS
+    );
+    printSyncSummary(result, { dev: true });
+  } catch (err) {
+    console.log();
+    console.log(
+      `${BAR} ${yellow("secrets:")} sync skipped (${firstLine(err?.message || String(err))})`
+    );
+    console.log();
+  }
+}
+function formatStatus(key) {
+  switch (key.kind) {
+    case "in-sync":
+      return `${green("\u2713")} ${key.name}`;
+    case "remote-newer":
+      return `${yellow("\u2193")} ${key.name} ${dim3("(update available \u2014 run `root secrets sync`)")}`;
+    case "locally-edited":
+      return `${dim3("\u2022")} ${key.name} ${dim3("(locally edited)")}`;
+    case "conflict":
+      return `${yellow("!")} ${key.name} ${dim3("(changed locally & remotely)")}`;
+    case "not-pulled":
+      return `${yellow("\u2193")} ${key.name} ${dim3("(not pulled yet)")}`;
+    default:
+      return key.name;
+  }
+}
+function printSyncSummary(result, opts = {}) {
+  const notable = result.changed.length > 0 || result.removed.length > 0 || result.conflicts.length > 0 || result.overwritten.length > 0 || result.errors.length > 0;
+  if (opts.dev && !notable) {
+    return;
+  }
+  const parts = [];
+  if (result.changed.length) {
+    parts.push(green(`${result.changed.length} updated`));
+  }
+  if (result.removed.length) {
+    parts.push(`${result.removed.length} removed`);
+  }
+  if (result.kept.length) {
+    parts.push(dim3(`${result.kept.length} local`));
+  }
+  if (result.conflicts.length) {
+    parts.push(yellow(`${result.conflicts.length} conflict`));
+  }
+  if (result.errors.length) {
+    parts.push(red(`${result.errors.length} error`));
+  }
+  console.log();
+  console.log(
+    `${BAR} ${green("secrets:")} ${parts.length ? parts.join(", ") : "up to date"}`
+  );
+  for (const name of result.changed) {
+    console.log(`${BAR}   ${green("+")} ${name}`);
+  }
+  for (const name of result.removed) {
+    console.log(`${BAR}   ${dim3("-")} ${name} ${dim3("(removed)")}`);
+  }
+  for (const name of result.overwritten) {
+    console.log(
+      `${BAR}   ${yellow("!")} ${name} ${dim3("(local value replaced)")}`
+    );
+  }
+  for (const name of result.conflicts) {
+    console.log(
+      `${BAR}   ${yellow("!")} ${name} ${dim3(
+        "(changed locally & remotely; keeping yours \u2014 `root secrets pull` to take remote)"
+      )}`
+    );
+  }
+  for (const err of result.errors) {
+    console.log(
+      `${BAR}   ${red("\xD7")} ${err.gsmKey}: ${firstLine(err.message)}`
+    );
+  }
+  console.log();
+}
+function printPushResult(result, rootDir, manifestFilePath) {
+  if (result.aborted) {
+    console.log(`${BAR} ${yellow("secrets:")} aborted, nothing written`);
+    return;
+  }
+  console.log();
+  if (result.pushed.length === 0) {
+    console.log(`${BAR} ${yellow("secrets:")} nothing to push`);
+  } else {
+    console.log(
+      `${BAR} ${green("secrets:")} pushed ${result.pushed.length} value(s) to "${result.gsmKey}"`
+    );
+    for (const name of result.pushed) {
+      console.log(`${BAR}   ${green("+")} ${name}`);
+    }
+  }
+  for (const skip of result.skipped) {
+    console.log(`${BAR}   ${dim3("-")} ${skip.name} ${dim3(`(${skip.reason})`)}`);
+  }
+  if (result.pushed.length > 0) {
+    console.log(
+      `${BAR}   ${dim3(`commit ${rel(rootDir, manifestFilePath)} to share`)}`
+    );
+  }
+  console.log();
+}
+async function ensureRootGitignored(rootDir) {
+  const gitignore = path10.join(rootDir, ".gitignore");
+  let content = "";
+  try {
+    content = await fs8.promises.readFile(gitignore, "utf8");
+  } catch {
+  }
+  const lines = content.split(/\r?\n/).map((line) => line.trim());
+  if (lines.includes(".root/") || lines.includes(".root")) {
+    return false;
+  }
+  const prefix = content && !content.endsWith("\n") ? "\n" : "";
+  await fs8.promises.writeFile(gitignore, `${content}${prefix}.root/
+`, "utf8");
+  return true;
+}
+async function warnIfEnvNotIgnored(rootDir) {
+  const ignored = await isPathGitIgnored(rootDir, ".env");
+  if (ignored === false) {
+    console.log(
