@secretstore/cli 0.0.0-stage → 0.7.0

package/dist/secretstore.js

@@ -0,0 +1,2015 @@
+#!/usr/bin/env node
+// secretstore 0.7.0: readable bundle of apps/cli for Node.js 20+. Source: https://github.com/CodingDiego/secret-store (apps/cli/src). AGPL-3.0-only.
+// apps/cli/src/runtime.ts
+import { spawn as nodeSpawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { open } from "node:fs/promises";
+import { createServer } from "node:http";
+import { text as streamText } from "node:stream/consumers";
+import { setTimeout as delay } from "node:timers/promises";
+var isBun = typeof Bun !== "undefined";
+var secrets = isBun ? Bun.secrets : undefined;
+var sleep = (ms) => isBun ? Bun.sleep(ms) : delay(ms);
+var readAllStdin = () => isBun ? Bun.stdin.text() : streamText(process.stdin);
+function spawn(argv, { env, cwd, stdio }) {
+  if (isBun)
+    return Bun.spawn(argv, { env, cwd, stdio: [stdio, stdio, stdio] });
+  const [file = "", ...args] = argv;
+  const child = nodeSpawn(file, args, { env, cwd, stdio });
+  const exited = new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("close", (code, signal) => resolve(code ?? (signal ? 1 : 0)));
+  });
+  return {
+    exited,
+    kill: (signal) => void child.kill(signal),
+    get exitCode() {
+      return child.exitCode;
+    },
+    get signalCode() {
+      return child.signalCode;
+    }
+  };
+}
+async function capture(argv, timeoutMs) {
+  if (isBun) {
+    const child = Bun.spawn(argv, { stdin: "ignore", stdout: "pipe", stderr: "ignore", timeout: timeoutMs });
+    const [out, code] = await Promise.all([new Response(child.stdout).text(), child.exited]);
+    return { text: out, code };
+  }
+  const [file = "", ...args] = argv;
+  const child = nodeSpawn(file, args, { stdio: ["ignore", "pipe", "ignore"], timeout: timeoutMs });
+  const closed = new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("close", (code) => resolve(code ?? 1));
+  });
+  const [out, code] = await Promise.all([streamText(child.stdout), closed]);
+  return { text: out, code };
+}
+async function serveLoopback(handler) {
+  if (isBun) {
+    const server = Bun.serve({ hostname: "127.0.0.1", port: 0, fetch: handler });
+    return { port: server.port ?? 0, stop: (force) => void server.stop(force) };
+  }
+  const server = createServer((req, res) => {
+    let response;
+    try {
+      response = handler(new Request(`http://127.0.0.1${req.url ?? "/"}`, { method: req.method }));
+    } catch {
+      response = new Response("Internal Server Error", { status: 500 });
+    }
+    res.writeHead(response.status, { ...Object.fromEntries(response.headers), connection: "close" });
+    response.text().then((body) => res.end(body));
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  const address = server.address();
+  return {
+    port: typeof address === "object" && address ? address.port : 0,
+    stop(force) {
+      server.close();
+      if (force)
+        server.closeAllConnections();
+      else
+        server.closeIdleConnections();
+    }
+  };
+}
+function sha256() {
+  if (isBun) {
+    const hasher = new Bun.CryptoHasher("sha256");
+    return { update: (chunk) => void hasher.update(chunk), digest: () => new Uint8Array(hasher.digest()) };
+  }
+  const hash = createHash("sha256");
+  return { update: (chunk) => void hash.update(chunk), digest: () => new Uint8Array(hash.digest()) };
+}
+async function fileWriter(path) {
+  if (isBun) {
+    const sink = Bun.file(path).writer();
+    return { write: async (chunk) => sink.write(chunk), end: async () => sink.end() };
+  }
+  const handle = await open(path, "w");
+  return { write: (chunk) => handle.write(chunk), end: () => handle.close() };
+}
+
+// apps/cli/src/browser.ts
+async function openInBrowser(url) {
+  if (!/^https?:\/\//.test(url))
+    throw new Error("not an http(s) URL");
+  const argv = process.platform === "win32" ? ["rundll32", "url.dll,FileProtocolHandler", url] : [process.platform === "darwin" ? "open" : "xdg-open", url];
+  const code = await spawn(argv, { stdio: "ignore" }).exited;
+  if (code !== 0)
+    throw new Error(`${argv[0]} exited with ${code}`);
+}
+
+// apps/cli/src/config.ts
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+// apps/cli/src/errors.ts
+var EXIT = { error: 1, usage: 2, auth: 3, notFound: 4, denied: 4, approval: 5, cannotRun: 127 };
+
+class CliError extends Error {
+  code;
+  constructor(message, code = EXIT.error) {
+    super(message);
+    this.code = code;
+  }
+}
+function classify(message) {
+  if (/not found|There is no secret/i.test(message))
+    return EXIT.notFound;
+  if (/request_access|is protected|sealed in the browser/i.test(message))
+    return EXIT.approval;
+  if (/does not have the|not allowed to access|cannot (read|modify)|can only read/i.test(message))
+    return EXIT.auth;
+  return EXIT.error;
+}
+
+// apps/cli/src/is-record.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// apps/cli/src/mcp.ts
+var TOOLS = {
+  whoami: "whoami",
+  listProjects: "list_projects",
+  getSecret: "get_secret",
+  setSecret: "set_secret",
+  deleteSecret: "delete_secret",
+  getEnvironment: "get_environment",
+  listEnvironments: "list_environments",
+  importEnv: "import_env",
+  requestAccess: "request_access",
+  checkAccessRequest: "check_access_request"
+};
+var TIMEOUT_MS = 30000;
+var notRpc = () => new CliError("The server answered with something that is not a JSON-RPC response");
+function parseRpc(contentType, body) {
+  try {
+    if (!contentType.includes("text/event-stream"))
+      return JSON.parse(body);
+    for (const event of body.split(/\r?\n\r?\n/)) {
+      const data = event.split(/\r?\n/).filter((line) => line.startsWith("data:")).map((line) => line.slice(5).replace(/^ /, "")).join(`
+`);
+      if (!data)
+        continue;
+      const message = JSON.parse(data);
+      if (message.result || message.error)
+        return message;
+    }
+  } catch {
+    throw notRpc();
+  }
+  throw notRpc();
+}
+function httpMessage(status, body) {
+  try {
+    const parsed = JSON.parse(body);
+    const error = isRecord(parsed) ? parsed.error : undefined;
+    const message = isRecord(error) && typeof error.message === "string" ? error.message : undefined;
+    const detail = isRecord(parsed) && parsed.error_description ? parsed.error_description : typeof error === "string" ? error : message;
+    if (typeof detail === "string" && detail)
+      return `${detail} (HTTP ${status})`;
+  } catch {}
+  return `The server answered HTTP ${status}`;
+}
+var DEAD_TOKEN = /invalid_token|expired/i;
+async function post(session, body) {
+  try {
+    const response = await fetch(session.endpoint, {
+      method: "POST",
+      headers: { ...await session.headers(), "content-type": "application/json", accept: "application/json, text/event-stream" },
+      body,
+      signal: AbortSignal.timeout(TIMEOUT_MS)
+    });
+    return { response, text: await response.text() };
+  } catch (error) {
+    if (error instanceof CliError)
+      throw error;
+    throw new CliError(`Cannot reach ${new URL(session.endpoint).origin}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function createClient(open) {
+  let opened;
+  const session = () => opened ??= open();
+  let id = 0;
+  async function invoke(tool, args) {
+    const current = await session();
+    const request = JSON.stringify({ jsonrpc: "2.0", id: ++id, method: "tools/call", params: { name: tool, arguments: args } });
+    let { response, text: body } = await post(current, request);
+    if (response.status === 401 && current.renew && DEAD_TOKEN.test(`${response.headers.get("www-authenticate")} ${body}`)) {
+      await current.renew();
+      ({ response, text: body } = await post(current, request));
+    }
+    if (!response.ok)
+      throw new CliError(httpMessage(response.status, body), response.status === 401 || response.status === 403 ? EXIT.auth : EXIT.error);
+    const rpc = parseRpc(response.headers.get("content-type") ?? "", body);
+    if (rpc.error)
+      throw new CliError(rpc.error.message ?? "The server rejected the request");
+    const texts = (rpc.result?.content ?? []).filter((block) => block.type === "text").map((block) => block.text ?? "");
+    if (rpc.result?.isError) {
+      const message = texts.join(`
+`) || "The server reported an error";
+      throw new CliError(message, classify(message));
+    }
+    return { texts, structured: rpc.result?.structuredContent };
+  }
+  return {
+    via: async () => (await session()).via,
+    call: async (tool, args) => (await invoke(tool, args)).texts,
+    async callStructured(tool, args) {
+      const { structured } = await invoke(tool, args);
+      if (!structured)
+        throw new CliError("The server sent a result this version of the CLI cannot read");
+      return structured;
+    }
+  };
+}
+function firstJson(texts) {
+  try {
+    return JSON.parse(texts[0] ?? "");
+  } catch {
+    throw new CliError("The server sent a result this version of the CLI cannot read");
+  }
+}
+async function allProjects(client) {
+  const rows = [];
+  const seen = new Set;
+  let cursor;
+  do {
+    const page = await client.callStructured(TOOLS.listProjects, cursor ? { cursor } : {});
+    if (!Array.isArray(page.projects))
+      throw new CliError("The server sent an invalid project page");
+    if (cursor === undefined && !Object.hasOwn(page, "nextCursor"))
+      return [...rows, ...page.projects];
+    const next = page.nextCursor;
+    if (next !== null && (typeof next !== "string" || !/^[A-Za-z0-9_-]{1,2048}$/.test(next)))
+      throw new CliError("The server sent an invalid project cursor");
+    if (typeof next === "string" && seen.has(next))
+      throw new CliError("The server repeated a project cursor");
+    rows.push(...page.projects);
+    if (next === null)
+      return rows;
+    seen.add(next);
+    cursor = next;
+  } while (cursor);
+  return rows;
+}
+
+// apps/cli/src/config.ts
+var DEFAULT_URL = "https://secretstore.sh";
+var PIN_FILE = ".secret-store.json";
+var LOOPBACK = new Set(["localhost", "127.0.0.1", "[::1]"]);
