@elding/cli 0.9.2 → 0.9.4

package/dist/commands/deploy.d.ts

@@ -0,0 +1 @@
+export declare function deploy(): Promise<void>;

package/dist/commands/deploy.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deploy = deploy;
+const config_js_1 = require("../lib/config.js");
+const api_js_1 = require("../lib/api.js");
+const terminal_js_1 = require("../lib/terminal.js");
+// `elding deploy` : génère une clé de déploiement (visible dans l'onglet Clés API)
+// et affiche les 2 variables d'environnement à coller en production.
+async function deploy() {
+    const { default: chalk } = await import("chalk");
+    const { default: ora } = await import("ora");
+    const config = (0, config_js_1.readConfig)();
+    if (!config) {
+        console.error(chalk.red("Not signed in. Run `elding login` first."));
+        process.exit(1);
+    }
+    const project = (0, config_js_1.readProject)();
+    if (!project) {
+        console.error(chalk.red("Project not linked. Run `elding init` first."));
+        process.exit(1);
+    }
+    const spinner = ora("Creating deployment key...").start();
+    let result;
+    try {
+        const accessToken = await (0, api_js_1.exchangeToken)(config.refreshToken);
+        result = await (0, api_js_1.createDeployToken)(accessToken);
+        spinner.stop();
+    }
+    catch (err) {
+        spinner.fail(chalk.red((0, terminal_js_1.safeText)(err.message, 200) || "Creation failed."));
+        process.exit(1);
+    }
+    console.log(chalk.green(`✓ Key "${(0, terminal_js_1.safeText)(result.label, 80)}" created (visible in the API Keys tab).`));
+    console.log(chalk.dim("\nAdd these 2 environment variables to your host (Vercel, etc.):\n"));
+    console.log(`  ELDING_REFRESH_TOKEN=${result.refreshToken}`);
+    console.log(`  ELDING_SET_ID=${(0, terminal_js_1.safeText)(project.setId, 64)}`);
+    console.log(chalk.yellow("\n⚠ The key is shown only once. Copy it now."));
+}

package/dist/commands/doctor.js

@@ -13,46 +13,46 @@ async function doctor() {
     // 1. Token local
     const config = (0, config_js_1.readConfig)();
     if (!config) {
-        fail("Non connecté — lancez `elding login`");
+        fail("Not signed in — run `elding login`");
         return;
     }
-    ok("Token local présent (trousseau OS)");
+    ok("Local token present (OS keychain)");
     // 2. Token valide + utilisateur
     let accessToken;
     try {
         accessToken = await (0, api_js_1.exchangeToken)(config.refreshToken);
         const me = await (0, api_js_1.getMe)(accessToken);
-        ok(`Authentifié : ${(0, terminal_js_1.safeText)(me.email)}`);
+        ok(`Authenticated: ${(0, terminal_js_1.safeText)(me.email)}`);
     }
     catch {
-        fail("Token expiré ou révoqué — relancez `elding login`");
+        fail("Token expired or revoked — run `elding login` again");
         return;
     }
     // 3. Set du projet
     const project = (0, config_js_1.readProject)();
     if (!project) {
-        warn("Aucun set configuré — lancez `elding init` ou `elding use <set>`");
+        warn("No set configured — run `elding init` or `elding use <set>`");
         return;
     }
-    ok(`Set actif : ${(0, terminal_js_1.safeText)(project.setName)}`);
+    ok(`Active set: ${(0, terminal_js_1.safeText)(project.setName)}`);
     // 4. Clés + verrouillage host
     try {
         const keys = await (0, api_js_1.listKeys)(accessToken, project.setId);
         if (keys.length === 0)
-            warn("Le set ne contient aucune clé");
+            warn("The set contains no keys");
         else {
             const locked = keys.filter((k) => k.allowedHost).length;
-            ok(`${keys.length} clé(s) — ${locked} verrouillée(s) sur un domaine`);
+            ok(`${keys.length} key(s) — ${locked} locked to a domain`);
             if (locked < keys.length)
-                warn(`${keys.length - locked} clé(s) sans domaine : exfiltrables via le proxy`);
+                warn(`${keys.length - locked} key(s) without a domain: exfiltratable via the proxy`);
         }
     }
     catch {
-        fail("Impossible de lire les clés du set");
+        fail("Could not read the set's keys");
     }
     // 5. Proxy
     if (process.env.ELDING_PROXY_URL)
-        ok(`Proxy actif : ${process.env.ELDING_PROXY_URL}`);
+        ok(`Proxy active: ${process.env.ELDING_PROXY_URL}`);
     else
-        console.log(chalk.dim("○ Proxy inactif (normal hors `elding proxy`)"));
+        console.log(chalk.dim("○ Proxy inactive (normal outside `elding proxy`)"));
 }

