@coffre/cli 0.0.0 → 0.1.0

package/dist/main.js

@@ -0,0 +1,1647 @@
+#!/usr/bin/env node
+import { parseArgs, promisify } from "node:util";
+import { execFile, spawn } from "node:child_process";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { homedir, hostname } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+//#region src/init.ts
+const KINDS = ["workers", "node"];
+/** Where a template lives: in the package when published, else in the repository. */
+function templateDir(kind) {
+	const packed = fileURLToPath(new URL(`./templates/${kind}/`, import.meta.url));
+	if (existsSync(packed)) return packed;
+	return fileURLToPath(new URL(`../../../examples/${kind}/`, import.meta.url));
+}
+/**
+* A template's files, relative and sorted: everything but what its own
+* `.gitignore` names, such as installed packages, local state and secrets.
+* Patterns are file or directory names, `*` standing for any run of
+* characters.
+*/
+function templateFiles(dir) {
+	const ignoreFile = [join(dir, ".gitignore"), join(dir, "gitignore")].find((path) => existsSync(path));
+	const ignored = (ignoreFile === void 0 ? "" : readFileSync(ignoreFile, "utf8")).split("\n").map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("#")).map((glob) => new RegExp(`^${glob.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`));
+	const files = [];
+	const walk = (relative) => {
+		for (const entry of readdirSync(join(dir, relative), { withFileTypes: true })) {
+			if (ignored.some((pattern) => pattern.test(entry.name))) continue;
+			const path = relative === "" ? entry.name : `${relative}/${entry.name}`;
+			if (entry.isDirectory()) walk(path);
+			else files.push(path);
+		}
+	};
+	walk("");
+	return files.sort();
+}
+/** The name a template file has in a project. */
+function projectPath(templatePath) {
+	return templatePath === "gitignore" ? ".gitignore" : templatePath;
+}
+/** A package name from a directory's, e.g. `Acme Secrets` → `acme-secrets`. */
+function packageName(dir) {
+	const name = basename(dir).toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[-._]+|-+$/g, "");
+	return name === "" ? "coffre" : name;
+}
+/** The template's package.json, for this project and this version of coffre. */
+function manifest(source, name, version) {
+	const pkg = JSON.parse(source);
+	pkg.name = name;
+	for (const field of ["dependencies", "devDependencies"]) {
+		const deps = pkg[field];
+		for (const dep of Object.keys(deps ?? {})) if (dep.startsWith("@coffre/")) deps[dep] = version;
+	}
+	return `${JSON.stringify(pkg, null, 2)}\n`;
+}
+/** Write a new deployment into `target`, which must be empty or absent. Returns the files written. */
+function init(kind, target, version) {
+	if (existsSync(target) && readdirSync(target).length > 0) throw new Error(`${target} is not empty; give \`coffre init\` a new directory`);
+	const source = templateDir(kind);
+	const written = [];
+	for (const file of templateFiles(source)) {
+		const path = projectPath(file);
+		const content = readFileSync(join(source, file), "utf8");
+		mkdirSync(dirname(join(target, path)), { recursive: true });
+		writeFileSync(join(target, path), path === "package.json" ? manifest(content, packageName(target), version) : content);
+		written.push(path);
+	}
+	return written;
+}
+//#endregion
+//#region src/instance.ts
+const MODES = ["signin", "cloudflare"];
+function emptyStore() {
+	return {
+		version: 2,
+		current: null,
+		instances: {}
+	};
+}
+/**
+* Read the credentials file. Anything unrecognised, including the single-token
+* file older CLIs wrote, reads as empty: the worst case is one extra login,
+* never a token sent to the wrong place.
+*/
+function parseStore(text) {
+	let raw;
+	try {
+		raw = JSON.parse(text);
+	} catch {
+		return emptyStore();
+	}
+	if (typeof raw !== "object" || raw === null) return emptyStore();
+	const candidate = raw;
+	if (candidate.version !== 2 || typeof candidate.instances !== "object" || candidate.instances === null) return emptyStore();
+	const instances = {};
+	for (const [origin, session] of Object.entries(candidate.instances)) if (typeof session === "object" && session !== null && MODES.includes(session.mode)) instances[origin] = session;
+	return {
+		version: 2,
+		current: typeof candidate.current === "string" && candidate.current in instances ? candidate.current : null,
+		instances
+	};
+}
+function parseMode(raw) {
+	const value = raw?.trim();
+	if (value === void 0 || value === "") return void 0;
+	if (!MODES.includes(value)) throw new Error(`COFFRE_AUTH_MODE must be one of ${MODES.join(", ")}, not "${value}"`);
+	return value;
+}
+function isLoopback(hostname) {
+	return hostname === "localhost" || hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(hostname);
+}
+/**
+* Normalise what someone typed into an origin the CLI will send credentials
+* to. Plain HTTP is refused except on this machine, where there is no wire to
+* listen on. A bare host name means HTTPS, or HTTP for this machine:
+* `coffre.example.com` and `127.0.0.1:3000` both do what they look like.
+*/
+function instanceOrigin(raw) {
+	const value = raw.trim();
+	const invalid = () => /* @__PURE__ */ new Error(`"${raw}" is not a coffre address; expected something like https://coffre.example.com`);
+	let url;
+	try {
+		if (/^[a-z][a-z0-9+.-]*:\/\//i.test(value)) url = new URL(value);
+		else {
+			url = new URL(`https://${value}`);
+			if (isLoopback(url.hostname)) url.protocol = "http:";
+		}
+	} catch {
+		throw invalid();
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:") throw invalid();
+	if (url.username !== "" || url.password !== "") throw new Error("the coffre address must not contain a user name or password");
+	if (url.pathname !== "/" && url.pathname !== "" || url.search !== "" || url.hash !== "") throw new Error(`the coffre address must be an origin, like ${url.origin}, without a path`);
+	if (url.protocol === "http:" && !isLoopback(url.hostname)) throw new Error(`refusing to send credentials over plain HTTP; use https://${url.host}`);
+	return url.origin;
+}
+function isJsonContentType(value) {
+	if (value === null) return false;
+	const mediaType = value.split(";", 1)[0].trim().toLowerCase();
+	return mediaType === "application/json" || mediaType.endsWith("+json");
+}
+/**
+* How to sign in somewhere, from its answer to `GET /api/auth` without a
+* credential. coffre says how it signs people in. Cloudflare Access, in front
+* of it, turns the CLI away first, with a redirect to its own login page:
+*
+*   200 { signin: { providers: […] }, access: null }   → a device login
+*   200 { signin: null, access: { … } }                 → cloudflared
+*   302 Location: https://acme.cloudflareaccess.com/…   → cloudflared
+*/
+function loginMode(origin, status, body) {
+	if (status >= 300 && status < 400) return "cloudflare";
+	const auth = status === 200 && typeof body === "object" && body !== null ? body : null;
+	if (auth?.signin) return "signin";
+	if (auth?.access) return "cloudflare";
+	if (status === 401 || status === 403) throw new Error(`${origin} turned the CLI away (status ${status}). If it is behind Cloudflare Access,\n  run \`COFFRE_AUTH_MODE=cloudflare coffre login ${origin}\``);
+	throw new Error(`${origin} does not look like coffre: GET /api/auth answered ${status}`);
+}
+/**
+* Decide where the next request goes and what it carries, or explain why it
+* cannot be sent. Pure, so every precedence rule is testable.
+*/
+function resolveTarget(env, store, now = /* @__PURE__ */ new Date()) {
+	const explicitMode = parseMode(env.COFFRE_AUTH_MODE);
+	const requested = env.COFFRE_API_URL?.trim() || store.current;
+	if (!requested) throw new Error("not signed in anywhere yet: run `coffre login <url>`");
+	const session = lookupSession(store, requested);
+	const accessClientId = env.COFFRE_ACCESS_CLIENT_ID?.trim();
+	const mode = explicitMode ?? session?.mode ?? (accessClientId ? "cloudflare" : "signin");
+	const origin = instanceOrigin(requested);
+	const token = env.COFFRE_TOKEN?.trim();
+	if (token) return {
+		origin,
+		mode,
+		credential: {
+			kind: "token",
+			token
+		}
+	};
+	if (mode === "cloudflare" && accessClientId) {
+		const clientSecret = env.COFFRE_ACCESS_CLIENT_SECRET?.trim();
+		if (!clientSecret) throw new Error("COFFRE_ACCESS_CLIENT_ID is set but COFFRE_ACCESS_CLIENT_SECRET is not");
+		return {
+			origin,
+			mode,
+			credential: {
+				kind: "access-service-token",
+				clientId: accessClientId,
+				clientSecret
+			}
+		};
+	}
+	const stored = store.instances[origin];
+	if (stored === void 0 || stored.mode !== mode) throw new Error(`not signed in to ${origin}: run \`coffre login ${origin}\``);
+	if (mode === "cloudflare") return {
+		origin,
+		mode,
+		credential: { kind: "cloudflared" }
+	};
+	if (!stored.token) throw new Error(`not signed in to ${origin}: run \`coffre login ${origin}\``);
+	if (stored.expiresAt && Date.parse(stored.expiresAt) <= now.getTime()) throw new Error(`your session on ${origin} ended on ${stored.expiresAt.slice(0, 10)}: run \`coffre login ${origin}\``);
+	return {
+		origin,
+		mode,
+		credential: {
+			kind: "token",
+			token: stored.token
+		}
+	};
+}
+/** The stored session for an address, however it was typed. */
+function lookupSession(store, requested) {
+	try {
+		return store.instances[instanceOrigin(requested)];
+	} catch {
+		return;
+	}
+}
+/**
+* The headers that carry a credential, per mode. coffre's own sign-in takes a
+* standard bearer token. Cloudflare Access takes its user token, or a service
+* token's id and secret, at the edge, and hands coffre its own assertion.
