@coffre/client 0.1.6 → 0.1.7

package/dist/index.d.ts

@@ -1,1722 +1,2 @@
-//#region src/api.d.ts
-/** Every route, by `METHOD /path`: what a caller sends (the body, or the query of a GET) and gets back. */
-type Api = {
-  "GET /me": {
-    input: undefined;
-    output: {
-      principal: {
-        type: "service" | "user";
-        id: string;
-      };
-      registered: boolean;
-      tampered: boolean;
-      instanceRole: "owner" | "root-admin" | "user";
-      isRootAdmin: boolean;
-      canReadAudit: boolean;
-      environments: {
-        project: string;
-        environment: string;
-        permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
-      }[];
-    };
-  };
-  "GET /projects": {
-    input: undefined;
-    output: {
-      projects: {
-        slug: string;
-        name: string;
-        archivedAt: string | null;
-        permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
-        environments: {
-          slug: string;
-          name: string;
-          accessible: boolean;
-          details: null | {
-            archivedAt: string | null;
-            secretCount: number | null;
-          };
-        }[];
-      }[];
-    };
-  };
-  "PUT /projects/:project": {
-    input: {
-      name: string;
-    };
-    output: {
-      project: {
-        slug: string;
-        name: string;
-        archivedAt: string | null;
-      };
-      created: boolean;
-    };
-  };
-  "PATCH /projects/:project": {
-    input: {
-      name?: string;
-      slug?: string;
-      archived?: boolean;
-    };
-    output: {
-      project: {
-        slug: string;
-        name: string;
-        archivedAt: string | null;
-      };
-    };
-  };
-  "PUT /projects/:project/:environment": {
-    input: {
-      name: string;
-    };
-    output: {
-      environment: {
-        slug: string;
-        name: string;
-        archivedAt: string | null;
-      };
-      created: boolean;
-    };
-  };
-  "PATCH /projects/:project/:environment": {
-    input: {
-      name?: string;
-      slug?: string;
-      archived?: boolean;
-    };
-    output: {
-      environment: {
-        slug: string;
-        name: string;
-        archivedAt: string | null;
-      };
-    };
-  };
-  "GET /secrets/:project/:environment": {
-    input: undefined;
-    output: {
-      permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
-      keys: {
-        key: string;
-        archived: boolean;
-        version: number | null;
-        updatedAt: string | null;
-        updatedBy: string | null;
-      }[];
-    };
-  };
-  "PATCH /secrets/:project/:environment": {
-    input: {
-      [key: string]: string | null;
-    };
-    output: {
-      operationId: string;
-      keys: {
-        [key: string]: {
-          version: number;
-        } | {
-          archived: true;
-        };
-      };
-    } | {
-      dryRun: true;
-      keys: {
-        [key: string]: "added" | "archived" | "changed" | "unchanged";
-      };
-    };
-  };
-  "PATCH /secrets/:project/:environment/:key": {
-    input: {
-      key?: string;
-      archived?: boolean;
-    };
-    output: {
-      key: string;
-      archived: boolean;
-    };
-  };
-  "GET /secrets/:project/:environment/:key/versions": {
-    input: undefined;
-    output: {
-      key: string;
-      archived: boolean;
-      versions: {
-        version: number;
-        createdAt: string;
-        createdBy: string;
-        current: boolean;
-        kek: string;
-      }[];
-    };
-  };
-  "POST /secrets/:project/:environment/:key/restore": {
-    input: {
-      version: number;
-    };
-    output: {
-      key: string;
-      version: number;
-    };
-  };
-  "POST /reveals": {
-    input: {
-      path: string;
-    };
-    output: {
-      operationId: string;
-      values: {
-        [key: string]: string;
-      };
-    };
-  };
-  "GET /members": {
-    input: {
-      path?: string;
-    };
-    output: {
-      members: {
-        member: string;
-        principalType: "service" | "user";
-        principalId: string;
-        instanceRole: "owner" | "root-admin" | "user";
-        isRootAdmin: boolean;
-        tampered: boolean;
-        grants: {
-          id: string;
-          project: string;
-          environment: string | null;
-          role: "access-manager" | "auditor" | "developer" | "maintainer" | "owner" | "viewer";
-          roleName: string;
-          permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
-          expiresAt: string | null;
-        }[];
-      }[];
-      removed: {
-        principalType: "service" | "user";
-        principalId: string;
-        toRotate: number;
-      }[];
-    };
-  };
-  "GET /members/:member": {
-    input: undefined;
-    output: {
-      principalType: "service" | "user";
-      principalId: string;
-      status: "active" | "removed" | "tampered";
-      instanceRole: "owner" | "root-admin" | "user";
-      isRootAdmin: boolean;
-      removedAt: string | null;
-      removedBy: string | null;
-      live: {
-        grants: number;
-        sessions: number;
-        tokens: number;
-        identities: number;
-      };
-      exposed: {
-        project: string;
-        environment: string;
-        key: string;
-        version: number;
-        how: "read" | "wrote";
-        at: string;
-      }[];
-      rotated: number;
-      issuedTokens: {
-        id: string;
-        service: string;
-        label: string | null;
-        hint: string;
-        expiresAt: string;
-        lastUsedAt: string | null;
-      }[];
-      syncs: {
-        id: string;
-        provider: string;
-        providerLabel: string;
-        brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
-        offered: boolean;
-        destination: string;
-        config: {
-          [key: string]: string | number | boolean | null | Json[] | {
-            [key: string]: Json;
-          };
-        };
-        credential: string;
-        createdAt: string;
-        createdBy: string;
-        paused: boolean;
-        running: boolean;
-        lastRunAt: string | null;
-        lastStatus: "failed" | "ok" | "partial" | null;
-        lastError: string | null;
-        synced: number;
-        pending: number;
-        skipped: {
-          key: string;
-          reason: string;
-        }[];
-        project: string;
-        environment: string;
