@envseal/cli 0.1.0

package/dist/commands/doctor.js

@@ -0,0 +1,89 @@
+import { existsSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { readFileSync } from 'node:fs';
+import { SepError } from '@envseal/protocol';
+import { emit, fail } from '../output.js';
+import { EXIT } from '../exit-codes.js';
+import { detectHost } from '../host.js';
+import { createBroker } from '../cli-utils.js';
+import { finish } from '../exit.js';
+export async function doctor(root, json) {
+    try {
+        // An audit of a project with no configuration would report an empty,
+        // healthy-looking bill of health: gitignore/no, missing keys/0, exit 0.
+        // Every other command treats that state as SEP_NOT_DECLARED; the audit
+        // command must not be the one place it reads as success.
+        const manifestPath = join(root, 'env.schema.jsonc');
+        if (!existsSync(manifestPath)) {
+            fail(json, new SepError({
+                code: 'SEP_NOT_DECLARED',
+                userMessage: 'No env.schema.jsonc in this project (or parents). Run `envseal init` to create one.',
+            }));
+            return;
+        }
+        const broker = await createBroker(root);
+        const status = await broker.describe();
+        const gitignorePath = join(root, '.gitignore');
+        const envPath = join(root, '.env');
+        // Check gitignore
+        let gitignoreCovers = false;
+        if (existsSync(gitignorePath)) {
+            const gitignoreContent = readFileSync(gitignorePath, 'utf-8');
+            gitignoreCovers = gitignoreContent.includes('.env');
+        }
+        // Check .env permissions
+        let envFileOk = false;
+        if (existsSync(envPath)) {
+            const stats = statSync(envPath);
+            envFileOk = (stats.mode & 0o077) === 0;
+        }
+        const host = detectHost(root);
+        const output = {
+            projectRoot: root,
+            manifestPath,
+            host: {
+                id: host.id,
+                name: host.name,
+                tier: host.tier,
+                reason: host.reason,
+                recommendation: host.recommendation,
+            },
+            gitignore: {
+                exists: existsSync(gitignorePath),
+                covers: gitignoreCovers,
+            },
+            envFile: {
+                exists: existsSync(envPath),
+                isTracked: false,
+                permissionsOk: envFileOk,
+            },
+            missingRequiredCount: status.missingRequired.length,
+            missingRequired: status.missingRequired,
+        };
+        if (!json) {
+            console.log(`Project root: ${root}`);
+            console.log(`Host: ${host.name} (Tier ${host.tier})`);
+            console.log(`  ${host.reason}`);
+            console.log(`  ${host.recommendation}`);
+            console.log(`Gitignore covers .env: ${gitignoreCovers ? 'yes' : 'no'}`);
+            console.log(`Missing required keys: ${status.missingRequired.length}`);
+            if (status.missingRequired.length > 0) {
+                for (const key of status.missingRequired) {
+                    console.log(`  - ${key}`);
+                }
+            }
+        }
+        else {
+            emit(json, '', output);
+        }
+        // Exit with UNSATISFIED if required keys are missing
+        if (status.missingRequired.length > 0) {
+            finish(EXIT.UNSATISFIED);
+            return;
+        }
+    }
+    catch (error) {
+        fail(json, error);
+    }
+}
+//# sourceMappingURL=doctor.js.map

package/dist/commands/ensure.d.ts

@@ -0,0 +1,2 @@
+export declare function ensure(root: string, json: boolean, check?: boolean): Promise<void>;
+//# sourceMappingURL=ensure.d.ts.map

