@chrisjowen/wheelhouse 0.1.1 → 0.2.1

package/dist/wh-vault.js

@@ -0,0 +1,1007 @@
+#!/usr/bin/env node
+
+// cli/vault/keychain.ts
+import { spawn } from "node:child_process";
+
+// cli/vault/backend.ts
+var BackendError = class extends Error {
+  constructor(kind, message) {
+    super(message);
+    this.kind = kind;
+    this.name = "BackendError";
+  }
+  kind;
+};
+
+// cli/vault/store.ts
+import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+// src/lib/vault.ts
+var SECRET_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+var PROJECT_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+
+// cli/vault/store.ts
+var VAULT_FILE = "vault.json";
+var SCHEMA = "wh-vault.v1";
+function vaultDir(configDir) {
+  return path.join(configDir, "vault");
+}
+function emptyVault(backend) {
+  return { schema: SCHEMA, backend, secrets: {} };
+}
+var isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function parseVault(text) {
+  let v;
+  try {
+    v = JSON.parse(text);
+  } catch (e) {
+    throw new Error(`it is not JSON (${e instanceof Error ? e.message : String(e)})`);
+  }
+  if (!isRecord(v) || v.schema !== SCHEMA) throw new Error(`its schema is not ${SCHEMA}`);
+  if (typeof v.backend !== "string" || !v.backend) throw new Error("it names no backend");
+  if (!isRecord(v.secrets)) throw new Error("it has no secrets object");
+  const secrets = {};
+  for (const [name, s] of Object.entries(v.secrets)) {
+    if (!SECRET_NAME.test(name)) throw new Error(`${JSON.stringify(name)} is not a secret name`);
+    if (!isRecord(s) || !Array.isArray(s.projects) || !s.projects.every((p) => typeof p === "string" && PROJECT_ID.test(p)) || typeof s.createdAt !== "string" || typeof s.updatedAt !== "string") {
+      throw new Error(`the entry for ${name} is malformed`);
+    }
+    secrets[name] = {
+      projects: [...new Set(s.projects)].sort(),
+      createdAt: s.createdAt,
+      updatedAt: s.updatedAt
+    };
+  }
+  return { schema: SCHEMA, backend: v.backend, secrets };
+}
+async function readVault(dir) {
+  const file = path.join(dir, VAULT_FILE);
+  let text;
+  try {
+    text = await readFile(file, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return null;
+    throw e;
+  }
+  try {
+    return parseVault(text);
+  } catch (e) {
+    throw new Error(`${file} cannot be read: ${e instanceof Error ? e.message : String(e)}`);
+  }
+}
+async function ensureDir(dir) {
+  await mkdir(dir, { recursive: true, mode: 448 });
+  await chmod(dir, 448);
+}
+async function writeVault(dir, vault) {
+  await ensureDir(dir);
+  const file = path.join(dir, VAULT_FILE);
+  const tmp = `${file}.${process.pid}.tmp`;
+  await writeFile(tmp, `${JSON.stringify(vault, null, "	")}
+`, { mode: 384 });
+  await chmod(tmp, 384);
+  await rename(tmp, file);
+}
+function grantedTo(vault, project) {
+  return Object.entries(vault.secrets).filter(([, s]) => s.projects.includes(project)).map(([name]) => name).sort();
+}
+
+// cli/vault/keychain.ts
+var KEYCHAIN_SERVICE = "wheelhouse-vault";
+var SECURITY = "/usr/bin/security";
+var MAX_LINE_BYTES = 4e3;
+var TIMEOUT_MS = 12e4;
+var ENCODED = "wh-vault:base64:";
+var EXIT_NOT_FOUND = 44;
+var EXIT_INTERACTION_NOT_ALLOWED = 36;
+function securityRunner(file = SECURITY, timeoutMs = TIMEOUT_MS) {
+  return (args, input) => new Promise((resolve) => {
+    const child = spawn(file, args, {
+      stdio: [input === void 0 ? "ignore" : "pipe", "pipe", "pipe"]
+    });
+    const out = [];
+    const err = [];
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGKILL");
+    }, timeoutMs);
+    child.stdout?.on("data", (c) => out.push(c));
+    child.stderr?.on("data", (c) => err.push(c));
+    child.on("error", (e) => {
+      clearTimeout(timer);
+      resolve({ code: null, stdout: "", stderr: "", spawnError: e.message });
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      resolve({
+        code,
+        stdout: Buffer.concat(out).toString("utf8"),
+        stderr: Buffer.concat(err).toString("utf8"),
+        timedOut
+      });
+    });
+    if (input !== void 0 && child.stdin) {
+      child.stdin.on("error", () => {
+      });
+      child.stdin.end(input);
+    }
+  });
+}
+function encodeValue(value) {
+  return /^[\x20-\x7e]*$/.test(value) && !value.startsWith(ENCODED) ? value : ENCODED + Buffer.from(value, "utf8").toString("base64");
+}
+function decodeValue(stored) {
+  return stored.startsWith(ENCODED) ? Buffer.from(stored.slice(ENCODED.length), "base64").toString("utf8") : stored;
+}
+var KeychainBackend = class {
+  constructor(security = securityRunner()) {
+    this.security = security;
+  }
+  security;
