@earthlink/dotvault 0.13.0

package/dist/index.js

@@ -0,0 +1,2326 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { realpathSync } from "fs";
+import { basename as basename6 } from "path";
+import { fileURLToPath } from "url";
+import { createRequire } from "module";
+import { Command } from "commander";
+
+// ../shared/dist/api-types.js
+function isAuthChallenge(r) {
+  return "challenge" in r;
+}
+var GLOBAL_ALL_ENV = "_all";
+var FILE_SLUG_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+function isValidFileSlug(value) {
+  if (value.length === 0 || value.length > 64)
+    return false;
+  if (value.includes(".."))
+    return false;
+  return FILE_SLUG_PATTERN.test(value);
+}
+function fileNameToSlug(fileName) {
+  const slug = fileName.startsWith(".") ? fileName.slice(1) : fileName;
+  if (!isValidFileSlug(slug)) {
+    throw new Error(`Invalid env file name: ${JSON.stringify(fileName)}`);
+  }
+  return slug;
+}
+function slugToFileName(slug) {
+  return slug.startsWith(".") ? slug : `.${slug}`;
+}
+
+// ../shared/dist/errors.js
+var EnvSyncError = class extends Error {
+  code;
+  exitCode;
+  constructor(code, message, exitCode) {
+    super(message);
+    this.name = "EnvSyncError";
+    this.code = code;
+    this.exitCode = exitCode;
+  }
+};
+var AuthRequiredError = class extends EnvSyncError {
+  constructor(msg = "Not logged in. Run `dotvault login` first.") {
+    super("AUTH_REQUIRED", msg, 3);
+    this.name = "AuthRequiredError";
+  }
+};
+var AuthExpiredError = class extends EnvSyncError {
+  constructor(msg = "Session expired. Run `dotvault login`.") {
+    super("AUTH_EXPIRED", msg, 3);
+    this.name = "AuthExpiredError";
+  }
+};
+var InvalidCredentialsError = class extends EnvSyncError {
+  constructor(msg = "Invalid email or password.") {
+    super("INVALID_CREDENTIALS", msg, 3);
+    this.name = "InvalidCredentialsError";
+  }
+};
+var PermissionDeniedError = class extends EnvSyncError {
+  constructor(project, env) {
+    super("PERMISSION_DENIED", `You do not have permission for project '${project}' env '${env}'. Ask an org admin to grant access at https://app.dotvault.io.`, 4);
+    this.name = "PermissionDeniedError";
+  }
+};
+var ProjectNotFoundError = class extends EnvSyncError {
+  constructor(project, env) {
+    super("PROJECT_NOT_FOUND", `No secrets found for project '${project}' env '${env}'. Check the names \u2014 they are case-sensitive \u2014 and that the project exists in the admin console.`, 5);
+    this.name = "ProjectNotFoundError";
+  }
+};
+var InvalidMfaCodeError = class extends EnvSyncError {
+  constructor(msg = "Invalid MFA code. Try again.") {
+    super("INVALID_MFA_CODE", msg, 3);
+    this.name = "InvalidMfaCodeError";
+  }
+};
+var MfaSessionExpiredError = class extends EnvSyncError {
+  constructor(msg = "MFA session expired. Run `dotvault login` again.") {
+    super("MFA_SESSION_EXPIRED", msg, 3);
+    this.name = "MfaSessionExpiredError";
+  }
+};
+var NetworkError = class extends EnvSyncError {
+  constructor(msg) {
+    super("NETWORK_ERROR", msg, 2);
+    this.name = "NetworkError";
+  }
+};
+var ValidationError = class extends EnvSyncError {
+  constructor(msg) {
+    super("VALIDATION_ERROR", msg, 6);
+    this.name = "ValidationError";
+  }
+};
+function isEnvSyncError(value) {
+  return value instanceof EnvSyncError;
+}
+
+// ../shared/dist/capabilities.js
+var ALL_CAPABILITIES = [
+  "secret.versioning",
+  "injection.run",
+  "cli.write",
+  "sdk.access",
+  "integration.sync",
+  "integration.webhook",
+  "dynamic.secrets",
+  "secret.rotation",
+  "secret.sharing",
+  "sso.saml_oidc",
+  "scim.provisioning",
+  "approval.workflow",
+  "audit.search",
+  "audit.export",
+  "audit.siem_stream",
+  "config.inheritance"
+];
+var DEFAULT_PLAN_CAPABILITIES = {
+  free: ["secret.versioning", "injection.run", "cli.write", "sdk.access"],
+  team: [
+    "secret.versioning",
+    "injection.run",
+    "cli.write",
+    "sdk.access",
+    "integration.sync",
+    "integration.webhook",
+    "secret.sharing",
+    "audit.search",
+    "config.inheritance"
+  ],
+  business: [
+    "secret.versioning",
+    "injection.run",
+    "cli.write",
+    "sdk.access",
+    "integration.sync",
+    "integration.webhook",
+    "secret.sharing",
+    "audit.search",
+    "config.inheritance",
+    "approval.workflow",
+    "dynamic.secrets",
+    "secret.rotation",
+    "audit.export",
+    "sso.saml_oidc"
+  ],
+  enterprise: [...ALL_CAPABILITIES]
+};
+var DEFAULT_PLAN_LIMITS = {
+  free: {
+    max_users: 10,
+    max_orgs: 1,
+    max_projects: 5,
+    max_keys: 50,
+    max_teams: null
+  },
+  team: {
+    max_users: 100,
+    max_orgs: 3,
+    max_projects: 50,
+    max_keys: 500,
+    max_teams: 10
+  },
+  business: {
+    max_users: 500,
+    max_orgs: null,
+    max_projects: null,
+    max_keys: null,
+    max_teams: null
+  },
+  enterprise: {
+    max_users: null,
+    max_orgs: null,
+    max_projects: null,
+    max_keys: null,
+    max_teams: null
+  }
+};
+var DEFAULT_PLAN_ALLOWED_ROLES = {
+  free: ["member", "org_admin"],
+  team: ["member", "team_admin", "org_admin"],
+  business: ["member", "team_admin", "org_admin"],
+  enterprise: ["member", "team_admin", "org_admin", "platform_admin"]
+};
+var DEFAULT_PLAN_CATALOG = {
+  free: {
+    plan: "free",
+    capabilities: [...DEFAULT_PLAN_CAPABILITIES.free],
+    limits: DEFAULT_PLAN_LIMITS.free,
+    allowed_roles: DEFAULT_PLAN_ALLOWED_ROLES.free,
+    version: 1,
+    updated_at: "1970-01-01T00:00:00.000Z",
+    updated_by: "system"
+  },
+  team: {
+    plan: "team",
+    capabilities: [...DEFAULT_PLAN_CAPABILITIES.team],
+    limits: DEFAULT_PLAN_LIMITS.team,
+    allowed_roles: DEFAULT_PLAN_ALLOWED_ROLES.team,
+    version: 1,
+    updated_at: "1970-01-01T00:00:00.000Z",
+    updated_by: "system"
+  },
+  business: {
+    plan: "business",
+    capabilities: [...DEFAULT_PLAN_CAPABILITIES.business],
+    limits: DEFAULT_PLAN_LIMITS.business,
+    allowed_roles: DEFAULT_PLAN_ALLOWED_ROLES.business,
+    version: 1,
+    updated_at: "1970-01-01T00:00:00.000Z",
+    updated_by: "system"
+  },
+  enterprise: {
+    plan: "enterprise",
+    capabilities: [...DEFAULT_PLAN_CAPABILITIES.enterprise],
+    limits: DEFAULT_PLAN_LIMITS.enterprise,
+    allowed_roles: DEFAULT_PLAN_ALLOWED_ROLES.enterprise,
+    version: 1,
+    updated_at: "1970-01-01T00:00:00.000Z",
+    updated_by: "system"
+  }
+};
+
+// src/config.ts
+import { readFile } from "fs/promises";
+import { resolve } from "path";
+
+// src/env-vars.ts
+function resolveServiceToken(env = process.env) {
+  return env.DOTVAULT_TOKEN ?? env.ENV_SYNC_TOKEN;
+}
+function resolveAdminServiceToken(env = process.env) {
+  return env.DOTVAULT_ADMIN_TOKEN ?? env.ENV_SYNC_ADMIN_TOKEN;
+}
+function resolveApiUrlOverride(env = process.env) {
+  return env.DOTVAULT_API_URL ?? env.ENV_SYNC_API_URL;
+}
+
+// src/config.ts
+async function loadProjectConfig(cwd = process.cwd()) {
+  const path = resolve(cwd, "project-config.json");
+  const cfg = await loadProjectConfigIfPresent(cwd);
+  if (cfg === null) {
+    throw new ValidationError(
+      `No project-config.json found at ${path}. Run \`env-sync init\` here, or run env-sync from a directory that has one.`
+    );
+  }
+  return cfg;
+}
+async function loadProjectConfigIfPresent(cwd = process.cwd()) {
+  const path = resolve(cwd, "project-config.json");
+  let raw;
+  try {
+    raw = await readFile(path, "utf8");
+  } catch (err) {
+    const e = err;
+    if (e.code === "ENOENT") return null;
+    throw new ValidationError(
+      `Could not read project-config.json at ${path}: ${err.message}`
+    );
+  }
+  return parseProjectConfig(raw, path);
+}
+var DEFAULT_API_URL = "https://api.dotvault.io/v1";
+async function resolveApiUrl(cwd = process.cwd()) {
+  const override = resolveApiUrlOverride();
+  if (override !== void 0 && override.length > 0) return override;
+  const cfg = await loadProjectConfigIfPresent(cwd);
+  return cfg?.proxy.apiUrl ?? DEFAULT_API_URL;
+}
+function parseProjectConfig(raw, source = "<inline>") {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new ValidationError(`Invalid JSON in ${source}: ${err.message}`);
+  }
+  const name = parsed.name;
+  if (typeof name !== "string" || name.length === 0) {
+    throw new ValidationError(`${source}: 'name' is required and must be a non-empty string`);
+  }
+  const proxyRaw = parsed.setup?.bootstrap?.proxy;
+  const apiUrl = proxyRaw?.apiUrl;
+  if (typeof apiUrl !== "string" || apiUrl.length === 0) {
+    throw new ValidationError(
+      `${source}: 'setup.bootstrap.proxy.apiUrl' is required for env-sync CLI`
+    );
+  }
+  const envSyncRaw = parsed.setup?.envSync;
+  const filesRaw = envSyncRaw?.files;
+  const targetRaw = envSyncRaw?.target;
+  let files;
+  let target;
+  let targetIsDeprecated = false;
+  if (Array.isArray(filesRaw) && filesRaw.length > 0) {
+    files = [];
+    for (const f of filesRaw) {
+      if (typeof f !== "string" || f.length === 0) {
+        throw new ValidationError(
+          `${source}: 'setup.envSync.files' must be a non-empty array of file name strings`
+        );
+      }
+      try {
+        fileNameToSlug(f);
+      } catch (err) {
+        throw new ValidationError(
+          `${source}: 'setup.envSync.files' entry ${JSON.stringify(f)} is invalid: ${err.message}`
+        );
+      }
+      files.push(f);
+    }
+    target = typeof targetRaw === "string" && targetRaw.length > 0 ? targetRaw : files[0];
+  } else if (typeof targetRaw === "string" && targetRaw.length > 0) {
+    try {
+      fileNameToSlug(targetRaw);
+    } catch (err) {
+      throw new ValidationError(
+        `${source}: 'setup.envSync.target' is invalid: ${err.message}`
+      );
+    }
+    files = [targetRaw];
+    target = targetRaw;
+    targetIsDeprecated = true;
+  } else {
+    throw new ValidationError(
+      `${source}: provide 'setup.envSync.files' (preferred, schema 2.7.0) or 'setup.envSync.target' (deprecated, schema 2.6.0)`
+    );
+  }
+  const defaultEnv = envSyncRaw?.defaultEnv;
+  if (defaultEnv !== "development" && defaultEnv !== "staging" && defaultEnv !== "production") {
+    throw new ValidationError(
+      `${source}: 'setup.envSync.defaultEnv' must be one of development/staging/production`
