@coffre/client 0.0.0 → 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,1722 @@
+//#region src/api.d.ts
+/** Every route, by `METHOD /path`: what a caller sends (the body, or the query of a GET) and gets back. */
+type Api = {
+  "GET /me": {
+    input: undefined;
+    output: {
+      principal: {
+        type: "service" | "user";
+        id: string;
+      };
+      registered: boolean;
+      tampered: boolean;
+      instanceRole: "owner" | "root-admin" | "user";
+      isRootAdmin: boolean;
+      canReadAudit: boolean;
+      environments: {
+        project: string;
+        environment: string;
+        permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
+      }[];
+    };
+  };
+  "GET /projects": {
+    input: undefined;
+    output: {
+      projects: {
+        slug: string;
+        name: string;
+        archivedAt: string | null;
+        permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
+        environments: {
+          slug: string;
+          name: string;
+          accessible: boolean;
+          details: null | {
+            archivedAt: string | null;
+            secretCount: number | null;
+          };
+        }[];
+      }[];
+    };
+  };
+  "PUT /projects/:project": {
+    input: {
+      name: string;
+    };
+    output: {
+      project: {
+        slug: string;
+        name: string;
+        archivedAt: string | null;
+      };
+      created: boolean;
+    };
+  };
+  "PATCH /projects/:project": {
+    input: {
+      name?: string;
+      slug?: string;
+      archived?: boolean;
+    };
+    output: {
+      project: {
+        slug: string;
+        name: string;
+        archivedAt: string | null;
+      };
+    };
+  };
+  "PUT /projects/:project/:environment": {
+    input: {
+      name: string;
+    };
+    output: {
+      environment: {
+        slug: string;
+        name: string;
+        archivedAt: string | null;
+      };
+      created: boolean;
+    };
+  };
+  "PATCH /projects/:project/:environment": {
+    input: {
+      name?: string;
+      slug?: string;
+      archived?: boolean;
+    };
+    output: {
+      environment: {
+        slug: string;
+        name: string;
+        archivedAt: string | null;
+      };
+    };
+  };
+  "GET /secrets/:project/:environment": {
+    input: undefined;
+    output: {
+      permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
+      keys: {
+        key: string;
+        archived: boolean;
+        version: number | null;
+        updatedAt: string | null;
+        updatedBy: string | null;
+      }[];
+    };
+  };
+  "PATCH /secrets/:project/:environment": {
+    input: {
+      [key: string]: string | null;
+    };
+    output: {
+      operationId: string;
+      keys: {
+        [key: string]: {
+          version: number;
+        } | {
+          archived: true;
+        };
+      };
+    } | {
+      dryRun: true;
+      keys: {
+        [key: string]: "added" | "archived" | "changed" | "unchanged";
+      };
+    };
+  };
+  "PATCH /secrets/:project/:environment/:key": {
+    input: {
+      key?: string;
+      archived?: boolean;
+    };
+    output: {
+      key: string;
+      archived: boolean;
+    };
+  };
+  "GET /secrets/:project/:environment/:key/versions": {
+    input: undefined;
+    output: {
+      key: string;
+      archived: boolean;
+      versions: {
+        version: number;
+        createdAt: string;
+        createdBy: string;
+        current: boolean;
+        kek: string;
+      }[];
+    };
+  };
+  "POST /secrets/:project/:environment/:key/restore": {
+    input: {
+      version: number;
+    };
+    output: {
+      key: string;
+      version: number;
+    };
+  };
+  "POST /reveals": {
+    input: {
+      path: string;
+    };
+    output: {
+      operationId: string;
+      values: {
+        [key: string]: string;
+      };
+    };
+  };
+  "GET /members": {
+    input: {
+      path?: string;
+    };
+    output: {
+      members: {
+        member: string;
+        principalType: "service" | "user";
+        principalId: string;
+        instanceRole: "owner" | "root-admin" | "user";
+        isRootAdmin: boolean;
+        tampered: boolean;
+        grants: {
+          id: string;
+          project: string;
+          environment: string | null;
+          role: "access-manager" | "auditor" | "developer" | "maintainer" | "owner" | "viewer";
+          roleName: string;
+          permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
+          expiresAt: string | null;
+        }[];
+      }[];
+      removed: {
+        principalType: "service" | "user";
+        principalId: string;
+        toRotate: number;
+      }[];
+    };
+  };
+  "GET /members/:member": {
+    input: undefined;
+    output: {
+      principalType: "service" | "user";
+      principalId: string;
+      status: "active" | "removed" | "tampered";
+      instanceRole: "owner" | "root-admin" | "user";
+      isRootAdmin: boolean;
+      removedAt: string | null;
+      removedBy: string | null;
+      live: {
+        grants: number;
+        sessions: number;
+        tokens: number;
+        identities: number;
+      };
+      exposed: {
+        project: string;
+        environment: string;
+        key: string;
+        version: number;
+        how: "read" | "wrote";
+        at: string;
+      }[];
+      rotated: number;
+      issuedTokens: {
+        id: string;
+        service: string;
+        label: string | null;