package/dist/commands/init.js

@@ -10,16 +10,16 @@ async function init() {
     const { default: inquirer } = await import("inquirer");
     const config = (0, config_js_1.readConfig)();
     if (!config) {
-        console.error(chalk.red("Non connecté. Lancez `elding login` d'abord."));
+        console.error(chalk.red("Not signed in. Run `elding login` first."));
         process.exit(1);
     }
-    const spinner = ora("Récupération des sets...").start();
+    const spinner = ora("Fetching sets...").start();
     let accessToken;
     try {
         accessToken = await (0, api_js_1.exchangeToken)(config.refreshToken);
     }
     catch (err) {
-        spinner.fail(chalk.red("Impossible d'obtenir un access token. Relancez `elding login`."));
+        spinner.fail(chalk.red("Could not get an access token. Run `elding login` again."));
         process.exit(1);
     }
     let sets;
@@ -28,11 +28,11 @@ async function init() {
         spinner.stop();
     }
     catch (err) {
-        spinner.fail(chalk.red("Impossible de récupérer les sets."));
+        spinner.fail(chalk.red("Could not fetch sets."));
         process.exit(1);
     }
     if (sets.length === 0) {
-        console.log(chalk.yellow("Aucun set trouvé. Créez-en un sur le vault."));
+        console.log(chalk.yellow("No sets found. Create one in the vault."));
         process.exit(0);
     }
     // Étape 1 : choisir l'organisation (toujours, pour une approche projet cohérente)
@@ -41,7 +41,7 @@ async function init() {
         {
             type: "select",
             name: "workspaceId",
-            message: "Quelle organisation ?",
+            message: "Which organization?",
             choices: orgs.map(([id, name]) => ({ name: (0, terminal_js_1.safeText)(name), value: id })),
         },
     ]);
@@ -52,7 +52,7 @@ async function init() {
         {
             type: "select",
             name: "setId",
-            message: "Quel set utiliser pour ce projet ?",
+            message: "Which set should this project use?",
             choices: orgSets.map((s) => {
                 const env = s.environment ? ENV_LABELS[s.environment] : undefined;
                 return { name: env ? `${(0, terminal_js_1.safeText)(s.name)} (${env})` : (0, terminal_js_1.safeText)(s.name), value: s.id };
@@ -68,5 +68,5 @@ async function init() {
     };
     (0, config_js_1.writeProject)(project);
     (0, config_js_1.trustProject)(project);
-    console.log(chalk.green(`✓ Set "${(0, terminal_js_1.safeText)(selected.name)}" (${(0, terminal_js_1.safeText)(selected.workspaceName)}) configuré dans .elding.json`));
+    console.log(chalk.green(`✓ Set "${(0, terminal_js_1.safeText)(selected.name)}" (${(0, terminal_js_1.safeText)(selected.workspaceName)}) saved in .elding.json`));
 }

package/dist/commands/keys.js

@@ -10,22 +10,22 @@ async function keys() {
     const { default: ora } = await import("ora");
     const project = (0, config_js_1.readProject)();
     if (!project) {
-        console.error(chalk.red("Projet non initialisé. Lancez `elding init` ou `elding use <set>`."));
+        console.error(chalk.red("Project not initialized. Run `elding init` or `elding use <set>`."));
         process.exit(1);
     }
-    const spinner = ora("Récupération des clés...").start();
+    const spinner = ora("Fetching keys...").start();
     const accessToken = await (0, session_js_1.requireAccessToken)();
     const list = await (0, api_js_1.listKeys)(accessToken, project.setId);
     spinner.stop();
     console.log(chalk.dim(`Set : ${(0, terminal_js_1.safeText)(project.setName)}`));
     if (list.length === 0) {
-        console.log(chalk.yellow("Aucune clé dans ce set."));
+        console.log(chalk.yellow("No keys in this set."));
         return;
     }
     for (const k of list) {
         const host = k.allowedHost
             ? chalk.dim(` → ${(0, terminal_js_1.safeText)(k.allowedHost)}`)
-            : chalk.yellow(" → aucun domaine (non verrouillé)");
+            : chalk.yellow(" → no domain (not locked)");
         console.log(`  ${(0, terminal_js_1.safeText)(k.name)}${host}`);
     }
 }

package/dist/commands/login.js

@@ -15,11 +15,11 @@ async function login() {
     const { default: open } = await import("open");
     const { default: ora } = await import("ora");
     const state = crypto_1.default.randomBytes(16).toString("hex");
-    const spinner = ora("En attente d'autorisation dans le navigateur...").start();
+    const spinner = ora("Waiting for authorization in the browser...").start();
     const token = await new Promise((resolve, reject) => {
         const timeout = setTimeout(() => {
             server.close();
-            reject(new Error("Timeout — aucune réponse après 5 minutes"));
+            reject(new Error("Timeout — no response after 5 minutes"));
         }, TIMEOUT_MS);
         const server = http_1.default.createServer(async (req, res) => {
             const addr = server.address();
@@ -32,7 +32,7 @@ async function login() {
                 /^[A-Za-z0-9._~-]{16,512}$/.test(receivedCode);
             if (receivedState !== state || !codeValid) {
                 res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
-                res.end("<p>Paramètres invalides. Fermez cet onglet.</p>");
+                res.end("<p>Invalid parameters. Close this tab.</p>");
                 return;
             }
             try {
@@ -42,7 +42,7 @@ async function login() {
                     "Referrer-Policy": "no-referrer",
                     "Cache-Control": "no-store",
                 });
-                res.end(`<!DOCTYPE html><html lang="fr"><head><meta charset="utf-8"><title>Elding</title><script>history.replaceState(null,"","/")</script><style>
+                res.end(`<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Elding</title><script>history.replaceState(null,"","/")</script><style>
           *{margin:0;padding:0;box-sizing:border-box}
           html,body{height:100%}
           body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;background:#fff;color:#000;display:flex;align-items:center;justify-content:center;text-align:center}
@@ -51,9 +51,9 @@ async function login() {
           p{font-size:1rem;color:#6b7280}
         </style></head><body>
           <div class="wrap">
-            <h1>Tout est prêt, codez l'esprit tranquille</h1>
-            <p>Vous êtes connecté à Elding.</p>
-            <p>Vous pouvez maintenant fermer cette fenêtre.</p>
+            <h1>All set, code with peace of mind</h1>
+            <p>You are signed in to Elding.</p>
+            <p>You can now close this window.</p>
           </div>
         </body></html>`);
                 clearTimeout(timeout);
@@ -62,7 +62,7 @@ async function login() {
             }
             catch (err) {
                 res.writeHead(502, { "Content-Type": "text/html; charset=utf-8" });
-                res.end("<p>Impossible de finaliser l'authentification. Fermez cet onglet et relancez le login.</p>");
+                res.end("<p>Could not finalize authentication. Close this tab and run login again.</p>");
                 clearTimeout(timeout);
                 server.close();
                 reject(new Error((0, terminal_js_1.safeError)(err)));
@@ -80,12 +80,12 @@ async function login() {
                 `?state=${encodeURIComponent(state)}` +
                 `&callback=${encodeURIComponent(callbackUrl)}`;
             open(authUrl).catch((err) => {
-                spinner.warn(`Impossible d'ouvrir le navigateur automatiquement.`);
-                console.log(chalk.cyan(`Ouvrez manuellement : ${authUrl}`));
+                spinner.warn("Could not open the browser automatically.");
+                console.log(chalk.cyan(`Open manually: ${authUrl}`));
             });
         });
     });
     (0, config_js_1.writeConfig)({ refreshToken: token });
-    spinner.succeed(chalk.green("Connecté avec succès."));
-    console.log(chalk.dim("Token sauvegardé dans le trousseau de votre OS."));
+    spinner.succeed(chalk.green("Signed in successfully."));
+    console.log(chalk.dim("Token saved in your OS keychain."));
 }

