@spendgraph/cli 0.2.0

package/dist/context.js

@@ -0,0 +1,89 @@
+import { readFileSync } from "node:fs";
+import { UsageError } from "./errors.js";
+/** Builds the `Ctx` a command runs against. `sg` is null for a command that stays local. */
+export function context(sg, parsed, positional, loaded) {
+    const flag = (name) => {
+        const value = parsed.flags[name];
+        return typeof value === "string" ? value : undefined;
+    };
+    const ctx = {
+        loaded,
+        get sg() {
+            if (!sg)
+                throw new UsageError("That command does not reach the API.");
+            return sg;
+        },
+        parsed,
+        arg: (index) => positional[index],
+        need(index, name) {
+            const value = positional[index];
+            if (value === undefined)
+                throw new UsageError(`Missing <${name}>.`);
+            return value;
+        },
+        flag,
+        bool: (name) => parsed.flags[name] === true || parsed.flags[name] === "true",
+        num(name) {
+            const raw = flag(name);
+            if (raw === undefined)
+                return undefined;
+            const value = Number(raw);
+            if (!Number.isFinite(value))
+                throw new UsageError(`--${name} must be a number.`);
+            return value;
+        },
+        list(name) {
+            const raw = flag(name);
+            return raw === undefined ? undefined : raw.split(",").map((one) => one.trim());
+        },
+        project() {
+            const id = flag("project") ?? loaded.env.SPENDGRAPH_PROJECT;
+            if (!id) {
+                throw new UsageError("Set --project or SPENDGRAPH_PROJECT, or put projectId in --file.");
+            }
+            return id;
+        },
+        scope() {
+            const id = flag("project") ?? loaded.env.SPENDGRAPH_PROJECT;
+            return id ? { project: id } : {};
+        },
+        body(fromFlags) {
+            const base = fileBody(flag("file"));
+            const given = Object.fromEntries(Object.entries(fromFlags).filter(([, value]) => value !== undefined));
+            return { ...base, ...given };
+        },
+    };
+    return ctx;
+}
+function fileBody(path) {
+    if (!path)
+        return {};
+    let text;
+    try {
+        text = readFileSync(path, "utf8");
+    }
+    catch {
+        throw new UsageError(`Could not read --file ${path}.`);
+    }
+    try {
+        const parsed = JSON.parse(text);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error("not an object");
+        }
+        return parsed;
+    }
+    catch {
+        throw new UsageError(`--file ${path} is not a JSON object.`);
+    }
+}
+/**
+ * A save body with its `projectId` settled.
+ *
+ * `--file` carrying one is enough on its own, so a definition checked into a
+ * repo applies without the project being named twice.
+ */
+export function scoped(ctx, body) {
+    return typeof body.projectId === "string" && body.projectId
+        ? body
+        : { ...body, projectId: ctx.project() };
+}

package/dist/env.d.ts

@@ -0,0 +1,42 @@
+/** The environment the credentials are read from. */
+export type Env = Record<string, string | undefined>;
+/**
+ * Parses a `.env`: `KEY=value`, one per line.
+ *
+ * `export` prefixes, `#` comments, blank lines and surrounding quotes are all
+ * accepted, because every one of them appears in a file somebody wrote by hand.
+ */
+export declare function parseEnv(text: string): Env;
+/** The nearest `.env` at or above `from`, or undefined where there is none. */
+export declare function findEnvFile(from: string): string | undefined;
+/** Which layer a value came from. */
+export type Source = "environment" | ".env" | "config";
+/** Where the values came from, so `config show` can say. */
+export interface Loaded {
+    env: Env;
+    /** The `.env` that was read, where one was found. */
+    file?: string;
+    /** The global config that was read, where it exists. */
+    config?: string;
+    source: Record<string, Source>;
+}
+/** What `loadEnv` layers under the real environment. */
+export interface Layers {
+    cwd: string;
+    base: Env;
+    /** `--env-file`, which replaces the upward search. */
+    explicit?: string;
+    /** The global config file, read last and beaten by everything. */
+    store?: {
+        path: string;
+        values: Env;
+    };
+}
+/**
+ * The environment a command runs against, layered.
+ *
+ * Highest wins: the real environment, then the nearest `.env`, then the global
+ * config. A variable already exported is never quietly overruled by a file, and
+ * a project's `.env` beats a global default the same way a local git config does.
+ */
+export declare function loadEnv(layers: Layers): Loaded;