+        hint: string;
+        expiresAt: string;
+        lastUsedAt: string | null;
+      }[];
+      syncs: {
+        id: string;
+        provider: string;
+        providerLabel: string;
+        brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
+        offered: boolean;
+        destination: string;
+        config: {
+          [key: string]: string | number | boolean | null | Json[] | {
+            [key: string]: Json;
+          };
+        };
+        credential: string;
+        createdAt: string;
+        createdBy: string;
+        paused: boolean;
+        running: boolean;
+        lastRunAt: string | null;
+        lastStatus: "failed" | "ok" | "partial" | null;
+        lastError: string | null;
+        synced: number;
+        pending: number;
+        skipped: {
+          key: string;
+          reason: string;
+        }[];
+        project: string;
+        environment: string;
+      }[];
+    };
+  };
+  "PUT /members/:member": {
+    input: {
+      owner?: boolean;
+    };
+    output: {
+      member: string;
+      instanceRole: "owner" | "user";
+      created: boolean;
+    };
+  };
+  "DELETE /members/:member": {
+    input: undefined;
+    output: {
+      revoked: {
+        grants: number;
+        sessions: number;
+        tokens: number;
+        identities: number;
+      };
+      report: {
+        principalType: "service" | "user";
+        principalId: string;
+        status: "active" | "removed" | "tampered";
+        instanceRole: "owner" | "root-admin" | "user";
+        isRootAdmin: boolean;
+        removedAt: string | null;
+        removedBy: string | null;
+        live: {
+          grants: number;
+          sessions: number;
+          tokens: number;
+          identities: number;
+        };
+        exposed: {
+          project: string;
+          environment: string;
+          key: string;
+          version: number;
+          how: "read" | "wrote";
+          at: string;
+        }[];
+        rotated: number;
+        issuedTokens: {
+          id: string;
+          service: string;
+          label: string | null;
+          hint: string;
+          expiresAt: string;
+          lastUsedAt: string | null;
+        }[];
+        syncs: {
+          id: string;
+          provider: string;
+          providerLabel: string;
+          brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
+          offered: boolean;
+          destination: string;
+          config: {
+            [key: string]: string | number | boolean | null | Json[] | {
+              [key: string]: Json;
+            };
+          };
+          credential: string;
+          createdAt: string;
+          createdBy: string;
+          paused: boolean;
+          running: boolean;
+          lastRunAt: string | null;
+          lastStatus: "failed" | "ok" | "partial" | null;
+          lastError: string | null;
+          synced: number;
+          pending: number;
+          skipped: {
+            key: string;
+            reason: string;
+          }[];
+          project: string;
+          environment: string;
+        }[];
+      };
+    };
+  };
+  "GET /members/:member/tokens": {
+    input: undefined;
+    output: {
+      tokens: {
+        id: string;
+        label: string | null;
+        hint: string;
+        createdAt: string;
+        createdBy: string;
+        expiresAt: string;
+        lastUsedAt: string | null;
+        lastUsedIp: string | null;
+      }[];
+    };
+  };
+  "POST /members/:member/tokens": {
+    input: {
+      expiresInDays: number;
+      label?: string | null;
+    };
+    output: {
+      id: string;
+      token: string;
+      expiresAt: string;
+    };
+  };
+  "DELETE /members/:member/tokens/:id": {
+    input: undefined;
+    output: {
+      revoked: true;
+    };
+  };
+  "PATCH /access/:member": {
+    input: {
+      [key: string]: "access-manager" | "auditor" | "developer" | "maintainer" | "owner" | "viewer" | null | {
+        role: "access-manager" | "auditor" | "developer" | "maintainer" | "owner" | "viewer";
+        until: string | null;
+      };
+    };
+    output: {
+      changes: {
+        [key: string]: "created" | "revoked" | "unchanged" | "updated";
+      };
+    };
+  };
+  "GET /sessions": {
+    input: undefined;
+    output: {
+      sessions: {
+        id: string;
+        kind: "browser" | "cli";
+        label: string | null;
+        hint: string;
+        provider: string | null;
+        createdAt: string;
+        expiresAt: string;
+        lastUsedAt: string | null;
+        lastUsedIp: string | null;
+        current: boolean;
+      }[];
+    };
+  };
+  "DELETE /sessions/:id": {
+    input: undefined;
+    output: {
+      revoked: true;
+    };
+  };
+  "GET /identities": {
+    input: undefined;
+    output: {
+      identities: {
+        id: string;
+        provider: string;
+        email: string | null;
+        createdAt: string;
+        lastSignInAt: string | null;
+      }[];
+    };
+  };
+  "DELETE /identities/:id": {
+    input: undefined;
+    output: {
+      unlinked: true;
+    };
+  };
+  "GET /device-logins/:code": {
+    input: undefined;
+    output: {
+      request: null | {
+        userCode: string;
+        clientLabel: string | null;
+        clientIp: string | null;
+        createdAt: string;
+        expiresAt: string;
+      };
+      sessionDays: number;
+    };
+  };
+  "POST /device-logins/:code": {
+    input: {
+      approve: boolean;
