@thisisamank/noenv-cli 0.0.0-stage → 0.1.1

package/dist/noenv.js

@@ -0,0 +1,2062 @@
+#!/usr/bin/env node
+
+// package.json
+var package_default = {
+  name: "@thisisamank/noenv-cli",
+  version: "0.1.1",
+  description: "Encrypted environment variables that load when you cd into a repo. CLI for noenv.",
+  type: "module",
+  bin: {
+    noenv: "dist/noenv.js"
+  },
+  files: [
+    "dist"
+  ],
+  engines: {
+    node: ">=22"
+  },
+  repository: {
+    type: "git",
+    url: "git+https://github.com/thisisamank/noenv.git",
+    directory: "cli"
+  },
+  homepage: "https://github.com/thisisamank/noenv#readme",
+  keywords: [
+    "secrets",
+    "env",
+    "dotenv",
+    "cloudflare",
+    "cli"
+  ],
+  scripts: {
+    build: "esbuild src/main.ts --bundle --platform=node --format=esm --target=node22 --outfile=dist/noenv.js",
+    prepublishOnly: "node ../scripts/check-npm-account.ts && npm run build"
+  },
+  devDependencies: {
+    "@noenv/config": "*",
+    "@noenv/crypto": "*",
+    "@noenv/dotenv": "*",
+    "@noenv/policy": "*",
+    "@noenv/worker": "*",
+    esbuild: "^0.28.2"
+  },
+  publishConfig: {
+    access: "public"
+  }
+};
+
+// src/version.ts
+var CLI_VERSION = package_default.version;
+
+// src/api.ts
+var TIMEOUT_MS = 1e4;
+var ApiError = class extends Error {
+  status;
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+  }
+};
+async function api(deployment, method, path, options = {}) {
+  const headers = { "X-Noenv-Version": CLI_VERSION };
+  if (options.token) headers.Authorization = `Bearer ${options.token}`;
+  if (options.body !== void 0) headers["Content-Type"] = "application/json";
+  const response = await deployment.fetch(deployment.url + path, {
+    method,
+    headers,
+    body: options.body === void 0 ? void 0 : JSON.stringify(options.body),
+    redirect: "manual",
+    signal: AbortSignal.timeout(TIMEOUT_MS)
+  });
+  if (response.status >= 300 && response.status < 400) {
+    throw new ApiError(response.status, `${deployment.url} redirected the request, check that Cloudflare Access does not protect /v1`);
+  }
+  const data = response.status === 204 ? null : await response.json().catch(() => void 0);
+  if (data === void 0) {
+    throw new ApiError(response.status, `${deployment.url} did not return a noenv API response (status ${response.status})`);
+  }
+  if (!response.ok) {
+    throw new ApiError(response.status, data?.error ?? `request failed with status ${response.status}`);
+  }
+  return data;
+}
+function repoPath(repo) {
+  return `/v1/repos/${encodeURIComponent(repo)}`;
+}
+function environmentPath(repo, environment) {
+  return `${repoPath(repo)}/environments/${environment}`;
+}
+
+// src/deployment.ts
+import { homedir } from "node:os";
+import { join } from "node:path";
+function currentDeployment(env = process.env) {
+  if (!env.NOENV_URL) return null;
+  const url = URL.parse(env.NOENV_URL);
+  if (!url || url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new Error("NOENV_URL must be an http or https URL");
+  }
+  const base = env.NOENV_CONFIG_DIR ?? join(env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "noenv");
+  return { url: url.origin, dir: join(base, url.host.replace(":", "_")), fetch: globalThis.fetch };
+}
+
+// src/identity.ts
+import { join as join2 } from "node:path";
+
+// ../packages/crypto/src/encoding.ts
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+function toBytes(text3) {
+  return encoder.encode(text3);
+}
+function fromBytes(bytes) {
+  return decoder.decode(bytes);
+}
+function toBase64(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+function fromBase64(text3) {
+  return Uint8Array.from(atob(text3), (char) => char.charCodeAt(0));
+}
+
+// ../packages/crypto/src/keys.ts
+var ECDH = { name: "ECDH", namedCurve: "P-256" };
+async function generateKeyPair() {
+  return crypto.subtle.generateKey(ECDH, true, ["deriveBits"]);
+}
+async function exportPublicKey(key) {
+  return toBase64(new Uint8Array(await crypto.subtle.exportKey("raw", key)));
+}
+async function importPublicKey(text3) {
+  return crypto.subtle.importKey("raw", fromBase64(text3), ECDH, true, []);
+}
+async function exportPrivateKey(key) {
+  return toBase64(new Uint8Array(await crypto.subtle.exportKey("pkcs8", key)));
+}
+async function importPrivateKey(text3) {
+  return crypto.subtle.importKey("pkcs8", fromBase64(text3), ECDH, true, ["deriveBits"]);
+}
+
+// ../packages/crypto/src/aead.ts
+var AES_GCM = { name: "AES-GCM", length: 256 };
+var IV_BYTES = 12;
+async function seal(key, plaintext, context) {
+  const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
+  const ciphertext = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv, additionalData: context },
+    key,
+    plaintext
+  );
+  return { iv: toBase64(iv), ciphertext: toBase64(new Uint8Array(ciphertext)) };
+}
+async function open(key, sealed, context) {
+  const plaintext = await crypto.subtle.decrypt(
+    { name: "AES-GCM", iv: fromBase64(sealed.iv), additionalData: context },
+    key,
+    fromBase64(sealed.ciphertext)
+  );
+  return new Uint8Array(plaintext);
+}
+
+// ../packages/crypto/src/box.ts
+async function sealTo(recipientPublicKey, plaintext, context) {
+  const ephemeral = await generateKeyPair();
+  const ephemeralPublicKey = await exportPublicKey(ephemeral.publicKey);
+  const key = await deriveKey(ephemeral.privateKey, recipientPublicKey, ephemeralPublicKey, context);
+  return { ...await seal(key, plaintext, context), ephemeralPublicKey };
+}
+async function openWith(recipientPrivateKey, sealed, context) {
+  const ephemeralKey = await importPublicKey(sealed.ephemeralPublicKey);
+  const key = await deriveKey(recipientPrivateKey, ephemeralKey, sealed.ephemeralPublicKey, context);
+  return open(key, sealed, context);
+}
+async function deriveKey(privateKey, publicKey, ephemeralPublicKey, context) {
+  const shared = await crypto.subtle.deriveBits({ name: "ECDH", public: publicKey }, privateKey, 256);
+  const hkdfKey = await crypto.subtle.importKey("raw", shared, "HKDF", false, ["deriveKey"]);
+  return crypto.subtle.deriveKey(
+    { name: "HKDF", hash: "SHA-256", salt: fromBase64(ephemeralPublicKey), info: context },
+    hkdfKey,
+    AES_GCM,
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+
+// ../packages/crypto/src/secrets.ts
+async function encryptSecret(environmentPublicKey, value, context) {
+  return sealTo(environmentPublicKey, toBytes(value), contextBytes(context));
+}
+async function decryptSecret(environmentPrivateKey, sealed, context) {
+  return fromBytes(await openWith(environmentPrivateKey, sealed, contextBytes(context)));
+}
+function contextBytes({ projectId, environment, name: name2 }) {
+  return toBytes(`noenv-secret-v1\0${projectId}\0${environment}\0${name2}`);
+}
+
+// ../packages/crypto/src/wrap.ts
+var WRAP_CONTEXT = toBytes("noenv-key-wrap-v1");