package/dist/commands/logout.js

@@ -8,12 +8,12 @@ async function logout() {
     const { default: ora } = await import("ora");
     const config = (0, config_js_1.readConfig)();
     if (!config) {
-        console.log(chalk.dim("Déjà déconnecté."));
+        console.log(chalk.dim("Already signed out."));
         return;
     }
-    const spinner = ora("Déconnexion...").start();
+    const spinner = ora("Signing out...").start();
     // Révoque côté serveur (best-effort) puis efface le token local
     await (0, api_js_1.revokeToken)(config.refreshToken);
     (0, config_js_1.clearConfig)();
-    spinner.succeed(chalk.green("Déconnecté. Token révoqué et supprimé localement."));
+    spinner.succeed(chalk.green("Signed out. Token revoked and removed locally."));
 }

package/dist/commands/open.js

@@ -7,7 +7,7 @@ async function open() {
     const { default: openUrl } = await import("open");
     const url = `${api_js_1.BASE_URL}/vault`;
     await openUrl(url).catch(() => {
-        console.log(chalk.cyan(`Ouvrez manuellement : ${url}`));
+        console.log(chalk.cyan(`Open manually: ${url}`));
     });
-    console.log(chalk.dim(`Vault ouvert : ${url}`));
+    console.log(chalk.dim(`Vault opened: ${url}`));
 }

package/dist/commands/proxy.js

@@ -1,7 +1,11 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.proxy = proxy;
 const child_process_1 = require("child_process");
+const path_1 = __importDefault(require("path"));
 const config_js_1 = require("../lib/config.js");
 const api_js_1 = require("../lib/api.js");
 const proxyServer_js_1 = require("../lib/proxyServer.js");
@@ -13,19 +17,19 @@ async function proxy(cmd, args, options = {}) {
     const { default: ora } = await import("ora");
     const config = (0, config_js_1.readConfig)();
     if (!config) {
-        console.error(chalk.red("Non connecté. Lancez `elding login` d'abord."));
+        console.error(chalk.red("Not signed in. Run `elding login` first."));
         process.exit(1);
     }
     const project = (0, config_js_1.readProject)();
     if (!project) {
-        console.error(chalk.red("Projet non initialisé. Lancez `elding init` d'abord."));
+        console.error(chalk.red("Project not initialized. Run `elding init` first."));
         process.exit(1);
     }
     await (0, trust_js_1.ensureProjectTrusted)(project);
     if (!options.shell && /\s/.test(cmd)) {
-        throw new Error("Commande invalide sans --shell. Passez le binaire et ses arguments separement, ou ajoutez --shell explicitement.");
+        throw new Error("Invalid command without --shell. Pass the binary and its arguments separately, or add --shell explicitly.");
     }
-    const spinner = ora("Démarrage du proxy...").start();
+    const spinner = ora("Starting proxy...").start();
     let secrets;
     let hosts;
     try {
@@ -40,22 +44,27 @@ async function proxy(cmd, args, options = {}) {
         ? (0, logBatcher_js_1.createLogBatcher)(config.refreshToken, project.setId, project.setName)
         : null;
     const server = await (0, proxyServer_js_1.startProxy)(secrets, hosts, !!options.verbose, batcher ? (e) => batcher.add(e) : undefined);
-    spinner.succeed(chalk.green(`Proxy actif sur ${server.url} — ${Object.keys(secrets).length} secret(s) pour ${(0, terminal_js_1.safeText)(project.setName)}`));
-    console.log(chalk.dim("Les clés restent dans le proxy, jamais dans la mémoire de l'app."));
+    spinner.succeed(chalk.green(`Proxy active on ${server.url} — ${Object.keys(secrets).length} secret(s) for ${(0, terminal_js_1.safeText)(project.setName)}`));
+    console.log(chalk.dim("Keys stay in the proxy, never in the app's memory."));
     if (!options.reportLogs)
-        console.log(chalk.dim("Logs cloud proxy désactivés (--no-report-logs)."));
+        console.log(chalk.dim("Cloud proxy logs disabled (--no-report-logs)."));
     else
-        console.log(chalk.dim("Métadonnées de requêtes envoyées au vault (jamais les valeurs). Couper avec --no-report-logs."));
+        console.log(chalk.dim("Request metadata sent to the vault (never the values). Disable with --no-report-logs."));
+    // Résout les binaires locaux (next, vite...) comme le ferait npm, en
+    // cross-platform : path.delimiter = ";" sur Windows, ":" sur POSIX.
+    const localBin = path_1.default.join(process.cwd(), "node_modules", ".bin");
+    // Sur Windows, les binaires sont des shims `.cmd` : il faut un shell pour les
+    // exécuter (sinon `next` échoue en ENOENT). Sur POSIX, on respecte --shell.
+    const useShell = process.platform === "win32" ? true : !!options.shell;
     const child = (0, child_process_1.spawn)(cmd, args, {
         env: {
             ...process.env,
-            // Résout les binaires locaux (next, vite...) comme le ferait npm.
-            PATH: `${process.cwd()}/node_modules/.bin:${process.env.PATH ?? ""}`,
+            PATH: `${localBin}${path_1.default.delimiter}${process.env.PATH ?? ""}`,
             ELDING_PROXY_URL: server.url,
             ELDING_PROXY_TOKEN: server.token,
         },
         stdio: "inherit",
-        shell: !!options.shell,
+        shell: useShell,
     });
     const shutdown = async () => {
         server.close();

