@coffre/cli 0.1.6 → 0.1.7

package/dist/main.js

@@ -1,11 +1,325 @@
 #!/usr/bin/env node
-import { T as init, a as keys, w as KINDS } from "./keys-BCKUEb-Y.js";
+import { T as init, _ as select, a as keys, c as Cancelled, f as openTerminal, h as release, u as hiddenLine, v as style, w as KINDS } from "./keys-BCKUEb-Y.js";
 import { i as isRole, r as assignableToEnvironment, t as ROLES } from "./access-CO1kGjWW.js";
-import { parseArgs, promisify } from "node:util";
+import { inspect, parseArgs, promisify } from "node:util";
 import { execFile, spawn } from "node:child_process";
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir, hostname } from "node:os";
 import { dirname, join, resolve } from "node:path";
+import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes, timingSafeEqual } from "node:crypto";
+//#region ../client/dist/index.js
+/**
+* The config from `name=value` arguments, as the CLI takes them. A field with
+* several options takes them comma-separated, and one left out gets what the
+* form preselects. Text goes as typed, for the server to check.
+*/
+function configFromArguments(provider, assignments) {
+	const config = {};
+	for (const assignment of assignments) {
+		const equals = assignment.indexOf("=");
+		const name = equals === -1 ? assignment : assignment.slice(0, equals);
+		const field = provider.fields.find((candidate) => candidate.name === name);
+		if (equals === -1 || field === void 0) {
+			const names = provider.fields.map((candidate) => candidate.name).join(", ");
+			throw new Error(`${provider.label} takes ${names} as name=value; got ${JSON.stringify(assignment)}`);
+		}
+		if (Object.hasOwn(config, name)) throw new Error(`${name} is given twice`);
+		const value = assignment.slice(equals + 1);
+		if (field.type === "text") config[name] = value;
+		else if (field.multiple) config[name] = value.split(",").map((item) => item.trim()).filter((item) => item !== "");
+		else config[name] = value;
+	}
+	for (const field of provider.fields) if (field.type === "options" && !Object.hasOwn(config, field.name)) config[field.name] = field.multiple ? field.initial : field.initial[0];
+	return config;
+}
+/** The API's error shape, `{ error, message }`, with the HTTP status. */
+const COFFRE_ERROR = Symbol.for("@coffre/client:CoffreError");
+var CoffreError = class extends Error {
+	/**
+	* `@coffre/ui`'s prebuilt pages bundle a copy of this class, and a page is
+	* handed a client the server made with this package's. So `instanceof`
+	* asks for the mark every copy leaves, rather than for this copy's prototype.
+	*/
+	static [Symbol.hasInstance](value) {
+		return typeof value === "object" && value !== null && COFFRE_ERROR in value;
+	}
+	[COFFRE_ERROR] = true;
+	status;
+	code;
+	/** The vault's own code when it refused: `no_grant`, `removed`, `bulk_limit`, ... */
+	reason;
+	constructor(status, code, message, reason) {
+		super(message);
+		this.name = "CoffreError";
+		this.status = status;
+		this.code = code;
+		this.reason = reason;
+	}
+};
+/** `market/prod/KEY` as route parameters. */
+function place(path) {
+	const [project = "", environment = "", key = ""] = path.replace(/^\/+|\/+$/g, "").split("/");
+	return {
+		project,
+		environment,
+		key
+	};
+}
+function createClient(options) {
+	const origin = options.url.replace(/\/+$/, "");
+	const transport = options.transport ?? ((request) => fetch(request));
+	async function send(method, path, input) {
+		const url = new URL(`${origin}/api${path}`);
+		const headers = new Headers(await options.headers?.());
+		let body;
+		if (method === "GET") {
+			for (const [name, value] of Object.entries(input ?? {})) if (value !== void 0 && value !== null) url.searchParams.set(name, String(value));
+		} else if (input !== void 0) {
+			headers.set("content-type", "application/json");
+			body = JSON.stringify(input);
+		}
+		const response = await transport(new Request(url, {
+			method,
+			headers,
+			body
+		}));
+		const payload = await response.json().catch(() => null);
+		if (!response.ok) {
+			const error = payload;
+			throw new CoffreError(response.status, typeof error?.error === "string" ? error.error : "http_error", typeof error?.message === "string" ? error.message : `request failed with status ${response.status}`, typeof error?.reason === "string" ? error.reason : void 0);
+		}
+		return payload;
+	}
+	/** A route key and its parameters as a method and a path. */
+	function address(key, params) {
+		const [method, pattern] = key.split(" ");
+		return [method, pattern.replace(/:(\w+)/g, (_, name) => encodeURIComponent(params[name]))];
+	}
+	/** Any route by its key: `call('GET /secrets/:project/:environment', { project, environment })`. */
+	async function call(key, ...[params, input]) {
+		const [method, path] = address(key, params);
+		return await send(method, path, input);
+	}
+	return {
+		call,
+		/** How this instance signs people in. Answers anyone, signed in or not. */
+		auth: () => send("GET", "/auth", void 0),
+		/** Who I am, and every place I can reach. */
+		me: () => call("GET /me", {}),
+		projects: {
+			/** With their environments. */
+			list: () => call("GET /projects", {}),
+			create: (project, input) => call("PUT /projects/:project", { project }, input),
+			update: (project, patch) => call("PATCH /projects/:project", { project }, patch)
+		},
+		environments: {
+			create: (path, input) => call("PUT /projects/:project/:environment", place(path), input),
+			update: (path, patch) => call("PATCH /projects/:project/:environment", place(path), patch)
+		},
+		secrets: {
+			/** Keys, versions and who changed what; never values. */
+			list: (path) => call("GET /secrets/:project/:environment", place(path)),
+			/** Decrypts one secret, or every secret in an environment. Logged in your name. */
+			reveal: (path) => call("POST /reveals", {}, { path }),
+			/** One transaction, a version and an audit entry per key; `null` archives. */
+			set: (path, values) => call("PATCH /secrets/:project/:environment", place(path), values),
+			/**
+			* What `set` would do to each key, `added`, `changed`, `unchanged` or
+			* `archived`, and nothing else: no value comes back and nothing is
+			* written. Comparing opens the current values, logged as reads.
+			*/
+			dryRun: (path, values) => {
+				const [method, route] = address("PATCH /secrets/:project/:environment", place(path));
+				return send(method, `${route}?dryRun=1`, values);
+			},
+			history: (path) => call("GET /secrets/:project/:environment/:key/versions", place(path)),
+			/** A new version holding the old one's value. */
+			restore: (path, version) => call("POST /secrets/:project/:environment/:key/restore", place(path), { version }),
+			rename: (path, key) => call("PATCH /secrets/:project/:environment/:key", place(path), { key }),
+			update: (path, patch) => call("PATCH /secrets/:project/:environment/:key", place(path), patch)
+		},
+		members: {
+			/** People and tokens, their role and their access; at a place, those who reach it. */
+			list: (path) => call("GET /members", {}, { path }),
+			/** What they hold, and what to rotate if they leave. */
+			get: (member) => call("GET /members/:member", { member }),
+			add: (member, input = {}) => call("PUT /members/:member", { member }, input),
+			/** Offboards; returns what to rotate. */
+			remove: (member) => call("DELETE /members/:member", { member })
+		},
+		tokens: {
+			list: (member) => call("GET /members/:member/tokens", { member }),
+			/** The value is in the answer, and only there. */
+			issue: (member, input) => call("POST /members/:member/tokens", { member }, input),
+			revoke: (member, id) => call("DELETE /members/:member/tokens/:id", {
+				member,
+				id
+			})
+		},
+		access: { 
+		/** What they should hold at each place; the server applies the difference. `null` revokes. */
+set: (member, access) => call("PATCH /access/:member", { member }, access) },
+		/** Where I am signed in. Only where coffre runs its own sign-in. */
+		sessions: {
+			list: () => call("GET /sessions", {}),
+			revoke: (id) => call("DELETE /sessions/:id", { id })
+		},
+		/** The accounts I sign in with. */
+		identities: {
+			list: () => call("GET /identities", {}),
+			unlink: (id) => call("DELETE /identities/:id", { id })
+		},
+		/** A `coffre login` waiting for someone to approve it, by the code it shows. */
+		deviceLogins: {
+			get: (code) => call("GET /device-logins/:code", { code }),
+			decide: (code, approve) => call("POST /device-logins/:code", { code }, { approve })
+		},
+		syncs: {
+			/** Where a sync can push on this instance, and what each asks for. */
+			providers: () => call("GET /syncs/providers", {}),
+			list: (path) => call("GET /syncs/:project/:environment", place(path)),
+			add: (path, input) => call("POST /syncs/:project/:environment", place(path), input),
+			update: (id, patch) => call("PATCH /syncs/by-id/:id", { id }, patch),
+			remove: (id) => call("DELETE /syncs/by-id/:id", { id }),
+			run: (id) => call("POST /syncs/by-id/:id/runs", { id })
+		},
+		audit: {
+			list: (query = {}) => call("GET /audit", {}, query),
+			verify: () => call("GET /audit/verification", {}),
+			/** What an escrowed key is checked against: public material, owners and root admins only. */
+			keys: () => call("GET /audit/keys", {})
+		}
+	};
+}
+/**
+* What writing these entries (a parsed `.env` file) would do, from a dry run
+* of the write: the server compares, so no value leaves it, and the values it
+* opens to compare are logged as reads. `changes` is what to pass to
+* `secrets.set`: the keys that differ, so an unchanged value does not become
+* a new version.