+*/
+function credentialHeaders(mode, credential, cloudflaredToken) {
+	switch (credential.kind) {
+		case "access-service-token": return {
+			"cf-access-client-id": credential.clientId,
+			"cf-access-client-secret": credential.clientSecret
+		};
+		case "cloudflared":
+			if (!cloudflaredToken) throw new Error("cloudflared did not return a token");
+			return { "cf-access-token": cloudflaredToken };
+		case "token": return mode === "cloudflare" ? { "cf-access-token": credential.token } : { authorization: `Bearer ${credential.token}` };
+	}
+}
+function withSession(store, origin, session) {
+	return {
+		version: 2,
+		current: origin,
+		instances: {
+			...store.instances,
+			[origin]: session
+		}
+	};
+}
+function withoutSession(store, origin) {
+	const { [origin]: _removed, ...instances } = store.instances;
+	return {
+		version: 2,
+		current: store.current === origin ? Object.keys(instances)[0] ?? null : store.current,
+		instances
+	};
+}
+//#endregion
+//#region ../client/dist/index.js
+/**
+* The config from `name=value` arguments, as the CLI takes them. A field with
+* several options takes them comma-separated, and one left out gets what the
+* form preselects. Text goes as typed, for the server to check.
+*/
+function configFromArguments(provider, assignments) {
+	const config = {};
+	for (const assignment of assignments) {
+		const equals = assignment.indexOf("=");
+		const name = equals === -1 ? assignment : assignment.slice(0, equals);
+		const field = provider.fields.find((candidate) => candidate.name === name);
+		if (equals === -1 || field === void 0) {
+			const names = provider.fields.map((candidate) => candidate.name).join(", ");
+			throw new Error(`${provider.label} takes ${names} as name=value; got ${JSON.stringify(assignment)}`);
+		}
+		if (Object.hasOwn(config, name)) throw new Error(`${name} is given twice`);
+		const value = assignment.slice(equals + 1);
+		if (field.type === "text") config[name] = value;
+		else if (field.multiple) config[name] = value.split(",").map((item) => item.trim()).filter((item) => item !== "");
+		else config[name] = value;
+	}
+	for (const field of provider.fields) if (field.type === "options" && !Object.hasOwn(config, field.name)) config[field.name] = field.multiple ? field.initial : field.initial[0];
+	return config;
+}
+/** The API's error shape, `{ error, message }`, with the HTTP status. */
+const COFFRE_ERROR = Symbol.for("@coffre/client:CoffreError");
+var CoffreError = class extends Error {
+	/**
+	* `@coffre/ui`'s prebuilt pages bundle a copy of this class, and a page is
+	* handed a client the server made with this package's. So `instanceof`
+	* asks for the mark every copy leaves, rather than for this copy's prototype.
+	*/
+	static [Symbol.hasInstance](value) {
+		return typeof value === "object" && value !== null && COFFRE_ERROR in value;
+	}
+	[COFFRE_ERROR] = true;
+	status;
+	code;
+	/** The vault's own code when it refused: `no_grant`, `removed`, `bulk_limit`, ... */
+	reason;
+	constructor(status, code, message, reason) {
+		super(message);
+		this.name = "CoffreError";
+		this.status = status;
+		this.code = code;
+		this.reason = reason;
+	}
+};
+/** `market/prod/KEY` as route parameters. */
+function place(path) {
+	const [project = "", environment = "", key = ""] = path.replace(/^\/+|\/+$/g, "").split("/");
+	return {
+		project,
+		environment,
+		key
+	};
+}
+function createClient(options) {
+	const origin = options.url.replace(/\/+$/, "");
+	const transport = options.transport ?? ((request) => fetch(request));
+	async function send(method, path, input) {
+		const url = new URL(`${origin}/api${path}`);
+		const headers = new Headers(await options.headers?.());
+		let body;
+		if (method === "GET") {
+			for (const [name, value] of Object.entries(input ?? {})) if (value !== void 0 && value !== null) url.searchParams.set(name, String(value));
+		} else if (input !== void 0) {
+			headers.set("content-type", "application/json");
+			body = JSON.stringify(input);
+		}
+		const response = await transport(new Request(url, {
+			method,
+			headers,
+			body
+		}));
+		const payload = await response.json().catch(() => null);
+		if (!response.ok) {
+			const error = payload;
+			throw new CoffreError(response.status, typeof error?.error === "string" ? error.error : "http_error", typeof error?.message === "string" ? error.message : `request failed with status ${response.status}`, typeof error?.reason === "string" ? error.reason : void 0);
+		}
+		return payload;
+	}
+	/** A route key and its parameters as a method and a path. */
+	function address(key, params) {
+		const [method, pattern] = key.split(" ");
+		return [method, pattern.replace(/:(\w+)/g, (_, name) => encodeURIComponent(params[name]))];
+	}
+	/** Any route by its key: `call('GET /secrets/:project/:environment', { project, environment })`. */
+	async function call(key, ...[params, input]) {
+		const [method, path] = address(key, params);
+		return await send(method, path, input);
+	}
+	return {
+		call,
+		/** How this instance signs people in. Answers anyone, signed in or not. */
+		auth: () => send("GET", "/auth", void 0),
+		/** Who I am, and every place I can reach. */
+		me: () => call("GET /me", {}),
+		projects: {
+			/** With their environments. */
+			list: () => call("GET /projects", {}),
+			create: (project, input) => call("PUT /projects/:project", { project }, input),
+			update: (project, patch) => call("PATCH /projects/:project", { project }, patch)
+		},
+		environments: {
+			create: (path, input) => call("PUT /projects/:project/:environment", place(path), input),
+			update: (path, patch) => call("PATCH /projects/:project/:environment", place(path), patch)
+		},
+		secrets: {
+			/** Keys, versions and who changed what; never values. */
+			list: (path) => call("GET /secrets/:project/:environment", place(path)),
+			/** Decrypts one secret, or every secret in an environment. Logged in your name. */
+			reveal: (path) => call("POST /reveals", {}, { path }),
+			/** One transaction, a version and an audit entry per key; `null` archives. */
+			set: (path, values) => call("PATCH /secrets/:project/:environment", place(path), values),
+			/**
+			* What `set` would do to each key, `added`, `changed`, `unchanged` or
+			* `archived`, and nothing else: no value comes back and nothing is
+			* written. Comparing opens the current values, logged as reads.