package/dist/commands/ensure.js

@@ -0,0 +1,126 @@
+import { emit, fail } from '../output.js';
+import { EXIT } from '../exit-codes.js';
+import { loadManifest, projectPaths } from '@envseal/core';
+import { SepError } from '@envseal/protocol';
+import { createBroker, outcomeForKey } from '../cli-utils.js';
+import { finish } from '../exit.js';
+export async function ensure(root, json, check = false) {
+    try {
+        // A project without env.schema.jsonc declares NOTHING, but describe()
+        // reports that exactly like an empty manifest: zero missing keys, so this
+        // used to print "✓ All required keys are satisfied" and exit 0 — vacuous
+        // success from the command whose job is telling the truth, while doctor on
+        // the same project reported the missing declarations.
+        //
+        // Exit USAGE (2), not UNSATISFIED (1): 1 means "required keys are still
+        // missing after the operation", and there are no keys here to satisfy.
+        // This is the same class as SEP_NOT_DECLARED, which already maps to 2.
+        // (`status` keeps exiting 0 on an init-less project because it is a
+        // read-only report with genuinely nothing to show; `ensure` claims work
+        // done, so it may not.) The message below differs from the missing-keys
+        // failure ("✗ Only N/M keys set" / satisfied:false), so scripts can tell
+        // the two apart by text as well as code.
+        const manifest = loadManifest(projectPaths(root));
+        if (manifest === null) {
+            throw new SepError({
+                code: 'SEP_NOT_DECLARED',
+                userMessage: 'No env.schema.jsonc in this project (or parents). Run `envseal init` to create one.',
+            });
+        }
+        const broker = await createBroker(root);
+        const status = await broker.describe();
+        // Use missingRequired array from ManifestStatus
+        const missingRequired = status.missingRequired;
+        // --check is the headless gate: it reports and exits, never requests.
+        // Skipping broker.request() is what makes it prompt-free — not just under
+        // CI (where a request would exit 4) but in an interactive terminal too,
+        // where a request would open a dialog the caller of a *check* never asked
+        // for. Total counts required entries only: an optional key being absent
+        // is not a failure.
+        if (check) {
+            const total = manifest.entries.filter((e) => e.required).length;
+            const missing = missingRequired.length;
+            if (!json) {
+                if (missing === 0) {
+                    console.log('✓ All required keys are satisfied');
+                }
+                else {
+                    console.log(`✗ ${missing} of ${total} required key(s) missing:`);
+                    for (const key of missingRequired) {
+                        console.log(`  ${key}`);
+                    }
+                }
+            }
+            else {
+                emit(json, '', {
+                    satisfied: missing === 0,
+                    keysSet: total - missing,
+                    total,
+                    missing: missingRequired,
+                });
+            }
+            if (missing > 0) {
+                finish(EXIT.UNSATISFIED);
+            }
+            return;
+        }
+        if (missingRequired.length === 0) {
+            if (!json) {
+                console.log('✓ All required keys are satisfied');
+            }
+            else {
+                // `total` is part of the documented shape and was omitted here, so a
+                // caller reading `total` got undefined on exactly the path it is most
+                // likely to take. Nothing was missing, so nothing was requested: 0.
+                emit(json, '', {
+                    satisfied: true,
+                    keysSet: 0,
+                    total: 0,
+                });
+            }
+            return;
+        }
+        // Request all missing keys at once
+        const ticket = await broker.request({
+            keys: missingRequired,
+            reason: 'Ensure all required keys are present',
+        });
+        // Await the results (timeoutMs defaults to 90000)
+        const results = await broker.await({
+            ticket: ticket.ticket,
+            timeoutMs: 90000,
+        });
+        const outcomes = missingRequired.map((key) => outcomeForKey(results, key));
+        const keysSet = outcomes.filter((o) => o === 'stored').length;
+        const allSet = keysSet === missingRequired.length;
+        if (!json) {
+            if (allSet) {
+                console.log(`✓ Set ${keysSet} key(s)`);
+            }
+            else {
+                console.log(`✗ Only ${keysSet}/${missingRequired.length} keys set`);
+            }
+        }
+        else {
+            emit(json, '', {
+                satisfied: allSet,
+                keysSet,
+                total: missingRequired.length,
+            });
+        }
+        if (!allSet) {
+            // Exit 1 says "still missing"; exit 3 says "a human declined or never
+            // answered". Both are retriable, but only 3 tells a caller that retrying
+            // unattended is pointless — so a stop of that kind wins over a plain
+            // shortfall. Everything else (skipped, invalid_format, verify_failed)
+            // stays 1.
+            const stopped = outcomes.some((o) => o === 'cancelled' || o === 'timeout');
+            finish(stopped ? EXIT.CANCELLED : EXIT.UNSATISFIED);
+            return;
+        }
+    }
+    catch (error) {
+        fail(json, error);
+    }
+}
+//# sourceMappingURL=ensure.js.map

package/dist/commands/init.d.ts

@@ -0,0 +1,2 @@
+export declare function init(root: string, json: boolean, hostOverride?: string): Promise<void>;
+//# sourceMappingURL=init.d.ts.map

