@coffre/cli 0.1.14 → 0.1.15

package/README.md

@@ -2,6 +2,9 @@
 
 The `coffre` command: secrets in your shell, and a new deployment.
 
+The published CLI runs on Node 20 or newer. Developing coffre from its
+TypeScript sources and running a deployment require Node 24.
+
 ```sh
 npx @coffre/cli init --workers my-coffre   # or --node
 npx @coffre/cli setup                      # its database, keys and, on Workers, Cloudflare

package/dist/{deployment-S8za5nUu.js → deployment-Di8BG9qY.js}

@@ -1,4 +1,4 @@
-import { r as isEmpty } from "./init-mO8V087p.js";
+import { r as isEmpty } from "./init-2xGelVG1.js";
 import { spawn } from "node:child_process";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
@@ -1285,7 +1285,10 @@ function install(dir) {
 	return (async () => {
 		const ran = await attempt("pnpm", ["install"]) ?? await attempt("corepack", ["pnpm", "install"]);
 		if (ran === null) throw new Error("pnpm is not installed: corepack enable, or npm install -g pnpm, then run setup again");
-		if (ran.code !== 0) throw new Error(installFailure(ran.output));
+		if (ran.code !== 0) {
+			const held = heldBack(ran.output);
+			throw held.length > 0 ? new HeldBack(held, installFailure(ran.output)) : new Error(installFailure(ran.output));
+		}
 	})();
 }
 /** A deployment's `@coffre/*` pins, as its package.json has them. */
@@ -1306,6 +1309,90 @@ function bumpPins(dir, version) {
 	for (const field of ["dependencies", "devDependencies"]) for (const name of Object.keys(manifest[field] ?? {})) if (name.startsWith("@coffre/")) manifest[field][name] = version;
 	writeFileSync(path, `${JSON.stringify(manifest, null, 2)}\n`);
 }
+/** pnpm install refused packages younger than the deployment's minimumReleaseAge. */
+var HeldBack = class extends Error {
+	held;
+	constructor(held, message) {
+		super(message);
+		this.held = held;
+	}
+};
+/** The packages pnpm held back, as its error names them. */
+function heldBack(output) {
+	if (!output.includes("MINIMUM_RELEASE_AGE")) return [];
+	return [...output.matchAll(/^\s*(\S+@\d\S*) was published at (\S+?),?\s/gm)].map((match) => ({
+		spec: match[1],
+		publishedAt: new Date(match[2])
+	}));
+}
+/** The deployment's minimumReleaseAge, in minutes, as its pnpm-workspace.yaml sets it; pnpm's own default, none, without one. */
+function minimumReleaseAge(dir) {
+	const path = join(dir, "pnpm-workspace.yaml");
+	const match = existsSync(path) ? /^minimumReleaseAge:\s*(\d+)/m.exec(readFileSync(path, "utf8")) : null;
+	return match === null ? 0 : Number(match[1]);
+}
+/** How every temporary exclusion `coffre update` writes ends: with when it lapses. */
+const EXCLUDED = /^\s*- '([^']+)' # coffre update: until (\S+)/;
+/**
+* Exclude `held` from minimumReleaseAge, each until it clears, named in the
+* deployment's pnpm-workspace.yaml with that date: never silently, and
+* removed by `removeCleared` once the date has passed.
+*/
+function excludeUntil(dir, held, reason) {
+	const path = join(dir, "pnpm-workspace.yaml");
+	const lines = (existsSync(path) ? readFileSync(path, "utf8") : "").replace(/\n*$/, "").split("\n");
+	const entries = held.map(({ spec, clears }) => `  - '${spec}' # coffre update: until ${clears.toISOString()}, ${reason}`);
+	const key = lines.findIndex((line) => /^minimumReleaseAgeExclude:/.test(line));
+	if (key === -1) lines.push("minimumReleaseAgeExclude:", ...entries);
+	else {
+		let end = key + 1;
+		while (end < lines.length && /^\s+(-|#)/.test(lines[end])) end++;
+		lines.splice(end, 0, ...entries);
+	}
+	writeFileSync(path, `${lines.join("\n")}\n`);
+}
+/** Remove the exclusions `excludeUntil` wrote whose date has passed; the packages they named. */
+function removeCleared(dir, now) {
+	const path = join(dir, "pnpm-workspace.yaml");
+	if (!existsSync(path)) return [];
+	const removed = [];
+	const kept = readFileSync(path, "utf8").split("\n").filter((line) => {
+		const match = EXCLUDED.exec(line);
+		if (match === null || new Date(match[2].replace(/,$/, "")) > now) return true;
+		removed.push(match[1]);
+		return false;
+	});
+	if (removed.length > 0) writeFileSync(path, kept.join("\n"));
+	return removed;
+}
+/**
+* The pnpm a deployment runs, `packageManager` in its package.json, set to
+* `wanted`, coffre's: then a laptop, CI and Workers Builds all install with
+* one pnpm, which holds minimumReleaseAge alike. The value it had, when it
+* changed; null when it was right already.