+  id = "keychain";
+  where = "the macOS login Keychain";
+  async get(name) {
+    this.check(name);
+    const r = await this.security([
+      "find-generic-password",
+      "-s",
+      KEYCHAIN_SERVICE,
+      "-a",
+      name,
+      "-w"
+    ]);
+    if (r.code !== 0) throw this.failure(r, name, "read");
+    return decodeValue(r.stdout.endsWith("\n") ? r.stdout.slice(0, -1) : r.stdout);
+  }
+  async set(name, value) {
+    this.check(name);
+    const hex = Buffer.from(encodeValue(value), "utf8").toString("hex");
+    const line = `add-generic-password -U -s ${KEYCHAIN_SERVICE} -a ${name} -l "${KEYCHAIN_SERVICE} ${name}" -X ${hex}
+`;
+    if (Buffer.byteLength(line) > MAX_LINE_BYTES) {
+      const room = Math.floor(
+        (MAX_LINE_BYTES - (Buffer.byteLength(line) - hex.length)) / 2 - ENCODED.length
+      );
+      throw new BackendError(
+        "too-large",
+        `the value is too long for the Keychain through the security tool (at most about ${Math.max(room, 0)} bytes)`
+      );
+    }
+    const r = await this.security(["-i"], line);
+    if (r.code !== 0)
+      throw this.failure({ ...r, stdout: "", stderr: redact(r.stderr, hex) }, name, "store");
+  }
+  async remove(name) {
+    this.check(name);
+    const r = await this.security(["delete-generic-password", "-s", KEYCHAIN_SERVICE, "-a", name]);
+    if (r.code === 0) return;
+    const e = this.failure(r, name, "delete");
+    if (e.kind !== "not-found") throw e;
+  }
+  /** A secret name is safe to write unquoted into a `security -i` line. */
+  check(name) {
+    if (!SECRET_NAME.test(name))
+      throw new BackendError("failed", `${JSON.stringify(name)} is not a secret name`);
+  }
+  failure(r, name, verb) {
+    if (r.spawnError !== void 0) {
+      return new BackendError(
+        "unavailable",
+        `could not run ${SECURITY} (${r.spawnError}); the Keychain backend works on macOS only`
+      );
+    }
+    if (r.timedOut) {
+      return new BackendError(
+        "failed",
+        `the Keychain did not answer within ${TIMEOUT_MS / 1e3} s; a Keychain dialog may be waiting on the Mac's screen`
+      );
+    }
+    if (r.code === EXIT_INTERACTION_NOT_ALLOWED || /interaction is not allowed/i.test(r.stderr)) {
+      return new BackendError(
+        "interaction-not-allowed",
+        `the Keychain would not answer here ("User interaction is not allowed"): this terminal runs outside the Mac's login session, so the Keychain cannot ask to be unlocked or to allow access`
+      );
+    }
+    if (r.code === EXIT_NOT_FOUND || /could not be found/i.test(r.stderr)) {
+      return new BackendError("not-found", `the Keychain has no value for ${name}`);
+    }
+    const said = r.stderr.trim().split("\n")[0]?.replace(/^security:\s*/, "") ?? "";
+    return new BackendError(
+      "failed",
+      `the Keychain could not ${verb} ${name} (security exited ${r.code ?? "abnormally"}${said ? `: ${said}` : ""})`
+    );
+  }
+};
+function redact(text, hex) {
+  let out = text.split(hex).join("[value]");
+  out = out.replace(/[0-9a-fA-F]{16,}/g, "[value]");
+  return out;
+}
+
+// cli/vault/program.ts
+import { readFile as readFile4, stat } from "node:fs/promises";
+import path6 from "node:path";
+import { Command, InvalidArgumentError } from "commander";
+
+// package.json
+var version = "0.2.1";
+
+// src/lib/server/plugins/config.ts
+import { homedir } from "node:os";
+import path2 from "node:path";
+function defaultConfigDir(env) {
+  if (env.WHEELHOUSE_CONFIG_DIR) return path2.resolve(env.WHEELHOUSE_CONFIG_DIR);
+  if (env.XDG_CONFIG_HOME) return path2.join(env.XDG_CONFIG_HOME, "wheelhouse");
+  return path2.join(homedir(), ".config", "wheelhouse");
+}
+var editing = Promise.resolve();
+
+// cli/vault/audit.ts
+import { appendFile, chmod as chmod2, open, readFile as readFile2 } from "node:fs/promises";
+import path3 from "node:path";
+var AUDIT_FILE = "audit.jsonl";
+async function appendAudit(dir, entry) {
+  await ensureDir(dir);
+  const file = path3.join(dir, AUDIT_FILE);
+  await appendFile(file, `${JSON.stringify(entry)}
+`, { mode: 384 });
+  await chmod2(file, 384);
+}
+async function checkAuditWritable(dir) {
+  await ensureDir(dir);
+  const fh = await open(path3.join(dir, AUDIT_FILE), "a", 384);
+  await fh.close();
+}
+var isEntry = (v) => {
+  if (typeof v !== "object" || v === null) return false;
+  const e = v;
+  return typeof e.at === "string" && typeof e.event === "string" && Array.isArray(e.names) && e.names.every((n) => typeof n === "string");
+};
+async function readAudit(dir, q = {}) {
+  let text;
+  try {