+*/
+async function planImport(coffre, path, entries) {
+	const values = Object.create(null);
+	for (const { key, value } of entries) values[key] = value;
+	const [listed, compared] = await Promise.allSettled([coffre.secrets.list(path), coffre.secrets.dryRun(path, { ...values })]);
+	if (listed.status === "rejected") throw listed.reason;
+	if (compared.status === "rejected") throw compared.reason;
+	const [{ keys }, dryRun] = [listed.value, compared.value];
+	const versions = new Map(keys.map((entry) => [entry.key, entry.version]));
+	const plan = [];
+	const changes = Object.create(null);
+	for (const [key, value] of Object.entries(values)) {
+		const action = dryRun.keys[key];
+		plan.push({
+			key,
+			action,
+			version: versions.get(key) ?? null
+		});
+		if (action !== "unchanged") changes[key] = value;
+	}
+	return {
+		plan,
+		changes: { ...changes }
+	};
+}
+//#endregion
+//#region src/verify/checks.ts
+/** A check that failed: what went wrong, and what was seen instead. */
+var Failure = class extends Error {
+	detail;
+	constructor(message, detail) {
+		super(message);
+		this.detail = detail;
+	}
+};
+/** A check that cannot run against this instance, and why. */
+var Skip = class extends Error {};
+function expect(condition, message, detail) {
+	if (!condition) throw new Failure(message, detail);
+}
+/** The status coffre turned a call away with. A call that went through fails the check: `what` says what it should not have done. */
+async function refused(what, call) {
+	const outcome = await call.then((value) => ({ value }), (error) => ({ error }));
+	if ("value" in outcome) throw new Failure(`${what}, and was let`, outcome.value);
+	if (!(outcome.error instanceof CoffreError)) throw outcome.error;
+	expect(outcome.error.status >= 400 && outcome.error.status < 500, `${what}, and failed with ${outcome.error.status}`, outcome.error.message);
+	return outcome.error;
+}
+/** End the command at once, for a mistake in how it was called: `message` on stderr, or on stdout for an exit 0 (help). */
+function stop(code, message) {
+	(code === 0 ? process.stdout : process.stderr).write(`${message}\n`);
+	process.exit(code);
+}
+/** The API as a service or the CLI calls it, with a bearer token: every refusal thrown, as a check wants it. */
+function bearer(origin, token) {
+	return createClient({
+		url: origin,
+		headers: () => ({ authorization: `Bearer ${token}` })
+	});
+}
+/** The checks of one run, each printed as it ends: a mark, its name, and a line. */
+var Checks = class {
+	#out;
+	#results = [];
+	constructor(out) {
+		this.#out = out;
+	}
+	get results() {
+		return this.#results;
+	}
+	get failed() {
+		return this.#results.filter(({ status }) => status === "fail").map(({ name }) => name);
+	}
+	/**
+	* Run one check. `needs` holds what earlier checks made: if one is
+	* missing, this one is skipped rather than run against an instance that
+	* is not in the state it expects.
+	*/
+	async check(name, needs, run) {
+		const missing = Object.keys(needs).filter((key) => needs[key] === void 0 || needs[key] === null);
+		if (missing.length > 0) {
+			this.#print(name, "skip", `no ${missing.join(" or ")}: an earlier check failed`);
+			return;
+		}
+		try {
+			const passed = await run(needs);
+			this.#print(name, "ok", typeof passed === "string" ? passed : passed.detail);
+			return typeof passed === "string" ? void 0 : passed.value;
+		} catch (error) {
+			if (error instanceof Skip) {
+				this.#print(name, "skip", error.message);
+				return;
+			}
+			const detail = error instanceof Failure ? error.detail : error instanceof Error ? error.stack : error;
+			this.#print(name, "fail", error instanceof Error ? error.message : String(error), detail);
+			return;
+		}
+	}
+	#print(name, status, line, detail) {
+		this.#results.push({
+			name,
+			status,
+			line
+		});
+		const s = style(this.#out);
+		const mark = {
+			ok: s.green("✓"),
+			fail: s.red("✗"),
+			skip: s.dim("–")
+		}[status];
+		const text = status === "skip" ? s.dim(line) : status === "fail" ? s.red(line) : line;
+		this.#out.write(`  ${mark} ${status === "skip" ? s.dim(name.padEnd(19)) : name.padEnd(19)} ${text}\n`);
+		if (status === "fail" && detail !== void 0) {
+			const shown = typeof detail === "string" ? detail : inspect(detail, {
+				depth: 6,
+				breakLength: 100,
+				colors: false
+			});
+			this.#out.write(`${s.dim(shown.replace(/^/gm, " ".repeat(24)))}\n`);
+		}
+	}
+};
+//#endregion
 //#region src/instance.ts
 const MODES = ["signin", "cloudflare"];
 function emptyStore() {
@@ -190,219 +504,1064 @@ function withoutSession(store, origin) {
 	};
 }
 //#endregion
-//#region ../client/dist/index.js
+//#region ../client/dist/routes.js
+function getCalls({ places, secrets, members, services }) {
+	const first = places[0];
+	return {
+		"GET /me": [{ params: {} }],
+		"GET /projects": [{ params: {} }],
+		"GET /secrets/:project/:environment": places.map((params) => ({ params })),
+		"GET /secrets/:project/:environment/:key/versions": secrets.map((params) => ({ params })),
+		"GET /members": [{ params: {} }, ...first === void 0 ? [] : [{
+			params: {},
+			input: { path: `${first.project}/${first.environment}` }
+		}]],
+		"GET /members/:member": members.map((member) => ({ params: { member } })),
+		"GET /members/:member/tokens": services.map((member) => ({ params: { member } })),
+		"GET /sessions": [{ params: {} }],
+		"GET /identities": [{ params: {} }],
+		"GET /device-logins/:code": [{ params: { code: "BCDF-GHJK" } }],
+		"GET /syncs/providers": [{ params: {} }],
+		"GET /syncs/:project/:environment": places.map((params) => ({ params })),
+		"GET /audit": [{
+			params: {},
+			input: { limit: 500 }
+		}, {
+			params: {},
+			input: {
+				limit: 500,
+				detail: "1"
+			}
+		}],
+		"GET /audit/verification": [{ params: {} }],
+		"GET /audit/keys": [{ params: {} }]
+	};
+}
+/** Each GET call as a URL, with its parameters and query filled in. */
+function getUrls(origin, calls) {
+	const urls = [];
+	for (const [key, asks] of Object.entries(calls)) for (const { params, input } of asks) urls.push({
+		key,
+		url: address(origin, key, params, input)
+	});
+	return urls;
+}
+/** Every route, whatever its method. */
+const EVERY_ROUTE = {
+	"GET /me": true,
+	"GET /projects": true,
+	"PUT /projects/:project": true,
+	"PATCH /projects/:project": true,
+	"PUT /projects/:project/:environment": true,
+	"PATCH /projects/:project/:environment": true,
+	"GET /secrets/:project/:environment": true,
+	"PATCH /secrets/:project/:environment": true,
+	"PATCH /secrets/:project/:environment/:key": true,
+	"GET /secrets/:project/:environment/:key/versions": true,
+	"POST /secrets/:project/:environment/:key/restore": true,
+	"POST /reveals": true,
+	"GET /members": true,
+	"GET /members/:member": true,
+	"PUT /members/:member": true,
+	"DELETE /members/:member": true,
+	"GET /members/:member/tokens": true,
+	"POST /members/:member/tokens": true,
+	"DELETE /members/:member/tokens/:id": true,
+	"PATCH /access/:member": true,
+	"GET /sessions": true,
+	"DELETE /sessions/:id": true,
+	"GET /identities": true,
+	"DELETE /identities/:id": true,
+	"GET /device-logins/:code": true,
+	"POST /device-logins/:code": true,
+	"GET /syncs/providers": true,
+	"GET /syncs/:project/:environment": true,
+	"POST /syncs/:project/:environment": true,
+	"PATCH /syncs/by-id/:id": true,
+	"DELETE /syncs/by-id/:id": true,
+	"POST /syncs/by-id/:id/runs": true,
+	"GET /audit": true,
+	"GET /audit/verification": true,
+	"GET /audit/keys": true
+};
+/**
+* Every route as a method and a URL, each parameter a made-up value: what
+* a caller with no right to any of them would send.
