@coffre/cli 0.1.2 → 0.1.3

package/dist/keys-RhB7ayOY.js

@@ -0,0 +1,726 @@
+import { parseArgs } from "node:util";
+import { spawn } from "node:child_process";
+import { openSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { emitKeypressEvents } from "node:readline";
+import tty from "node:tty";
+//#region src/clipboard.ts
+const CLEAR_AFTER_MS = 3e4;
+/** The system's clipboard tool, by platform and display server; null for none known. */
+function systemTool(platform = process.platform, env = process.env) {
+	const windows = {
+		copy: ["clip.exe"],
+		clear: ["clip.exe"],
+		paste: [
+			"powershell.exe",
+			"-NoProfile",
+			"-Command",
+			"Get-Clipboard"
+		]
+	};
+	if (platform === "darwin") return {
+		copy: ["pbcopy"],
+		clear: ["pbcopy"],
+		paste: ["pbpaste"]
+	};
+	if (platform === "win32") return windows;
+	if (platform !== "linux") return null;
+	if (env.WSL_DISTRO_NAME) return windows;
+	if (env.WAYLAND_DISPLAY) return {
+		copy: ["wl-copy"],
+		clear: ["wl-copy", "--clear"],
+		paste: ["wl-paste", "--no-newline"]
+	};
+	if (env.DISPLAY) {
+		const xclip = [
+			"xclip",
+			"-selection",
+			"clipboard"
+		];
+		return {
+			copy: [...xclip],
+			clear: [...xclip],
+			paste: [...xclip, "-o"]
+		};
+	}
+	return null;
+}
+var Clipboard = class {
+	#tool;
+	#terminal;
+	#pending = null;
+	#onCleared;
+	/** `terminal` writes an escape sequence to the screen, for OSC 52; `onCleared` hears of a clear. */
+	constructor(terminal, onCleared = () => {}, tool = systemTool()) {
+		this.#tool = tool;
+		this.#terminal = terminal;
+		this.#onCleared = onCleared;
+	}
+	async copy(text) {
+		if (this.#tool !== null) try {
+			await feed(this.#tool.copy, text);
+			this.#schedule(text);
+			return "system";
+		} catch {
+			this.#tool = null;
+		}
+		this.#terminal(`\x1b]52;c;${Buffer.from(text).toString("base64")}\x07`);
+		return "terminal";
+	}
+	/** Clear a copy still pending now, as the screen closes. */
+	async settle() {
+		const pending = this.#pending;
+		if (pending === null) return;
+		clearTimeout(pending.timer);
+		this.#pending = null;
+		await this.#clearIfHolds(pending.text);
+	}
+	#schedule(text) {
+		if (this.#pending !== null) clearTimeout(this.#pending.timer);
+		const timer = setTimeout(() => {
+			this.#pending = null;
+			this.#clearIfHolds(text).then(this.#onCleared, () => {});
+		}, CLEAR_AFTER_MS);
+		this.#pending = {
+			text,
+			timer
+		};
+	}
+	/** Clear the clipboard if it still holds `text`: whatever was copied since stays. */
+	async #clearIfHolds(text) {
+		const tool = this.#tool;
+		if (tool === null) return;
+		try {
+			if (await read(tool.paste) === text) await feed(tool.clear, "");
+		} catch {}
+	}
+};
+const TOOL_TIMEOUT_MS = 3e3;
+/** Run `command` with `input` on its stdin; its output is not waited for, since xclip and wl-copy stay to serve it. */
+function feed([command, ...args], input) {
+	return new Promise((resolve, reject) => {
+		const child = spawn(command, args, {
+			stdio: [
+				"pipe",
+				"ignore",
+				"ignore"
+			],
+			timeout: TOOL_TIMEOUT_MS
+		});
+		child.on("error", reject);
+		child.on("close", (code) => code === 0 ? resolve() : reject(/* @__PURE__ */ new Error(`${command} exited with ${code}`)));
+		child.stdin.on("error", () => {});
+		if (input === "") child.stdin.end();
+		else child.stdin.end(input);
+	});
+}
+function read([command, ...args]) {
+	return new Promise((resolve, reject) => {
+		const child = spawn(command, args, {
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			],
+			timeout: TOOL_TIMEOUT_MS
+		});
+		let out = "";
+		child.stdout.setEncoding("utf8").on("data", (chunk) => out += chunk);
+		child.on("error", reject);
+		child.on("close", (code) => code === 0 ? resolve(out.replace(/\r?\n$/, "")) : reject(/* @__PURE__ */ new Error(`${command} exited with ${code}`)));
+	});
+}
+//#endregion
+//#region src/tty.ts
+const plain = (text) => text;
+/**
+* The web UI's accent, green and red, at the depth the terminal takes:
+* 24-bit, 256 colours or the 16 named ones. NO_COLOR (and FORCE_COLOR) are
+* the stream's own `hasColors`; bold and dim stay, being no colour.