+			*/
+			dryRun: (path, values) => {
+				const [method, route] = address("PATCH /secrets/:project/:environment", place(path));
+				return send(method, `${route}?dryRun=1`, values);
+			},
+			history: (path) => call("GET /secrets/:project/:environment/:key/versions", place(path)),
+			/** A new version holding the old one's value. */
+			restore: (path, version) => call("POST /secrets/:project/:environment/:key/restore", place(path), { version }),
+			rename: (path, key) => call("PATCH /secrets/:project/:environment/:key", place(path), { key }),
+			update: (path, patch) => call("PATCH /secrets/:project/:environment/:key", place(path), patch)
+		},
+		members: {
+			/** People and tokens, their role and their access; at a place, those who reach it. */
+			list: (path) => call("GET /members", {}, { path }),
+			/** What they hold, and what to rotate if they leave. */
+			get: (member) => call("GET /members/:member", { member }),
+			add: (member, input = {}) => call("PUT /members/:member", { member }, input),
+			/** Offboards; returns what to rotate. */
+			remove: (member) => call("DELETE /members/:member", { member })
+		},
+		tokens: {
+			list: (member) => call("GET /members/:member/tokens", { member }),
+			/** The value is in the answer, and only there. */
+			issue: (member, input) => call("POST /members/:member/tokens", { member }, input),
+			revoke: (member, id) => call("DELETE /members/:member/tokens/:id", {
+				member,
+				id
+			})
+		},
+		access: { 
+		/** What they should hold at each place; the server applies the difference. `null` revokes. */
+set: (member, access) => call("PATCH /access/:member", { member }, access) },
+		/** Where I am signed in. Only where coffre runs its own sign-in. */
+		sessions: {
+			list: () => call("GET /sessions", {}),
+			revoke: (id) => call("DELETE /sessions/:id", { id })
+		},
+		/** The accounts I sign in with. */
+		identities: {
+			list: () => call("GET /identities", {}),
+			unlink: (id) => call("DELETE /identities/:id", { id })
+		},
+		/** A `coffre login` waiting for someone to approve it, by the code it shows. */
+		deviceLogins: {
+			get: (code) => call("GET /device-logins/:code", { code }),
+			decide: (code, approve) => call("POST /device-logins/:code", { code }, { approve })
+		},
+		syncs: {
+			/** Where a sync can push on this instance, and what each asks for. */
+			providers: () => call("GET /syncs/providers", {}),
+			list: (path) => call("GET /syncs/:project/:environment", place(path)),
+			add: (path, input) => call("POST /syncs/:project/:environment", place(path), input),
+			update: (id, patch) => call("PATCH /syncs/by-id/:id", { id }, patch),
+			remove: (id) => call("DELETE /syncs/by-id/:id", { id }),
+			run: (id) => call("POST /syncs/by-id/:id/runs", { id })
+		},
+		audit: {
+			list: (query = {}) => call("GET /audit", {}, query),
+			verify: () => call("GET /audit/verification", {})
+		}
+	};
+}
+/**
+* What writing these entries (a parsed `.env` file) would do, from a dry run
+* of the write: the server compares, so no value leaves it, and the values it
+* opens to compare are logged as reads. `changes` is what to pass to
+* `secrets.set`: the keys that differ, so an unchanged value does not become
+* a new version.
+*/
+async function planImport(coffre, path, entries) {
+	const values = Object.create(null);
+	for (const { key, value } of entries) values[key] = value;
+	const [listed, compared] = await Promise.allSettled([coffre.secrets.list(path), coffre.secrets.dryRun(path, { ...values })]);
+	if (listed.status === "rejected") throw listed.reason;
+	if (compared.status === "rejected") throw compared.reason;
+	const [{ keys }, dryRun] = [listed.value, compared.value];
+	const versions = new Map(keys.map((entry) => [entry.key, entry.version]));
+	const plan = [];
+	const changes = Object.create(null);
+	for (const [key, value] of Object.entries(values)) {
+		const action = dryRun.keys[key];
+		plan.push({
+			key,
+			action,
+			version: versions.get(key) ?? null
+		});
+		if (action !== "unchanged") changes[key] = value;
+	}
+	return {
+		plan,
+		changes: { ...changes }
+	};
+}
+//#endregion
+//#region ../core/dist/access.js
+/**
+* Who may do what: seven permissions and the six roles that bundle them.
+*
+* Deliberately constants and not tables or a policy language. A grant names
+* one role for one member on one place, and a check is a lookup in this file,
+* so authorisation stays something you can read end to end.
+*/
+const PERMISSIONS = [
+	"secret.read",
+	"secret.write",
+	"secret.archive",
+	"audit.read",
+	"environment.manage",
+	"grant.manage",
+	"project.manage"
+];
+/**
+* Permissions that only make sense on a project. Granting
+* `environment.manage` on one environment would be incoherent: what it
+* authorises is creating that environment's siblings.
+*/
+const PROJECT_ONLY_PERMISSIONS = [
+	"environment.manage",
+	"grant.manage",
+	"project.manage"
+];
+const ROLES = {
+	viewer: {
+		name: "Viewer",
+		description: "Read secret values.",
+		permissions: ["secret.read"]
+	},
+	developer: {
+		name: "Developer",
+		description: "Read and write secrets.",
+		permissions: ["secret.read", "secret.write"]
+	},
+	maintainer: {
+		name: "Maintainer",
+		description: "Read, write and retire secrets, and manage environments.",
+		permissions: [
+			"secret.read",
+			"secret.write",
+			"secret.archive",
+			"environment.manage"
+		]
+	},
+	"access-manager": {
+		name: "Access manager",
+		description: "Manage who has access. Cannot read secret values.",
+		permissions: ["grant.manage"]
+	},
+	auditor: {
+		name: "Auditor",
+		description: "Read the audit log. Cannot read secret values.",
+		permissions: ["audit.read"]
+	},
+	owner: {
+		name: "Owner",
+		description: "Everything, including reading secret values.",
+		permissions: [...PERMISSIONS]
+	}
+};
+Object.keys(ROLES);
+function isRole(value) {
+	return Object.hasOwn(ROLES, value);
+}
+/** Roles that hold a project-only permission can only be granted on a project. */
+function assignableToEnvironment(role) {
+	return !ROLES[role].permissions.some((permission) => PROJECT_ONLY_PERMISSIONS.includes(permission));
+}
+//#endregion
+//#region ../core/dist/dotenv.js
+const KEY_RE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+function parseDotenv(input) {
+	const entries = [];
+	const problems = [];
+	const seen = /* @__PURE__ */ new Set();
+	const lines = input.split(/\r\n|\n|\r/);
+	for (let index = 0; index < lines.length; index++) {
+		const lineNumber = index + 1;
+		const trimmed = lines[index].trim();
+		if (trimmed === "" || trimmed.startsWith("#")) continue;
+		const withoutExport = trimmed.startsWith("export ") ? trimmed.slice(7).trim() : trimmed;
+		const equals = withoutExport.indexOf("=");
+		if (equals === -1) {
+			problems.push({
+				line: lineNumber,
+				text: trimmed,
+				reason: "no \"=\" on this line"
+			});
+			continue;
+		}
+		const key = withoutExport.slice(0, equals).trim();
+		if (!KEY_RE.test(key)) {
+			problems.push({
+				line: lineNumber,
+				text: key,
+				reason: "key must match ^[A-Za-z_][A-Za-z0-9_]*$"
+			});
+			continue;
+		}
+		let rest = withoutExport.slice(equals + 1).trim();
+		let value;
+		if (rest.startsWith("\"")) {
+			const closing = findClosingQuote(rest, "\"");
+			if (closing === -1) {
+				problems.push({
+					line: lineNumber,
+					text: key,
+					reason: "unterminated double quote (multi-line values are not supported)"
+				});
+				continue;
+			}
+			value = unescapeDoubleQuoted(rest.slice(1, closing));
+			if (trailingIsSignificant(rest.slice(closing + 1))) {
+				problems.push({
+					line: lineNumber,
+					text: key,
+					reason: "unexpected text after the closing quote"
+				});
+				continue;
+			}
+		} else if (rest.startsWith("'")) {
+			const closing = rest.indexOf("'", 1);
+			if (closing === -1) {
+				problems.push({
+					line: lineNumber,
+					text: key,
+					reason: "unterminated single quote (multi-line values are not supported)"
+				});
+				continue;
+			}
+			value = rest.slice(1, closing);
+			if (trailingIsSignificant(rest.slice(closing + 1))) {
+				problems.push({
+					line: lineNumber,
+					text: key,
+					reason: "unexpected text after the closing quote"
+				});
+				continue;
+			}
+		} else {
+			const comment = rest.indexOf(" #");
+			if (comment !== -1) rest = rest.slice(0, comment);
+			value = rest.trim();
+		}
+		if (value.includes("\0")) {
+			problems.push({
+				line: lineNumber,
+				text: key,
+				reason: "value contains a NUL byte, which cannot be passed in an environment"
+			});
+			continue;
+		}
+		if (seen.has(key)) {
+			problems.push({
+				line: lineNumber,
+				text: key,
+				reason: "duplicate key in this file"
+			});
+			continue;
+		}
+		seen.add(key);
+		entries.push({
+			key,
+			value,
+			line: lineNumber
+		});
+	}
+	return {
+		entries,
+		problems
+	};
+}
+/** True when what follows a closing quote is neither whitespace nor a comment. */
+function trailingIsSignificant(rest) {
+	const trimmed = rest.trim();
+	return trimmed !== "" && !trimmed.startsWith("#");
+}
+function findClosingQuote(text, quote) {
+	for (let index = 1; index < text.length; index++) {
+		if (text[index] === "\\") {
+			index++;
+			continue;
+		}
+		if (text[index] === quote) return index;
+	}
+	return -1;
+}
+/**
+* Expand escapes inside a double-quoted value.
+*
+* Deliberately minimal: only the escapes that are necessary. `\n` and `\r`
+* because multi-line values (PEM keys) cannot otherwise be expressed on one
+* line, and `\\` `\"` `\'` because quoting needs them.