+*/
+function everyRoute(origin) {
+	return Object.keys(EVERY_ROUTE).map((key) => {
+		const [method, pattern] = key.split(" ");
+		return {
+			key,
+			method,
+			url: `${origin}/api${pattern.replace(/:(\w+)/g, (_, name) => encodeURIComponent(name === "member" ? "token:conformance-nobody" : "conformance-nobody"))}`
+		};
+	});
+}
+function address(origin, key, params, input) {
+	const path = key.slice(4).replace(/:(\w+)/g, (_, name) => encodeURIComponent(params[name]));
+	const url = new URL(`${origin}/api${path}`);
+	for (const [name, value] of Object.entries(input ?? {})) url.searchParams.set(name, String(value));
+	return url.href;
+}
+//#endregion
+//#region src/verify/anonymous.ts
+/** The page anyone may open. Every other page sends no one to /login. */
+const OPEN_PAGES = ["/login"];
+/** The pages behind sign-in, whatever the instance holds. */
+const CLOSED_PAGES = [
+	"/",
+	"/account",
+	"/access",
+	"/audit",
+	"/auth/device",
+	"/settings",
+	"/projects",
+	"/users",
+	"/tokens",
+	"/unregistered"
+];
+/** A made-up place and member, which no instance has. */
+const NOWHERE = {
+	project: "conformance-nowhere",
+	environment: "none"
+};
+const NOBODY = "token:conformance-nobody";
+/** The checks anyone can run: no sign-in, nothing written. */
+async function anonymousChecks(report, origin) {
+	await report.check("health", {}, () => reachable(origin));
+	await report.check("headers", {}, () => headers(origin));
+	await report.check("anonymous api", {}, () => anonymousApi(origin));
+	await report.check("forged cross-site", {}, () => forgedCrossSite(origin));
+	await report.check("sign-in info", {}, () => signinInfo(origin));
+	await report.check("anonymous answers", {}, () => anonymousAnswers(origin));
+}
+/** An instance someone else runs: up, and its scheduled job beating. */
+async function reachable(origin) {
+	const live = await fetch(`${origin}/livez`);
+	expect(live.ok, `/livez answered ${live.status}`);
+	const ready = await fetch(`${origin}/readyz`);
+	expect(ready.ok, `/readyz answered ${ready.status}: is the scheduled job running?`, await ready.text());
+	return "/livez and /readyz";
+}
+async function headers(origin) {
+	const anonymous = await fetch(`${origin}/api/me`);
+	expect(anonymous.status === 401, `/api/me answered ${anonymous.status} to no one`);
+	securityHeaders(anonymous, "a refusal");
+	const login = await fetch(`${origin}/login`);
+	expect(login.status === 200, `/login answered ${login.status}`);
+	const csp = securityHeaders(login, "/login");
+	const html = await login.text();
+	const nonce = /'nonce-([^']+)'/.exec(csp)[1];
+	expect(html.includes(`nonce="${nonce}"`), "/login's scripts do not carry the policy's nonce");
+	expect(!securityHeaders(await fetch(`${origin}/login`), "/login").includes(`'nonce-${nonce}'`), "two pages were served with the same nonce");
+	const asset = /\/_coffre\/assets\/[\w.-]+\.js/.exec(html)?.[0];
+	expect(asset !== void 0, "/login loads no script from /_coffre/assets/", html.slice(0, 2e3));
+	const script = await fetch(`${origin}${asset}`);
+	expect(script.ok && /javascript/.test(script.headers.get("content-type") ?? ""), `${asset} answered ${script.status} ${script.headers.get("content-type")}`);
+	const allowed = (await fetch(`${origin}/api/me`, { headers: { origin: "https://attacker.example" } })).headers.get("access-control-allow-origin");
+	expect(allowed === null, `the API allows another origin to read it: ${allowed}`);
+	return `a fresh CSP nonce per page, frames refused, nosniff; no CORS; ${asset} served`;
+}
+function securityHeaders(response, what) {
+	const csp = response.headers.get("content-security-policy") ?? "";
+	expect(/script-src 'self' 'nonce-[^']+'/.test(csp), `${what}: no nonce-based script-src`, csp);
+	expect(csp.includes("frame-ancestors 'none'"), `${what}: frames not refused`, csp);
+	expect(response.headers.get("x-content-type-options") === "nosniff", `${what}: no nosniff`);
+	expect(response.headers.get("x-frame-options") === "DENY", `${what}: no x-frame-options DENY`);
+	expect(response.headers.get("cross-origin-resource-policy") === "same-origin", `${what}: other sites may embed it`);
+	expect(/no-store/.test(response.headers.get("cache-control") ?? ""), `${what}: may be cached`);
+	if (response.url.startsWith("https:")) {
+		const hsts = response.headers.get("strict-transport-security") ?? "";
+		expect(/max-age=\d{7,}/.test(hsts), `${what}: no strict-transport-security for months or more`, hsts);
+	}
+	return csp;
+}
+/** Every route, whatever its method, turns away a caller with no credential, and says nothing else. */
+async function anonymousApi(origin) {
+	const routes = everyRoute(origin);
+	for (const { key, method, url } of routes) {
+		const response = await fetch(url, {
+			method,
+			headers: { "content-type": "application/json" },
+			body: method === "GET" ? void 0 : "{}"
+		});
+		const text = await response.text();
+		expect(response.status === 401, `${key} answered ${response.status} to no one`, text);
+		expect(onlyRefusal(text), `${key} refused no one with more than a refusal`, text);
+	}
+	return `${routes.length} routes, every method: 401, and nothing but the refusal`;
+}
+/**
+* A change sent with a session cookie from another site's page is refused
+* before the cookie is even looked at, so a made-up one shows it: a real
+* cookie would get the same answer. Behind Cloudflare Access the same holds
+* for its cookie and assertion.
+*/
+async function forgedCrossSite(origin) {
+	const changes = everyRoute(origin).filter((route) => route.method !== "GET");
+	const forged = {
+		cookie: "coffre_session=conformance-forged; __Host-coffre_session=conformance-forged; CF_Authorization=conformance-forged",
+		"cf-access-jwt-assertion": "conformance-forged",
+		origin: "https://attacker.example",
+		"sec-fetch-site": "cross-site",
+		"content-type": "application/json"
+	};
+	for (const { key, method, url } of [...changes, {
+		key: "POST /auth/signout",
+		method: "POST",
+		url: `${origin}/auth/signout`
+	}]) {
+		const response = await fetch(url, {
+			method,
+			headers: forged,
+			body: "{}",
+			redirect: "manual"
+		});
+		const text = await response.text();
+		expect(response.status === 403, `${key} from another site answered ${response.status}`, text);
+	}
+	return `${changes.length + 1} changes, sign-out included, from another site with a session cookie: 403`;
+}
+/** `GET /api/auth` names how to sign in, and nothing more. */
+async function signinInfo(origin) {
+	const response = await fetch(`${origin}/api/auth`);
+	expect(response.ok, `/api/auth answered ${response.status}`);
+	const info = await response.json();
+	expect(sameKeys(info, ["access", "signin"]), "/api/auth says more than how to sign in", info);
+	expect(info.signin === null !== (info.access === null), "/api/auth names neither or both ways in", info);
+	if (info.access !== null) {
+		expect(sameKeys(info.access, ["assertion"]) && info.access.assertion === false, "/api/auth says more of Access than whether it vouched", info);
+		return "Cloudflare Access, and nothing more";
+	}
+	const signin = info.signin;
+	expect(sameKeys(signin, [
+		"note",
+		"providers",
+		"title"
+	]), "/api/auth says more of its sign-in than a page needs", signin);
+	for (const provider of signin.providers) expect(sameKeys(provider, [
+		"brand",
+		"id",
+		"label"
+	]), `/api/auth says more of ${provider.id} than its button`, provider);
+	return `coffre's sign-in through ${signin.providers.map((provider) => provider.id).join(", ")}, and nothing more`;
+}
+/**
+* Nothing that could be a stored value in what no one is shown. Without a
+* canary this is a best effort: the API's refusals are checked to be only
+* refusals above, every closed page must send no one to /login with an
+* empty body, and the open pages must carry no credential coffre issues.
+*/
+async function anonymousAnswers(origin) {
+	const pages = [
+		...CLOSED_PAGES,
+		`/projects/${NOWHERE.project}`,
+		`/projects/${NOWHERE.project}/${NOWHERE.environment}`
+	];
+	for (const path of pages) {
+		let at = path;
+		for (let hop = 0; at !== "/login"; hop++) {
+			const response = await fetch(`${origin}${at}`, { redirect: "manual" });
+			const text = await response.text();
+			const to = new URL(response.headers.get("location") ?? at, origin);
+			expect(hop < 3 && response.status >= 300 && response.status < 400 && to.origin === origin, `${at} answered no one ${response.status}${response.headers.has("location") ? ` to ${to.href}` : ""}, not a redirect on to /login`, text.slice(0, 2e3));
+			expect(text.trim().length < 512, `${at} sent no one a body with its redirect`, text.slice(0, 2e3));
+			at = to.pathname;
+		}
+	}
+	for (const path of OPEN_PAGES) {
+		const response = await fetch(`${origin}${path}`, { redirect: "manual" });
+		const text = await response.text();
+		expect(response.status === 200, `${path} answered ${response.status}`);
+		const issued = /coffre_(svc|cli|web)_[A-Za-z0-9_-]{20,}/.exec(text);
+		expect(issued === null, `${path} carries a credential coffre issues`, issued?.[0]);
+	}
+	return `best effort, without a canary: ${pages.length} closed pages send no one to /login with nothing else; /login carries no credential`;
+}
+/** `{ error, message }` and nothing else. */
+function onlyRefusal(text) {
+	try {
+		return sameKeys(JSON.parse(text), ["error", "message"]);
+	} catch {
+		return false;
+	}
+}
+function sameKeys(value, keys) {
+	return typeof value === "object" && value !== null && JSON.stringify(Object.keys(value).sort()) === JSON.stringify(keys);
+}
+//#endregion
+//#region src/verify/token.ts
+/** Parse `<project>/<environment>/<KEY>=<value>`, or the path alone with the value given apart. */
+function parseCanary(text, value) {
+	const at = text.indexOf("=");
+	const path = at === -1 ? text : text.slice(0, at);
+	const given = at === -1 ? value : text.slice(at + 1);
+	const parts = path.split("/");
+	if (parts.length !== 3 || parts.some((part) => part === "")) throw new Error(`the canary is <project>/<environment>/<KEY>, not "${path}"`);
+	if (given === void 0 || given === "") throw new Error("the canary has no value: pass it after =, on stdin, or in COFFRE_CONFORMANCE_CANARY");
+	const [project, environment, key] = parts;
+	return {
+		project,
+		environment,
+		key,
+		value: given
+	};
+}
+/**
+* The checks with a service token that reads the canary, and audits its
+* project. `prefix` names them apart, run twice; `verification` false leaves
+* out the last, which a token can only skip, for a caller that verifies the
+* chain otherwise.
