@envseal/cli 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined in Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity exercising
+      permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or Object
+      form, made available under the License, as indicated by a copyright
+      notice that is included in or attached to the work (an example is
+      provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original Work and any Derivative Works thereof, that is
+      intentionally submitted to, or received by, Licensor for inclusion
+      in the Work by the copyright owner or by an individual or Legal
+      Entity authorized to submit on behalf of the copyright owner. For
+      the purposes of this definition, "submitted" means any form of
+      electronic, verbal, or written communication sent to the Licensor
+      or its representatives, including but not limited to communication
+      on electronic mailing lists, source code control systems, and issue
+      tracking systems that are managed by, or on behalf of, the Licensor
+      for the purpose of discussing and improving the Work, but excluding
+      communication that is conspicuously marked or otherwise designated
+      in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any Legal Entity on behalf of
+      which a Contribution has been received by Licensor and subsequently
+      incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file, then any
+          Derivative Works that You distribute must include a readable
+          copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE from the Work, provided that
+          such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions of this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contribution.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in appropriate
+      comment syntax for the file type. We also recommend that you
+      include a file or class name and date of last modification in
+      the header comment to make it easier to identify the original
+      author and when the file was changed.
+
+         Copyright 2026 The envseal authors
+
+         Licensed under the Apache License, Version 2.0 (the "License");
+         you may not use this file except in compliance with the License.
+         You may obtain a copy of the License at
+
+             http://www.apache.org/licenses/LICENSE-2.0
+
+         Unless required by applicable law or agreed to in writing, software
+         distributed under the License is distributed on an "AS IS" BASIS,
+         WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+         See the License for the specific language governing permissions and
+         limitations under the License.

package/dist/bin.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=bin.d.ts.map

package/dist/bin.js

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+import { findProjectRoot } from '@envseal/core';
+import { EXIT } from './exit-codes.js';
+import { fail } from './output.js';
+import { finish } from './exit.js';
+import { parseArgs, commandUsage } from './cli-utils.js';
+import { status } from './commands/status.js';
+import { ensure } from './commands/ensure.js';
+import { set } from './commands/set.js';
+import { verify } from './commands/verify.js';
+import { run } from './commands/run.js';
+import { doctor } from './commands/doctor.js';
+import { revoke } from './commands/revoke.js';
+import { mcp } from './commands/mcp.js';
+import { init } from './commands/init.js';
+const VERSION = '0.1.0';
+async function main() {
+    const argv = process.argv.slice(2);
+    if (argv.length === 0 || argv[0] === '--help' || argv[0] === '-h') {
+        showHelp();
+        finish(EXIT.OK);
+        return;
+    }
+    if (argv[0] === '--version' || argv[0] === '-v') {
+        console.log(`envseal version ${VERSION}`);
+        finish(EXIT.OK);
+        return;
+    }
+    const command = argv[0];
+    const rest = argv.slice(1);
+    // Parse global flags
+    const parsed = parseArgs(rest);
+    // A help request anywhere before the `--` terminator describes the
+    // subcommand and exits 0 without executing it. Before this check,
+    // `envseal ensure -h` ran the real command (exit 4 under CI) and an
+    // interactive `set --help` reached the live browser prompt — a question
+    // about the tool answered with side effects.
+    if (parsed.flags.help === true) {
+        const usage = commandUsage(command);
+        if (usage !== null) {
+            console.log(usage);
+            finish(EXIT.OK);
+            return;
+        }
+        // An unknown command asking for help keeps its existing treatment below:
+        // the unknown-command error plus top-level help, exiting 2.
+    }
+    const json = parsed.flags.json === true;
+    const projectFlag = parsed.flags.project;
+    // Determine project root
+    let root;
+    try {
+        root = projectFlag || findProjectRoot(process.cwd());
+    }
+    catch {
+        root = process.cwd();
+    }
+    try {
+        switch (command) {
+            case 'init': {
+                const host = parsed.flags.host;
+                await init(root, json, host);
+                break;
+            }
+            case 'ensure': {
+                await ensure(root, json, parsed.flags.check === true);
+                break;
+            }
+            case 'set': {
+                const key = parsed.args[0];
+                if (!key) {
+                    console.error('Error: set requires a KEY argument');
+                    finish(EXIT.USAGE);
+                    break;
+                }
+                await set(root, key, json);
+                break;
+            }
+            case 'status': {
+                const keys = parsed.args;
+                await status(root, keys, json);
+                break;
+            }
+            case 'verify': {
+                const keys = parsed.args;
+                await verify(root, keys, json);
+                break;
+            }
+            case 'run': {
+                if (parsed.args.length === 0 || parsed.args[0] !== '--') {
+                    console.error('Error: run requires -- followed by command');
+                    finish(EXIT.USAGE);
+                    break;
+                }
+                const cmdArgs = parsed.args.slice(1);
+                if (cmdArgs.length === 0) {
+                    console.error('Error: run requires a command after --');
+                    finish(EXIT.USAGE);
+                    break;
+                }
+                await run(root, cmdArgs, json, parsed.flags.yes === true);
+                break;
+            }
+            case 'doctor': {
+                await doctor(root, json);
+                break;
+            }
+            case 'revoke': {
+                const key = parsed.args[0];
+                if (!key) {
+                    console.error('Error: revoke requires a KEY argument');
+                    finish(EXIT.USAGE);
+                    break;
+                }
+                await revoke(root, key, json);
+                break;
+            }
+            case 'mcp': {
+                await mcp(root);
+                break;
+            }
+            default: {
+                console.error(`Error: unknown command '${command}'`);
+                showHelp();
+                finish(EXIT.USAGE);
+                break;
+            }
+        }
+    }
+    catch (error) {
+        fail(json, error);
+    }
+}
+function showHelp() {
+    console.log(`envseal ${VERSION}
+
+Usage: envseal <command> [options]
+
+Commands:
+  init [--host <name>]          Initialize env.schema.jsonc
+  ensure [--check]             Prompt for all missing required keys
+                               (--check: report only, exit 0/1, never prompt)
+  set <KEY>                     Prompt for a single key
+  status [KEYS...]              Show status of keys
+  verify [KEYS...]              Run verification probes
+  run -- <cmd...>               Execute command with injected secrets
+  doctor                        Report project configuration status
+  revoke <KEY>                  Revoke a key from the sink
+  mcp                           Start the MCP server
+
+Global Options:
+  --project <path>              Project root (default: auto-detect)
+  --json                        Output as JSON
+  --help, -h                    Show this help
+  --version, -v                 Show version
+`);
+}
+main().catch((error) => {
+    fail(false, error);
+});
+//# sourceMappingURL=bin.js.map