+*
+* EVERYTHING ELSE IS PRESERVED VERBATIM, backslash included. The obvious
+* implementation -- returning the character and dropping the backslash for
+* unknown escapes -- silently mangles credentials: `"C:\path\to\file"` came
+* out as `C:path<TAB>ofile`, and `"\d+\w"` as `d+w`. A secrets store that
+* quietly rewrites what you gave it is worse than one that refuses.
+*
+* A value that should contain no interpretation at all belongs in single
+* quotes, which are literal.
+*/
+function unescapeDoubleQuoted(text) {
+	return text.replace(/\\(.)/g, (match, character) => {
+		switch (character) {
+			case "n": return "\n";
+			case "r": return "\r";
+			case "\\":
+			case "\"":
+			case "'": return character;
+			default: return match;
+		}
+	});
+}
+/** Values that read the same unquoted: no spaces, quotes, `#`, `$` or backslashes. */
+const PLAIN_VALUE = /^[A-Za-z0-9_./:@+,=%?-]*$/;
+/**
+* Write entries as a .env file that `parseDotenv` reads back exactly.
+*
+* Plain values stay bare; anything else is single-quoted, which is literal;
+* values holding a quote or a line break are double-quoted with the four
+* escapes the parser knows (`\\`, `\"`, `\n`, `\r`).
+*/
+function formatDotenv(entries) {
+	let out = "";
+	for (const [key, value] of entries) {
+		assertWritable(key, value);
+		out += `${key}=${quoteDotenv(value)}\n`;
+	}
+	return out;
+}
+function assertWritable(key, value) {
+	if (!KEY_RE.test(key)) throw new Error(`${JSON.stringify(key)} is not a valid variable name`);
+	if (value.includes("\0")) throw new Error(`${key} contains a NUL byte`);
+}
+function quoteDotenv(value) {
+	if (PLAIN_VALUE.test(value)) return value;
+	if (!/['\n\r]/.test(value)) return `'${value}'`;
+	return `"${value.replace(/[\\"\n\r]/g, (character) => {
+		switch (character) {
+			case "\n": return "\\n";
+			case "\r": return "\\r";
+			default: return `\\${character}`;
+		}
+	})}"`;
+}
+/**
+* Write entries as POSIX shell `export` statements, for
+* `eval "$(coffre export … --format shell)"`. Single quotes are the only
+* shell quoting with no expansion inside; a single quote itself is written
+* as `'\''`.
+*/
+function formatShellExports(entries) {
+	let out = "";
+	for (const [key, value] of entries) {
+		assertWritable(key, value);
+		out += `export ${key}='${value.replaceAll("'", "'\\''")}'\n`;
+	}
+	return out;
+}
+//#endregion
+//#region src/main.ts
+/**
+* coffre CLI.
+*
+* Deliberately dependency-free: node:util's parseArgs and node:child_process
+* are enough. A tool that handles every credential we own is a poor place to
+* add a transitive dependency tree for argument parsing.
+*/
+const CREDENTIALS_PATH = join(homedir(), ".coffre", "credentials.json");
+process.stdout.on("error", (error) => {
+	if (error.code === "EPIPE") process.exit(0);
+	throw error;
+});
+function readStore() {
+	return existsSync(CREDENTIALS_PATH) ? parseStore(readFileSync(CREDENTIALS_PATH, "utf8")) : emptyStore();
+}
+function writeStore(store) {
+	const directory = dirname(CREDENTIALS_PATH);
+	try {
+		mkdirSync(directory, {
+			recursive: true,
+			mode: 448
+		});
+		if (lstatSync(directory).isSymbolicLink() || existsSync(CREDENTIALS_PATH) && lstatSync(CREDENTIALS_PATH).isSymbolicLink()) throw new Error("a symbolic link is not a credentials path");
+		chmodSync(directory, 448);
+		if ((statSync(directory).mode & 511) !== 448) throw new Error("directory permissions must be 0700");
+		const temporary = join(directory, `.credentials-${crypto.randomUUID()}`);
+		try {
+			writeFileSync(temporary, `${JSON.stringify(store, null, 2)}\n`, {
+				mode: 384,
+				flag: "wx"
+			});
+			chmodSync(temporary, 384);
+			if ((statSync(temporary).mode & 511) !== 384) throw new Error("file permissions must be 0600");
+			renameSync(temporary, CREDENTIALS_PATH);
+		} finally {
+			rmSync(temporary, { force: true });
+		}
+	} catch (error) {
+		fail(`cannot secure credentials at ${CREDENTIALS_PATH}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+function fail(message) {
+	process.stderr.write(`coffre: ${message}\n`);
+	process.exit(1);
+}
+function attempt(step) {
+	try {
+		return step();
+	} catch (error) {
+		fail(error instanceof Error ? error.message : String(error));
+	}
+}
+function target() {
+	return attempt(() => resolveTarget(process.env, readStore()));
+}
+/** cloudflared keeps and refreshes the Access token; ask it each time. */
+async function cloudflaredToken(origin) {
+	try {
+		const { stdout } = await promisify(execFile)("cloudflared", [
+			"access",
+			"token",
+			`-app=${origin}`
+		]);
+		const token = stdout.trim();
+		if (token === "" || token.includes(" ")) throw new Error(stdout);
+		return token;
+	} catch {
+		fail(`could not get a Cloudflare Access token for ${origin}: run \`coffre login ${origin}\``);
+	}
+}
+async function headersFor(to) {
+	const access = to.credential.kind === "cloudflared" ? await cloudflaredToken(to.origin) : void 0;
+	return credentialHeaders(to.mode, to.credential, access);
+}
+/** The API, for one instance. */
+function client(to = target()) {
+	return createClient({
+		url: to.origin,
+		headers: () => headersFor(to),
+		transport: (request) => send(request, to)
+	});
+}
+/** One request; every way it can fail is explained in terms of what to do next. */
+async function send(request, to) {
+	let response;
+	try {
+		response = await fetch(request, { redirect: "manual" });
+	} catch (error) {
+		fail(`could not reach ${to.origin}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const relogin = `run \`coffre login ${to.origin}\``;
+	if (response.status >= 300 && response.status < 400) {
+		if (to.mode === "cloudflare") fail(`Cloudflare Access did not accept your token: ${relogin}`);
+		fail(`${to.origin} redirected to ${response.headers.get("location") ?? "elsewhere"}; is that the right address?`);
+	}
+	if (response.status === 401) fail(`your session on ${to.origin} is missing, expired or revoked: ${relogin}`);
+	const json = isJsonContentType(response.headers.get("content-type"));
+	if (!response.ok) {
+		const body = json ? await response.json().catch(() => ({})) : {};
+		const detail = typeof body.message === "string" && body.message.length > 0 ? body.message : null;
+		if (response.status === 403) fail(`forbidden: ${detail ?? "you do not have a grant for that environment"}`);
+		if (response.status === 404) fail(detail === null ? "not found" : `not found: ${detail}`);
+		const status = `request failed with status ${response.status}`;
+		if (detail !== null) fail(`${status}: ${detail}`);
+		if (typeof body.error === "string" && body.error.length > 0) fail(`${status}: ${body.error}`);
+		fail(status);
+	}
+	if (!json) fail("request returned a non-JSON response");
+	return response;
+}
+/** Parse `project/environment/KEY` or `project/environment`. */
+function parsePath(raw) {
+	const parts = raw.split("/");
+	if (parts.length < 2 || parts.length > 3 || parts.some((part) => part.length === 0)) fail(`expected project/environment[/KEY], got: ${raw}`);
+	return {
+		project: parts[0],
+		environment: parts[1],
+		key: parts[2]
+	};
+}
+function printMe(me) {
+	if (me.environments.length === 0) process.stdout.write("  no environments granted yet\n");
+	for (const entry of me.environments) process.stdout.write(`  ${`${entry.project}/${entry.environment}`.padEnd(24)} ${entry.permissions.join(", ")}\n`);
+}
+/**
+* Sign in to an instance and make it the current one. How depends on who
+* vouches for people there, which the CLI finds out by asking (`loginMode`):
+*
+* - coffre's own sign-in: the CLI shows a code, you approve it in a browser
+*   where you are signed in, and the CLI receives a session token of its own.
+* - Cloudflare Access: the CLI hands over to `cloudflared`, which keeps the
+*   Access token from then on.