package/dist/commands/run.js

@@ -1,7 +1,11 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.run = run;
 const child_process_1 = require("child_process");
+const path_1 = __importDefault(require("path"));
 const config_js_1 = require("../lib/config.js");
 const api_js_1 = require("../lib/api.js");
 const env_js_1 = require("../lib/env.js");
@@ -12,48 +16,51 @@ async function run(cmd, args, options = {}) {
     const { default: ora } = await import("ora");
     const config = (0, config_js_1.readConfig)();
     if (!config) {
-        console.error(chalk.red("Non connecté. Lancez `elding login` d'abord."));
+        console.error(chalk.red("Not signed in. Run `elding login` first."));
         process.exit(1);
     }
     const project = (0, config_js_1.readProject)();
     if (!project) {
-        console.error(chalk.red("Projet non initialisé. Lancez `elding init` d'abord."));
+        console.error(chalk.red("Project not initialized. Run `elding init` first."));
         process.exit(1);
     }
     await (0, trust_js_1.ensureProjectTrusted)(project);
     if (!options.shell && /\s/.test(cmd)) {
-        throw new Error("Commande invalide sans --shell. Passez le binaire et ses arguments separement, ou ajoutez --shell explicitement.");
+        throw new Error("Invalid command without --shell. Pass the binary and its arguments separately, or add --shell explicitly.");
     }
-    const spinner = ora("Récupération des secrets...").start();
+    const spinner = ora("Fetching secrets...").start();
     let secrets;
     try {
         const accessToken = await (0, api_js_1.exchangeToken)(config.refreshToken);
         ({ secrets } = await (0, api_js_1.fetchSecrets)(accessToken, project.setId, "run"));
-        spinner.succeed(chalk.green(`${Object.keys(secrets).length} secret(s) chargé(s) pour ${(0, terminal_js_1.safeText)(project.setName)}.`));
+        spinner.succeed(chalk.green(`${Object.keys(secrets).length} secret(s) loaded for ${(0, terminal_js_1.safeText)(project.setName)}.`));
     }
     catch (err) {
         spinner.fail(chalk.red((0, terminal_js_1.safeError)(err)));
         process.exit(1);
     }
-    console.error(chalk.yellow("⚠ Mode run : les clés sont injectées en clair dans process.env (lisibles par votre IA et vos dépendances)."));
-    console.error(chalk.dim("  Pour que les clés n'entrent jamais dans votre app, préférez `elding proxy`."));
+    console.error(chalk.yellow("⚠ Run mode: keys are injected in clear text into process.env (readable by your AI and your dependencies)."));
+    console.error(chalk.dim("  To keep keys out of your app entirely, prefer `elding proxy`."));
     const { env: safeSecrets, rejected } = (0, env_js_1.filterSecretsForEnv)(secrets);
     if (rejected.length > 0) {
-        throw new Error(`Secrets refuses car leurs noms sont dangereux pour l'environnement: ${rejected.map((name) => (0, terminal_js_1.safeText)(name, 80)).join(", ")}`);
+        throw new Error(`Secrets rejected because their names are unsafe for the environment: ${rejected.map((name) => (0, terminal_js_1.safeText)(name, 80)).join(", ")}`);
     }
+    // Résout les binaires locaux (next, vite...) en cross-platform.
+    const localBin = path_1.default.join(process.cwd(), "node_modules", ".bin");
     const env = {
         ...process.env,
-        // Résout les binaires locaux (next, vite...) comme le ferait npm.
-        PATH: `${process.cwd()}/node_modules/.bin:${process.env.PATH ?? ""}`,
+        PATH: `${localBin}${path_1.default.delimiter}${process.env.PATH ?? ""}`,
         ...safeSecrets,
     };
+    // Sur Windows, les binaires locaux sont des shims `.cmd` : shell requis.
+    const useShell = process.platform === "win32" ? true : !!options.shell;
     const result = (0, child_process_1.spawnSync)(cmd, args, {
         env,
         stdio: "inherit",
-        shell: !!options.shell,
+        shell: useShell,
     });
     if (result.error) {
-        console.error(chalk.red(`Impossible de lancer la commande : ${result.error.message}`));
+        console.error(chalk.red(`Could not run the command: ${result.error.message}`));
         process.exit(1);
     }
     process.exit(result.status ?? 0);