package/dist/cli-utils.d.ts

@@ -0,0 +1,50 @@
+import { Broker } from '@envseal/core';
+import type { TicketKeyOutcome, TicketOutcome } from '@envseal/protocol';
+type BrokerOpts = ConstructorParameters<typeof Broker>[0];
+/**
+ * Create a broker for the given project root.
+ * Uses the stub prompter if ENVSEAL_TEST_MODE and ENVSEAL_TEST_PROMPTER_VALUE are both set.
+ *
+ * The broker's `dispose()` is registered with the exit path here rather than
+ * left to each command. No command called it before, so every invocation left
+ * the ticket store's sweep interval running into `process.exit()`.
+ */
+export declare function createBroker(root: string, opts?: {
+    onConfirm?: BrokerOpts['onConfirm'];
+    onApprovalNeeded?: BrokerOpts['onApprovalNeeded'];
+}): Promise<Broker>;
+/**
+ * Whether there is a human we could put a question to.
+ *
+ * `CI` is checked as well as the TTY because a CI runner can attach a pseudo
+ * terminal while there is still nobody watching it; `selectPrompter` already
+ * treats `CI` as decisive, and disagreeing with it here would mean the probe
+ * approval prompt blocks a build that `env_request` correctly refuses.
+ */
+export declare function hasInteractiveSurface(): boolean;
+/**
+ * The recorded outcome for `key`, or one derived from the ticket state when the
+ * prompt surface never produced one.
+ *
+ * A ticket that expires or is torn down leaves `keys` empty. `set` used to
+ * throw a bare `Error('No outcome returned')` there, which reported a timeout
+ * as a generic internal failure and lost the documented exit code. Returns null
+ * only for the genuinely inconsistent case: the ticket resolved, yet said
+ * nothing about this key.
+ */
+export declare function outcomeForKey(result: TicketOutcome, key: string): TicketKeyOutcome | null;
+/**
+ * Parse command-line arguments, extracting flags and positional args.
+ */
+export interface ParsedArgs {
+    flags: Record<string, string | boolean>;
+    args: string[];
+}
+export declare function parseArgs(argv: string[]): ParsedArgs;
+/**
+ * The usage block for `command`, or null when the command is not one envseal
+ * knows — an unknown command keeps its unknown-command treatment in bin.ts.
+ */
+export declare function commandUsage(command: string | undefined): string | null;
+export {};
+//# sourceMappingURL=cli-utils.d.ts.map