-      }[];
-    };
-  };
-  "PUT /members/:member": {
-    input: {
-      owner?: boolean;
-    };
-    output: {
-      member: string;
-      instanceRole: "owner" | "user";
-      created: boolean;
-    };
-  };
-  "DELETE /members/:member": {
-    input: undefined;
-    output: {
-      revoked: {
-        grants: number;
-        sessions: number;
-        tokens: number;
-        identities: number;
-      };
-      report: {
-        principalType: "service" | "user";
-        principalId: string;
-        status: "active" | "removed" | "tampered";
-        instanceRole: "owner" | "root-admin" | "user";
-        isRootAdmin: boolean;
-        removedAt: string | null;
-        removedBy: string | null;
-        live: {
-          grants: number;
-          sessions: number;
-          tokens: number;
-          identities: number;
-        };
-        exposed: {
-          project: string;
-          environment: string;
-          key: string;
-          version: number;
-          how: "read" | "wrote";
-          at: string;
-        }[];
-        rotated: number;
-        issuedTokens: {
-          id: string;
-          service: string;
-          label: string | null;
-          hint: string;
-          expiresAt: string;
-          lastUsedAt: string | null;
-        }[];
-        syncs: {
-          id: string;
-          provider: string;
-          providerLabel: string;
-          brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
-          offered: boolean;
-          destination: string;
-          config: {
-            [key: string]: string | number | boolean | null | Json[] | {
-              [key: string]: Json;
-            };
-          };
-          credential: string;
-          createdAt: string;
-          createdBy: string;
-          paused: boolean;
-          running: boolean;
-          lastRunAt: string | null;
-          lastStatus: "failed" | "ok" | "partial" | null;
-          lastError: string | null;
-          synced: number;
-          pending: number;
-          skipped: {
-            key: string;
-            reason: string;
-          }[];
-          project: string;
-          environment: string;
-        }[];
-      };
-    };
-  };
-  "GET /members/:member/tokens": {
-    input: undefined;
-    output: {
-      tokens: {
-        id: string;
-        label: string | null;
-        hint: string;
-        createdAt: string;
-        createdBy: string;
-        expiresAt: string;
-        lastUsedAt: string | null;
-        lastUsedIp: string | null;
-      }[];
-    };
-  };
-  "POST /members/:member/tokens": {
-    input: {
-      expiresInDays: number;
-      label?: string | null;
-    };
-    output: {
-      id: string;
-      token: string;
-      expiresAt: string;
-    };
-  };
-  "DELETE /members/:member/tokens/:id": {
-    input: undefined;
-    output: {
-      revoked: true;
-    };
-  };
-  "PATCH /access/:member": {
-    input: {
-      [key: string]: "access-manager" | "auditor" | "developer" | "maintainer" | "owner" | "viewer" | null | {
-        role: "access-manager" | "auditor" | "developer" | "maintainer" | "owner" | "viewer";
-        until: string | null;
-      };
-    };
-    output: {
-      changes: {
-        [key: string]: "created" | "revoked" | "unchanged" | "updated";
-      };
-    };
-  };
-  "GET /sessions": {
-    input: undefined;
-    output: {
-      sessions: {
-        id: string;
-        kind: "browser" | "cli";
-        label: string | null;
-        hint: string;
-        provider: string | null;
-        createdAt: string;
-        expiresAt: string;
-        lastUsedAt: string | null;
-        lastUsedIp: string | null;
-        current: boolean;
-      }[];
-    };
-  };
-  "DELETE /sessions/:id": {
-    input: undefined;
-    output: {
-      revoked: true;
-    };
-  };
-  "GET /identities": {
-    input: undefined;
-    output: {
-      identities: {
-        id: string;
-        provider: string;
-        email: string | null;
-        createdAt: string;
-        lastSignInAt: string | null;
-      }[];
-    };
-  };
-  "DELETE /identities/:id": {
-    input: undefined;
-    output: {
-      unlinked: true;
-    };
-  };
-  "GET /device-logins/:code": {
-    input: undefined;
-    output: {
-      request: null | {
-        userCode: string;
-        clientLabel: string | null;
-        clientIp: string | null;
-        createdAt: string;
-        expiresAt: string;
-      };
-      sessionDays: number;
-    };
-  };
-  "POST /device-logins/:code": {
-    input: {
-      approve: boolean;
-    };
-    output: {
-      decided: true;
-    };
-  };
-  "GET /syncs/providers": {
-    input: undefined;
-    output: {
-      providers: {
-        brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
-        id: string;
-        credential: {
-          placeholder: string;
-          hint: string;
-        };
-        label: string;
-        fields: ({
-          type: "text";
-          name: string;
-          label: string;
-          placeholder: string;
-          optional?: boolean;
-          hint?: string;
-          when?: {
-            field: string;
-            is: string[];
-          };
-        } | {
-          type: "options";
-          name: string;
-          label: string;
-          options: {
-            value: string;
-            label: string;
-          }[];
-          multiple: boolean;
-          initial: string[];
-          hint?: string;
-        })[];
-      }[];
-    };
-  };
-  "GET /syncs/:project/:environment": {
-    input: undefined;
-    output: {
-      syncs: {
-        id: string;
-        provider: string;
-        providerLabel: string;
-        brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
-        offered: boolean;
-        destination: string;
-        config: {
-          [key: string]: string | number | boolean | null | Json[] | {
-            [key: string]: Json;
-          };
-        };
-        credential: string;
-        createdAt: string;
-        createdBy: string;
-        paused: boolean;
-        running: boolean;
-        lastRunAt: string | null;
-        lastStatus: "failed" | "ok" | "partial" | null;
-        lastError: string | null;
-        synced: number;
-        pending: number;
-        skipped: {
-          key: string;
-          reason: string;
-        }[];
-      }[];
-      canManage: boolean;