+*/
+function pinPackageManager(dir, wanted) {
+	const path = join(dir, "package.json");
+	const manifest = JSON.parse(readFileSync(path, "utf8"));
+	if (manifest.packageManager === wanted) return null;
+	const was = manifest.packageManager;
+	let next;
+	if (was !== void 0) next = {
+		...manifest,
+		packageManager: wanted
+	};
+	else {
+		const after = "private" in manifest ? "private" : "name";
+		next = {};
+		for (const [field, value] of Object.entries(manifest)) {
+			next[field] = value;
+			if (field === after) next.packageManager = wanted;
+		}
+		next.packageManager ??= wanted;
+	}
+	writeFileSync(path, `${JSON.stringify(next, null, 2)}\n`);
+	return was;
+}
 /**
 * Why pnpm install failed, in a sentence. The deployment's minimumReleaseAge
 * holds back every package published within the week, coffre's own
@@ -1366,4 +1453,4 @@ function editWorker(dir, path, changes) {
 	return changed;
 }
 //#endregion
-export { install as a, editWorker as i, coffrePins as n, placeholder as o, deploymentKind as r, readWorker as s, bumpPins as t };
+export { editWorker as a, minimumReleaseAge as c, readWorker as d, removeCleared as f, deploymentKind as i, pinPackageManager as l, bumpPins as n, excludeUntil as o, coffrePins as r, install as s, HeldBack as t, placeholder as u };

package/dist/{init-mO8V087p.js → init-2xGelVG1.js}

@@ -68,4 +68,4 @@ function init(kind, target, version) {
 	return written;
 }
 //#endregion
-export { init as n, isEmpty as r, KINDS as t };
+export { templateDir as i, init as n, isEmpty as r, KINDS as t };

package/dist/main.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
-import { n as init, t as KINDS } from "./init-mO8V087p.js";
+import { n as init, t as KINDS } from "./init-2xGelVG1.js";
 import { a as keys } from "./keys-DDdMwm0N.js";
 import { a as openTerminal, c as release, d as style, r as hiddenLine, t as Cancelled, u as select } from "./tty-BDa14JX2.js";
 import { i as isRole, r as assignableToEnvironment, t as ROLES } from "./access-CO1kGjWW.js";
 import { inspect, parseArgs, promisify } from "node:util";
 import { execFile, spawn } from "node:child_process";
-import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { homedir, hostname } from "node:os";
+import { appendFileSync, chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { EOL, homedir, hostname } from "node:os";
 import { dirname, join, resolve } from "node:path";
-import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes, timingSafeEqual } from "node:crypto";
+import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 /**
 * The line to show, or null: nothing pending, or nothing told. An instance
 * older than this notice has no `instance` on `/me` at all.