+*/
+function style(stream) {
+	if (stream.isTTY !== true) return {
+		ansi: false,
+		bold: plain,
+		dim: plain,
+		accent: plain,
+		green: plain,
+		red: plain
+	};
+	const terminal = stream;
+	const depth = typeof terminal.hasColors === "function" && terminal.hasColors() ? terminal.getColorDepth() : 1;
+	const sgr = (open, close) => (text) => `\x1b[${open}m${text}\x1b[${close}m`;
+	const colour = (rgb, index256, index16) => depth >= 24 ? sgr(`38;2;${rgb.join(";")}`, "39") : depth >= 8 ? sgr(`38;5;${index256}`, "39") : depth >= 4 ? sgr(String(index16), "39") : plain;
+	return {
+		ansi: true,
+		bold: sgr("1", "22"),
+		dim: sgr("2", "22"),
+		accent: colour([
+			91,
+			141,
+			239
+		], 69, 94),
+		green: colour([
+			63,
+			174,
+			111
+		], 71, 32),
+		red: colour([
+			229,
+			83,
+			75
+		], 167, 31)
+	};
+}
+const ESCAPE = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07]*\x07/g;
+/** Columns `text` takes on screen: its characters, less its escape codes. */
+function width(text) {
+	return [...text.replace(ESCAPE, "")].length;
+}
+/** `text` cut to `columns` on screen, escape codes kept, an ellipsis where it was cut. */
+function truncate(text, columns) {
+	if (width(text) <= columns) return text;
+	let out = "";
+	let used = 0;
+	for (let i = 0; i < text.length;) {
+		ESCAPE.lastIndex = i;
+		const code = text[i] === "\x1B" ? ESCAPE.exec(text) : null;
+		if (code !== null && code.index === i) {
+			out += code[0];
+			i += code[0].length;
+			continue;
+		}
+		const char = String.fromCodePoint(text.codePointAt(i));
+		if (used === columns - 1) return `${out}…${text.includes("\x1B") ? "\x1B[0m" : ""}`;
+		out += char;
+		used += 1;
+		i += char.length;
+	}
+	return out;
+}
+/** Plain `text` in lines of at most `columns`, broken at spaces, or anywhere in a word longer than a line. */
+function wrap(text, columns) {
+	const lines = [];
+	let line = "";
+	for (const word of text.split(" ")) {
+		let rest = word;
+		while (width(rest) > columns) {
+			if (line !== "") lines.push(line);
+			line = "";
+			lines.push([...rest].slice(0, columns).join(""));
+			rest = [...rest].slice(columns).join("");
+		}
+		if (line === "") line = rest;
+		else if (width(line) + 1 + width(rest) <= columns) line += ` ${rest}`;
+		else {
+			lines.push(line);
+			line = rest;
+		}
+	}
+	return [...lines, line];
+}
+/** `text` wrapped to the stream's width, each line indented by `indent` spaces. */
+function paragraph(out, text, indent = 2) {
+	const pad = " ".repeat(indent);
+	return wrap(text, Math.max(20, (out.columns || 80) - indent - 1)).map((line) => `${pad}${line}`).join("\n");
+}
+/** A labelled row: `label` in a column of `column`, `text` wrapped beside it with a hanging indent. */
+function row(out, s, label, text, indent = 4, column = 10) {
+	const lines = wrap(text, Math.max(20, (out.columns || 80) - indent - column - 1));
+	const pad = " ".repeat(indent);
+	return lines.map((line, i) => `${pad}${i === 0 ? s.dim(label.padEnd(column)) : " ".repeat(column)}${line}`).join("\n");
+}
+/**
+* The keyboard: stdin when it is a terminal, otherwise the terminal itself,
+* as `less` reads it when its input is piped. Null without one.