+      `${BAR}   ${yellow("warning:")} ${dim3(".env is not git-ignored \u2014 add it to .gitignore")}`
+    );
+  }
+}
+function isPathGitIgnored(rootDir, relPath) {
+  return new Promise((resolve) => {
+    try {
+      const child = spawn3("git", ["check-ignore", "--quiet", relPath], {
+        cwd: rootDir
+      });
+      child.on("error", () => resolve(void 0));
+      child.on("close", (code) => {
+        if (code === 0) {
+          resolve(true);
+        } else if (code === 1) {
+          resolve(false);
+        } else {
+          resolve(void 0);
+        }
+      });
+    } catch {
+      resolve(void 0);
+    }
+  });
+}
+function readSecretValue(name) {
+  if (process.stdin.isTTY) {
+    return promptSecret(`Value for ${name}: `);
+  }
+  return readStdin().then(stripOneTrailingNewline);
+}
+function readStdin() {
+  return new Promise((resolve, reject) => {
+    let data = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      data += chunk;
+    });
+    process.stdin.on("end", () => resolve(data));
+    process.stdin.on("error", reject);
+  });
+}
+function stripOneTrailingNewline(value) {
+  return value.replace(/\r?\n$/, "");
+}
+function promptYesNo(question) {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout
+    });
+    rl.question(question, (answer) => {
+      rl.close();
+      const normalized = answer.trim().toLowerCase();
+      resolve(normalized === "y" || normalized === "yes");
+    });
+  });
+}
+function promptSecret(question) {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout,
+      terminal: true
+    });
+    let muted = false;
+    const rlAny = rl;
+    rlAny._writeToOutput = (chunk) => {
+      if (!muted) {
+        rlAny.output.write(chunk);
+      } else if (chunk.includes("\n") || chunk.includes("\r")) {
+        rlAny.output.write("\n");
+      }
+    };
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    });
+    muted = true;
+  });
+}
+function withTimeout(promise, ms) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      reject(new Error(`timed out after ${ms}ms`));
+    }, ms);
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (err) => {
+        clearTimeout(timer);
+        reject(err);
+      }
+    );
+  });
+}
+function rel(rootDir, filePath) {
+  return path10.relative(rootDir, filePath) || path10.basename(filePath);
+}
+function firstLine(text) {
+  return String(text).split("\n")[0];
+}
+function action(fn) {
+  return async (...args) => {
+    try {
+      await fn(...args);
+    } catch (err) {
+      console.error(`${red("error:")} ${err?.message || err}`);
+      process.exitCode = 1;
+    }
+  };
+}
+
 // src/cli/startup/startup-tasks.ts
 import os from "node:os";
-import path7 from "node:path";
+import path11 from "node:path";
 
 // src/cli/startup/check-version.ts
-import { dim as dim3, green, yellow } from "kleur/colors";
+import { dim as dim4, green as green2, yellow as yellow2 } from "kleur/colors";
 var PACKAGE_NAME = "@blinkk/root";
 var ONE_DAY_MS = 24 * 60 * 60 * 1e3;
 var REGISTRY_TIMEOUT_MS = 3e3;
@@ -1467,16 +2651,16 @@ function parseVersion(version) {
   return [toInt(parts[0]), toInt(parts[1]), toInt(parts[2])];
 }
 function printUpdateNotice(current, latest) {
-  const bar = dim3("\u2503");
-  const label = yellow(`Update available for ${PACKAGE_NAME}:`);
+  const bar = dim4("\u2503");
+  const label = yellow2(`Update available for ${PACKAGE_NAME}:`);
   console.log();
-  console.log(`${bar} ${label} ${dim3(current)} \u2192 ${green(latest)}`);
+  console.log(`${bar} ${label} ${dim4(current)} \u2192 ${green2(latest)}`);
   console.log();
 }
 
 // src/cli/startup/startup-tasks.ts
 var STARTUP_TASKS = [checkVersionTask];
-var STATE_FILE = path7.join(os.homedir(), ".root", "startup-tasks.json");
+var STATE_FILE = path11.join(os.homedir(), ".root", "startup-tasks.json");
 async function runStartupTasks(ctx) {
   try {
     const state = await readState();
@@ -1527,16 +2711,17 @@ async function writeState(state) {
 }
 
 // src/cli/dev.ts