+*/
+async function login(args) {
+	const { values, positionals } = parseArgs({
+		args,
+		options: { "no-browser": {
+			type: "boolean",
+			default: false
+		} },
+		allowPositionals: true
+	});
+	const requested = positionals[0] ?? process.env.COFFRE_API_URL ?? readStore().current;
+	if (!requested) fail("usage: coffre login <url>, for example `coffre login https://coffre.example.com`");
+	const origin = attempt(() => instanceOrigin(requested));
+	if ((attempt(() => parseMode(process.env.COFFRE_AUTH_MODE)) ?? await askMode(origin)) === "cloudflare") return accessLogin(origin);
+	let started;
+	try {
+		started = await fetch(`${origin}/api/auth/device`, {
+			method: "POST",
+			redirect: "manual",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ client_label: `coffre CLI on ${hostname()}` })
+		});
+	} catch (error) {
+		fail(`could not reach ${origin}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (started.status === 429) fail("too many sign-in attempts from this address; wait a minute and retry");
+	if (!started.ok || !isJsonContentType(started.headers.get("content-type"))) fail(`${origin} did not start a sign-in (status ${started.status})`);
+	const device = await started.json();
+	process.stderr.write(`\nTo sign in, open\n\n    ${device.verification_uri_complete}\n\nand check that it shows the code  ${device.user_code}\n\n`);
+	if (!values["no-browser"] && process.stderr.isTTY) openBrowser(device.verification_uri_complete);
+	process.stderr.write("Waiting for you to approve it…\n");
+	const session = await pollDevice(origin, device.device_code, device.interval, device.expires_in);
+	const me = await client({
+		origin,
+		mode: "signin",
+		credential: {
+			kind: "token",
+			token: session.access_token
+		}
+	}).me();
+	writeStore(withSession(readStore(), origin, {
+		mode: "signin",
+		token: session.access_token,
+		principal: me.principal,
+		expiresAt: session.expires_at,
+		obtainedAt: (/* @__PURE__ */ new Date()).toISOString()
+	}));
+	process.stdout.write(`Signed in to ${origin} as ${me.principal.id}\n`);
+	printMe(me);
+}
+/** Ask the instance how it signs people in. */
+async function askMode(origin) {
+	let response;
+	try {
+		response = await fetch(`${origin}/api/auth`, {
+			redirect: "manual",
+			headers: { accept: "application/json" }
+		});
+	} catch (error) {
+		fail(`could not reach ${origin}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const body = isJsonContentType(response.headers.get("content-type")) ? await response.json().catch(() => void 0) : void 0;
+	return attempt(() => loginMode(origin, response.status, body));
+}
+async function pollDevice(origin, deviceCode, interval, expiresIn) {
+	const deadline = Date.now() + expiresIn * 1e3;
+	let wait = Math.max(interval, 1) * 1e3;
+	while (Date.now() < deadline) {
+		await new Promise((resolve) => setTimeout(resolve, wait));
+		let response;
+		try {
+			response = await fetch(`${origin}/api/auth/device/token`, {
+				method: "POST",
+				redirect: "manual",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({ device_code: deviceCode })
+			});
+		} catch {
+			continue;
+		}
+		if (response.ok) return await response.json();
+		const { error } = await response.json().catch(() => ({}));
+		if (response.status === 429 || error === "slow_down") {
+			wait += 5e3;
+			continue;
+		}
+		if (error === "authorization_pending") continue;
+		if (error === "access_denied") fail("the sign-in was declined in the browser");
+		if (error === "expired_token") fail("the code expired before it was approved; run `coffre login` again");
+		fail(`sign-in failed: ${error ?? `status ${response.status}`}`);
+	}
+	fail("the code expired before it was approved; run `coffre login` again");
+}
+/** Best effort: on a machine without a desktop the printed link is enough. */
+function openBrowser(url) {
+	const [command, ...args] = process.platform === "darwin" ? ["open", url] : process.platform === "win32" ? [
+		"cmd",
+		"/c",
+		"start",
+		"\"\"",
+		url
+	] : ["xdg-open", url];
+	const child = spawn(command, args, {
+		stdio: "ignore",
+		detached: true
+	});
+	child.on("error", () => {});
+	child.unref();
+}
+async function accessLogin(origin) {
+	process.stderr.write(`${origin} is behind Cloudflare Access; signing in with cloudflared.\n`);
+	const code = await new Promise((resolve) => {
+		const child = spawn("cloudflared", [
+			"access",
+			"login",
+			origin
+		], { stdio: "inherit" });
+		child.on("error", () => resolve(null));
+		child.on("exit", (status) => resolve(status));
+	});
+	if (code === null) fail("this instance uses Cloudflare Access, which needs cloudflared: https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/\n  In CI, set COFFRE_ACCESS_CLIENT_ID and COFFRE_ACCESS_CLIENT_SECRET to an Access service token instead.");
+	if (code !== 0) fail("cloudflared could not sign you in");
+	const me = await client({
+		origin,
+		mode: "cloudflare",
+		credential: { kind: "cloudflared" }
+	}).me();
+	writeStore(withSession(readStore(), origin, {
+		mode: "cloudflare",
+		principal: me.principal,
+		obtainedAt: (/* @__PURE__ */ new Date()).toISOString()
+	}));
+	process.stdout.write(`Signed in to ${origin} as ${me.principal.id}\n`);
+	printMe(me);
+}
+/** End the session on the server, then forget it here. */
+async function logout(args) {
+	const store = readStore();
+	const requested = args[0] ?? process.env.COFFRE_API_URL ?? store.current;
+	if (!requested) fail("not signed in anywhere");
+	const origin = attempt(() => instanceOrigin(requested));
+	const session = store.instances[origin];
+	if (session === void 0) fail(`not signed in to ${origin}`);
+	if (session.mode === "signin" && session.token) {
+		const response = await fetch(`${origin}/api/auth/logout`, {
+			method: "POST",
+			redirect: "manual",
+			headers: {
+				authorization: `Bearer ${session.token}`,
+				"content-type": "application/json"
+			}
+		}).catch(() => null);
+		if (response === null) fail(`could not reach ${origin} to end the session; nothing was changed`);
+		if (!response.ok && response.status !== 401) fail(`${origin} refused to end the session (status ${response.status}); nothing was changed`);
+	}
+	writeStore(withoutSession(store, origin));
+	process.stdout.write(`Signed out of ${origin}\n`);
+	if (session.mode === "cloudflare") process.stdout.write("  cloudflared still holds its Access token until it expires.\n");
+}
+async function whoami() {
+	const to = target();
+	const me = await client(to).me();
+	const session = readStore().instances[to.origin];
+	const via = to.credential.kind === "access-service-token" ? "an Access service token" : process.env.COFFRE_TOKEN ? "COFFRE_TOKEN" : {
+		signin: "coffre sign-in",
+		cloudflare: "Cloudflare Access"
+	}[to.mode];
+	process.stdout.write(`${me.principal.id} (${me.principal.type}) on ${to.origin}, via ${via}\n`);
+	if (!process.env.COFFRE_TOKEN && session?.expiresAt) {
+		const days = Math.round((Date.parse(session.expiresAt) - Date.now()) / 864e5);
+		process.stdout.write(`  session ends ${session.expiresAt.slice(0, 10)} (in ${days} day${days === 1 ? "" : "s"})\n`);
+	}
+	printMe(me);
+}
+/** Switch the current instance, or list them. */
+function use(args) {
+	const store = readStore();
+	if (args[0] === void 0) {
+		const origins = Object.keys(store.instances);
+		if (origins.length === 0) fail("not signed in anywhere yet: run `coffre login <url>`");
+		for (const origin of origins) {
+			const session = store.instances[origin];
+			const marker = origin === store.current ? "*" : " ";
+			process.stdout.write(`${marker} ${origin.padEnd(36)} ${session.principal?.id ?? ""}\n`);
+		}
+		return;
+	}
+	const origin = attempt(() => instanceOrigin(args[0]));
+	if (!(origin in store.instances)) fail(`not signed in to ${origin}: run \`coffre login ${origin}\``);
+	writeStore({
+		...store,
+		current: origin
+	});
+	process.stdout.write(`Now using ${origin}\n`);
+}
+async function get(args) {
+	const target = args[0];
+	if (!target) fail("usage: coffre get <project>/<environment>/<KEY>");
+	const { project, environment, key } = parsePath(target);
+	if (!key) fail("usage: coffre get <project>/<environment>/<KEY>");
+	const { values } = await client().secrets.reveal(`${project}/${environment}/${key}`);
+	process.stdout.write(`${values[key]}\n`);
+}
+async function list(args) {
+	const target = args[0];
+	if (!target) fail("usage: coffre list <project>/<environment>");
+	const { project, environment } = parsePath(target);
+	const result = await client().secrets.list(`${project}/${environment}`);
+	for (const entry of result.keys) {
+		const archived = entry.archived ? "  (archived)" : "";
+		process.stdout.write(`${entry.key}\tv${entry.version ?? "-"}\t${entry.updatedBy ?? "-"}${archived}\n`);
+	}
+}
+async function set(args) {
+	const [target, value] = args;
+	if (!target) fail("usage: coffre set <project>/<environment>/<KEY> [value]");
+	const { project, environment, key } = parsePath(target);
+	if (!key) fail("usage: coffre set <project>/<environment>/<KEY> [value]");
+	const resolved = value ?? readFileSync(0, "utf8").replace(/\n$/, "");
+	const outcome = (await client().secrets.set(`${project}/${environment}`, { [key]: resolved })).keys[key];
+	process.stdout.write(`${key} written as version ${"version" in outcome ? outcome.version : "?"}\n`);
+}
+/**
+* Fetch every secret for an environment and exec a command with them in the
+* environment. One round trip, and one audit row per secret injected.