package/dist/env.js

@@ -0,0 +1,69 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { UsageError } from "./errors.js";
+const QUOTED = /^(['"])([\s\S]*)\1$/;
+/**
+ * Parses a `.env`: `KEY=value`, one per line.
+ *
+ * `export` prefixes, `#` comments, blank lines and surrounding quotes are all
+ * accepted, because every one of them appears in a file somebody wrote by hand.
+ */
+export function parseEnv(text) {
+    const out = {};
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim().replace(/^export\s+/, "");
+        if (!line || line.startsWith("#"))
+            continue;
+        const at = line.indexOf("=");
+        if (at < 1)
+            continue;
+        const key = line.slice(0, at).trim();
+        const value = line.slice(at + 1).trim();
+        const quoted = QUOTED.exec(value);
+        out[key] = quoted ? quoted[2] : value.replace(/\s+#.*$/, "");
+    }
+    return out;
+}
+/** The nearest `.env` at or above `from`, or undefined where there is none. */
+export function findEnvFile(from) {
+    let dir = resolve(from);
+    for (;;) {
+        const candidate = join(dir, ".env");
+        if (existsSync(candidate))
+            return candidate;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+}
+/**
+ * The environment a command runs against, layered.
+ *
+ * Highest wins: the real environment, then the nearest `.env`, then the global
+ * config. A variable already exported is never quietly overruled by a file, and
+ * a project's `.env` beats a global default the same way a local git config does.
+ */
+export function loadEnv(layers) {
+    const { cwd, base, explicit, store } = layers;
+    const file = explicit ? resolve(explicit) : findEnvFile(cwd);
+    if (explicit && !existsSync(explicit))
+        throw new UsageError(`No such --env-file ${explicit}.`);
+    const dotenv = file ? parseEnv(readFileSync(file, "utf8")) : {};
+    const stored = store?.values ?? {};
+    const source = {};
+    for (const key of Object.keys(stored))
+        source[key] = "config";
+    for (const key of Object.keys(dotenv))
+        source[key] = ".env";
+    for (const key of Object.keys(base)) {
+        if (base[key] !== undefined)
+            source[key] = "environment";
+    }
+    return {
+        env: { ...stored, ...dotenv, ...base },
+        ...(file ? { file } : {}),
+        ...(store && Object.keys(stored).length ? { config: store.path } : {}),
+        source,
+    };
+}

package/dist/errors.d.ts

@@ -0,0 +1,3 @@
+/** A message meant for the user rather than a stack trace. */
+export declare class UsageError extends Error {
+}

package/dist/errors.js

@@ -0,0 +1,3 @@
+/** A message meant for the user rather than a stack trace. */
+export class UsageError extends Error {
+}

package/dist/help.d.ts

@@ -0,0 +1,5 @@
+import type { Group } from "./types.js";
+/** What `sg` alone prints: the groups, and how to prove who you are. */
+export declare function overview(): string;
+/** What `sg <group>` prints. */
+export declare function groupHelp(group: Group): string;