-var __dirname3 = path8.dirname(fileURLToPath3(import.meta.url));
+var __dirname3 = path12.dirname(fileURLToPath3(import.meta.url));
 var DEV_SERVER_404_LOG_IGNORE_PATHS = /* @__PURE__ */ new Set([
   "/.well-known/appspecific/com.chrome.devtools.json"
 ]);
 async function dev(rootProjectDir, options) {
   process.env.NODE_ENV = "development";
-  const rootDir = path8.resolve(rootProjectDir || process.cwd());
+  const rootDir = path12.resolve(rootProjectDir || process.cwd());
   const defaultPort = parseInt(process.env.PORT || "4007");
   const host = options?.host || "localhost";
   const port = await findOpenPort(defaultPort, defaultPort + 10);
+  await syncSecretsOnDev(rootDir);
   void runStartupTasks({ rootDir, version: options?.version });
   let currentServer = null;
   let currentViteServer = null;
@@ -1548,19 +2733,19 @@ async function dev(rootProjectDir, options) {
     const basePath = rootConfig.base || "";
     const homePagePath = rootConfig.server?.homePagePath || basePath;
     console.log();
-    console.log(`${dim4("\u2503")} project:  ${rootDir}`);
-    console.log(`${dim4("\u2503")} server:   http://${host}:${port}${homePagePath}`);
+    console.log(`${dim5("\u2503")} project:  ${rootDir}`);
+    console.log(`${dim5("\u2503")} server:   http://${host}:${port}${homePagePath}`);
     if (testCmsEnabled(rootConfig)) {
-      console.log(`${dim4("\u2503")} cms:      http://${host}:${port}/cms/`);
+      console.log(`${dim5("\u2503")} cms:      http://${host}:${port}/cms/`);
     }
-    console.log(`${dim4("\u2503")} mode:     development`);
+    console.log(`${dim5("\u2503")} mode:     development`);
     console.log();
     currentServer = server.listen(port, host);
     const rootConfigDependencies = server.get(
       "rootConfigDependencies"
     );
     const dependencies = [
-      path8.resolve(rootDir, "root.config.ts"),
+      path12.resolve(rootDir, "root.config.ts"),
       ...rootConfigDependencies
     ];
     viteServer.watcher.add(dependencies);
@@ -1568,7 +2753,7 @@ async function dev(rootProjectDir, options) {
       if (dependencies.includes(file)) {
         console.log(
           `
-${dim4("\u2503")} root.config.ts changed. restarting server...`
+${dim5("\u2503")} root.config.ts changed. restarting server...`
         );
         await restart();
       }
@@ -1588,7 +2773,7 @@ ${dim4("\u2503")} root.config.ts changed. restarting server...`
   await start2();
 }
 async function createDevServer(options) {
-  const rootDir = path8.resolve(options?.rootDir || process.cwd());
+  const rootDir = path12.resolve(options?.rootDir || process.cwd());
   const { rootConfig, dependencies } = await loadRootConfigWithDeps(rootDir, {
     command: "dev"
   });
@@ -1624,7 +2809,7 @@ async function createDevServer(options) {
       if (rootConfig.server?.headers) {
         server.use(headersMiddleware({ rootConfig }));
       }
-      const publicDir = path8.join(rootDir, "public");
+      const publicDir = path12.join(rootDir, "public");
       if (await dirExists(publicDir)) {
         server.use(rootPublicDirMiddleware({ publicDir, viteServer }));
       }
@@ -1652,10 +2837,10 @@ async function createViteMiddleware(options) {
     return sourceFile.relPath;
   });
   const bundleScripts = [];
-  if (await isDirectory(path8.join(rootDir, "bundles"))) {
+  if (await isDirectory(path12.join(rootDir, "bundles"))) {
     const bundleFiles = await glob4("bundles/*", { cwd: rootDir });
     bundleFiles.forEach((file) => {
-      const parts = path8.parse(file);
+      const parts = path12.parse(file);
       if (isJsFile(parts.base)) {
         bundleScripts.push(file);
       }
@@ -1672,7 +2857,7 @@ async function createViteMiddleware(options) {
     optimizeDeps
   });
   function isInElementsDir(changedFilePath) {
-    const filePath = path8.resolve(changedFilePath);
+    const filePath = path12.resolve(changedFilePath);
     const elementsDirs = getElementsDirs(rootConfig, pods);
     return elementsDirs.some((dirPath) => filePath.startsWith(dirPath));