package/dist/commands/sets.js

@@ -8,12 +8,12 @@ const terminal_js_1 = require("../lib/terminal.js");
 async function sets() {
     const { default: chalk } = await import("chalk");
     const { default: ora } = await import("ora");
-    const spinner = ora("Récupération des sets...").start();
+    const spinner = ora("Fetching sets...").start();
     const accessToken = await (0, session_js_1.requireAccessToken)();
     const list = await (0, api_js_1.listSets)(accessToken);
     spinner.stop();
     if (list.length === 0) {
-        console.log(chalk.yellow("Aucun set. Créez-en un sur le vault."));
+        console.log(chalk.yellow("No sets. Create one in the vault."));
         return;
     }
     const activeId = (0, config_js_1.readProject)()?.setId;

package/dist/commands/status.js

@@ -8,7 +8,7 @@ async function status() {
     const { default: chalk } = await import("chalk");
     const config = (0, config_js_1.readConfig)();
     if (!config) {
-        console.log(chalk.yellow("Non connecté.") + chalk.dim("  Lancez `elding login`."));
+        console.log(chalk.yellow("Not signed in.") + chalk.dim("  Run `elding login`."));
         return;
     }
     // Vérifie la validité du token + récupère l'utilisateur
@@ -18,13 +18,13 @@ async function status() {
         user = await (0, api_js_1.getMe)(accessToken);
     }
     catch {
-        console.log(chalk.red("Token expiré ou révoqué.") + chalk.dim("  Relancez `elding login`."));
+        console.log(chalk.red("Token expired or revoked.") + chalk.dim("  Run `elding login` again."));
         return;
     }
     const project = (0, config_js_1.readProject)();
     const proxyActive = !!process.env.ELDING_PROXY_URL;
-    console.log(chalk.green("● Connecté"));
-    console.log(`  ${chalk.dim("Utilisateur")}  ${(0, terminal_js_1.safeText)(user.email)}${user.name ? chalk.dim(` (${(0, terminal_js_1.safeText)(user.name)})`) : ""}`);
-    console.log(`  ${chalk.dim("Set actif")}    ${project ? `${(0, terminal_js_1.safeText)(project.setName)} ${chalk.dim(`(${(0, terminal_js_1.safeText)(project.setId)})`)}` : chalk.yellow("aucun — `elding init`")}`);
-    console.log(`  ${chalk.dim("Proxy")}        ${proxyActive ? chalk.green("actif") : chalk.dim("inactif")}`);
+    console.log(chalk.green("● Signed in"));
+    console.log(`  ${chalk.dim("User")}          ${(0, terminal_js_1.safeText)(user.email)}${user.name ? chalk.dim(` (${(0, terminal_js_1.safeText)(user.name)})`) : ""}`);
+    console.log(`  ${chalk.dim("Active set")}    ${project ? `${(0, terminal_js_1.safeText)(project.setName)} ${chalk.dim(`(${(0, terminal_js_1.safeText)(project.setId)})`)}` : chalk.yellow("none — `elding init`")}`);
+    console.log(`  ${chalk.dim("Proxy")}        ${proxyActive ? chalk.green("active") : chalk.dim("inactive")}`);
 }

package/dist/commands/use.js

@@ -8,7 +8,7 @@ const terminal_js_1 = require("../lib/terminal.js");
 async function use(nameArg) {
     const { default: chalk } = await import("chalk");
     const { default: ora } = await import("ora");
-    const spinner = ora("Récupération des sets...").start();
+    const spinner = ora("Fetching sets...").start();
     const accessToken = await (0, session_js_1.requireAccessToken)();
     const list = await (0, api_js_1.listSets)(accessToken);
     spinner.stop();
@@ -16,11 +16,11 @@ async function use(nameArg) {
     const matches = list.filter((s) => s.name.toLowerCase() === query);
     const candidates = matches.length ? matches : list.filter((s) => s.name.toLowerCase().includes(query));
     if (candidates.length === 0) {
-        console.error(chalk.red(`Aucun set nommé "${(0, terminal_js_1.safeText)(nameArg)}".`) + chalk.dim("  Voir `elding sets`."));
+        console.error(chalk.red(`No set named "${(0, terminal_js_1.safeText)(nameArg)}".`) + chalk.dim("  See `elding sets`."));
         process.exit(1);
     }
     if (candidates.length > 1) {
-        console.error(chalk.red(`Plusieurs sets correspondent à "${(0, terminal_js_1.safeText)(nameArg)}" :`));
+        console.error(chalk.red(`Several sets match "${(0, terminal_js_1.safeText)(nameArg)}":`));
         candidates.forEach((s) => console.error(chalk.dim(`  - ${(0, terminal_js_1.safeText)(s.name)}`)));
         process.exit(1);
     }
@@ -33,5 +33,5 @@ async function use(nameArg) {
     };
     (0, config_js_1.writeProject)(project);
     (0, config_js_1.trustProject)(project);
-    console.log(chalk.green(`✓ Set actif : "${(0, terminal_js_1.safeText)(set.name)}"`));
+    console.log(chalk.green(`✓ Active set: "${(0, terminal_js_1.safeText)(set.name)}"`));
 }