+*/
+async function tokenChecks(report, origin, setup, { prefix = "", verification = true } = {}) {
+	const api = setup.token === void 0 ? void 0 : bearer(origin, setup.token);
+	const token = await report.check(`${prefix}token`, {
+		api,
+		canary: setup.canary
+	}, ({ api, canary }) => whoIsToken(origin, api, canary));
+	const needs = {
+		api,
+		canary: setup.canary,
+		token,
+		secret: setup.token
+	};
+	await report.check(`${prefix}token reveal`, needs, ({ api, canary, token }) => tokenReveal(api, canary, token));
+	await report.check(`${prefix}token scan`, needs, ({ canary, secret }) => tokenScan(origin, secret, canary));
+	await report.check(`${prefix}token scope`, needs, ({ api, canary }) => tokenScope(api, canary));
+	if (verification) await report.check(`${prefix}token verification`, { api }, ({ api }) => tokenVerification(api));
+}
+/** The token is a service's, and reads the canary's environment. */
+async function whoIsToken(origin, api, canary) {
+	if ((await (await fetch(`${origin}/api/auth`)).json()).signin === null) throw new Skip("behind Cloudflare Access, coffre issues no service tokens: the token's checks need coffre's own sign-in");
+	const me = await api.me();
+	expect(me.principal.type === "service", `the token is ${me.principal.type}:${me.principal.id}'s, not a service's`);
+	const member = `token:${me.principal.id}`;
+	const place = `${canary.project}/${canary.environment}`;
+	expect(me.environments.find((env) => `${env.project}/${env.environment}` === place)?.permissions.includes("secret.read"), `${member} cannot read ${place}`, me.environments);
+	const { keys } = await api.secrets.list(place);
+	expect(keys.some((key) => key.key === canary.key), `${place} holds no ${canary.key}`, keys.map((key) => key.key));
+	return {
+		detail: `${member}, reading ${place}`,
+		value: { member }
+	};
+}
+/** Reveal the canary once, and find its `secret.read` in the audit log, by the reveal's request. */
+async function tokenReveal(api, canary, token) {
+	const path = `${canary.project}/${canary.environment}`;
+	const { operationId, values } = await api.secrets.reveal(`${path}/${canary.key}`);
+	expect(values[canary.key] === canary.value, `${path}/${canary.key} is not the value given as the canary`);
+	let entries;
+	try {
+		({entries} = await api.audit.list({
+			path,
+			actor: token.member,
+			limit: 50
+		}));
+	} catch (error) {
+		if (error instanceof CoffreError && error.status === 403) throw new Skip(`the token holds no audit.read on ${canary.project}, so the reveal's entry cannot be looked for`);
+		throw error;
+	}
+	const read = entries.filter((entry) => entry.operationId === operationId);
+	expect(read.length === 1, `the reveal is logged ${read.length} times, not once`, entries.slice(0, 5));
+	const [entry] = read;
+	expect(entry.action === "secret.read" && entry.decision === "allow" && entry.key === canary.key && entry.requestId !== null, "the reveal's entry is not an allowed read of the canary, under a request", entry);
+	return `one secret.read of ${canary.key}, entry ${entry.seq}, under request ${entry.requestId}`;
+}
+/**
+* The canary's value, in any answer to a GET route as the token or as no
+* one, or in any page. The reveal is the only answer allowed to carry it.
+*/
+async function tokenScan(origin, token, canary) {
+	const me = await bearer(origin, token).me();
+	const member = `token:${me.principal.id}`;
+	const listed = me.environments.map(({ project, environment }) => ({
+		project,
+		environment
+	}));
+	const calls = getCalls({
+		places: [...listed, NOWHERE],
+		secrets: [{
+			project: canary.project,
+			environment: canary.environment,
+			key: canary.key
+		}, {
+			...NOWHERE,
+			key: "NONE"
+		}],
+		members: [
+			member,
+			NOBODY,
+			"user:nobody@conformance.example"
+		],
+		services: [member, NOBODY]
+	});
+	const forms = [
+		canary.value,
+		Buffer.from(canary.value).toString("base64"),
+		Buffer.from(canary.value).toString("hex")
+	];
+	const leaks = [];
+	const callers = [["the token", { authorization: `Bearer ${token}` }], ["no one", {}]];
+	let answers = 0;
+	const look = async (what, url, headers) => {
+		const text = await (await fetch(url, {
+			headers,
+			redirect: "manual"
+		})).text();
+		answers++;
+		if (forms.some((form) => text.includes(form))) leaks.push(what);
+	};
+	for (const { key, url } of getUrls(origin, calls)) for (const [name, headers] of callers) await look(`${key} as ${name}`, url, headers);
+	const pages = [
+		...OPEN_PAGES,
+		...CLOSED_PAGES,
+		...listed.flatMap(({ project, environment }) => [`/projects/${project}`, `/projects/${project}/${environment}`])
+	];
+	for (const path of new Set(pages)) for (const [name, headers] of callers) await look(`the page ${path} as ${name}`, `${origin}${path}`, headers);
+	expect(leaks.length === 0, "the canary's value was found outside its reveal", leaks);
+	return `${answers} answers from ${Object.keys(calls).length} GET routes and ${new Set(pages).size} pages, as the token and as no one: no value`;
+}
+/** The token reaches the canary's project and nothing else: not another environment, project or member. */
+async function tokenScope(api, canary) {
+	const { projects } = await api.projects.list();
+	const seen = projects.map((project) => project.slug);
+	expect(seen.length === 1 && seen[0] === canary.project, `the token sees ${seen.join(", ") || "no project"}, not only ${canary.project}`);
+	const me = await api.me();
+	const own = `${canary.project}/${canary.environment}`;
+	const reads = me.environments.filter((env) => env.permissions.includes("secret.read")).map((env) => `${env.project}/${env.environment}`);
+	expect(reads.length === 1 && reads[0] === own, `the token reads ${reads.join(", ")}, not only ${own}`);
+	const more = [...new Set(me.environments.flatMap((env) => env.permissions))].filter((permission) => permission !== "secret.read" && permission !== "audit.read");
+	expect(more.length === 0, `the token holds more than reading: ${more.join(", ")}`);
+	const others = projects[0].environments.map((env) => `${canary.project}/${env.slug}`).filter((path) => path !== own);
+	const nowhere = `${NOWHERE.project}/${NOWHERE.environment}`;
+	let refusals = 0;
+	for (const path of [...others, nowhere]) {
+		await refused(`the token listed ${path}`, api.secrets.list(path));
+		await refused(`the token revealed ${path}`, api.secrets.reveal(path));
+		await refused(`the token read ${path}'s syncs`, api.syncs.list(path));
+		refusals += 3;
+	}
+	await refused(`the token read ${nowhere}'s audit`, api.audit.list({
+		path: nowhere,
+		limit: 1
+	}));
+	await refused("the token listed the members", api.members.list());
+	await refused(`the token read ${NOBODY}`, api.members.get(NOBODY));
+	refusals += 3;
+	try {
+		const { entries } = await api.audit.list({ limit: 500 });
+		const outside = entries.filter((entry) => entry.project !== null && entry.project !== canary.project);
+		expect(outside.length === 0, `the token reads audit entries about ${[...new Set(outside.map((entry) => entry.project))].join(", ")}`);
+	} catch (error) {
+		if (!(error instanceof CoffreError && error.status === 403)) throw error;
+	}
+	const elsewhere = others.length === 0 ? "no other environment" : `${others.length} other environment${others.length === 1 ? "" : "s"}`;
+	return `only ${own}; ${refusals} reads elsewhere refused: ${elsewhere} of ${canary.project}, a made-up place, the members`;
+}
+async function tokenVerification(api) {
+	let verified;
+	try {
+		verified = await api.audit.verify();
+	} catch (error) {
+		if (error instanceof CoffreError && error.status === 403) throw new Skip("verification is for owners and root admins, which this token is not: not checked");
+		throw error;
+	}
+	expect(verified.ok, "the audit log does not verify", verified);
+	return `${verified.entries} entries verify, through entry ${verified.through}`;
+}
+//#endregion
+//#region src/verify/instance.ts
+/** The run's own place on an instance, made the first time, and found after. Nothing else is touched. */
+const PROBE = {
+	project: "conformance",
+	environment: "live",
+	service: "token:conformance-probe",
+	key: "SIGN_IN_CANARY"
+};
+const INSTANCE_USAGE = `usage:
+  coffre verify instance [<url>]
+  COFFRE_TOKEN=<service token> coffre verify instance [<url>] --canary <project>/<environment>/<KEY>[=<value>]
+
+Checks an instance from outside, the current one unless <url> names another:
+
+  as no one        health, headers, every route refusing no one, changes from
+                   another site refused, /api/auth, nothing like a value shown
+  as an owner      with your \`coffre login\` session, as an owner or a root
+                   admin: finds or makes conformance/live and
+                   token:conformance-probe, issues it a credential, writes a
+                   fresh canary, runs the token's checks below, then verifies
+                   the whole audit log as you. The credential is revoked
+                   however the run ends, and your session stays signed in
+  with a token     a service token in COFFRE_TOKEN, for CI, that reads the
+                   canary's environment and holds auditor on its project: its
+                   value nowhere but its reveal, the reveal audited, nothing
+                   else in reach
+  --canary         the canary the token reads; its value after =, or in
+                   COFFRE_CONFORMANCE_CANARY, or on stdin, so that it stays
+                   out of the shell's history
+
+Each run adds a few entries to the instance's audit log, which is
+append-only, so they stay: the canary's read, and the reads it was refused.