+    );
+  }
+  const enabledRaw = envSyncRaw?.enabled;
+  const enabled = typeof enabledRaw === "boolean" ? enabledRaw : false;
+  const cognitoUserPoolId = typeof proxyRaw?.cognitoUserPoolId === "string" ? proxyRaw.cognitoUserPoolId : void 0;
+  const cognitoClientId = typeof proxyRaw?.cognitoClientId === "string" ? proxyRaw.cognitoClientId : void 0;
+  return {
+    name,
+    proxy: { apiUrl, cognitoUserPoolId, cognitoClientId },
+    envSync: { enabled, files, target, targetIsDeprecated, defaultEnv }
+  };
+}
+function resolveEnv(flag, appEnvVar, defaultEnv) {
+  return flag ?? appEnvVar ?? defaultEnv;
+}
+
+// src/http.ts
+function createHttpClient(apiUrl, fetchImpl = fetch) {
+  const base = apiUrl.replace(/\/+$/, "");
+  async function post(path, body, token) {
+    const res = await callFetch(fetchImpl, `${base}${path}`, {
+      method: "POST",
+      headers: jsonHeaders(token),
+      body: JSON.stringify(body)
+    });
+    return handleResponse(res);
+  }
+  return {
+    async login(req) {
+      return post("/auth/login", req);
+    },
+    async mfaRespond(req) {
+      return post("/auth/mfa-respond", req);
+    },
+    async refresh(req) {
+      return post("/auth/refresh", req);
+    },
+    async envPull(token, query) {
+      const url = new URL(`${base}/env/pull`);
+      url.searchParams.set("project", query.project);
+      url.searchParams.set("env", query.env);
+      url.searchParams.set("file", query.file);
+      const res = await callFetch(fetchImpl, url.toString(), {
+        method: "GET",
+        headers: jsonHeaders(token)
+      });
+      return handleResponse(res);
+    },
+    async envPullAll(token, query) {
+      const url = new URL(`${base}/env/pull`);
+      url.searchParams.set("project", query.project);
+      url.searchParams.set("env", query.env);
+      const res = await callFetch(fetchImpl, url.toString(), {
+        method: "GET",
+        headers: jsonHeaders(token)
+      });
+      return handleResponse(res);
+    },
+    async envList(token, query) {
+      const url = new URL(`${base}/env/list`);
+      url.searchParams.set("project", query.project);
+      const res = await callFetch(fetchImpl, url.toString(), {
+        method: "GET",
+        headers: jsonHeaders(token)
+      });
+      return handleResponse(res);
+    },
+    async envKeysPut(token, query, body) {
+      const url = writeUrl(base, "/env/keys", query);
+      const res = await callFetch(fetchImpl, url, {
+        method: "PUT",
+        headers: jsonHeaders(token),
+        body: JSON.stringify(body)
+      });
+      return handleResponse(res);
+    },
+    async envKeysDelete(token, query, body) {
+      const url = writeUrl(base, "/env/keys", query);
+      const res = await callFetch(fetchImpl, url, {
+        method: "DELETE",
+        headers: jsonHeaders(token),
+        body: JSON.stringify(body)
+      });
+      return handleResponse(res);
+    },
+    async envVersions(token, query) {
+      const url = new URL(`${base}/env/versions`);
+      url.searchParams.set("project", query.project);
+      url.searchParams.set("env", query.env);
+      url.searchParams.set("file", query.file);
+      url.searchParams.set("key", query.key);
+      const res = await callFetch(fetchImpl, url.toString(), {
+        method: "GET",
+        headers: jsonHeaders(token)
+      });
+      return handleResponse(res);
+    },
+    async envRollback(token, query, body) {
+      const url = writeUrl(base, "/env/rollback", query);
+      const res = await callFetch(fetchImpl, url, {
+        method: "POST",
+        headers: jsonHeaders(token),
+        body: JSON.stringify(body)
+      });
+      return handleResponse(res);
+    },
+    async envFilesPut(token, query, body) {
+      const url = new URL(`${base}/env/files`);
+      url.searchParams.set("project", query.project);
+      url.searchParams.set("env", query.env);
+      const res = await callFetch(fetchImpl, url.toString(), {
+        method: "PUT",
+        headers: jsonHeaders(token),
+        body: JSON.stringify(body)
+      });
+      return handleResponse(res);
+    },
+    async envFilesGet(token, query) {
+      const url = new URL(`${base}/env/files`);
+      url.searchParams.set("project", query.project);
+      url.searchParams.set("env", query.env);
+      const res = await callFetch(fetchImpl, url.toString(), {
+        method: "GET",
+        headers: jsonHeaders(token)
+      });
+      return handleResponse(res);
+    },
+    async envGlobalKeys(token, query, opts) {
+      const url = new URL(`${base}/env/global-keys`);
+      if (query?.project !== void 0) url.searchParams.set("project", query.project);
+      const res = await callFetch(fetchImpl, url.toString(), {
+        method: "GET",
+        headers: jsonHeaders(token, opts?.orgId)
+      });
+      return handleResponse(res);
+    },
+    async envGlobalKeysSet(token, query, body, opts) {
+      const url = new URL(`${base}/env/global-keys`);
+      if (query.env !== void 0) url.searchParams.set("env", query.env);
+      const res = await callFetch(fetchImpl, url.toString(), {
+        method: "PUT",
+        headers: jsonHeaders(token, opts?.orgId),
+        body: JSON.stringify(body)
+      });
+      return handleResponse(res);
+    },
+    async envGlobalKeysDelete(token, query, body, opts) {
+      const url = new URL(`${base}/env/global-keys`);
+      if (query.env !== void 0) url.searchParams.set("env", query.env);
+      const res = await callFetch(fetchImpl, url.toString(), {
+        method: "DELETE",
+        headers: jsonHeaders(token, opts?.orgId),
+        body: JSON.stringify(body)
+      });
+      return handleResponse(res);
+    },
+    async envGlobalBindingsGet(token, query) {
+      const url = new URL(`${base}/env/global-bindings`);
+      url.searchParams.set("project", query.project);
+      const res = await callFetch(fetchImpl, url.toString(), {
+        method: "GET",
+        headers: jsonHeaders(token)
+      });
+      return handleResponse(res);
+    },
+    async envGlobalBindingsPatch(token, query, body) {
+      const url = new URL(`${base}/env/global-bindings`);
+      url.searchParams.set("project", query.project);
+      const res = await callFetch(fetchImpl, url.toString(), {
+        method: "PATCH",
+        headers: jsonHeaders(token),
+        body: JSON.stringify(body)
+      });
+      return handleResponse(res);
+    },
+    async adminTokensList(token, query) {
+      const res = await callFetch(
+        fetchImpl,
+        `${base}/admin/orgs/${encodeURIComponent(query.orgId)}/tokens`,
+        { method: "GET", headers: jsonHeaders(token) }
+      );
+      return handleResponse(res);
+    },
+    async adminTokensCreate(token, query, body) {
+      const res = await callFetch(
+        fetchImpl,
+        `${base}/admin/orgs/${encodeURIComponent(query.orgId)}/tokens`,
+        { method: "POST", headers: jsonHeaders(token), body: JSON.stringify(body) }
+      );
+      return handleResponse(res);
+    },
+    async adminTokensRevoke(token, query) {
+      const res = await callFetch(
+        fetchImpl,
+        `${base}/admin/orgs/${encodeURIComponent(query.orgId)}/tokens/${encodeURIComponent(query.tokenId)}`,
+        { method: "DELETE", headers: jsonHeaders(token) }
+      );
+      if (!res.ok) {
+        await handleResponse(res);
+      }
+    },
+    async adminProjectsCreate(token, body) {
+      const res = await callFetch(fetchImpl, `${base}/admin/projects`, {
+        method: "POST",
+        headers: jsonHeaders(token),
+        body: JSON.stringify(body)
+      });
+      return handleResponse(res);
+    },
+    async adminProjectsUpdate(token, projectRef, body) {
+      const res = await callFetch(
+        fetchImpl,
+        `${base}/admin/projects/${encodeURIComponent(projectRef)}`,
+        {
+          method: "PUT",
+          headers: jsonHeaders(token),
+          body: JSON.stringify(body)
+        }
+      );
+      return handleResponse(res);
+    }
+  };
+}
+function writeUrl(base, path, query) {
+  const url = new URL(`${base}${path}`);
+  url.searchParams.set("project", query.project);
+  url.searchParams.set("env", query.env);
+  url.searchParams.set("file", query.file);
+  return url.toString();
+}
+function jsonHeaders(token, orgId) {
+  const h = { "content-type": "application/json" };
+  if (token !== void 0) h.authorization = `Bearer ${token}`;
+  if (orgId !== void 0 && orgId.length > 0) h["x-org-context"] = orgId;
+  return h;
+}
+async function callFetch(fetchImpl, url, init) {
+  try {
+    return await fetchImpl(url, init);
+  } catch (err) {
+    const msg = err.message;
+    throw new NetworkError(
+      `Could not reach ${new URL(url).host} (${msg}). Check your network and the apiUrl in project-config.json.`
+    );
+  }
+}
+async function handleResponse(res) {
+  if (res.ok) {
+    return await res.json();
+  }
+  const body = await res.text();
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    parsed = void 0;
+  }
+  const code = parsed?.error ?? `HTTP_${res.status}`;
+  const message = parsed?.message ?? `Request failed: HTTP ${res.status}`;
+  if (res.status === 400) {
+    throw new EnvSyncError(code, message, 1);
+  }
+  if (res.status === 401) {
+    if (code === "INVALID_CREDENTIALS") throw new InvalidCredentialsError(message);
+    if (code === "INVALID_MFA_CODE") throw new InvalidMfaCodeError(message);
+    if (code === "MFA_SESSION_EXPIRED") throw new MfaSessionExpiredError(message);
+    if (code === "AUTH_EXPIRED") throw new AuthExpiredError(message);
+    throw new AuthRequiredError(message);
+  }
+  if (res.status === 403) {
+    throw new PermissionDeniedError("unknown", "unknown");
+  }
+  if (res.status === 404) {
+    throw new ProjectNotFoundError("unknown", "unknown");
+  }
+  throw new EnvSyncError(code, message, 99);
+}
+
+// src/keychain.ts
+var SERVICE = "eln-env-sync";
+var keytarInstance;
+async function getKeytar() {
+  if (keytarInstance === void 0) {
+    const mod = await import("keytar");
+    keytarInstance = mod.default ?? mod;
+  }
+  return keytarInstance;
+}
+async function saveTokens(email, tokens) {
+  const k = await getKeytar();
+  await k.setPassword(SERVICE, email, JSON.stringify(tokens));