-    };
-  };
-  "POST /syncs/:project/:environment": {
-    input: {
-      provider: string;
-      config: {
-        [key: string]: unknown;
-      };
-      credential: string;
-    };
-    output: {
-      id: string;
-      provider: string;
-      providerLabel: string;
-      brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
-      offered: boolean;
-      destination: string;
-      config: {
-        [key: string]: string | number | boolean | null | Json[] | {
-          [key: string]: Json;
-        };
-      };
-      credential: string;
-      createdAt: string;
-      createdBy: string;
-      paused: boolean;
-      running: boolean;
-      lastRunAt: string | null;
-      lastStatus: "failed" | "ok" | "partial" | null;
-      lastError: string | null;
-      synced: number;
-      pending: number;
-      skipped: {
-        key: string;
-        reason: string;
-      }[];
-    };
-  };
-  "PATCH /syncs/by-id/:id": {
-    input: {
-      paused: boolean;
-    };
-    output: {
-      id: string;
-      provider: string;
-      providerLabel: string;
-      brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
-      offered: boolean;
-      destination: string;
-      config: {
-        [key: string]: string | number | boolean | null | Json[] | {
-          [key: string]: Json;
-        };
-      };
-      credential: string;
-      createdAt: string;
-      createdBy: string;
-      paused: boolean;
-      running: boolean;
-      lastRunAt: string | null;
-      lastStatus: "failed" | "ok" | "partial" | null;
-      lastError: string | null;
-      synced: number;
-      pending: number;
-      skipped: {
-        key: string;
-        reason: string;
-      }[];
-    };
-  };
-  "DELETE /syncs/by-id/:id": {
-    input: undefined;
-    output: {
-      id: string;
-      provider: string;
-      providerLabel: string;
-      brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
-      offered: boolean;
-      destination: string;
-      config: {
-        [key: string]: string | number | boolean | null | Json[] | {
-          [key: string]: Json;
-        };
-      };
-      credential: string;
-      createdAt: string;
-      createdBy: string;
-      paused: boolean;
-      running: boolean;
-      lastRunAt: string | null;
-      lastStatus: "failed" | "ok" | "partial" | null;
-      lastError: string | null;
-      synced: number;
-      pending: number;
-      skipped: {
-        key: string;
-        reason: string;
-      }[];
-    };
-  };
-  "POST /syncs/by-id/:id/runs": {
-    input: undefined;
-    output: {
-      sync: {
-        id: string;
-        provider: string;
-        providerLabel: string;
-        brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
-        offered: boolean;
-        destination: string;
-        config: {
-          [key: string]: string | number | boolean | null | Json[] | {
-            [key: string]: Json;
-          };
-        };
-        credential: string;
-        createdAt: string;
-        createdBy: string;
-        paused: boolean;
-        running: boolean;
-        lastRunAt: string | null;
-        lastStatus: "failed" | "ok" | "partial" | null;
-        lastError: string | null;
-        synced: number;
-        pending: number;
-        skipped: {
-          key: string;
-          reason: string;
-        }[];
-      };
-      outcome: {
-        status: "busy";
-      } | {
-        status: "failed" | "ok" | "partial";
-        upserted: string[];
-        deleted: string[];
-        failed: {
-          key: string;
-          operation: "delete" | "upsert";
-          message: string;
-        }[];
-        error: string | null;
-      };
-    };
-  };
-  "GET /audit": {
-    input: {
-      path?: string;
-      actor?: string;
-      decision?: "allow" | "deny";
-      detail?: "1" | "true";
-      before?: unknown;
-      limit?: unknown;
-    };
-    output: {
-      entries: {
-        seq: number;
-        author: "app" | "vault";
-        occurredAt: string;
-        actorType: "service" | "system" | "user";
-        actorId: string;
-        action: string;
-        decision: "allow" | "deny";
-        reason: string | null;
-        detail: boolean;
-        subject: string | null;
-        project: string | null;
-        environment: string | null;
-        key: string | null;
-        version: number | null;
-        operationId: string | null;
-        relatedSeq: number | null;
-        requestId: string | null;
-        metadata: {
-          [key: string]: unknown;
-        };
-      }[];
-      hidden?: {
-        action: string;
-        count: number;
-      }[];
-    };
-  };
-  "GET /audit/verification": {
-    input: undefined;
-    output: {
-      ok: true;
-      through: number | null;
-      entries: number;
-      checkpoint: null | {
-        seq: number;
-        signedAt: string;
-      };
-      pending?: number;
-    } | {
-      ok: false;
-      through: number | null;
-      failedAtSeq: number | null;
-      author: "app" | "vault";
-      reason: string;
-    };
-  };
-};
-type AccessValue = "access-manager" | "auditor" | "developer" | "maintainer" | "owner" | "viewer" | null | {
-  role: "access-manager" | "auditor" | "developer" | "maintainer" | "owner" | "viewer";
-  until: string | null;
-};
-type AuditEntryView = {
-  seq: number;
-  author: "app" | "vault";
-  occurredAt: string;
-  actorType: "service" | "system" | "user";
-  actorId: string;
-  action: string;
-  decision: "allow" | "deny";
-  reason: string | null;
-  detail: boolean;
-  subject: string | null;
-  project: string | null;
-  environment: string | null;
-  key: string | null;
-  version: number | null;
-  operationId: string | null;
-  relatedSeq: number | null;
-  requestId: string | null;
-  metadata: {
-    [key: string]: unknown;
-  };
-};
-type AuthInfo = {
-  signin: null | {
-    title: string;
-    note: string | null;
-    providers: {
-      id: string;
-      label: string;
-      brand: "github" | "google" | "microsoft" | "oidc";
-    }[];
-  };
-  access: null | {
-    assertion: boolean;
-  };
-};
-type DryRunOutcome = "added" | "archived" | "changed" | "unchanged";
-type DryRunResult = {
-  dryRun: true;
-  keys: {
-    [key: string]: "added" | "archived" | "changed" | "unchanged";
-  };
-};
-type IdentityRow = {
-  id: string;
-  provider: string;