+A run as an owner leaves its project, environment and service for the next,
+and writes its canary and its grants. Exits 1 when a check fails.`;
+async function verifyInstance(args, store, env, out = process.stdout) {
+	const { values, positionals } = parseArgs({
+		args,
+		allowPositionals: true,
+		options: {
+			canary: { type: "string" },
+			help: {
+				type: "boolean",
+				short: "h"
+			}
+		}
+	});
+	if (values.help) stop(0, INSTANCE_USAGE);
+	if (positionals.length > 1) stop(2, INSTANCE_USAGE);
+	const requested = positionals[0] ?? (env.COFFRE_API_URL?.trim() || store.current);
+	if (!requested) stop(1, "coffre: not signed in anywhere yet: run `coffre login <url>` first");
+	let origin;
+	try {
+		origin = instanceOrigin(requested);
+	} catch (error) {
+		stop(2, `coffre: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const s = style(out);
+	const report = new Checks(out);
+	const token = env.COFFRE_TOKEN?.trim();
+	if (token !== void 0 && token !== "") {
+		if (values.canary === void 0) stop(2, "coffre: with a token, name its canary: --canary <project>/<environment>/<KEY>[=<value>]");
+		let canary;
+		try {
+			canary = parseCanary(values.canary, values.canary.includes("=") ? void 0 : await canaryValue(env));
+		} catch (error) {
+			stop(2, `coffre: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		out.write(`${s.bold(`Checking ${origin}`)}, as no one and with the token in COFFRE_TOKEN\n`);
+		out.write(s.dim("  The token's reads add a few entries to the instance's audit log, for good.\n\n"));
+		await anonymousChecks(report, origin);
+		await tokenChecks(report, origin, {
+			token,
+			canary
+		});
+		return finish(out, report);
+	}
+	if (values.canary !== void 0) stop(2, "coffre: --canary goes with a service token in COFFRE_TOKEN; as an owner, the run writes a canary of its own");
+	if (store.instances[origin] === void 0) stop(1, `coffre: not signed in to ${origin}: run \`coffre login ${origin}\` first`);
+	let api;
+	try {
+		const to = resolveTarget({
+			...env,
+			COFFRE_API_URL: origin,
+			COFFRE_TOKEN: void 0
+		}, store);
+		if (to.mode === "cloudflare") stop(1, `coffre: ${origin} is behind Cloudflare Access, which turns everyone away before coffre answers, so it cannot be checked from outside. \`coffre verify log\` verifies its audit log, as you.`);
+		api = createClient({
+			url: origin,
+			headers: () => credentialHeaders(to.mode, to.credential)
+		});
+	} catch (error) {
+		stop(1, `coffre: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	out.write(`${s.bold(`Checking ${origin}`)}, as no one, then as you\n`);
+	out.write(s.dim(`  It keeps ${PROBE.project}/${PROBE.environment} and ${PROBE.service} for the next run, and its reads stay in the audit log, for good.\n\n`));
+	await anonymousChecks(report, origin);
+	await ownerChecks(report, origin, api);
+	finish(out, report);
+}
+/**
+* As the signed-in owner: who they are, set up, the token's checks,
+* verification; and, however it ends, a Ctrl-C included, the credential
+* revoked. The session stays as it was.
+*/
+async function ownerChecks(report, origin, api) {
+	if (await report.check("owner", {}, () => signedIn(api, origin)) === void 0) return;
+	const issued = [];
+	let ended = null;
+	const end = () => ended ??= cleanUp(api, issued);
+	const interrupted = (code) => () => void end().finally(() => process.exit(code));
+	const onInt = interrupted(130);
+	const onTerm = interrupted(143);
+	process.once("SIGINT", onInt);
+	process.once("SIGTERM", onTerm);
+	try {
+		await tokenChecks(report, origin, await report.check("setup", {}, () => setUp(api, issued)) ?? {}, { verification: false });
+		await report.check("owner verification", {}, () => verification(api));
+	} finally {
+		process.off("SIGINT", onInt);
+		process.off("SIGTERM", onTerm);
+		await report.check("clean-up", {}, end);
+	}
+}
+/** The session's owner, or a root admin: anyone else is stopped before anything is made. */
+async function signedIn(api, origin) {
+	let me;
+	try {
+		me = await api.me();
+	} catch (error) {
+		if (error instanceof CoffreError && error.status === 401) throw new Failure(`your session on ${origin} is missing, expired or revoked: run \`coffre login ${origin}\`, then again`);
+		throw error;
+	}
+	const who = me.principal.id;
+	if (me.instanceRole === "user") throw new Failure(`${who} is neither an owner nor a root admin of ${origin}: nothing was made. Sign in as one, or use a service token in COFFRE_TOKEN with --canary`);
+	return {
+		detail: `${who}, ${me.instanceRole === "owner" ? "an owner" : "a root admin"}, with this CLI's session`,
+		value: who
+	};
+}
+/** Make what is missing of the run's place, and the service's two grants; then a fresh canary, and a fresh credential. */
+async function setUp(api, issued) {
+	const place = `${PROBE.project}/${PROBE.environment}`;
+	const made = [];
+	const { projects } = await api.projects.list();
+	const project = projects.find(({ slug }) => slug === PROBE.project);
+	expect(project?.archivedAt == null, `${PROBE.project} is archived: unarchive it, or the run has nowhere to go`);
+	if (project === void 0) {
+		await api.projects.create(PROBE.project, { name: "Conformance" });
+		made.push(`the project ${PROBE.project}`);
+	}
+	const environment = project?.environments.find(({ slug }) => slug === PROBE.environment);
+	expect(environment?.details?.archivedAt == null, `${place} is archived: unarchive it, or the run has nowhere to go`);
+	if (environment === void 0) {
+		await api.environments.create(place, { name: "Live" });
+		made.push(`the environment ${place}`);
+	}
+	if ((await api.members.add(PROBE.service)).created) made.push(`the service ${PROBE.service}`);
+	const { changes } = await api.access.set(PROBE.service, {
+		[place]: "viewer",
+		[PROBE.project]: "auditor"
+	});
+	const granted = Object.entries(changes).filter(([, change]) => change !== "unchanged");
+	if (granted.length > 0) made.push(`its grants on ${granted.map(([where]) => where).join(" and ")}`);
+	const value = `coffre-canary-${randomBytes(12).toString("hex")}`;
+	await api.secrets.set(place, { [PROBE.key]: value });
+	const credential = await api.tokens.issue(PROBE.service, {
+		label: "coffre verify instance, one run",
+		expiresInDays: 1
+	});
+	issued.push({
+		member: PROBE.service,
+		id: credential.id
+	});
+	return {
+		detail: `${made.length === 0 ? "all found" : `made ${made.join(", ")}`}; a fresh ${place}/${PROBE.key} and a fresh credential for ${PROBE.service}`,
+		value: {
+			token: credential.token,
+			canary: {
+				project: PROBE.project,
+				environment: PROBE.environment,
+				key: PROBE.key,
+				value
+			}
+		}
+	};
+}
+/** What the whole audit chain says, read by the owner, which a token cannot be. */
+async function verification(api) {
+	const verified = await api.audit.verify();
+	expect(verified.ok, "the audit log does not verify", verified);
+	return `the whole chain verifies, as you: ${verified.entries} entries, through entry ${verified.through}`;
+}
+/** Revoke what the run issued, and say what stays: the session among it. */
+async function cleanUp(api, issued) {
+	for (const { member, id } of issued) await api.tokens.revoke(member, id);
+	const { tokens } = await api.tokens.list(PROBE.service).catch(() => ({ tokens: [] }));
+	const others = tokens.length === 0 ? "no working credential" : `${tokens.length} credential${tokens.length === 1 ? "" : "s"} this run did not issue, left as they are`;
+	return `${issued.length === 0 ? "nothing issued" : "the credential revoked"}; your session stays. Staying: ${PROBE.project}/${PROBE.environment} and its ${PROBE.key}, ${PROBE.service} with ${others}, and this run's entries in the audit log`;
+}
+/** The canary's value from the environment, or the first line of stdin when it is piped. */
+async function canaryValue(env) {
+	const given = env.COFFRE_CONFORMANCE_CANARY;
+	if (given !== void 0 && given !== "") return given;
+	if (process.stdin.isTTY) return void 0;
+	let text = "";
+	for await (const chunk of process.stdin) text += String(chunk);
+	return text.split(/\r?\n/)[0];
+}
+/** The verdict, under the checks, and the exit code: 0 when every one passed, or was skipped for a reason given. */
+function finish(out, report) {
+	const s = style(out);
+	const { failed } = report;
+	out.write(failed.length === 0 ? `\n${s.green("✓")} ${s.bold("Conformant")}\n` : `\n${s.red("✗")} ${s.bold("Not conformant:")} ${failed.join(", ")}\n`);
+	process.exitCode = failed.length === 0 ? 0 : 1;
+}
+Buffer.from("coffre.audit.mac.v2", "utf8");
+Buffer.from("coffre.audit.chain.v2", "utf8");
+Buffer.alloc(32, 0);
+/**
+* An author's log key, derived from one of its secrets: `auditChainKey` for
+* the app. The id is a fingerprint of the key, so a rotation shows in every
+* entry, and an old key can be kept for verification by its id.