package/dist/help.js

@@ -0,0 +1,38 @@
+import { GROUPS } from "./registry.js";
+const pad = (text, width) => text.padEnd(width);
+/** What `sg` alone prints: the groups, and how to prove who you are. */
+export function overview() {
+    const width = Math.max(...GROUPS.map((group) => group.name.length));
+    return [
+        "sg — drive the spendgraph dashboard from a terminal",
+        "",
+        "Usage: sg <group> <command> [args] [flags]",
+        "",
+        "Groups:",
+        ...GROUPS.map((group) => `  ${pad(group.name, width)}  ${group.summary}`),
+        "",
+        "Credentials:",
+        "  SPENDGRAPH_BASE_URL   where your app is deployed",
+        "  SPENDGRAPH_API_KEY    an sg_ key: prompts, tools, usage and stats",
+        "  SPENDGRAPH_SESSION    a dashboard session: keys, projects, pricing, credentials",
+        "  SPENDGRAPH_PROJECT    the default --project",
+        "",
+        "Flags on every command:",
+        "  --file <path>  a JSON body; flags given alongside it win",
+        "  --json         print the reply as JSON rather than a table",
+        "  --project <id> the project to act in",
+        "",
+        "Run `sg <group>` to list its commands.",
+    ].join("\n");
+}
+/** What `sg <group>` prints. */
+export function groupHelp(group) {
+    const width = Math.max(...group.commands.map((command) => command.name.length));
+    return [
+        `sg ${group.name} — ${group.summary}`,
+        "",
+        ...group.commands.map((command) => `  ${pad(command.name, width)}  ${command.summary}${command.usage
+            ? `\n  ${pad("", width)}  usage: sg ${group.name} ${command.name} ${command.usage}`
+            : ""}`),
+    ].join("\n");
+}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { main } from "./cli.js";
+const code = await main(process.argv.slice(2), {
+    out: (text) => process.stdout.write(`${text}\n`),
+    err: (text) => process.stderr.write(`${text}\n`),
+}, { cwd: process.cwd() });
+process.exitCode = code;

package/dist/output.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Renders a reply for a terminal, or as JSON where `--json` asked for it.
+ *
+ * A list of flat rows becomes a table because that is what a person reads;
+ * anything else stays JSON rather than being flattened into a shape that hides
+ * a nested field.
+ */
+export declare function render(value: unknown, json: boolean): string;

package/dist/output.js

@@ -0,0 +1,56 @@
+const MAX_CELL = 48;
+const isRow = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+function rows(value) {
+    if (Array.isArray(value))
+        return value.every(isRow) ? value : undefined;
+    if (!isRow(value))
+        return undefined;
+    const arrays = Object.values(value).filter(Array.isArray);
+    if (arrays.length !== 1)
+        return undefined;
+    const only = arrays[0];
+    return only.every(isRow) ? only : undefined;
+}
+function cell(value) {
+    if (value === null || value === undefined)
+        return "";
+    const text = typeof value === "object" ? JSON.stringify(value) : String(value);
+    const flat = text.replace(/\s+/g, " ");
+    return flat.length > MAX_CELL ? `${flat.slice(0, MAX_CELL - 1)}…` : flat;
+}
+const MAX_COLUMNS = 8;
+const blob = (list, column) => list.some((row) => typeof row[column] === "object" && row[column] !== null);
+function table(list) {
+    const every = [...new Set(list.flatMap((row) => Object.keys(row)))];
+    const readable = every.filter((column) => !blob(list, column));
+    const columns = (readable.length ? readable : every).slice(0, MAX_COLUMNS);
+    const hidden = every.length - columns.length;
+    const widths = columns.map((column) => Math.max(column.length, ...list.map((row) => cell(row[column]).length)));
+    const line = (cells) => cells
+        .map((text, i) => text.padEnd(widths[i]))
+        .join("  ")
+        .trimEnd();
+    return [
+        line(columns),
+        line(widths.map((width) => "-".repeat(width))),
+        ...list.map((row) => line(columns.map((column) => cell(row[column])))),
+        ...(hidden > 0 ? [`(${hidden} more ${hidden === 1 ? "column" : "columns"} — use --json)`] : []),
+    ].join("\n");
+}
+/**
+ * Renders a reply for a terminal, or as JSON where `--json` asked for it.
+ *
+ * A list of flat rows becomes a table because that is what a person reads;
+ * anything else stays JSON rather than being flattened into a shape that hides
+ * a nested field.
+ */
+export function render(value, json) {
+    if (json)
+        return JSON.stringify(value, null, 2);
+    const list = rows(value);
+    if (list?.length)
+        return table(list);
+    if (list)
+        return "(none)";
+    return typeof value === "string" ? value : JSON.stringify(value, null, 2);
+}

package/dist/registry.d.ts

@@ -0,0 +1,7 @@
+import type { Command, Group } from "./types.js";
+/** Every group the CLI offers, in the order help lists them. */
+export declare const GROUPS: Group[];
+/** The group by that name, or undefined. */
+export declare const groupNamed: (name: string) => Group | undefined;
+/** The command by that name within a group, or undefined. */
+export declare const commandNamed: (group: Group, name: string) => Command | undefined;