@@ -40,6 +40,231 @@ async function dailyNotice(origin, now, checked, me) {
 	return noticeFor(origin, instance);
 }
 //#endregion
+//#region ../core/dist/dotenv.js
+const KEY_RE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+function parseDotenv(input) {
+	const entries = [];
+	const problems = [];
+	const seen = /* @__PURE__ */ new Set();
+	const lines = input.split(/\r\n|\n|\r/);
+	for (let index = 0; index < lines.length; index++) {
+		const lineNumber = index + 1;
+		const trimmed = lines[index].trim();
+		if (trimmed === "" || trimmed.startsWith("#")) continue;
+		const withoutExport = trimmed.startsWith("export ") ? trimmed.slice(7).trim() : trimmed;
+		const equals = withoutExport.indexOf("=");
+		if (equals === -1) {
+			problems.push({
+				line: lineNumber,
+				text: trimmed,
+				reason: "no \"=\" on this line"
+			});
+			continue;
+		}
+		const key = withoutExport.slice(0, equals).trim();
+		if (!KEY_RE.test(key)) {
+			problems.push({
+				line: lineNumber,
+				text: key,
+				reason: "key must match ^[A-Za-z_][A-Za-z0-9_]*$"
+			});
+			continue;
+		}
+		let rest = withoutExport.slice(equals + 1).trim();
+		let value;
+		if (rest.startsWith("\"")) {
+			const closing = findClosingQuote(rest, "\"");
+			if (closing === -1) {
+				problems.push({
+					line: lineNumber,
+					text: key,
+					reason: "unterminated double quote (multi-line values are not supported)"
+				});
+				continue;
+			}
+			value = unescapeDoubleQuoted(rest.slice(1, closing));
+			if (trailingIsSignificant(rest.slice(closing + 1))) {
+				problems.push({
+					line: lineNumber,
+					text: key,
+					reason: "unexpected text after the closing quote"
+				});
+				continue;
+			}
+		} else if (rest.startsWith("'")) {
+			const closing = rest.indexOf("'", 1);
+			if (closing === -1) {
+				problems.push({
+					line: lineNumber,
+					text: key,
+					reason: "unterminated single quote (multi-line values are not supported)"
+				});
+				continue;
+			}
+			value = rest.slice(1, closing);
+			if (trailingIsSignificant(rest.slice(closing + 1))) {
+				problems.push({
+					line: lineNumber,
+					text: key,
+					reason: "unexpected text after the closing quote"
+				});
+				continue;
+			}
+		} else {
+			const comment = rest.indexOf(" #");
+			if (comment !== -1) rest = rest.slice(0, comment);
+			value = rest.trim();
+		}
+		if (value.includes("\0")) {
+			problems.push({
+				line: lineNumber,
+				text: key,
+				reason: "value contains a NUL byte, which cannot be passed in an environment"
+			});
+			continue;
+		}
+		if (seen.has(key)) {
+			problems.push({
+				line: lineNumber,
+				text: key,
+				reason: "duplicate key in this file"
+			});
+			continue;
+		}
+		seen.add(key);
+		entries.push({
+			key,
+			value,
+			line: lineNumber
+		});
+	}
+	return {
+		entries,
+		problems
+	};
+}
+/** True when what follows a closing quote is neither whitespace nor a comment. */
+function trailingIsSignificant(rest) {
+	const trimmed = rest.trim();
+	return trimmed !== "" && !trimmed.startsWith("#");
+}
+function findClosingQuote(text, quote) {
+	for (let index = 1; index < text.length; index++) {
+		if (text[index] === "\\") {
+			index++;
+			continue;
+		}
+		if (text[index] === quote) return index;
+	}
+	return -1;
+}
+/**
+* Expand escapes inside a double-quoted value.
+*
+* Deliberately minimal: only the escapes that are necessary. `\n` and `\r`
+* because multi-line values (PEM keys) cannot otherwise be expressed on one
+* line, and `\\` `\"` `\'` because quoting needs them.
+*
+* EVERYTHING ELSE IS PRESERVED VERBATIM, backslash included. The obvious
+* implementation -- returning the character and dropping the backslash for
+* unknown escapes -- silently mangles credentials: `"C:\path\to\file"` came
+* out as `C:path<TAB>ofile`, and `"\d+\w"` as `d+w`. A secrets store that
+* quietly rewrites what you gave it is worse than one that refuses.
+*
+* A value that should contain no interpretation at all belongs in single
+* quotes, which are literal.
+*/
+function unescapeDoubleQuoted(text) {
+	return text.replace(/\\(.)/g, (match, character) => {
+		switch (character) {
+			case "n": return "\n";
+			case "r": return "\r";
+			case "\\":
+			case "\"":
+			case "'": return character;
+			default: return match;
+		}
+	});
+}
+/** Values that read the same unquoted: no spaces, quotes, `#`, `$` or backslashes. */
+const PLAIN_VALUE = /^[A-Za-z0-9_./:@+,=%?-]*$/;
+/**
+* Write entries as a .env file that `parseDotenv` reads back exactly.
+*
+* Plain values stay bare; anything else is single-quoted, which is literal;
+* values holding a quote or a line break are double-quoted with the four
+* escapes the parser knows (`\\`, `\"`, `\n`, `\r`).