   }
@@ -1691,7 +2876,7 @@ async function createViteMiddleware(options) {
   const viteMiddleware = async (req, res, next) => {
     try {
       req.viteServer = viteServer;
-      const renderModulePath = path8.resolve(__dirname3, "./render.js");
+      const renderModulePath = path12.resolve(__dirname3, "./render.js");
       const render = await viteServer.ssrLoadModule(
         renderModulePath
       );
@@ -1715,7 +2900,7 @@ function rootPublicDirMiddleware(options) {
     handler = sirv(publicDir, sirvOptions);
   }, 1e3);
   function isInPublicDir(changedFilePath) {
-    const filePath = path8.resolve(changedFilePath);
+    const filePath = path12.resolve(changedFilePath);
     return filePath.startsWith(publicDir);
   }
   const watcher = options.viteServer.watcher;
@@ -1747,7 +2932,7 @@ function rootDevServer404Middleware() {
     }
     if (req.renderer) {
       const url = req.path;
-      const ext = path8.extname(url);
+      const ext = path12.extname(url);
       if (!ext) {
         const renderer = req.renderer;
         const data = await renderer.renderDevServer404(req);
@@ -1765,7 +2950,7 @@ function rootDevServer500Middleware() {
     console.error(String(err.stack || err));
     if (req.renderer) {
       const url = req.path;
-      const ext = path8.extname(url);
+      const ext = path12.extname(url);
       if (!ext) {
         const renderer = req.renderer;
         const data = await renderer.renderDevServer500(req, err);
@@ -1791,7 +2976,7 @@ function debounce(fn, timeout) {
 
 // src/cli/gae-deploy.ts
 import { execSync } from "node:child_process";
-import fs5 from "node:fs";
+import fs9 from "node:fs";
 import yaml from "js-yaml";
 async function gaeDeploy(appDir, options) {
   if (!appDir) {
@@ -1805,10 +2990,10 @@ async function gaeDeploy(appDir, options) {
   }
   process.chdir(appDir);
   const appYamlPath = "app.yaml";
-  if (!fs5.existsSync(appYamlPath)) {
+  if (!fs9.existsSync(appYamlPath)) {
     throw new Error(`[gae-deplopy] Missing: ${appYamlPath}`);
   }
-  const appYaml = yaml.load(fs5.readFileSync(appYamlPath, "utf8"));
+  const appYaml = yaml.load(fs9.readFileSync(appYamlPath, "utf8"));
   const service = appYaml.service;
   if (!service) {
     throw new Error(
@@ -1834,7 +3019,7 @@ async function gaeDeploy(appDir, options) {
     { stdio: "inherit" }
   );
   if (backupAppYaml) {
-    fs5.copyFileSync(backupAppYaml, "app.yaml");
+    fs9.copyFileSync(backupAppYaml, "app.yaml");
   }
   if (options?.healthcheckUrl) {
     const healthcheckPassed = await testHealth(
@@ -1921,8 +3106,8 @@ function testIsEnvPlaceholder(envValue) {
 }
 function updateAppYamlEnv(appYamlPath, appYaml) {
   const backupAppYaml = `${appYamlPath}.bak`;
-  fs5.copyFileSync(appYamlPath, backupAppYaml);
-  let content = fs5.readFileSync(appYamlPath, "utf8");
+  fs9.copyFileSync(appYamlPath, backupAppYaml);
+  let content = fs9.readFileSync(appYamlPath, "utf8");
   const envVars = appYaml.env_variables;
   Object.entries(envVars).forEach(([envVar, envValue]) => {
     if (testIsEnvPlaceholder(envValue)) {
@@ -1935,7 +3120,7 @@ function updateAppYamlEnv(appYamlPath, appYaml) {
       }
     }
   });
-  fs5.writeFileSync(appYamlPath, content, "utf8");
+  fs9.writeFileSync(appYamlPath, content, "utf8");
   return backupAppYaml;
 }
 function getTimestamp() {
@@ -1959,29 +3144,29 @@ function testManagedVersion(service, appInfo, prefix) {
 }
 
 // src/cli/preview.ts
-import path9 from "node:path";
+import path13 from "node:path";
 import compression from "compression";
 import cookieParser2 from "cookie-parser";
 import { default as express2 } from "express";
-import { dim as dim5 } from "kleur/colors";
+import { dim as dim6 } from "kleur/colors";
 import sirv2 from "sirv";
 async function preview(rootProjectDir, options) {
   process.env.NODE_ENV = "development";
-  const rootDir = path9.resolve(rootProjectDir || process.cwd());
+  const rootDir = path13.resolve(rootProjectDir || process.cwd());
   const server = await createPreviewServer({ rootDir });