+*/
+function keyboard() {
+	if (process.stdin.isTTY) return process.stdin;
+	try {
+		return new tty.ReadStream(openSync("/dev/tty", "r"));
+	} catch {
+		return null;
+	}
+}
+/** Where a screen is drawn and read from: stdout, and the keyboard. Null unless both are a terminal. */
+function openTerminal() {
+	if (!process.stdout.isTTY) return null;
+	const keys = keyboard();
+	return keys === null ? null : {
+		keys,
+		out: process.stdout
+	};
+}
+/** Release a keyboard `keyboard()` opened: stdin stays, /dev/tty closes. */
+function release(keys) {
+	keys.setRawMode?.(false);
+	keys.pause();
+	if (keys !== process.stdin) keys.destroy?.();
+}
+/** Every key pressed, in raw mode, until `until` returns true. */
+function readKeys(keys, until) {
+	emitKeypressEvents(keys);
+	keys.setRawMode?.(true);
+	keys.resume();
+	return new Promise((resolve, reject) => {
+		let busy = Promise.resolve();
+		const onKey = (sequence, key) => {
+			busy = busy.then(async () => {
+				if (await until(key ?? { sequence }, sequence ?? key?.sequence ?? "")) {
+					keys.off("keypress", onKey);
+					keys.setRawMode?.(false);
+					keys.pause();
+					resolve();
+				}
+			}).catch(reject);
+		};
+		keys.on("keypress", onKey);
+	});
+}
+var Cancelled = class extends Error {
+	constructor() {
+		super("cancelled");
+	}
+};
+/**
+* A line typed without echo: a bullet for each character, so that a paste
+* shows it arrived. The question, its hint and the bullets go once it is
+* given. Ctrl-C cancels.
+*/
+async function hiddenLine(keys, out, s, question, hint) {
+	const columns = Math.max(20, (out.columns || 80) - 1);
+	out.write(`${truncate(`  ${s.accent("?")} ${s.bold(question)}`, columns)}\n${truncate(`    ${s.dim(hint)}`, columns)}\n`);
+	let typed = "";
+	const draw = () => {
+		const count = typed.length > 0 ? s.dim(`  ${typed.length} characters`) : "";
+		out.write(`\r\x1b[2K${truncate(`    ${s.accent("›")} ${"•".repeat(typed.length)}`, columns - width(count))}${count}`);
+	};
+	draw();
+	let cancelled = false;
+	await readKeys(keys, (key, sequence) => {
+		if (key.ctrl && key.name === "c") cancelled = true;
+		else if (key.name === "return" || key.name === "enter") return true;
+		else if (key.name === "backspace") typed = typed.slice(0, -1);
+		else if (key.ctrl && key.name === "u") typed = "";
+		else if (!key.ctrl && !key.meta && sequence.length > 0 && !sequence.startsWith("\x1B") && sequence >= " ") typed += sequence;
+		if (cancelled) return true;
+		draw();
+		return false;
+	});
+	out.write("\r\x1B[2K\x1B[1A\x1B[2K\x1B[1A\x1B[2K");
+	if (cancelled) throw new Cancelled();
+	return typed.trim();
+}
+/** One key: y for yes, anything else for no. Ctrl-C cancels. */
+async function yes(keys) {
+	let answer = false;
+	let cancelled = false;
+	await readKeys(keys, (key) => {
+		if (key.ctrl && key.name === "c") cancelled = true;
+		answer = key.name === "y";
+		return true;
+	});
+	if (cancelled) throw new Cancelled();
+	return answer;
+}
+//#endregion
+//#region src/secrets.ts
+function initialState() {
+	return {
+		view: "values",
+		selected: {
+			values: 0,