+*/
+function formatDotenv(entries) {
+	let out = "";
+	for (const [key, value] of entries) {
+		assertEnvironmentEntry(key, value);
+		out += `${key}=${quoteDotenv(value)}\n`;
+	}
+	return out;
+}
+/** Reject names and values that cannot be passed intact in an environment. */
+function assertEnvironmentEntry(key, value) {
+	if (!KEY_RE.test(key)) throw new Error(`${JSON.stringify(key)} is not a valid variable name`);
+	if (value.includes("\0")) throw new Error(`${key} contains a NUL byte`);
+}
+function quoteDotenv(value) {
+	if (PLAIN_VALUE.test(value)) return value;
+	if (!/['\n\r]/.test(value)) return `'${value}'`;
+	return `"${value.replace(/[\\"\n\r]/g, (character) => {
+		switch (character) {
+			case "\n": return "\\n";
+			case "\r": return "\\r";
+			default: return `\\${character}`;
+		}
+	})}"`;
+}
+/**
+* Write entries as POSIX shell `export` statements, for
+* `eval "$(coffre export … --format shell)"`. Single quotes are the only
+* shell quoting with no expansion inside; a single quote itself is written
+* as `'\''`.
+*/
+function formatShellExports(entries) {
+	let out = "";
+	for (const [key, value] of entries) {
+		assertEnvironmentEntry(key, value);
+		out += `export ${key}='${value.replaceAll("'", "'\\''")}'\n`;
+	}
+	return out;
+}
+//#endregion
+//#region src/github-env.ts
+/** The runner decodes %, CR and LF in command data, in this escaping order.
+* https://github.com/actions/toolkit/blob/main/packages/core/src/command.ts
+*/
+function githubMasks(entries) {
+	let out = "";
+	for (const [, value] of entries) for (const mask of /* @__PURE__ */ new Set([value, ...value.split(/\r\n|\r|\n/)])) {
+		if (mask === "") continue;
+		out += `::add-mask::${mask.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A")}\n`;
+	}
+	return out;
+}
+/** Multiline-safe environment records, consumed by GitHub after the step.
+* https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-commands#multiline-strings
+* Match the host's framing newline, including on Windows, so a trailing CR
+* in the value is not mistaken for part of that newline.
+*/
+function githubEnvironment(entries, nextDelimiter = () => `coffre_${randomUUID()}`, newline = EOL) {
+	let out = "";
+	for (const [key, value] of entries) {
+		assertEnvironmentEntry(key, value);
+		if (key.toUpperCase() === "NODE_OPTIONS") throw new Error(`${key} cannot be set through GITHUB_ENV`);
+		let delimiter;
+		do
+			delimiter = nextDelimiter();
+		while (value.includes(delimiter));
+		out += `${key}<<${delimiter}${newline}${value}${newline}${delimiter}${newline}`;
+	}
+	return out;
+}
+//#endregion
 //#region ../client/dist/index.js
 /** The API's error shape, `{ error, message }`, with the HTTP status. */
 const COFFRE_ERROR = Symbol.for("@coffre/client:CoffreError");
@@ -1554,199 +1779,6 @@ async function pickCheck() {
 	}
 }
 //#endregion
-//#region ../core/dist/dotenv.js
-const KEY_RE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
-function parseDotenv(input) {
-	const entries = [];
-	const problems = [];
-	const seen = /* @__PURE__ */ new Set();
-	const lines = input.split(/\r\n|\n|\r/);
-	for (let index = 0; index < lines.length; index++) {
-		const lineNumber = index + 1;
-		const trimmed = lines[index].trim();
-		if (trimmed === "" || trimmed.startsWith("#")) continue;
-		const withoutExport = trimmed.startsWith("export ") ? trimmed.slice(7).trim() : trimmed;
-		const equals = withoutExport.indexOf("=");
-		if (equals === -1) {
-			problems.push({
-				line: lineNumber,
-				text: trimmed,
-				reason: "no \"=\" on this line"
-			});
-			continue;
-		}
-		const key = withoutExport.slice(0, equals).trim();
-		if (!KEY_RE.test(key)) {
-			problems.push({
-				line: lineNumber,
-				text: key,
-				reason: "key must match ^[A-Za-z_][A-Za-z0-9_]*$"
-			});
-			continue;
-		}
-		let rest = withoutExport.slice(equals + 1).trim();
-		let value;
-		if (rest.startsWith("\"")) {
-			const closing = findClosingQuote(rest, "\"");
-			if (closing === -1) {
-				problems.push({
-					line: lineNumber,
-					text: key,
-					reason: "unterminated double quote (multi-line values are not supported)"
-				});
-				continue;
-			}
-			value = unescapeDoubleQuoted(rest.slice(1, closing));
-			if (trailingIsSignificant(rest.slice(closing + 1))) {
-				problems.push({
-					line: lineNumber,
-					text: key,