-  email: string | null;
-  createdAt: string;
-  lastSignInAt: string | null;
-};
-type Me = {
-  principal: {
-    type: "service" | "user";
-    id: string;
-  };
-  registered: boolean;
-  tampered: boolean;
-  instanceRole: "owner" | "root-admin" | "user";
-  isRootAdmin: boolean;
-  canReadAudit: boolean;
-  environments: {
-    project: string;
-    environment: string;
-    permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
-  }[];
-};
-type Member = {
-  member: string;
-  principalType: "service" | "user";
-  principalId: string;
-  instanceRole: "owner" | "root-admin" | "user";
-  isRootAdmin: boolean;
-  tampered: boolean;
-  grants: {
-    id: string;
-    project: string;
-    environment: string | null;
-    role: "access-manager" | "auditor" | "developer" | "maintainer" | "owner" | "viewer";
-    roleName: string;
-    permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
-    expiresAt: string | null;
-  }[];
-};
-type OffboardingReport = {
-  principalType: "service" | "user";
-  principalId: string;
-  status: "active" | "removed" | "tampered";
-  instanceRole: "owner" | "root-admin" | "user";
-  isRootAdmin: boolean;
-  removedAt: string | null;
-  removedBy: string | null;
-  live: {
-    grants: number;
-    sessions: number;
-    tokens: number;
-    identities: number;
-  };
-  exposed: {
-    project: string;
-    environment: string;
-    key: string;
-    version: number;
-    how: "read" | "wrote";
-    at: string;
-  }[];
-  rotated: number;
-  issuedTokens: {
-    id: string;
-    service: string;
-    label: string | null;
-    hint: string;
-    expiresAt: string;
-    lastUsedAt: string | null;
-  }[];
-  syncs: {
-    id: string;
-    provider: string;
-    providerLabel: string;
-    brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
-    offered: boolean;
-    destination: string;
-    config: {
-      [key: string]: string | number | boolean | null | Json[] | {
-        [key: string]: Json;
-      };
-    };
-    credential: string;
-    createdAt: string;
-    createdBy: string;
-    paused: boolean;
-    running: boolean;
-    lastRunAt: string | null;
-    lastStatus: "failed" | "ok" | "partial" | null;
-    lastError: string | null;
-    synced: number;
-    pending: number;
-    skipped: {
-      key: string;
-      reason: string;
-    }[];
-    project: string;
-    environment: string;
-  }[];
-};
-type ProjectSummary = {
-  slug: string;
-  name: string;
-  archivedAt: string | null;
-  permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
-  environments: {
-    slug: string;
-    name: string;
-    accessible: boolean;
-    details: null | {
-      archivedAt: string | null;
-      secretCount: number | null;
-    };
-  }[];
-};
-type RemovedMember = {
-  principalType: "service" | "user";
-  principalId: string;
-  toRotate: number;
-};
-type RunOutcome = {
-  status: "busy";
-} | {
-  status: "failed" | "ok" | "partial";
-  upserted: string[];
-  deleted: string[];
-  failed: {
-    key: string;
-    operation: "delete" | "upsert";
-    message: string;
-  }[];
-  error: string | null;
-};
-type SecretKey = {
-  key: string;
-  archived: boolean;
-  version: number | null;
-  updatedAt: string | null;
-  updatedBy: string | null;
-};
-type SecretVersion = {
-  version: number;
-  createdAt: string;
-  createdBy: string;
-  current: boolean;
-  kek: string;
-};
-type ServiceTokenRow = {
-  id: string;
-  label: string | null;
-  hint: string;
-  createdAt: string;
-  createdBy: string;
-  expiresAt: string;
-  lastUsedAt: string | null;
-  lastUsedIp: string | null;
-};
-type SessionRow = {
-  id: string;
-  kind: "browser" | "cli";
-  label: string | null;
-  hint: string;
-  provider: string | null;
-  createdAt: string;
-  expiresAt: string;
-  lastUsedAt: string | null;
-  lastUsedIp: string | null;
-  current: boolean;
-};
-type SetResult = {
-  operationId: string;
-  keys: {
-    [key: string]: {
-      version: number;
-    } | {
-      archived: true;
-    };
-  };
-};
-type SyncField = {
-  type: "text";
-  name: string;
-  label: string;
-  placeholder: string;
-  optional?: boolean;
-  hint?: string;
-  when?: {
-    field: string;
-    is: string[];
-  };
-} | {
-  type: "options";
-  name: string;
-  label: string;
-  options: {
-    value: string;
-    label: string;
-  }[];
-  multiple: boolean;
-  initial: string[];
-  hint?: string;
-};
-type SyncProviderInfo = {
-  brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
-  id: string;
-  credential: {
-    placeholder: string;
-    hint: string;
-  };
-  label: string;
-  fields: ({
-    type: "text";
-    name: string;
-    label: string;
-    placeholder: string;
-    optional?: boolean;
-    hint?: string;
-    when?: {
-      field: string;
-      is: string[];
-    };
-  } | {
-    type: "options";
-    name: string;
-    label: string;
-    options: {
-      value: string;
-      label: string;
-    }[];
-    multiple: boolean;
-    initial: string[];
-    hint?: string;
-  })[];
-};
-type SyncView = {
-  id: string;
-  provider: string;
-  providerLabel: string;
-  brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
-  offered: boolean;
-  destination: string;
-  config: {
-    [key: string]: string | number | boolean | null | Json[] | {
-      [key: string]: Json;
-    };
-  };
-  credential: string;
-  createdAt: string;
-  createdBy: string;
-  paused: boolean;
-  running: boolean;
-  lastRunAt: string | null;
-  lastStatus: "failed" | "ok" | "partial" | null;
-  lastError: string | null;
-  synced: number;
-  pending: number;
-  skipped: {
-    key: string;
-    reason: string;
-  }[];
-};
-type Json = string | number | boolean | null | Json[] | {
-  [key: string]: Json;
-};
-//#endregion
-//#region src/sync-fields.d.ts
-type FormValues = Record<string, string | string[]>;
-export declare function initialValues(provider: SyncProviderInfo): FormValues;
-/** Whether the rest of the form makes the field meaningful. */
-export declare function isAsked(field: SyncField, values: FormValues): boolean;
-/** The label of the first required field left empty, or null when the form can be sent. */
-export declare function firstMissing(provider: SyncProviderInfo, values: FormValues): string | null;
-/**
- * The provider's config. Text is trimmed, and an optional field left empty
- * is left out rather than sent as "", which the server rightly refuses.