+*/
+async function run(args) {
+	const separator = args.indexOf("--");
+	if (separator === -1 || separator === args.length - 1) fail("usage: coffre run <project>/<environment> -- <command> [args...]");
+	const target = args.slice(0, separator)[0];
+	if (!target) fail("usage: coffre run <project>/<environment> -- <command> [args...]");
+	const { project, environment } = parsePath(target);
+	const command = args.slice(separator + 1);
+	const { values } = await client().secrets.reveal(`${project}/${environment}`);
+	const child = spawn(command[0], command.slice(1), {
+		env: {
+			...process.env,
+			...values
+		},
+		stdio: "inherit"
+	});
+	child.on("error", (error) => fail(`failed to run ${command[0]}: ${error.message}`));
+	child.on("exit", (code, signal) => {
+		if (signal) process.kill(process.pid, signal);
+		process.exit(code ?? 0);
+	});
+}
+/**
+* Print every secret in an environment, for tools that want a file or a
+* shell rather than a child process. Each value read is one audit row in
+* your name, exactly as with `run`.
+*/
+async function exportEnv(args) {
+	const { values, positionals } = parseArgs({
+		args,
+		options: { format: {
+			type: "string",
+			default: "dotenv"
+		} },
+		allowPositionals: true
+	});
+	const usage = "usage: coffre export <project>/<environment> [--format dotenv|json|shell]";
+	if (!positionals[0]) fail(usage);
+	const format = values.format;
+	if (format !== "dotenv" && format !== "json" && format !== "shell") fail(usage);
+	const { project, environment } = parsePath(positionals[0]);
+	const revealed = await client().secrets.reveal(`${project}/${environment}`);
+	const entries = Object.entries(revealed.values).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+	process.stdout.write(format === "json" ? `${JSON.stringify(Object.fromEntries(entries), null, 2)}\n` : attempt(() => format === "shell" ? formatShellExports(entries) : formatDotenv(entries)));
+	if (process.stderr.isTTY) {
+		const count = entries.length;
+		process.stderr.write(`coffre: read ${count} secret${count === 1 ? "" : "s"} from ${project}/${environment}; each read is in the audit log under your name\n`);
+	}
+}
+async function history(args) {
+	const target = args[0];
+	if (!target) fail("usage: coffre history <project>/<environment>/<KEY>");
+	const { project, environment, key } = parsePath(target);
+	if (!key) fail("usage: coffre history <project>/<environment>/<KEY>");
+	const result = await client().secrets.history(`${project}/${environment}/${key}`);
+	for (const version of result.versions) process.stdout.write(`v${String(version.version).padEnd(4)} ${version.createdAt.slice(0, 19).replace("T", " ")}  ${version.createdBy.padEnd(24)}${version.current ? " (current)" : ""}\n`);
+}
+async function rollback(args) {
+	const [target, version] = args;
+	if (!target || !version) fail("usage: coffre rollback <project>/<environment>/<KEY> <version>");
+	const { project, environment, key } = parsePath(target);
+	if (!key) fail("usage: coffre rollback <project>/<environment>/<KEY> <version>");
+	const wanted = Number(version);
+	if (!Number.isInteger(wanted) || wanted < 1) fail(`"${version}" is not a version number`);
+	await client().secrets.restore(`${project}/${environment}/${key}`, wanted);
+	process.stdout.write(`${key} rolled back to version ${version}\n`);
+}
+/**
+* Import a .env file. Previews by default; --apply writes.
+*
+* The preview is a dry run of the write: the server compares against the
+* current values, logs each one it opens as a read, and sends none back.
+* --apply then writes the keys that differ in one transaction, a new version
+* each.
+*/
+async function importEnv(args) {
+	const { values, positionals } = parseArgs({
+		args,
+		options: {
+			file: { type: "string" },
+			apply: {
+				type: "boolean",
+				default: false
+			}
+		},
+		allowPositionals: true
+	});
+	const target = positionals[0];
+	if (!target) fail("usage: coffre import <project>/<environment> [--file .env] [--apply]");
+	const { project, environment } = parsePath(target);
+	const parsed = parseDotenv(values.file ? readFileSync(values.file, "utf8") : readFileSync(0, "utf8"));
+	for (const problem of parsed.problems) process.stderr.write(`  line ${problem.line}: ${problem.reason} (${problem.text})\n`);
+	if (parsed.entries.length === 0) return;
+	const coffre = client();
+	const path = `${project}/${environment}`;
+	const { plan, changes } = await planImport(coffre, path, parsed.entries);
+	if (values.apply && Object.keys(changes).length > 0) await coffre.secrets.set(path, changes);
+	for (const entry of plan) process.stdout.write(`${entry.action.padEnd(10)} ${entry.key}\n`);
+	if (!values.apply) {
+		const pending = Object.keys(changes).length;
+		process.stdout.write(`\n${pending} change${pending === 1 ? "" : "s"} pending. Re-run with --apply to write.\n`);
+	}
+}
+async function projects() {
+	const result = await client().projects.list();
+	for (const project of result.projects) {
+		const archived = project.archivedAt === null ? "" : " (archived)";
+		process.stdout.write(`${project.slug}${archived}  ${project.name}\n`);
+		for (const environment of project.environments) {
+			if (environment.details?.archivedAt) continue;
+			const count = environment.details?.secretCount;
+			process.stdout.write(`  ${environment.slug.padEnd(16)} ${count === null || count === void 0 ? "" : `${count} secrets`}\n`);
+		}
+	}
+}
+async function whoHasAccess() {
+	const result = await client().members.list();
+	for (const member of result.members) {
+		const root = member.isRootAdmin ? "  [root admin]" : "";
+		const tampered = member.tampered ? "  [record failed its integrity check: remove to start over]" : "";
+		process.stdout.write(`${member.principalId} (${member.principalType})${root}${tampered}\n`);
+		for (const g of member.grants) {
+			const place = g.environment === null ? g.project : `${g.project}/${g.environment}`;
+			const until = g.expiresAt === null ? "" : ` until ${g.expiresAt.slice(0, 10)}`;
+			process.stdout.write(`  ${place.padEnd(24)} ${g.role}${until}\n`);
+		}
+	}
+}
+async function grantAccess(args) {
+	const { values, positionals } = parseArgs({
+		args,
+		options: {
+			role: { type: "string" },
+			env: { type: "string" },
+			service: {
+				type: "boolean",
+				default: false
+			},
+			expires: { type: "string" }
+		},
+		allowPositionals: true
+	});
+	const [project, principalId] = positionals;
+	if (!project || !principalId || !values.role) fail("usage: coffre grant <project> <principal> --role <role> [--env <env>] [--service] [--expires YYYY-MM-DD]");
+	const role = values.role;
+	if (!isRole(role)) fail(`no role "${role}": \`coffre roles\` lists them`);
+	const scope = values.env ? `${project}/${values.env}` : project;
+	await client().access.set(`${values.service ? "token" : "user"}:${principalId}`, { [scope]: values.expires ? {
+		role,
+		until: values.expires
+	} : role });
+	process.stdout.write(`granted ${values.role} on ${scope} to ${principalId}\n`);
+}
+function plural(count, word) {
+	return `${count} ${word}${count === 1 ? "" : "s"}`;
+}
+/** "2 grants, 1 session, 0 linked accounts": what a removal ends. */
+function waysIn(principalType, counts) {
+	return principalType === "user" ? [
+		plural(counts.grants, "grant"),
+		plural(counts.sessions, "session"),
+		plural(counts.identities, "linked account")
+	].join(", ") : [plural(counts.grants, "grant"), plural(counts.tokens, "token")].join(", ");
+}
+/**
+* Offboard someone. Previews by default, like import: what removing them
+* would revoke, and what they leave behind. --apply removes them.
+*
+* Removal takes every way in away at once. What it cannot take back is what
+* they saw, so the report after it is the list of values to rotate.