package/dist/commands/init.js

@@ -0,0 +1,101 @@
+import { projectPaths, loadManifest, declareEntries } from '@envseal/core';
+import { emit, fail } from '../output.js';
+import { detectHost } from '../host.js';
+import { scanForEnvKeys, entryForKey } from '../scan.js';
+import { EXIT } from '../exit-codes.js';
+import { finish } from '../exit.js';
+// The ids detectHost can ever return. --host used to accept any string
+// silently, recording a host detection would never report and printing a tier
+// computed for a fiction.
+const KNOWN_HOST_IDS = [
+    'claude-code',
+    'cursor',
+    'continue',
+    'aider',
+    'windsurf',
+    'cline',
+    'zed',
+    'codex',
+    'jetbrains',
+    'goose',
+    'copilot',
+    'generic',
+    'unknown',
+];
+export async function init(root, json, hostOverride) {
+    try {
+        if (hostOverride !== undefined && !KNOWN_HOST_IDS.includes(hostOverride)) {
+            console.error(`Error: unknown --host '${hostOverride}'. Valid values: ${KNOWN_HOST_IDS.join(', ')}.`);
+            finish(EXIT.USAGE);
+            return;
+        }
+        const paths = projectPaths(root);
+        const discovered = scanForEnvKeys(root);
+        const entries = discovered.map(entryForKey);
+        // declareEntries creates the manifest when absent and edits it surgically
+        // when present, so re-running init on an existing project is safe and
+        // preserves any descriptions the user has written by hand. It runs even
+        // when the scan finds nothing: the "created an empty manifest" message
+        // below must be true, not aspirational.
+        const result = declareEntries(paths, entries);
+        const manifest = loadManifest(paths);
+        const host = hostOverride
+            ? { id: hostOverride, name: hostOverride, tier: 'C', reason: 'specified with --host', recommendation: '' }
+            : detectHost(root);
+        const output = {
+            manifestPath: paths.manifest,
+            host: host.id,
+            protectionTier: host.tier,
+            scanned: discovered.length,
+            added: result.added,
+            updated: result.updated,
+            unchanged: result.unchanged,
+            secretKeys: discovered.filter((d) => d.secret).map((d) => d.key),
+            configKeys: discovered.filter((d) => !d.secret).map((d) => d.key),
+            entries: manifest?.entries.length ?? 0,
+        };
+        if (json) {
+            emit(json, '', output);
+            return;
+        }
+        if (discovered.length === 0) {
+            console.log('No environment variables found in this project.');
+            console.log(`Created an empty manifest at ${paths.manifest}.`);
+            console.log('Add entries with `envseal set <KEY>` or let your agent call env_declare.');
+        }
+        else {
+            console.log(`✓ Manifest written to ${paths.manifest}`);
+            console.log(`  Found ${discovered.length} variable(s): ${result.added.length} added, ${result.unchanged.length} unchanged`);
+            const secrets = discovered.filter((d) => d.secret);
+            if (secrets.length > 0) {
+                console.log(`  Secrets: ${secrets.map((s) => s.key).join(', ')}`);
+            }
+            const config = discovered.filter((d) => !d.secret);
+            if (config.length > 0) {
+                console.log(`  Config (not prompted): ${config.map((s) => s.key).join(', ')}`);
+            }
+        }
+        console.log(`  Host: ${host.name} (protection tier ${host.tier})`);
+        if (host.recommendation)
+            console.log(`  ${host.recommendation}`);
+        if (hostOverride) {
+            // The override line above is what was ASKED for, not what is here. An
+            // auto-detected init on the same project can print a different tier, and
+            // doctor is the one that reports evidence.
+            console.log('  Override recorded; envseal doctor reports what is actually detected.');
+        }
+        if (host.id === 'claude-code') {
+            // Without this the first run ends at a manifest and no connection: init
+            // writes env.schema.jsonc but nothing tells the user the agent still has
+            // to be pointed at the broker.
+            console.log('');
+            console.log('Connect your agent: create .mcp.json in the project root containing');
+            console.log('  {"mcpServers":{"envseal-mcp":{"command":"envseal-mcp","args":[]}}}');
+            console.log('then restart Claude Code — or install plugins/claude-code for Tier A hooks.');
+        }
+    }
+    catch (error) {
+        fail(json, error);
+    }
+}
+//# sourceMappingURL=init.js.map

package/dist/commands/mcp.d.ts

@@ -0,0 +1,2 @@
+export declare function mcp(root: string): Promise<void>;
+//# sourceMappingURL=mcp.d.ts.map