- */
-export declare function configFromForm(provider: SyncProviderInfo, values: FormValues): Record<string, unknown>;
-/**
- * The config from `name=value` arguments, as the CLI takes them. A field with
- * several options takes them comma-separated, and one left out gets what the
- * form preselects. Text goes as typed, for the server to check.
- */
-export declare function configFromArguments(provider: SyncProviderInfo, assignments: readonly string[]): Record<string, unknown>;
-//#endregion
-//#region src/index.d.ts
-export type RouteKey = keyof Api;
-/** What a caller sends: the body, or the query string for a GET. */
-export type RouteInput<K extends RouteKey> = Api[K]['input'];
-/** What comes back, as JSON. */
-export type RouteOutput<K extends RouteKey> = Api[K]['output'];
-type ParamNames<Pattern> = Pattern extends `${string}:${infer Name}/${infer Rest}` ? Name | ParamNames<`/${Rest}`> : Pattern extends `${string}:${infer Name}` ? Name : never;
-/** `GET /members/:member` takes `{ member }`. */
-export type Params<Key> = { [Name in ParamNames<Key>]: string; };
-export type Transport = (request: Request) => Promise<Response>;
-export type ClientOptions = {
-  /** The instance's origin, e.g. `https://coffre.acme.example`. */
-  url: string;
-  /** Sent with every request: a bearer token, a Cloudflare Access header. */
-  headers?: () => HeadersInit | Promise<HeadersInit>;
-  transport?: Transport;
-};
-/** The API's error shape, `{ error, message }`, with the HTTP status. */
-declare const COFFRE_ERROR: unique symbol;
-export declare class CoffreError extends Error {
-  /**
-   * `@coffre/ui`'s prebuilt pages bundle a copy of this class, and a page is
-   * handed a client the server made with this package's. So `instanceof`
-   * asks for the mark every copy leaves, rather than for this copy's prototype.
-   */
-  static [Symbol.hasInstance](value: unknown): boolean;
-  readonly [COFFRE_ERROR] = true;
-  readonly status: number;
-  readonly code: string;
-  /** The vault's own code when it refused: `no_grant`, `removed`, `bulk_limit`, ... */
-  readonly reason: string | undefined;
-  constructor(status: number, code: string, message: string, reason?: string);
-}
-type Args<K extends RouteKey> = RouteInput<K> extends undefined ? [params: Params<K>, input?: undefined] : Partial<RouteInput<K>> extends RouteInput<K> ? [params: Params<K>, input?: RouteInput<K>] : [params: Params<K>, input: RouteInput<K>];
-export declare function createClient(options: ClientOptions): {
-  call: <K extends RouteKey>(key: K, ...[params, input]: Args<K>) => Promise<RouteOutput<K>>;
-  /** How this instance signs people in. Answers anyone, signed in or not. */
-  auth: () => Promise<AuthInfo>;
-  /** Who I am, and every place I can reach. */
-  me: () => Promise<{
-    principal: {
-      type: "service" | "user";
-      id: string;
-    };
-    registered: boolean;
-    tampered: boolean;
-    instanceRole: "owner" | "root-admin" | "user";
-    isRootAdmin: boolean;
-    canReadAudit: boolean;
-    environments: {
-      project: string;
-      environment: string;
-      permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
-    }[];
-  }>;
-  projects: {
-    /** With their environments. */
-    list: () => Promise<{
-      projects: {
-        slug: string;
-        name: string;
-        archivedAt: string | null;
-        permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
-        environments: {
-          slug: string;
-          name: string;
-          accessible: boolean;
-          details: null | {
-            archivedAt: string | null;
-            secretCount: number | null;
-          };
-        }[];
-      }[];
-    }>;
-    create: (project: string, input: RouteInput<"PUT /projects/:project">) => Promise<{
-      project: {
-        slug: string;
-        name: string;
-        archivedAt: string | null;
-      };
-      created: boolean;
-    }>;
-    update: (project: string, patch: RouteInput<"PATCH /projects/:project">) => Promise<{
-      project: {
-        slug: string;
-        name: string;
-        archivedAt: string | null;
-      };
-    }>;
-  };
-  environments: {
-    create: (path: string, input: RouteInput<"PUT /projects/:project/:environment">) => Promise<{
-      environment: {
-        slug: string;
-        name: string;
-        archivedAt: string | null;
-      };
-      created: boolean;
-    }>;
-    update: (path: string, patch: RouteInput<"PATCH /projects/:project/:environment">) => Promise<{
-      environment: {
-        slug: string;
-        name: string;
-        archivedAt: string | null;
-      };
-    }>;
-  };
-  secrets: {
-    /** Keys, versions and who changed what; never values. */
-    list: (path: string) => Promise<{
-      permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
-      keys: {
-        key: string;
-        archived: boolean;
-        version: number | null;
-        updatedAt: string | null;
-        updatedBy: string | null;
-      }[];
-    }>;
-    /** Decrypts one secret, or every secret in an environment. Logged in your name. */
-    reveal: (path: string) => Promise<{
-      operationId: string;
-      values: {
-        [key: string]: string;
-      };
-    }>;
-    /** One transaction, a version and an audit entry per key; `null` archives. */
-    set: (path: string, values: RouteInput<"PATCH /secrets/:project/:environment">) => Promise<SetResult>;
-    /**
-     * What `set` would do to each key, `added`, `changed`, `unchanged` or
-     * `archived`, and nothing else: no value comes back and nothing is
-     * written. Comparing opens the current values, logged as reads.