+    };
+    output: {
+      decided: true;
+    };
+  };
+  "GET /syncs/providers": {
+    input: undefined;
+    output: {
+      providers: {
+        brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
+        id: string;
+        credential: {
+          placeholder: string;
+          hint: string;
+        };
+        label: string;
+        fields: ({
+          type: "text";
+          name: string;
+          label: string;
+          placeholder: string;
+          optional?: boolean;
+          hint?: string;
+          when?: {
+            field: string;
+            is: string[];
+          };
+        } | {
+          type: "options";
+          name: string;
+          label: string;
+          options: {
+            value: string;
+            label: string;
+          }[];
+          multiple: boolean;
+          initial: string[];
+          hint?: string;
+        })[];
+      }[];
+    };
+  };
+  "GET /syncs/:project/:environment": {
+    input: undefined;
+    output: {
+      syncs: {
+        id: string;
+        provider: string;
+        providerLabel: string;
+        brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
+        offered: boolean;
+        destination: string;
+        config: {
+          [key: string]: string | number | boolean | null | Json[] | {
+            [key: string]: Json;
+          };
+        };
+        credential: string;
+        createdAt: string;
+        createdBy: string;
+        paused: boolean;
+        running: boolean;
+        lastRunAt: string | null;
+        lastStatus: "failed" | "ok" | "partial" | null;
+        lastError: string | null;
+        synced: number;
+        pending: number;
+        skipped: {
+          key: string;
+          reason: string;
+        }[];
+      }[];
+      canManage: boolean;
+    };
+  };
+  "POST /syncs/:project/:environment": {
+    input: {
+      provider: string;
+      config: {
+        [key: string]: unknown;
+      };
+      credential: string;
+    };
+    output: {
+      id: string;
+      provider: string;
+      providerLabel: string;
+      brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
+      offered: boolean;
+      destination: string;
+      config: {
+        [key: string]: string | number | boolean | null | Json[] | {
+          [key: string]: Json;
+        };
+      };
+      credential: string;
+      createdAt: string;
+      createdBy: string;
+      paused: boolean;
+      running: boolean;
+      lastRunAt: string | null;
+      lastStatus: "failed" | "ok" | "partial" | null;
+      lastError: string | null;
+      synced: number;
+      pending: number;
+      skipped: {
+        key: string;
+        reason: string;
+      }[];
+    };
+  };
+  "PATCH /syncs/by-id/:id": {
+    input: {
+      paused: boolean;
+    };
+    output: {
+      id: string;
+      provider: string;
+      providerLabel: string;
+      brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
+      offered: boolean;
+      destination: string;
+      config: {
+        [key: string]: string | number | boolean | null | Json[] | {
+          [key: string]: Json;
+        };
+      };
+      credential: string;
+      createdAt: string;
+      createdBy: string;
+      paused: boolean;
+      running: boolean;
+      lastRunAt: string | null;
+      lastStatus: "failed" | "ok" | "partial" | null;
+      lastError: string | null;
+      synced: number;
+      pending: number;
+      skipped: {
+        key: string;
+        reason: string;
+      }[];
+    };
+  };
+  "DELETE /syncs/by-id/:id": {
+    input: undefined;
+    output: {
+      id: string;
+      provider: string;
+      providerLabel: string;
+      brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
+      offered: boolean;
+      destination: string;
+      config: {
+        [key: string]: string | number | boolean | null | Json[] | {
+          [key: string]: Json;
+        };
+      };
+      credential: string;
+      createdAt: string;
+      createdBy: string;
+      paused: boolean;
+      running: boolean;
+      lastRunAt: string | null;
+      lastStatus: "failed" | "ok" | "partial" | null;
+      lastError: string | null;
+      synced: number;
+      pending: number;
+      skipped: {
+        key: string;
+        reason: string;
+      }[];
+    };
+  };
+  "POST /syncs/by-id/:id/runs": {
+    input: undefined;
+    output: {
+      sync: {
+        id: string;
+        provider: string;
+        providerLabel: string;
+        brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
+        offered: boolean;
+        destination: string;
+        config: {
+          [key: string]: string | number | boolean | null | Json[] | {
+            [key: string]: Json;
+          };
+        };
+        credential: string;
+        createdAt: string;
+        createdBy: string;
+        paused: boolean;
+        running: boolean;
+        lastRunAt: string | null;
+        lastStatus: "failed" | "ok" | "partial" | null;
+        lastError: string | null;
+        synced: number;
+        pending: number;
+        skipped: {
+          key: string;
+          reason: string;
+        }[];
+      };
+      outcome: {
+        status: "busy";
+      } | {
+        status: "failed" | "ok" | "partial";
+        upserted: string[];
+        deleted: string[];
+        failed: {
+          key: string;
+          operation: "delete" | "upsert";
+          message: string;
+        }[];