+    text = await readFile2(path3.join(dir, AUDIT_FILE), "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return [];
+    throw e;
+  }
+  const out = [];
+  const lines = text.split("\n");
+  for (let i = lines.length - 1; i >= 0; i--) {
+    if (q.limit !== void 0 && out.length >= q.limit) break;
+    const line = lines[i].trim();
+    if (!line) continue;
+    let e;
+    try {
+      e = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (!isEntry(e)) continue;
+    if (q.project !== void 0 && e.project !== q.project) continue;
+    if (q.task !== void 0 && e.task !== q.task) continue;
+    if (q.name !== void 0 && !e.names.includes(q.name)) continue;
+    if (q.event !== void 0 && e.event !== q.event) continue;
+    out.push({ ...e, task: e.task ?? null, project: e.project ?? null });
+  }
+  return out;
+}
+async function lastUsed(dir) {
+  const used = /* @__PURE__ */ new Map();
+  for (const e of await readAudit(dir, { event: "run" })) {
+    if (e.outcome !== "ok") continue;
+    for (const n of e.names) if (!used.has(n)) used.set(n, e.at);
+  }
+  return used;
+}
+
+// cli/vault/caller.ts
+import { execFile } from "node:child_process";
+import { readFile as readFile3 } from "node:fs/promises";
+import path4 from "node:path";
+var TASK_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+async function resolveCaller(deps) {
+  const read = deps.readFile ?? ((f) => readFile3(f, "utf8"));
+  const origin = deps.originUrl ?? gitOriginUrl;
+  const raw = deps.env.FM_TASK_ID?.trim();
+  const task = raw && TASK_ID.test(raw) ? raw : null;
+  if (task) {
+    const project2 = await projectFromTaskRecord(task, deps.env, read);
+    if (project2) return { task, project: project2, via: "task-record" };
+  }
+  const url = await origin(deps.cwd).catch(() => null);
+  const project = url ? repoName(url) : null;
+  return project ? { task, project, via: "origin-remote" } : { task, project: null, via: null };
+}
+function stateDir(task, env) {
+  const inbox = env.FM_TASK_INBOX;
+  if (inbox && path4.isAbsolute(inbox) && path4.basename(inbox) === `${task}.inbox`) {
+    return path4.dirname(inbox);
+  }
+  return env.FM_HOME && path4.isAbsolute(env.FM_HOME) ? path4.join(env.FM_HOME, "state") : null;
+}
+async function projectFromTaskRecord(task, env, read) {
+  const state = stateDir(task, env);
+  if (!state) return null;
+  let meta;
+  try {
+    meta = await read(path4.join(state, `${task}.meta`));
+  } catch {
+    return null;
+  }
+  let clone = null;
+  for (const line of meta.split("\n")) {
+    if (line.startsWith("project=")) clone = line.slice("project=".length).trim();
+  }
+  if (!clone || !path4.isAbsolute(clone)) return null;
+  if (path4.resolve(clone) === path4.resolve(path4.dirname(state))) return "firstmate";
+  const id = path4.basename(clone);
+  return PROJECT_ID.test(id) ? id : null;
+}
+function repoName(url) {
+  const s = url.trim().replace(/\/+$/, "");
+  const last = s.split(/[/:]/).pop() ?? "";
+  const name = last.replace(/\.git$/, "");
+  return PROJECT_ID.test(name) ? name : null;
+}
+function gitOriginUrl(cwd) {
+  return new Promise((resolve) => {
+    execFile(
+      "git",
+      ["remote", "get-url", "origin"],
+      { cwd, timeout: 5e3, env: { ...process.env, GIT_TERMINAL_PROMPT: "0" } },
+      (err, stdout) => resolve(err ? null : stdout.trim() || null)
+    );
+  });
+}
+
+// cli/vault/dotenv.ts
+var LINE = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/;
+function parseDotenv(text) {
+  const entries = [];
+  const skipped = [];
+  const lines = text.replace(/\r\n/g, "\n").split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line.trim() || line.trim().startsWith("#")) continue;
+    const m = LINE.exec(line);
+    if (!m) {
+      skipped.push(i + 1);
+      continue;
+    }
+    const value = parseValue(m[2]);
+    if (value === null) skipped.push(i + 1);
+    else entries.push({ name: m[1], value, line: i + 1 });
+  }
+  return { entries, skipped };
+}
+function parseValue(raw) {
+  const s = raw.trim();
+  if (s.startsWith("'")) {
+    const end = s.indexOf("'", 1);
+    return end === -1 || !isTail(s.slice(end + 1)) ? null : s.slice(1, end);
+  }
+  if (s.startsWith('"')) {
+    let out = "";
+    for (let i = 1; i < s.length; i++) {
+      const c = s[i];
+      if (c === "\\" && i + 1 < s.length) {
+        const n = s[++i];
+        out += n === "n" ? "\n" : n === "t" ? "	" : n === "r" ? "\r" : n;
+      } else if (c === '"') {
+        return isTail(s.slice(i + 1)) ? out : null;
+      } else {
+        out += c;
+      }
+    }
+    return null;
+  }
+  const hash = s.search(/\s#/);
+  return (hash === -1 ? s : s.slice(0, hash)).trim();