   const port = parseInt(process.env.PORT || "4007");
   const host = options?.host || "localhost";
   console.log();
-  console.log(`${dim5("\u2503")} project:  ${rootDir}`);
-  console.log(`${dim5("\u2503")} server:   http://${host}:${port}`);
-  console.log(`${dim5("\u2503")} mode:     preview`);
+  console.log(`${dim6("\u2503")} project:  ${rootDir}`);
+  console.log(`${dim6("\u2503")} server:   http://${host}:${port}`);
+  console.log(`${dim6("\u2503")} mode:     preview`);
   console.log();
   server.listen(port, host);
 }
 async function createPreviewServer(options) {
   const rootDir = options.rootDir;
   const rootConfig = await loadBundledConfig(rootDir, { command: "preview" });
-  const distDir = path9.join(rootDir, "dist");
+  const distDir = path13.join(rootDir, "dist");
   const server = express2();
   server.disable("x-powered-by");
   server.use(compression());
@@ -2007,7 +3192,7 @@ async function createPreviewServer(options) {
       if (rootConfig.server?.headers) {
         server.use(headersMiddleware({ rootConfig }));
       }
-      const publicDir = path9.join(distDir, "html");
+      const publicDir = path13.join(distDir, "html");
       server.use(sirv2(publicDir, { dev: false }));
       server.use(trailingSlashMiddleware({ rootConfig }));
       server.use(rootPreviewServerMiddleware());
@@ -2026,20 +3211,20 @@ async function createPreviewServer(options) {
 }
 async function rootPreviewRendererMiddleware(options) {
   const { distDir, rootConfig } = options;
-  const render = await import(path9.join(distDir, "server/render.js"));
-  const manifestPath = path9.join(distDir, ".root/manifest.json");
-  if (!await fileExists(manifestPath)) {
+  const render = await import(path13.join(distDir, "server/render.js"));
+  const manifestPath2 = path13.join(distDir, ".root/manifest.json");
+  if (!await fileExists(manifestPath2)) {
     throw new Error(
-      `could not find ${manifestPath}. run \`root build\` before \`root preview\`.`
+      `could not find ${manifestPath2}. run \`root build\` before \`root preview\`.`
     );
   }
-  const elementGraphJsonPath = path9.join(distDir, ".root/elements.json");
+  const elementGraphJsonPath = path13.join(distDir, ".root/elements.json");
   if (!await fileExists(elementGraphJsonPath)) {
     throw new Error(
       `could not find ${elementGraphJsonPath}. run \`root build\` before \`root preview\`.`
     );
   }
-  const rootManifest = await loadJson(manifestPath);
+  const rootManifest = await loadJson(manifestPath2);
   const assetMap = BuildAssetMap.fromRootManifest(rootConfig, rootManifest);
   const elementGraphJson = await loadJson(elementGraphJsonPath);
   const elementGraph = ElementGraph.fromJson(elementGraphJson);
@@ -2073,7 +3258,7 @@ function rootPreviewServer404Middleware() {
     console.error(`\u2753 404 ${req.originalUrl}`);
     if (req.renderer) {
       const url = req.path;
-      const ext = path9.extname(url);
+      const ext = path13.extname(url);
       if (!ext) {
         const renderer = req.renderer;
         const data = await renderer.render404({ currentPath: url });
@@ -2091,7 +3276,7 @@ function rootPreviewServer500Middleware() {
     console.error(String(err.stack || err));
     if (req.renderer) {
       const url = req.path;
-      const ext = path9.extname(url);
+      const ext = path13.extname(url);
       if (!ext) {
         const renderer = req.renderer;
         const data = await renderer.renderDevServer500(req, err);
@@ -2105,29 +3290,29 @@ function rootPreviewServer500Middleware() {
 }
 
 // src/cli/start.ts
-import path10 from "node:path";
+import path14 from "node:path";
 import compression2 from "compression";
 import cookieParser3 from "cookie-parser";
 import { default as express3 } from "express";
-import { dim as dim6 } from "kleur/colors";
+import { dim as dim7 } from "kleur/colors";
 import sirv3 from "sirv";
 async function start(rootProjectDir, options) {
   process.env.NODE_ENV = "production";