+function resolveUrl(flag, env) {
+  return secureOrigin(flag || env.SECRET_STORE_URL || DEFAULT_URL);
+}
+function secureOrigin(raw) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new CliError(`"${raw}" is not a URL`, EXIT.usage);
+  }
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && LOOPBACK.has(url.hostname))) {
+    throw new CliError("The server URL must be https (http is only accepted for localhost)", EXIT.usage);
+  }
+  return url.origin;
+}
+var mcpEndpoint = (origin) => `${origin}/api/mcp`;
+function resolveToken(flag, env) {
+  if (flag)
+    return { token: flag, via: "--token" };
+  return env.SECRET_STORE_TOKEN ? { token: env.SECRET_STORE_TOKEN, via: "SECRET_STORE_TOKEN" } : undefined;
+}
+function colorEnabled(env, tty) {
+  return tty && !env.NO_COLOR;
+}
+function readPin(cwd) {
+  for (let dir = cwd;; dir = dirname(dir)) {
+    const file = join(dir, PIN_FILE);
+    let text;
+    try {
+      text = readFileSync(file, "utf8");
+    } catch {}
+    if (text !== undefined) {
+      try {
+        const pin = JSON.parse(text);
+        if (!isRecord(pin))
+          throw new TypeError("not a JSON object");
+        return { project: typeof pin.project === "string" ? pin.project : undefined, environment: typeof pin.environment === "string" ? pin.environment : undefined, file };
+      } catch {
+        throw new CliError(`${file} is not valid JSON`);
+      }
+    }
+    if (existsSync(join(dir, ".git")) || dirname(dir) === dir)
+      return {};
+  }
+}
+function resolveTarget(args, cwd, shape) {
+  const lead = shape.environment ? 2 : 1;
+  if (args.length >= lead + shape.need)
+    return { project: args[0] ?? "", environment: shape.environment ? args[1] ?? "" : "", rest: args.slice(lead) };
+  const pin = readPin(cwd);
+  if (!pin.project || shape.environment && !pin.environment) {
+    throw new CliError(`Name the project${shape.environment ? " and environment" : ""}, or add ${PIN_FILE} with {"project"${shape.environment ? ', "environment"' : ""}} to the repo.`, EXIT.usage);
+  }
+  return { project: pin.project, environment: pin.environment ?? "", rest: args, source: pin.file };
+}
+function confirmPinned({ io }, source, name, verb) {
+  if (!io.confirm)
+    throw new CliError(`${source} chose ${name}; there is no terminal to ask, so name the target on the command line or pass --yes`, EXIT.usage);
+  if (!io.confirm(`${verb} ${name}, chosen by ${source}?`))
+    throw new CliError("Cancelled; nothing was done");
+}
+function targetFor({ io, flags }, args, shape) {
+  const target = resolveTarget(args, io.cwd, shape);
+  if (!target.source)
+    return target;
+  const name = shape.environment ? `${target.project}/${target.environment}` : target.project;
+  if (!flags.json)
+    io.stderr(`using ${name} from ${target.source}
+`);
+  if (!flags.yes && shape.write)
+    confirmPinned({ io }, target.source, name, "Change");
+  return target;
+}
+async function readTarget(ctx, args, need) {
+  const target = targetFor(ctx, args, { environment: true, need });
+  if (!target.source || ctx.flags.yes)
+    return target;
+  let production = true;
+  try {
+    const { environments } = firstJson(await ctx.client.call(TOOLS.listEnvironments, { project: target.project }));
+    production = environments.some((e) => e.kind === "production" && (e.slug === target.environment || e.id === target.environment));
+  } catch {}
+  if (production)
+    confirmPinned(ctx, target.source, `${target.project}/${target.environment}`, "Read");
+  return target;
+}
+// apps/cli/package.json
+var package_default = {
+  name: "cli",
+  version: "0.7.0",
+  private: true,
+  license: "AGPL-3.0-only",
+  type: "module",
+  description: "secretstore: command-line client for Secret Store (MCP over an OAuth login or a personal token).",
+  scripts: {
+    typecheck: "tsc --noEmit",
+    lint: "oxlint -c ../../.oxlintrc.json --tsconfig ./tsconfig.json --type-aware .",
+    test: "bun test",
+    compile: "bun build --compile --no-compile-autoload-dotenv --no-compile-autoload-bunfig --outfile dist/secretstore src/index.ts"
+  },
+  devDependencies: {
+    "@secret-store/auth": "*",
+    "@secret-store/typescript-config": "*",
+    "@types/bun": "^1.4.3",
+    oxlint: "^1.88.0",
+    "oxlint-tsgolint": "^7.0.2004",
+    typescript: "^7.0.2"
+  }
+};
+
+// apps/cli/src/args.ts
+var VALUE_FLAGS = ["url", "token", "out", "format", "kind", "scopes", "keys", "reason", "duration", "status"];
+var SWITCHES = {
+  json: "json",
+  help: "help",
+  write: "write",
+  "no-browser": "noBrowser",
+  overwrite: "overwrite",
+  wait: "wait",
+  force: "force",
+  "allow-non-tty": "allowNonTty",
+  "request-access": "requestAccess",
+  check: "check",
+  yes: "yes",
+  "allow-env-override": "allowEnvOverride"
+};
+var isSwitch = (name) => Object.hasOwn(SWITCHES, name);
+var isValueFlag = (name) => VALUE_FLAGS.includes(name);
+function parseArgs(argv) {
+  const flags = { json: false, help: false };
+  const positionals = [];
+  let rest;
+  for (let i = 0;i < argv.length; i++) {
+    const arg = argv[i] ?? "";
+    if (arg === "--") {
+      rest = argv.slice(i + 1);
+      break;
+    }
+    if (arg === "-h") {
+      flags.help = true;
+    } else if (!arg.startsWith("-") || arg === "-") {
+      positionals.push(arg);
+    } else if (arg.startsWith("--")) {
+      const [name = "", inline] = arg.slice(2).split(/=(.*)/s);
+      if (isSwitch(name)) {
+        if (inline !== undefined)
+          throw new CliError(`--${name} does not take a value`, EXIT.usage);
+        flags[SWITCHES[name]] = true;
+      } else if (isValueFlag(name)) {
+        const value = inline ?? argv[++i];
+        if (value === undefined)
+          throw new CliError(`--${name} needs a value`, EXIT.usage);
+        flags[name] = value;
+      } else {
+        throw new CliError(`Unknown option --${name}`, EXIT.usage);
+      }
+    } else {
+      throw new CliError(`Unknown option ${arg}`, EXIT.usage);
+    }
+  }
+  const [command, ...args] = positionals;
+  return { command, args, rest, flags };
+}
+
+// apps/cli/src/help.ts
+var USAGE = {
+  login: "secretstore login [--url <origin>] [--write] [--no-browser]",
+  logout: "secretstore logout",
+  whoami: "secretstore whoami",
+  projects: "secretstore projects",
+  envs: "secretstore envs [project]",
+  init: "secretstore init [project environment] [--force]",
+  get: "secretstore get [project env] <KEY> [--allow-non-tty] [--request-access]",
+  set: "secretstore set [project env] <KEY> [value|-]",
+  delete: "secretstore delete [project env] <KEY>",
+  push: "secretstore push [project env] [file|-] [--overwrite] [--kind secret|plain]",
+  pull: "secretstore pull [project env] [--out .env] [--request-access]",
+  export: "secretstore export [project env] [--format dotenv|json|shell] [--allow-non-tty] [--request-access]",
+  run: "secretstore run [project env] [--request-access] [--allow-env-override] -- <command...>",
+  "request-access": "secretstore request-access [project] [environment] [--scopes <a,b>] [--keys A,B] [--reason <text>] [--duration once|15m|1h|8h] [--wait] | --status <id> [--wait]",
+  doctor: "secretstore doctor",
+  completion: "secretstore completion bash|zsh|fish|powershell",
+  update: "secretstore update [--check] [--yes]",
+  version: "secretstore version",
+  help: "secretstore help"
+};
+var GLOBAL_FLAGS = ["--json", "--url", "--token", "--help"];
+function usage(command) {
+  return new CliError(`usage: ${USAGE[command] ?? "secretstore help"}`, EXIT.usage);
+}
+var HELP = `secretstore: command-line client for Secret Store
+
+Usage: secretstore [options] <command> [arguments]
+
+Commands:
+${Object.values(USAGE).map((line) => `  ${line.replace("secretstore ", "")}`).join(`
+`)}
+
+Options:
+  --json         machine-readable output
+  --url <url>    server (default: $SECRET_STORE_URL, then https://secretstore.sh)
+  --token <tok>  personal token (discouraged: shows in process lists; prefer $SECRET_STORE_TOKEN)
+  --write        login: also ask for secrets:write (set and delete)
+  --no-browser   login: print the URL instead of opening it
+  --check        update: only report whether a newer version is published
+  --yes          update: install without asking; set, delete, push and reads of an environment whose kind is production: accept the target a .secret-store.json chose
+  -h, --help     this text, or the usage line when a command is given
+
+Command options:
+  --allow-non-tty         get, export: print values although stdout is a pipe or a file (an agent or a log can read it)
+  --request-access        get, pull, export, run: when the token lacks the environment or key, ask for it, wait, retry once
+  --allow-env-override    run: also pass secrets named PATH, NODE_OPTIONS, LD_*, GIT_* and similar to the command (refused by default)
+  --overwrite             push: replace values that already exist
+  --kind secret|plain     push: how new entries are stored (default secret)
+  --scopes <a,b>          request-access: scopes to ask for (default secrets:read)
+  --keys A,B              request-access: only these keys (default every key)
+  --reason <text>         request-access and --request-access: what the person approving reads
+  --duration <d>          request-access and --request-access: once (default), 15m, 1h or 8h
+  --wait                  request-access: wait for the answer
+  --status <id>           request-access: the state of a request made earlier
+  --force                 init: replace an existing .secret-store.json
+  --out <file>            pull: where to write the dotenv file (default .env)
+  --format <f>            export: dotenv, json or shell (default dotenv, or json with --json)
+
+Credentials: --token, then $SECRET_STORE_TOKEN, then the login that "secretstore login" stored for the server.
+
+[project env] may be left out when a .secret-store.json with {"project", "environment"} is in the
+current directory or above. A value on the command line ends up in your shell history: use "-" to
+read it from stdin.