-     */
-    dryRun: (path: string, values: RouteInput<"PATCH /secrets/:project/:environment">) => Promise<DryRunResult>;
-    history: (path: string) => Promise<{
-      key: string;
-      archived: boolean;
-      versions: {
-        version: number;
-        createdAt: string;
-        createdBy: string;
-        current: boolean;
-        kek: string;
-      }[];
-    }>;
-    /** A new version holding the old one's value. */
-    restore: (path: string, version: number) => Promise<{
-      key: string;
-      version: number;
-    }>;
-    rename: (path: string, key: string) => Promise<{
-      key: string;
-      archived: boolean;
-    }>;
-    update: (path: string, patch: RouteInput<"PATCH /secrets/:project/:environment/:key">) => Promise<{
-      key: string;
-      archived: boolean;
-    }>;
-  };
-  members: {
-    /** People and tokens, their role and their access; at a place, those who reach it. */
-    list: (path?: string) => Promise<{
-      members: {
-        member: string;
-        principalType: "service" | "user";
-        principalId: string;
-        instanceRole: "owner" | "root-admin" | "user";
-        isRootAdmin: boolean;
-        tampered: boolean;
-        grants: {
-          id: string;
-          project: string;
-          environment: string | null;
-          role: "access-manager" | "auditor" | "developer" | "maintainer" | "owner" | "viewer";
-          roleName: string;
-          permissions: ("audit.read" | "environment.manage" | "grant.manage" | "project.manage" | "secret.archive" | "secret.read" | "secret.write")[];
-          expiresAt: string | null;
-        }[];
-      }[];
-      removed: {
-        principalType: "service" | "user";
-        principalId: string;
-        toRotate: number;
-      }[];
-    }>;
-    /** What they hold, and what to rotate if they leave. */
-    get: (member: string) => Promise<{
-      principalType: "service" | "user";
-      principalId: string;
-      status: "active" | "removed" | "tampered";
-      instanceRole: "owner" | "root-admin" | "user";
-      isRootAdmin: boolean;
-      removedAt: string | null;
-      removedBy: string | null;
-      live: {
-        grants: number;
-        sessions: number;
-        tokens: number;
-        identities: number;
-      };
-      exposed: {
-        project: string;
-        environment: string;
-        key: string;
-        version: number;
-        how: "read" | "wrote";
-        at: string;
-      }[];
-      rotated: number;
-      issuedTokens: {
-        id: string;
-        service: string;
-        label: string | null;
-        hint: string;
-        expiresAt: string;
-        lastUsedAt: string | null;
-      }[];
-      syncs: {
-        id: string;
-        provider: string;
-        providerLabel: string;
-        brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
-        offered: boolean;
-        destination: string;
-        config: {
-          [key: string]: string | number | boolean | null | Json[] | {
-            [key: string]: Json;
-          };
-        };
-        credential: string;
-        createdAt: string;
-        createdBy: string;
-        paused: boolean;
-        running: boolean;
-        lastRunAt: string | null;
-        lastStatus: "failed" | "ok" | "partial" | null;
-        lastError: string | null;
-        synced: number;
-        pending: number;
-        skipped: {
-          key: string;
-          reason: string;
-        }[];
-        project: string;
-        environment: string;
-      }[];
-    }>;
-    add: (member: string, input?: RouteInput<"PUT /members/:member">) => Promise<{
-      member: string;
-      instanceRole: "owner" | "user";
-      created: boolean;
-    }>;
-    /** Offboards; returns what to rotate. */
-    remove: (member: string) => Promise<{
-      revoked: {
-        grants: number;
-        sessions: number;
-        tokens: number;
-        identities: number;
-      };
-      report: {
-        principalType: "service" | "user";
-        principalId: string;
-        status: "active" | "removed" | "tampered";
-        instanceRole: "owner" | "root-admin" | "user";
-        isRootAdmin: boolean;
-        removedAt: string | null;
-        removedBy: string | null;
-        live: {
-          grants: number;
-          sessions: number;
-          tokens: number;
-          identities: number;
-        };
-        exposed: {
-          project: string;
-          environment: string;
-          key: string;
-          version: number;
-          how: "read" | "wrote";
-          at: string;
-        }[];
-        rotated: number;
-        issuedTokens: {
-          id: string;
-          service: string;
-          label: string | null;
-          hint: string;
-          expiresAt: string;
-          lastUsedAt: string | null;
-        }[];
-        syncs: {
-          id: string;
-          provider: string;
-          providerLabel: string;
-          brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
-          offered: boolean;
-          destination: string;
-          config: {
-            [key: string]: string | number | boolean | null | Json[] | {
-              [key: string]: Json;
-            };
-          };
-          credential: string;
-          createdAt: string;
-          createdBy: string;
-          paused: boolean;
-          running: boolean;
-          lastRunAt: string | null;
-          lastStatus: "failed" | "ok" | "partial" | null;
-          lastError: string | null;
-          synced: number;
-          pending: number;
-          skipped: {
-            key: string;
-            reason: string;