+}
+var isTail = (rest) => !rest.trim() || rest.trim().startsWith("#");
+
+// cli/vault/run.ts
+import { spawn as spawn2 } from "node:child_process";
+import { constants } from "node:os";
+import path5 from "node:path";
+
+// cli/vault/mask.ts
+var MASK = "<concealed by wh-vault>";
+var Masker = class {
+  values;
+  mask;
+  pending = Buffer.alloc(0);
+  constructor(values, mask = MASK) {
+    this.values = [...new Set(values.filter((v) => v.length > 0))].map((v) => Buffer.from(v, "utf8")).sort((a, b) => b.length - a.length);
+    this.mask = Buffer.from(mask, "utf8");
+  }
+  /** What of the output so far can be shown now. */
+  write(chunk) {
+    return this.scan(Buffer.concat([this.pending, chunk]), false);
+  }
+  /** The rest, once the output has ended. */
+  end() {
+    return this.scan(this.pending, true);
+  }
+  scan(buf, final) {
+    const limit2 = final ? buf.length : this.partialStart(buf);
+    const out = [];
+    let i = 0;
+    for (; ; ) {
+      let at = -1;
+      let len = 0;
+      for (const v of this.values) {
+        const p = buf.indexOf(v, i);
+        if (p !== -1 && p < limit2 && (at === -1 || p < at)) {
+          at = p;
+          len = v.length;
+        }
+      }
+      if (at === -1) break;
+      out.push(buf.subarray(i, at), this.mask);
+      i = at + len;
+    }
+    const keep = Math.max(i, limit2);
+    out.push(buf.subarray(i, keep));
+    this.pending = Buffer.from(buf.subarray(keep));
+    return Buffer.concat(out);
+  }
+  /** Where the longest end of `buf` that begins some value starts (`buf.length` if none). */
+  partialStart(buf) {
+    let start = buf.length;
+    for (const v of this.values) {
+      for (let k = Math.min(v.length - 1, buf.length); k > buf.length - start; k--) {
+        if (buf.subarray(buf.length - k).equals(v.subarray(0, k))) {
+          start = buf.length - k;
+          break;
+        }
+      }
+    }
+    return start;
+  }
+};
+
+// cli/vault/run.ts
+var EXIT_REFUSED = 125;
+var EXIT_CANNOT_RUN = 126;
+var EXIT_NOT_FOUND2 = 127;
+async function runWithSecrets(command, only, deps) {
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const say = (line) => deps.stderr.write(`wh-vault: ${line}
+`);
+  const program = command[0] ? path5.basename(command[0]) : "";
+  const { project, task } = deps.caller;
+  const vault = await readVault(deps.dir);
+  if (!vault) {
+    say("the vault is empty. The captain stores a secret with `wh-vault set NAME`.");
+    return EXIT_REFUSED;
+  }
+  const log = async (e) => {
+    try {
+      await appendAudit(deps.dir, {
+        at: now().toISOString(),
+        event: "run",
+        task,
+        project,
+        program,
+        ...e
+      });
+    } catch (err) {
+      say(`could not write the usage log: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  };
+  const refuse = async (names3, reason) => {
+    say(`${reason}.`);
+    await log({ names: names3, outcome: "denied", reason });
+    return EXIT_REFUSED;
+  };
+  if (!project) {
+    return refuse(
+      only ?? [],
+      "could not tell which project this is: there is no Firstmate task record (FM_TASK_ID) and no origin remote here"
+    );
+  }
+  const granted = grantedTo(vault, project);
+  let names2;
+  if (only?.length) {
+    const missing = only.filter((n) => !granted.includes(n));
+    if (missing.length) {
+      return refuse(
+        only,
+        `${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} not granted to ${project}; the captain grants one with \`wh-vault grant NAME ${project}\``
+      );
+    }
+    names2 = [...new Set(only)];
+  } else {
+    if (!granted.length) {
+      return refuse(
+        [],
+        `no secrets are granted to ${project}; the captain grants one with \`wh-vault grant NAME ${project}\``
+      );
+    }
+    names2 = granted;
+  }
+  try {
+    await checkAuditWritable(deps.dir);
+  } catch (err) {
+    say(
+      `will not hand out secrets without logging the use, and the usage log cannot be written: ${err instanceof Error ? err.message : String(err)}.`
+    );
+    return EXIT_REFUSED;
+  }
+  const values = {};
+  for (const name of names2) {
+    try {
+      values[name] = await deps.backend.get(name);
+    } catch (err) {
+      const reason = err instanceof BackendError ? err.message : `could not read ${name}: ${String(err)}`;
+      say(`${reason}.`);
+      if (err instanceof BackendError && err.kind === "interaction-not-allowed") {
+        say(
+          "Run the command from a terminal in the login session (Terminal.app, or a terminal server started there). See docs/vault.md."