+async function wrapPrivateKey(privateKey, recipientPublicKey) {
+  const pkcs8 = new Uint8Array(await crypto.subtle.exportKey("pkcs8", privateKey));
+  return sealTo(recipientPublicKey, pkcs8, WRAP_CONTEXT);
+}
+async function unwrapPrivateKey(wrapped, recipientPrivateKey) {
+  const pkcs8 = await openWith(recipientPrivateKey, wrapped, WRAP_CONTEXT);
+  return crypto.subtle.importKey("pkcs8", pkcs8, ECDH, true, ["deriveBits"]);
+}
+
+// src/files.ts
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+async function readJsonFile(path) {
+  try {
+    return JSON.parse(await readFile(path, "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+async function writeJsonFile(path, value, flag = "w") {
+  await mkdir(dirname(path), { recursive: true, mode: 448 });
+  await writeFile(path, JSON.stringify(value), { mode: 384, flag });
+}
+async function removeFile(path) {
+  await rm(path, { force: true });
+}
+
+// src/identity.ts
+async function loadIdentity(deployment) {
+  const stored = await readJsonFile(identityPath(deployment));
+  if (!stored) return null;
+  return { publicKey: stored.publicKey, privateKey: await importPrivateKey(stored.privateKey) };
+}
+async function ensureIdentity(deployment, token) {
+  const local = await loadIdentity(deployment);
+  const me = await api(deployment, "GET", "/v1/me", { token });
+  if (local && me.publicKey === local.publicKey) return local;
+  if (me.publicKey) {
+    throw new Error(`your noenv key was registered on another device, copy ${identityPath(deployment)} from that device`);
+  }
+  const identity = local ?? await createIdentity(deployment);
+  await api(deployment, "PUT", "/v1/me/public-key", { token, body: { publicKey: identity.publicKey } });
+  return identity;
+}
+async function createIdentity(deployment) {
+  const pair = await generateKeyPair();
+  const stored = {
+    publicKey: await exportPublicKey(pair.publicKey),
+    privateKey: await exportPrivateKey(pair.privateKey)
+  };
+  await writeJsonFile(identityPath(deployment), stored, "wx");
+  return { publicKey: stored.publicKey, privateKey: pair.privateKey };
+}
+function identityPath(deployment) {
+  return join2(deployment.dir, "identity.json");
+}
+
+// src/session.ts
+import { spawn } from "node:child_process";
+import { hostname } from "node:os";
+import { join as join3 } from "node:path";
+async function loadSession(deployment) {
+  const session = await readJsonFile(sessionPath(deployment));
+  if (!session) return null;
+  return Date.parse(`${session.expiresAt.replace(" ", "T")}Z`) > Date.now() ? session.token : null;
+}
+async function clearSession(deployment) {
+  await removeFile(sessionPath(deployment));
+}
+async function requireSession(deployment) {
+  const token = await loadSession(deployment);
+  if (!token) {
+    throw new Error("you are not signed in, open a new shell or run `noenv auth`");
+  }
+  return token;
+}
+async function startSignIn(deployment) {
+  const existing = await readJsonFile(pendingPath(deployment));
+  if (existing && existing.expiresAt > Date.now()) {
+    return { pending: existing, started: false };
+  }
+  await removeFile(pendingPath(deployment));
+  const device = await api(deployment, "POST", "/v1/auth/device");
+  if (!device.verificationUriComplete.startsWith(`${deployment.url}/activate`)) {
+    throw new Error("the server returned an unexpected sign-in URL");
+  }
+  const pending = {
+    deviceCode: device.deviceCode,
+    userCode: device.userCode,
+    url: device.verificationUriComplete,
+    interval: device.interval,
+    expiresAt: Date.now() + device.expiresIn * 1e3
+  };
+  try {
+    await writeJsonFile(pendingPath(deployment), pending, "wx");
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    return startSignIn(deployment);
+  }
+  return { pending, started: true };
+}
+async function waitForSignIn(deployment, pending) {
+  while (pending.expiresAt > Date.now()) {
+    await sleep(pending.interval * 1e3);
+    try {
+      const session = await api(deployment, "POST", "/v1/auth/token", {
+        body: { deviceCode: pending.deviceCode, deviceName: hostname().slice(0, 100) }
+      });
+      await writeJsonFile(sessionPath(deployment), session);
+      await removeFile(pendingPath(deployment));
+      await ensureIdentity(deployment, session.token);
+      return true;
+    } catch (error) {
+      if (!(error instanceof ApiError) || error.message !== "authorization_pending") break;
+    }
+  }
+  await removeFile(pendingPath(deployment));
+  return await loadSession(deployment) !== null;
+}
+async function readPendingSignIn(deployment) {
+  return readJsonFile(pendingPath(deployment));
+}
+function openBrowser(url) {
+  const command2 = process.platform === "darwin" ? "open" : "xdg-open";
+  spawn(command2, [url], { detached: true, stdio: "ignore" }).on("error", () => {
+  }).unref();
+}
+function startBackgroundPoller() {
+  spawn(process.execPath, [...process.execArgv, process.argv[1], "auth", "--wait"], {
+    detached: true,
+    stdio: "ignore"
+  }).unref();
+}
+function sessionPath(deployment) {
+  return join3(deployment.dir, "session.json");
+}
+function pendingPath(deployment) {
+  return join3(deployment.dir, "pending-sign-in.json");
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// ../packages/config/src/errors.ts
+var ConfigError = class extends Error {
+};
+
+// ../node_modules/smol-toml/dist/error.js
+function getLineColFromPtr(string, ptr) {
+  let lines = string.slice(0, ptr).split(/\r?\n/);
+  return [lines.length, lines.pop().length + 1];
+}
+function makeCodeBlock(string, line, column) {
+  let lines = string.split(/\r?\n/);
+  let codeblock = "";
+  let numberLen = (Math.log10(line + 1) | 0) + 1;
+  for (let i = line - 1; i <= line + 1; i++) {
+    let l = lines[i - 1];
+    if (!l)
+      continue;
+    codeblock += i.toString().padEnd(numberLen, " ");
+    codeblock += ":  ";
+    codeblock += l;
+    codeblock += "\n";
+    if (i === line) {
+      codeblock += " ".repeat(numberLen + column + 2);
+      codeblock += "^\n";
+    }
+  }
+  return codeblock;
+}
+var TomlError = class _TomlError extends Error {
+  line;
+  column;
+  codeblock;
+  constructor(message, options) {
+    const [line, column] = getLineColFromPtr(options.toml, options.ptr);
+    const codeblock = makeCodeBlock(options.toml, line, column);
+    super(`Invalid TOML document: ${message}
+
+${codeblock}`, options);
+    this.line = line;
+    this.column = column;
+    this.codeblock = codeblock;
+  }
+  /** @internal */
+  static x(message, ctx, ptr) {
+    throw new _TomlError(message, { toml: ctx.s, ptr: ptr ?? ctx.p });
+  }
+};
+
+// ../node_modules/smol-toml/dist/primitive.js
+function parseString(ctx) {
+  let startPtr = ctx.p;
+  let c = ctx.s.charCodeAt(ctx.p++);
+  let first = c;
+  let isLiteral = c === 39;
+  let isMultiline = c === ctx.s.charCodeAt(ctx.p) && c === ctx.s.charCodeAt(ctx.p + 1);