-          }[];
-          project: string;
-          environment: string;
-        }[];
-      };
-    }>;
-  };
-  tokens: {
-    list: (member: string) => Promise<{
-      tokens: {
-        id: string;
-        label: string | null;
-        hint: string;
-        createdAt: string;
-        createdBy: string;
-        expiresAt: string;
-        lastUsedAt: string | null;
-        lastUsedIp: string | null;
-      }[];
-    }>;
-    /** The value is in the answer, and only there. */
-    issue: (member: string, input: RouteInput<"POST /members/:member/tokens">) => Promise<{
-      id: string;
-      token: string;
-      expiresAt: string;
-    }>;
-    revoke: (member: string, id: string) => Promise<{
-      revoked: true;
-    }>;
-  };
-  access: {
-    /** What they should hold at each place; the server applies the difference. `null` revokes. */
-    set: (member: string, access: RouteInput<"PATCH /access/:member">) => Promise<{
-      changes: {
-        [key: string]: "created" | "revoked" | "unchanged" | "updated";
-      };
-    }>;
-  };
-  /** Where I am signed in. Only where coffre runs its own sign-in. */
-  sessions: {
-    list: () => Promise<{
-      sessions: {
-        id: string;
-        kind: "browser" | "cli";
-        label: string | null;
-        hint: string;
-        provider: string | null;
-        createdAt: string;
-        expiresAt: string;
-        lastUsedAt: string | null;
-        lastUsedIp: string | null;
-        current: boolean;
-      }[];
-    }>;
-    revoke: (id: string) => Promise<{
-      revoked: true;
-    }>;
-  };
-  /** The accounts I sign in with. */
-  identities: {
-    list: () => Promise<{
-      identities: {
-        id: string;
-        provider: string;
-        email: string | null;
-        createdAt: string;
-        lastSignInAt: string | null;
-      }[];
-    }>;
-    unlink: (id: string) => Promise<{
-      unlinked: true;
-    }>;
-  };
-  /** A `coffre login` waiting for someone to approve it, by the code it shows. */
-  deviceLogins: {
-    get: (code: string) => Promise<{
-      request: null | {
-        userCode: string;
-        clientLabel: string | null;
-        clientIp: string | null;
-        createdAt: string;
-        expiresAt: string;
-      };
-      sessionDays: number;
-    }>;
-    decide: (code: string, approve: boolean) => Promise<{
-      decided: true;
-    }>;
-  };
-  syncs: {
-    /** Where a sync can push on this instance, and what each asks for. */
-    providers: () => Promise<{
-      providers: {
-        brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
-        id: string;
-        credential: {
-          placeholder: string;
-          hint: string;
-        };
-        label: string;
-        fields: ({
-          type: "text";
-          name: string;
-          label: string;
-          placeholder: string;
-          optional?: boolean;
-          hint?: string;
-          when?: {
-            field: string;
-            is: string[];
-          };
-        } | {
-          type: "options";
-          name: string;
-          label: string;
-          options: {
-            value: string;
-            label: string;
-          }[];
-          multiple: boolean;
-          initial: string[];
-          hint?: string;
-        })[];
-      }[];
-    }>;
-    list: (path: string) => Promise<{
-      syncs: {
-        id: string;
-        provider: string;
-        providerLabel: string;
-        brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
-        offered: boolean;
-        destination: string;
-        config: {
-          [key: string]: string | number | boolean | null | Json[] | {
-            [key: string]: Json;
-          };
-        };
-        credential: string;
-        createdAt: string;
-        createdBy: string;
-        paused: boolean;
-        running: boolean;
-        lastRunAt: string | null;
-        lastStatus: "failed" | "ok" | "partial" | null;
-        lastError: string | null;
-        synced: number;
-        pending: number;
-        skipped: {
-          key: string;
-          reason: string;
-        }[];
-      }[];
-      canManage: boolean;
-    }>;
-    add: (path: string, input: RouteInput<"POST /syncs/:project/:environment">) => Promise<{
-      id: string;
-      provider: string;
-      providerLabel: string;
-      brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
-      offered: boolean;
-      destination: string;
-      config: {
-        [key: string]: string | number | boolean | null | Json[] | {
-          [key: string]: Json;
-        };
-      };
-      credential: string;
-      createdAt: string;
-      createdBy: string;
-      paused: boolean;
-      running: boolean;
-      lastRunAt: string | null;
-      lastStatus: "failed" | "ok" | "partial" | null;
-      lastError: string | null;
-      synced: number;
-      pending: number;
-      skipped: {
-        key: string;
-        reason: string;
-      }[];
-    }>;
-    update: (id: string, patch: RouteInput<"PATCH /syncs/by-id/:id">) => Promise<{
-      id: string;
-      provider: string;
-      providerLabel: string;
-      brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
-      offered: boolean;
-      destination: string;
-      config: {
-        [key: string]: string | number | boolean | null | Json[] | {
-          [key: string]: Json;
-        };
-      };
-      credential: string;
-      createdAt: string;
-      createdBy: string;
-      paused: boolean;
-      running: boolean;
-      lastRunAt: string | null;
-      lastStatus: "failed" | "ok" | "partial" | null;
-      lastError: string | null;