+			guide: 0
+		},
+		scroll: {
+			values: 0,
+			guide: 0
+		},
+		revealed: /* @__PURE__ */ new Set(),
+		revealAll: false,
+		copied: /* @__PURE__ */ new Set(),
+		status: "",
+		confirming: false
+	};
+}
+/** What the arrows move between: a view's values, or its commands. */
+function items(screen, view) {
+	if (view === "values") return screen.sections.flatMap(({ values }) => values.map(({ label, value, mask }) => ({
+		id: label,
+		text: value,
+		secret: mask !== "none",
+		name: `the ${lower(label)}`
+	})));
+	return screen.guide.flatMap(({ lines }) => lines.flatMap((line) => typeof line === "string" ? [] : [{
+		id: line.command,
+		text: line.command,
+		secret: false,
+		name: "the command"
+	}]));
+}
+const DOTS = "•".repeat(32);
+const URL_PASSWORD = /(:\/\/[^:@/\s']*:)([^@\s']+)(@)/g;
+function masked(value, mask) {
+	if (mask === "all") return DOTS;
+	if (mask === "password") return value.replace(URL_PASSWORD, "$1••••••••$3");
+	return value;
+}
+/** The values' count in words, for the question before leaving. */
+function saved(count) {
+	return count === 1 ? "the value" : count === 2 ? "both values" : `all ${[
+		"three",
+		"four",
+		"five",
+		"six"
+	][count - 3] ?? count} values`;
+}
+/**
+* The screen as `rows` lines of at most `columns`: a header, the view's
+* lines, scrolled to keep the selected item in sight, and the keys. Sets
+* the view's scroll in `state`.
+*/
+function render(screen, state, columns, rows, s) {
+	const inner = Math.max(20, columns - 6);
+	const rule = `  ${s.dim("─".repeat(Math.max(10, columns - 4)))}`;
+	const count = screen.sections.reduce((n, { values }) => n + values.length, 0);
+	const right = s.dim(`${count} value${count === 1 ? "" : "s"} · shown once`);
+	const title = `  ${s.bold(screen.title)}`;
+	const header = [
+		"",
+		`${title}${" ".repeat(Math.max(1, columns - width(title) - width(right) - 2))}${right}`,
+		rule,
+		...state.view === "values" ? wrap("Save each one in your password manager now. They aren't stored anywhere, and won't be shown again.", columns - 4).map((line) => `  ${line}`) : [`  ${s.bold("Where these go")}`],
+		""
+	];
+	const body = [];
+	const spans = [];
+	const list = items(screen, state.view);
+	const selected = Math.min(state.selected[state.view], list.length - 1);
+	const shown = (item) => state.revealAll || state.revealed.has(item.id);
+	const bar = (on) => on ? `  ${s.accent("▎")} ` : "    ";
+	if (state.view === "values") {
+		let index = 0;
+		for (const section of screen.sections) {
+			body.push(`  ${s.dim(s.bold(section.title.toUpperCase()))}`);
+			for (const value of section.values) {
+				const on = index === selected;
+				const item = list[index];
+				const start = body.length;
+				const copied = state.copied.has(item.id) ? `  ${s.green("✓ copied")}` : "";
+				body.push(`${bar(on)}${on ? s.accent(s.bold(value.label)) : s.bold(value.label)}${copied}`);
+				if (shown(item) || value.mask === "none") for (const line of wrap(value.value, inner)) body.push(`${bar(on)}${line}`);
+				else body.push(`${bar(on)}${truncate(dimDots(masked(value.value, value.mask), s), inner)}`);