-					reason: "unexpected text after the closing quote"
-				});
-				continue;
-			}
-		} else if (rest.startsWith("'")) {
-			const closing = rest.indexOf("'", 1);
-			if (closing === -1) {
-				problems.push({
-					line: lineNumber,
-					text: key,
-					reason: "unterminated single quote (multi-line values are not supported)"
-				});
-				continue;
-			}
-			value = rest.slice(1, closing);
-			if (trailingIsSignificant(rest.slice(closing + 1))) {
-				problems.push({
-					line: lineNumber,
-					text: key,
-					reason: "unexpected text after the closing quote"
-				});
-				continue;
-			}
-		} else {
-			const comment = rest.indexOf(" #");
-			if (comment !== -1) rest = rest.slice(0, comment);
-			value = rest.trim();
-		}
-		if (value.includes("\0")) {
-			problems.push({
-				line: lineNumber,
-				text: key,
-				reason: "value contains a NUL byte, which cannot be passed in an environment"
-			});
-			continue;
-		}
-		if (seen.has(key)) {
-			problems.push({
-				line: lineNumber,
-				text: key,
-				reason: "duplicate key in this file"
-			});
-			continue;
-		}
-		seen.add(key);
-		entries.push({
-			key,
-			value,
-			line: lineNumber
-		});
-	}
-	return {
-		entries,
-		problems
-	};
-}
-/** True when what follows a closing quote is neither whitespace nor a comment. */
-function trailingIsSignificant(rest) {
-	const trimmed = rest.trim();
-	return trimmed !== "" && !trimmed.startsWith("#");
-}
-function findClosingQuote(text, quote) {
-	for (let index = 1; index < text.length; index++) {
-		if (text[index] === "\\") {
-			index++;
-			continue;
-		}
-		if (text[index] === quote) return index;
-	}
-	return -1;
-}
-/**
-* Expand escapes inside a double-quoted value.
-*
-* Deliberately minimal: only the escapes that are necessary. `\n` and `\r`
-* because multi-line values (PEM keys) cannot otherwise be expressed on one
-* line, and `\\` `\"` `\'` because quoting needs them.
-*
-* EVERYTHING ELSE IS PRESERVED VERBATIM, backslash included. The obvious
-* implementation -- returning the character and dropping the backslash for
-* unknown escapes -- silently mangles credentials: `"C:\path\to\file"` came
-* out as `C:path<TAB>ofile`, and `"\d+\w"` as `d+w`. A secrets store that
-* quietly rewrites what you gave it is worse than one that refuses.
-*
-* A value that should contain no interpretation at all belongs in single
-* quotes, which are literal.
-*/
-function unescapeDoubleQuoted(text) {
-	return text.replace(/\\(.)/g, (match, character) => {
-		switch (character) {
-			case "n": return "\n";
-			case "r": return "\r";
-			case "\\":
-			case "\"":
-			case "'": return character;
-			default: return match;
-		}
-	});
-}
-/** Values that read the same unquoted: no spaces, quotes, `#`, `$` or backslashes. */
-const PLAIN_VALUE = /^[A-Za-z0-9_./:@+,=%?-]*$/;
-/**
-* Write entries as a .env file that `parseDotenv` reads back exactly.
-*
-* Plain values stay bare; anything else is single-quoted, which is literal;
-* values holding a quote or a line break are double-quoted with the four
-* escapes the parser knows (`\\`, `\"`, `\n`, `\r`).
-*/
-function formatDotenv(entries) {
-	let out = "";
-	for (const [key, value] of entries) {
-		assertWritable(key, value);
-		out += `${key}=${quoteDotenv(value)}\n`;
-	}
-	return out;
-}
-function assertWritable(key, value) {
-	if (!KEY_RE.test(key)) throw new Error(`${JSON.stringify(key)} is not a valid variable name`);
-	if (value.includes("\0")) throw new Error(`${key} contains a NUL byte`);
-}
-function quoteDotenv(value) {
-	if (PLAIN_VALUE.test(value)) return value;
-	if (!/['\n\r]/.test(value)) return `'${value}'`;
-	return `"${value.replace(/[\\"\n\r]/g, (character) => {
-		switch (character) {
-			case "\n": return "\\n";
-			case "\r": return "\\r";
-			default: return `\\${character}`;
-		}
-	})}"`;
-}
-/**
-* Write entries as POSIX shell `export` statements, for
-* `eval "$(coffre export … --format shell)"`. Single quotes are the only
-* shell quoting with no expansion inside; a single quote itself is written
-* as `'\''`.
-*/
-function formatShellExports(entries) {
-	let out = "";
-	for (const [key, value] of entries) {
-		assertWritable(key, value);
-		out += `export ${key}='${value.replaceAll("'", "'\\''")}'\n`;
-	}
-	return out;
-}
-//#endregion
 //#region src/main.ts
 /**
 * coffre CLI.