+        error: string | null;
+      };
+    };
+  };
+  "GET /audit": {
+    input: {
+      path?: string;
+      actor?: string;
+      decision?: "allow" | "deny";
+      detail?: "1" | "true";
+      before?: unknown;
+      limit?: unknown;
+    };
+    output: {
+      entries: {
+        seq: number;
+        author: "app" | "vault";
+        occurredAt: string;
+        actorType: "service" | "system" | "user";
+        actorId: string;
+        action: string;
+        decision: "allow" | "deny";
+        reason: string | null;
+        detail: boolean;
+        subject: string | null;
+        project: string | null;
+        environment: string | null;
+        key: string | null;
+        version: number | null;
+        operationId: string | null;
+        relatedSeq: number | null;
+        requestId: string | null;
+        metadata: {
+          [key: string]: unknown;
+        };
+      }[];
+      hidden?: {
+        action: string;
+        count: number;
+      }[];
+    };
+  };
+  "GET /audit/verification": {
+    input: undefined;
+    output: {
+      ok: true;
+      through: number | null;
+      entries: number;
+      checkpoint: null | {
+        seq: number;
+        signedAt: string;
+      };
+      pending?: number;
+    } | {
+      ok: false;
+      through: number | null;
+      failedAtSeq: number | null;
+      author: "app" | "vault";
+      reason: string;
+    };
+  };
+};
+type AccessValue = "access-manager" | "auditor" | "developer" | "maintainer" | "owner" | "viewer" | null | {
+  role: "access-manager" | "auditor" | "developer" | "maintainer" | "owner" | "viewer";
+  until: string | null;
+};
+type AuditEntryView = {
+  seq: number;
+  author: "app" | "vault";
+  occurredAt: string;
+  actorType: "service" | "system" | "user";
+  actorId: string;
+  action: string;
+  decision: "allow" | "deny";
+  reason: string | null;
+  detail: boolean;
+  subject: string | null;
+  project: string | null;
+  environment: string | null;
+  key: string | null;
+  version: number | null;
+  operationId: string | null;
+  relatedSeq: number | null;
+  requestId: string | null;
+  metadata: {
+    [key: string]: unknown;
+  };
+};
+type AuthInfo = {
+  signin: null | {
+    title: string;
+    note: string | null;
+    providers: {
+      id: string;
+      label: string;
+      brand: "github" | "google" | "microsoft" | "oidc";
+    }[];
+  };
+  access: null | {
+    assertion: boolean;
+  };
+};
+type DryRunOutcome = "added" | "archived" | "changed" | "unchanged";
+type DryRunResult = {
+  dryRun: true;
+  keys: {
+    [key: string]: "added" | "archived" | "changed" | "unchanged";
+  };
+};
+type IdentityRow = {
+  id: string;
+  provider: string;
+  email: string | null;
+  createdAt: string;
+  lastSignInAt: string | null;
+};
+type Me = {
+  principal: {
+    type: "service" | "user";
+    id: string;
+  };
+  registered: boolean;
+  tampered: boolean;
+  instanceRole: "owner" | "root-admin" | "user";
+  isRootAdmin: boolean;
+  canReadAudit: boolean;
+  environments: {
+    project: string;
+    environment: string;
+    permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
+  }[];
+};
+type Member = {
+  member: string;
+  principalType: "service" | "user";
+  principalId: string;
+  instanceRole: "owner" | "root-admin" | "user";
+  isRootAdmin: boolean;
+  tampered: boolean;
+  grants: {
+    id: string;
+    project: string;
+    environment: string | null;
+    role: "access-manager" | "auditor" | "developer" | "maintainer" | "owner" | "viewer";
+    roleName: string;
+    permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
+    expiresAt: string | null;
+  }[];
+};
+type OffboardingReport = {
+  principalType: "service" | "user";
+  principalId: string;
+  status: "active" | "removed" | "tampered";
+  instanceRole: "owner" | "root-admin" | "user";
+  isRootAdmin: boolean;
+  removedAt: string | null;
+  removedBy: string | null;
+  live: {
+    grants: number;
+    sessions: number;
+    tokens: number;
+    identities: number;
+  };
+  exposed: {
+    project: string;
+    environment: string;
+    key: string;
+    version: number;
+    how: "read" | "wrote";
+    at: string;
+  }[];
+  rotated: number;
+  issuedTokens: {
+    id: string;
+    service: string;
+    label: string | null;
+    hint: string;
+    expiresAt: string;
+    lastUsedAt: string | null;
+  }[];
+  syncs: {
+    id: string;
+    provider: string;
+    providerLabel: string;
+    brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
+    offered: boolean;
+    destination: string;
+    config: {
+      [key: string]: string | number | boolean | null | Json[] | {
+        [key: string]: Json;
+      };
+    };
+    credential: string;
+    createdAt: string;
+    createdBy: string;
+    paused: boolean;
+    running: boolean;
+    lastRunAt: string | null;
+    lastStatus: "failed" | "ok" | "partial" | null;
+    lastError: string | null;
+    synced: number;
+    pending: number;
+    skipped: {
+      key: string;
+      reason: string;
+    }[];
+    project: string;
+    environment: string;
+  }[];
+};
+type ProjectSummary = {
+  slug: string;
+  name: string;
+  archivedAt: string | null;
+  permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
+  environments: {
+    slug: string;
+    name: string;
+    accessible: boolean;
+    details: null | {
+      archivedAt: string | null;
+      secretCount: number | null;
+    };
+  }[];
+};
+type RemovedMember = {