package/dist/registry.js

@@ -0,0 +1,12 @@
+import { config } from "./commands/config.js";
+import { credentials, keys, pricing, projects, spend } from "./commands/dashboard.js";
+import { prompts } from "./commands/prompts.js";
+import { skillCommands } from "./commands/skills.js";
+import { tools } from "./commands/tools.js";
+const RESOURCES = [prompts, tools, projects, keys, credentials, pricing, spend, config];
+/** Every group the CLI offers, in the order help lists them. */
+export const GROUPS = [...RESOURCES, skillCommands(RESOURCES)];
+/** The group by that name, or undefined. */
+export const groupNamed = (name) => GROUPS.find((group) => group.name === name);
+/** The command by that name within a group, or undefined. */
+export const commandNamed = (group, name) => group.commands.find((command) => command.name === name);

package/dist/skills.d.ts

@@ -0,0 +1,11 @@
+import type { Group } from "./types.js";
+/** An agent skill: the frontmatter that decides when it loads, and the body it loads. */
+export interface Skill {
+    name: string;
+    description: string;
+    body: string;
+}
+/** The skills this CLI ships, with the command reference rendered from the live registry. */
+export declare const catalogue: (groups: Group[]) => Skill[];
+/** One skill as the SKILL.md file an agent loads. */
+export declare const document: (skill: Skill) => string;