+*/
+async function offboard(args) {
+	const { values, positionals } = parseArgs({
+		args,
+		options: {
+			service: {
+				type: "boolean",
+				default: false
+			},
+			apply: {
+				type: "boolean",
+				default: false
+			}
+		},
+		allowPositionals: true
+	});
+	const principalId = positionals[0];
+	if (!principalId) fail("usage: coffre offboard <principal> [--service] [--apply]");
+	const member = `${values.service ? "token" : "user"}:${principalId}`;
+	const coffre = client();
+	let report = await coffre.members.get(member);
+	const they = report.principalType === "user" ? "they" : "it";
+	if (report.status === "active" && values.apply) {
+		const removed = await coffre.members.remove(member);
+		process.stdout.write(`removed ${principalId}: revoked ${waysIn(report.principalType, removed.revoked)}\n`);
+		report = removed.report;
+	} else if (report.status === "active") process.stdout.write(`${principalId} is active; removing would revoke ${waysIn(report.principalType, report.live)}\n`);
+	else {
+		const by = report.removedBy === null ? "" : ` by ${report.removedBy}`;
+		const at = report.removedAt === null ? "" : ` on ${report.removedAt.slice(0, 16).replace("T", " ")}`;
+		process.stdout.write(`${principalId} was removed${by}${at}\n`);
+	}
+	const rotated = report.rotated > 0 ? `, ${report.rotated} already rotated` : "";
+	const when = report.status === "active" ? ` once ${they} ${they === "they" ? "leave" : "is retired"}` : "";
+	process.stdout.write(`\nValues ${they} saw that nobody has changed since, to rotate${when} (${report.exposed.length}${rotated})\n`);
+	if (report.exposed.length === 0) process.stdout.write("  none\n");
+	const names = report.exposed.map((entry) => `${entry.project}/${entry.environment}/${entry.key}`);
+	const width = Math.max(0, ...names.map((name) => name.length));
+	report.exposed.forEach((entry, index) => {
+		process.stdout.write(`  ${names[index].padEnd(width)}  v${String(entry.version).padEnd(4)} ${entry.how} ${entry.at.slice(0, 10)}\n`);
+	});
+	if (report.syncs.length > 0) {
+		process.stdout.write(`\nSyncs ${they} set up, which keep pushing\n`);
+		for (const entry of report.syncs) {
+			const paused = entry.paused ? " (paused)" : "";
+			process.stdout.write(`  ${entry.project}/${entry.environment} -> ${entry.providerLabel} ${entry.destination}${paused}\n`);
+		}
+	}
+	if (report.issuedTokens.length > 0) {
+		process.stdout.write(`\nService tokens ${they} issued, which still work\n`);
+		for (const token of report.issuedTokens) {
+			const label = token.label === null ? "" : ` "${token.label}"`;
+			process.stdout.write(`  ${token.service}${label} ${token.hint}, expires ${token.expiresAt.slice(0, 10)}\n`);
+		}
+	}
+	if (report.status === "active" && !values.apply) process.stdout.write(`\nNothing changed. Re-run with --apply to remove ${principalId}.\n`);
+}
+function roles() {
+	for (const [slug, role] of Object.entries(ROLES)) {
+		const scope = assignableToEnvironment(slug) ? "project or env" : "project only";
+		process.stdout.write(`${slug.padEnd(16)} [${scope}]  ${role.permissions.join(", ")}\n`);
+	}
+}
+async function audit(args) {
+	const { values } = parseArgs({
+		args,
+		options: {
+			limit: {
+				type: "string",
+				default: "20"
+			},
+			actor: { type: "string" },
+			denied: {
+				type: "boolean",
+				default: false
+			},
+			detail: {
+				type: "boolean",
+				default: false
+			}
+		},
+		allowPositionals: false
+	});
+	const limit = Number(values.limit);
+	if (!Number.isInteger(limit) || limit < 1) fail(`--limit takes a positive number, not "${values.limit}"`);
+	const result = await client().audit.list({
+		limit,
+		actor: values.actor,
+		decision: values.denied ? "deny" : void 0,
+		detail: values.detail ? "1" : void 0
+	});
+	for (const entry of result.entries.reverse()) {
+		const place = [
+			entry.project,
+			entry.environment,
+			entry.key
+		].filter((part) => part !== null).join("/") || "-";
+		process.stdout.write(`${entry.occurredAt}  ${entry.decision.padEnd(5)}  ${entry.actorId.padEnd(28)}  ${entry.action.padEnd(16)}  ${place}\n`);
+	}
+}
+async function verify() {
+	const result = await client().audit.verify();
+	if (result.ok) {
+		const through = result.through === null ? "empty" : `verified through entry ${result.through}`;
+		const signed = result.checkpoint === null ? "no checkpoint signed yet" : `last checkpoint: entry ${result.checkpoint.seq}, signed ${result.checkpoint.signedAt}`;
+		const pending = result.pending === void 0 ? "" : `${result.pending} key operations still under way\n`;
+		process.stdout.write(`audit log OK: ${through}, ${result.entries} entries; members and grants replayed\n${signed}\n${pending}`);
+		return;
+	}
+	const at = result.failedAtSeq === null ? "" : ` at entry ${result.failedAtSeq}`;
+	const through = result.through === null ? "nothing verified" : `verified through entry ${result.through}`;
+	process.stderr.write(`audit log BROKEN${at}, found by the ${result.author}'s check (${through}): ${result.reason}\n`);
+	process.exit(2);
+}
+const SYNC_USAGE = `usage:
+  coffre sync providers
+  coffre sync list   <project>/<environment>
+  coffre sync add    <project>/<environment> <provider> name=value… --credential <project>/<environment>/<KEY>
+  coffre sync run    <project>/<environment> <sync>
+  coffre sync pause  <project>/<environment> <sync>
+  coffre sync resume <project>/<environment> <sync>
+  coffre sync remove <project>/<environment> <sync>
+
+\`coffre sync providers\` lists where this instance can sync to, and what each
+provider takes. <sync> is the start of an id from \`coffre sync list\`, or the
+provider's id when the environment syncs there only once.
+`;
+/** Where this instance can sync to, one provider to a paragraph. */
+function printProviders(providers) {
+	if (providers.length === 0) {
+		process.stdout.write("This instance offers no sync providers.\n");
+		return;
+	}
+	process.stdout.write("What is in brackets can be left out. A choice left out is what comes\nbefore the first |, and several choices go comma-separated.\n");
+	for (const provider of providers) process.stdout.write(`\n${provider.id}  ${provider.label}\n    ${[...provider.fields.map(fieldUsage), `--credential ${provider.credential.placeholder}`].join(" ")}\n${indented(provider.credential.hint)}\n`);
+}
+/** Prose under a usage line, indented and wrapped to a terminal's 80 columns. */
+function indented(text) {
+	const lines = [];
+	for (const word of text.split(/\s+/)) {
+		const last = lines.length - 1;
+		if (last >= 0 && lines[last].length + 1 + word.length <= 76) lines[last] += ` ${word}`;
+		else lines.push(word);
+	}
+	return lines.map((line) => `    ${line}`).join("\n");
+}
+function fieldUsage(field) {
+	if (field.type === "text") return field.optional ? `[${field.name}=…]` : `${field.name}=…`;
+	const others = field.options.map((option) => option.value).filter((value) => !field.initial.includes(value));
+	return `[${field.name}=${[field.initial.join(","), ...others].join("|")}]`;
+}
+/**
+* Push an environment somewhere else and keep it current. The server does
+* the work and checks every field; this names things and reports back.