+  principalType: "service" | "user";
+  principalId: string;
+  toRotate: number;
+};
+type RunOutcome = {
+  status: "busy";
+} | {
+  status: "failed" | "ok" | "partial";
+  upserted: string[];
+  deleted: string[];
+  failed: {
+    key: string;
+    operation: "delete" | "upsert";
+    message: string;
+  }[];
+  error: string | null;
+};
+type SecretKey = {
+  key: string;
+  archived: boolean;
+  version: number | null;
+  updatedAt: string | null;
+  updatedBy: string | null;
+};
+type SecretVersion = {
+  version: number;
+  createdAt: string;
+  createdBy: string;
+  current: boolean;
+  kek: string;
+};
+type ServiceTokenRow = {
+  id: string;
+  label: string | null;
+  hint: string;
+  createdAt: string;
+  createdBy: string;
+  expiresAt: string;
+  lastUsedAt: string | null;
+  lastUsedIp: string | null;
+};
+type SessionRow = {
+  id: string;
+  kind: "browser" | "cli";
+  label: string | null;
+  hint: string;
+  provider: string | null;
+  createdAt: string;
+  expiresAt: string;
+  lastUsedAt: string | null;
+  lastUsedIp: string | null;
+  current: boolean;
+};
+type SetResult = {
+  operationId: string;
+  keys: {
+    [key: string]: {
+      version: number;
+    } | {
+      archived: true;
+    };
+  };
+};
+type SyncField = {
+  type: "text";
+  name: string;
+  label: string;
+  placeholder: string;
+  optional?: boolean;
+  hint?: string;
+  when?: {
+    field: string;
+    is: string[];
+  };
+} | {
+  type: "options";
+  name: string;
+  label: string;
+  options: {
+    value: string;
+    label: string;
+  }[];
+  multiple: boolean;
+  initial: string[];
+  hint?: string;
+};
+type SyncProviderInfo = {
+  brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
+  id: string;
+  credential: {
+    placeholder: string;
+    hint: string;
+  };
+  label: string;
+  fields: ({
+    type: "text";
+    name: string;
+    label: string;
+    placeholder: string;
+    optional?: boolean;
+    hint?: string;
+    when?: {
+      field: string;
+      is: string[];
+    };
+  } | {
+    type: "options";
+    name: string;
+    label: string;
+    options: {
+      value: string;
+      label: string;
+    }[];
+    multiple: boolean;
+    initial: string[];
+    hint?: string;
+  })[];
+};
+type SyncView = {
+  id: string;
+  provider: string;
+  providerLabel: string;
+  brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
+  offered: boolean;
+  destination: string;
+  config: {
+    [key: string]: string | number | boolean | null | Json[] | {
+      [key: string]: Json;
+    };
+  };
+  credential: string;
+  createdAt: string;
+  createdBy: string;
+  paused: boolean;
+  running: boolean;
+  lastRunAt: string | null;
+  lastStatus: "failed" | "ok" | "partial" | null;
+  lastError: string | null;
+  synced: number;
+  pending: number;
+  skipped: {
+    key: string;
+    reason: string;
+  }[];
+};
+type Json = string | number | boolean | null | Json[] | {
+  [key: string]: Json;
+};
+//#endregion
+//#region src/sync-fields.d.ts
+type FormValues = Record<string, string | string[]>;
+export declare function initialValues(provider: SyncProviderInfo): FormValues;
+/** Whether the rest of the form makes the field meaningful. */
+export declare function isAsked(field: SyncField, values: FormValues): boolean;
+/** The label of the first required field left empty, or null when the form can be sent. */
+export declare function firstMissing(provider: SyncProviderInfo, values: FormValues): string | null;
+/**
+ * The provider's config. Text is trimmed, and an optional field left empty
+ * is left out rather than sent as "", which the server rightly refuses.
+ */
+export declare function configFromForm(provider: SyncProviderInfo, values: FormValues): Record<string, unknown>;
+/**
+ * The config from `name=value` arguments, as the CLI takes them. A field with
+ * several options takes them comma-separated, and one left out gets what the
+ * form preselects. Text goes as typed, for the server to check.
+ */
+export declare function configFromArguments(provider: SyncProviderInfo, assignments: readonly string[]): Record<string, unknown>;
+//#endregion
+//#region src/index.d.ts
+export type RouteKey = keyof Api;
+/** What a caller sends: the body, or the query string for a GET. */
+export type RouteInput<K extends RouteKey> = Api[K]['input'];
+/** What comes back, as JSON. */
+export type RouteOutput<K extends RouteKey> = Api[K]['output'];
+type ParamNames<Pattern> = Pattern extends `${string}:${infer Name}/${infer Rest}` ? Name | ParamNames<`/${Rest}`> : Pattern extends `${string}:${infer Name}` ? Name : never;
+/** `GET /members/:member` takes `{ member }`. */
+export type Params<Key> = { [Name in ParamNames<Key>]: string; };
+export type Transport = (request: Request) => Promise<Response>;
+export type ClientOptions = {
+  /** The instance's origin, e.g. `https://coffre.acme.example`. */
+  url: string;
+  /** Sent with every request: a bearer token, a Cloudflare Access header. */
+  headers?: () => HeadersInit | Promise<HeadersInit>;
+  transport?: Transport;
+};
+/** The API's error shape, `{ error, message }`, with the HTTP status. */
+declare const COFFRE_ERROR: unique symbol;
+export declare class CoffreError extends Error {
+  /**
+   * `@coffre/ui`'s prebuilt pages bundle a copy of this class, and a page is
+   * handed a client the server made with this package's. So `instanceof`
+   * asks for the mark every copy leaves, rather than for this copy's prototype.