-      synced: number;
-      pending: number;
-      skipped: {
-        key: string;
-        reason: string;
-      }[];
-    }>;
-    remove: (id: string) => Promise<{
-      id: string;
-      provider: string;
-      providerLabel: string;
-      brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
-      offered: boolean;
-      destination: string;
-      config: {
-        [key: string]: string | number | boolean | null | Json[] | {
-          [key: string]: Json;
-        };
-      };
-      credential: string;
-      createdAt: string;
-      createdBy: string;
-      paused: boolean;
-      running: boolean;
-      lastRunAt: string | null;
-      lastStatus: "failed" | "ok" | "partial" | null;
-      lastError: string | null;
-      synced: number;
-      pending: number;
-      skipped: {
-        key: string;
-        reason: string;
-      }[];
-    }>;
-    run: (id: string) => Promise<{
-      sync: {
-        id: string;
-        provider: string;
-        providerLabel: string;
-        brand: "cloudflare" | "github" | "other" | "railway" | "vercel";
-        offered: boolean;
-        destination: string;
-        config: {
-          [key: string]: string | number | boolean | null | Json[] | {
-            [key: string]: Json;
-          };
-        };
-        credential: string;
-        createdAt: string;
-        createdBy: string;
-        paused: boolean;
-        running: boolean;
-        lastRunAt: string | null;
-        lastStatus: "failed" | "ok" | "partial" | null;
-        lastError: string | null;
-        synced: number;
-        pending: number;
-        skipped: {
-          key: string;
-          reason: string;
-        }[];
-      };
-      outcome: {
-        status: "busy";
-      } | {
-        status: "failed" | "ok" | "partial";
-        upserted: string[];
-        deleted: string[];
-        failed: {
-          key: string;
-          operation: "delete" | "upsert";
-          message: string;
-        }[];
-        error: string | null;
-      };
-    }>;
-  };
-  audit: {
-    list: (query?: RouteInput<"GET /audit">) => Promise<{
-      entries: {
-        seq: number;
-        author: "app" | "vault";
-        occurredAt: string;
-        actorType: "service" | "system" | "user";
-        actorId: string;
-        action: string;
-        decision: "allow" | "deny";
-        reason: string | null;
-        detail: boolean;
-        subject: string | null;
-        project: string | null;
-        environment: string | null;
-        key: string | null;
-        version: number | null;
-        operationId: string | null;
-        relatedSeq: number | null;
-        requestId: string | null;
-        metadata: {
-          [key: string]: unknown;
-        };
-      }[];
-      hidden?: {
-        action: string;
-        count: number;
-      }[];
-    }>;
-    verify: () => Promise<{
-      ok: true;
-      through: number | null;
-      entries: number;
-      checkpoint: null | {
-        seq: number;
-        signedAt: string;
-      };
-      pending?: number;
-    } | {
-      ok: false;
-      through: number | null;
-      failedAtSeq: number | null;
-      author: "app" | "vault";
-      reason: string;
-    }>;
-  };
-};
-export type CoffreClient = ReturnType<typeof createClient>;
-export type ImportAction = Exclude<DryRunOutcome, 'archived'>;
-/**
- * What writing these entries (a parsed `.env` file) would do, from a dry run
- * of the write: the server compares, so no value leaves it, and the values it
- * opens to compare are logged as reads. `changes` is what to pass to
- * `secrets.set`: the keys that differ, so an unchanged value does not become
- * a new version.
- */
-export declare function planImport(coffre: CoffreClient, path: string, entries: readonly {
-  key: string;
-  value: string;
-}[]): Promise<{
-  plan: {
-    key: string;
-    action: ImportAction;
-    version: number | null;
-  }[];
-  changes: Record<string, string>;
-}>;
-//#endregion
-export type { AccessValue, Api, AuditEntryView, AuthInfo, DryRunOutcome, DryRunResult, FormValues, IdentityRow, Json, Me, Member, OffboardingReport, ProjectSummary, RemovedMember, RunOutcome, SecretKey, SecretVersion, ServiceTokenRow, SessionRow, SetResult, SyncField, SyncProviderInfo, SyncView };
+import { A as RemovedMember, C as DryRunResult, D as Member, E as Me, F as SessionRow, I as SetResult, L as SyncField, M as SecretKey, N as SecretVersion, O as OffboardingReport, P as ServiceTokenRow, R as SyncProviderInfo, S as DryRunOutcome, T as Json, _ as isAsked, a as Params, b as AuditEntryView, c as RouteOutput, d as planImport, f as FormValues, g as initialValues, h as firstMissing, i as ImportAction, j as RunOutcome, k as ProjectSummary, l as Transport, m as configFromForm, n as CoffreClient, o as RouteInput, p as configFromArguments, r as CoffreError, s as RouteKey, t as ClientOptions, u as createClient, v as AccessValue, w as IdentityRow, x as AuthInfo, y as Api, z as SyncView } from "./index-BJZEgxE8.js";
+export { type AccessValue, type Api, type AuditEntryView, type AuthInfo, ClientOptions, CoffreClient, CoffreError, type DryRunOutcome, type DryRunResult, type FormValues, type IdentityRow, ImportAction, type Json, type Me, type Member, type OffboardingReport, Params, type ProjectSummary, type RemovedMember, RouteInput, RouteKey, RouteOutput, type RunOutcome, type SecretKey, type SecretVersion, type ServiceTokenRow, type SessionRow, type SetResult, type SyncField, type SyncProviderInfo, type SyncView, Transport, configFromArguments, configFromForm, createClient, firstMissing, initialValues, isAsked, planImport };