+        );
+      }
+      await log({ names: names2, outcome: "unavailable", reason });
+      return EXIT_REFUSED;
+    }
+  }
+  const result2 = await spawnMasked(command, values, deps);
+  if ("error" in result2) {
+    say(result2.error);
+    await log({ names: names2, outcome: "failed", reason: result2.error });
+    return result2.code;
+  }
+  await log({ names: names2, outcome: "ok", exit: result2.code, signal: result2.signal });
+  if (result2.signal) {
+    return 128 + (constants.signals[result2.signal] ?? 0);
+  }
+  return result2.code ?? EXIT_REFUSED;
+}
+function spawnMasked(command, values, deps) {
+  return new Promise((resolve) => {
+    const child = spawn2(command[0], command.slice(1), {
+      cwd: deps.cwd,
+      env: { ...deps.env, ...values },
+      stdio: ["inherit", "pipe", "pipe"]
+    });
+    const secrets = Object.values(values);
+    const out = new Masker(secrets);
+    const err = new Masker(secrets);
+    child.stdout?.on("data", (c) => deps.stdout.write(out.write(c)));
+    child.stderr?.on("data", (c) => deps.stderr.write(err.write(c)));
+    const forward = (sig) => () => child.kill(sig);
+    const handlers = deps.forwardSignals ? ["SIGTERM", "SIGHUP"].map((s) => [s, forward(s)]) : [];
+    const onInt = () => {
+    };
+    if (deps.forwardSignals) process.on("SIGINT", onInt);
+    for (const [s, h] of handlers) process.on(s, h);
+    let settled = false;
+    const done = (r) => {
+      if (settled) return;
+      settled = true;
+      if (deps.forwardSignals) process.off("SIGINT", onInt);
+      for (const [s, h] of handlers) process.off(s, h);
+      resolve(r);
+    };
+    child.on(
+      "error",
+      (e) => done(
+        e.code === "ENOENT" ? { error: `${command[0]}: command not found.`, code: EXIT_NOT_FOUND2 } : { error: `${command[0]}: ${e.message}.`, code: EXIT_CANNOT_RUN }
+      )
+    );
+    child.on("close", (code, signal) => {
+      if (settled) return;
+      deps.stdout.write(out.end());
+      deps.stderr.write(err.end());
+      done({ code, signal });
+    });
+  });
+}
+
+// cli/vault/program.ts
+var CliError = class extends Error {
+  constructor(message, code = 1) {
+    super(message);
+    this.code = code;
+  }
+  code;
+};
+var secretName = (v) => {
+  if (!SECRET_NAME.test(v)) {
+    throw new InvalidArgumentError(
+      "A secret name is an environment variable name: letters, digits and underscores, not starting with a digit."
+    );
+  }
+  return v;
+};
+var projectId = (v) => {
+  if (!PROJECT_ID.test(v)) {
+    throw new InvalidArgumentError(
+      "A project id is the project\u2019s name in Firstmate: letters, digits, dots, dashes and underscores."