package/dist/index.js

@@ -4,6 +4,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const commander_1 = require("commander");
 const login_js_1 = require("./commands/login.js");
 const init_js_1 = require("./commands/init.js");
+const deploy_js_1 = require("./commands/deploy.js");
 const run_js_1 = require("./commands/run.js");
 const proxy_js_1 = require("./commands/proxy.js");
 const logout_js_1 = require("./commands/logout.js");
@@ -17,13 +18,13 @@ const whoami_js_1 = require("./commands/whoami.js");
 const program = new commander_1.Command();
 program
     .name("elding")
-    .description("Elding CLI — secrets depuis le vault, zéro .env")
-    .version("0.8.2")
+    .description("Elding CLI — secrets from the vault, zero .env")
+    .version("0.9.3")
     // Permet aux sous-commandes de passer les flags de la commande wrappée (next dev --turbopack...).
     .enablePositionalOptions();
 program
     .command("login")
-    .description("Authentifier le CLI via le navigateur")
+    .description("Authenticate the CLI through the browser")
     .action(async () => {
     await (0, login_js_1.login)().catch((err) => {
         console.error(err.message);
@@ -32,17 +33,26 @@ program
 });
 program
     .command("init")
-    .description("Associer ce projet à un set de secrets")
+    .description("Link this project to a secret set")
     .action(async () => {
     await (0, init_js_1.init)().catch((err) => {
         console.error(err.message);
         process.exit(1);
     });
 });
+program
+    .command("deploy")
+    .description("Generate a deployment key and the env variables for production")
+    .action(async () => {
+    await (0, deploy_js_1.deploy)().catch((err) => {
+        console.error(err.message);
+        process.exit(1);
+    });
+});
 program
     .command("run <cmd> [args...]")
-    .description("Lancer une commande avec les secrets injectés en variables d'environnement")
-    .option("--shell", "Executer via le shell systeme (a utiliser seulement si necessaire)")
+    .description("Run a command with secrets injected as environment variables")
+    .option("--shell", "Run through the system shell (use only if necessary)")
     .passThroughOptions()
     .allowUnknownOption()
     .action(async (cmd, args = [], options) => {
@@ -53,10 +63,10 @@ program
 });
 program
     .command("proxy <cmd> [args...]")
-    .description("Lancer une commande derrière un proxy local qui injecte les clés — jamais en mémoire de l'app")
-    .option("-v, --verbose", "Logger chaque requête (méthode/host/status/latence)")
-    .option("--no-report-logs", "Ne pas envoyer les metadonnees de requetes proxy au vault")
-    .option("--shell", "Executer via le shell systeme (a utiliser seulement si necessaire)")
+    .description("Run a command behind a local proxy that injects keys — never in the app's memory")
+    .option("-v, --verbose", "Log every request (method/host/status/latency)")
+    .option("--no-report-logs", "Do not send proxy request metadata to the vault")
+    .option("--shell", "Run through the system shell (use only if necessary)")
     .passThroughOptions()
     .allowUnknownOption()
     .action(async (cmd, args = [], options) => {
@@ -71,7 +81,7 @@ program
 });
 program
     .command("logout")
-    .description("Révoquer le token et le supprimer localement")
+    .description("Revoke the token and remove it locally")
     .action(async () => {
     await (0, logout_js_1.logout)().catch((err) => {
         console.error(err.message);
@@ -80,7 +90,7 @@ program
 });
 program
     .command("status")
-    .description("Afficher l'état de connexion, le set actif et le proxy")
+    .description("Show sign-in status, active set and proxy")
     .action(async () => {
     await (0, status_js_1.status)().catch((err) => {
         console.error(err.message);
@@ -89,7 +99,7 @@ program
 });
 program
     .command("sets")
-    .description("Lister les sets accessibles")
+    .description("List accessible sets")
     .action(async () => {
     await (0, sets_js_1.sets)().catch((err) => {
         console.error(err.message);
@@ -98,7 +108,7 @@ program
 });
 program
     .command("use <name>")
-    .description("Changer le set actif du projet")
+    .description("Switch the project's active set")
     .action(async (name) => {
     await (0, use_js_1.use)(name).catch((err) => {
         console.error(err.message);
@@ -107,7 +117,7 @@ program
 });
 program
     .command("keys")
-    .description("Lister les noms de clés du set actif (jamais les valeurs)")
+    .description("List the key names of the active set (never the values)")
     .action(async () => {
     await (0, keys_js_1.keys)().catch((err) => {
         console.error(err.message);
@@ -116,7 +126,7 @@ program
 });
 program
     .command("doctor")
-    .description("Diagnostiquer la configuration (connexion, set, clés, proxy)")
+    .description("Diagnose the configuration (sign-in, set, keys, proxy)")
     .action(async () => {
     await (0, doctor_js_1.doctor)().catch((err) => {
         console.error(err.message);
@@ -125,7 +135,7 @@ program
 });
 program
     .command("open")
-    .description("Ouvrir le vault dans le navigateur")
+    .description("Open the vault in the browser")
     .action(async () => {
     await (0, open_js_1.open)().catch((err) => {
         console.error(err.message);
@@ -134,7 +144,7 @@ program
 });
 program
     .command("whoami")
-    .description("Afficher l'utilisateur connecté")
+    .description("Show the signed-in user")
     .action(async () => {
     await (0, whoami_js_1.whoami)().catch((err) => {
         console.error(err.message);