package/dist/commands/mcp.js

@@ -0,0 +1,21 @@
+import { spawnSync } from 'node:child_process';
+import { EXIT } from '../exit-codes.js';
+import { finish } from '../exit.js';
+export async function mcp(root) {
+    // Delegate to the mcp-server binary
+    const result = spawnSync('envseal-mcp', ['--project', root], {
+        stdio: 'inherit',
+    });
+    // A spawn failure leaves `status` null AND populates `error`. The old
+    // `result.status ?? 0` turned "the server binary does not exist / cannot be
+    // executed" into exit 0 — a host wiring this command saw silent success while
+    // nothing was serving. Report it honestly instead.
+    if (result.error || result.status === null) {
+        const reason = result.error?.message ?? 'the envseal-mcp binary could not be executed';
+        console.error(`Error: failed to start the envseal MCP server (is @envseal/mcp-server installed?): ${reason}`);
+        finish(EXIT.SINK_FAILURE);
+        return;
+    }
+    finish(result.status);
+}
+//# sourceMappingURL=mcp.js.map

package/dist/commands/revoke.d.ts

@@ -0,0 +1,2 @@
+export declare function revoke(root: string, key: string, json: boolean): Promise<void>;
+//# sourceMappingURL=revoke.d.ts.map

package/dist/commands/revoke.js

@@ -0,0 +1,48 @@
+import { emit, fail } from '../output.js';
+import { EXIT } from '../exit-codes.js';
+import { createBroker } from '../cli-utils.js';
+import { finish } from '../exit.js';
+export async function revoke(root, key, json) {
+    try {
+        const broker = await createBroker(root);
+        const results = await broker.revoke({
+            keys: [key],
+        });
+        // `broker.revoke` skips keys that are not in the manifest, so an unknown
+        // key comes back as an empty array rather than `removed: false`.
+        const result = results[0];
+        const removed = result?.removed ?? false;
+        const rotateUrl = result?.rotateUrl ?? null;
+        if (!json) {
+            if (removed) {
+                console.log(`✓ ${key} revoked`);
+                if (rotateUrl) {
+                    console.log(`  Rotate the credential at: ${rotateUrl}`);
+                }
+            }
+            else if (result === undefined) {
+                console.log(`✗ ${key} is not declared in this project's manifest`);
+            }
+            else {
+                console.log(`✗ Failed to revoke ${key}: nothing was removed from the sink`);
+            }
+        }
+        else {
+            emit(json, '', {
+                key,
+                removed,
+                rotateUrl,
+            });
+        }
+        // Exit 0 meant "revoked" even when nothing was removed, so a caller could
+        // not distinguish a burned key from a no-op.
+        if (!removed) {
+            finish(EXIT.UNSATISFIED);
+            return;
+        }
+    }
+    catch (error) {
+        fail(json, error);
+    }
+}
+//# sourceMappingURL=revoke.js.map

package/dist/commands/run.d.ts

@@ -0,0 +1,2 @@
+export declare function run(root: string, command: string[], json: boolean, assumeYes?: boolean): Promise<void>;
+//# sourceMappingURL=run.d.ts.map