+*/
+function deriveLogKey(author, secret) {
+	if (secret.length < 32) throw new Error("a log key needs at least 32 bytes of secret");
+	const key = Buffer.from(hkdfSync("sha256", secret, /* @__PURE__ */ new Uint8Array(0), `coffre.audit.${author}.v2`, 32));
+	return {
+		author,
+		keyId: `${author}:${createHash("sha256").update(key).digest("hex").slice(0, 16)}`,
+		key
+	};
+}
+//#endregion
+//#region ../core/dist/types-Mi7-Tzj9.js
+/**
+* Version prefix for the AAD encoding. If the encoding ever changes, this
+* changes with it, and old ciphertexts keep decrypting under the old rule.
+*/
+const AAD_VERSION = "coffre.aad.v1";
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+function assertUuid(value, field) {
+	if (typeof value !== "string" || !UUID_RE.test(value)) throw new Error(`context.${field} must be a lowercase UUID, got: ${String(value)}`);
+}
+/** Throw unless every field is a lowercase UUID. */
+function checkContext(ctx) {
+	assertUuid(ctx.projectId, "projectId");
+	assertUuid(ctx.environmentId, "environmentId");
+	assertUuid(ctx.secretId, "secretId");
+}
+/**
+* Encode a context into AAD bytes.
+*
+* Every field is validated as a UUID first, which is what makes joining with
+* `|` unambiguous: a UUID cannot contain the separator, so no two distinct
+* contexts can encode to the same bytes.
+*/
+function encodeAad(ctx) {
+	checkContext(ctx);
+	return Buffer.from(`${AAD_VERSION}|${ctx.projectId}|${ctx.environmentId}|${ctx.secretId}`, "utf8");
+}
+/**
+* The key service could not answer: it is down, throttling past the
+* retries, or refusing coffre's own credentials. Nothing is known about the
+* wrapped key, so the vault fails the call instead of refusing it.
+*/
+var KekUnavailableError = class extends Error {
+	name = "KekUnavailableError";
+	uncertain;
+	constructor(message, uncertain = false) {
+		super(message);
+		this.uncertain = uncertain;
+	}
+};
+/** No more work may start. A request already sent may have been accepted by KMS. */
+var KekCancelledError = class extends KekUnavailableError {
+	name = "KekCancelledError";
+	constructor(uncertain = false) {
+		super("key operation was cancelled", uncertain);
+	}
+};
+/** The ciphertext does not open under the claimed key and context. */
+var KekBadClaimError = class extends Error {
+	name = "KekBadClaimError";
+};
+//#endregion
+//#region ../core/dist/kek.js
+function checkOperation(operation, uncertain = false) {
+	if (operation !== void 0 && (operation.signal.aborted || Date.now() >= operation.deadline)) throw new KekCancelledError(uncertain);
+}
+const IV_BYTES = 12;
+const KEK_BYTES = 32;
 /**
-* The config from `name=value` arguments, as the CLI takes them. A field with
-* several options takes them comma-separated, and one left out gets what the
-* form preselects. Text goes as typed, for the server to check.
+* A KEK held in local process memory, loaded from configuration.
+*
+* This is the local-development implementation of `KekProvider`. It is a
+* different implementation of the same interface, not a branch that skips
+* wrapping: the envelope format, the context binding and the failure modes are
+* identical to what a remote KMS-backed provider will produce.
 */
-function configFromArguments(provider, assignments) {
-	const config = {};
-	for (const assignment of assignments) {
-		const equals = assignment.indexOf("=");
-		const name = equals === -1 ? assignment : assignment.slice(0, equals);
-		const field = provider.fields.find((candidate) => candidate.name === name);
-		if (equals === -1 || field === void 0) {
-			const names = provider.fields.map((candidate) => candidate.name).join(", ");
-			throw new Error(`${provider.label} takes ${names} as name=value; got ${JSON.stringify(assignment)}`);
-		}
-		if (Object.hasOwn(config, name)) throw new Error(`${name} is given twice`);
-		const value = assignment.slice(equals + 1);
-		if (field.type === "text") config[name] = value;
-		else if (field.multiple) config[name] = value.split(",").map((item) => item.trim()).filter((item) => item !== "");
-		else config[name] = value;
+var LocalKekProvider = class LocalKekProvider {
+	provider = "local";
+	keyId;
+	keyVersion;
+	#kek;
+	constructor(kek, keyId, keyVersion = "1") {
+		if (kek.length !== KEK_BYTES) throw new Error(`a local vault key must be ${KEK_BYTES} bytes, got ${kek.length}`);
+		this.#kek = kek;
+		this.keyId = keyId;
+		this.keyVersion = keyVersion;
+	}
+	/** Build a provider from a base64-encoded 32-byte key, e.g. from an env var. */
+	static fromBase64(encoded, keyId, keyVersion = "1") {
+		return new LocalKekProvider(Buffer.from(encoded, "base64"), keyId, keyVersion);
+	}
+	/** Generate a fresh random KEK. Used by tests and by the dev seed script. */
+	static generate(keyId, keyVersion = "1") {
+		return new LocalKekProvider(randomBytes(KEK_BYTES), keyId, keyVersion);
 	}
-	for (const field of provider.fields) if (field.type === "options" && !Object.hasOwn(config, field.name)) config[field.name] = field.multiple ? field.initial : field.initial[0];
-	return config;
-}
-/** The API's error shape, `{ error, message }`, with the HTTP status. */
-const COFFRE_ERROR = Symbol.for("@coffre/client:CoffreError");
-var CoffreError = class extends Error {
 	/**
-	* `@coffre/ui`'s prebuilt pages bundle a copy of this class, and a page is
-	* handed a client the server made with this package's. So `instanceof`
-	* asks for the mark every copy leaves, rather than for this copy's prototype.
+	* AAD for the wrap operation.
+	*
+	* Binds the wrapped DEK both to the secret it belongs to and to the KEK
+	* identity that produced it, so a wrapped DEK cannot be replayed against a
+	* row claiming a different KEK.
 	*/
-	static [Symbol.hasInstance](value) {
-		return typeof value === "object" && value !== null && COFFRE_ERROR in value;
+	#wrapAad(ctx) {
+		return Buffer.concat([encodeAad(ctx), Buffer.from(`|${this.provider}|${this.keyId}|${this.keyVersion}`, "utf8")]);
 	}
-	[COFFRE_ERROR] = true;
-	status;
-	code;
-	/** The vault's own code when it refused: `no_grant`, `removed`, `bulk_limit`, ... */
-	reason;
-	constructor(status, code, message, reason) {
-		super(message);
-		this.name = "CoffreError";
-		this.status = status;
-		this.code = code;
-		this.reason = reason;
+	async wrap(dek, ctx, operation) {
+		checkOperation(operation);
+		if (dek.length !== 32) throw new Error(`DEK must be 32 bytes, got ${dek.length}`);
+		const iv = randomBytes(IV_BYTES);
+		const cipher = createCipheriv("aes-256-gcm", this.#kek, iv);
+		cipher.setAAD(this.#wrapAad(ctx));
+		const body = Buffer.concat([cipher.update(dek), cipher.final()]);
+		return {
+			kekProvider: this.provider,
+			kekId: this.keyId,
+			kekVersion: this.keyVersion,
+			bytes: Buffer.concat([
+				iv,
+				cipher.getAuthTag(),
+				body
+			])
+		};
+	}
+	async unwrap(wrapped, ctx, operation) {
+		checkOperation(operation);
+		if (wrapped.kekProvider !== this.provider || wrapped.kekId !== this.keyId) throw new KekBadClaimError(`wrapped DEK is for ${wrapped.kekProvider}:${wrapped.kekId}, not ${this.provider}:${this.keyId}`);
+		if (wrapped.bytes.length !== 60) throw new KekBadClaimError("wrapped DEK has the wrong length");
+		const iv = wrapped.bytes.subarray(0, IV_BYTES);
+		const tag = wrapped.bytes.subarray(IV_BYTES, 28);
+		const body = wrapped.bytes.subarray(28);
+		const decipher = createDecipheriv("aes-256-gcm", this.#kek, iv);
+		decipher.setAAD(this.#wrapAad(ctx));
+		decipher.setAuthTag(tag);
+		let dek;
+		const partial = decipher.update(body);
+		try {
+			dek = Buffer.concat([partial, decipher.final()]);
+		} catch {
+			throw new KekBadClaimError("wrapped DEK does not open under this context");
+		} finally {
+			partial.fill(0);
+		}
+		if (dek.length !== 32) {
+			dek.fill(0);
+			throw new KekBadClaimError("unwrapped DEK has the wrong length");
+		}
+		return dek;
 	}
 };
-/** `market/prod/KEY` as route parameters. */
-function place(path) {
-	const [project = "", environment = "", key = ""] = path.replace(/^\/+|\/+$/g, "").split("/");
-	return {
-		project,
-		environment,
-		key
-	};
+/** Constant-time buffer comparison, for tests and callers that need it. */
+function equalBytes(a, b) {
+	return a.length === b.length && timingSafeEqual(a, b);
+}
+/** The known value a check wraps: the size of a data key. */
+const KEY_CHECK_VALUE = createHash("sha256").update("coffre.kek.check.v1").digest();
+const NIL = "00000000-0000-0000-0000-000000000000";
+/** The context a check is wrapped in, which no secret has: the nil UUID throughout. */
+const KEY_CHECK_CONTEXT = {
+	projectId: NIL,
+	environmentId: NIL,
+	secretId: NIL
+};
+/**
+* Whether `key`, a local vault key, is the one that wrapped `check`: it
+* opens it, under the vault ID the check names, to the known value. The ID
+* is bound into the wrap, so a match also says the ID is the escrowed one's.