+    );
+  }
+  return v;
+};
+var names = (v, prev = []) => [
+  ...prev,
+  ...v.split(",").map((s) => s.trim()).filter(Boolean).map(secretName)
+];
+var limit = (v) => {
+  const n = Number(v);
+  if (!Number.isInteger(n) || n < 1) throw new InvalidArgumentError("A whole number above 0.");
+  return n;
+};
+function when(iso) {
+  if (!iso) return "never";
+  const d = new Date(iso);
+  if (Number.isNaN(d.getTime())) return iso;
+  const p = (n) => String(n).padStart(2, "0");
+  return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())} ${p(d.getHours())}:${p(d.getMinutes())}`;
+}
+var shellQuote = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
+function columns(rows) {
+  const widths = rows[0].map((_, i) => Math.max(...rows.map((r) => r[i].length)));
+  return rows.map(
+    (r) => r.map((c, i) => c.padEnd(widths[i])).join("  ").trimEnd()
+  ).join("\n");
+}
+function vaultProgram(deps) {
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const out = (line = "") => deps.stdout.write(`${line}
+`);
+  const program = new Command("wh-vault").description(
+    "Secrets for Firstmate\u2019s crew by name, never by value: values stay in the macOS login Keychain, and a project\u2019s granted secrets reach one command at a time."
+  ).version(version).option(
+    "--config-dir <dir>",
+    "the Wheelhouse config directory whose vault folder holds the vault (default: $WHEELHOUSE_CONFIG_DIR, else $XDG_CONFIG_HOME/wheelhouse, else ~/.config/wheelhouse)"
+  ).enablePositionalOptions().showHelpAfterError();
+  program.configureOutput({
+    writeOut: (s) => deps.stdout.write(s),
+    writeErr: (s) => deps.stderr.write(s)
+  });
+  const dirOf = () => {
+    const configDir = program.opts().configDir;
+    return vaultDir(configDir ? path6.resolve(deps.cwd, configDir) : defaultConfigDir(deps.env));
+  };
+  const caller = () => (deps.caller ?? (() => resolveCaller({ env: deps.env, cwd: deps.cwd })))();
+  const task = () => {
+    const t = deps.env.FM_TASK_ID?.trim();
+    return t ? t : null;
+  };
+  const audit = (dir, e) => appendAudit(dir, { at: now().toISOString(), task: task(), ...e });
+  const loadVault = async (dir) => {
+    const vault = await readVault(dir) ?? emptyVault(deps.backend.id);
+    if (vault.backend !== deps.backend.id) {
+      throw new CliError(
+        `this vault keeps its values in the ${vault.backend} backend, which this wh-vault does not have`
+      );
+    }
+    return vault;
+  };
+  const needSecret = (vault, name) => {
+    if (!vault.secrets[name]) {
+      throw new CliError(
+        `there is no secret named ${name}; store it first with \`wh-vault set ${name}\``
+      );
+    }
+  };
+  const messageOf = (e) => e instanceof Error ? e.message : String(e);
+  const act = (fn) => async (...a) => {
+    try {
+      const code = await fn(...a);
+      process.exitCode = code ?? 0;
+    } catch (e) {
+      deps.stderr.write(`wh-vault: ${messageOf(e)}.
+`);
+      process.exitCode = e instanceof CliError ? e.code : 1;
+    }
+  };
+  const store = async (dir, vault, name, value) => {
+    if (!value) throw new CliError(`no value given for ${name}; nothing was stored`);
+    await deps.backend.set(name, value);
+    const at = now().toISOString();
+    const had = vault.secrets[name];
+    vault.secrets[name] = had ? { ...had, updatedAt: at } : { projects: [], createdAt: at, updatedAt: at };
+    return !!had;
+  };
+  program.command("set <name>").description(
+    "Store a value under NAME in the Keychain, typed without echo (or piped on stdin); replaces any value already there."
+  ).action(
+    act(async (name) => {
+      secretName(name);
+      const dir = dirOf();
+      const vault = await loadVault(dir);
+      const value = await deps.readValue(`Value for ${name} (not shown): `);
+      if (value === null) throw new CliError(`no value given for ${name}; nothing was stored`);
+      const replaced = await store(dir, vault, name, value);
+      await writeVault(dir, vault);
+      await audit(dir, { event: "set", names: [name], project: null });
+      out(
+        replaced ? `Replaced the value of ${name}.` : `Stored ${name} in ${deps.backend.where}.`
+      );
+      const projects = vault.secrets[name].projects;
+      out(
+        projects.length ? `Granted to: ${projects.join(", ")}.` : `No project may use it yet. Grant it with: wh-vault grant ${name} <project>`
+      );
+    })
+  );
+  program.command("import <file>").description(
+    "Store every NAME=value line of a .env file in the Keychain, then show how to delete the file."
+  ).action(
+    act(async (file) => {
+      const full = path6.resolve(deps.cwd, file);
+      let text;
+      try {
+        if (!(await stat(full)).isFile()) throw new Error("not a file");
+        text = await readFile4(full, "utf8");
+      } catch (e) {
+        throw new CliError(`cannot read ${file}: ${messageOf(e)}`);
+      }
+      const parsed = parseDotenv(text);
+      const entries = parsed.entries.filter(({ name, line }) => {
+        if (SECRET_NAME.test(name)) return true;
+        deps.stderr.write(
+          `wh-vault: skipped line ${line} of ${file}: a secret name is at most 128 characters.