+
+Exit codes: 0 ok, 1 error, 2 usage, 3 auth, 4 not found (or sign-in denied), 5 needs approval (protected or sealed item), 127 run could not start the command
+`;
+
+// apps/cli/src/commands/access.ts
+var POLL_MS = 2000;
+var DURATIONS = ["once", "15m", "1h", "8h"];
+var DEFAULT_REASON = "Requested from the secretstore CLI";
+var list = (value) => value.split(/[\s,]+/).filter(Boolean);
+async function ask(ctx, target) {
+  const { duration, reason } = ctx.flags;
+  if (duration !== undefined && !DURATIONS.includes(duration))
+    throw new CliError(`--duration is ${DURATIONS.join(", ")}, not "${duration}"`, EXIT.usage);
+  return ctx.client.callStructured(TOOLS.requestAccess, {
+    project: target.project,
+    ...target.environment ? { environment: target.environment } : {},
+    scopes: target.scopes,
+    ...target.keys?.length ? { keys: target.keys } : {},
+    reason: reason ?? DEFAULT_REASON,
+    ...duration ? { duration } : {}
+  });
+}
+var check = (ctx, request) => ctx.client.callStructured(TOOLS.checkAccessRequest, { request });
+async function poll(ctx, request) {
+  for (;; ) {
+    const state = await check(ctx, request);
+    if (state.status !== "pending" || !(ctx.io.now() < Date.parse(state.answerBy ?? "")))
+      return state;
+    await ctx.io.sleep(POLL_MS);
+  }
+}
+function verdict(state) {
+  if (state.status === "active")
+    return;
+  if (state.status === "pending")
+    return new CliError(`Access request ${state.request} is still pending. Approve it at ${state.approveUrl} before ${state.answerBy}.`, EXIT.approval);
+  return new CliError(`Access request ${state.request} is ${state.status}.${state.note ? ` ${state.note}` : ""}`, state.status === "denied" ? EXIT.denied : EXIT.error);
+}
+function approved(state) {
+  const keys = Array.isArray(state.keys) ? `keys ${state.keys.join(", ")}` : state.keys;
+  const when = state.singleUse ? "one use" : state.until ? `until ${state.until}` : "";
+  return `Approved: ${[state.scopes?.join(", "), keys, when].filter(Boolean).join("; ")}.`;
+}
+function announce(target, asked) {
+  const where = target.environment ? `${target.project}/${target.environment}` : target.project;
+  return `Access request ${asked.request} for ${where} (${target.scopes.join(", ")}).
+Approve it at ${asked.approveUrl} (it needs your second factor); answer by ${asked.answerBy}.
+`;
+}
+function report({ io, flags }, state) {
+  const failure = verdict(state);
+  if (flags.json) {
+    io.stdout(JSON.stringify(state, null, 2) + `
+`);
+    return failure?.code ?? 0;
+  }
+  if (failure)
+    throw failure;
+  io.stdout(approved(state) + `
+`);
+  return 0;
+}
+var requestAccess = async (ctx) => {
+  const { io, flags, args } = ctx;
+  if (flags.status !== undefined) {
+    if (args.length > 0)
+      throw usage("request-access");
+    return report(ctx, flags.wait ? await poll(ctx, flags.status) : await check(ctx, flags.status));
+  }
+  const { project, environment, rest } = targetFor(ctx, args, { environment: false, need: 0 });
+  if (rest.length > 1)
+    throw usage("request-access");
+  const target = { project, environment: rest[0] ?? environment, scopes: list(flags.scopes ?? "secrets:read"), keys: flags.keys ? list(flags.keys) : undefined };
+  const asked = await ask(ctx, target);
+  if (flags.wait) {
+    if (!flags.json)
+      io.stderr(announce(target, asked));
+    return report(ctx, await poll(ctx, asked.request));
+  }
+  io.stdout(flags.json ? JSON.stringify({ request: asked.request, status: "pending", approveUrl: asked.approveUrl, answerBy: asked.answerBy }, null, 2) + `
+` : `${announce(target, asked)}Check it with: secretstore request-access --status ${asked.request}
+`);
+  return 0;
+};
+var askable = (message) => /request_access/.test(message) && !/include_protected/.test(message);
+async function withAccess(ctx, target, read) {
+  try {
+    return await read();
+  } catch (error) {
+    if (!(error instanceof CliError) || error.code !== EXIT.approval || !askable(error.message))
+      throw error;
+    if (!ctx.flags.requestAccess)
+      throw new CliError(`${error.message}
+Run again with --request-access to ask for it and wait for the answer.`, error.code);
+    const wanted = { ...target, scopes: ["secrets:read"] };
+    const asked = await ask(ctx, wanted);
+    ctx.io.stderr(announce(wanted, asked));
+    const failure = verdict(await poll(ctx, asked.request));
+    if (failure)
+      throw failure;
+    ctx.io.stderr(`Approved; reading again.
+`);
+    return await read();
+  }
+}
+
+// packages/auth/src/first-party.ts
+var CLI_CLIENT_PATH = "/.well-known/oauth-client/cli.json";
+function cliClientId(origin) {
+  return origin + CLI_CLIENT_PATH;
+}
+
+// apps/cli/src/dpop.ts
+var ES256 = { name: "ECDSA", namedCurve: "P-256" };
+var base64url = (data) => Buffer.from(typeof data === "string" ? data : new Uint8Array(data)).toString("base64url");
+var sha2562 = async (text) => new Uint8Array(await crypto.subtle.digest("SHA-256", Buffer.from(text)));
+async function generateDpopKey() {
+  const pair = await crypto.subtle.generateKey(ES256, true, ["sign", "verify"]);
+  const { kty, crv, x, y, d } = await crypto.subtle.exportKey("jwk", pair.privateKey);
+  return { kty, crv, x, y, d };
+}
+async function dpopProof(key, request) {
+  const { d: _private, ...publicJwk } = key;
+  const header = { typ: "dpop+jwt", alg: "ES256", jwk: publicJwk };
+  const claims = {
+    htm: request.htm,
+    htu: request.htu,
+    jti: base64url(crypto.getRandomValues(new Uint8Array(16))),
+    iat: Math.floor(request.nowMs / 1000),
+    ...request.accessToken === undefined ? {} : { ath: base64url(await sha2562(request.accessToken)) }
+  };
+  const input = `${base64url(JSON.stringify(header))}.${base64url(JSON.stringify(claims))}`;
+  const signingKey = await crypto.subtle.importKey("jwk", key, ES256, false, ["sign"]);
+  const signature = await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, signingKey, Buffer.from(input));
+  return `${input}.${base64url(signature)}`;
+}
+
+// apps/cli/src/oauth.ts
+class OAuthError extends CliError {
+  oauthCode;
+  constructor(oauthCode, message, code) {
+    super(message, code);
+    this.oauthCode = oauthCode;
+  }
+}
+var TIMEOUT_MS2 = 30000;
+var unreachable = (origin, error) => new CliError(`Cannot reach ${origin}: ${error instanceof Error ? error.message : String(error)}`);
+function endpoint(body, name) {
+  const value = body[name];
+  if (typeof value !== "string")
+    throw new CliError(`The server's OAuth metadata has no ${name}`);
+  try {
+    secureOrigin(value);
+  } catch {
+    throw new CliError(`The server's OAuth metadata names an insecure ${name}`);
+  }
+  return value;
+}
+async function discover(origin, fetcher = fetch) {
+  let body;
+  try {
+    const response = await fetcher(`${origin}/.well-known/oauth-authorization-server`, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(TIMEOUT_MS2) });
+    if (!response.ok)
+      throw new CliError(`${origin} does not look like a Secret Store server (HTTP ${response.status} for its OAuth metadata)`);
+    const json = await response.json();
+    body = isRecord(json) ? json : {};
+  } catch (error) {
+    throw error instanceof CliError ? error : unreachable(origin, error);
+  }
+  const raw = endpoint(body, "issuer");
+  const issuer = secureOrigin(raw);
+  if (raw !== issuer && raw !== `${issuer}/`)
+    throw new CliError("The server's issuer is not a plain origin");
+  return { issuer, authorizationEndpoint: endpoint(body, "authorization_endpoint"), tokenEndpoint: endpoint(body, "token_endpoint"), revocationEndpoint: endpoint(body, "revocation_endpoint") };
+}
+async function pkce() {
+  const verifier = base64url(crypto.getRandomValues(new Uint8Array(48)));
+  return { verifier, challenge: base64url(await sha2562(verifier)) };
+}
+var randomState = () => base64url(crypto.getRandomValues(new Uint8Array(24)));
+function authorizeUrl(meta, request) {
+  const url = new URL(meta.authorizationEndpoint);
+  const params = {
+    client_id: cliClientId(meta.issuer),
+    redirect_uri: request.redirectUri,
+    response_type: "code",
+    code_challenge: request.challenge,
+    code_challenge_method: "S256",
+    scope: request.scopes.join(" "),
+    state: request.state,
+    resource: mcpEndpoint(meta.issuer)
+  };
+  for (const [name, value] of Object.entries(params))
+    url.searchParams.set(name, value);
+  return url.href;
+}
+function refusal(status, body) {
+  let error;
+  let description = `The server answered HTTP ${status}`;
+  try {
+    const parsed = JSON.parse(body);
+    if (isRecord(parsed) && typeof parsed.error === "string")
+      error = parsed.error;
+    if (isRecord(parsed) && typeof parsed.error_description === "string")
+      description = parsed.error_description;
+  } catch {}
+  return new OAuthError(error, error ? `${description} (${error})` : description);
+}
+async function tokenRequest(tokenEndpoint, key, form, nowMs, fetcher) {
+  let response;
+  try {
+    response = await fetcher(tokenEndpoint, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json", dpop: await dpopProof(key, { htm: "POST", htu: tokenEndpoint, nowMs }) },
+      body: new URLSearchParams(form),
+      signal: AbortSignal.timeout(TIMEOUT_MS2)
+    });
+  } catch (error) {
+    throw unreachable(new URL(tokenEndpoint).origin, error);
+  }
+  const text = await response.text();
+  if (!response.ok)
+    throw refusal(response.status, text);
+  let body = {};
+  try {
+    const parsed = JSON.parse(text);
+    if (isRecord(parsed))
+      body = parsed;
+  } catch {}
+  const { access_token: accessToken, refresh_token: refreshToken, expires_in: expiresIn } = body;
+  if (typeof accessToken !== "string" || typeof refreshToken !== "string" || typeof expiresIn !== "number" || String(body.token_type).toLowerCase() !== "dpop") {
+    throw new CliError("The server did not answer with a DPoP-bound token pair");
+  }
+  return { accessToken, refreshToken, expiresAt: nowMs + expiresIn * 1000, scope: typeof body.scope === "string" ? body.scope : "" };
+}
+function exchangeCode(meta, key, request, nowMs, fetcher = fetch) {
+  const form = {
+    grant_type: "authorization_code",
+    code: request.code,
+    client_id: cliClientId(meta.issuer),