+*/
+async function opensKeyCheck(key, check) {
+	if (check.kekProvider !== "local" || key.length !== 32) return false;
+	try {
+		const value = await new LocalKekProvider(key, check.kekId, check.kekVersion).unwrap(check, KEY_CHECK_CONTEXT);
+		const right = equalBytes(value, KEY_CHECK_VALUE);
+		value.fill(0);
+		return right;
+	} catch (error) {
+		if (error instanceof KekBadClaimError) return false;
+		throw error;
+	}
 }
-function createClient(options) {
-	const origin = options.url.replace(/\/+$/, "");
-	const transport = options.transport ?? ((request) => fetch(request));
-	async function send(method, path, input) {
-		const url = new URL(`${origin}/api${path}`);
-		const headers = new Headers(await options.headers?.());
-		let body;
-		if (method === "GET") {
-			for (const [name, value] of Object.entries(input ?? {})) if (value !== void 0 && value !== null) url.searchParams.set(name, String(value));
-		} else if (input !== void 0) {
-			headers.set("content-type", "application/json");
-			body = JSON.stringify(input);
+/** The id the log records for entries the app signs with `key`, its APP_KEY. */
+function appLogKeyId(key) {
+	return deriveLogKey("app", key).keyId;
+}
+//#endregion
+//#region src/verify/keys.ts
+const KEYS_USAGE = `usage:
+  coffre verify keys [--vault-id <id>]
+
+Asks for the vault key, then the app key, without showing them, and checks
+each against the current instance, on this machine: neither is sent. Enter
+alone skips one. As an owner or a root admin.
+
+  --vault-id   the vault ID kept with the vault key, to check as well; or in
+               COFFRE_VAULT_KEY_ID. It is shown either way
+
+In a script: the keys in COFFRE_VAULT_KEY and COFFRE_APP_KEY, or on stdin,
+the vault key on the first line and the app key on the second, never as
+arguments. Exits 1 when a key is not the instance's.`;
+/**
+* A key's text, as an operator pastes it: 32 bytes in base64, and nothing
+* more. Node's decoder, which the deployment uses, stops where it can, so a
+* key pasted twice would decode to the key: the text must be the key's own.
+*/
+function decoded(text) {
+	const key = Buffer.from(text, "base64");
+	const unpadded = text.replace(/=+$/, "");
+	return key.length === 32 && (unpadded === key.toString("base64").replace(/=+$/, "") || unpadded === key.toString("base64url")) ? key : null;
+}
+function malformed(what, text) {
+	return new Failure(`not ${what}: one is 32 bytes in base64, 44 characters, and these ${text.length} characters are not`);
+}
+/**
+* The vault key: the one the vault wraps under now if it opens that key's
+* check; a key the vault replaced if it opens an older one's, which is said;
+* otherwise none of this instance's. The vault ID is bound into every
+* check, so the one opened names the key's.
+*/
+async function vaultKeyVerdict(text, material, vaultId) {
+	if (text === "") throw new Skip("not given: not checked");
+	const key = decoded(text);
+	if (key === null) throw malformed("a vault key", text);
+	try {
+		const { current, checks } = material;
+		let opened;
+		for (const check of checks) if (await opensKeyCheck(key, {
+			kekProvider: check.provider,
+			kekId: check.vaultId,
+			kekVersion: check.version,
+			bytes: Buffer.from(check.wrapped, "base64")
+		})) {
+			opened = check;
+			break;
 		}
-		const response = await transport(new Request(url, {
-			method,
-			headers,
-			body
-		}));
-		const payload = await response.json().catch(() => null);
-		if (!response.ok) {
-			const error = payload;
-			throw new CoffreError(response.status, typeof error?.error === "string" ? error.error : "http_error", typeof error?.message === "string" ? error.message : `request failed with status ${response.status}`, typeof error?.reason === "string" ? error.reason : void 0);
+		const now = current.provider === "local" ? `vault ID ${current.vaultId}` : `${current.vaultId}, in ${current.provider}`;
+		if (opened === void 0) {
+			if (checks.length === 0) throw new Failure(`the vault holds no check to hold a key to yet. It wraps under ${now}`);
+			throw new Failure(`not this instance's vault key: ${checks.length === 1 ? "it does not open the vault key's check" : `it opens none of the checks of its ${checks.length} vault keys, current or replaced`}. The vault wraps under ${now}`);
 		}
-		return payload;
-	}
-	/** A route key and its parameters as a method and a path. */
-	function address(key, params) {
-		const [method, pattern] = key.split(" ");
-		return [method, pattern.replace(/:(\w+)/g, (_, name) => encodeURIComponent(params[name]))];
+		if (opened.vaultId !== current.vaultId || opened.provider !== current.provider) throw new Failure(`this is a previous vault key (vault ID ${opened.vaultId}), not the current one: the vault wraps under ${now}`);
+		if (vaultId !== void 0 && vaultId !== opened.vaultId) throw new Failure(`the key is right, but its vault ID is ${opened.vaultId}, not ${vaultId}: keep the right one with it`);
+		return `the current one, vault ID ${opened.vaultId}${vaultId === void 0 ? "" : ", as given"}`;
+	} finally {
+		key.fill(0);
 	}
-	/** Any route by its key: `call('GET /secrets/:project/:environment', { project, environment })`. */
-	async function call(key, ...[params, input]) {
-		const [method, path] = address(key, params);
-		return await send(method, path, input);
+}
+/** The app key: right if the log's entries the app signs now would carry the fingerprint it makes. */
+function appKeyVerdict(text, material) {
+	if (text === "") throw new Skip("not given: not checked");
+	const key = decoded(text);
+	if (key === null) throw malformed("an app key", text);
+	try {
+		if (appLogKeyId(key) !== material.keyId) throw new Failure("not this instance's app key: the app signs with another");
+		return "the one the app signs with now";
+	} finally {
+		key.fill(0);
 	}
-	return {
-		call,
-		/** How this instance signs people in. Answers anyone, signed in or not. */
-		auth: () => send("GET", "/auth", void 0),
-		/** Who I am, and every place I can reach. */
-		me: () => call("GET /me", {}),
-		projects: {
-			/** With their environments. */
-			list: () => call("GET /projects", {}),
-			create: (project, input) => call("PUT /projects/:project", { project }, input),
-			update: (project, patch) => call("PATCH /projects/:project", { project }, patch)
-		},
-		environments: {
-			create: (path, input) => call("PUT /projects/:project/:environment", place(path), input),
-			update: (path, patch) => call("PATCH /projects/:project/:environment", place(path), patch)
-		},
-		secrets: {
-			/** Keys, versions and who changed what; never values. */
-			list: (path) => call("GET /secrets/:project/:environment", place(path)),
-			/** Decrypts one secret, or every secret in an environment. Logged in your name. */
-			reveal: (path) => call("POST /reveals", {}, { path }),
-			/** One transaction, a version and an audit entry per key; `null` archives. */
-			set: (path, values) => call("PATCH /secrets/:project/:environment", place(path), values),
-			/**
-			* What `set` would do to each key, `added`, `changed`, `unchanged` or
-			* `archived`, and nothing else: no value comes back and nothing is
-			* written. Comparing opens the current values, logged as reads.
-			*/
-			dryRun: (path, values) => {
-				const [method, route] = address("PATCH /secrets/:project/:environment", place(path));
-				return send(method, `${route}?dryRun=1`, values);
-			},
-			history: (path) => call("GET /secrets/:project/:environment/:key/versions", place(path)),
-			/** A new version holding the old one's value. */
-			restore: (path, version) => call("POST /secrets/:project/:environment/:key/restore", place(path), { version }),
-			rename: (path, key) => call("PATCH /secrets/:project/:environment/:key", place(path), { key }),
-			update: (path, patch) => call("PATCH /secrets/:project/:environment/:key", place(path), patch)
-		},
-		members: {
-			/** People and tokens, their role and their access; at a place, those who reach it. */
-			list: (path) => call("GET /members", {}, { path }),
-			/** What they hold, and what to rotate if they leave. */
-			get: (member) => call("GET /members/:member", { member }),
-			add: (member, input = {}) => call("PUT /members/:member", { member }, input),
-			/** Offboards; returns what to rotate. */
-			remove: (member) => call("DELETE /members/:member", { member })
-		},
-		tokens: {
-			list: (member) => call("GET /members/:member/tokens", { member }),
-			/** The value is in the answer, and only there. */
-			issue: (member, input) => call("POST /members/:member/tokens", { member }, input),
-			revoke: (member, id) => call("DELETE /members/:member/tokens/:id", {
-				member,
-				id
-			})
-		},
-		access: { 
-		/** What they should hold at each place; the server applies the difference. `null` revokes. */
-set: (member, access) => call("PATCH /access/:member", { member }, access) },
-		/** Where I am signed in. Only where coffre runs its own sign-in. */
-		sessions: {
-			list: () => call("GET /sessions", {}),
-			revoke: (id) => call("DELETE /sessions/:id", { id })
-		},
-		/** The accounts I sign in with. */
-		identities: {
-			list: () => call("GET /identities", {}),
-			unlink: (id) => call("DELETE /identities/:id", { id })
-		},
-		/** A `coffre login` waiting for someone to approve it, by the code it shows. */
-		deviceLogins: {
-			get: (code) => call("GET /device-logins/:code", { code }),
-			decide: (code, approve) => call("POST /device-logins/:code", { code }, { approve })
-		},
-		syncs: {
-			/** Where a sync can push on this instance, and what each asks for. */
-			providers: () => call("GET /syncs/providers", {}),
-			list: (path) => call("GET /syncs/:project/:environment", place(path)),
-			add: (path, input) => call("POST /syncs/:project/:environment", place(path), input),
-			update: (id, patch) => call("PATCH /syncs/by-id/:id", { id }, patch),
-			remove: (id) => call("DELETE /syncs/by-id/:id", { id }),
-			run: (id) => call("POST /syncs/by-id/:id/runs", { id })
-		},
-		audit: {
-			list: (query = {}) => call("GET /audit", {}, query),
-			verify: () => call("GET /audit/verification", {})
-		}
-	};
 }
 /**
-* What writing these entries (a parsed `.env` file) would do, from a dry run
-* of the write: the server compares, so no value leaves it, and the values it
-* opens to compare are logged as reads. `changes` is what to pass to
-* `secrets.set`: the keys that differ, so an unchanged value does not become
-* a new version.