+}
+async function loadTokens(email) {
+  const k = await getKeytar();
+  const raw = await k.getPassword(SERVICE, email);
+  if (raw === null) return null;
+  return JSON.parse(raw);
+}
+async function deleteTokens(email) {
+  const k = await getKeytar();
+  return k.deletePassword(SERVICE, email);
+}
+async function getCurrentUser() {
+  const k = await getKeytar();
+  const accts = await k.findCredentials(SERVICE);
+  return accts.length > 0 ? accts[0]?.account ?? null : null;
+}
+
+// src/commands/global.ts
+async function globalKeysCommand(opts = {}) {
+  const { http, orgId, authedFetch } = await resolvePool(opts);
+  return authedFetch((bearer) => http.envGlobalKeys(bearer, void 0, { orgId }));
+}
+async function globalSetCommand(opts) {
+  const { http, orgId, env, authedFetch } = await resolvePoolWithEnv(opts);
+  const body = {
+    ...opts.keys !== void 0 ? { keys: opts.keys } : {},
+    ...opts.descriptions !== void 0 ? { descriptions: opts.descriptions } : {}
+  };
+  return authedFetch((bearer) => http.envGlobalKeysSet(bearer, { env }, body, { orgId }));
+}
+async function globalDeleteCommand(opts) {
+  const { http, orgId, env, authedFetch } = await resolvePoolWithEnv(opts);
+  return authedFetch(
+    (bearer) => http.envGlobalKeysDelete(bearer, { env }, { keys: opts.keys }, { orgId })
+  );
+}
+async function globalDescribeCommand(opts) {
+  const { http, orgId, env, authedFetch } = await resolvePoolWithEnv(opts);
+  return authedFetch(
+    (bearer) => http.envGlobalKeysSet(bearer, { env }, { descriptions: { [opts.key]: opts.text } }, { orgId })
+  );
+}
+async function globalStatusCommand(opts = {}) {
+  const { http, project, authedFetch } = await resolve2(opts);
+  return authedFetch((bearer) => http.envGlobalBindingsGet(bearer, { project }));
+}
+async function globalUseCommand(opts) {
+  const { http, project, authedFetch } = await resolve2(opts);
+  const entry = opts.alias !== void 0 ? { key: opts.key, alias: opts.alias } : { key: opts.key };
+  return authedFetch(
+    (bearer) => http.envGlobalBindingsPatch(bearer, { project }, { add: [entry] })
+  );
+}
+async function globalDropCommand(opts) {
+  const { http, project, authedFetch } = await resolve2(opts);
+  return authedFetch(
+    (bearer) => http.envGlobalBindingsPatch(bearer, { project }, { remove: [opts.key] })
+  );
+}
+async function resolve2(opts) {
+  const cfg = await loadProjectConfig(opts.cwd);
+  const project = opts.project ?? cfg.name;
+  const http = opts.http ?? createHttpClient(cfg.proxy.apiUrl);
+  const authedFetch = await buildAuthedFetch(http);
+  return { http, project, authedFetch };
+}
+async function resolvePool(opts) {
+  const cfg = await loadProjectConfig(opts.cwd);
+  const http = opts.http ?? createHttpClient(cfg.proxy.apiUrl);
+  const authedFetch = await buildAuthedFetch(http);
+  return { http, orgId: opts.orgId, authedFetch };
+}
+async function resolvePoolWithEnv(opts) {
+  const cfg = await loadProjectConfig(opts.cwd);
+  const env = opts.env ?? GLOBAL_ALL_ENV;
+  const http = opts.http ?? createHttpClient(cfg.proxy.apiUrl);
+  const authedFetch = await buildAuthedFetch(http);
+  return { http, orgId: opts.orgId, env, authedFetch };
+}
+async function buildAuthedFetch(http) {
+  const serviceToken = resolveServiceToken();
+  if (serviceToken !== void 0 && serviceToken.length > 0) {
+    return (call) => call(serviceToken);
+  }
+  const email = await getCurrentUser();
+  if (email === null) throw new AuthRequiredError();
+  const tokens = await loadTokens(email);
+  if (tokens === null) throw new AuthRequiredError();
+  return async (call) => {
+    try {
+      return await call(tokens.idToken);
+    } catch (err) {
+      if (!(err instanceof AuthRequiredError) && !(err instanceof AuthExpiredError)) {
+        throw err;
+      }
+      const refreshed = await http.refresh({ refreshToken: tokens.refreshToken });
+      const expiresAt = Math.floor(Date.now() / 1e3) + refreshed.expiresIn;
+      await saveTokens(email, { ...tokens, idToken: refreshed.idToken, expiresAt });
+      return await call(refreshed.idToken);
+    }
+  };
+}
+
+// src/commands/list.ts
+async function listCommand(opts = {}) {
+  const cfg = await loadProjectConfig(opts.cwd);
+  const project = opts.project ?? cfg.name;
+  const http = opts.http ?? createHttpClient(cfg.proxy.apiUrl);
+  const serviceToken = resolveServiceToken();
+  if (serviceToken !== void 0 && serviceToken.length > 0) {
+    const res2 = await http.envList(serviceToken, { project });
+    return { project: res2.project, files: res2.files };
+  }
+  const email = await getCurrentUser();
+  if (email === null) throw new AuthRequiredError();
+  const tokens = await loadTokens(email);
+  if (tokens === null) throw new AuthRequiredError();
+  const res = await fetchWithRefresh(
+    http,
+    tokens,
+    email,
+    (idToken) => http.envList(idToken, { project })
+  );
+  return { project: res.project, files: res.files };
+}
+async function fetchWithRefresh(http, tokens, email, call) {
+  try {
+    return await call(tokens.idToken);
+  } catch (err) {
+    if (!(err instanceof AuthRequiredError) && !(err instanceof AuthExpiredError)) {
+      throw err;
+    }
+    const refreshed = await http.refresh({ refreshToken: tokens.refreshToken });
+    const expiresAt = Math.floor(Date.now() / 1e3) + refreshed.expiresIn;
+    await saveTokens(email, { ...tokens, idToken: refreshed.idToken, expiresAt });
+    return await call(refreshed.idToken);
+  }
+}
+
+// src/prompt.ts
+import { createInterface } from "readline/promises";
+import { stdin, stdout } from "process";
+async function promptText(label) {
+  const rl = createInterface({ input: stdin, output: stdout });
+  try {
+    const answer = await rl.question(label);
+    return answer.trim();
+  } finally {
+    rl.close();
+  }
+}
+async function promptPassword(label) {
+  return new Promise((resolve8, reject) => {
+    stdout.write(label);
+    const wasRaw = stdin.isTTY ? stdin.isRaw : false;
+    if (stdin.isTTY) stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    let buf = "";
+    const onData = (chunk) => {
+      for (const ch of chunk) {
+        if (ch === "\n" || ch === "\r" || ch === "") {
+          cleanup();
+          stdout.write("\n");
+          resolve8(buf);
+          return;
+        }
+        if (ch === "") {
+          cleanup();
+          stdout.write("\n");
+          reject(new Error("Aborted"));
+          return;
+        }
+        if (ch === "\x7F" || ch === "\b") {
+          buf = buf.slice(0, -1);
+          continue;
+        }
+        buf += ch;
+      }
+    };
+    const cleanup = () => {
+      stdin.off("data", onData);
+      if (stdin.isTTY) stdin.setRawMode(wasRaw);
+      stdin.pause();
+    };
+    stdin.on("data", onData);
+  });
+}
+
+// src/commands/login.ts
+var MFA_MAX_ATTEMPTS = 3;
+async function loginCommand(opts = {}) {
+  const apiUrl = await resolveApiUrl(opts.cwd);
+  const email = opts.email ?? await promptText("Email: ");
+  const password = await promptPassword("Password: ");
+  const http = opts.http ?? createHttpClient(apiUrl);
+  const result = await http.login({ email, password });
+  let tokens;
+  let usedMfa = false;
+  if (isAuthChallenge(result)) {
+    usedMfa = true;
+    tokens = await answerMfa(http, result.session, email, opts.mfaCode);
+  } else {
+    tokens = result;
+  }
+  const expiresAt = Math.floor(Date.now() / 1e3) + tokens.expiresIn;
+  await saveTokens(email, {
+    idToken: tokens.idToken,
+    refreshToken: tokens.refreshToken,
+    expiresAt
+  });
+  return { email, expiresAt, mfa: usedMfa };
+}
+async function answerMfa(http, session, email, presetCode) {
+  for (let attempt = 1; attempt <= MFA_MAX_ATTEMPTS; attempt += 1) {
+    const code = presetCode ?? await promptText("MFA code: ");
+    try {
+      return await http.mfaRespond({ email, session, code });
+    } catch (err) {
+      if (err instanceof InvalidMfaCodeError && presetCode === void 0 && attempt < MFA_MAX_ATTEMPTS) {
+        process.stderr.write("Invalid MFA code, try again.\n");
+        continue;
+      }
+      throw err;
+    }
+  }
+  throw new InvalidMfaCodeError("Too many invalid MFA attempts.");
+}
+
+// src/commands/logout.ts
+async function logoutCommand() {
+  const email = await getCurrentUser();
+  if (email === null) return null;
+  await deleteTokens(email);
+  return email;
+}
+
+// src/commands/pull.ts
+import { writeFileSync } from "fs";
+import { resolve as resolve3, basename as basename2 } from "path";
+
+// src/env-writer.ts
+import { chmod, readFile as readFile2, rename, unlink, writeFile } from "fs/promises";
+import { dirname, basename, join } from "path";
+import { randomBytes } from "crypto";
+var MARKER_BEGIN = "# BEGIN: eln-bootstrap-envsync (managed by env-sync)";
+var MARKER_END = "# END: eln-bootstrap-envsync";
+async function rewriteMarkers(target, keys) {
+  const prepared = await prepareRewrite(target, keys);
+  await writeTemp(prepared);
+  await commitTemp(prepared);
+  return prepared.result;
+}
+async function rewriteMarkersMulti(files) {
+  const prepared = [];
+  try {
+    for (const f of files) {
+      prepared.push(await prepareRewrite(f.target, f.keys));
+    }
+    for (const p of prepared) {
+      await writeTemp(p);
+    }
+  } catch (err) {
+    await Promise.allSettled(prepared.map((p) => unlink(p.tmp).catch(() => void 0)));
+    throw err;
+  }
+  const results = [];
+  for (const p of prepared) {
+    await commitTemp(p);
+    results.push({
+      target: p.target,
+      writtenKeys: p.result.writtenKeys,
+      hadExistingMarkers: p.result.hadExistingMarkers,
+      targetExisted: p.result.targetExisted
+    });
+  }
+  return results;
+}
+async function prepareRewrite(target, keys) {
+  let existing = "";
+  let targetExisted = true;
+  try {
+    existing = await readFile2(target, "utf8");
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") {
+      targetExisted = false;
+    } else {
+      throw err;
+    }
+  }
+  const { outside, hadExistingMarkers } = stripMarkerBlock(existing);
+  const block = renderBlock(keys);
+  const next = composeFile(outside, block);
+  const dir = dirname(target);