+*/
+async function sync(args) {
+	const [verb, path, ...rest] = args;
+	if (verb === "providers") {
+		const { providers } = await client().syncs.providers();
+		printProviders(providers);
+		return;
+	}
+	if (verb === void 0 || verb === "--help" || path === void 0) {
+		process.stdout.write(SYNC_USAGE);
+		process.exit(verb === void 0 || verb === "--help" ? 0 : 1);
+	}
+	const { project, environment, key } = parsePath(path);
+	if (key !== void 0) fail(`syncs belong to an environment: use ${project}/${environment}`);
+	const place = `${project}/${environment}`;
+	const coffre = client();
+	if (verb === "list") {
+		const { syncs } = await coffre.syncs.list(place);
+		if (syncs.length === 0) process.stdout.write(`${project}/${environment} is not synced anywhere\n`);
+		for (const entry of syncs) printSync(entry);
+		return;
+	}
+	if (verb === "add") {
+		const { values, positionals } = parseArgs({
+			args: rest,
+			options: { credential: { type: "string" } },
+			allowPositionals: true
+		});
+		const [id, ...assignments] = positionals;
+		const { providers } = await coffre.syncs.providers();
+		const provider = providers.find((candidate) => candidate.id === id);
+		if (provider === void 0) fail(`name a provider this instance offers (${providers.length === 0 ? "none" : providers.map((candidate) => candidate.id).join(", ")}); \`coffre sync providers\` shows what each takes`);
+		if (values.credential === void 0) fail(`--credential names the secret holding the ${provider.label} token, such as ${provider.credential.placeholder}`);
+		const config = attempt(() => configFromArguments(provider, assignments));
+		const created = await coffre.syncs.add(place, {
+			provider: provider.id,
+			config,
+			credential: values.credential
+		});
+		process.stdout.write(`Syncing ${project}/${environment} to ${created.destination} (${created.providerLabel}), id ${created.id.slice(0, 8)}.\nThe first push has started; \`coffre sync list ${project}/${environment}\` shows how it went.\n`);
+		return;
+	}
+	if (![
+		"run",
+		"pause",
+		"resume",
+		"remove"
+	].includes(verb)) fail(`unknown sync command "${verb}"; see \`coffre sync --help\``);
+	const reference = rest[0];
+	if (reference === void 0) fail(`usage: coffre sync ${verb} ${project}/${environment} <sync>`);
+	const { syncs } = await coffre.syncs.list(place);
+	const chosen = attempt(() => pickSync(syncs, reference));
+	if (verb === "run") {
+		if (chosen.paused) fail(`syncing to ${chosen.destination} is paused; resume it first`);
+		const { sync: after, outcome } = await coffre.syncs.run(chosen.id);
+		if (outcome.status === "busy") fail(`a run to ${chosen.destination} is already under way`);
+		for (const failure of outcome.failed) process.stderr.write(`  could not ${failure.operation === "upsert" ? "push" : "remove"} ${failure.key}: ${failure.message}\n`);
+		if (outcome.status === "failed") fail(`could not sync to ${after.destination}: ${outcome.error ?? "the run failed"}`);
+		const changed = outcome.upserted.length + outcome.deleted.length;
+		process.stdout.write(changed === 0 && outcome.failed.length === 0 ? `${after.destination} was already current\n` : `Pushed ${outcome.upserted.length}, removed ${outcome.deleted.length} at ${after.destination}\n`);
+		if (outcome.status === "partial") process.exit(1);
+		return;
+	}
+	if (verb === "remove") {
+		await coffre.syncs.remove(chosen.id);
+		process.stdout.write(`No longer syncing to ${chosen.destination}. Keys coffre pushed there stay; remove them at ${chosen.providerLabel} if they should go too.\n`);
+		return;
+	}
+	const paused = verb === "pause";
+	await coffre.syncs.update(chosen.id, { paused });
+	process.stdout.write(paused ? `Paused syncing to ${chosen.destination}\n` : `Resumed syncing to ${chosen.destination}; changes since the pause go out on the next run\n`);
+}
+/** By id prefix, or by provider when only one sync here goes there. */
+function pickSync(syncs, reference) {
+	const byProvider = syncs.filter((entry) => entry.provider === reference);
+	if (byProvider.length === 1) return byProvider[0];
+	if (byProvider.length > 1) throw new Error(`more than one ${reference} sync here; name it by id (coffre sync list)`);
+	if (reference.length < 4) throw new Error("give at least 4 characters of a sync id, or a provider id");
+	const byId = syncs.filter((entry) => entry.id.startsWith(reference.toLowerCase()));
+	if (byId.length === 1) return byId[0];
+	if (byId.length > 1) throw new Error(`"${reference}" starts more than one sync id; give more of it`);
+	throw new Error(`no sync "${reference}" here; \`coffre sync list\` shows them`);
+}
+function printSync(entry) {
+	const state = entry.running ? "pushing" : entry.paused ? "paused" : entry.lastStatus === "failed" ? "failed" : entry.lastStatus === "partial" ? "partial" : entry.lastRunAt === null ? "not run yet" : entry.pending > 0 ? "behind" : "in sync";
+	const counts = [`${entry.synced} synced`, ...entry.pending > 0 ? [`${entry.pending} pending`] : []];
+	if (entry.lastRunAt !== null) counts.push(`last run ${entry.lastRunAt.slice(0, 16).replace("T", " ")}`);
+	process.stdout.write(`${entry.id.slice(0, 8)}  ${entry.providerLabel.padEnd(18)} ${entry.destination}\n`);
+	process.stdout.write(`          ${state}: ${counts.join(", ")}; token from ${entry.credential}\n`);
+	if (entry.lastError !== null && !entry.running) process.stdout.write(`          ${entry.lastError}\n`);
+	for (const skipped of entry.skipped) process.stdout.write(`          skips ${skipped.key}: ${skipped.reason}\n`);
+}
+/** `coffre init --workers|--node [<dir>]`: a new deployment of coffre. */
+function initProject(args) {
+	const { values, positionals } = parseArgs({
+		args,
+		options: {
+			workers: { type: "boolean" },
+			node: { type: "boolean" }
+		},
+		allowPositionals: true
+	});
+	const kinds = KINDS.filter((kind) => values[kind]);
+	if (kinds.length !== 1 || positionals.length > 1) fail("usage: coffre init --workers|--node [<dir>]");
+	const kind = kinds[0];
+	const dir = resolve(positionals[0] ?? ".");
+	const { version } = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+	const files = attempt(() => init(kind, dir, version));
+	for (const file of files) process.stdout.write(`  ${file}\n`);
+	const at = dir === process.cwd() ? null : positionals[0] ?? null;
+	process.stdout.write(`\nA ${kind === "workers" ? "Cloudflare Workers" : "Node"} deployment of coffre ${version}${at === null ? " here" : ` in ${at}`}. README.md takes it from there:\n\n${at === null ? "" : `  cd ${/\s/.test(at) ? `'${at}'` : at}\n`}  pnpm install\n`);
+}
+const USAGE = `coffre - secrets, with an audit log
+
+  New deployment
+    coffre init --workers [<dir>]           two Cloudflare Workers: the app and its vault
+    coffre init --node [<dir>]              a Node server, and its vault beside it
+
+  Session
+    coffre login [<url>] [--no-browser]     sign in, and make <url> the current instance
+    coffre logout [<url>]
+    coffre whoami
+    coffre use [<url>]                      list instances, or switch the current one
+
+  Secrets
+    coffre list     <project>/<environment>
+    coffre get      <project>/<environment>/<KEY>
+    coffre set      <project>/<environment>/<KEY> [value]   (reads stdin if omitted)
+    coffre run      <project>/<environment> -- <command>
+    coffre export   <project>/<environment> [--format dotenv|json|shell]
+    coffre history  <project>/<environment>/<KEY>
+    coffre rollback <project>/<environment>/<KEY> <version>
+    coffre import   <project>/<environment> [--file .env] [--apply]
+
+  Access
+    coffre projects
+    coffre roles
+    coffre access
+    coffre grant <project> <principal> --role <role> [--env <env>] [--service]
+                 [--expires YYYY-MM-DD]
+    coffre offboard <principal> [--service] [--apply]
+                                            what removing them revokes, and what to rotate
+
+  Syncs (coffre sync providers for where to, and what each takes)
+    coffre sync list   <project>/<environment>
+    coffre sync add    <project>/<environment> <provider> name=value…
+                       --credential <project>/<environment>/<KEY>
+    coffre sync run|pause|resume|remove <project>/<environment> <sync>
+
+  Audit
+    coffre audit [--limit N] [--actor <id>] [--denied] [--detail]
+    coffre verify
+
+  Environment (each overrides the saved session for one command)
+    COFFRE_API_URL          which instance to talk to
+    COFFRE_TOKEN            a service token (coffre_svc_…), for CI
+    COFFRE_ACCESS_CLIENT_ID, COFFRE_ACCESS_CLIENT_SECRET
+                            a Cloudflare Access service token, for CI
+    COFFRE_AUTH_MODE        signin or cloudflare; normally detected at login
+`;
+const [command, ...rest] = process.argv.slice(2);
+switch (command) {
+	case "init":
+		initProject(rest);
+		break;
+	case "login":
+		await login(rest);
+		break;
+	case "logout":
+		await logout(rest);
+		break;
+	case "whoami":
+		await whoami();
+		break;
+	case "use":
+		use(rest);
+		break;
+	case "export":
+		await exportEnv(rest);
+		break;
+	case "list":
+		await list(rest);
+		break;
+	case "get":
+		await get(rest);
+		break;
+	case "set":
+		await set(rest);
+		break;
+	case "run":
+		await run(rest);
+		break;
+	case "history":
+		await history(rest);
+		break;
+	case "rollback":
+		await rollback(rest);
+		break;
+	case "import":
+		await importEnv(rest);
+		break;
+	case "projects":
+		await projects();
+		break;
+	case "roles":
+		roles();
+		break;
+	case "access":
+		await whoHasAccess();
+		break;
+	case "grant":
+		await grantAccess(rest);
+		break;
+	case "offboard":
+		await offboard(rest);
+		break;
+	case "sync":
+		await sync(rest);
+		break;
+	case "audit":
+		await audit(rest);
+		break;
+	case "verify":
+		await verify();
+		break;
+	default:
+		process.stdout.write(USAGE);
+		process.exit(command === void 0 || command === "--help" ? 0 : 1);
+}
+//#endregion
+export {};