+    redirect_uri: request.redirectUri,
+    code_verifier: request.verifier,
+    resource: mcpEndpoint(meta.issuer)
+  };
+  return tokenRequest(meta.tokenEndpoint, key, form, nowMs, fetcher);
+}
+function refreshGrant(login, nowMs, fetcher = fetch) {
+  return tokenRequest(login.tokenEndpoint, login.key, { grant_type: "refresh_token", refresh_token: login.refreshToken, client_id: login.clientId }, nowMs, fetcher);
+}
+async function revokeToken(login, fetcher = fetch) {
+  let response;
+  try {
+    response = await fetcher(login.revocationEndpoint, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ token: login.refreshToken, token_type_hint: "refresh_token", client_id: login.clientId }),
+      signal: AbortSignal.timeout(TIMEOUT_MS2)
+    });
+  } catch (error) {
+    throw unreachable(login.issuer, error);
+  }
+  if (!response.ok)
+    throw refusal(response.status, await response.text());
+}
+
+// apps/cli/src/callback.ts
+var PAGE = '<!doctype html><meta charset="utf-8"><title>Secret Store CLI</title><p>You can close this tab and return to the terminal.</p>';
+function refusal2(error, description) {
+  if (error === "access_denied")
+    return new OAuthError(error, "Sign-in was denied in the browser.", EXIT.denied);
+  return new OAuthError(error, `The server refused the sign-in: ${description ?? error} (${error})`);
+}
+async function listenForCallback(state, timeoutMs) {
+  let resolveCode;
+  let rejectCode;
+  const code = new Promise((resolve, reject) => {
+    resolveCode = resolve;
+    rejectCode = reject;
+  });
+  code.catch(() => {
+    return;
+  });
+  const stop = (force) => {
+    clearTimeout(timer);
+    server.stop(force);
+  };
+  const server = await serveLoopback((request) => {
+    const url = new URL(request.url);
+    if (url.pathname !== "/callback")
+      return new Response("Not found", { status: 404 });
+    if (url.searchParams.get("state") !== state)
+      return new Response("This link does not belong to the sign-in that is waiting.", { status: 400 });
+    const error = url.searchParams.get("error");
+    const granted = url.searchParams.get("code");
+    if (error)
+      rejectCode(refusal2(error, url.searchParams.get("error_description")));
+    else if (granted)
+      resolveCode(granted);
+    else
+      return new Response("The redirect carried no code.", { status: 400 });
+    stop(false);
+    return new Response(PAGE, { headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "referrer-policy": "no-referrer" } });
+  });
+  const timer = setTimeout(() => {
+    rejectCode(new CliError('Timed out waiting for the browser. Run "secretstore login" again.'));
+    stop(true);
+  }, timeoutMs);
+  return { port: server.port, code, close: () => stop(true) };
+}
+
+// apps/cli/src/keystore.ts
+import { mkdirSync, readFileSync as readFileSync2, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname as dirname2, join as join2 } from "node:path";
+var SERVICE = "secret-store-cli";
+function parseLogin(value) {
+  const login = isRecord(value) ? value : undefined;
+  const strings = [login?.issuer, login?.clientId, login?.tokenEndpoint, login?.revocationEndpoint, login?.accessToken, login?.refreshToken, login?.scope];
+  const jwk = login?.key;
+  const valid = strings.every((s) => typeof s === "string") && typeof login?.expiresAt === "number" && typeof login.createdAt === "number" && isRecord(jwk) && typeof jwk.d === "string";
+  return valid ? login : undefined;
+}
+var at = (name) => ({ service: SERVICE, name });
+var noOsKeystore = () => new CliError("Node.js has no OS keystore; the native secretstore binary does", EXIT.usage);
+function osKeystore(secrets2 = secrets ?? null) {
+  if (!secrets2) {
+    return {
+      get: () => Promise.reject(noOsKeystore()),
+      set: () => Promise.reject(noOsKeystore()),
+      remove: () => Promise.reject(noOsKeystore())
+    };
+  }
+  return {
+    async get(name) {
+      const text = await secrets2.get(at(name));
+      return text ? parseLogin(JSON.parse(text)) : undefined;
+    },
+    async set(name, login) {
+      await secrets2.set({ ...at(name), value: JSON.stringify(login) });
+    },
+    async remove(name) {
+      await secrets2.delete(at(name));
+    }
+  };
+}
+function credentialsPath(env, platform = process.platform) {
+  const base = platform === "win32" ? env.APPDATA ?? join2(homedir(), "AppData", "Roaming") : env.XDG_CONFIG_HOME || join2(env.HOME || homedir(), ".config");
+  return join2(base, "secret-store", "credentials.json");
+}
+function fileKeystore(path) {
+  const read = () => {
+    let text;
+    try {
+      text = readFileSync2(path, "utf8");
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "ENOENT")
+        return {};
+      throw error;
+    }
+    try {
+      const parsed = JSON.parse(text);
+      if (!isRecord(parsed))
+        throw new TypeError("not a JSON object");
+      return parsed;
+    } catch {
+      throw new CliError(`${path} is not valid JSON; fix or delete it`);
+    }
+  };
+  const write = (all) => {
+    mkdirSync(dirname2(path), { recursive: true, mode: 448 });
+    const next = `${path}.${process.pid}.tmp`;
+    writeFileSync(next, JSON.stringify(all, null, 2) + `
+`, { mode: 384 });
+    renameSync(next, path);
+  };
+  return {
+    async get(name) {
+      return parseLogin(read()[name]);
+    },
+    async set(name, login) {
+      write({ ...read(), [name]: login });
+    },
+    async remove(name) {
+      const { [name]: gone, ...rest } = read();
+      if (gone !== undefined)
+        write(rest);
+    }
+  };
+}
+var quietly = (lookup) => lookup.catch(() => {
+  return;
+});
+function forcedBackend(env) {
+  const choice = env.SECRET_STORE_KEYSTORE;
+  if (choice === "os" || choice === "file")
+    return choice;
+  if (choice)
+    throw new CliError(`SECRET_STORE_KEYSTORE is "os" or "file", not "${choice}"`, EXIT.usage);
+  return;
+}
+async function activeBackend(env, secrets2 = secrets ?? null) {
+  const forced = forcedBackend(env);
+  if (forced === "os" && !secrets2)
+    throw noOsKeystore();
+  return forced ?? await secrets2?.get(at("doctor")).then(() => "os", () => "file") ?? "file";
+}
+function openKeystore(env, warn, secrets2 = secrets ?? null) {
+  const os = osKeystore(secrets2);
+  const path = credentialsPath(env);
+  const file = fileKeystore(path);
+  const choice = forcedBackend(env);
+  if (choice === "os")
+    return os;
+  if (choice === "file")
+    return file;
+  return {
+    async get(name) {
+      return await quietly(os.get(name)) ?? await quietly(file.get(name));
+    },
+    async set(name, login) {
+      try {
+        await os.set(name, login);
+      } catch (error) {
+        if (!await quietly(file.get(name)))
+          warn(`note: no OS keystore (${error instanceof Error ? error.message : String(error)}); the login is kept in ${path} (mode 0600)
+`);
+        await file.set(name, login);
+      }
+    },
+    async remove(name) {
+      const results = await Promise.allSettled([os.remove(name), file.remove(name)]);
+      const failed = results.filter((r) => r.status === "rejected");
+      if (failed.length === results.length && failed[0])
+        throw failed[0].reason;
+    }
+  };
+}
+
+// apps/cli/src/commands/auth.ts
+var LOGIN_TIMEOUT_MS = 5 * 60000;
+var READ_SCOPES = ["projects:read", "secrets:read"];
+var reason = (error) => error instanceof Error ? error.message : String(error);
+var login = async ({ args, flags, io }) => {
+  if (args.length > 0)
+    throw usage("login");
+  const store = openKeystore(io.env, io.stderr);
+  const name = resolveUrl(flags.url, io.env);
+  const meta = await discover(name);
+  const { verifier, challenge } = await pkce();
+  const state = randomState();
+  const key = await generateDpopKey();
+  const listener = await listenForCallback(state, LOGIN_TIMEOUT_MS);
+  let grant;
+  try {
+    const redirectUri = `http://127.0.0.1:${listener.port}/callback`;
+    const url = authorizeUrl(meta, { redirectUri, challenge, state, scopes: flags.write ? [...READ_SCOPES, "secrets:write"] : READ_SCOPES });
+    io.stdout(`Open this URL to sign in to ${meta.issuer} (waiting up to 5 minutes):
+${url}
+`);
+    if (!flags.noBrowser) {
+      try {
+        await io.openUrl(url);
+      } catch {
+        io.stderr(`note: could not open a browser; open the URL above yourself
+`);
+      }
+    }
+    grant = await exchangeCode(meta, key, { code: await listener.code, verifier, redirectUri }, io.now());
+  } catch (error) {
+    if (flags.write && error instanceof OAuthError && error.oauthCode === "invalid_scope") {
+      throw new CliError(`${error.message}. secrets:write is offered only while the server's agent-write-scope flag is on; sign in without --write for read access.`, error.code);
+    }
+    throw error;
+  } finally {
+    listener.close();
+  }
+  const saved = {
+    issuer: meta.issuer,
+    clientId: cliClientId(meta.issuer),
+    tokenEndpoint: meta.tokenEndpoint,
+    revocationEndpoint: meta.revocationEndpoint,
+    accessToken: grant.accessToken,
+    expiresAt: grant.expiresAt,
+    refreshToken: grant.refreshToken,
+    key,
+    scope: grant.scope,
+    createdAt: io.now()
+  };
+  const previous = await store.get(name).catch(() => {
+    return;
+  });
+  if (previous)
+    await revokeToken(previous).catch(() => {
+      return;
+    });
+  try {
+    await store.set(name, saved);
+  } catch (error) {
+    throw new CliError(`Signed in, but the login could not be saved (${reason(error)}). Revoke "Secret Store CLI" on ${meta.issuer}/settings/agents and try again.`);
+  }
+  if (flags.write && !grant.scope.split(" ").includes("secrets:write")) {
+    io.stderr(`note: secrets:write was not granted (you have to tick it on the consent page); set and delete will be refused
+`);
+  }
+  io.stdout(`Signed in to ${meta.issuer} with ${grant.scope}.
+The access token lasts an hour and renews itself. Revoke this login any time on ${meta.issuer}/settings/agents.
+`);
+};
+var logout = async ({ args, flags, io }) => {
+  if (args.length > 0)
+    throw usage("logout");
+  const store = openKeystore(io.env, io.stderr);
+  const name = resolveUrl(flags.url, io.env);
+  const stored = await store.get(name);
+  if (!stored) {
+    io.stdout(`Not signed in to ${name}.