+  const tmpName = `.${basename(target)}.${randomBytes(6).toString("hex")}.tmp`;
+  const tmp = join(dir, tmpName);
+  return {
+    target,
+    tmp,
+    content: next,
+    result: {
+      writtenKeys: Object.keys(keys),
+      hadExistingMarkers,
+      targetExisted
+    }
+  };
+}
+async function writeTemp(p) {
+  await writeFile(p.tmp, p.content, { mode: 384 });
+}
+async function commitTemp(p) {
+  await rename(p.tmp, p.target);
+  await chmod(p.target, 384);
+}
+function stripMarkerBlock(content) {
+  const beginIdx = content.indexOf(MARKER_BEGIN);
+  if (beginIdx === -1) {
+    return { outside: content, hadExistingMarkers: false };
+  }
+  const endIdx = content.indexOf(MARKER_END, beginIdx);
+  if (endIdx === -1) {
+    return { outside: content, hadExistingMarkers: false };
+  }
+  const afterEnd = content.indexOf("\n", endIdx);
+  const tail = afterEnd === -1 ? "" : content.slice(afterEnd + 1);
+  const head = content.slice(0, beginIdx);
+  const trimmedHead = head.replace(/\n+$/, "");
+  const outside = trimmedHead.length === 0 ? tail : tail.length === 0 ? trimmedHead : `${trimmedHead}
+${tail}`;
+  return { outside, hadExistingMarkers: true };
+}
+function renderBlock(keys) {
+  const lines = [MARKER_BEGIN];
+  for (const [k, v] of Object.entries(keys)) {
+    lines.push(`${k}=${v}`);
+  }
+  lines.push(MARKER_END);
+  return lines.join("\n");
+}
+function composeFile(outside, block) {
+  if (outside.length === 0) return `${block}
+`;
+  const trimmed = outside.replace(/\n+$/, "");
+  return `${trimmed}
+
+${block}
+`;
+}
+
+// src/commands/pull.ts
+async function pullCommand(opts = {}) {
+  const cfg = await loadProjectConfig(opts.cwd);
+  const project = opts.project ?? cfg.name;
+  const env = resolveEnv(opts.env, process.env.APP_ENV, cfg.envSync.defaultEnv);
+  const cwd = opts.cwd ?? process.cwd();
+  const explicitFile = opts.file ?? (opts.target !== void 0 ? basename2(opts.target) : void 0);
+  const http = opts.http ?? createHttpClient(cfg.proxy.apiUrl);
+  opts.onProgress?.("authenticating");
+  const authedFetch = await buildAuthedFetch2(http);
+  if (explicitFile !== void 0) {
+    const fileName = slugToFileName(fileNameToSlug(explicitFile));
+    opts.onProgress?.("fetching");
+    const response2 = await authedFetch(
+      (bearer) => http.envPull(bearer, { project, env, file: fileName })
+    );
+    const target = opts.target !== void 0 ? resolve3(cwd, opts.target) : resolve3(cwd, fileName);
+    opts.onProgress?.("writing");
+    const result = await rewriteMarkers(target, response2.keys);
+    return {
+      project: response2.project,
+      env: response2.env,
+      files: [
+        {
+          file: response2.file,
+          writtenKeys: result.writtenKeys,
+          target,
+          hadExistingMarkers: result.hadExistingMarkers
+        }
+      ],
+      summary: { filesSynced: 1, filesExcluded: 0, totalKeys: result.writtenKeys.length }
+    };
+  }
+  opts.onProgress?.("fetching");
+  const response = await authedFetch((bearer) => http.envPullAll(bearer, { project, env }));
+  const requests = response.files.map((f) => ({
+    target: resolve3(cwd, f.file),
+    keys: f.keys
+  }));
+  opts.onProgress?.("writing");
+  const writes = await rewriteMarkersMulti(requests);
+  try {
+    const fileResp = await authedFetch(
+      (bearer) => http.envFilesGet(bearer, { project, env })
+    ).catch(() => null);
+    for (const f of fileResp?.files ?? []) {
+      writeFileSync(resolve3(cwd, f.destPath), f.content, { mode: 384 });
+    }
+  } catch {
+  }
+  const files = response.files.map((f, i) => ({
+    file: f.file,
+    writtenKeys: writes[i].writtenKeys,
+    target: writes[i].target,
+    hadExistingMarkers: writes[i].hadExistingMarkers
+  }));
+  const declaredSlugs = new Set(cfg.envSync.files.map((f) => fileNameToSlug(f)));
+  const syncedSlugs = new Set(files.map((f) => fileNameToSlug(f.file)));
+  const filesExcluded = [...declaredSlugs].filter((slug) => !syncedSlugs.has(slug)).length;
+  const totalKeys = files.reduce((sum, f) => sum + f.writtenKeys.length, 0);
+  return {
+    project: response.project,
+    env: response.env,
+    files,
+    summary: { filesSynced: files.length, filesExcluded, totalKeys }
+  };
+}
+async function buildAuthedFetch2(http) {
+  const serviceToken = resolveServiceToken();
+  if (serviceToken !== void 0 && serviceToken.length > 0) {
+    return (call) => call(serviceToken);
+  }
+  const email = await getCurrentUser();
+  if (email === null) throw new AuthRequiredError();
+  const tokens = await loadTokens(email);
+  if (tokens === null) throw new AuthRequiredError();
+  return async (call) => {
+    try {
+      return await call(tokens.idToken);
+    } catch (err) {
+      if (!(err instanceof AuthRequiredError) && !(err instanceof AuthExpiredError)) {
+        throw err;
+      }
+      const refreshed = await http.refresh({ refreshToken: tokens.refreshToken });
+      const expiresAt = Math.floor(Date.now() / 1e3) + refreshed.expiresIn;
+      await saveTokens(email, { ...tokens, idToken: refreshed.idToken, expiresAt });
+      return await call(refreshed.idToken);
+    }
+  };
+}
+
+// src/commands/run.ts
+import { spawn as nodeSpawn } from "child_process";
+import { mkdtempSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { tmpdir } from "os";
+import { basename as basename3, join as join2, resolve as resolve4 } from "path";
+async function runCommand(opts) {
+  if (opts.command === void 0 || opts.command.length === 0) {
+    throw new EnvSyncError(
+      "BAD_REQUEST",
+      "run requires a command, e.g. env-sync run -- npm start",
+      1
+    );
+  }
+  const cfg = await loadProjectConfig(opts.cwd);
+  const project = opts.project ?? cfg.name;
+  const env = resolveEnv(opts.env, process.env.APP_ENV, cfg.envSync.defaultEnv);
+  const http = opts.http ?? createHttpClient(cfg.proxy.apiUrl);
+  const authedFetch = await buildAuthedFetch3(http);
+  let merged = {};
+  if (opts.file !== void 0) {
+    const fileName = slugToFileName(fileNameToSlug(opts.file));
+    const response = await authedFetch(
+      (bearer) => http.envPull(bearer, { project, env, file: fileName })
+    );
+    merged = { ...response.keys };
+  } else {
+    const response = await authedFetch((bearer) => http.envPullAll(bearer, { project, env }));
+    for (const f of response.files) {
+      merged = { ...merged, ...f.keys };
+    }
+  }
+  const baseEnv = opts.baseEnv ?? process.env;
+  const childEnv = { ...baseEnv, ...merged };
+  const cleanup = [];
+  let tmpDir;
+  const cwd = opts.cwd ?? process.cwd();
+  try {
+    const fileResp = await authedFetch(
+      (bearer) => http.envFilesGet(bearer, { project, env })
+    ).catch(() => null);
+    for (const f of fileResp?.files ?? []) {
+      if (f.pointerEnv !== void 0) {
+        tmpDir ??= mkdtempSync(join2(tmpdir(), "env-sync-files-"));
+        const p = join2(tmpDir, basename3(f.name));
+        writeFileSync2(p, f.content, { mode: 384 });
+        childEnv[f.pointerEnv] = p;
+      } else {
+        const p = resolve4(cwd, f.destPath);
+        writeFileSync2(p, f.content, { mode: 384 });
+        cleanup.push(p);
+      }
+    }
+  } catch {
+  }
+  const spawnImpl = opts.spawn ?? defaultSpawn;
+  let exitCode;
+  try {
+    exitCode = await runChild(spawnImpl, opts.command, opts.args ?? [], childEnv);
+  } finally {
+    for (const p of cleanup) rmSync(p, { force: true });
+    if (tmpDir !== void 0) rmSync(tmpDir, { recursive: true, force: true });
+  }
+  return {
+    project,
+    env,
+    command: opts.command,
+    injectedKeys: Object.keys(merged),
+    exitCode
+  };
+}
+var defaultSpawn = (command, args, options) => nodeSpawn(command, args, options);
+function runChild(spawn, command, args, env) {
+  return new Promise((resolveP, rejectP) => {
+    const child = spawn(command, args, { env, stdio: "inherit" });
+    child.on("error", (err) => {
+      rejectP(new EnvSyncError("SPAWN_FAILED", `Failed to run '${command}': ${err.message}`, 127));
+    });
+    child.on("exit", (code) => {
+      resolveP(code ?? 1);
+    });
+  });
+}
+async function buildAuthedFetch3(http) {
+  const serviceToken = resolveServiceToken();
+  if (serviceToken !== void 0 && serviceToken.length > 0) {
+    return (call) => call(serviceToken);
+  }
+  const email = await getCurrentUser();
+  if (email === null) throw new AuthRequiredError();
+  const tokens = await loadTokens(email);
+  if (tokens === null) throw new AuthRequiredError();
+  return async (call) => {
+    try {
+      return await call(tokens.idToken);
+    } catch (err) {
+      if (!(err instanceof AuthRequiredError) && !(err instanceof AuthExpiredError)) {
+        throw err;
+      }
+      const refreshed = await http.refresh({ refreshToken: tokens.refreshToken });
+      const expiresAt = Math.floor(Date.now() / 1e3) + refreshed.expiresIn;
+      await saveTokens(email, { ...tokens, idToken: refreshed.idToken, expiresAt });
+      return await call(refreshed.idToken);
+    }
+  };
+}
+
+// src/commands/files.ts
+import { readFile as readFile3 } from "fs/promises";
+import { basename as basename4, resolve as resolve5 } from "path";
+async function resolveAuth(opts) {
+  const cfg = await loadProjectConfig(opts.cwd);
+  const project = opts.project ?? cfg.name;
+  const env = resolveEnv(opts.env, process.env.APP_ENV, cfg.envSync.defaultEnv);
+  const http = opts.http ?? createHttpClient(cfg.proxy.apiUrl);
+  const serviceToken = resolveServiceToken();
+  if (serviceToken !== void 0 && serviceToken.length > 0) {
+    return { project, env, http, bearer: serviceToken };
+  }
+  const email = await getCurrentUser();
+  if (email === null) throw new AuthRequiredError();
+  const tokens = await loadTokens(email);
+  if (tokens === null) throw new AuthRequiredError();
+  return { project, env, http, bearer: tokens.idToken, refreshable: { email, tokens } };
+}
+async function withAuth(ctx, call) {
+  try {
+    return await call(ctx.bearer);
+  } catch (err) {
+    if (ctx.refreshable === void 0 || !(err instanceof AuthRequiredError) && !(err instanceof AuthExpiredError)) {
+      throw err;
+    }
+    const { email, tokens } = ctx.refreshable;
+    const refreshed = await ctx.http.refresh({ refreshToken: tokens.refreshToken });