@@ -2192,14 +2224,22 @@ async function exportEnv(args) {
 		} },
 		allowPositionals: true
 	});
-	const usage = "usage: coffre export <project>/<environment> [--format dotenv|json|shell]";
+	const usage = "usage: coffre export <project>/<environment> [--format dotenv|json|shell|github]";
 	if (!positionals[0]) fail(usage);
 	const format = values.format;
-	if (format !== "dotenv" && format !== "json" && format !== "shell") fail(usage);
+	if (format !== "dotenv" && format !== "json" && format !== "shell" && format !== "github") fail(usage);
+	const githubEnv = process.env.GITHUB_ENV;
+	if (format === "github" && !githubEnv) fail("--format github requires GITHUB_ENV (run it in a GitHub Actions step)");
 	const { project, environment } = parsePath(positionals[0]);
 	const revealed = await client().secrets.reveal(`${project}/${environment}`);
 	const entries = Object.entries(revealed.values).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-	process.stdout.write(format === "json" ? `${JSON.stringify(Object.fromEntries(entries), null, 2)}\n` : attempt(() => format === "shell" ? formatShellExports(entries) : formatDotenv(entries)));
+	if (format === "github") {
+		process.stdout.write(githubMasks(entries));
+		attempt(() => appendFileSync(githubEnv, githubEnvironment(entries), {
+			encoding: "utf8",
+			mode: 384
+		}));
+	} else process.stdout.write(format === "json" ? `${JSON.stringify(Object.fromEntries(entries), null, 2)}\n` : attempt(() => format === "shell" ? formatShellExports(entries) : formatDotenv(entries)));
 	if (process.stderr.isTTY) {
 		const count = entries.length;
 		process.stderr.write(`coffre: read ${count} secret${count === 1 ? "" : "s"} from ${project}/${environment}; each read is in the audit log under your name\n`);
@@ -2527,7 +2567,7 @@ const USAGE = `coffre - secrets, with an audit log
     coffre get      <project>/<environment>/<KEY>
     coffre set      <project>/<environment>/<KEY> [value]   (reads stdin if omitted)
     coffre run      <project>/<environment> -- <command>
-    coffre export   <project>/<environment> [--format dotenv|json|shell]
+    coffre export   <project>/<environment> [--format dotenv|json|shell|github]
     coffre history  <project>/<environment>/<KEY>
     coffre rollback <project>/<environment>/<KEY> <version>
     coffre import   <project>/<environment> [--file .env] [--apply]
@@ -2566,10 +2606,10 @@ switch (command) {
 		await keys(rest);
 		break;
 	case "setup":
-		await (await import("./setup-qGoLPykX.js")).setup(rest);
+		await (await import("./setup-Bs8q8Ily.js")).setup(rest);
 		break;
 	case "update":
-		await (await import("./update-DwGbG-eM.js")).update(rest);
+		await (await import("./update-eYzLTNoL.js")).update(rest);
 		break;
 	case "migrate":
 		await (await import("./migrate-ERNNgYO0.js")).migrate(rest, migrateTarget);

package/dist/{setup-qGoLPykX.js → setup-Bs8q8Ily.js}

@@ -1,11 +1,11 @@
 import { d as esm_default } from "./esm-Bts-esAl.js";
-import { n as init, t as KINDS } from "./init-mO8V087p.js";
+import { n as init, t as KINDS } from "./init-2xGelVG1.js";
 import { i as keyValues, n as jsonWarning, o as needsTerminal, r as keyGuide, s as showSecrets, t as generateKeys } from "./keys-DDdMwm0N.js";
 import { a as openTerminal, c as release, d as style, f as textLine, i as listed, l as row, o as paragraph, t as Cancelled, u as select } from "./tty-BDa14JX2.js";
 import { r as postgresConnection } from "./connect-C4wevMJ5.js";
 import { n as migrateDatabase, t as readDatabaseUrl } from "./database-url-CJ9yqoi_.js";
 import { n as StepFailed, r as Steps, t as cliVersion } from "./version-CPk6zTTK.js";
-import { a as install, i as editWorker, o as placeholder, r as deploymentKind, s as readWorker } from "./deployment-S8za5nUu.js";
+import { a as editWorker, d as readWorker, i as deploymentKind, s as install, u as placeholder } from "./deployment-Di8BG9qY.js";
 import { parseArgs } from "node:util";
 import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";

package/dist/templates/node/package.json

@@ -1,6 +1,7 @@