+   */
+  static [Symbol.hasInstance](value: unknown): boolean;
+  readonly [COFFRE_ERROR] = true;
+  readonly status: number;
+  readonly code: string;
+  /** The vault's own code when it refused: `no_grant`, `removed`, `bulk_limit`, ... */
+  readonly reason: string | undefined;
+  constructor(status: number, code: string, message: string, reason?: string);
+}
+type Args<K extends RouteKey> = RouteInput<K> extends undefined ? [params: Params<K>, input?: undefined] : Partial<RouteInput<K>> extends RouteInput<K> ? [params: Params<K>, input?: RouteInput<K>] : [params: Params<K>, input: RouteInput<K>];
+export declare function createClient(options: ClientOptions): {
+  call: <K extends RouteKey>(key: K, ...[params, input]: Args<K>) => Promise<RouteOutput<K>>;
+  /** How this instance signs people in. Answers anyone, signed in or not. */
+  auth: () => Promise<AuthInfo>;
+  /** Who I am, and every place I can reach. */
+  me: () => Promise<{
+    principal: {
+      type: "service" | "user";
+      id: string;
+    };
+    registered: boolean;
+    tampered: boolean;
+    instanceRole: "owner" | "root-admin" | "user";
+    isRootAdmin: boolean;
+    canReadAudit: boolean;
+    environments: {
+      project: string;
+      environment: string;
+      permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
+    }[];
+  }>;
+  projects: {
+    /** With their environments. */
+    list: () => Promise<{
+      projects: {
+        slug: string;
+        name: string;
+        archivedAt: string | null;
+        permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
+        environments: {
+          slug: string;
+          name: string;
+          accessible: boolean;
+          details: null | {
+            archivedAt: string | null;
+            secretCount: number | null;
+          };
+        }[];
+      }[];
+    }>;
+    create: (project: string, input: RouteInput<"PUT /projects/:project">) => Promise<{
+      project: {
+        slug: string;
+        name: string;
+        archivedAt: string | null;
+      };
+      created: boolean;
+    }>;
+    update: (project: string, patch: RouteInput<"PATCH /projects/:project">) => Promise<{
+      project: {
+        slug: string;
+        name: string;
+        archivedAt: string | null;
+      };
+    }>;
+  };
+  environments: {
+    create: (path: string, input: RouteInput<"PUT /projects/:project/:environment">) => Promise<{
+      environment: {
+        slug: string;
+        name: string;
+        archivedAt: string | null;
+      };
+      created: boolean;
+    }>;
+    update: (path: string, patch: RouteInput<"PATCH /projects/:project/:environment">) => Promise<{
+      environment: {
+        slug: string;
+        name: string;
+        archivedAt: string | null;
+      };
+    }>;
+  };
+  secrets: {
+    /** Keys, versions and who changed what; never values. */
+    list: (path: string) => Promise<{
+      permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
+      keys: {
+        key: string;
+        archived: boolean;
+        version: number | null;
+        updatedAt: string | null;
+        updatedBy: string | null;
+      }[];
+    }>;
+    /** Decrypts one secret, or every secret in an environment. Logged in your name. */
+    reveal: (path: string) => Promise<{
+      operationId: string;
+      values: {
+        [key: string]: string;
+      };
+    }>;
+    /** One transaction, a version and an audit entry per key; `null` archives. */
+    set: (path: string, values: RouteInput<"PATCH /secrets/:project/:environment">) => Promise<SetResult>;
+    /**
+     * What `set` would do to each key, `added`, `changed`, `unchanged` or
+     * `archived`, and nothing else: no value comes back and nothing is
+     * written. Comparing opens the current values, logged as reads.
+     */
+    dryRun: (path: string, values: RouteInput<"PATCH /secrets/:project/:environment">) => Promise<DryRunResult>;
+    history: (path: string) => Promise<{
+      key: string;
+      archived: boolean;
+      versions: {
+        version: number;
+        createdAt: string;
+        createdBy: string;
+        current: boolean;
+        kek: string;
+      }[];
+    }>;
+    /** A new version holding the old one's value. */
+    restore: (path: string, version: number) => Promise<{
+      key: string;
+      version: number;
+    }>;
+    rename: (path: string, key: string) => Promise<{
+      key: string;
+      archived: boolean;
+    }>;
+    update: (path: string, patch: RouteInput<"PATCH /secrets/:project/:environment/:key">) => Promise<{
+      key: string;
+      archived: boolean;
+    }>;
+  };
+  members: {
+    /** People and tokens, their role and their access; at a place, those who reach it. */
+    list: (path?: string) => Promise<{
+      members: {
+        member: string;
+        principalType: "service" | "user";
+        principalId: string;
+        instanceRole: "owner" | "root-admin" | "user";
+        isRootAdmin: boolean;
+        tampered: boolean;
+        grants: {
+          id: string;
+          project: string;
+          environment: string | null;
+          role: "access-manager" | "auditor" | "developer" | "maintainer" | "owner" | "viewer";
+          roleName: string;
+          permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
+          expiresAt: string | null;
+        }[];
+      }[];
+      removed: {
+        principalType: "service" | "user";
+        principalId: string;
+        toRotate: number;
+      }[];
+    }>;
+    /** What they hold, and what to rotate if they leave. */
+    get: (member: string) => Promise<{
+      principalType: "service" | "user";
+      principalId: string;
+      status: "active" | "removed" | "tampered";
+      instanceRole: "owner" | "root-admin" | "user";
+      isRootAdmin: boolean;
+      removedAt: string | null;
+      removedBy: string | null;
+      live: {
+        grants: number;
+        sessions: number;
+        tokens: number;
+        identities: number;
+      };
+      exposed: {
+        project: string;
+        environment: string;
+        key: string;
+        version: number;
+        how: "read" | "wrote";
+        at: string;
+      }[];
+      rotated: number;
+      issuedTokens: {
+        id: string;
+        service: string;
+        label: string | null;
+        hint: string;
+        expiresAt: string;
+        lastUsedAt: string | null;
+      }[];