+`);
+    return;
+  }
+  let unrevoked = "";
+  try {
+    await revokeToken(stored);
+  } catch (error) {
+    unrevoked = ` The server could not be told (${reason(error)}), so revoke "Secret Store CLI" on ${stored.issuer}/settings/agents.`;
+  }
+  await store.remove(name);
+  io.stdout(`Signed out of ${name}.${unrevoked}
+`);
+};
+var keystoreSelftest = async ({ io }) => {
+  const store = openKeystore(io.env, io.stderr);
+  const name = `selftest-${crypto.randomUUID()}`;
+  const probe = {
+    issuer: "https://selftest.invalid",
+    clientId: "selftest",
+    tokenEndpoint: "https://selftest.invalid/token",
+    revocationEndpoint: "https://selftest.invalid/revoke",
+    accessToken: base64url(crypto.getRandomValues(new Uint8Array(400))),
+    expiresAt: 0,
+    refreshToken: base64url(crypto.getRandomValues(new Uint8Array(100))),
+    key: await generateDpopKey(),
+    scope: "",
+    createdAt: 0
+  };
+  try {
+    await store.set(name, probe);
+    if ((await store.get(name))?.accessToken !== probe.accessToken)
+      throw new CliError("The keystore returned a different value than it was given");
+  } finally {
+    await store.remove(name).catch(() => {
+      return;
+    });
+  }
+  io.stdout(`OK
+`);
+};
+
+// apps/cli/src/commands/completion.ts
+var byCommand = () => Object.entries(USAGE).map(([name, line]) => [name, [...new Set([...line.match(/--[a-z][a-z-]*/g) ?? [], ...GLOBAL_FLAGS])]]);
+var bash = (commands) => `# bash completion for secretstore. In ~/.bashrc: source <(secretstore completion bash)
+_secretstore() {
+  local cur=\${COMP_WORDS[COMP_CWORD]}
+  if [ "$COMP_CWORD" -eq 1 ]; then
+    COMPREPLY=($(compgen -W "${commands.map(([name]) => name).join(" ")}" -- "$cur"))
+  elif [[ $cur == -* ]]; then
+    case \${COMP_WORDS[1]} in
+${commands.map(([name, flags]) => `      ${name}) COMPREPLY=($(compgen -W "${flags.join(" ")}" -- "$cur")) ;;`).join(`
+`)}
+    esac
+  fi
+}
+complete -o default -F _secretstore secretstore
+`;
+var zsh = (commands) => `#compdef secretstore
+# zsh completion for secretstore. In ~/.zshrc, after compinit: source <(secretstore completion zsh)
+_secretstore() {
+  if (( CURRENT == 2 )); then
+    compadd -- ${commands.map(([name]) => name).join(" ")}
+  elif [[ $PREFIX == -* ]]; then
+    case $words[2] in
+${commands.map(([name, flags]) => `      ${name}) compadd -- ${flags.join(" ")} ;;`).join(`
+`)}
+    esac
+  else
+    _files
+  fi
+}
+compdef _secretstore secretstore
+`;
+var fish = (commands) => `# fish completion for secretstore. Save it: secretstore completion fish > ~/.config/fish/completions/secretstore.fish
+complete -c secretstore -f -n __fish_use_subcommand -a "${commands.map(([name]) => name).join(" ")}"
+${commands.flatMap(([name, flags]) => flags.map((flag) => `complete -c secretstore -n "__fish_seen_subcommand_from ${name}" -l ${flag.slice(2)}`)).join(`
+`)}
+`;
+var powershell = (commands) => `# PowerShell completion for secretstore. In your profile ($PROFILE): secretstore completion powershell | Out-String | Invoke-Expression
+Register-ArgumentCompleter -Native -CommandName secretstore -ScriptBlock {
+    param($wordToComplete, $commandAst, $cursorPosition)
+    $flags = [ordered]@{
+${commands.map(([name, list]) => `        '${name}' = @(${list.map((flag) => `'${flag}'`).join(", ")})`).join(`
+`)}
+    }
+    $words = @($commandAst.CommandElements | Select-Object -Skip 1 | ForEach-Object { $_.ToString() })
+    if ($wordToComplete) { $words = @($words | Select-Object -SkipLast 1) }
+    $candidates = if ($words.Count -eq 0) { @($flags.Keys) } elseif ($flags.Contains($words[0])) { @($flags[$words[0]]) } else { @() }
+    $candidates | Where-Object { $_ -like "$wordToComplete*" } | ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterValue', $_) }
+}
+`;
+var SCRIPTS = { bash, zsh, fish, powershell };
+var completion = async ({ args, io }) => {
+  const [shell, ...extra] = args;
+  const script = shell !== undefined && Object.hasOwn(SCRIPTS, shell) ? SCRIPTS[shell] : undefined;
+  if (!script || extra.length > 0)
+    throw usage("completion");
+  io.stdout(script(byCommand()));
+};
+
+// apps/cli/src/commands/doctor.ts
+var SKEW_WARN_MS = 30000;
+var LOGIN_HINT = 'Run "secretstore login", or export SECRET_STORE_TOKEN for a personal token.';
+var doctor = async ({ io, flags, client }) => {
+  const origin = resolveUrl(flags.url, io.env);
+  const results = [];
+  const check = async (name, hint, test) => {
+    try {
+      const [status, detail, own] = await test();
+      results.push({ check: name, status, detail, ...own ? { hint: own } : {} });
+    } catch (error) {
+      results.push({ check: name, status: "fail", detail: error instanceof Error ? error.message : String(error), ...hint ? { hint } : {} });
+    }
+  };
+  const seen = { serverDate: null, reachable: false, credential: false };
+  await check("version", "", async () => ["ok", package_default.version]);
+  await check("server", "Check the address (--url or SECRET_STORE_URL) and your network.", async () => {
+    const meta = await discover(origin, async (url, init) => {
+      const response = await fetch(url, init);
+      seen.serverDate = response.headers.get("date");
+      return response;
+    });
+    seen.reachable = true;
+    return ["ok", `${origin} (issuer ${meta.issuer})`];
+  });
+  await check("auth", LOGIN_HINT, async () => {
+    const given = resolveToken(flags.token, io.env);
+    if (given) {
+      seen.credential = true;
+      return ["ok", `${given.via}, a personal token sent as a bearer`];
+    }
+    const login = await openKeystore(io.env, io.stderr).get(origin);
+    if (!login)
+      return ["fail", "no credential for this server", LOGIN_HINT];
+    seen.credential = true;
+    const left = login.expiresAt - io.now();
+    return ["ok", `login, scopes ${login.scope}; the access token ${left > 0 ? `lasts ${Math.ceil(left / 60000)} more minutes` : "has expired and renews on the next call"}`];
+  });
+  await check("keystore", "Set SECRET_STORE_KEYSTORE to os or file.", async () => {
+    const backend = await activeBackend(io.env);
+    if (backend === "os")
+      return ["ok", "the operating system's keystore"];
+    const where = credentialsPath(io.env);
+    return io.env.SECRET_STORE_KEYSTORE === "file" ? ["ok", `the credentials file ${where}`] : ["warn", `no OS keystore here, so logins go to ${where} (mode 0600)`, "Set SECRET_STORE_KEYSTORE=file to say so on purpose."];
+  });
+  await check("token", `Run "secretstore login" again, or create a new token on ${origin}/settings/agents.`, async () => {
+    if (!seen.reachable || !seen.credential)
+      return ["warn", "not checked: needs a reachable server and a credential"];
+    const who = firstJson(await client.call(TOOLS.whoami, {}));
+    return ["ok", `accepted by the server${who.scopes ? `, scopes ${who.scopes.join(" ")}` : ""}`];
+  });
+  await check("pin", `Fix the JSON, or replace the file with "secretstore init <project> <environment> --force".`, async () => {
+    const pin = readPin(io.cwd);
+    if (!pin.project || !pin.environment) {
+      return ["warn", `no ${PIN_FILE} with a project and an environment in this directory or above`, 'Pin them with "secretstore init <project> <environment>".'];
+    }
+    return ["ok", `${PIN_FILE}: ${pin.project}/${pin.environment}`];
+  });
+  await check("clock", "", async () => {
+    const server = Date.parse(seen.serverDate ?? "");
+    if (Number.isNaN(server))
+      return ["warn", `not checked: ${seen.reachable ? "the server's answer had no Date header" : "the server was not reached"}`];
+    const skew = io.now() - server;
+    const detail = `${Math.round(skew / 1000)} s from the server`;
+    return Math.abs(skew) > SKEW_WARN_MS ? ["warn", detail, "DPoP proofs need a clock within about 30 s of the server's: sync your system clock."] : ["ok", detail];
+  });
+  if (flags.json)
+    io.stdout(JSON.stringify(results, null, 2) + `
+`);
+  else
+    io.stdout(results.map((r) => `${r.status.padEnd(4)}  ${r.check.padEnd(8)}  ${r.detail}${r.hint ? `  Hint: ${r.hint}` : ""}`).join(`
+`) + `
+`);
+  return results.some((r) => r.status === "fail") ? EXIT.error : 0;
+};
+
+// apps/cli/src/commands/env.ts
+import { randomUUID } from "node:crypto";
+import { chmodSync, lstatSync, renameSync as renameSync2, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { constants } from "node:os";
+import { resolve } from "node:path";
+
+// apps/cli/src/format.ts
+var KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var BARE = /^[A-Za-z0-9_./:@+=,-]+$/;
+function assertKeys(env) {
+  for (const key of Object.keys(env)) {
+    if (!KEY.test(key))
+      throw new CliError(`Refusing to write the key ${JSON.stringify(key)}: names are letters, digits and underscores`);
+  }
+}
+function entries(env) {
+  assertKeys(env);
+  return Object.entries(env);
+}
+var lines = (rows) => rows.length ? rows.join(`
+`) + `
+` : "";
+function toDotenv(env) {
+  return lines(entries(env).map(([key, value]) => BARE.test(value) ? `${key}=${value}` : `${key}="${value.replaceAll("\\", "\\\\").replaceAll('"', "\\\"").replaceAll(`
+`, "\\n").replaceAll("\r", "\\r")}"`));
+}
+function toShell(env) {
+  return lines(entries(env).map(([key, value]) => `export ${key}='${value.replaceAll("'", "'\\''")}'`));
+}
+function toJson(env) {
+  return JSON.stringify(env, null, 2) + `
+`;
+}
+function table(header, rows) {
+  const all = [header, ...rows];
+  const widths = header.map((_, i) => Math.max(...all.map((row) => (row[i] ?? "").length)));
+  return all.map((row) => row.map((cell, i) => cell.padEnd(widths[i] ?? 0)).join("  ").trimEnd()).join(`
+`) + `
+`;
+}
+var red = (text, on) => on ? `\x1B[31m${text}\x1B[0m` : text;
+
+// apps/cli/src/commands/env.ts
+var signalNumber = (signal) => {
+  const signals = constants.signals;
+  return (typeof signal === "string" ? signals[signal] : undefined) ?? 0;
+};
+var FORMATS = { dotenv: toDotenv, json: toJson, shell: toShell };
+var isFormat = (name) => Object.hasOwn(FORMATS, name);
+function requireTty({ io, flags }) {
+  if (!io.isTty && !flags.allowNonTty) {
+    throw new CliError('Refusing to print secrets to a pipe or file because an agent or a log can read it; pass --allow-non-tty if you mean it (or use "run" or "pull").', EXIT.usage);
+  }
+}
+var OVERRIDES = /^(PATH|PATHEXT|COMSPEC|SYSTEMROOT|NODE_OPTIONS|NODE_PATH|SHELLOPTS|BASH_ENV|ENV|PERL5OPT|PERL5LIB|RUBYOPT|RUBYLIB|PROMPT_COMMAND|NODE_EXTRA_CA_CERTS|JAVA_TOOL_OPTIONS|_JAVA_OPTIONS|DOTNET_STARTUP_HOOKS|PYTHON.*|(LD|DYLD|BUN|GIT|SSH|NPM_CONFIG)_.*|.*_PRELOAD)$/i;
+var overridingKeys = (keys) => keys.filter((key) => OVERRIDES.test(key));
+function fetchEnvironment(ctx, project, environment) {
+  return withAccess(ctx, { project, environment }, async () => {
+    const [body, ...notes] = await ctx.client.call(TOOLS.getEnvironment, { project, environment, format: "json" });
+    for (const note of notes)
+      ctx.io.stderr(`note: ${note}
+`);
+    return firstJson([body ?? ""]);
+  });
+}
+var pull = async (ctx) => {
+  const { io, flags } = ctx;
+  const { project, environment, rest } = await readTarget(ctx, ctx.args, 0);
+  if (rest.length > 0)
+    throw usage("pull");
+  const out = flags.out ?? ".env";
+  const path = resolve(io.cwd, out);
+  if (lstatSync(path, { throwIfNoEntry: false })?.isSymbolicLink())
+    throw new CliError(`${out} is a symbolic link; remove it and run pull again`, EXIT.usage);
+  const env = await fetchEnvironment(ctx, project, environment);
+  const temp = `${path}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync2(temp, toDotenv(env), { mode: 384, flag: "wx" });
+    chmodSync(temp, 384);
+    renameSync2(temp, path);
+  } catch (error) {
+    rmSync(temp, { force: true });
+    throw error;
+  }
+  const keys = Object.keys(env);
+  if (flags.json)
+    io.stdout(JSON.stringify({ file: out, keys }, null, 2) + `
+`);
+  else
+    io.stdout(`Wrote ${keys.length} ${keys.length === 1 ? "key" : "keys"} to ${out} (mode 0600).