 {
   "name": "coffre-node",
   "private": true,
+  "packageManager": "pnpm@11.8.0",
   "type": "module",
   "engines": {
     "node": ">=24"
@@ -13,11 +14,11 @@
     "conformance": "coffre-conformance node"
   },
   "dependencies": {
-    "@coffre/server": "0.1.14",
-    "@coffre/vault": "0.1.14"
+    "@coffre/server": "0.1.15",
+    "@coffre/vault": "0.1.15"
   },
   "devDependencies": {
-    "@coffre/conformance": "0.1.14",
+    "@coffre/conformance": "0.1.15",
     "@types/node": "26.1.1",
     "typescript": "5.9.3"
   }

package/dist/templates/workers/package.json

@@ -1,6 +1,7 @@
 {
   "name": "coffre-workers",
   "private": true,
+  "packageManager": "pnpm@11.8.0",
   "type": "module",
   "engines": {
     "node": ">=24"
@@ -14,13 +15,13 @@
     "conformance": "coffre-conformance workers"
   },
   "dependencies": {
-    "@coffre/server": "0.1.14",
-    "@coffre/ui": "0.1.14",
-    "@coffre/vault": "0.1.14"
+    "@coffre/server": "0.1.15",
+    "@coffre/ui": "0.1.15",
+    "@coffre/vault": "0.1.15"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "5.20260920.1",
-    "@coffre/conformance": "0.1.14",
+    "@coffre/conformance": "0.1.15",
     "typescript": "5.9.3",
     "wrangler": "4.118.0"
   }

package/dist/{update-DwGbG-eM.js → update-eYzLTNoL.js}

@@ -1,10 +1,11 @@
+import { i as templateDir } from "./init-2xGelVG1.js";
 import { a as openTerminal, c as release, d as style, i as listed, t as Cancelled } from "./tty-BDa14JX2.js";
 import { n as StepFailed, r as Steps, t as cliVersion } from "./version-CPk6zTTK.js";
-import { a as install, n as coffrePins, r as deploymentKind, t as bumpPins } from "./deployment-S8za5nUu.js";
+import { c as minimumReleaseAge, f as removeCleared, i as deploymentKind, l as pinPackageManager, n as bumpPins, o as excludeUntil, r as coffrePins, s as install, t as HeldBack } from "./deployment-Di8BG9qY.js";
 import { createRequire } from "node:module";
 import { parseArgs } from "node:util";
 import { spawn, spawnSync } from "node:child_process";
-import { readFileSync, realpathSync } from "node:fs";
+import { readFileSync, realpathSync, writeFileSync } from "node:fs";
 import { dirname, join, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 /**
@@ -221,20 +222,71 @@ async function update(args) {
 			}
 		});
 		if (deployment !== null) await steps.run(2, async (step) => {
-			if (pinned.length === 1 && pinned[0] === latest) return `This deployment's coffre packages are at ${latest} already`;
+			const details = [];
+			const cleared = removeCleared(deployment, /* @__PURE__ */ new Date());
+			if (cleared.length > 0) details.push(`No longer excluded from minimumReleaseAge, now old enough: ${listed(cleared, "and")}`);
+			const pnpm = templatePackageManager(kind);
+			const repin = pnpm !== null && coffrePackageManager(deployment) !== pnpm;
+			const current = pinned.length === 1 && pinned[0] === latest;
+			if (current && !repin) return {
+				text: `This deployment's coffre packages are at ${latest} already`,
+				details
+			};
 			const was = pinned.length === 1 ? pinned[0] : listed(pinned, "and");
-			if (!await ask(`Move this deployment's coffre packages from ${was} to ${latest}, and install them?`, step)) return {
-				text: `This deployment stays at ${was}`,
-				details: []
+			const on = pnpm?.replace("@", " ");
+			const question = current ? `Pin this deployment to ${on}, as coffre installs with, and install it?` : `Move this deployment from ${was} to ${latest}${repin ? `, on ${on},` : ""} and install it?`;
+			if (!await ask(question, step)) return {
+				text: `This deployment stays as it is, at ${was}`,
+				details
 			};
 			before = deploymentMigrations(deployment) ?? before;
+			const manifest = join(deployment, "package.json");
+			const saved = readFileSync(manifest, "utf8");
 			bumpPins(deployment, latest);
+			if (repin) {
+				const replaced = pinPackageManager(deployment, pnpm);
+				details.push(`Pinned ${pnpm}${replaced ? `, not ${replaced}` : ""}: every install, here, in CI and on Workers Builds, holds minimumReleaseAge alike`);