package/dist/cli-utils.js

@@ -0,0 +1,228 @@
+import { Broker } from '@envseal/core';
+import { createStubPrompter, createRefusingPrompter, isStubOutcome } from './test-prompter.js';
+import { registerDisposable } from './exit.js';
+/**
+ * Create a broker for the given project root.
+ * Uses the stub prompter if ENVSEAL_TEST_MODE and ENVSEAL_TEST_PROMPTER_VALUE are both set.
+ *
+ * The broker's `dispose()` is registered with the exit path here rather than
+ * left to each command. No command called it before, so every invocation left
+ * the ticket store's sweep interval running into `process.exit()`.
+ */
+export async function createBroker(root, opts) {
+    let prompter;
+    // Double-gated stub prompters for testing only
+    if (process.env.ENVSEAL_TEST_MODE === '1') {
+        if (process.env.ENVSEAL_TEST_PROMPTER_VALUE) {
+            prompter = createStubPrompter(process.env.ENVSEAL_TEST_PROMPTER_VALUE);
+        }
+        else if (isStubOutcome(process.env.ENVSEAL_TEST_PROMPTER_OUTCOME)) {
+            prompter = createRefusingPrompter(process.env.ENVSEAL_TEST_PROMPTER_OUTCOME);
+        }
+    }
+    const broker = new Broker({
+        root,
+        prompter,
+        onConfirm: opts?.onConfirm,
+        onApprovalNeeded: opts?.onApprovalNeeded,
+    });
+    registerDisposable(() => broker.dispose());
+    return broker;
+}
+/**
+ * Whether there is a human we could put a question to.
+ *
+ * `CI` is checked as well as the TTY because a CI runner can attach a pseudo
+ * terminal while there is still nobody watching it; `selectPrompter` already
+ * treats `CI` as decisive, and disagreeing with it here would mean the probe
+ * approval prompt blocks a build that `env_request` correctly refuses.
+ */
+export function hasInteractiveSurface() {
+    if (process.env.CI !== undefined)
+        return false;
+    return process.stdin.isTTY === true;
+}
+/**
+ * The recorded outcome for `key`, or one derived from the ticket state when the
+ * prompt surface never produced one.
+ *
+ * A ticket that expires or is torn down leaves `keys` empty. `set` used to
+ * throw a bare `Error('No outcome returned')` there, which reported a timeout
+ * as a generic internal failure and lost the documented exit code. Returns null
+ * only for the genuinely inconsistent case: the ticket resolved, yet said
+ * nothing about this key.
+ */
+export function outcomeForKey(result, key) {
+    const recorded = result.keys.find((k) => k.key === key);
+    if (recorded)
+        return recorded.outcome;
+    switch (result.state) {
+        case 'expired':
+            return 'timeout';
+        case 'cancelled':
+            return 'cancelled';
+        case 'pending':
+            // `await` returned while still pending: its own timeout fired first.
+            return 'timeout';
+        case 'resolved':
+            return null;
+        default: {
+            const _exhaustive = result.state;
+            return _exhaustive;
+        }
+    }
+}
+/**
+ * The only flags that consume the following token as their value — exactly the
+ * ones bin.ts reads with `as string` (`--project`, `--host`). Every other
+ * `--flag` is boolean.
+ *
+ * Without this table the parser treated ANY token after a bare flag as that
+ * flag's value, so `envseal status --json OPENAI_API_KEY` silently parsed as
+ * `status` with neither `--json` nor the key filter: flags.json became the
+ * STRING 'OPENAI_API_KEY' (so `flags.json === true` was false) and the key name
+ * never reached `args`. Plain-text status for all keys, exit 0.
+ */
+const VALUE_FLAGS = new Set(['project', 'host']);
+export function parseArgs(argv) {
+    const flags = {};
+    const args = [];
+    let i = 0;
+    while (i < argv.length) {
+        const arg = argv[i];
+        if (arg === undefined)
+            break;
+        // `--` is the end-of-flags terminator, not a flag. It must be checked
+        // before the `startsWith('--')` branch, which would otherwise parse it as a
+        // flag named '' and swallow the command that follows — breaking
+        // `envseal run -- <cmd>` entirely.
+        if (arg === '--') {
+            args.push('--');
+            for (let j = i + 1; j < argv.length; j++) {
+                const a = argv[j];
+                if (a !== undefined)
+                    args.push(a);
+            }
+            break;
+        }
+        if (arg.startsWith('--')) {
+            const eqIndex = arg.indexOf('=');
+            if (eqIndex > -1) {
+                const key = arg.slice(2, eqIndex);
+                const value = arg.slice(eqIndex + 1);
+                flags[key] = value;
+            }
+            else {
+                const key = arg.slice(2);
+                const nextArg = argv[i + 1];