+Add ${out} to .gitignore so it is never committed.
+`);
+};
+var exportEnv = async (ctx) => {
+  const { io, flags } = ctx;
+  const { project, environment, rest } = await readTarget(ctx, ctx.args, 0);
+  if (rest.length > 0)
+    throw usage("export");
+  const format = flags.format ?? (flags.json ? "json" : "dotenv");
+  if (!isFormat(format))
+    throw new CliError(`--format is dotenv, json or shell, not "${format}"`, EXIT.usage);
+  requireTty(ctx);
+  io.stdout(FORMATS[format](await fetchEnvironment(ctx, project, environment)));
+};
+var run = async (ctx) => {
+  const { io, flags, rest: command } = ctx;
+  const { project, environment, rest } = await readTarget(ctx, ctx.args, 0);
+  if (rest.length > 0 || !command?.length)
+    throw usage("run");
+  const secrets = await fetchEnvironment(ctx, project, environment);
+  assertKeys(secrets);
+  const refused = overridingKeys(Object.keys(secrets));
+  if (refused.length > 0 && !flags.allowEnvOverride) {
+    throw new CliError(`Not running: ${refused.join(", ")} would override the command's own environment (loader, path or tool settings). Remove the secret${refused.length === 1 ? "" : "s"} or pass --allow-env-override if you trust everyone who can edit this environment.`, EXIT.usage);
+  }
+  const { SECRET_STORE_TOKEN: _token, SECRET_STORE_PACKAGE_MANAGED: _managed, ...inherited } = io.env;
+  let child;
+  try {
+    child = spawn(command, { env: { ...inherited, ...secrets }, cwd: io.cwd, stdio: "inherit" });
+  } catch {
+    throw new CliError(`Cannot start "${command[0]}"`, EXIT.cannotRun);
+  }
+  const forward = (signal) => () => child.kill(signal);
+  const handlers = ["SIGINT", "SIGTERM"].map((signal) => [signal, forward(signal)]);
+  for (const [signal, handler] of handlers)
+    process.on(signal, handler);
+  try {
+    await child.exited;
+  } catch {
+    throw new CliError(`Cannot start "${command[0]}"`, EXIT.cannotRun);
+  } finally {
+    for (const [signal, handler] of handlers)
+      process.off(signal, handler);
+  }
+  return child.exitCode ?? 128 + signalNumber(child.signalCode);
+};
+
+// apps/cli/src/commands/init.ts
+import { writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join3 } from "node:path";
+var init = async ({ args, client, flags, io }) => {
+  if (args.length === 1 || args.length > 2)
+    throw usage("init");
+  const environmentsOf = async (project) => firstJson(await client.call(TOOLS.listEnvironments, { project })).environments;
+  const [project, environment] = args;
+  if (project === undefined || environment === undefined) {
+    const projects = await allProjects(client);
+    const listed = [];
+    for (const p of projects) {
+      listed.push({ ...p, environments: await environmentsOf(p.slug) });
+    }
+    if (flags.json)
+      io.stdout(JSON.stringify(listed, null, 2) + `
+`);
+    else if (listed.length === 0)
+      io.stdout(`No projects.
+`);
+    else {
+      const rows = listed.flatMap((p) => p.environments.map((e) => [p.slug + (p.archived ? " (archived)" : ""), e.slug, e.kind, e.restricted ? "restricted for this token" : ""]));
+      io.stdout(table(["PROJECT", "ENVIRONMENT", "KIND", ""], rows) + `Pin one to this directory with: secretstore init <project> <environment>
+`);
+    }
+    return;
+  }
+  const environments = await environmentsOf(project);
+  if (!environments.some((e) => e.slug === environment)) {
+    throw new CliError(`The project "${project}" has no environment "${environment}". It has: ${environments.map((e) => e.slug).join(", ") || "none"}.`, EXIT.notFound);
+  }
+  try {
+    writeFileSync3(join3(io.cwd, PIN_FILE), JSON.stringify({ project, environment }, null, 2) + `
+`, { flag: flags.force ? "w" : "wx" });
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "EEXIST")
+      throw new CliError(`${PIN_FILE} already exists here; pass --force to replace it`, EXIT.usage);
+    throw error;
+  }
+  if (flags.json)
+    io.stdout(JSON.stringify({ file: PIN_FILE, project, environment }, null, 2) + `
+`);
+  else
+    io.stdout(`Wrote ${PIN_FILE}: ${project}/${environment}. It holds names only, so it is safe to commit.
+If you use "secretstore pull", add .env to your .gitignore (this command never edits it).
+`);
+};
+
+// apps/cli/src/commands/push.ts
+import { readFileSync as readFileSync3 } from "node:fs";
+import { resolve as resolve2 } from "node:path";
+
+// apps/cli/src/dotenv.ts
+var CHUNK_BYTES = 200 * 1024;
+var ENTRY = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/;
+function closingQuote(text, from, q) {
+  for (let i = from;i < text.length; i++) {
+    if (text[i] === "\\")
+      i++;
+    else if (text[i] === q)
+      return i;
+  }
+  return -1;
+}
+function entries2(text) {
+  const found = [];
+  let preamble = "";
+  let open;
+  for (const line of text.split(/(?<=\n)/)) {
+    if (open !== undefined) {
+      if (closingQuote(line, 0, open) !== -1)
+        open = undefined;
+    } else {
+      const start = ENTRY.exec(line);
+      if (start?.[1] !== undefined) {
+        found.push({ key: start[1], text: preamble });
+        preamble = "";
+        const value = line.slice(start[0].length).trimStart();
+        const quote = value[0];
+        if ((quote === '"' || quote === "'" || quote === "`") && closingQuote(value, 1, quote) === -1)
+          open = quote;
+      }
+    }
+    const last = found.at(-1);
+    if (last)
+      last.text += line;
+    else
+      preamble += line;
+  }
+  return found;
+}
+function chunkDotenv(text, max = CHUNK_BYTES) {
+  const chunks = [];
+  let current = "";
+  let size = 0;
+  for (const entry of entries2(text)) {
+    const bytes = Buffer.byteLength(entry.text);
+    if (bytes > max)
+      throw new CliError(`${entry.key} alone is ${Math.ceil(bytes / 1024)} KiB, more than the ${Math.floor(max / 1024)} KiB one import takes`, EXIT.usage);
+    if (size + bytes > max) {
+      chunks.push(current);
+      current = "";
+      size = 0;
+    }
+    current += entry.text;
+    size += bytes;
+  }
+  if (current)
+    chunks.push(current);
+  return chunks;
+}
+
+// apps/cli/src/commands/push.ts
+var NOT_DONE = [
+  ["protected", "protected"],
+  ["sealed", "sealed in the browser"],
+  ["restricted", "outside this token's limits"],
+  ["invalid", "not valid keys"]
+];
+function summary(total, where) {
+  const lines = [`Imported into ${where}: ${total.created.length} created, ${total.updated.length} updated, ${total.skipped.length} skipped (already set).`];
+  for (const [list, why] of NOT_DONE)
+    if (total[list].length > 0)
+      lines.push(`Skipped, ${why}: ${total[list].join(", ")}`);
+  if (total.skipped.length > 0)
+    lines.push("Pass --overwrite to replace values that are already set.");
+  return lines.join(`
+`) + `
+`;
+}
+var push = async (ctx) => {
+  const { io, flags, client } = ctx;
+  const { project, environment, rest } = targetFor(ctx, ctx.args, { environment: true, need: 0, write: true });
+  if (rest.length > 1)
+    throw usage("push");
+  if (flags.kind !== undefined && flags.kind !== "secret" && flags.kind !== "plain")
+    throw new CliError(`--kind is secret or plain, not "${flags.kind}"`, EXIT.usage);
+  const label = rest[0] ?? ".env";
+  let text;
+  if (label === "-") {
+    text = await io.readStdin();
+  } else {
+    try {
+      text = readFileSync3(resolve2(io.cwd, label), "utf8");
+    } catch {
+      throw new CliError(`Cannot read ${label}`, EXIT.usage);
+    }
+  }
+  const chunks = chunkDotenv(text);
+  if (chunks.length === 0)
+    throw new CliError(`No KEY=value lines in ${label === "-" ? "the input" : label}`, EXIT.usage);
+  const total = { created: [], updated: [], skipped: [], invalid: [], sealed: [], protected: [], restricted: [] };
+  const refused = [];
+  let failure;
+  let landed = 0;
+  for (const chunk of chunks) {
+    try {
+      const result = firstJson(await client.call(TOOLS.importEnv, { project, environment, text: chunk, ...flags.overwrite ? { overwrite: true } : {}, ...flags.kind ? { kind: flags.kind } : {} }));
+      for (const list of Object.keys(total))
+        total[list].push(...result[list] ?? []);
+      landed++;
+    } catch (error) {
+      if (!(error instanceof CliError && error.code === EXIT.approval)) {
+        failure = error;
+        break;
+      }
+      refused.push(error);
+    }
+  }
+  if (landed === 0)
+    throw failure ?? refused[0];
+  if (flags.json)
+    io.stdout(JSON.stringify({ project, environment, ...total }, null, 2) + `
+`);
+  else
+    io.stdout(summary(total, `${project}/${environment}`));
+  for (const error of refused)
+    io.stderr(`note: ${error.message}
+`);
+  if (failure)
+    throw failure;
+  const done = total.created.length + total.updated.length + total.skipped.length;
+  return done === 0 && total.protected.length + total.sealed.length > 0 ? EXIT.approval : 0;
+};
+
+// apps/cli/src/commands/read.ts
+var pretty = (value) => JSON.stringify(value, null, 2) + `
+`;
+var whoami = async ({ args, client, io }) => {
+  if (args.length > 0)
+    throw usage("whoami");
+  const token = firstJson(await client.call(TOOLS.whoami, {}));
+  io.stdout(pretty({ ...token, authenticatedWith: await client.via() }));
+};
+var projects = async ({ args, client, flags, io }) => {
+  if (args.length > 0)
+    throw usage("projects");
+  const rows = await allProjects(client);
+  if (flags.json)
+    io.stdout(pretty(rows));
+  else if (rows.length === 0)
+    io.stdout(`No projects.