+				for (const line of wrap(value.about, inner)) body.push(`${bar(on)}${s.dim(line)}`);
+				spans.push([start, body.length]);
+				body.push("");
+				index += 1;
+			}
+		}
+	} else {
+		let index = 0;
+		for (const block of screen.guide) {
+			body.push(`  ${s.dim(s.bold(block.title.toUpperCase()))}`);
+			let after = false;
+			for (const line of block.lines) {
+				if (typeof line === "string") {
+					if (after) body.push("");
+					for (const part of wrap(line, inner)) body.push(`    ${part}`);
+					after = false;
+					continue;
+				}
+				after = true;
+				const on = index === selected;
+				const item = list[index];
+				const start = body.length;
+				const text = line.command;
+				const copied = state.copied.has(item.id) ? ` ${s.green("✓")}` : "";
+				wrap(text, inner - 2).forEach((part, i) => {
+					const prompt = i === 0 ? s.dim("$ ") : "  ";
+					body.push(`${bar(on)}${prompt}${on ? s.accent(part) : part}${i === 0 ? copied : ""}`);
+				});
+				spans.push([start, body.length]);
+				index += 1;
+			}
+			body.push("");
+		}
+	}
+	const keys = (pairs) => {
+		const lines = [];
+		let line = "";
+		for (const [key, what] of pairs) {
+			const hint = `${s.accent(key)} ${s.dim(what)}`;
+			if (line !== "" && width(line) + 3 + width(hint) > columns - 4) {
+				lines.push(`  ${line}`);
+				line = hint;
+			} else line = line === "" ? hint : `${line}   ${hint}`;
+		}
+		return [...lines, `  ${line}`];
+	};
+	const footer = state.confirming ? [
+		rule,
+		...wrap(`Have you saved ${saved(count)}? They won't be shown again. (y/N)`, columns - 6).map((line, i) => `  ${i === 0 ? s.accent("?") : " "} ${s.bold(line)}`),
+		...keys([["y", "yes, leave"], ["n", "stay"]])
+	] : [
+		rule,
+		...keys([
+			["↑↓", "move"],
+			["c", "copy"],
+			...state.view === "values" ? [["r", "reveal"], ["R", "reveal all"]] : [],
+			["w", state.view === "values" ? "where these go" : "back to the values"],
+			["q", "done"]
+		]),
+		state.status === "" ? "" : `  ${state.status}`
+	];
+	while (body.at(-1) === "") body.pop();
+	const height = Math.max(1, rows - header.length - footer.length - 1);
+	const [start, end] = spans[selected] ?? [0, 0];
+	let scroll = state.scroll[state.view];
+	if (start < scroll) scroll = start;
+	if (end > scroll + height) scroll = end - height;
+	scroll = Math.max(0, Math.min(scroll, Math.max(0, body.length - height)));
+	state.scroll[state.view] = scroll;
+	const visible = body.slice(scroll, scroll + height);
+	const more = [scroll > 0 ? "↑" : "", scroll + height < body.length ? "↓" : ""].join("");
+	const filler = Array.from({ length: height - visible.length }, () => "");
+	const scrolled = more === "" ? "" : `  ${s.dim(`${more} more`)}`;
+	return [
+		...header,
+		...visible,
+		...filler,
+		scrolled,
+		...footer
+	].slice(0, rows).map((line) => truncate(line, columns));
+}
+/**
+* Show `screen` on the alternate screen until the operator leaves it,
+* having said the values are saved. Nothing it shows reaches the main
+* screen, on any way out: q, Ctrl-C, a signal or an error.