+                // Only a known value-taking flag may swallow the next token. A bare
+                // boolean flag (`--json`) must leave it for the positional loop below,
+                // so `status --json KEY` and the documented `status KEY --json` parse
+                // identically.
+                if (VALUE_FLAGS.has(key) && nextArg !== undefined && !nextArg.startsWith('--')) {
+                    flags[key] = nextArg;
+                    i++;
+                }
+                else {
+                    flags[key] = true;
+                }
+            }
+        }
+        else if (arg === '-') {
+            // End of flags, rest are positional
+            for (let j = i + 1; j < argv.length; j++) {
+                const a = argv[j];
+                if (a !== undefined) {
+                    args.push(a);
+                }
+            }
+            break;
+        }
+        else if (arg === '-h') {
+            // A help request is a control token, not data. Left in args, it made
+            // `envseal ensure -h` run the real command with '-h' as a stray
+            // positional; bin.ts reads flags.help and prints usage instead.
+            flags.help = true;
+        }
+        else {
+            args.push(arg);
+        }
+        i++;
+    }
+    return { flags, args };
+}
+/**
+ * Per-subcommand usage, shown when -h/--help appears anywhere before the `--`
+ * terminator. Text mirrors docs/cli-contract.md; every block opens with the
+ * word "Usage" so a caller can assert that help was shown rather than a command
+ * having run.
+ */
+const COMMAND_USAGE = {
+    init: `Usage: envseal init [--host <name>] [--json] [--project <path>]
+
+Initialize env.schema.jsonc, declaring every environment-variable reference found by scanning the project.
+
+  --host <name>     Override host detection. Valid values: claude-code, cursor, continue, aider, windsurf, cline, zed, codex, jetbrains, goose, copilot, generic, unknown.
+  --json            Output as JSON.
+  --project <path>  Project root (default: auto-detect).`,
+    ensure: `Usage: envseal ensure [--check] [--json] [--project <path>]
+
+Prompt for every missing required key in one pass.
+
+  --check           Never prompt, even interactively: report whether every required
+                    key is present and exit 0 or 1 accordingly. Safe under CI.
+  --json            Output as JSON.
+  --project <path>  Project root (default: auto-detect).`,
+    set: `Usage: envseal set <KEY> [--json] [--project <path>]
+
+Prompt for a single key and store it in the entry's declared sink.
+
+  --json            Output as JSON.
+  --project <path>  Project root (default: auto-detect).`,
+    status: `Usage: envseal status [KEY...] [--json] [--project <path>]
+
+Show which declared keys are present. Never prints values.
+
+  --json            Output as JSON.
+  --project <path>  Project root (default: auto-detect).`,
+    verify: `Usage: envseal verify [KEY...] [--json] [--project <path>]
+
+Run verification probes and report a classified result per key.
+
+  --json            Output as JSON.
+  --project <path>  Project root (default: auto-detect).`,
+    run: `Usage: envseal run [--yes] [--json] [--project <path>] -- <cmd...>
+
+Execute a command with secrets injected into the child environment only.
+Asks for confirmation first; --yes (or ENVSEAL_ASSUME_YES=1) pre-approves it.
+
+  --yes             Skip the confirmation prompt.
+  --json            Output exit code and redacted stdout/stderr as JSON.
+  --project <path>  Project root (default: auto-detect).`,
+    doctor: `Usage: envseal doctor [--json] [--project <path>]
+
+Audit the project configuration: detected host and tier, gitignore coverage,
+file permissions, missing required keys.
+
+  --json            Output as JSON.
+  --project <path>  Project root (default: auto-detect).`,
+    revoke: `Usage: envseal revoke <KEY> [--json] [--project <path>]
+
+Remove a key from its sink and report the provider's rotation URL.
+
+  --json            Output as JSON.
+  --project <path>  Project root (default: auto-detect).`,
+    mcp: `Usage: envseal mcp
+
+Start the MCP server over stdio. The host launches this itself; do not run it directly.`,
+};
+/**
+ * The usage block for `command`, or null when the command is not one envseal
+ * knows — an unknown command keeps its unknown-command treatment in bin.ts.
+ */
+export function commandUsage(command) {
+    if (command === undefined)
+        return null;
+    return COMMAND_USAGE[command] ?? null;
+}
+//# sourceMappingURL=cli-utils.js.map

package/dist/commands/doctor.d.ts

@@ -0,0 +1,2 @@
+export declare function doctor(root: string, json: boolean): Promise<void>;
+//# sourceMappingURL=doctor.d.ts.map