+    const expiresAt = Math.floor(Date.now() / 1e3) + refreshed.expiresIn;
+    await saveTokens(email, { ...tokens, idToken: refreshed.idToken, expiresAt });
+    return await call(refreshed.idToken);
+  }
+}
+async function pushCommand(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  let content;
+  try {
+    content = await readFile3(resolve5(cwd, opts.path), "utf8");
+  } catch (err) {
+    throw new ValidationError(`Could not read ${opts.path}: ${err.message}`);
+  }
+  const name = opts.as ?? (opts.path.startsWith("/") ? basename4(opts.path) : opts.path);
+  const ctx = await resolveAuth(opts);
+  return withAuth(
+    ctx,
+    (bearer) => ctx.http.envFilesPut(
+      bearer,
+      { project: ctx.project, env: ctx.env },
+      { name, content, destPath: opts.as, pointerEnv: opts.pointer }
+    )
+  );
+}
+async function filesCommand(opts) {
+  const ctx = await resolveAuth(opts);
+  const res = await withAuth(
+    ctx,
+    (bearer) => ctx.http.envFilesGet(bearer, { project: ctx.project, env: ctx.env })
+  );
+  return res.files.map((f) => ({
+    name: f.name,
+    destPath: f.destPath,
+    pointerEnv: f.pointerEnv,
+    version: 0,
+    valueSha256: "",
+    createdAt: "",
+    createdBy: ""
+  }));
+}
+
+// src/scan.ts
+import { readdirSync, readFileSync, statSync } from "fs";
+import { join as join3, relative } from "path";
+var RULES = [
+  { id: "aws-access-key-id", description: "AWS Access Key ID", regex: /AKIA[0-9A-Z]{16}/g },
+  {
+    id: "aws-secret-access-key",
+    description: "Possible AWS Secret Access Key",
+    regex: /aws.{0,20}['"][0-9a-zA-Z/+]{40}['"]/gi
+  },
+  {
+    id: "private-key",
+    description: "Private key block",
+    regex: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/g
+  },
+  { id: "github-pat", description: "GitHub personal access token", regex: /ghp_[0-9A-Za-z]{36}/g },
+  {
+    id: "github-fine-grained-pat",
+    description: "GitHub fine-grained token",
+    regex: /github_pat_[0-9A-Za-z_]{60,}/g
+  },
+  { id: "slack-token", description: "Slack token", regex: /xox[baprs]-[0-9A-Za-z-]{10,}/g },
+  { id: "stripe-secret-key", description: "Stripe secret key", regex: /sk_live_[0-9A-Za-z]{24,}/g },
+  { id: "google-api-key", description: "Google API key", regex: /AIza[0-9A-Za-z_-]{35}/g },
+  {
+    id: "dotvault-service-token",
+    description: "dotvault service token",
+    regex: /est_[0-9a-f]{32}\.[A-Za-z0-9_-]{20,}/g
+  },
+  {
+    id: "generic-assignment",
+    description: "Generic secret assignment",
+    regex: /(?:secret|token|password|passwd|api[_-]?key)["']?\s*[:=]\s*["'][^"'\s]{16,}["']/gi
+  }
+];
+var SKIP_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  ".next",
+  "coverage",
+  "cdk.out",
+  ".turbo"
+]);
+function redact(match) {
+  if (match.length <= 8) return "*".repeat(match.length);
+  return `${match.slice(0, 4)}...${match.slice(-2)} (${match.length} chars)`;
+}
+function scanText(content, file = "<text>") {
+  const findings = [];
+  const lines = content.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i += 1) {
+    const line = lines[i];
+    for (const rule of RULES) {
+      rule.regex.lastIndex = 0;
+      let m;
+      while ((m = rule.regex.exec(line)) !== null) {
+        findings.push({
+          rule: rule.id,
+          description: rule.description,
+          file,
+          line: i + 1,
+          excerpt: redact(m[0])
+        });
+        if (m.index === rule.regex.lastIndex) rule.regex.lastIndex += 1;
+      }
+    }
+  }
+  return findings;
+}
+function looksBinary(buf) {
+  const limit = Math.min(buf.length, 8192);
+  for (let i = 0; i < limit; i += 1) {
+    if (buf.charCodeAt(i) === 0) return true;
+  }
+  return false;
+}
+var MAX_FILE_BYTES = 5 * 1024 * 1024;
+function scanPaths(paths, root = process.cwd()) {
+  const findings = [];
+  const visit = (p) => {
+    let st;
+    try {
+      st = statSync(p);
+    } catch {
+      return;
+    }
+    if (st.isDirectory()) {
+      for (const entry of readdirSync(p)) {
+        if (SKIP_DIRS.has(entry)) continue;
+        visit(join3(p, entry));
+      }
+      return;
+    }
+    if (!st.isFile() || st.size > MAX_FILE_BYTES) return;
+    let content;
+    try {
+      content = readFileSync(p, "utf8");
+    } catch {
+      return;
+    }
+    if (looksBinary(content)) return;
+    findings.push(...scanText(content, relative(root, p) || p));
+  };
+  for (const p of paths) visit(p);
+  return findings;
+}
+
+// src/commands/write.ts
+import { readFile as readFile4 } from "fs/promises";
+import { resolve as resolve6 } from "path";
+async function resolveContext(opts) {
+  const cfg = await loadProjectConfig(opts.cwd);
+  const project = opts.project ?? cfg.name;
+  const env = resolveEnv(opts.env, process.env.APP_ENV, cfg.envSync.defaultEnv);
+  const fileInput = opts.file ?? cfg.envSync.files[0];
+  const file = slugToFileName(fileNameToSlug(fileInput));
+  const http = opts.http ?? createHttpClient(cfg.proxy.apiUrl);
+  const serviceToken = resolveServiceToken();
+  if (serviceToken !== void 0 && serviceToken.length > 0) {
+    return { project, env, file, http, bearer: serviceToken };
+  }
+  const email = await getCurrentUser();
+  if (email === null) throw new AuthRequiredError();
+  const tokens = await loadTokens(email);
+  if (tokens === null) throw new AuthRequiredError();
+  return { project, env, file, http, bearer: tokens.idToken, refreshable: { email, tokens } };
+}
+function parsePairs(pairs) {
+  const out = {};
+  for (const pair of pairs) {
+    const eq = pair.indexOf("=");
+    if (eq <= 0) {
+      throw new ValidationError(`Invalid KEY=VALUE pair: ${JSON.stringify(pair)}`);
+    }
+    out[pair.slice(0, eq)] = pair.slice(eq + 1);
+  }
+  return out;
+}
+function parseEnvFile(text) {
+  const out = {};
+  for (const raw of text.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (line.length === 0 || line.startsWith("#")) continue;
+    const body = line.startsWith("export ") ? line.slice(7) : line;
+    const eq = body.indexOf("=");
+    if (eq <= 0) continue;
+    const key = body.slice(0, eq).trim();
+    let val = body.slice(eq + 1).trim();
+    if (val.startsWith('"') && val.endsWith('"') || val.startsWith("'") && val.endsWith("'")) {
+      val = val.slice(1, -1);
+    }
+    out[key] = val;
+  }
+  return out;
+}
+async function setCommand(opts) {
+  const keys = parsePairs(opts.pairs);
+  if (Object.keys(keys).length === 0) {
+    throw new ValidationError("set requires at least one KEY=VALUE");
+  }
+  const ctx = await resolveContext(opts);
+  return fetchWithRefresh2(
+    ctx,
+    (idToken) => ctx.http.envKeysPut(idToken, { project: ctx.project, env: ctx.env, file: ctx.file }, { keys })
+  );
+}
+async function deleteCommand(opts) {
+  if (opts.keys.length === 0) throw new ValidationError("delete requires at least one KEY");
+  const ctx = await resolveContext(opts);
+  return fetchWithRefresh2(
+    ctx,
+    (idToken) => ctx.http.envKeysDelete(
+      idToken,
+      { project: ctx.project, env: ctx.env, file: ctx.file },
+      { keys: opts.keys }
+    )
+  );
+}
+async function importCommand(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  let text;
+  try {
+    text = await readFile4(resolve6(cwd, opts.path), "utf8");
+  } catch (err) {
+    throw new ValidationError(`Could not read ${opts.path}: ${err.message}`);
+  }
+  const keys = parseEnvFile(text);
+  if (Object.keys(keys).length === 0) {
+    throw new ValidationError(`No KEY=VALUE lines found in ${opts.path}`);
+  }
+  const ctx = await resolveContext(opts);
+  return fetchWithRefresh2(
+    ctx,
+    (idToken) => ctx.http.envKeysPut(idToken, { project: ctx.project, env: ctx.env, file: ctx.file }, { keys })
+  );
+}
+async function describeCommand(opts) {
+  const ctx = await resolveContext(opts);
+  return fetchWithRefresh2(
+    ctx,
+    (idToken) => ctx.http.envKeysPut(
+      idToken,
+      { project: ctx.project, env: ctx.env, file: ctx.file },
+      { descriptions: { [opts.key]: opts.text } }
+    )
+  );
+}
+async function versionsCommand(opts) {
+  const ctx = await resolveContext(opts);
+  return fetchWithRefresh2(
+    ctx,
+    (idToken) => ctx.http.envVersions(idToken, {
+      project: ctx.project,
+      env: ctx.env,
+      file: ctx.file,
+      key: opts.key
+    })
+  );
+}
+async function rollbackCommand(opts) {
+  if (!Number.isInteger(opts.toVersion) || opts.toVersion < 1) {
+    throw new ValidationError("rollback --to must be a positive integer version");
+  }
+  const ctx = await resolveContext(opts);
+  return fetchWithRefresh2(
+    ctx,
+    (idToken) => ctx.http.envRollback(
+      idToken,
+      { project: ctx.project, env: ctx.env, file: ctx.file },
+      { key: opts.key, toVersion: opts.toVersion }
+    )
+  );
+}
+async function fetchWithRefresh2(ctx, call) {
+  try {
+    return await call(ctx.bearer);
+  } catch (err) {
+    if (ctx.refreshable === void 0 || !(err instanceof AuthRequiredError) && !(err instanceof AuthExpiredError)) {
+      throw err;
+    }
+    const { email, tokens } = ctx.refreshable;
+    const refreshed = await ctx.http.refresh({ refreshToken: tokens.refreshToken });
+    const expiresAt = Math.floor(Date.now() / 1e3) + refreshed.expiresIn;
+    await saveTokens(email, { ...tokens, idToken: refreshed.idToken, expiresAt });
+    return await call(refreshed.idToken);
+  }
+}
+
+// src/commands/whoami.ts
+async function whoamiCommand(env = process.env) {
+  const serviceToken = resolveServiceToken(env);
+  if (serviceToken !== void 0 && serviceToken.length > 0) {
+    return {
+      kind: "service",
+      tokenPrefix: serviceToken.slice(0, 12)
+    };
+  }
+  const email = await getCurrentUser();
+  if (email === null) return null;
+  const tokens = await loadTokens(email);
+  if (tokens === null) return null;
+  const now = Math.floor(Date.now() / 1e3);
+  return {
+    kind: "user",
+    email,
+    expiresAt: tokens.expiresAt,
+    expiresInSeconds: Math.max(0, tokens.expiresAt - now)
+  };
+}
+
+// src/commands/init.ts
+import { writeFile as writeFile2, access } from "fs/promises";
+import { resolve as resolve7, basename as basename5 } from "path";
+import { constants } from "fs";
+var CONFIG_FILENAME = "project-config.json";