+`);
+  else
+    io.stdout(table(["SLUG", "NAME", "ROLE", "ENVS", "SECRETS"], rows.map((p) => [p.slug + (p.archived ? " (archived)" : ""), p.name, p.role, String(p.environments), String(p.secrets)])));
+};
+var envs = async ({ args, client, flags, io }) => {
+  const { project, rest } = targetFor({ io, flags }, args, { environment: false, need: 0 });
+  if (rest.length > 0)
+    throw usage("envs");
+  const listed = firstJson(await client.call(TOOLS.listEnvironments, { project }));
+  const environments = listed.environments.map(({ id, slug, name, kind, restricted }) => ({ ...id === undefined ? {} : { id }, slug, name, kind, ...restricted ? { restricted } : {} }));
+  if (flags.json)
+    io.stdout(pretty(environments));
+  else
+    io.stdout(table(["SLUG", "NAME", "KIND", ""], environments.map((e) => [e.slug, e.name, e.kind, e.restricted ? "restricted for this token" : ""])));
+};
+var get = async (ctx) => {
+  const { args, client, flags, io } = ctx;
+  const { project, environment, rest } = await readTarget(ctx, args, 1);
+  const [key] = rest;
+  if (key === undefined || rest.length > 1)
+    throw usage("get");
+  requireTty(ctx);
+  const result = await withAccess(ctx, { project, environment, keys: [key] }, async () => firstJson(await client.call(TOOLS.getSecret, { project, environment, key })));
+  io.stdout(flags.json ? pretty({ key: result.key, value: result.value }) : result.value + `
+`);
+};
+
+// apps/cli/update-public-key.txt
+var update_public_key_default = "";
+
+// apps/cli/src/prompt.ts
+import { readSync } from "node:fs";
+function confirmOnStderr(question) {
+  process.stderr.write(`${question} [y/N] `);
+  const byte = Buffer.alloc(1);
+  let line = "";
+  try {
+    while (readSync(0, byte, 0, 1, null) === 1 && byte.readUInt8(0) !== 10)
+      line += String.fromCharCode(byte.readUInt8(0));
+  } catch {
+    return false;
+  }
+  return /^y(es)?$/i.test(line.trim());
+}
+
+// apps/cli/src/update.ts
+import { chmodSync as chmodSync2, readFileSync as readFileSync4, realpathSync, renameSync as renameSync3, rmSync as rmSync2 } from "node:fs";
+import { basename, dirname as dirname3, join as join4 } from "node:path";
+
+// apps/web/src/lib/desktop-version.ts
+var VERSION = /^(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
+function isVersion(value) {
+  return VERSION.test(value);
+}
+function compareVersions(a, b) {
+  const pa = VERSION.exec(a);
+  const pb = VERSION.exec(b);
+  if (!pa || !pb)
+    throw new Error("Versions look like 1.2.3 or 1.2.3-beta.1");
+  for (let i = 1;i <= 3; i++) {
+    const diff = Number(pa[i]) - Number(pb[i]);
+    if (diff !== 0)
+      return diff;
+  }
+  const [preA, preB] = [pa[4], pb[4]];
+  if (preA === preB)
+    return 0;
+  if (preA === undefined)
+    return 1;
+  if (preB === undefined)
+    return -1;
+  const idsA = preA.split(".");
+  const idsB = preB.split(".");
+  for (let i = 0;i < Math.max(idsA.length, idsB.length); i++) {
+    const [x, y] = [idsA[i], idsB[i]];
+    if (x === undefined)
+      return -1;
+    if (y === undefined)
+      return 1;
+    const [nx, ny] = [/^\d+$/.test(x), /^\d+$/.test(y)];
+    if (nx && ny && Number(x) !== Number(y))
+      return Number(x) - Number(y);
+    if (nx !== ny)
+      return nx ? -1 : 1;
+    if (x !== y)
+      return x < y ? -1 : 1;
+  }
+  return 0;
+}
+
+// apps/cli/src/update-verify.ts
+var toHex = (bytes) => Buffer.from(bytes).toString("hex");
+async function verifyDigest(publicKey, digest, signature) {
+  const key = await crypto.subtle.importKey("raw", Buffer.from(publicKey, "base64"), "Ed25519", false, ["verify"]);
+  return crypto.subtle.verify("Ed25519", key, Buffer.from(signature, "base64"), digest);
+}
+
+// apps/cli/src/update.ts
+var FEED_TIMEOUT_MS = 30000;
+var DOWNLOAD_TIMEOUT_MS = 10 * 60000;
+var VERSION_TIMEOUT_MS = 1e4;
+var TARGETS = new Set(["windows-x64", "linux-x64", "linux-arm64", "darwin-x64", "darwin-arm64"]);
+var OS = new Map([
+  ["win32", "windows"],
+  ["linux", "linux"],
+  ["darwin", "darwin"]
+]);
+function platformKey(platform, arch) {
+  const key = `${OS.get(platform)}-${arch}`;
+  return TARGETS.has(key) ? key : undefined;
+}
+var isDevelopmentRun = (execPath) => /^bun(\.exe)?$/i.test(basename(execPath));
+var installedPath = () => realpathSync(process.execPath);
+function isPackageManaged(execPath, env) {
+  if (!isBun || env.SECRET_STORE_PACKAGE_MANAGED === "1")
+    return true;
+  try {
+    const manifest = JSON.parse(readFileSync4(join4(dirname3(realpathSync(execPath)), "..", "package.json"), "utf8"));
+    return isRecord(manifest) && typeof manifest.name === "string" && /^@secretstore\/cli-(?:windows-x64|linux-(?:x64|arm64)|darwin-(?:x64|arm64))$/.test(manifest.name);
+  } catch {
+    return false;
+  }
+}
+var aside = (execPath) => `${execPath}.old`;
+function removeStale(execPath) {
+  if (isDevelopmentRun(execPath) || isPackageManaged(execPath, process.env))
+    return;
+  try {
+    rmSync2(aside(realpathSync(execPath)), { force: true });
+  } catch {}
+}
+var plain = (text) => text.replaceAll(/(?![\n\t])\p{Cc}/gu, "");
+var unreachable2 = (origin, error) => new CliError(`Cannot reach ${origin}: ${error instanceof Error ? error.message : String(error)}`);
+async function fetchRelease(origin, fetcher) {
+  let response;
+  try {
+    response = await fetcher(`${origin}/api/cli/latest`, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(FEED_TIMEOUT_MS) });
+  } catch (error) {
+    throw unreachable2(origin, error);
+  }
+  const body = await response.json().catch(() => {
+    return;
+  });
+  if (response.status === 404 && isRecord(body) && body.code === "not_found")
+    return;
+  if (!response.ok)
+    throw new CliError(`The update feed at ${origin} answered HTTP ${response.status}`);
+  if (!isRecord(body) || typeof body.version !== "string" || !isVersion(body.version) || !isRecord(body.platforms)) {
+    throw new CliError("The update feed is not in the format this version of the CLI reads");
+  }
+  return { version: body.version, notes: typeof body.notes === "string" ? plain(body.notes) : "", platforms: body.platforms };
+}
+function assetFor(release, key) {
+  const asset = Object.hasOwn(release.platforms, key) ? release.platforms[key] : undefined;
+  if (asset === undefined)
+    throw new CliError(`Version ${release.version} has no build for ${key}`);
+  if (!isRecord(asset) || typeof asset.size !== "number" || !Number.isSafeInteger(asset.size) || asset.size <= 0)
+    throw new CliError("The update feed is not in the format this version of the CLI reads");
+  if (typeof asset.sha256 !== "string" || !/^[0-9a-f]{64}$/.test(asset.sha256) || typeof asset.signature !== "string")
+    throw new CliError("The update feed is not in the format this version of the CLI reads");
+  return { size: asset.size, sha256: asset.sha256, signature: asset.signature };
+}
+async function download(url, path, size, fetcher) {
+  let response;
+  try {
+    response = await fetcher(url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) });
+  } catch (error) {
+    throw unreachable2(new URL(url).origin, error);
+  }
+  if (!response.ok || !response.body)
+    throw new CliError(`The download answered HTTP ${response.status}`);
+  const hasher = sha256();
+  const sink = await fileWriter(path);
+  let received = 0;
+  try {
+    for await (const chunk of response.body) {
+      received += chunk.byteLength;
+      if (received > size)
+        throw new CliError("The download is larger than the server announced; nothing was installed");
+      hasher.update(chunk);
+      await sink.write(chunk);
+    }
+  } finally {
+    await sink.end();
+  }
+  if (received !== size)
+    throw new CliError(`The download is ${received} bytes, not the ${size} the server announced; nothing was installed`);
+  return hasher.digest();
+}
+async function replaceExecutable(execPath, next, expected, versionOf) {
+  const old = aside(execPath);
+  chmodSync2(next, 493);
+  rmSync2(old, { force: true });
+  renameSync3(execPath, old);
+  try {
+    renameSync3(next, execPath);
+    const reported = await versionOf(execPath);
+    if (reported !== expected)
+      throw new CliError(`it reports ${JSON.stringify(reported)}, not ${expected}`);
+  } catch (error) {
+    const why = error instanceof Error ? error.message : String(error);
+    try {
+      rmSync2(execPath, { force: true });
+      renameSync3(old, execPath);
+    } catch {
+      throw new CliError(`The new binary failed its version check (${why}) and the previous one could not be put back: it is at ${old}`);
+    }
+    throw new CliError(`The new binary failed its version check (${why}); the previous version was put back`);
+  }
+  try {
+    rmSync2(old, { force: true });
+  } catch {}
+}
+async function spawnVersion(path) {
+  const { text, code } = await capture([path, "version"], VERSION_TIMEOUT_MS);
+  if (code !== 0)
+    throw new CliError(`it exited with ${code}`);
+  return text.trim();
+}
+async function runUpdate({ io, flags, args }, deps) {
+  if (args.length > 0)
+    throw usage("update");
+  if (isPackageManaged(deps.execPath, io.env)) {
+    const tag = deps.version.includes("-") ? "next" : "latest";
+    const message = `Package-managed installation. Update with bun add --global @secretstore/cli@${tag} or npm install --global @secretstore/cli@${tag}; for a local dependency, omit --global.`;
+    io.stdout(flags.json ? JSON.stringify({ updated: false, managed: true, message }) + `
+` : `${message}
+`);
+    return 0;
+  }
+  if (isDevelopmentRun(deps.execPath))
+    throw new CliError("update replaces the installed binary; this is a development run", EXIT.usage);
+  if (!flags.check && !deps.publicKey)
+    throw new CliError("this build has no update key; build with apps/cli/update-public-key.txt set");
+  const origin = resolveUrl(flags.url, io.env);
+  const say = (text) => {
+    if (!flags.json)
+      io.stdout(`${text}
+`);
+  };
+  const release = await fetchRelease(origin, deps.fetcher);
+  const order = release ? compareVersions(release.version, deps.version) : 0;
+  if (flags.check) {
+    if (flags.json) {
+      io.stdout(JSON.stringify({ current: deps.version, available: release?.version ?? null, updateAvailable: order > 0, notes: order > 0 ? release?.notes : undefined }) + `
+`);
+    } else {
+      io.stdout(`current: ${deps.version}
+available: ${release?.version ?? "none"}
+`);
+      io.stdout(order > 0 ? `${release?.notes ? `
+${release.notes}
+
+` : ""}Run "secretstore update" to install it.