+  if (isMultiline) {
+    if ((c = ctx.s.charCodeAt(ctx.p += 2)) === 10)
+      ctx.p++;
+    else if (c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10)
+      ctx.p += 2;
+  }
+  let parsed = "";
+  let sliceStart = ctx.p;
+  let state = 0;
+  for (; ctx.p < ctx.s.length; ctx.p++) {
+    c = ctx.s.charCodeAt(ctx.p);
+    if (isMultiline && (c === 10 || c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10)) {
+      state = state && 3;
+    } else if (c < 32 && c !== 9 || c === 127) {
+      TomlError.x("control characters are not allowed in strings", ctx);
+    } else if ((!state || state === 3) && c === first && (!isMultiline || ctx.s.charCodeAt(ctx.p + 1) === first && ctx.s.charCodeAt(ctx.p + 2) === first)) {
+      if (isMultiline) {
+        if (ctx.s.charCodeAt(ctx.p + 3) === first)
+          ctx.p++;
+        if (ctx.s.charCodeAt(ctx.p + 3) === first)
+          ctx.p++;
+      }
+      if (!state) {
+        let s = ctx.s.slice(sliceStart, ctx.p);
+        parsed = parsed ? parsed + s : s;
+      }
+      ctx.p += isMultiline ? 3 : 1;
+      return parsed;
+    } else if (!state) {
+      if (!isLiteral && c === 92) {
+        parsed += ctx.s.slice(sliceStart, sliceStart = ctx.p);
+        state = 1;
+      }
+    } else if (state === 1) {
+      if (c === 120 || c === 117 || c === 85) {
+        let errPtr = ctx.p++ - 1;
+        let value = 0;
+        let len = c === 120 ? 2 : c === 117 ? 4 : 8;
+        for (let j = 0; j < len; j++, ctx.p++) {
+          let hex = ctx.s.charCodeAt(ctx.p);
+          let digit = (
+            /* 0-9 */
+            hex >= 48 && hex <= 57 ? hex - 48 : (
+              /* A-F */
+              hex >= 65 && hex <= 70 ? hex - 65 + 10 : (
+                /* a-f */
+                hex >= 97 && hex <= 102 ? hex - 97 + 10 : -1
+              )
+            )
+          );
+          if (digit < 0)
+            TomlError.x("invalid non-hex character in unicode escape", ctx);
+          value = value << 4 | digit;
+        }
+        if (value < 0 || value > 1114111 || value >= 55296 && value <= 57343) {
+          TomlError.x("invalid unicode escape", ctx, errPtr);
+        }
+        parsed += String.fromCodePoint(value);
+        sliceStart = ctx.p--;
+        state = 0;
+      } else if (isMultiline && (c === 32 || c === 9)) {
+        state = 2;
+      } else {
+        if (c === 98)
+          parsed += "\b";
+        else if (c === 116)
+          parsed += "	";
+        else if (c === 110)
+          parsed += "\n";
+        else if (c === 102)
+          parsed += "\f";
+        else if (c === 114)
+          parsed += "\r";
+        else if (c === 101)
+          parsed += "\x1B";
+        else if (c === 34)
+          parsed += '"';
+        else if (c === 92)
+          parsed += "\\";
+        else
+          TomlError.x("unrecognised escape sequence", ctx);
+        sliceStart = ctx.p + 1;
+        state = 0;
+      }
+    } else if (c !== 32 && c !== 9) {
+      if (state === 2)
+        TomlError.x("invalid escape: only line-ending whitespace may be escaped", ctx, sliceStart);
+      state = !isLiteral && c === 92 ? 1 : 0;
+      sliceStart = ctx.p;
+    }
+  }
+  TomlError.x("unfinished string", ctx, startPtr);
+}
+
+// ../node_modules/smol-toml/dist/date.js
+var DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[Tt ]?(?:(\d{2}):\d{2}(?::\d{2}(?:\.\d+)?)?)?(Z|z|[-+]\d{2}:\d{2})?$/i;
+var TomlDate = class _TomlDate extends Date {
+  #hasDate = false;
+  #hasTime = false;
+  #offset = null;
+  constructor(date, fasttype, unsafeDelim) {
+    let hasDate = true;
+    let hasTime = true;
+    let offset = "Z";
+    let c;
+    if (typeof date === "string") {
+      if (fasttype)
+        prep: {
+          if (fasttype < 3) {
+            if (+date.slice(11, 13) > 23) {
+              date = "";
+              break prep;
+            }
+            if (fasttype === 2) {
+              offset = null;
+              date += "Z";
+            } else if ((c = date.charCodeAt(date.length - 1)) !== 90 && c !== 122) {
+              offset = date.slice(date.length - 6);
+            }
+            if (unsafeDelim)
+              date = date.slice(0, 10) + "T" + date.slice(11);
+          } else if (fasttype === 4) {
+            date = +date.slice(0, 2) > 23 ? "" : `0000-01-01T${date}Z`;
+          }
+          hasDate = fasttype !== 4;
+          hasTime = fasttype !== 3;
+        }
+      else {
+        let match = date.match(DATE_TIME_RE);
+        if (match) {
+          if (!match[1]) {
+            hasDate = false;
+            date = `0000-01-01T${date}`;
+          }
+          hasTime = !!match[2];
+          hasTime && date[10] === " " && (date = date.replace(" ", "T"));
+          if (match[2] && +match[2] > 23) {
+            date = "";
+          } else {
+            offset = match[3] || null;
+            if (!offset && hasTime)
+              date += "Z";
+          }
+        } else {
+          date = "";
+        }
+      }
+    }
+    super(date);
+    if (!isNaN(this.getTime())) {
+      this.#hasDate = hasDate;
+      this.#hasTime = hasTime;
+      this.#offset = offset;
+    }
+  }
+  isDateTime() {
+    return this.#hasDate && this.#hasTime;
+  }
+  isLocal() {
+    return !this.#hasDate || !this.#hasTime || !this.#offset;
+  }
+  isDate() {
+    return this.#hasDate && !this.#hasTime;
+  }
+  isTime() {
+    return this.#hasTime && !this.#hasDate;
+  }
+  isValid() {
+    return this.#hasDate || this.#hasTime;
+  }
+  toISOString() {
+    let iso = super.toISOString();
+    if (this.isDate())
+      return iso.slice(0, 10);
+    if (this.isTime())
+      return iso.slice(11, 23);
+    if (this.#offset === null)
+      return iso.slice(0, -1);
+    if (this.#offset === "Z" || this.#offset === "z")
+      return iso;
+    let offset = +this.#offset.slice(1, 3) * 60 + +this.#offset.slice(4, 6);
+    offset = this.#offset[0] === "-" ? offset : -offset;
+    let offsetDate = new Date(this.getTime() - offset * 6e4);
+    return offsetDate.toISOString().slice(0, -1) + this.#offset;
+  }
+  static wrapAsOffsetDateTime(jsDate, offset = "Z") {
+    let date = new _TomlDate(jsDate);
+    date.#offset = offset;
+    return date;
+  }
+  static wrapAsLocalDateTime(jsDate) {
+    let date = new _TomlDate(jsDate);
+    date.#offset = null;
+    return date;
+  }
+  static wrapAsLocalDate(jsDate) {
+    let date = new _TomlDate(jsDate);
+    date.#hasTime = false;
+    date.#offset = null;
+    return date;
+  }
+  static wrapAsLocalTime(jsDate) {
+    let date = new _TomlDate(jsDate);
+    date.#hasDate = false;
+    date.#offset = null;
+    return date;
+  }
+};
+
+// ../node_modules/smol-toml/dist/extract.js
+function isDigit(char, base = 10) {
+  return base === 16 ? char > 47 && char < 58 || char > 64 && char < 71 || char > 96 && char < 103 : char > 47 && char < 48 + base;