+*/
+async function showSecrets(terminal, screen, clipboard) {
+	const { keys, out } = terminal;
+	const s = style(out);
+	const state = initialState();
+	const draw = () => {
+		const lines = render(screen, state, out.columns || 80, out.rows || 24, s);
+		out.write(`\x1b[H${lines.map((line, i) => `\x1b[${i + 1};1H${line}\x1b[K`).join("")}\x1b[J`);
+	};
+	const board = clipboard ?? new Clipboard((sequence) => out.write(sequence), () => {
+		if (state.status.startsWith("Copied")) {
+			state.status = s.dim("Cleared the clipboard.");
+			draw();
+		}
+	});
+	let shown = true;
+	const leave = () => {
+		if (!shown) return;
+		shown = false;
+		out.write("\x1B[?25h\x1B[?1049l");
+	};
+	const signals = [
+		"SIGINT",
+		"SIGTERM",
+		"SIGHUP"
+	].map((signal) => {
+		const handler = () => {
+			leave();
+			keys.setRawMode?.(false);
+			process.exit(128 + {
+				SIGINT: 2,
+				SIGTERM: 15,
+				SIGHUP: 1
+			}[signal]);
+		};
+		process.on(signal, handler);
+		return () => process.off(signal, handler);
+	});
+	process.on("exit", leave);
+	const resize = () => draw();
+	out.on("resize", resize);
+	out.write("\x1B[?1049h\x1B[?25l\x1B[2J");
+	try {
+		draw();
+		await readKeys(keys, async (key) => {
+			const done = await press(key, screen, state, board, s);
+			if (!done) draw();
+			return done;
+		});
+	} finally {
+		await board.settle();
+		leave();
+		out.off("resize", resize);
+		process.off("exit", leave);
+		for (const off of signals) off();
+	}
+}
+/** Act on one key; true to leave. */
+async function press(key, screen, state, clipboard, s) {
+	const quit = key.name === "q" || key.name === "escape" || key.ctrl === true && key.name === "c";
+	if (state.confirming) {
+		if (key.name === "y" || key.ctrl === true && key.name === "c") return true;
+		state.confirming = false;
+		return false;
+	}
+	if (quit) {
+		state.confirming = true;
+		return false;
+	}
+	const list = items(screen, state.view);
+	const at = state.selected[state.view];
+	const item = list[at];
+	if (key.name === "up" || key.name === "k" || key.name === "tab" && key.shift === true) state.selected[state.view] = (at - 1 + list.length) % list.length;
+	else if (key.name === "down" || key.name === "j" || key.name === "tab") state.selected[state.view] = (at + 1) % list.length;
+	else if (key.name === "w") {
+		state.view = state.view === "values" ? "guide" : "values";
+		state.status = "";
+	} else if (key.name === "r" && key.shift === true) {
+		state.revealAll = !state.revealAll;
+		if (!state.revealAll) state.revealed.clear();
+	} else if (key.name === "r" && item !== void 0) {
+		if (state.revealed.has(item.id)) state.revealed.delete(item.id);
+		else state.revealed.add(item.id);
+	} else if ((key.name === "c" || key.name === "return" || key.name === "enter") && item !== void 0) try {
+		const where = await clipboard.copy(item.text);
+		state.copied.add(item.id);
+		state.status = where === "system" ? `Copied ${item.name}. ${s.dim(`The clipboard clears in ${CLEAR_AFTER_MS / 1e3} s, or when you leave.`)}` : `Copied ${item.name}, through the terminal. ${s.dim("Clear the clipboard once it is pasted.")}`;
+	} catch (error) {
+		state.status = s.red(`Couldn't copy ${item.name}: ${error instanceof Error ? error.message : String(error)}. Reveal it with r.`);
+	}
+	return false;
+}
+/** Masking dots, dimmed: what is hidden recedes. */
+function dimDots(text, s) {
+	return text.replace(/•+/g, (dots) => s.dim(dots));
+}
+function lower(label) {
+	return label.replace(/^[A-Z](?![A-Z])/, (first) => first.toLowerCase());
+}
+//#endregion
+//#region src/keys.ts
+const BASE32 = "abcdefghijklmnopqrstuvwxyz234567";
+/**
+* A vault ID: the day, so that ids read in order, and six random base32
+* characters, so that two made the same day differ. The vault refuses two
+* keys under one id.
+*/
+function vaultKeyId(now = /* @__PURE__ */ new Date()) {
+	const suffix = [...randomBytes(6)].map((byte) => BASE32[byte % 32]).join("");
+	return `vault-${now.toISOString().slice(0, 10)}-${suffix}`;
+}
+/** Two fresh keys, each 32 random bytes in base64, and the vault key's id. */
+function generateKeys(now = /* @__PURE__ */ new Date()) {
+	const key = () => randomBytes(32).toString("base64");
+	return {
+		APP_KEY: key(),
+		VAULT_KEY_ID: vaultKeyId(now),
+		VAULT_KEY: key()
+	};
+}
+/** The keys as values to save, each with what it is for and where it goes. */
+function keyValues(keys) {
+	return {
+		app: [{
+			label: "App key",
+			value: keys.APP_KEY,
+			mask: "all",
+			about: "Signs the app's sessions, tokens and log entries. Goes in the app, as APP_KEY."