package/dist/skills.js

@@ -0,0 +1,200 @@
+const AUTH = `## Credentials
+
+Resolved in layers, highest first: a \`--flag\`, then the exported environment,
+then the nearest \`.env\` searching upward from the working directory, then the
+global config at \`~/.config/spendgraph/config.json\`.
+
+\`\`\`sh
+sg config set --base-url https://… --api-key sg_…   # keep them globally, once
+sg config show                                       # what is in effect, and from which layer
+sg config reaches                                    # which groups those credentials open
+\`\`\`
+
+Once the global config is set, no \`.env\` and no exports are needed anywhere. A
+project that wants different credentials puts them in its own \`.env\`, which
+beats the global config the way a local git config does.
+
+| variable | what it opens |
+| --- | --- |
+| \`SPENDGRAPH_BASE_URL\` | required, always |
+| \`SPENDGRAPH_API_KEY\` | reading prompts, tools, stats and events; writing usage |
+| \`SPENDGRAPH_SESSION\` | everything else, including **every write to a prompt or a tool** |
+| \`SPENDGRAPH_PROJECT\` | the default \`--project\` |
+
+**Reading is not writing.** An \`sg_\` key lists and gets prompts and tools, but
+\`prompt create\`, \`prompt update\`, \`prompt promote\`, \`tool create\` and
+\`tool update\` all call a route that requires a signed-in session, as does
+everything under \`key\`, \`project\`, \`pricing\` and \`credential\`. Run
+\`sg config reaches\` for the split on the credentials actually in effect.
+
+There is no API-key path to the session half and adding one is not wanted:
+\`credential\` holds provider keys and \`key\` mints API keys. A 401 there means the
+session is missing, not that the command was wrong. Do not retry it and do not
+look for a way around it — say what is missing.`;
+const EXITS = `## Exit codes
+
+| | |
+| --- | --- |
+| 0 | the server answered |
+| 1 | the server refused |
+| 2 | the command line was wrong, and **nothing was sent** |
+
+A 2 never reached the network, so retrying it unchanged will fail identically.
+Fix the line instead. A 1 is worth reading: the message carries the server's own
+code.`;
+const reference = (groups) => groups
+    .map((group) => [
+    `### ${group.name} — ${group.summary}`,
+    "",
+    ...group.commands.map((command) => `- \`sg ${group.name} ${command.name}${command.usage ? ` ${command.usage}` : ""}\` — ${command.summary}`),
+].join("\n"))
+    .join("\n\n");
+const operating = (groups) => ({
+    name: "spendgraph-cli",
+    description: "Drive the spendgraph dashboard from a terminal with the `sg` CLI: stored prompts, tools, projects, API keys, provider credentials, model pricing and spend. Use when asked to read or change anything in spendgraph rather than in application code.",
+    body: `# Driving spendgraph with \`sg\`
+
+\`sg\` is a front-end over \`@spendgraph/sdk\`. Every command is one API call.
+
+\`\`\`sh
+sg                      # the groups
+sg <group>              # a group's commands, with usage
+sg <group> <command> --help
+\`\`\`
+
+${AUTH}
+
+## Flags, and \`--file\`
+
+Simple fields are flags. Anything structured — a prompt's \`blocks\`, a tool's
+\`args\`, a dataset — goes in \`--file\`, which takes a path to a JSON object.
+
+A flag given alongside \`--file\` wins. That is the efficient way to change one
+field of a stored definition without restating the rest:
+
+\`\`\`sh
+sg tool create --file ./tools/deeprecall.json --description "Searches the KB"
+\`\`\`
+
+\`projectId\` inside the file is enough on its own; pass \`--project\` only when the
+file does not carry one.
+
+## Reading the output
+
+A list of flat rows prints as a table. **Pass \`--json\` whenever you intend to
+parse the result** — the table truncates long cells and drops nested fields,
+so parsing it will lose data:
+
+\`\`\`sh
+sg tool list --json | jq '.tools[] | select(.effect == "destructive") | .name'
+\`\`\`
+
+${EXITS}
+
+## Working efficiently
+
+- \`sg <group>\` is cheap and local. Read it before guessing a command name.
+- Set \`SPENDGRAPH_PROJECT\` once rather than passing \`--project\` every time.
+- Prefer one \`--file\` over many flags when writing a whole definition; prefer
+  flags over editing a file when changing one field.
+- \`sg spend summary\` before \`sg spend events\`: the totals answer most questions
+  without paging through rows.
+- Nothing here runs a model except \`sg prompt run\` and \`sg spend playground\`.
+  Every other command only reads or writes records, so it costs nothing.
+
+## Every command
+
+${reference(groups)}
+`,
+});
+const authoring = () => ({
+    name: "spendgraph-prompt-authoring",
+    description: "Write, version and promote spendgraph stored prompts, and declare the tools a model may call, using the `sg` CLI and JSON definition files. Use when creating a new prompt or tool, changing an existing one, or promoting a prompt version to current.",
+    body: `# Authoring prompts and tools with \`sg\`
+
+Both a prompt and a tool are a JSON object sent to a save route. Keep the object
+in a file under version control and let \`sg\` apply it; that way the definition
+has a history and the command line stays short.
+
+## A prompt definition
+
+\`\`\`json
+{
+  "projectId": "prj_…",
+  "name": "decompose",
+  "blocks": [
+    { "role": "system", "content": "You are a stage." },
+    { "role": "user", "content": "{question}" }
+  ],
+  "models": ["claude-sonnet-5"],
+  "temperature": 0,
+  "maxTokens": 2048
+}
+\`\`\`
+
+Every prompt takes its request through \`{question}\`. Any other \`{name}\` is a
+variable you must supply when the prompt is rendered or run.
+
+\`\`\`sh
+sg prompt create --file ./prompts/decompose.json
+sg prompt update pr_123 --file ./prompts/decompose.json   # writes a new version
+sg prompt versions pr_123
+sg prompt promote pr_123 pv_456                            # make one current
+sg prompt publish pr_123
+\`\`\`
+
+\`update\` writes a version; it does not make it current. **Promote is a separate
+step**, and unchanged text is a no-op rather than a fork.
+
+## A tool definition
+
+\`\`\`json
+{
+  "projectId": "prj_…",
+  "name": "deeprecall",
+  "description": "Searches the knowledge base and answers from it.",
+  "args": [
+    { "name": "question", "type": "string", "required": true }
+  ],
+  "effect": "readonly"
+}
+\`\`\`
+
+\`effect\` is one of \`readonly\`, \`idempotent\`, \`destructive\`. The description is
+what the model reads when it decides whether to call the tool, so write it for
+that reader: say what it returns and when it is the right choice, not how it is
+implemented.
+
+\`\`\`sh
+sg tool create --file ./tools/deeprecall.json
+sg tool update tl_123 --description "Searches the knowledge base."
+sg tool archive tl_123          # out of the list; --no-archived brings it back
+\`\`\`
+
+For a tool with no structured arguments, \`--arg\` avoids a file entirely. It is
+\`name:type\` or \`name:type:required\`, comma-separated for more than one:
+
+\`\`\`sh
+sg tool create --name deeprecall --description "Searches the KB." \\
+  --effect readonly --arg question:string:required
+\`\`\`
+
+Anything richer — an enum, a per-argument description — needs \`--file\`.
+
+## Checking the result
+
+\`\`\`sh
+sg prompt get pr_123 --json          # the current version
+sg prompt rollouts pr_123            # what it has been run for, and the cost
+sg prompt cases pr_123               # the evaluation dataset
+sg prompt put-cases pr_123 --file ./cases.json
+\`\`\`
+
+\`put-cases\` **replaces** the dataset rather than adding to it. Read \`cases\`
+first if you mean to append.
+`,
+});
+/** The skills this CLI ships, with the command reference rendered from the live registry. */
+export const catalogue = (groups) => [operating(groups), authoring()];
+/** One skill as the SKILL.md file an agent loads. */
+export const document = (skill) => `---\nname: ${skill.name}\ndescription: ${skill.description}\n---\n\n${skill.body}`;