+}
+function isEndOfValue(char, delim) {
+  return char === 32 || char === 9 || char === 10 || char === 13 || // Structure end or next value delimiter
+  delim && (char === delim || char === 44) || // Comment
+  char === 35;
+}
+function extractValue(ctx, end) {
+  let errPtr = ctx.p;
+  let c = ctx.s.charCodeAt(ctx.p);
+  if (c === 91 || c === 123) {
+    ctx.d-- || TomlError.x("document contains excessively nested structures. aborting.", ctx);
+    let value = c === 91 ? parseArray(ctx) : parseInlineTable(ctx);
+    ctx.d++;
+    return value;
+  }
+  if (c === 34 || c === 39) {
+    return parseString(ctx);
+  }
+  if (c === 116) {
+    if (ctx.s.charCodeAt(++ctx.p) !== 114 || ctx.s.charCodeAt(++ctx.p) !== 117 || ctx.s.charCodeAt(++ctx.p) !== 101)
+      TomlError.x("invalid value", ctx, errPtr);
+    return ctx.p++, true;
+  }
+  if (c === 102) {
+    if (ctx.s.charCodeAt(++ctx.p) !== 97 || ctx.s.charCodeAt(++ctx.p) !== 108 || ctx.s.charCodeAt(++ctx.p) !== 115 || ctx.s.charCodeAt(++ctx.p) !== 101)
+      TomlError.x("invalid value", ctx, errPtr);
+    return ctx.p++, false;
+  }
+  if (c === 43 || c === 45) {
+    return parseNumber(ctx, ctx.p, ctx.s.charCodeAt(++ctx.p), 44 - c, end);
+  }
+  if (ctx.s.charCodeAt(ctx.p + 4) === 45 && ctx.s.charCodeAt(ctx.p + 7) === 45) {
+    return parseDate(ctx, c, end);
+  }
+  if (ctx.s.charCodeAt(ctx.p + 2) === 58) {
+    return parseTime(ctx, c, end);
+  }
+  return parseNumber(ctx, ctx.p, c, 0, end);
+}
+function parseNumber(ctx, startPtr, startChr, sign, endChr) {
+  let c = startChr;
+  let state = 0;
+  let hasUnderscores = false;
+  if (c === 105) {
+    if (ctx.s.charCodeAt(++ctx.p) !== 110 || ctx.s.charCodeAt(++ctx.p) !== 102)
+      TomlError.x("invalid value", ctx, startPtr);
+    return ctx.p++, (sign || 1) / 0;
+  }
+  if (c === 110) {
+    if (ctx.s.charCodeAt(++ctx.p) !== 97 || ctx.s.charCodeAt(++ctx.p) !== 110)
+      TomlError.x("invalid value", ctx, startPtr);
+    return ctx.p++, NaN;
+  }
+  if (c === 48) {
+    if (++ctx.p >= ctx.s.length || isEndOfValue(c = ctx.s.charCodeAt(ctx.p), endChr))
+      return ctx.bi === true ? 0n : 0;
+    if (!sign) {
+      if (c === 120)
+        return parseIntegerBaseN(ctx, startPtr, 16, endChr);
+      else if (c === 98)
+        return parseIntegerBaseN(ctx, startPtr, 2, endChr);
+      else if (c === 111)
+        return parseIntegerBaseN(ctx, startPtr, 8, endChr);
+    }
+    if (c === 46)
+      state = 2;
+    else if (c === 101 || c === 69)
+      state = 4;
+    else
+      TomlError.x("illegal leading zero", ctx, startPtr);
+  } else if (!isDigit(c))
+    TomlError.x("invalid value", ctx, startPtr);
+  while (++ctx.p < ctx.s.length && (c = ctx.s.charCodeAt(ctx.p), !isEndOfValue(c, endChr))) {
+    if (!state)
+      state = 1;
+    if (c === 95) {
+      if (!(state & 1))
+        TomlError.x("illegal underscore", ctx);
+      state += 11;
+      hasUnderscores = true;
+    } else if (state === 1 && c === 46)
+      state = 2;
+    else if ((state === 1 || state === 3) && (c === 101 || c === 69))
+      state = 4;
+    else if (state === 4 && (c === 43 || c === 45)) {
+      state = 6;
+    } else if (!isDigit(c))
+      TomlError.x(`illegal character in numeric literal`, ctx);
+    else if (state > 9)
+      state -= 11;
+    else if (!(state & 1))
+      state++;
+  }
+  if (!state) {
+    let val = (startChr - 48) * (sign || 1);
+    return ctx.bi === true ? BigInt(val) : val;
+  }
+  if (!(state & 1))
+    TomlError.x("unfinished numeric value", ctx, startPtr);
+  let str = ctx.s.slice(startPtr, ctx.p);
+  if (hasUnderscores)
+    str = str.replaceAll("_", "");
+  return state > 1 ? parseFloat(str) : parseInteger(ctx, str, 10, startPtr);
+}
+function parseIntegerBaseN(ctx, startPtr, base, endChr) {
+  let c, underscore = 1;
+  while (++ctx.p < ctx.s.length && (c = ctx.s.charCodeAt(ctx.p), !isEndOfValue(c, endChr))) {
+    if (c === 95) {
+      if (underscore & 1)
+        TomlError.x("illegal underscore", ctx);
+      underscore = 3;
+    } else if (!isDigit(c, base))
+      TomlError.x(`illegal character in numeric literal`, ctx);
+    else if (underscore & 1)
+      underscore--;
+  }
+  if (underscore & 1)
+    TomlError.x("unfinished numeric value", ctx);
+  let str = ctx.s.slice(startPtr + 2, ctx.p);
+  if (underscore)
+    str = str.replaceAll("_", "");
+  return parseInteger(ctx, str, base, startPtr);
+}
+function parseInteger(ctx, str, base, startPtr) {
+  if (ctx.bi !== true)
+    int: {
+      let val = parseInt(str, base);
+      if (!Number.isSafeInteger(val)) {
+        if (ctx.bi)
+          break int;
+        TomlError.x("integer value cannot be represented losslessly", ctx, startPtr);
+      }
+      return val;
+    }
+  return base === 10 ? BigInt(str) : BigInt((base === 2 ? "0b" : base === 8 ? "0o" : "0x") + str);
+}
+function parseDate(ctx, c, endChr) {
+  let startPtr = ctx.p++, unsafeSeparator;
+  if (!isDigit(c) || !isDigit(ctx.s.charCodeAt(ctx.p++)) || !isDigit(ctx.s.charCodeAt(ctx.p++)) || !isDigit(ctx.s.charCodeAt(ctx.p++))) {
+    return parseNumber(ctx, ctx.p = startPtr, c, 0, endChr);
+  }
+  ctx.p += 5;
+  if (!isDigit(ctx.s.charCodeAt(ctx.p++)))
+    TomlError.x("invalid date-time: date part is malformed", ctx, startPtr);
+  if (ctx.p >= ctx.s.length || ((c = ctx.s.charCodeAt(ctx.p)) !== 32 || (unsafeSeparator = true, !isDigit(ctx.s.charCodeAt(ctx.p + 1)))) && c !== 84 && c !== 116) {
+    let t2 = ctx.s.slice(startPtr, ctx.p);
+    return readDate(ctx, t2, 3, false, startPtr);
+  }
+  if (ctx.s.charCodeAt(ctx.p += 3) !== 58)
+    TomlError.x("invalid date-time: time part is malformed", ctx, startPtr);
+  if (ctx.s.charCodeAt(ctx.p += 3) === 58)
+    ctx.p += 3;
+  if (ctx.s.charCodeAt(ctx.p) === 46)
+    while (isDigit(ctx.s.charCodeAt(++ctx.p)))
+      ;
+  if (c = ctx.s.charCodeAt(ctx.p)) {
+    if (c === 90 || c === 122) {
+      let t2 = ctx.s.slice(startPtr, ++ctx.p);
+      return readDate(ctx, t2, 1, unsafeSeparator, startPtr, "[+00:00]");
+    }
+    if (c === 43 || c === 45) {
+      let t2 = ctx.s.slice(startPtr, ctx.p += 6);
+      return readDate(ctx, t2, 1, unsafeSeparator, startPtr, !ctx.ld && "[" + ctx.s.slice(ctx.p - 6, ctx.p) + "]");
+    }
+  }
+  let t = ctx.s.slice(startPtr, ctx.p);
+  return readDate(ctx, t, 2, unsafeSeparator, startPtr);
+}
+function parseTime(ctx, c, endChr) {
+  let start = ctx.p;
+  if (!isDigit(c) || !isDigit(ctx.s.charCodeAt(++ctx.p))) {
+    return parseNumber(ctx, --ctx.p, c, 0, endChr);
+  }
+  if (ctx.s.charCodeAt(ctx.p += 4) === 58)
+    ctx.p += 3;
+  if (ctx.s.charCodeAt(ctx.p) === 46)
+    while (isDigit(ctx.s.charCodeAt(++ctx.p)))
+      ;
+  let t = ctx.s.slice(start, ctx.p);
+  return readDate(ctx, t, 4, false, start);
+}
+function readDate(ctx, str, type, unsafeDelim, errPtr, temporalSuffix) {
+  if (ctx.ld) {