+` : `up to date
+`);
+    }
+    return 0;
+  }
+  const unchanged = (text) => {
+    io.stdout(flags.json ? JSON.stringify({ updated: false, current: deps.version, available: release?.version ?? null }) + `
+` : `${text}
+`);
+    return 0;
+  };
+  if (!release)
+    return unchanged(`No release is published on ${origin}; ${deps.version} is up to date.`);
+  if (order < 0)
+    throw new CliError(`${origin} offers ${release.version}, which is older than ${deps.version}; refusing to downgrade`);
+  if (order === 0)
+    return unchanged(`${deps.version} is up to date.`);
+  const key = platformKey(deps.platform, deps.arch);
+  if (!key)
+    throw new CliError(`There is no build of secretstore for ${deps.platform} ${deps.arch}`);
+  const asset = assetFor(release, key);
+  say(`Update available: ${deps.version} -> ${release.version} (${key}, ${(asset.size / 1e6).toFixed(1)} MB)`);
+  if (release.notes)
+    say(`
+${release.notes}
+`);
+  if (!flags.yes) {
+    if (!deps.interactive)
+      throw new CliError("Not a terminal, so there is nobody to ask: pass --yes to update without asking", EXIT.usage);
+    if (!deps.confirm(`Install ${release.version}?`)) {
+      say("Cancelled.");
+      return EXIT.error;
+    }
+  }
+  const next = `${deps.execPath}.new`;
+  try {
+    const digest = await download(`${origin}/api/cli/download/${encodeURIComponent(key)}/${encodeURIComponent(release.version)}`, next, asset.size, deps.fetcher);
+    if (toHex(digest) !== asset.sha256)
+      throw new CliError("The download does not match the checksum the server published; nothing was installed");
+    if (!await verifyDigest(deps.publicKey, digest, asset.signature))
+      throw new CliError("the update is not signed by the key this build trusts");
+    await replaceExecutable(deps.execPath, next, release.version, deps.versionOf);
+  } finally {
+    rmSync2(next, { force: true });
+  }
+  if (flags.json)
+    io.stdout(JSON.stringify({ updated: true, from: deps.version, to: release.version }) + `
+`);
+  else
+    io.stdout(`Updated secretstore ${deps.version} -> ${release.version}.
+`);
+  return 0;
+}
+
+// apps/cli/src/commands/update.ts
+var update = (ctx) => runUpdate(ctx, {
+  version: package_default.version,
+  execPath: installedPath(),
+  platform: process.platform,
+  arch: process.arch,
+  publicKey: update_public_key_default.trim(),
+  fetcher: fetch,
+  versionOf: spawnVersion,
+  interactive: Boolean(process.stdin.isTTY),
+  confirm: confirmOnStderr
+});
+
+// apps/cli/src/commands/write.ts
+var set = async ({ args, client, flags, io }) => {
+  const { project, environment, rest } = targetFor({ io, flags }, args, { environment: true, need: 1, write: true });
+  const [key, given] = rest;
+  if (key === undefined || rest.length > 2)
+    throw usage("set");
+  let value;
+  if (given === undefined || given === "-") {
+    value = (await io.readStdin()).replace(/\r?\n$/, "");
+  } else {
+    io.stderr(`warning: a value on the command line stays in your shell history and is visible to other processes; pass - to read it from stdin
+`);
+    value = given;
+  }
+  const result = firstJson(await client.call(TOOLS.setSecret, { project, environment, key, value }));
+  io.stdout(flags.json ? JSON.stringify(result, null, 2) + `
+` : `${result.created ? "Created" : "Updated"} ${result.key} in ${project}/${environment} (version ${result.version})
+`);
+};
+var del = async ({ args, client, flags, io }) => {
+  const { project, environment, rest } = targetFor({ io, flags }, args, { environment: true, need: 1, write: true });
+  const [key] = rest;
+  if (key === undefined || rest.length > 1)
+    throw usage("delete");
+  const result = firstJson(await client.call(TOOLS.deleteSecret, { project, environment, key }));
+  io.stdout(flags.json ? JSON.stringify(result, null, 2) + `
+` : `Deleted ${result.key} from ${project}/${environment}
+`);
+};
+
+// apps/cli/src/session.ts
+var REFRESH_MARGIN_MS = 60000;
+var signIn = (reason) => new CliError(`${reason} Run "secretstore login" to sign in.`, EXIT.auth);
+async function refreshLogin(store, name, stale, now, fetcher = fetch) {
+  const stored = await store.get(name);
+  if (!stored)
+    throw signIn("Not signed in any more.");
+  if (stored.accessToken !== stale.accessToken && stored.expiresAt - now() > REFRESH_MARGIN_MS)
+    return stored;
+  let grant;
+  try {
+    grant = await refreshGrant(stored, now(), fetcher);
+  } catch (error) {
+    if (!(error instanceof OAuthError && error.oauthCode === "invalid_grant"))
+      throw error;
+    const latest = await store.get(name);
+    if (latest && latest.refreshToken !== stored.refreshToken)
+      return latest;
+    await store.remove(name);
+    throw signIn("Your login expired or was revoked.");
+  }
+  const next = { ...stored, accessToken: grant.accessToken, refreshToken: grant.refreshToken, expiresAt: grant.expiresAt, scope: grant.scope || stored.scope };
+  await store.set(name, next);
+  return next;
+}
+function loginSession(store, name, login, now, fetcher) {
+  let current = login;
+  const endpoint = mcpEndpoint(login.issuer);
+  const renew = async () => {
+    current = await refreshLogin(store, name, current, now, fetcher);
+  };
+  return {
+    via: "login",
+    endpoint,
+    async headers() {
+      if (current.expiresAt - now() < REFRESH_MARGIN_MS)
+        await renew();
+      const proof = await dpopProof(current.key, { htm: "POST", htu: endpoint, accessToken: current.accessToken, nowMs: now() });
+      return { authorization: `DPoP ${current.accessToken}`, dpop: proof };
+    },
+    renew
+  };
+}
+async function openSession(io, flags) {
+  const origin = resolveUrl(flags.url, io.env);
+  const given = resolveToken(flags.token, io.env);
+  if (given)
+    return { via: given.via, endpoint: mcpEndpoint(origin), headers: async () => ({ authorization: `Bearer ${given.token}` }) };
+  const store = openKeystore(io.env, io.stderr);
+  const login = await store.get(origin);
+  if (!login)
+    throw new CliError('Not signed in. Run "secretstore login", or export SECRET_STORE_TOKEN for a personal token.', EXIT.auth);
+  return loginSession(store, origin, login, io.now);
+}
+
+// apps/cli/src/main.ts
+var COMMANDS = {
+  login,
+  logout,
+  whoami,
+  projects,
+  envs,
+  init,
+  get,
+  set,
+  delete: del,
+  push,
+  pull,
+  export: exportEnv,
+  run,
+  "request-access": requestAccess,
+  doctor,
+  completion,
+  update,
+  "keystore-selftest": keystoreSelftest
+};
+async function main(argv, io) {
+  let json = false;
+  try {
+    const { command, args, rest, flags } = parseArgs(argv);
+    json = flags.json;
+    if (command === "version") {
+      io.stdout(json ? JSON.stringify({ version: package_default.version }) + `
+` : package_default.version + `
+`);
+      return 0;
+    }
+    if (command === "help" || !command && flags.help) {
+      io.stdout(HELP);
+      return 0;
+    }
+    if (!command) {
+      io.stderr(HELP);
+      return EXIT.usage;
+    }
+    if (!Object.hasOwn(COMMANDS, command))
+      throw new CliError(`Unknown command "${command}". Run "secretstore help".`, EXIT.usage);
+    if (flags.help) {
+      io.stdout(`usage: ${USAGE[command] ?? `secretstore ${command}`}
+`);
+      return 0;
+    }
+    let client;
+    const ctx = {
+      io,
+      flags,
+      args,
+      rest,
+      get client() {
+        client ??= createClient(() => openSession(io, flags));
+        return client;
+      }
+    };
+    return await COMMANDS[command]?.(ctx) ?? 0;
+  } catch (error) {
+    const failure = error instanceof CliError ? error : new CliError(error instanceof Error ? error.message : String(error));
+    io.stderr(json ? JSON.stringify({ error: failure.message }) + `
+` : `${red("error:", io.color)} ${failure.message}
+`);
+    return failure.code;
+  }
+}
+
+// apps/cli/src/index.ts
+removeStale(process.execPath);
+process.exitCode = await main(process.argv.slice(2), {
+  env: process.env,
+  cwd: process.cwd(),
+  stdout: (text) => void process.stdout.write(text),
+  stderr: (text) => void process.stderr.write(text),
+  readStdin: readAllStdin,
+  color: colorEnabled(process.env, process.stderr.isTTY),
+  openUrl: openInBrowser,
+  now: Date.now,
+  sleep,
+  isTty: process.stdout.isTTY === true,
+  confirm: process.stdin.isTTY ? confirmOnStderr : undefined
+});