-  const rootDir = path10.resolve(rootProjectDir || process.cwd());
+  const rootDir = path14.resolve(rootProjectDir || process.cwd());
   const server = await createProdServer({ rootDir });
   const port = parseInt(process.env.PORT || "4007");
   const host = options?.host || "localhost";
   console.log();
-  console.log(`${dim6("\u2503")} project:  ${rootDir}`);
-  console.log(`${dim6("\u2503")} server:   http://${host}:${port}`);
-  console.log(`${dim6("\u2503")} mode:     production`);
+  console.log(`${dim7("\u2503")} project:  ${rootDir}`);
+  console.log(`${dim7("\u2503")} server:   http://${host}:${port}`);
+  console.log(`${dim7("\u2503")} mode:     production`);
   console.log();
   server.listen(port, host);
 }
 async function createProdServer(options) {
   const rootDir = options.rootDir;
   const rootConfig = await loadBundledConfig(rootDir, { command: "start" });
-  const distDir = path10.join(rootDir, "dist");
+  const distDir = path14.join(rootDir, "dist");
   const server = express3();
   server.disable("x-powered-by");
   server.use(compression2());
@@ -2153,7 +3338,7 @@ async function createProdServer(options) {
       if (rootConfig.server?.headers) {
         server.use(headersMiddleware({ rootConfig }));
       }
-      const publicDir = path10.join(distDir, "html");
+      const publicDir = path14.join(distDir, "html");
       server.use(sirv3(publicDir, { dev: false }));
       server.use(trailingSlashMiddleware({ rootConfig }));
       server.use(rootProdServerMiddleware());
@@ -2172,20 +3357,20 @@ async function createProdServer(options) {
 }
 async function rootProdRendererMiddleware(options) {
   const { distDir, rootConfig } = options;
-  const render = await import(path10.join(distDir, "server/render.js"));
-  const manifestPath = path10.join(distDir, ".root/manifest.json");
-  if (!await fileExists(manifestPath)) {
+  const render = await import(path14.join(distDir, "server/render.js"));
+  const manifestPath2 = path14.join(distDir, ".root/manifest.json");
+  if (!await fileExists(manifestPath2)) {
     throw new Error(
-      `could not find ${manifestPath}. run \`root build\` before \`root start\`.`
+      `could not find ${manifestPath2}. run \`root build\` before \`root start\`.`
     );
   }
-  const elementGraphJsonPath = path10.join(distDir, ".root/elements.json");
+  const elementGraphJsonPath = path14.join(distDir, ".root/elements.json");
   if (!await fileExists(elementGraphJsonPath)) {
     throw new Error(
       `could not find ${elementGraphJsonPath}. run \`root build\` before \`root start\`.`
     );
   }
-  const rootManifest = await loadJson(manifestPath);
+  const rootManifest = await loadJson(manifestPath2);
   const assetMap = BuildAssetMap.fromRootManifest(rootConfig, rootManifest);
   const elementGraphJson = await loadJson(elementGraphJsonPath);
   const elementGraph = ElementGraph.fromJson(elementGraphJson);
@@ -2219,7 +3404,7 @@ function rootProdServer404Middleware() {
     console.error(`\u2753 404 ${req.originalUrl}`);
     if (req.renderer) {
       const url = req.path;
-      const ext = path10.extname(url);
+      const ext = path14.extname(url);
       if (!ext) {
         const renderer = req.renderer;
         const data = await renderer.render404({ currentPath: url });
@@ -2237,7 +3422,7 @@ function rootProdServer500Middleware() {
     console.error(String(err.stack || err));
     if (req.renderer) {
       const url = req.path;
-      const ext = path10.extname(url);
+      const ext = path14.extname(url);
       if (!ext) {
         const renderer = req.renderer;
         const data = await renderer.renderError(err);
@@ -2321,6 +3506,7 @@ var CliRunner = class {
       "--host <host>",
       "network address the server should listen on, e.g. 127.0.0.1"
     ).action(start);
+    registerSecretsCommands(program);
     await program.parseAsync(argv);
   }
 };
@@ -2343,4 +3529,4 @@ export {
   createProdServer,
   CliRunner
 };
-//# sourceMappingURL=chunk-JTZWI4MH.js.map
+//# sourceMappingURL=chunk-URG2INLL.js.map