+    let date = new TomlDate(str, type, unsafeDelim);
+    if (!date.isValid())
+      TomlError.x("invalid date", ctx, errPtr);
+    return date;
+  }
+  try {
+    if (temporalSuffix)
+      str += temporalSuffix;
+    switch (type) {
+      case 1:
+        return Temporal.ZonedDateTime.from(str);
+      case 2:
+        return Temporal.PlainDateTime.from(str);
+      case 3:
+        return Temporal.PlainDate.from(str);
+      case 4:
+        return Temporal.PlainTime.from(str);
+    }
+  } catch (e) {
+    TomlError.x(e instanceof Error ? e.message : "" + e, ctx, errPtr);
+  }
+}
+
+// ../node_modules/smol-toml/dist/util.js
+function skipComment(ctx) {
+  for (; ctx.p < ctx.s.length; ctx.p++) {
+    let c = ctx.s.charCodeAt(ctx.p);
+    if (c === 10)
+      break;
+    if (c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10) {
+      ctx.p++;
+      break;
+    }
+    if (c < 32 && c !== 9 || c === 127) {
+      TomlError.x("control characters are not allowed in comments", ctx);
+    }
+  }
+}
+function skipVoid(ctx, banNewLines, banComments) {
+  let c;
+  while (ctx.p < ctx.s.length) {
+    while (ctx.p < ctx.s.length && ((c = ctx.s.charCodeAt(ctx.p)) === 32 || c === 9 || !banNewLines && (c === 10 || c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10)))
+      ctx.p++;
+    if (banComments || c !== 35)
+      break;
+    skipComment(ctx);
+  }
+}
+
+// ../node_modules/smol-toml/dist/struct.js
+function parseKey(ctx, end = 61) {
+  let startPtr;
+  let state = 0;
+  let parsed = [];
+  let sliceStart;
+  let c = ctx.s.charCodeAt(startPtr = ctx.p);
+  do {
+    if (c === end) {
+      if (!state)
+        TomlError.x("unexpected end of key", ctx);
+      if (state === 1)
+        parsed.push(ctx.s.slice(sliceStart, ctx.p));
+      return ctx.p++, parsed;
+    } else if (c === 46) {
+      if (!state)
+        TomlError.x("illegal empty bare key", ctx);
+      if (state === 1)
+        parsed.push(ctx.s.slice(sliceStart, ctx.p));
+      state = 0;
+    } else if (!state && (c === 34 || c === 39)) {
+      if (c === ctx.s.charCodeAt(ctx.p + 1) && c === ctx.s.charCodeAt(ctx.p + 2))
+        TomlError.x("illegal quoted key: multiline strings are not allowed", ctx);
+      parsed.push(parseString(ctx));
+      state = 2;
+      ctx.p--;
+    } else if (c === 32 || c === 9) {
+      if (state === 1) {
+        parsed.push(ctx.s.slice(sliceStart, ctx.p));
+        state = 2;
+      }
+    } else if (state === 2 || c < 48 && c !== 45 || c > 57 && c < 65 || c > 90 && c < 97 && c !== 95 || c > 122) {
+      TomlError.x("illegal character in key", ctx);
+    } else if (!state) {
+      state = 1;
+      sliceStart = ctx.p;
+    }
+  } while (c = ctx.s.charCodeAt(++ctx.p));
+  TomlError.x("incomplete key-value: cannot find end of key", ctx, startPtr);
+}
+function parseInlineTable(ctx) {
+  let startPtr = ctx.p++;
+  let res = /* @__PURE__ */ Object.create(null);
+  let seen = /* @__PURE__ */ new Set();
+  let c;
+  while (ctx.p < ctx.s.length) {
+    skipVoid(ctx);
+    if ((c = ctx.s.charCodeAt(ctx.p)) === 125) {
+      ctx.p++;
+      return res;
+    }
+    let k;
+    let t = res;
+    let hasOwn = false;
+    let errPtr = ctx.p;
+    let key = parseKey(ctx);
+    for (let i = 0; i < key.length; i++) {
+      if (i)
+        t = hasOwn ? t[k] : t[k] = /* @__PURE__ */ Object.create(null);
+      k = key[i];
+      if ((hasOwn = Object.hasOwn(t, k)) && (typeof t[k] !== "object" || seen.has(t[k]))) {
+        TomlError.x("trying to redefine an already defined value", ctx, errPtr);
+      }
+      let unsafe = k === "__proto__";
+      if (ctx.uk && (unsafe || k === "constructor")) {
+        t = ctx.uk !== 1 && TomlError.x("document contains an unsafe property", ctx, errPtr);
+        break;
+      }
+      if (!hasOwn && unsafe) {
+        Object.defineProperty(t, k, { enumerable: true, configurable: true, writable: true });
+      }
+    }
+    if (hasOwn) {
+      TomlError.x("trying to redefine an already defined value", ctx, errPtr);
+    }
+    skipVoid(ctx, true, true);
+    let value = extractValue(
+      ctx,
+      125
+      /* } */
+    );
+    if (t && typeof (t[k] = value) === "object")
+      seen.add(value);
+    skipVoid(ctx);
+    if ((c = ctx.s.charCodeAt(ctx.p++)) === 125) {
+      return res;
+    }
+    if (c !== 44)
+      TomlError.x("expected comma or end of structure", ctx, ctx.p - 1);
+  }
+  TomlError.x("unfinished table", ctx, startPtr);
+}
+function parseArray(ctx) {
+  let startPtr = ctx.p++;
+  let res = [];
+  let c;
+  while (ctx.p < ctx.s.length) {
+    skipVoid(ctx);
+    if ((c = ctx.s.charCodeAt(ctx.p)) === 93) {
+      ctx.p++;
+      return res;
+    }
+    res.push(extractValue(
+      ctx,
+      93
+      /* ] */
+    ));
+    skipVoid(ctx);
+    if ((c = ctx.s.charCodeAt(ctx.p++)) === 93) {
+      return res;
+    }
+    if (c !== 44)
+      TomlError.x("expected comma or end of structure", ctx, ctx.p - 1);
+  }
+  TomlError.x("unfinished array", ctx, startPtr);
+}
+
+// ../node_modules/smol-toml/dist/parse.js
+function peekTable(ctx, key, table, meta, type) {
+  let t = table;
+  let m = meta;
+  let k;
+  let hasOwn = false;
+  let state;
+  for (let i = 0; i < key.length; i++) {
+    if (i) {
+      t = hasOwn ? t[k] : t[k] = /* @__PURE__ */ Object.create(null);
+      m = (state = m[k]).c;
+      if (type === 0 && (state.t === 1 || state.t === 2)) {
+        return null;
+      }
+      if (state.t === 2) {
+        let l = t.length - 1;
+        t = t[l];
+        m = m[l].c;
+      }
+    }
+    k = key[i];
+    if ((hasOwn = Object.hasOwn(t, k)) && m[k]?.t === 0 && m[k]?.d) {
+      return null;
+    }
+    if (!hasOwn) {
+      let unsafe = k === "__proto__";
+      if (ctx.uk && (unsafe || k === "constructor"))
+        return false;
+      if (unsafe) {
+        Object.defineProperty(t, k, { enumerable: true, configurable: true, writable: true });
+        Object.defineProperty(m, k, { enumerable: true, configurable: true, writable: true });
+      }
+      m[k] = {
+        t: i < key.length - 1 && type === 2 ? 3 : type,
+        d: false,
+        i: 0,
+        c: /* @__PURE__ */ Object.create(null)
+      };
+    }
+  }
+  state = m[k];
+  if (state.t !== type && !(type === 1 && state.t === 3)) {
+    return null;
+  }
+  if (type === 2) {
+    if (!state.d) {
+      state.d = true;
+      t[k] = [];
+    }
+    t[k].push(t = /* @__PURE__ */ Object.create(null));
+    state.c[state.i++] = state = { t: 1, d: false, i: 0, c: /* @__PURE__ */ Object.create(null) };
+  }
+  if (state.d) {
+    return null;
+  }
+  state.d = true;
+  if (type === 1) {
+    t = hasOwn ? t[k] : t[k] = /* @__PURE__ */ Object.create(null);
+  } else if (type === 0 && hasOwn) {
+    return null;
+  }
+  return [k, t, state.c];
+}
+function validateTablePeek(ctx, peek, ptr) {
+  if (peek === null || ctx.uk === 2)