+* The two keys, from where they are: each one's environment variable, then
+* stdin's lines in order when it is piped, or hidden prompts on a terminal.
 */
-async function planImport(coffre, path, entries) {
-	const values = Object.create(null);
-	for (const { key, value } of entries) values[key] = value;
-	const [listed, compared] = await Promise.allSettled([coffre.secrets.list(path), coffre.secrets.dryRun(path, { ...values })]);
-	if (listed.status === "rejected") throw listed.reason;
-	if (compared.status === "rejected") throw compared.reason;
-	const [{ keys }, dryRun] = [listed.value, compared.value];
-	const versions = new Map(keys.map((entry) => [entry.key, entry.version]));
-	const plan = [];
-	const changes = Object.create(null);
-	for (const [key, value] of Object.entries(values)) {
-		const action = dryRun.keys[key];
-		plan.push({
-			key,
-			action,
-			version: versions.get(key) ?? null
+async function readKeys(env) {
+	const given = {
+		vault: env.COFFRE_VAULT_KEY?.trim(),
+		app: env.COFFRE_APP_KEY?.trim()
+	};
+	const missing = ["vault", "app"].filter((which) => !given[which]);
+	const asked = {};
+	if (missing.length > 0 && !process.stdin.isTTY) {
+		let text = "";
+		for await (const chunk of process.stdin) text += String(chunk);
+		const lines = text.split(/\r?\n/);
+		missing.forEach((which, i) => asked[which] = {
+			text: lines[i]?.trim() ?? "",
+			from: "stdin"
 		});
-		if (action !== "unchanged") changes[key] = value;
+	} else if (missing.length > 0) {
+		const terminal = openTerminal();
+		if (terminal === null) stop(2, "coffre: no terminal to ask for the keys on: pass them in COFFRE_VAULT_KEY and COFFRE_APP_KEY, or on stdin, the vault key first");
+		const s = style(terminal.out);
+		try {
+			for (const which of missing) {
+				const name = which === "vault" ? "Vault key" : "App key";
+				asked[which] = {
+					text: await hiddenLine(terminal.keys, terminal.out, s, `${name}?`, "Paste it: it stays hidden, and on this machine. Enter alone skips it."),
+					from: "the prompt"
+				};
+			}
+		} finally {
+			release(terminal.keys);
+		}
 	}
+	const source = (which, variable) => given[which] ? {
+		text: given[which],
+		from: variable
+	} : asked[which];
 	return {
-		plan,
-		changes: { ...changes }
+		vault: source("vault", "COFFRE_VAULT_KEY"),
+		app: source("app", "COFFRE_APP_KEY")
 	};
 }
+async function verifyKeys(args, api, origin, env, out = process.stdout) {
+	const { values } = parseArgs({
+		args,
+		allowPositionals: false,
+		options: {
+			"vault-id": { type: "string" },
+			help: {
+				type: "boolean",
+				short: "h"
+			}
+		}
+	});
+	if (values.help) stop(0, KEYS_USAGE);
+	const vaultId = values["vault-id"] ?? (env.COFFRE_VAULT_KEY_ID?.trim() || void 0);
+	const material = await api.audit.keys();
+	const s = style(out);
+	out.write(`${s.bold(`Checking your keys against ${origin}`)}\n`);
+	out.write(s.dim("  On this machine: what they're checked against was read from the instance, and the keys go nowhere.\n\n"));
+	const keys = await readKeys(env);
+	const report = new Checks(out);
+	await report.check("vault key", {}, () => said(keys.vault, () => vaultKeyVerdict(keys.vault.text, material.vault, vaultId)));
+	await report.check("app key", {}, () => said(keys.app, () => appKeyVerdict(keys.app.text, material.app)));
+	const { failed, results } = report;
+	const right = results.filter(({ status }) => status === "ok").map(({ name }) => name);
+	out.write(failed.length > 0 ? `\n${s.red("✗")} ${s.bold(failed.length === 2 ? `Neither key is ${origin}'s.` : `The ${failed[0]} is not ${origin}'s.`)}\n` : right.length === 0 ? `\n${s.red("✗")} ${s.bold("No key given: nothing checked.")}\n` : `\n${s.green("✓")} ${s.bold(right.length === 2 ? `Both keys are ${origin}'s.` : `The ${right[0]} is ${origin}'s.`)}\n`);
+	process.exitCode = failed.length > 0 || right.length === 0 ? 1 : 0;
+}
+/** A key's verdict, and where the key came from when not a prompt: so that a script's run says which variable it read. */
+async function said(source, verdict) {
+	const where = source.from === "the prompt" ? "" : ` (from ${source.from})`;
+	try {
+		return `${await verdict()}${where}`;
+	} catch (error) {
+		if (error instanceof Failure) throw new Failure(`${error.message}${where}`, error.detail);
+		throw error;
+	}
+}
+//#endregion
+//#region src/verify/index.ts
+/** The checks, in the order they are offered: each one's name, and what it checks. */
+const CHECKS = [
+	["instance", "the instance from outside: as no one, then as you, an owner"],
+	["keys", "the vault key and app key you keep, against the instance"],
+	["log", "the whole audit log, as you, an owner"]
+];
+const VERIFY_USAGE = `usage: coffre verify instance | keys | log
+
+${CHECKS.map(([name, what]) => `  ${name.padEnd(10)}${what}`).join("\n")}
+
+On a terminal, \`coffre verify\` alone asks which. \`coffre verify <check> --help\`
+says more about each.`;
+/** The check named, or, with none, the one chosen on the terminal; without a terminal, the list, and exit 2. */
+async function pickCheck() {
+	const terminal = openTerminal();
+	if (terminal === null) stop(2, VERIFY_USAGE);
+	const s = style(terminal.out);
+	try {
+		const at = await select(terminal.keys, terminal.out, s, "Which check?", CHECKS.map(([name, what]) => `${name.padEnd(10)}${s.dim(what)}`));
+		terminal.out.write("\n");
+		return CHECKS[at][0];
+	} catch (error) {
+		if (error instanceof Cancelled) process.exit(130);
+		throw error;
+	} finally {
+		release(terminal.keys);
+	}
+}
 //#endregion
 //#region ../core/dist/dotenv.js
 const KEY_RE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
@@ -1225,7 +2384,30 @@ async function audit(args) {
 		process.stdout.write(`${entry.occurredAt}  ${entry.decision.padEnd(5)}  ${entry.actorId.padEnd(28)}  ${entry.action.padEnd(16)}  ${place}\n`);
 	}
 }
-async function verify() {
+/** One check of the instance, named, or chosen on the terminal (`verify/index.ts`). */
+async function verify(args) {
+	const [named, ...more] = args;
+	if (named === "--help" || named === "-h") {
+		process.stdout.write(`${VERIFY_USAGE}\n`);
+		return;
+	}
+	const check = named ?? await pickCheck();
+	switch (check) {
+		case "instance": return verifyInstance(more, readStore(), process.env);
+		case "keys": {
+			const to = target();
+			return verifyKeys(more, client(to), to.origin, process.env);
+		}
+		case "log":
+			if (more.length > 0) fail("usage: coffre verify log");
+			return verifyLog();
+		default:
+			process.stderr.write(`coffre: no check named ${check}\n${VERIFY_USAGE}\n`);
+			process.exit(2);
+	}
+}
+/** The whole audit log, verified by the app and the vault, as an owner. */
+async function verifyLog() {
 	const result = await client().audit.verify();
 	if (result.ok) {
 		const through = result.through === null ? "empty" : `verified through entry ${result.through}`;
@@ -1435,7 +2617,11 @@ const USAGE = `coffre - secrets, with an audit log
 
   Audit
     coffre audit [--limit N] [--actor <id>] [--denied] [--detail]
-    coffre verify
+
+  Verify (coffre verify alone asks which, on a terminal)
+    coffre verify instance [<url>]          the instance from outside: as no one, then as you, an owner
+    coffre verify keys                      the vault key and app key you keep, checked on this machine
+    coffre verify log                       the whole audit log, as an owner
 
   Environment (each overrides the saved session for one command)
     COFFRE_API_URL          which instance to talk to
@@ -1513,7 +2699,7 @@ switch (command) {
 		await audit(rest);
 		break;
 	case "verify":
-		await verify();
+		await verify(rest);
 		break;
 	default:
 		process.stdout.write(USAGE);