package/dist/store.d.ts

@@ -0,0 +1,15 @@
+import type { Env } from "./env.js";
+/** The variables the global config may hold. Nothing else is written. */
+export declare const SETTABLE: readonly ["SPENDGRAPH_BASE_URL", "SPENDGRAPH_API_KEY", "SPENDGRAPH_SESSION", "SPENDGRAPH_PROJECT"];
+export type Settable = (typeof SETTABLE)[number];
+/** Where the global config lives: `$XDG_CONFIG_HOME/spendgraph/config.json`, or under `~/.config`. */
+export declare function storePath(env?: Env): string;
+/** What the global config holds, or nothing where there is no file. */
+export declare function readStore(path: string): Env;
+/**
+ * Writes the global config, readable only by its owner.
+ *
+ * It holds an API key, so the mode is set after the write as well as during it —
+ * an existing file keeps whatever mode it already had otherwise.
+ */
+export declare function writeStore(path: string, values: Env): string;

package/dist/store.js

@@ -0,0 +1,47 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { UsageError } from "./errors.js";
+/** The variables the global config may hold. Nothing else is written. */
+export const SETTABLE = [
+    "SPENDGRAPH_BASE_URL",
+    "SPENDGRAPH_API_KEY",
+    "SPENDGRAPH_SESSION",
+    "SPENDGRAPH_PROJECT",
+];
+/** Where the global config lives: `$XDG_CONFIG_HOME/spendgraph/config.json`, or under `~/.config`. */
+export function storePath(env = process.env) {
+    const base = env.XDG_CONFIG_HOME || join(env.HOME || homedir(), ".config");
+    return join(base, "spendgraph", "config.json");
+}
+/** What the global config holds, or nothing where there is no file. */
+export function readStore(path) {
+    if (!existsSync(path))
+        return {};
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        throw new UsageError(`${path} is not valid JSON. Fix or delete it.`);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new UsageError(`${path} must hold a JSON object.`);
+    }
+    return Object.fromEntries(Object.entries(parsed)
+        .filter(([key]) => SETTABLE.includes(key))
+        .map(([key, value]) => [key, String(value)]));
+}
+/**
+ * Writes the global config, readable only by its owner.
+ *
+ * It holds an API key, so the mode is set after the write as well as during it —
+ * an existing file keeps whatever mode it already had otherwise.
+ */
+export function writeStore(path, values) {
+    mkdirSync(dirname(path), { recursive: true });
+    const kept = Object.fromEntries(Object.entries(values).filter(([, value]) => value));
+    writeFileSync(path, `${JSON.stringify(kept, null, 2)}\n`, { mode: 0o600 });
+    chmodSync(path, 0o600);
+    return path;
+}