+    TomlError.x(peek === null ? "trying to redefine an already defined table or value" : "document contains an unsafe property", ctx, ptr);
+}
+function parse(toml, options = {}) {
+  let ctx = {
+    s: toml,
+    p: 0,
+    d: options.maxDepth ?? 1e3,
+    bi: options.integersAsBigInt ?? false,
+    ld: options.useLegacyDate ?? true,
+    uk: options.unsafeKeyBehaviour === "throw" ? 2 : options.unsafeKeyBehaviour === "drop" ? 1 : 0
+  };
+  let res = /* @__PURE__ */ Object.create(null);
+  let meta = /* @__PURE__ */ Object.create(null);
+  let tmp;
+  let skipping = false;
+  let tbl = res;
+  let m = meta;
+  if (toml.charCodeAt(0) === 65279)
+    ctx.p++;
+  skipVoid(ctx);
+  while (ctx.p < toml.length) {
+    if (toml.charCodeAt(ctx.p) === 91) {
+      let isTableArray = toml.charCodeAt(++ctx.p) === 91;
+      tmp = ctx.p += +isTableArray;
+      skipping = false;
+      let k = parseKey(
+        ctx,
+        93
+        /* ] */
+      );
+      if (isTableArray) {
+        if (toml.charCodeAt(ctx.p) !== 93) {
+          TomlError.x("expected end of table array declaration", ctx);
+        }
+        ctx.p++;
+      }
+      let p = peekTable(
+        ctx,
+        k,
+        res,
+        meta,
+        isTableArray ? 2 : 1
+        /* Type.EXPLICIT */
+      );
+      if (!p) {
+        validateTablePeek(ctx, p, tmp);
+        skipping = true;
+      } else {
+        m = p[2];
+        tbl = p[1];
+      }
+    } else {
+      tmp = ctx.p;
+      let k = parseKey(ctx);
+      let p = peekTable(
+        ctx,
+        k,
+        tbl,
+        m,
+        0
+        /* Type.DOTTED */
+      );
+      if (!p && !skipping)
+        validateTablePeek(ctx, p, tmp);
+      skipVoid(ctx, true, true);
+      let v = extractValue(ctx, void 0);
+      if (p && !skipping)
+        p[1][p[0]] = v;
+    }
+    skipVoid(ctx, true);
+    if (ctx.p < toml.length && (tmp = toml.charCodeAt(ctx.p)) !== 10 && (tmp !== 13 || toml.charCodeAt(ctx.p + 1) !== 10)) {
+      TomlError.x("each key-value declaration must be followed by an end-of-line", ctx);
+    }
+    skipVoid(ctx);
+  }
+  return res;
+}
+
+// ../node_modules/smol-toml/dist/stringify.js
+var HAS_WELLFORMED = !!"".isWellFormed;
+
+// ../packages/config/src/names.ts
+var IDENTIFIER = /^[A-Za-z0-9_-]+$/;
+var ENV_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var REPO = /^[a-z0-9.-]+(\/[a-z0-9._~-]+)+$/;
+
+// ../packages/config/src/parse.ts
+var DEFAULT_CONFIG = {
+  environment: "development",
+  requiredSecrets: []
+};
+function parseConfig(text3) {
+  const raw = parse(text3);
+  if (raw.version !== 1) {
+    throw new ConfigError("version must be 1");
+  }
+  const environment = raw.environment ?? DEFAULT_CONFIG.environment;
+  if (typeof environment !== "string" || !IDENTIFIER.test(environment)) {
+    throw new ConfigError('environment must contain only letters, digits, "_" or "-"');
+  }
+  const secrets = raw.secrets ?? {};
+  const required = secrets.required ?? [];
+  if (!Array.isArray(required) || !required.every(isEnvVarName)) {
+    throw new ConfigError("secrets.required must be a list of valid variable names");
+  }
+  return { environment, requiredSecrets: required };
+}
+function isEnvVarName(value) {
+  return typeof value === "string" && ENV_VAR_NAME.test(value);
+}
+
+// ../packages/config/src/repo.ts
+var URL_SCHEME = /^[a-z][a-z0-9+.-]*:\/\//i;
+var SCP_LIKE = /^(?:[^@/]+@)?([^:/]+):(.+)$/;
+var SUPPORTED_PROTOCOLS = ["https:", "http:", "ssh:", "git:"];
+function normalizeRemoteUrl(remote) {
+  const [host, path] = splitRemote(remote.trim());
+  const cleanPath = path.replace(/^\/+|\/+$/g, "").replace(/\.git$/, "");
+  const repo = `${host}/${cleanPath}`.toLowerCase();
+  if (!REPO.test(repo)) {
+    throw new ConfigError("git origin is not a supported remote URL");
+  }
+  return repo;
+}
+function splitRemote(remote) {
+  if (URL_SCHEME.test(remote)) {
+    const url = URL.parse(remote);
+    if (!url || !SUPPORTED_PROTOCOLS.includes(url.protocol)) {
+      throw new ConfigError("git origin is not a supported remote URL");
+    }
+    return [url.hostname, decodeURIComponent(url.pathname)];
+  }
+  const scp = remote.match(SCP_LIKE);
+  if (!scp) {
+    throw new ConfigError("git origin is not a supported remote URL");
+  }
+  return [scp[1], scp[2]];
+}
+
+// ../packages/config/src/git.ts
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+var run = promisify(execFile);
+async function readGitOrigin(dir) {
+  try {
+    const root = await git(dir, "rev-parse", "--show-toplevel");
+    const url = await git(dir, "config", "--get", "remote.origin.url");
+    return { root, url };
+  } catch {
+    return null;
+  }
+}
+async function git(dir, ...args2) {
+  const { stdout } = await run("git", ["-C", dir, ...args2]);
+  return stdout.trim();
+}
+
+// ../packages/config/src/find.ts
+import { readFile as readFile2 } from "node:fs/promises";
+import { join as join4 } from "node:path";
+var CONFIG_FILE = ".noenv";
+async function findProject(startDir) {
+  const origin = await readGitOrigin(startDir);
+  if (!origin) return null;
+  const text3 = await readConfigFile(join4(origin.root, CONFIG_FILE));
+  const config = text3 === null ? DEFAULT_CONFIG : parseConfig(text3);
+  return { root: origin.root, repo: normalizeRemoteUrl(origin.url), hasConfig: text3 !== null, ...config };
+}
+async function readConfigFile(path) {
+  try {
+    return await readFile2(path, "utf8");
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "EISDIR") return null;
+    throw error;
+  }
+}
+
+// src/target.ts
+async function findTarget(cwd, env) {
+  const project = await findProject(cwd);
+  if (!project) return null;
+  const environment = env.NOENV_ENVIRONMENT || project.environment;
+  if (!IDENTIFIER.test(environment)) {
+    throw new Error('NOENV_ENVIRONMENT must contain only letters, digits, "_" or "-"');
+  }
+  return { ...project, environment };
+}
+async function requireTarget(cwd = process.cwd(), env = process.env) {
+  const target = await findTarget(cwd, env);
+  if (!target) {
+    throw new Error("this directory is not inside a git repository with an origin remote");
+  }
+  return target;
+}
+
+// src/context.ts
+function requireDeployment() {
+  const deployment = currentDeployment();
+  if (!deployment) {
+    throw new Error("NOENV_URL is not set, add the lines from your noenv landing page to your shell profile");
+  }
+  return deployment;
+}
+async function signedIn() {
+  const deployment = requireDeployment();
+  const token = await requireSession(deployment);
+  return { deployment, token, identity: await ensureIdentity(deployment, token) };
+}
+async function inProject() {
+  return { ...await signedIn(), target: await requireTarget() };
+}
+
+// src/commands/auth.ts
+async function authCommand(args2) {
+  const deployment = requireDeployment();
+  if (args2.includes("--wait")) {