+async function initCommand(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const path = resolve7(cwd, CONFIG_FILENAME);
+  const project = opts.name ?? basename5(cwd);
+  const apiUrl = opts.api ?? DEFAULT_API_URL;
+  const exists = await fileExists(path);
+  if (exists && !opts.force) {
+    throw new ValidationError(`${CONFIG_FILENAME} already exists. Use --force to overwrite.`);
+  }
+  const config = buildConfig(project, apiUrl);
+  await writeFile2(path, JSON.stringify(config, null, 2) + "\n", "utf8");
+  return { path, project };
+}
+function buildConfig(name, apiUrl) {
+  return {
+    name,
+    setup: {
+      bootstrap: {
+        proxy: {
+          apiUrl
+        }
+      },
+      envSync: {
+        enabled: true,
+        files: [".env"],
+        defaultEnv: "development"
+      }
+    }
+  };
+}
+async function fileExists(path) {
+  try {
+    await access(path, constants.F_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/commands/project.ts
+async function projectCreateCommand(opts) {
+  const cfg = await loadProjectConfig(opts.cwd);
+  const http = createHttpClient(cfg.proxy.apiUrl);
+  const body = {
+    name: opts.name,
+    ...opts.orgId !== void 0 ? { owning_org_id: opts.orgId } : {}
+  };
+  const serviceToken = resolveAdminServiceToken() ?? resolveServiceToken();
+  if (serviceToken !== void 0 && serviceToken.length > 0) {
+    return http.adminProjectsCreate(serviceToken, body);
+  }
+  const authedFetch = await buildAuthedFetch4(http);
+  return authedFetch((bearer) => http.adminProjectsCreate(bearer, body));
+}
+async function buildAuthedFetch4(http) {
+  const email = await getCurrentUser();
+  if (email === null) throw new AuthRequiredError();
+  const tokens = await loadTokens(email);
+  if (tokens === null) throw new AuthRequiredError();
+  return async (call) => {
+    try {
+      return await call(tokens.idToken);
+    } catch (err) {
+      if (!(err instanceof AuthRequiredError) && !(err instanceof AuthExpiredError)) {
+        throw err;
+      }
+      const refreshed = await http.refresh({ refreshToken: tokens.refreshToken });
+      const expiresAt = Math.floor(Date.now() / 1e3) + refreshed.expiresIn;
+      await saveTokens(email, { ...tokens, idToken: refreshed.idToken, expiresAt });
+      return await call(refreshed.idToken);
+    }
+  };
+}
+
+// src/commands/token.ts
+async function tokenListCommand(opts) {
+  const cfg = await loadProjectConfig(opts.cwd);
+  const http = createHttpClient(cfg.proxy.apiUrl);
+  const authedFetch = await buildAuthedFetch5(http);
+  return authedFetch((bearer) => http.adminTokensList(bearer, { orgId: opts.orgId }));
+}
+async function tokenCreateCommand(opts) {
+  const cfg = await loadProjectConfig(opts.cwd);
+  const http = createHttpClient(cfg.proxy.apiUrl);
+  const authedFetch = await buildAuthedFetch5(http);
+  const body = {
+    name: opts.name,
+    role: opts.role,
+    ...opts.projectId !== void 0 ? { projectId: opts.projectId } : {},
+    ...opts.ttlSeconds !== void 0 ? { ttlSeconds: opts.ttlSeconds } : {}
+  };
+  return authedFetch((bearer) => http.adminTokensCreate(bearer, { orgId: opts.orgId }, body));
+}
+async function tokenRevokeCommand(opts) {
+  const cfg = await loadProjectConfig(opts.cwd);
+  const http = createHttpClient(cfg.proxy.apiUrl);
+  const authedFetch = await buildAuthedFetch5(http);
+  await authedFetch(
+    (bearer) => http.adminTokensRevoke(bearer, { orgId: opts.orgId, tokenId: opts.tokenId })
+  );
+}
+async function buildAuthedFetch5(http) {
+  const email = await getCurrentUser();
+  if (email === null) throw new AuthRequiredError();
+  const tokens = await loadTokens(email);
+  if (tokens === null) throw new AuthRequiredError();
+  return async (call) => {
+    try {
+      return await call(tokens.idToken);
+    } catch (err) {
+      if (!(err instanceof AuthRequiredError) && !(err instanceof AuthExpiredError)) {
+        throw err;
+      }
+      const refreshed = await http.refresh({ refreshToken: tokens.refreshToken });
+      const expiresAt = Math.floor(Date.now() / 1e3) + refreshed.expiresIn;
+      await saveTokens(email, { ...tokens, idToken: refreshed.idToken, expiresAt });
+      return await call(refreshed.idToken);
+    }
+  };
+}
+
+// src/index.ts
+var useColor = (stream) => stream.isTTY === true && process.env.NO_COLOR === void 0;
+var paint = (code, s, stream) => useColor(stream) ? `\x1B[${code}m${s}\x1B[0m` : s;
+var green = (s) => paint("32", s, process.stdout);
+var red = (s) => paint("31", s, process.stderr);
+var cyan = (s) => paint("36", s, process.stdout);
+var bold = (s) => paint("1", s, process.stdout);
+var dim = (s) => paint("2", s, process.stdout);
+var PULL_STAGES = ["authenticating", "fetching", "writing"];
+var PULL_STAGE_LABELS = {
+  authenticating: "Authenticating\u2026",
+  fetching: "Fetching secrets\u2026",
+  writing: "Writing files\u2026"
+};
+function renderProgressBar(step, total, width = 20) {
+  const filled = Math.round(step / total * width);
+  return `[${"\u2588".repeat(filled)}${"-".repeat(width - filled)}]`;
+}
+function pullProgressReporter() {
+  return (stage) => {
+    if (!useColor(process.stdout)) return;
+    const step = PULL_STAGES.indexOf(stage) + 1;
+    const bar = renderProgressBar(step, PULL_STAGES.length);
+    process.stdout.write(`\r\x1B[K${cyan(bar)} ${dim(PULL_STAGE_LABELS[stage])}`);
+  };
+}
+function clearProgressLine() {
+  if (!useColor(process.stdout)) return;
+  process.stdout.write("\r\x1B[K");
+}
+function readPackageVersion() {
+  try {
+    const require2 = createRequire(import.meta.url);
+    const pkg = require2("../package.json");
+    return pkg.version;
+  } catch {
+    return "0.0.0-unknown";
+  }
+}
+var PACKAGE_VERSION = readPackageVersion();
+function buildProgram() {
+  const program = new Command();
+  program.enablePositionalOptions();
+  program.name("dotvault").description(
+    "dotvault \u2014 sync .env / .npmrc / .gitconfig and any config file across machines and CI/CD. No AWS account required."
+  ).usage("<command> [options]").version(PACKAGE_VERSION);
+  program.addHelpText(
+    "after",
+    `
+Examples:
+  $ dotvault login                    # browser-based auth (Cognito)
+  $ dotvault pull                     # write .env / .npmrc etc. to local disk
+  $ dotvault run -- npm run dev       # inject secrets into child process (no file written)
+  $ dotvault push .npmrc              # add any file to the sync set
+  $ dotvault scan .                   # detect committed secrets
+
+Common workflows:
+  - First-time setup:     dotvault login \u2192 dotvault pull
+  - Local dev:            dotvault run -- npm run dev
+  - CI/CD pull:           dotvault login (service token) \u2192 dotvault pull --env production
+  - Audit history:        dotvault versions DATABASE_URL
+  - Roll back a secret:   dotvault rollback DATABASE_URL --to 4
+  - Mint a CI token:      dotvault token create --org <id> --name ci --role viewer
+  - Share a key org-wide: dotvault global keys \u2192 dotvault global use <KEY>
+
+More:
+  Admin console:  https://app.dotvault.io
+  Help & FAQ:     https://app.dotvault.io/admin/help
+  Docs:           https://github.com/EarthLinkNetwork/dotvault#readme`
+  );
+  program.command("init").description("Create project-config.json with sensible defaults").option("-n, --name <name>", "project name (default: current directory name)").option("--api <url>", "API base URL (default: https://api.dotvault.io/v1)").option("-f, --force", "overwrite existing config").addHelpText(
+    "after",
+    `
+Example:
+  $ dotvault init
+  $ dotvault init --name my-app
+  $ dotvault init --name my-app --api https://self-hosted.example.com/v1`
+  ).action(async (opts) => {
+    const result = await initCommand(opts);
+    process.stdout.write(
+      `Created project-config.json (project=${result.project}). Next: dotvault login && dotvault pull
+`
+    );
+  });
+  program.command("login").description("Log in with email + password and store tokens in OS keychain").option("-e, --email <email>", "email (skip the prompt)").addHelpText(
+    "after",
+    `
+Example:
+  $ dotvault login                       # prompts for email + password
+  $ dotvault login -e you@dotvault.io`
+  ).action(async (opts) => {
+    const result = await loginCommand({ email: opts.email });
+    const expiresIn = Math.max(0, result.expiresAt - Math.floor(Date.now() / 1e3));
+    process.stdout.write(
+      `Logged in as ${result.email}. Token expires in ${expiresIn}s. Refresh token saved.
+`
+    );
+  });
+  program.command("pull").description("Pull env vars and write them to every declared file (markers preserved).").option("-p, --project <project>", "override project name").option("-E, --env <env>", "environment: development | staging | production").option("-f, --file <file>", "pull only this file (e.g. .env.local)").option("-t, --target <path>", "DEPRECATED \u2014 pre-2.7.0 alias for --file. Use --file instead.").addHelpText(
+    "after",
+    `
+Example:
+  $ dotvault pull                              # all declared files
+  $ dotvault pull --file .env.local            # .env.local only
+  $ dotvault pull --env staging                # staging environment`
+  ).action(async (opts) => {
+    if (opts.target !== void 0 && opts.file === void 0) {
+      process.stderr.write("warning: --target is deprecated as of v0.5.0; use --file instead.\n");
+    }
+    let result;
+    try {
+      result = await pullCommand({ ...opts, onProgress: pullProgressReporter() });
+    } catch (err) {
+      clearProgressLine();
+      throw err;
+    }
+    clearProgressLine();
+    for (const f of result.files) {
+      process.stdout.write(
+        `${green("\u2713")} Wrote ${f.writtenKeys.length} keys to ${f.target} (project=${result.project}, env=${result.env}, file=${f.file}). Markers preserved.
+`
+      );
+    }
+    const { filesSynced, filesExcluded, totalKeys } = result.summary;
+    process.stdout.write(
+      `${bold(green("\u2714"))} ${filesSynced} file${filesSynced === 1 ? "" : "s"} synced, ${filesExcluded} excluded, ${totalKeys} key${totalKeys === 1 ? "" : "s"} total
+`
+    );
+  });
+  program.command("run").description(
+    "Inject secrets into a child process (no .env written). Recommended for local dev and CI."