package/dist/lib/api.d.ts

@@ -12,6 +12,10 @@ export type KeyItem = {
 };
 export declare function listKeys(accessToken: string, setId: string): Promise<KeyItem[]>;
 export declare function exchangeToken(refreshToken: string): Promise<string>;
+export declare function createDeployToken(accessToken: string, label?: string): Promise<{
+    refreshToken: string;
+    label: string;
+}>;
 export declare function exchangeLoginCode(code: string, state: string, callbackUrl: string): Promise<string>;
 export declare function reportProxyLogs(accessToken: string, setId: string, setName: string, entries: unknown[]): Promise<void>;
 export declare function revokeToken(refreshToken: string): Promise<void>;

package/dist/lib/api.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.BASE_URL = void 0;
 exports.listKeys = listKeys;
 exports.exchangeToken = exchangeToken;
+exports.createDeployToken = createDeployToken;
 exports.exchangeLoginCode = exchangeLoginCode;
 exports.reportProxyLogs = reportProxyLogs;
 exports.revokeToken = revokeToken;
@@ -24,26 +25,37 @@ async function listKeys(accessToken, setId) {
 }
 async function exchangeToken(refreshToken) {
     if (!REFRESH_TOKEN.test(refreshToken))
-        throw new Error("Token local invalide. Relancez `elding login`.");
+        throw new Error("Invalid local token. Run `elding login` again.");
     const body = await requestJson("/api/cli/auth/token", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ refreshToken }),
     });
     if (!body.success || !body.accessToken)
-        throw new Error((0, terminal_js_1.safeText)(body.error, 200) || "Impossible d'obtenir un access token");
+        throw new Error((0, terminal_js_1.safeText)(body.error, 200) || "Could not get an access token");
     return body.accessToken;
 }
+// Crée une clé API de service (déploiement). Apparaît dans l'onglet Clés API.
+async function createDeployToken(accessToken, label) {
+    const body = await requestJson("/api/cli/deploy-token", {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${accessToken}` },
+        body: JSON.stringify({ label }),
+    });
+    if (!body.success || !body.refreshToken)
+        throw new Error((0, terminal_js_1.safeText)(body.error, 200) || "Could not create the deployment key");
+    return { refreshToken: body.refreshToken, label: body.label ?? "Deployment" };
+}
 async function exchangeLoginCode(code, state, callbackUrl) {
     if (!LOGIN_CODE.test(code))
-        throw new Error("Code d'autorisation invalide.");
+        throw new Error("Invalid authorization code.");
     const body = await requestJson("/api/cli/auth/exchange", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ code, state, callbackUrl }),
     });
     if (!body.success || !body.refreshToken || !REFRESH_TOKEN.test(body.refreshToken)) {
-        throw new Error((0, terminal_js_1.safeText)(body.error, 200) || "Impossible de finaliser l'authentification.");
+        throw new Error((0, terminal_js_1.safeText)(body.error, 200) || "Could not finalize authentication.");
     }
     return body.refreshToken;
 }
@@ -70,7 +82,7 @@ async function getMe(accessToken) {
         headers: { Authorization: `Bearer ${accessToken}` },
     });
     if (!body.success || !body.user)
-        throw new Error("Réponse invalide");
+        throw new Error("Invalid response");
     return body.user;
 }
 async function listSets(accessToken) {
@@ -84,7 +96,7 @@ async function fetchSecrets(accessToken, setId, mode = "proxy") {
         headers: { Authorization: `Bearer ${accessToken}` },
     });
     if (!body.success || !body.secrets || typeof body.secrets !== "object")
-        throw new Error("Réponse invalide");
+        throw new Error("Invalid response");
     return {
         secrets: sanitizeSecrets(body.secrets),
         hosts: body.hosts && typeof body.hosts === "object" ? sanitizeSecrets(body.hosts) : {},
@@ -112,9 +124,9 @@ async function requestJson(path, init) {
     });
     const body = (await res.json().catch(() => null));
     if (!res.ok) {
-        throw new Error((0, terminal_js_1.safeText)(body?.error, 200) || `Erreur ${res.status}`);
+        throw new Error((0, terminal_js_1.safeText)(body?.error, 200) || `Error ${res.status}`);
     }
     if (!body || typeof body !== "object")
-        throw new Error("Réponse invalide");
+        throw new Error("Invalid response");
     return body;
 }

package/dist/lib/apiUrl.js

@@ -28,17 +28,17 @@ function resolveBaseUrl(raw = process.env.ELDING_API_URL) {
         url = new URL(input);
     }
     catch {
-        throw new Error("ELDING_API_URL invalide.");
+        throw new Error("Invalid ELDING_API_URL.");
     }
     if (url.username || url.password) {
-        throw new Error("ELDING_API_URL ne doit pas contenir d'identifiants.");
+        throw new Error("ELDING_API_URL must not contain credentials.");
     }
     if (url.pathname !== "/" || url.search || url.hash) {
-        throw new Error("ELDING_API_URL doit etre une origine seule, par exemple https://elding.app.");
+        throw new Error("ELDING_API_URL must be an origin only, for example https://elding.app.");
     }
     if (url.protocol === "https:")
         return url.origin;
     if (url.protocol === "http:" && isLoopbackHost(url.hostname))
         return url.origin;
-    throw new Error("ELDING_API_URL doit utiliser HTTPS, sauf pour localhost en developpement.");
+    throw new Error("ELDING_API_URL must use HTTPS, except for localhost during development.");
 }