+    const pending2 = await readPendingSignIn(deployment);
+    if (pending2) await waitForSignIn(deployment, pending2);
+    return;
+  }
+  const { pending, started } = await startSignIn(deployment);
+  console.log(`Open ${pending.url} and confirm the code ${pending.userCode}`);
+  if (started) openBrowser(pending.url);
+  if (!await waitForSignIn(deployment, pending)) {
+    throw new Error("sign-in was not completed");
+  }
+  const me = await api(deployment, "GET", "/v1/me", { token: await loadSession(deployment) });
+  console.log(`Signed in as ${me.email}`);
+}
+async function statusCommand() {
+  const deployment = requireDeployment();
+  console.log(`Deployment:  ${deployment.url}`);
+  const token = await loadSession(deployment);
+  if (!token) {
+    console.log("Signed in:   no");
+    return;
+  }
+  const me = await api(deployment, "GET", "/v1/me", { token });
+  console.log(`Signed in:   ${me.email}${me.isAdmin ? " (organization admin)" : ""}`);
+  const target = await findTarget(process.cwd(), process.env);
+  if (!target) {
+    console.log("Project:     none (not in a git repository with an origin)");
+    return;
+  }
+  console.log(`Project:     ${target.repo}`);
+  console.log(`Environment: ${target.environment}`);
+  try {
+    const path = `${environmentPath(target.repo, target.environment)}/secrets`;
+    const { secrets } = await api(deployment, "GET", path, { token });
+    console.log(`Secrets:     ${secrets.length}`);
+  } catch {
+    console.log("Secrets:     no access");
+  }
+}
+
+// ../packages/policy/src/defaults.ts
+var DEFAULT_POLICIES = {
+  dotenv: {
+    mode: "warn",
+    include: [".env", ".env.*"],
+    exclude: [".env.example", ".env.sample", ".env.template", ".env.*.example"]
+  },
+  minCliVersion: null,
+  sessionTtlHours: 168,
+  environmentMinRole: "reader"
+};
+
+// ../packages/dotenv/src/policy.ts
+var DEFAULT_DOTENV_POLICY = DEFAULT_POLICIES.dotenv;
+
+// ../packages/dotenv/src/find.ts
+import { opendir } from "node:fs/promises";
+import { join as join5, matchesGlob } from "node:path";
+var SKIPPED_DIRECTORIES = /* @__PURE__ */ new Set([".git", "node_modules"]);
+async function findDotenvFiles(root, policy) {
+  const found = [];
+  await walk(root, policy, found);
+  return found.sort();
+}
+async function walk(dir, policy, found) {
+  for await (const entry of await opendir(dir)) {
+    const path = join5(dir, entry.name);
+    if (entry.isFile() && matchesPolicy(entry.name, policy)) {
+      found.push(path);
+    } else if (entry.isDirectory() && !SKIPPED_DIRECTORIES.has(entry.name) && !await isGitRepository(path)) {
+      await walk(path, policy, found);
+    }
+  }
+}
+function matchesPolicy(name2, { include, exclude }) {
+  return include.some((pattern) => matchesGlob(name2, pattern)) && !exclude.some((pattern) => matchesGlob(name2, pattern));
+}
+async function isGitRepository(dir) {
+  for await (const entry of await opendir(dir)) {
+    if (entry.name === ".git") return true;
+  }
+  return false;
+}
+
+// ../packages/dotenv/src/file.ts
+import { lstat, readFile as readFile3, unlink } from "node:fs/promises";
+import { parseEnv } from "node:util";
+async function readDotenvFile(path) {
+  await requireRegularFile(path);
+  const content = await readFile3(path, "utf8");
+  const values = parseEnv(content);
+  const invalidNames = Object.keys(values).filter((name2) => !ENV_VAR_NAME.test(name2));
+  return { path, content, values, invalidNames };
+}
+async function removeIfUnchanged(file) {
+  await requireRegularFile(file.path);
+  if (await readFile3(file.path, "utf8") !== file.content) return false;
+  await unlink(file.path);
+  return true;
+}
+async function requireRegularFile(path) {
+  if (!(await lstat(path)).isFile()) {
+    throw new Error("not a regular file");
+  }
+}
+
+// ../packages/dotenv/src/migrate.ts
+async function migrateDotenvFile(file, store) {
+  const conflicts = [];
+  for (const [name2, value] of Object.entries(file.values)) {
+    const stored = await store.get(name2);
+    if (stored === void 0) {
+      await store.set(name2, value);
+    } else if (stored !== value) {
+      conflicts.push(name2);
+    }
+  }
+  if (conflicts.length > 0) return { verified: false, conflicts };
+  return { verified: await isFullyStored(file, store), conflicts };
+}
+async function isFullyStored(file, store) {
+  for (const [name2, value] of Object.entries(file.values)) {
+    if (await store.get(name2) !== value) return false;
+  }
+  return true;
+}
+
+// ../packages/dotenv/src/enforce.ts
+async function enforceDotenvPolicy(root, policy, store) {
+  const paths = await findDotenvFiles(root, policy);
+  if (policy.mode !== "delete") {
+    const files2 = paths.map((path) => ({ path, status: "found", names: [] }));
+    return { blocked: policy.mode !== "warn" && files2.length > 0, files: files2 };
+  }
+  const files = [];
+  for (const path of paths) {
+    files.push(await deleteAfterMigration(path, store));
+  }
+  return { blocked: files.some((file) => file.status !== "deleted"), files };
+}
+async function deleteAfterMigration(path, store) {
+  try {
+    const file = await readDotenvFile(path);
+    if (file.invalidNames.length > 0) {
+      return { path, status: "invalid", names: file.invalidNames };
+    }
+    const migration = await migrateDotenvFile(file, store);
+    if (migration.conflicts.length > 0) {
+      return { path, status: "conflict", names: migration.conflicts };
+    }
+    if (!migration.verified) {
+      return { path, status: "failed", names: [] };
+    }
+    return { path, status: await removeIfUnchanged(file) ? "deleted" : "changed", names: [] };
+  } catch {
+    return { path, status: "failed", names: [] };
+  }
+}
+
+// src/commands/migrate.ts
+import { relative as relative2 } from "node:path";
+
+// src/bundle.ts
+async function fetchBundle(deployment, token, privateKey, repo, environment) {
+  const raw = await api(deployment, "GET", `${environmentPath(repo, environment)}/bundle`, { token });
+  const environmentPrivateKey = await unwrapPrivateKey(raw.wrappedKey, privateKey);
+  const secrets = {};
+  for (const { name: name2, sealed } of raw.secrets) {
+    secrets[name2] = await decryptSecret(environmentPrivateKey, sealed, { projectId: raw.projectId, environment, name: name2 });
+  }
+  return {
+    projectId: raw.projectId,
+    revision: raw.revision,
+    policies: raw.policies,
+    environmentPublicKey: await importPublicKey(raw.publicKey),
+    environmentPrivateKey,
+    secrets
+  };
+}
+
+// src/compliance.ts
+import { relative } from "node:path";
+var DESCRIPTIONS = {
+  found: "found",
+  invalid: "kept, it has invalid variable names",
+  conflict: "kept, its values differ from noenv",
+  failed: "kept, it could not be migrated",
+  migrated: "migrated to noenv",
+  changed: "kept, it changed during migration",