package/dist/commands/run.js

@@ -0,0 +1,82 @@
+import { createInterface } from 'node:readline';
+import { SepError } from '@envseal/protocol';
+import { emit, fail } from '../output.js';
+import { createBroker } from '../cli-utils.js';
+import { finish } from '../exit.js';
+/**
+ * Ask the user to approve running a command with secrets injected.
+ *
+ * Without this the broker's confirmation callback is absent and `use` always
+ * throws SEP_CONFIRMATION_DENIED, making the command impossible to use. The
+ * prompt reads from the controlling terminal, so it still works when stdout is
+ * being piped.
+ *
+ * Fails closed: no TTY and no --yes means no approval. That is the right
+ * default, because the alternative is a CI job silently handing credentials to
+ * whatever it was told to run.
+ */
+async function confirmInteractive(info) {
+    if (process.env.ENVSEAL_ASSUME_YES === '1')
+        return true;
+    if (!process.stdin.isTTY) {
+        // Distinct from a refusal. Reporting "the user denied the confirmation" when
+        // no human was ever asked is actively misleading, and it is the shell-only
+        // agents of Tier 4 that hit this path — the ones this binding exists for.
+        throw new SepError({
+            code: 'SEP_NO_INTERACTIVE_SURFACE',
+            userMessage: 'envseal run needs confirmation before injecting secrets, but there is no terminal to ask on. ' +
+                'Re-run in an interactive shell, or pass --yes (or set ENVSEAL_ASSUME_YES=1) to approve non-interactively.',
+        });
+    }
+    const lines = [
+        '',
+        'envseal is about to run a command with secrets in its environment:',
+        `  command: ${info.command.join(' ')}`,
+        `  keys:    ${info.keys.join(', ')}`,
+    ];
+    if (info.networkEgress) {
+        lines.push('  WARNING: this command can make network requests, so it could send', '           these values somewhere. Only continue if you trust it.');
+    }
+    lines.push('');
+    process.stderr.write(lines.join('\n'));
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        const answer = await new Promise((resolve) => {
+            rl.question('Continue? [y/N] ', resolve);
+        });
+        return /^y(es)?$/i.test(answer.trim());
+    }
+    finally {
+        rl.close();
+    }
+}
+export async function run(root, command, json, assumeYes = false) {
+    try {
+        const broker = await createBroker(root, {
+            onConfirm: assumeYes ? async () => true : confirmInteractive,
+        });
+        const status = await broker.describe();
+        const presentKeys = status.entries.filter((e) => e.present).map((e) => e.key);
+        const result = await broker.use({ keys: presentKeys, command });
+        if (!json) {
+            if (result.stdout)
+                process.stdout.write(result.stdout);
+            if (result.stderr)
+                process.stderr.write(result.stderr);
+        }
+        else {
+            emit(json, '', {
+                exitCode: result.exitCode,
+                stdout: result.stdout,
+                stderr: result.stderr,
+                redactedCount: result.redactedCount,
+            });
+        }
+        finish(result.exitCode ?? 0);
+        return;
+    }
+    catch (error) {
+        fail(json, error);
+    }
+}
+//# sourceMappingURL=run.js.map

package/dist/commands/set.d.ts

@@ -0,0 +1,2 @@
+export declare function set(root: string, key: string, json: boolean): Promise<void>;
+//# sourceMappingURL=set.d.ts.map

package/dist/commands/set.js

@@ -0,0 +1,122 @@
+import { emit, fail } from '../output.js';
+import { EXIT, exitCodeForOutcome } from '../exit-codes.js';
+import { createBroker, outcomeForKey } from '../cli-utils.js';
+import { finish } from '../exit.js';
+import { loadManifest, projectPaths, saveManifest } from '@envseal/core';
+/**
+ * Undo a declaration THIS invocation added, after nothing was stored under it.
+ *
+ * `set` declares before it requests (the declare-time schema guard has to run
+ * first), so every attempt that did not end `stored` — a CI run with no prompt
+ * surface, a cancelled or timed-out prompt, a typo the user abandons — used to
+ * leave the key behind as required+secret in env.schema.jsonc. Nothing
+ * mentioned the mutation: status then shows a phantom key forever, revoke
+ * touches only sinks, and init does not prune. An entry that already existed
+ * before this run is left alone — it was not ours to remove.
+ *
+ * stderr only: stdout is the machine-readable channel in --json mode.
+ */
+function rollbackDeclaredEntry(root, key) {
+    const paths = projectPaths(root);
+    const manifest = loadManifest(paths);
+    if (manifest === null)
+        return;
+    const remaining = manifest.entries.filter((e) => e.key !== key);
+    if (remaining.length === manifest.entries.length)
+        return;
+    manifest.entries = remaining;
+    // saveManifest edits only the changed field through jsonc, so the header
+    // comments survive.
+    saveManifest(paths, manifest);
+    console.error(`declared ${key} but nothing was stored; declaration removed`);
+}
+export async function set(root, key, json) {
+    // Whether the declare below added the entry, as opposed to finding it already
+    // there. Lives outside the try so the catch can roll it back when `request`
+    // throws (no interactive surface in CI is the common case).
+    let declaredHere = false;
+    try {
+        const broker = await createBroker(root);
+        // Declare the key only if it is not already in the manifest.
+        //
+        // `declareEntries` replaces an entry wholesale rather than merging, so
+        // declaring unconditionally meant `envseal set OPENAI_API_KEY` on an
+        // initialised project overwrote the existing entry with this bare stub —
+        // silently dropping its format pattern, its provider links and its verify
+        // probe. Caught by the invalid_format case in contract-e2e.test.ts, which
+        // stored a value the declared pattern rejects.
+        const status = await broker.describe();
+        if (!status.entries.some((e) => e.key === key)) {
+            try {
+                const entry = {
+                    key,
+                    description: `Configuration for ${key}`,
+                    required: true,
+                    secret: true,
+                    sink: 'dotenv',
+                };
+                const declareResult = await broker.declare({
+                    entries: [entry],
+                });
+                declaredHere = declareResult.added.includes(key);
+            }
+            catch {
+                // A key name the manifest schema rejects. Fall through: `request` then
+                // raises SEP_NOT_DECLARED, which maps to exit 2 (usage) — the right
+                // answer for a bad argument. Nothing was written, so no rollback.
+            }
+        }
+        // Request the key
+        const ticket = await broker.request({
+            keys: [key],
+            reason: `Set ${key}`,
+        });
+        // Await the result (timeoutMs defaults to 90000)
+        const result = await broker.await({
+            ticket: ticket.ticket,
+            timeoutMs: 90000,
+        });
+        const outcome = outcomeForKey(result, key);
+        if (outcome === null) {
+            // The ticket resolved without saying anything about the key we asked
+            // for. That is an internal inconsistency, not a user decision, so report
+            // it as such rather than as a silent success. Nothing was stored, so the
+            // declaration we added has nothing to show for itself either.
+            if (declaredHere)
+                rollbackDeclaredEntry(root, key);
+            fail(json, `The prompt for ${key} finished without reporting an outcome.`);
+            return;
+        }
+        if (!json) {
+            if (outcome === 'stored') {
+                console.log(`✓ ${key} set successfully`);
+            }
+            else {
+                console.log(`✗ Failed to set ${key}: ${outcome}`);
+            }
+        }
+        else {
+            emit(json, '', {
+                key,
+                outcome,
+            });
+        }
+        if (outcome !== 'stored' && declaredHere) {
+            rollbackDeclaredEntry(root, key);
+        }
+        const code = exitCodeForOutcome(outcome);
+        if (code !== EXIT.OK) {
+            finish(code);
+            return;
+        }
+    }
+    catch (error) {
+        // `request` throws before any prompt happens (SEP_NO_INTERACTIVE_SURFACE
+        // under CI=1 is the common route here), so a declaration we just added
+        // would otherwise outlive a run that never even asked for the value.
+        if (declaredHere)
+            rollbackDeclaredEntry(root, key);
+        fail(json, error);
+    }
+}
+//# sourceMappingURL=set.js.map