+  ).option("-p, --project <project>", "override project name").option("-E, --env <env>", "environment: development | staging | production").option("-f, --file <file>", "inject only this file (e.g. .env.local)").argument("<command...>", "command to run with secrets injected into its environment").passThroughOptions().addHelpText(
+    "after",
+    `
+Example:
+  $ dotvault run -- node server.js
+  $ dotvault run --env production -- npm start`
+  ).action(
+    async (commandParts, opts) => {
+      const [command, ...args] = commandParts;
+      const result = await runCommand({
+        project: opts.project,
+        env: opts.env,
+        file: opts.file,
+        command: command ?? "",
+        args
+      });
+      process.exitCode = result.exitCode;
+    }
+  );
+  const writeOpts = (cmd) => cmd.option("-p, --project <project>", "override project name").option("-E, --env <env>", "environment: development | staging | production").option("-f, --file <file>", "target file (e.g. .env.local)");
+  writeOpts(
+    program.command("set").description("Set one or more secrets.").argument("<pairs...>", "KEY=VALUE pairs").addHelpText(
+      "after",
+      `
+Example:
+  $ dotvault set DATABASE_URL=postgres://localhost
+  $ dotvault set FOO=1 BAR=2 BAZ=3`
+    )
+  ).action(async (pairs, opts) => {
+    const r = await setCommand({ ...opts, pairs });
+    for (const k of r.results) {
+      process.stdout.write(`set ${k.key} (v${k.version}) in ${r.file} [${r.project}/${r.env}]
+`);
+    }
+  });
+  writeOpts(
+    program.command("describe").description("Set or clear a secret's description (metadata, not the value).").argument("<key>", "the key").argument("<text>", 'description text; pass "" to clear').addHelpText(
+      "after",
+      `
+Example:
+  $ dotvault describe DATABASE_URL "prod read replica, rotated quarterly"
+  $ dotvault describe DATABASE_URL ""   # clears the description`
+    )
+  ).action(
+    async (key, text, opts) => {
+      const r = await describeCommand({ ...opts, key, text });
+      if (r.notFound !== void 0 && r.notFound.length > 0) {
+        process.stderr.write(
+          `warning: ${key} has no current value in ${r.file} [${r.project}/${r.env}] \u2014 description not applied
+`
+        );
+        process.exitCode = 1;
+        return;
+      }
+      process.stdout.write(`described ${key} in ${r.file} [${r.project}/${r.env}]
+`);
+    }
+  );
+  writeOpts(
+    program.command("delete").description("Delete one or more secrets.").argument("<keys...>", "keys to delete").addHelpText(
+      "after",
+      `
+Example:
+  $ dotvault delete OLD_API_KEY`
+    )
+  ).action(async (keys, opts) => {
+    const r = await deleteCommand({ ...opts, keys });
+    process.stdout.write(
+      `deleted ${r.deleted.length} keys from ${r.file} [${r.project}/${r.env}]
+`
+    );
+  });
+  writeOpts(
+    program.command("import").description("Import all key/value pairs from a .env file.").argument("<path>", "path to a .env file").addHelpText(
+      "after",
+      `
+Example:
+  $ dotvault import .env.production`
+    )
+  ).action(async (path, opts) => {
+    const r = await importCommand({ ...opts, path });
+    process.stdout.write(
+      `imported ${r.results.length} keys into ${r.file} [${r.project}/${r.env}]
+`
+    );
+  });
+  writeOpts(
+    program.command("versions").description("Show version history of a secret key.").argument("<key>", "the key").addHelpText(
+      "after",
+      `
+Example:
+  $ dotvault versions DATABASE_URL`
+    )
+  ).action(async (key, opts) => {
+    const r = await versionsCommand({ ...opts, key });
+    process.stdout.write(
+      `${r.key} [${r.project}/${r.env}/${r.file}] \u2014 ${r.versions.length} versions
+`
+    );
+    for (const v of r.versions) {
+      process.stdout.write(
+        `  v${v.version}  ${v.createdAt}  by ${v.createdBy}  sha=${v.valueSha256.slice(0, 12)}
+`
+      );
+    }
+  });
+  writeOpts(
+    program.command("rollback").description("Restore a secret key to a prior version.").argument("<key>", "the key").requiredOption("--to <version>", "version number to restore").addHelpText(
+      "after",
+      `
+Example:
+  $ dotvault rollback DATABASE_URL --to 4`
+    )
+  ).action(
+    async (key, opts) => {
+      const r = await rollbackCommand({ ...opts, key, toVersion: Number(opts.to) });
+      process.stdout.write(
+        `rolled back ${r.key} to v${r.restoredFrom} (now v${r.version}) in ${r.file} [${r.project}/${r.env}]
+`
+      );
+    }
+  );
+  program.command("list").description("List the (env, file) inventory available to pull for this project.").option("-p, --project <project>", "override project name").addHelpText(
+    "after",
+    `
+Example:
+  $ dotvault list
+  $ dotvault list --project my-app`
+  ).action(async (opts) => {
+    const result = await listCommand(opts);
+    if (result.files.length === 0) {
+      process.stdout.write(`project=${result.project}: no files visible.
+`);
+      return;
+    }
+    const widths = {
+      env: Math.max(3, ...result.files.map((f) => f.env.length)),
+      file: Math.max(4, ...result.files.map((f) => f.file.length)),
+      keys: 4
+    };
+    const pad = (s, w) => s.padEnd(w);
+    process.stdout.write(`project=${result.project}
+`);
+    process.stdout.write(
+      `${pad("env", widths.env)}  ${pad("file", widths.file)}  ${pad("keys", widths.keys)}  last_modified
+`
+    );
+    for (const f of result.files) {
+      process.stdout.write(
+        `${pad(f.env, widths.env)}  ${pad(f.file, widths.file)}  ${pad(String(f.keyCount), widths.keys)}  ${f.lastModifiedAt ?? "-"}
+`
+      );
+    }
+  });
+  const globalGroup = program.command("global").description(`Manage this project's binding to the org's shared "global" key pool.`);
+  globalGroup.command("keys").description("List the org's global key pool (name + description + which envs have a value).").option(
+    "--org <id>",
+    "org id \u2014 required when signed in via `dotvault login` (ignored for service tokens, which already encode their org)"
+  ).addHelpText(
+    "after",
+    `
+Example:
+  $ dotvault global keys
+  $ dotvault global keys --org org_eln`
+  ).action(async (opts) => {
+    const result = await globalKeysCommand({ orgId: opts.org });
+    if (result.keys.length === 0) {
+      process.stdout.write("org has no global keys.\n");
+      return;
+    }
+    const formatEnvs = (k) => [...k.has_common ? ["common"] : [], ...k.override_envs].join(",") || "-";
+    const widths = {
+      key: Math.max(3, ...result.keys.map((k) => k.key.length)),
+      envs: Math.max(4, ...result.keys.map((k) => formatEnvs(k).length))
+    };
+    const pad = (s, w) => s.padEnd(w);
+    process.stdout.write(`${pad("key", widths.key)}  ${pad("envs", widths.envs)}  description
+`);
+    for (const k of result.keys) {
+      process.stdout.write(
+        `${pad(k.key, widths.key)}  ${pad(formatEnvs(k), widths.envs)}  ${k.description ?? "-"}
+`
+      );
+    }
+  });
+  globalGroup.command("set").description("Add or update one or more values in the global key pool (ADR-0023).").argument("<pairs...>", "KEY=VALUE pairs").option(
+    "-E, --env <env>",
+    "environment (development/staging/production, or a custom env) \u2014 omit for the common value shared by every env unless overridden"
+  ).option("--org <id>", "org id \u2014 required when signed in via `dotvault login`").addHelpText(
+    "after",
+    `
+Example:
+  $ dotvault global set SENTRY_DSN=https://...              # common value (all envs)
+  $ dotvault global set SENTRY_DSN=https://... -E production # override for production only`
+  ).action(async (pairs, opts) => {
+    const keys = parsePairs(pairs);
+    if (Object.keys(keys).length === 0) {
+      throw new ValidationError("global set requires at least one KEY=VALUE");
+    }
+    const result = await globalSetCommand({ env: opts.env, orgId: opts.org, keys });
+    process.stdout.write(
+      `set ${result.results.length} key(s) in the global pool [${result.env}]
+`
+    );
+    if (result.notFound !== void 0 && result.notFound.length > 0) {
+      process.stdout.write(`Warning: no description target for: ${result.notFound.join(", ")}
+`);
+    }
+  });
+  globalGroup.command("delete").description("Remove one or more keys from the global key pool (ADR-0023).").argument("<keys...>", "key names").option(
+    "-E, --env <env>",
+    "environment (development/staging/production, or a custom env) \u2014 omit to delete the common value"
+  ).option("--org <id>", "org id \u2014 required when signed in via `dotvault login`").addHelpText(
+    "after",
+    `
+Example:
+  $ dotvault global delete SENTRY_DSN               # deletes the common value
+  $ dotvault global delete SENTRY_DSN -E production  # deletes the production override only`
+  ).action(async (keys, opts) => {
+    const result = await globalDeleteCommand({ env: opts.env, orgId: opts.org, keys });
+    process.stdout.write(
+      `deleted ${result.deleted.length} key(s) from the global pool [${result.env}]
+`
+    );
+  });
+  globalGroup.command("describe").description("Set or clear (empty text) a global pool key's description (ADR-0020).").argument("<KEY>", "global key name").argument("<text>", "description text (empty string clears it)").option(
+    "-E, --env <env>",
+    "environment (development/staging/production, or a custom env) \u2014 omit for the common value"
+  ).option("--org <id>", "org id \u2014 required when signed in via `dotvault login`").addHelpText(
+    "after",
+    `
+Example:
+  $ dotvault global describe SENTRY_DSN "Shared Sentry project DSN" -E production`
+  ).action(async (key, text, opts) => {
+    const result = await globalDescribeCommand({ env: opts.env, orgId: opts.org, key, text });
+    process.stdout.write(`described ${key} in the global pool [${result.env}]
+`);
+  });
+  globalGroup.command("status").description("Show this project's current global-key bindings.").option("-p, --project <project>", "override project name").addHelpText(
+    "after",
+    `
+Example:
+  $ dotvault global status`
+  ).action(async (opts) => {
+    const result = await globalStatusCommand(opts);
+    if (result.bindings.length === 0) {
+      process.stdout.write(`project=${result.project}: no global keys bound.
+`);
+      return;
+    }
+    process.stdout.write(`project=${result.project}
+`);
+    for (const b of result.bindings) {
+      process.stdout.write(b.alias !== void 0 ? `${b.key} -> ${b.alias}
+` : `${b.key}
+`);
+    }
+  });
+  globalGroup.command("use").description("Bind an org global key to this project (received on the next pull).").argument("<KEY>", "global key name").option("-p, --project <project>", "override project name").option("--as <name>", "rename the key on output (defaults to the key name)").addHelpText(
+    "after",
+    `
+Example:
+  $ dotvault global use SENTRY_DSN
+  $ dotvault global use GH_TOKEN --as GITHUB_TOKEN`
+  ).action(async (key, opts) => {
+    const result = await globalUseCommand({ project: opts.project, key, alias: opts.as });
+    const asSuffix = opts.as !== void 0 ? ` (as ${opts.as})` : "";
+    process.stdout.write(`Bound ${key}${asSuffix} to ${result.project}.