+		}],
+		vault: [{
+			label: "Vault ID",
+			value: keys.VAULT_KEY_ID,
+			mask: "none",
+			about: "Names the vault key, and isn't secret. Goes in the vault, as VAULT_KEY_ID."
+		}, {
+			label: "Vault key",
+			value: keys.VAULT_KEY,
+			mask: "all",
+			about: "Decrypts every value: lose it, and they're lost for good. Goes in the vault, as VAULT_KEY."
+		}]
+	};
+}
+/** Where the keys go: the vault ID as a var and the keys as secrets on Workers, the env files on Node. */
+function keyGuide() {
+	return {
+		workers: [
+			"The vault ID goes under vars in vault/wrangler.jsonc, as VAULT_KEY_ID. The keys are secrets; each command asks for its value:",
+			{ command: "pnpm exec wrangler secret put APP_KEY -c app/wrangler.jsonc" },
+			{ command: "pnpm exec wrangler secret put VAULT_KEY -c vault/wrangler.jsonc" }
+		],
+		node: ["server.env takes APP_KEY; vault.env takes VAULT_KEY_ID and VAULT_KEY."]
+	};
+}
+function keysScreen(keys) {
+	const { app, vault } = keyValues(keys);
+	const guide = keyGuide();
+	return {
+		title: "coffre keys",
+		sections: [{
+			title: "App",
+			values: app
+		}, {
+			title: "Vault",
+			values: vault
+		}],
+		guide: [
+			{
+				title: "On Cloudflare Workers",
+				lines: guide.workers
+			},
+			{
+				title: "On Node",
+				lines: guide.node
+			},
+			{
+				title: "For a rotation",
+				lines: ["Take only the vault ID and key. The vault key they replace moves to previousKeks, and stays there: what it wrapped still needs it. The app key cannot change. docs/keys.md has the steps."]
+			}
+		]
+	};
+}
+/** Why a command that shows secrets will not print them to a pipe or a file. */
+function needsTerminal(command) {
+	return `${command} shows the values it makes on a screen of their own, so that they never reach a file, a pipe or the scrollback, and that needs a terminal. In a script, --json prints them to stdout instead.`;
+}
+/** The stderr warning before --json prints secrets. */
+function jsonWarning(out, secrets) {
+	const s = style(out);
+	out.write(`${s.red("!")} ${s.bold(`--json prints ${secrets} to stdout.`)} ${s.dim("Keep it out of logs, and out of files others can read.")}\n`);
+}
+async function keys(args) {
+	const { values } = parseArgs({
+		args,
+		options: { json: {
+			type: "boolean",
+			default: false
+		} },
+		allowPositionals: false
+	});
+	if (values.json) {
+		jsonWarning(process.stderr, "the app key and the vault key");
+		process.stdout.write(`${JSON.stringify(generateKeys())}\n`);
+		return;
+	}
+	const terminal = openTerminal();
+	if (terminal === null) {
+		process.stderr.write(`coffre keys: ${needsTerminal("coffre keys")}\n`);
+		process.exit(1);
+	}
+	const fresh = generateKeys();
+	try {
+		await showSecrets(terminal, keysScreen(fresh));
+	} finally {
+		release(terminal.keys);
+	}
+	const { out } = terminal;
+	const s = style(out);
+	out.write([
+		"",
+		`  ${s.green("✓")} ${s.bold("The app key and the vault key were shown once.")}`,
+		s.dim(paragraph(out, "They aren't stored anywhere: a lost key can't be recovered.", 4)),
+		"",
+		row(out, s, "Vault ID", `${fresh.VAULT_KEY_ID}, not a secret`),
+		"",
+		""
+	].join("\n"));
+}
+//#endregion
+export { yes as _, keys as a, Cancelled as c, paragraph as d, release as f, wrap as g, truncate as h, keyValues as i, hiddenLine as l, style as m, jsonWarning as n, needsTerminal as o, row as p, keyGuide as r, showSecrets as s, generateKeys as t, openTerminal as u };