package/dist/commands/status.d.ts

@@ -0,0 +1,2 @@
+export declare function status(root: string, keys: string[], json: boolean): Promise<void>;
+//# sourceMappingURL=status.d.ts.map

package/dist/commands/status.js

@@ -0,0 +1,49 @@
+import { emit, fail } from '../output.js';
+import { EXIT } from '../exit-codes.js';
+import { createBroker } from '../cli-utils.js';
+import { finish } from '../exit.js';
+export async function status(root, keys, json) {
+    try {
+        const broker = await createBroker(root);
+        const status = await broker.describe();
+        let entriesToShow = status.entries;
+        if (keys.length > 0) {
+            entriesToShow = entriesToShow.filter((e) => keys.includes(e.key));
+        }
+        const hasRequired = status.missingRequired.length > 0;
+        if (!json && keys.length === 0) {
+            if (entriesToShow.length === 0) {
+                console.log('No environment variables declared.');
+            }
+            else {
+                for (const entry of entriesToShow) {
+                    const status_str = entry.present ? '✓' : '✗';
+                    console.log(`${status_str} ${entry.key}`);
+                }
+            }
+        }
+        else {
+            emit(json, '', {
+                entries: entriesToShow.map((e) => ({
+                    key: e.key,
+                    present: e.present,
+                    sink: e.sink,
+                    formatValid: e.formatValid,
+                    lengthBucket: e.lengthBucket,
+                    fingerprint: e.fingerprint,
+                    lastVerified: e.lastVerified,
+                    verifyResult: e.verifyResult,
+                })),
+            });
+        }
+        // Exit with UNSATISFIED if required keys are missing
+        if (hasRequired) {
+            finish(EXIT.UNSATISFIED);
+            return;
+        }
+    }
+    catch (error) {
+        fail(json, error);
+    }
+}
+//# sourceMappingURL=status.js.map

package/dist/commands/verify.d.ts

@@ -0,0 +1,2 @@
+export declare function verify(root: string, keys: string[], json: boolean): Promise<void>;
+//# sourceMappingURL=verify.d.ts.map