+      syncs: {
+        id: string;
+        provider: string;
+        providerLabel: string;
+        brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
+        offered: boolean;
+        destination: string;
+        config: {
+          [key: string]: string | number | boolean | null | Json[] | {
+            [key: string]: Json;
+          };
+        };
+        credential: string;
+        createdAt: string;
+        createdBy: string;
+        paused: boolean;
+        running: boolean;
+        lastRunAt: string | null;
+        lastStatus: "failed" | "ok" | "partial" | null;
+        lastError: string | null;
+        synced: number;
+        pending: number;
+        skipped: {
+          key: string;
+          reason: string;
+        }[];
+        project: string;
+        environment: string;
+      }[];
+    }>;
+    add: (member: string, input?: RouteInput<"PUT /members/:member">) => Promise<{
+      member: string;
+      instanceRole: "owner" | "user";
+      created: boolean;
+    }>;
+    /** Offboards; returns what to rotate. */
+    remove: (member: string) => Promise<{
+      revoked: {
+        grants: number;
+        sessions: number;
+        tokens: number;
+        identities: number;
+      };
+      report: {
+        principalType: "service" | "user";
+        principalId: string;
+        status: "active" | "removed" | "tampered";
+        instanceRole: "owner" | "root-admin" | "user";
+        isRootAdmin: boolean;
+        removedAt: string | null;
+        removedBy: string | null;
+        live: {
+          grants: number;
+          sessions: number;
+          tokens: number;
+          identities: number;
+        };
+        exposed: {
+          project: string;
+          environment: string;
+          key: string;
+          version: number;
+          how: "read" | "wrote";
+          at: string;
+        }[];
+        rotated: number;
+        issuedTokens: {
+          id: string;
+          service: string;
+          label: string | null;
+          hint: string;
+          expiresAt: string;
+          lastUsedAt: string | null;
+        }[];
+        syncs: {
+          id: string;
+          provider: string;
+          providerLabel: string;
+          brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
+          offered: boolean;
+          destination: string;
+          config: {
+            [key: string]: string | number | boolean | null | Json[] | {
+              [key: string]: Json;
+            };
+          };
+          credential: string;
+          createdAt: string;
+          createdBy: string;
+          paused: boolean;
+          running: boolean;
+          lastRunAt: string | null;
+          lastStatus: "failed" | "ok" | "partial" | null;
+          lastError: string | null;
+          synced: number;
+          pending: number;
+          skipped: {
+            key: string;
+            reason: string;
+          }[];
+          project: string;
+          environment: string;
+        }[];
+      };
+    }>;
+  };
+  tokens: {
+    list: (member: string) => Promise<{
+      tokens: {
+        id: string;
+        label: string | null;
+        hint: string;
+        createdAt: string;
+        createdBy: string;
+        expiresAt: string;
+        lastUsedAt: string | null;
+        lastUsedIp: string | null;
+      }[];
+    }>;
+    /** The value is in the answer, and only there. */
+    issue: (member: string, input: RouteInput<"POST /members/:member/tokens">) => Promise<{
+      id: string;
+      token: string;
+      expiresAt: string;
+    }>;
+    revoke: (member: string, id: string) => Promise<{
+      revoked: true;
+    }>;
+  };
+  access: {
+    /** What they should hold at each place; the server applies the difference. `null` revokes. */
+    set: (member: string, access: RouteInput<"PATCH /access/:member">) => Promise<{
+      changes: {
+        [key: string]: "created" | "revoked" | "unchanged" | "updated";
+      };
+    }>;
+  };
+  /** Where I am signed in. Only where coffre runs its own sign-in. */
+  sessions: {
+    list: () => Promise<{
+      sessions: {
+        id: string;
+        kind: "browser" | "cli";
+        label: string | null;
+        hint: string;
+        provider: string | null;
+        createdAt: string;
+        expiresAt: string;
+        lastUsedAt: string | null;
+        lastUsedIp: string | null;
+        current: boolean;
+      }[];
+    }>;
+    revoke: (id: string) => Promise<{
+      revoked: true;
+    }>;
+  };
+  /** The accounts I sign in with. */
+  identities: {
+    list: () => Promise<{
+      identities: {
+        id: string;
+        provider: string;
+        email: string | null;
+        createdAt: string;
+        lastSignInAt: string | null;
+      }[];
+    }>;
+    unlink: (id: string) => Promise<{
+      unlinked: true;
+    }>;
+  };
+  /** A `coffre login` waiting for someone to approve it, by the code it shows. */
+  deviceLogins: {
+    get: (code: string) => Promise<{
+      request: null | {
+        userCode: string;
+        clientLabel: string | null;
+        clientIp: string | null;
+        createdAt: string;
+        expiresAt: string;
+      };
+      sessionDays: number;
+    }>;
+    decide: (code: string, approve: boolean) => Promise<{
+      decided: true;
+    }>;
+  };
+  syncs: {
+    /** Where a sync can push on this instance, and what each asks for. */
+    providers: () => Promise<{
+      providers: {
+        brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
+        id: string;
+        credential: {
+          placeholder: string;
+          hint: string;
+        };
+        label: string;
+        fields: ({
+          type: "text";
+          name: string;
+          label: string;
+          placeholder: string;
+          optional?: boolean;
+          hint?: string;
+          when?: {
+            field: string;
+            is: string[];
+          };
+        } | {
+          type: "options";
+          name: string;
+          label: string;
+          options: {
+            value: string;
+            label: string;
+          }[];
+          multiple: boolean;
+          initial: string[];
+          hint?: string;
+        })[];
+      }[];
+    }>;
+    list: (path: string) => Promise<{
+      syncs: {
+        id: string;
+        provider: string;
+        providerLabel: string;
+        brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