+`
+        );
+        return false;
+      });
+      const { skipped } = parsed;
+      if (skipped.length) {
+        deps.stderr.write(
+          `wh-vault: skipped line${skipped.length === 1 ? "" : "s"} ${skipped.join(", ")} of ${file}: not a NAME=value line.
+`
+        );
+      }
+      if (!entries.length) throw new CliError(`${file} has no NAME=value lines to import`);
+      const dir = dirOf();
+      const vault = await loadVault(dir);
+      const stored = [];
+      const replaced = [];
+      let failure = null;
+      for (const { name, value } of entries) {
+        if (!value) {
+          deps.stderr.write(`wh-vault: ${name} is empty in ${file}; not stored.
+`);
+          continue;
+        }
+        try {
+          (await store(dir, vault, name, value) ? replaced : stored).push(name);
+        } catch (e) {
+          failure = e;
+          break;
+        }
+      }
+      const done = [...stored, ...replaced];
+      if (done.length) {
+        await writeVault(dir, vault);
+        await audit(dir, { event: "set", names: done, project: null });
+      }
+      if (stored.length) out(`Stored in ${deps.backend.where}: ${stored.join(", ")}.`);
+      if (replaced.length) out(`Replaced: ${replaced.join(", ")}.`);
+      if (failure) throw failure;
+      out(
+        `Check them with \`wh-vault list --all\`, then delete the file: rm ${shellQuote(full)}`
+      );
+      out("Grant each to the projects that need it: wh-vault grant NAME <project>");
+    })
+  );
+  program.command("list").description(
+    "The secret names granted to this project (a Firstmate task\u2019s, else the origin remote\u2019s), or with --all every secret and its grants. Never values."
+  ).option(
+    "--all",
+    "every secret, with the projects it is granted to and when it was set and used"
+  ).option("--json", "machine-readable output").action(
+    act(async (o) => {
+      const dir = dirOf();
+      const vault = await readVault(dir);
+      if (o.all) {
+        const used = await lastUsed(dir);
+        const secrets = Object.entries(vault?.secrets ?? {}).sort(([a], [b]) => a.localeCompare(b)).map(([name, s]) => ({ name, ...s, lastUsedAt: used.get(name) ?? null }));
+        if (o.json) {
+          out(
+            JSON.stringify({
+              schema: "wh-vault.list.v1",
+              initialized: vault !== null,
+              backend: vault?.backend ?? deps.backend.id,
+              secrets
+            })
+          );
+          return;
+        }
+        if (!secrets.length) {
+          out("The vault is empty. Store a secret with: wh-vault set NAME");
+          return;
+        }
+        out(
+          columns([
+            ["NAME", "PROJECTS", "SET", "LAST USED"],
+            ...secrets.map((s) => [
+              s.name,
+              s.projects.join(",") || "-",
+              when(s.updatedAt),
+              when(s.lastUsedAt)
+            ])
+          ])
+        );
+        return;
+      }
+      const c = await caller();
+      const granted = c.project && vault ? grantedTo(vault, c.project) : [];
+      if (o.json) {
+        out(JSON.stringify({ schema: "wh-vault.list.v1", ...c, names: granted }));
+        return;
+      }
+      if (!c.project) {
+        out(
+          "wh-vault cannot tell which project this is: there is no Firstmate task record (FM_TASK_ID) and no origin remote here. `wh-vault list --all` shows every secret."
+        );
+        return;
+      }
+      const from = c.via === "task-record" ? `task ${c.task}` : "the origin remote";
+      if (!granted.length) {
+        out(`No secrets are granted to ${c.project} (from ${from}).`);
+        return;
+      }
+      out(`Secrets granted to ${c.project} (from ${from}):`);
+      for (const n of granted) out(`  ${n}`);
+      out("Use them in one command with: wh-vault run -- <command>");
+    })
+  );
+  const changeGrant = (event) => act(async (name, projects) => {
+    secretName(name);
+    projects.forEach(projectId);
+    const dir = dirOf();
+    const vault = await loadVault(dir);
+    needSecret(vault, name);
+    const s = vault.secrets[name];
+    const set = new Set(s.projects);
+    for (const p of projects) {
+      if (event === "grant") set.add(p);
+      else set.delete(p);
+    }
+    s.projects = [...set].sort();
+    await writeVault(dir, vault);
+    for (const p of projects) await audit(dir, { event, names: [name], project: p });
+    out(
+      s.projects.length ? `${name} is granted to: ${s.projects.join(", ")}.` : `${name} is granted to no project.`
+    );
+  });
+  program.command("grant <name> <projects...>").description("Let commands run for these projects receive NAME.").action(changeGrant("grant"));
+  program.command("revoke <name> <projects...>").description("Stop commands run for these projects receiving NAME.").action(changeGrant("revoke"));
+  program.command("remove <name>").description("Delete NAME\u2019s value from the Keychain and its grants from the vault.").action(
+    act(async (name) => {
+      secretName(name);
+      const dir = dirOf();
+      const vault = await loadVault(dir);
+      needSecret(vault, name);
+      await deps.backend.remove(name);
+      delete vault.secrets[name];
+      await writeVault(dir, vault);
+      await audit(dir, { event: "remove", names: [name], project: null });
+      out(`Removed ${name}.`);
+    })
+  );
+  program.command("run").description(
+    "Run one command with this project\u2019s granted secrets in its environment, hiding their values in its output and logging the use by name."