+`);
+    if (result.unknown_keys !== void 0 && result.unknown_keys.length > 0) {
+      process.stdout.write(
+        `Warning: the global project has no value yet for: ${result.unknown_keys.join(", ")}
+`
+      );
+    }
+  });
+  globalGroup.command("drop").description("Unbind an org global key from this project.").argument("<KEY>", "global key name").option("-p, --project <project>", "override project name").addHelpText(
+    "after",
+    `
+Example:
+  $ dotvault global drop SENTRY_DSN`
+  ).action(async (key, opts) => {
+    const result = await globalDropCommand({ project: opts.project, key });
+    process.stdout.write(`Dropped ${key} from ${result.project}.
+`);
+  });
+  writeOpts(
+    program.command("push").description("Sync a whole file as-is (.npmrc, kubeconfig, certs, etc.). Zero extra config.").argument("<path>", "file to upload").option("--as <destPath>", "destination path on pull/run (default: same as path)").option("--pointer <env>", "pointer env var for run (default: known-tool table)").addHelpText(
+      "after",
+      `
+Example:
+  $ dotvault push .npmrc
+  $ dotvault push ~/.kube/config --as .kube/config --pointer KUBECONFIG`
+    )
+  ).action(
+    async (path, opts) => {
+      const r = await pushCommand({
+        project: opts.project,
+        env: opts.env,
+        path,
+        as: opts.as,
+        pointer: opts.pointer
+      });
+      process.stdout.write(
+        `pushed ${r.name} (v${r.version}) \u2192 ${r.destPath}` + (r.pointerEnv ? ` [run sets ${r.pointerEnv}]` : "") + "\n"
+      );
+    }
+  );
+  program.command("files").description("List files synced for this project/env.").option("-p, --project <project>", "override project name").option("-E, --env <env>", "environment").addHelpText(
+    "after",
+    `
+Example:
+  $ dotvault files
+  $ dotvault files --env production`
+  ).action(async (opts) => {
+    const files = await filesCommand(opts);
+    if (files.length === 0) {
+      process.stdout.write("No files synced.\n");
+      return;
+    }
+    for (const f of files) {
+      process.stdout.write(
+        `${f.name} \u2192 ${f.destPath}${f.pointerEnv ? ` (${f.pointerEnv})` : ""}
+`
+      );
+    }
+  });
+  program.command("scan").description("Scan files for committed secrets (offline). Exits non-zero if any found.").argument("[paths...]", "files or directories to scan (default: current directory)").addHelpText(
+    "after",
+    `
+Example:
+  $ dotvault scan .              # current directory
+  $ dotvault scan src/ tests/    # multiple targets`
+  ).action((paths) => {
+    const targets = paths.length > 0 ? paths : ["."];
+    const findings = scanPaths(targets);
+    if (findings.length === 0) {
+      process.stdout.write("No secrets found.\n");
+      return;
+    }
+    for (const f of findings) {
+      process.stdout.write(`${f.file}:${f.line}  [${f.rule}] ${f.description} \u2014 ${f.excerpt}
+`);
+    }
+    process.stderr.write(`
+${findings.length} potential secret(s) found.
+`);
+    process.exitCode = 1;
+  });
+  const token = program.command("token").description("Manage service tokens (CI/CD machine identity). Requires org_admin.");
+  token.command("list").description("List service tokens for an org.").requiredOption("--org <id>", "org id (see `dotvault whoami` or the admin console)").addHelpText(
+    "after",
+    `
+Example:
+  $ dotvault token list --org org_abc123`
+  ).action(async (opts) => {
+    const result = await tokenListCommand({ orgId: opts.org });
+    if (result.tokens.length === 0) {
+      process.stdout.write("No service tokens.\n");
+      return;
+    }
+    const widths = {
+      id: Math.max(8, ...result.tokens.map((t) => t.tokenId.length)),
+      name: Math.max(4, ...result.tokens.map((t) => t.name.length)),
+      role: 6
+    };
+    const pad = (s, w) => s.padEnd(w);
+    process.stdout.write(
+      `${pad("token_id", widths.id)}  ${pad("name", widths.name)}  ${pad("role", widths.role)}  expires_at  revoked
+`
+    );
+    for (const t of result.tokens) {
+      const exp = t.expiresAt === null ? "never" : new Date(t.expiresAt * 1e3).toISOString();
+      process.stdout.write(
+        `${pad(t.tokenId, widths.id)}  ${pad(t.name, widths.name)}  ${pad(t.role, widths.role)}  ${exp}  ${t.revoked ? "yes" : "no"}
+`
+      );
+    }
+  });
+  token.command("create").description("Mint a new service token. The token value is shown ONCE.").requiredOption("--org <id>", "org id").requiredOption("--name <name>", 'human-readable label (e.g. "ci-prod")').requiredOption("--role <role>", "viewer | member | provisioner").option("--project <id>", "restrict the token to a single project").option("--ttl <seconds>", "seconds until expiry (default: never)", (v) => Number(v)).addHelpText(
+    "after",
+    `
+Example:
+  $ dotvault token create --org org_abc --name ci-prod --role viewer
+  $ dotvault token create --org org_abc --name ci-deploy --role member --ttl 2592000
+  $ dotvault token create --org org_abc --name claude-provision --role provisioner
+
+A provisioner token (ADR-0018) can create projects but cannot read or write
+secrets; use it as DOTVAULT_ADMIN_TOKEN (or legacy ENV_SYNC_ADMIN_TOKEN) for
+headless \`project create\`.
+
+Save the printed est_\u2026 token in your CI secret store immediately \u2014 it cannot
+be retrieved again.`
+  ).action(
+    async (opts) => {
+      if (opts.role !== "viewer" && opts.role !== "member" && opts.role !== "provisioner") {
+        process.stderr.write(
+          `role must be 'viewer', 'member', or 'provisioner' (got '${opts.role}')
+`
+        );
+        process.exitCode = 1;
+        return;
+      }
+      if (opts.ttl !== void 0 && (!Number.isFinite(opts.ttl) || opts.ttl <= 0)) {
+        process.stderr.write(`--ttl must be a positive integer (seconds)
+`);
+        process.exitCode = 1;
+        return;
+      }
+      const result = await tokenCreateCommand({
+        orgId: opts.org,
+        name: opts.name,
+        role: opts.role,
+        projectId: opts.project,
+        ttlSeconds: opts.ttl
+      });
+      process.stdout.write(`token_id: ${result.tokenId}
+`);
+      process.stdout.write(`name:     ${result.name}
+`);
+      process.stdout.write(`role:     ${result.role}
+`);
+      if (result.projectId !== void 0) {
+        process.stdout.write(`project:  ${result.projectId}
+`);
+      }
+      process.stdout.write(
+        `expires:  ${result.expiresAt === null ? "never" : new Date(result.expiresAt * 1e3).toISOString()}
+`
+      );
+      process.stdout.write(`
+token (save now \u2014 shown only once):
+${result.token}
+`);
+    }
+  );
+  token.command("revoke").description("Revoke a service token by id.").requiredOption("--org <id>", "org id").requiredOption("--id <token_id>", "token id to revoke").addHelpText(
+    "after",
+    `
+Example:
+  $ dotvault token revoke --org org_abc --id est_meta_xyz`
+  ).action(async (opts) => {
+    await tokenRevokeCommand({ orgId: opts.org, tokenId: opts.id });
+    process.stdout.write(`Revoked token ${opts.id}.
+`);
+  });
+  const project = program.command("project").description("Manage projects (create without the admin web console \u2014 ADR-0018).");
+  project.command("create").description("Create a project. Works headlessly with a provisioner token.").requiredOption("--name <name>", "project name (^[a-z0-9][a-z0-9_-]*$)").option("--org <id>", "owning org id (optional with a provisioner token)").addHelpText(
+    "after",
+    `
+Credential precedence: DOTVAULT_ADMIN_TOKEN (or legacy ENV_SYNC_ADMIN_TOKEN) \u2192
+DOTVAULT_TOKEN (or legacy ENV_SYNC_TOKEN) \u2192 keychain login.
+
+Example (headless \u2014 Claude Code / CI):
+  $ DOTVAULT_ADMIN_TOKEN=est_\u2026 dotvault project create --name myapp
+
+Example (interactive):
+  $ dotvault login && dotvault project create --name myapp --org org_abc`
+  ).action(async (opts) => {
+    const result = await projectCreateCommand({ name: opts.name, orgId: opts.org });
+    process.stdout.write(`project:    ${result.project}
+`);
+    if (result.project_id !== void 0) {
+      process.stdout.write(`project_id: ${result.project_id}
+`);
+    }
+    if (result.owning_org_id !== void 0) {
+      process.stdout.write(`org:        ${result.owning_org_id}
+`);
+    }
+    process.stdout.write(`created_at: ${result.createdAt}
+`);
+  });
+  program.command("logout").description("Remove stored tokens from the OS keychain.").action(async () => {
+    const email = await logoutCommand();
+    if (email === null) {
+      process.stdout.write("Not logged in.\n");
+    } else {
+      process.stdout.write(`Logged out ${email}.
+`);
+    }
+  });
+  program.command("whoami").description("Show the logged-in user and token expiry.").addHelpText(
+    "after",
+    `
+Example:
+  $ dotvault whoami`
+  ).action(async () => {
+    const result = await whoamiCommand();
+    if (result === null) {
+      process.stdout.write("Not logged in.\n");
+      process.exitCode = 3;
+      return;
+    }
+    if (result.kind === "service") {
+      process.stdout.write(
+        `Service token (DOTVAULT_TOKEN=${result.tokenPrefix}\u2026) \u2014 CI / Lambda mode
+`
+      );
+      return;
+    }
+    process.stdout.write(`${result.email} (token expires in ${result.expiresInSeconds}s)
+`);
+  });
+  return program;
+}
+function renameNoticeFor(argv1) {
+  if (argv1 === void 0) return null;
+  const lastSegment = argv1.split(/[/\\]/).pop() ?? argv1;
+  const base = basename6(lastSegment).replace(/\.(cmd|ps1|exe)$/i, "");
+  if (base !== "env-sync") return null;
+  return "env-sync is now dotvault \u2014 the env-sync command keeps working as an alias.";
+}
+async function main(argv, argv1 = process.argv[1]) {
+  const notice = renameNoticeFor(argv1);
+  if (notice !== null) {
+    process.stderr.write(`${notice}
+`);
+  }
+  const program = buildProgram();
+  try {
+    await program.parseAsync(argv, { from: "user" });
+    const code = process.exitCode;
+    return typeof code === "number" ? code : 0;
+  } catch (err) {
+    if (isEnvSyncError(err)) {
+      process.stderr.write(`${red("\u2716")} ${err.code}: ${err.message}
+`);
+      return err.exitCode;
+    }
+    process.stderr.write(`${red("\u2716")} unexpected: ${err.message}
+`);
+    return 99;
+  }
+}
+var isDirectRun = (() => {
+  if (process.argv[1] === void 0) return false;
+  try {
+    return realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1]);
+  } catch {
+    return false;
+  }
+})();
+if (isDirectRun) {
+  main(process.argv.slice(2)).then((code) => {
+    process.exit(code);
+  });
+}
+export {
+  PACKAGE_VERSION,
+  buildProgram,
+  main,
+  renameNoticeFor
+};
+//# sourceMappingURL=index.js.map