+			}
 			step.note(`Installing coffre ${latest}'s packages, with pnpm`);
-			await install(deployment);
+			try {
+				await install(deployment);
+			} catch (error) {
+				if (!(error instanceof HeldBack)) throw error;
+				const age = minimumReleaseAge(deployment);
+				const clears = error.held.map(({ spec, publishedAt }) => ({
+					spec,
+					clears: new Date(publishedAt.getTime() + age * 6e4)
+				})).sort((x, y) => x.clears.getTime() - y.clears.getTime());
+				const last = clears.at(-1).clears;
+				const lines = clears.map(({ spec, clears: at }) => `${spec}, old enough from ${when(at)}`);
+				const held = `pnpm holds back ${clears.length === 1 ? "1 package" : `${clears.length} packages`} younger than this deployment's minimumReleaseAge, ${days(age)}`;
+				if (yes || keys() === null) {
+					writeFileSync(manifest, saved);
+					throw new Error(`${held}: ${lines.join("; ")}. Run coffre update after ${when(last)}, or on a terminal to exclude them until then`);
+				}
+				step.under(lines);
+				const choice = await step.choose(held, [`Wait: stay at ${was}, and run coffre update again after ${when(last)}`, `Proceed: let ${clears.length === 1 ? "it" : "these"} through until each is old enough, named in pnpm-workspace.yaml`]);
+				step.under([]);
+				if (choice === 0) {
+					writeFileSync(manifest, saved);
+					return {
+						text: `This deployment stays at ${was}, until ${when(last)}`,
+						details: [
+							...details,
+							...lines,
+							`Run coffre update again after ${when(last)}`
+						]
+					};
+				}
+				excludeUntil(deployment, clears, `for coffre ${latest}`);
+				step.note(`Installing coffre ${latest}'s packages, with pnpm`);
+				await install(deployment);
+				details.push("Let through until each is old enough, named in pnpm-workspace.yaml:", ...clears.map(({ spec, clears: at }) => `  ${spec}, until ${when(at)}`), `The first coffre update after ${when(last)} removes them`);
+			}
 			after = deploymentMigrations(deployment) ?? after;
 			return {
-				text: `Moved this deployment from ${was} to ${latest}, and installed it`,
-				details: [`${Object.keys(pins).length} coffre packages, which minimumReleaseAge lets through at once`]
+				text: current ? `Pinned ${pnpm}, and installed it` : `Moved this deployment from ${was} to ${latest}, and installed it`,
+				details
 			};
 		});
 	} catch (error) {
@@ -255,6 +307,25 @@ async function update(args) {
 		out.write("\n");
 	}
 }
+/** The pnpm coffre installs with, as the template of a deployment of `kind` pins it. */
+function templatePackageManager(kind) {
+	try {
+		return JSON.parse(readFileSync(join(templateDir(kind), "package.json"), "utf8")).packageManager ?? null;
+	} catch {
+		return null;
+	}
+}
+function coffrePackageManager(dir) {
+	return JSON.parse(readFileSync(join(dir, "package.json"), "utf8")).packageManager;
+}
+/** A moment, to the minute, in UTC: when a package is old enough. */
+function when(date) {
+	return `${date.toISOString().slice(0, 16).replace("T", " ")} UTC`;
+}
+function days(minutes) {
+	const d = minutes / 1440;
+	return Number.isInteger(d) ? `${d} day${d === 1 ? "" : "s"}` : `${minutes} minutes`;
+}
 function finish(out, message, code) {
 	if (message !== "") out.write(`${message}\n`);
 	process.exit(code);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/cli",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "The coffre command line: secrets in your shell, and `coffre init` for a new deployment.",
   "license": "MIT",
   "repository": {
@@ -10,7 +10,7 @@
   },
   "type": "module",
   "engines": {
-    "node": ">=24"
+    "node": ">=20"
   },
   "files": [
     "dist"
@@ -28,9 +28,9 @@
     "pg": "8.16.3",
     "tsdown": "0.23.0",
     "typescript": "5.9.3",
-    "@coffre/client": "0.1.14",
-    "@coffre/db": "0.1.14",
-    "@coffre/core": "0.1.14"
+    "@coffre/core": "0.1.15",
+    "@coffre/db": "0.1.15",
+    "@coffre/client": "0.1.15"
   },
   "scripts": {
     "build": "tsdown && node scripts/copy-templates.ts && node scripts/copy-migrations.ts",