+        offered: boolean;
+        destination: string;
+        config: {
+          [key: string]: string | number | boolean | null | Json[] | {
+            [key: string]: Json;
+          };
+        };
+        credential: string;
+        createdAt: string;
+        createdBy: string;
+        paused: boolean;
+        running: boolean;
+        lastRunAt: string | null;
+        lastStatus: "failed" | "ok" | "partial" | null;
+        lastError: string | null;
+        synced: number;
+        pending: number;
+        skipped: {
+          key: string;
+          reason: string;
+        }[];
+      }[];
+      canManage: boolean;
+    }>;
+    add: (path: string, input: RouteInput<"POST /syncs/:project/:environment">) => Promise<{
+      id: string;
+      provider: string;
+      providerLabel: string;
+      brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
+      offered: boolean;
+      destination: string;
+      config: {
+        [key: string]: string | number | boolean | null | Json[] | {
+          [key: string]: Json;
+        };
+      };
+      credential: string;
+      createdAt: string;
+      createdBy: string;
+      paused: boolean;
+      running: boolean;
+      lastRunAt: string | null;
+      lastStatus: "failed" | "ok" | "partial" | null;
+      lastError: string | null;
+      synced: number;
+      pending: number;
+      skipped: {
+        key: string;
+        reason: string;
+      }[];
+    }>;
+    update: (id: string, patch: RouteInput<"PATCH /syncs/by-id/:id">) => Promise<{
+      id: string;
+      provider: string;
+      providerLabel: string;
+      brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
+      offered: boolean;
+      destination: string;
+      config: {
+        [key: string]: string | number | boolean | null | Json[] | {
+          [key: string]: Json;
+        };
+      };
+      credential: string;
+      createdAt: string;
+      createdBy: string;
+      paused: boolean;
+      running: boolean;
+      lastRunAt: string | null;
+      lastStatus: "failed" | "ok" | "partial" | null;
+      lastError: string | null;
+      synced: number;
+      pending: number;
+      skipped: {
+        key: string;
+        reason: string;
+      }[];
+    }>;
+    remove: (id: string) => Promise<{
+      id: string;
+      provider: string;
+      providerLabel: string;
+      brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
+      offered: boolean;
+      destination: string;
+      config: {
+        [key: string]: string | number | boolean | null | Json[] | {
+          [key: string]: Json;
+        };
+      };
+      credential: string;
+      createdAt: string;
+      createdBy: string;
+      paused: boolean;
+      running: boolean;
+      lastRunAt: string | null;
+      lastStatus: "failed" | "ok" | "partial" | null;
+      lastError: string | null;
+      synced: number;
+      pending: number;
+      skipped: {
+        key: string;
+        reason: string;
+      }[];
+    }>;
+    run: (id: string) => Promise<{
+      sync: {
+        id: string;
+        provider: string;
+        providerLabel: string;
+        brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
+        offered: boolean;
+        destination: string;
+        config: {
+          [key: string]: string | number | boolean | null | Json[] | {
+            [key: string]: Json;
+          };
+        };
+        credential: string;
+        createdAt: string;
+        createdBy: string;
+        paused: boolean;
+        running: boolean;
+        lastRunAt: string | null;
+        lastStatus: "failed" | "ok" | "partial" | null;
+        lastError: string | null;
+        synced: number;
+        pending: number;
+        skipped: {
+          key: string;
+          reason: string;
+        }[];
+      };
+      outcome: {
+        status: "busy";
+      } | {
+        status: "failed" | "ok" | "partial";
+        upserted: string[];
+        deleted: string[];
+        failed: {
+          key: string;
+          operation: "delete" | "upsert";
+          message: string;
+        }[];
+        error: string | null;
+      };
+    }>;
+  };
+  audit: {
+    list: (query?: RouteInput<"GET /audit">) => Promise<{
+      entries: {
+        seq: number;
+        author: "app" | "vault";
+        occurredAt: string;
+        actorType: "service" | "system" | "user";
+        actorId: string;
+        action: string;
+        decision: "allow" | "deny";
+        reason: string | null;
+        detail: boolean;
+        subject: string | null;
+        project: string | null;
+        environment: string | null;
+        key: string | null;
+        version: number | null;
+        operationId: string | null;
+        relatedSeq: number | null;
+        requestId: string | null;
+        metadata: {
+          [key: string]: unknown;
+        };
+      }[];
+      hidden?: {
+        action: string;
+        count: number;
+      }[];
+    }>;
+    verify: () => Promise<{
+      ok: true;
+      through: number | null;
+      entries: number;
+      checkpoint: null | {
+        seq: number;
+        signedAt: string;
+      };
+      pending?: number;
+    } | {
+      ok: false;
+      through: number | null;
+      failedAtSeq: number | null;
+      author: "app" | "vault";
+      reason: string;
+    }>;
+  };
+};
+export type CoffreClient = ReturnType<typeof createClient>;
+export type ImportAction = Exclude<DryRunOutcome, 'archived'>;
+/**
+ * What writing these entries (a parsed `.env` file) would do, from a dry run
+ * of the write: the server compares, so no value leaves it, and the values it
+ * opens to compare are logged as reads. `changes` is what to pass to
+ * `secrets.set`: the keys that differ, so an unchanged value does not become
+ * a new version.
+ */
+export declare function planImport(coffre: CoffreClient, path: string, entries: readonly {
+  key: string;
+  value: string;
+}[]): Promise<{
+  plan: {
+    key: string;
+    action: ImportAction;
+    version: number | null;
+  }[];
+  changes: Record<string, string>;
+}>;
+//#endregion
+export type { AccessValue, Api, AuditEntryView, AuthInfo, DryRunOutcome, DryRunResult, FormValues, IdentityRow, Json, Me, Member, OffboardingReport, ProjectSummary, RemovedMember, RunOutcome, SecretKey, SecretVersion, ServiceTokenRow, SessionRow, SetResult, SyncField, SyncProviderInfo, SyncView };