package/dist/lib/config.js

@@ -62,7 +62,7 @@ function ensureConfigDir() {
     try {
         const stat = fs_1.default.lstatSync(CONFIG_DIR);
         if (stat.isSymbolicLink() || !stat.isDirectory()) {
-            throw new Error(`${CONFIG_DIR} doit etre un dossier non symbolique.`);
+            throw new Error(`${CONFIG_DIR} must be a non-symbolic directory.`);
         }
     }
     catch (err) {
@@ -123,7 +123,7 @@ function isProjectTrusted(project, cwd = process.cwd()) {
 function trustProject(project, cwd = process.cwd()) {
     const config = readConfig();
     if (!config)
-        throw new Error("Non connecté. Lancez `elding login` d'abord.");
+        throw new Error("Not signed in. Run `elding login` first.");
     writeConfig({
         ...config,
         trustedProjects: {

package/dist/lib/proxyServer.js

@@ -144,13 +144,13 @@ function startProxy(secrets, hosts = {}, verbose = false, onLog) {
         for (const m of val.matchAll(PLACEHOLDER)) {
             const name = m[1];
             if (!Object.prototype.hasOwnProperty.call(secrets, name))
-                return `${name} inconnu`;
+                return `${name} is unknown`;
             const allowed = hosts[name];
             if (!allowed)
-                return `${name} sans domaine autorise`;
+                return `${name} has no allowed domain`;
             const allowedHost = normalizeAllowedHost(allowed);
             if (!allowedHost || allowedHost !== targetHost)
-                return `${name} non autorise`;
+                return `${name} is not allowed`;
         }
         return null;
     };
@@ -193,7 +193,7 @@ function startProxy(secrets, hosts = {}, verbose = false, onLog) {
             const targetHost = normalizeHostname(targetUrl.hostname);
             const resolved = await resolvePublicAddresses(targetHost);
             if (resolved.length === 0) {
-                log(req.method ?? "?", targetHost, req.url ?? "/", "BLOCKED", Date.now() - started, "host bloqué");
+                log(req.method ?? "?", targetHost, req.url ?? "/", "BLOCKED", Date.now() - started, "blocked host");
                 res.writeHead(403);
                 res.end("blocked host");
                 return;
@@ -211,7 +211,7 @@ function startProxy(secrets, hosts = {}, verbose = false, onLog) {
                         continue;
                     log(req.method ?? "?", targetHost, upstream.pathname, "BLOCKED", Date.now() - started, bad);
                     res.writeHead(403);
-                    res.end(`secret bloque: ${bad}`);
+                    res.end(`blocked secret: ${bad}`);
                     return;
                 }
             }

package/dist/lib/session.js

@@ -7,11 +7,11 @@ const api_js_1 = require("./api.js");
 async function requireAccessToken() {
     const config = (0, config_js_1.readConfig)();
     if (!config)
-        throw new Error("Non connecté. Lancez `elding login` d'abord.");
+        throw new Error("Not signed in. Run `elding login` first.");
     try {
         return await (0, api_js_1.exchangeToken)(config.refreshToken);
     }
     catch {
-        throw new Error("Token expiré ou révoqué. Relancez `elding login`.");
+        throw new Error("Token expired or revoked. Run `elding login` again.");
     }
 }

package/dist/lib/terminal.js

@@ -11,5 +11,5 @@ function safeText(value, maxLength = 500) {
         .slice(0, maxLength);
 }
 function safeError(value) {
-    return safeText(value instanceof Error ? value.message : value, 300) || "Erreur inconnue";
+    return safeText(value instanceof Error ? value.message : value, 300) || "Unknown error";
 }

package/dist/lib/trust.js

@@ -15,15 +15,15 @@ async function ensureProjectTrusted(project) {
     const target = `${(0, terminal_js_1.safeText)(project.setName)} (${(0, terminal_js_1.safeText)(project.setId)})`;
     const workspace = project.workspaceName ? ` / ${(0, terminal_js_1.safeText)(project.workspaceName)}` : "";
     if (!process_1.stdin.isTTY || !process_1.stdout.isTTY) {
-        throw new Error(`Projet non approuve pour le set ${target}${workspace}. Lancez \`elding init\` ou \`elding use <set>\` interactivement.`);
+        throw new Error(`Project not approved for set ${target}${workspace}. Run \`elding init\` or \`elding use <set>\` interactively.`);
     }
     const rl = promises_1.default.createInterface({ input: process_1.stdin, output: process_1.stdout });
     try {
-        console.log(`Projet : ${(0, terminal_js_1.safeText)(location)}`);
-        console.log(`Set Elding : ${target}${workspace}`);
-        const answer = await rl.question("Approuver ce projet pour ce set ? [y/N] ");
+        console.log(`Project: ${(0, terminal_js_1.safeText)(location)}`);
+        console.log(`Elding set: ${target}${workspace}`);
+        const answer = await rl.question("Approve this project for this set? [y/N] ");
         if (!/^y(es)?$/i.test(answer.trim())) {
-            throw new Error("Projet non approuve.");
+            throw new Error("Project not approved.");
         }
         (0, config_js_1.trustProject)(project);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elding/cli",
-  "version": "0.9.2",
+  "version": "0.9.4",
   "description": "Elding CLI — zero .env, secrets from vault",
   "bin": {
     "elding": "dist/index.js"