+  ).argument("<command...>", "the command and its arguments, after --").option(
+    "--only <names>",
+    "hand over only these names (comma-separated, or repeat --only)",
+    names
+  ).passThroughOptions().action(
+    act(async (command, o) => {
+      if (!command.length) throw new CliError("no command given: wh-vault run -- <command>", 2);
+      return runWithSecrets(command, o.only, {
+        backend: deps.backend,
+        dir: dirOf(),
+        caller: await caller(),
+        env: deps.env,
+        cwd: deps.cwd,
+        stdout: deps.stdout,
+        stderr: deps.stderr,
+        now,
+        forwardSignals: deps.forwardSignals
+      });
+    })
+  );
+  program.command("audit").description(
+    "The usage log, newest first: who used which names, when, for what and how it ended. Never values."
+  ).option("--project <id>", "only this project", projectId).option("--task <id>", "only this Firstmate task").option("--name <name>", "only uses of this secret", secretName).option("--event <event>", "only run, set, remove, grant or revoke").option("--limit <n>", "at most this many (default 50)", limit).option("--json", "machine-readable output").action(
+    act(
+      async (o) => {
+        const events = ["run", "set", "remove", "grant", "revoke"];
+        if (o.event !== void 0 && !events.includes(o.event)) {
+          throw new CliError(`--event takes ${events.join(", ")}`, 2);
+        }
+        const entries = await readAudit(dirOf(), {
+          project: o.project,
+          task: o.task,
+          name: o.name,
+          event: o.event,
+          limit: o.limit ?? 50
+        });
+        if (o.json) {
+          out(JSON.stringify({ schema: "wh-vault.audit.v1", entries }));
+          return;
+        }
+        if (!entries.length) {
+          out("Nothing logged yet.");
+          return;
+        }
+        out(
+          columns([
+            ["WHEN", "EVENT", "PROJECT", "TASK", "NAMES", "PROGRAM", "RESULT"],
+            ...entries.map((e) => [
+              when(e.at),
+              e.event,
+              e.project ?? "-",
+              e.task ?? "-",
+              e.names.join(",") || "-",
+              e.program ?? "-",
+              result(e)
+            ])
+          ])
+        );
+      }
+    )
+  );
+  return program;
+}
+function result(e) {
+  if (e.event !== "run") return "done";
+  if (e.outcome === "ok") return e.signal ? `ok (${e.signal})` : `ok (exit ${e.exit ?? "?"})`;
+  return e.outcome ?? "-";
+}
+
+// cli/vault/prompt.ts
+function readHidden(prompt, input = process.stdin, output = process.stderr) {
+  return new Promise((resolve) => {
+    output.write(prompt);
+    const wasRaw = input.isRaw;
+    input.setRawMode(true);
+    input.resume();
+    let value = "";
+    const finish = (v) => {
+      input.off("data", onData);
+      input.setRawMode(wasRaw);
+      input.pause();
+      output.write("\n");
+      resolve(v);
+    };
+    const onData = (chunk) => {
+      const text = chunk.toString("utf8").replace(/\x1b\[[0-9;?]*[A-Za-z~]/g, "");
+      for (const ch of text) {
+        if (ch === "\r" || ch === "\n") return finish(value);
+        if (ch === "") return finish(null);
+        if (ch === "") return finish(value || null);
+        if (ch === "\x7F" || ch === "\b") value = [...value].slice(0, -1).join("");
+        else if (ch === "") value = "";
+        else if (ch >= " " || ch === "	") value += ch;
+      }
+    };
+    input.on("data", onData);
+  });
+}
+async function readStdin(input = process.stdin) {
+  const chunks = [];
+  for await (const c of input) chunks.push(typeof c === "string" ? Buffer.from(c) : c);
+  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+}
+
+// cli/vault/index.ts
+await vaultProgram({
+  backend: new KeychainBackend(),
+  env: process.env,
+  cwd: process.cwd(),
+  stdout: process.stdout,
+  stderr: process.stderr,
+  readValue: async (prompt) => {
+    if (process.stdin.isTTY) return readHidden(prompt);
+    const value = await readStdin();
+    return value || null;
+  },
+  forwardSignals: true
+}).parseAsync(process.argv);