+  deleted: "migrated to noenv and deleted"
+};
+function describeOutcome(target, outcome) {
+  const names = outcome.names.length > 0 ? ` (${outcome.names.join(", ")})` : "";
+  return `${relative(target.root, outcome.path)}: ${DESCRIPTIONS[outcome.status]}${names}`;
+}
+async function reportCompliance(deployment, token, target, result) {
+  await api(deployment, "POST", `${environmentPath(target.repo, target.environment)}/compliance`, {
+    token,
+    body: {
+      compliant: result.files.every((file) => file.status === "deleted"),
+      files: result.files.map((file) => ({ path: relative(target.root, file.path), status: file.status }))
+    }
+  });
+}
+
+// src/prompt.ts
+import { createInterface } from "node:readline/promises";
+import { text } from "node:stream/consumers";
+async function readSecretValue(label) {
+  if (!process.stdin.isTTY) {
+    return (await text(process.stdin)).replace(/\r?\n$/, "");
+  }
+  process.stderr.write(label);
+  process.stdin.setRawMode(true);
+  process.stdin.resume();
+  return new Promise((resolve) => {
+    let value = "";
+    const onData = (chunk) => {
+      for (const char of chunk.toString("utf8")) {
+        if (char === "\r" || char === "\n") {
+          finish();
+          return resolve(value);
+        }
+        if (char === "") {
+          finish();
+          process.exit(130);
+        }
+        value = char === "\x7F" ? value.slice(0, -1) : value + char;
+      }
+    };
+    const finish = () => {
+      process.stdin.off("data", onData);
+      process.stdin.setRawMode(false);
+      process.stdin.pause();
+      process.stderr.write("\n");
+    };
+    process.stdin.on("data", onData);
+  });
+}
+async function confirm(question) {
+  if (!process.stdin.isTTY) return false;
+  const readline = createInterface({ input: process.stdin, output: process.stderr });
+  const answer = await readline.question(`${question} [y/N] `);
+  readline.close();
+  return answer.trim().toLowerCase() === "y";
+}
+
+// src/secret-store.ts
+function remoteSecretStore(deployment, token, identity, repo, environment, initial = null) {
+  let cached = initial;
+  const bundle = async () => cached ??= await fetchBundle(deployment, token, identity.privateKey, repo, environment);
+  return {
+    async get(name2) {
+      return (await bundle()).secrets[name2];
+    },
+    async set(name2, value) {
+      const { environmentPublicKey, projectId } = await bundle();
+      const sealed = await encryptSecret(environmentPublicKey, value, { projectId, environment, name: name2 });
+      const path = `${environmentPath(repo, environment)}/secrets/${name2}`;
+      const { version } = await api(deployment, "PUT", path, { token, body: sealed });
+      cached = null;
+      return version;
+    }
+  };
+}
+
+// src/watch.ts
+import { spawn as spawn2 } from "node:child_process";
+import { createHash } from "node:crypto";
+import { mkdir as mkdir2, readFile as readFile4, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join6 } from "node:path";
+var POLL_INTERVAL_MS = 5e3;
+var IDLE_LIMIT_MS = 60 * 60 * 1e3;
+var CHANGED = "changed";
+function markerPath(deployment, repo, environment) {
+  const name2 = createHash("sha256").update(`${repo}\0${environment}`).digest("hex").slice(0, 32);
+  return join6(deployment.dir, "revisions", name2);
+}
+async function readMarker(path) {
+  return readFile4(path, "utf8").catch(() => "");
+}
+async function writeMarker(path, value) {
+  await mkdir2(join6(path, ".."), { recursive: true, mode: 448 });
+  await writeFile2(path, value, { mode: 384 });
+}
+async function markChanged(deployment, repo, environment) {
+  await writeMarker(markerPath(deployment, repo, environment), CHANGED);
+}
+async function watchEnvironment(deployment, repo, environment) {
+  const list = await readJsonFile(watchListPath(deployment)) ?? {};
+  list[`${repo}\0${environment}`] = { repo, environment, seenAt: Date.now() };
+  await writeJsonFile(watchListPath(deployment), list);
+}
+async function startWatcher(deployment) {
+  if (await isWatcherRunning(deployment)) return;
+  spawn2(process.execPath, [...process.execArgv, process.argv[1], "watch"], { detached: true, stdio: "ignore" }).unref();
+}
+async function runWatcher(deployment) {
+  try {
+    await writeJsonFile(pidPath(deployment), process.pid, "wx");
+  } catch {
+    if (await isWatcherRunning(deployment)) return;
+    await writeJsonFile(pidPath(deployment), process.pid);
+  }
+  try {
+    while (await checkForUpdates(deployment)) {
+      await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+    }
+  } finally {
+    await removeFile(pidPath(deployment));
+  }
+}
+async function checkForUpdates(deployment) {
+  const token = await loadSession(deployment);
+  const list = await readJsonFile(watchListPath(deployment)) ?? {};
+  const active = Object.values(list).filter((entry) => Date.now() - entry.seenAt < IDLE_LIMIT_MS);
+  if (!token || active.length === 0) return false;
+  await refreshMarkers(deployment, token, active).catch(() => {
+  });
+  return true;
+}
+async function refreshMarkers(deployment, token, entries) {
+  const { revisions } = await api(deployment, "POST", "/v1/revisions", {
+    token,
+    body: { environments: entries.map(({ repo, environment }) => ({ repo, environment })) }
+  });
+  for (const { repo, environment, revision } of revisions) {
+    const path = markerPath(deployment, repo, environment);
+    if (await readMarker(path) !== String(revision)) await writeMarker(path, String(revision));
+  }
+}
+async function isWatcherRunning(deployment) {
+  const pid = await readJsonFile(pidPath(deployment));
+  if (!pid) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function watchListPath(deployment) {
+  return join6(deployment.dir, "watch.json");
+}
+function pidPath(deployment) {
+  return join6(deployment.dir, "watcher.pid");
+}
+
+// src/commands/migrate.ts
+async function migrateCommand() {
+  const { deployment, token, identity, target } = await inProject();
+  const bundle = await fetchBundle(deployment, token, identity.privateKey, target.repo, target.environment);
+  const store = remoteSecretStore(deployment, token, identity, target.repo, target.environment, bundle);
+  const paths = await findDotenvFiles(target.root, bundle.policies.dotenv);
+  const outcomes = [];
+  if (paths.length === 0) {
+    console.log("No .env files found");
+    return;
+  }
+  for (const path of paths) {
+    const name2 = relative2(target.root, path);
+    const file = await readDotenvFile(path);
+    if (file.invalidNames.length > 0) {
+      console.log(`${name2}: skipped, invalid names: ${file.invalidNames.join(", ")}`);
+      outcomes.push({ path, status: "invalid", names: file.invalidNames });
+      continue;
+    }
+    const result = await migrateDotenvFile(file, store);
+    if (result.conflicts.length > 0) {
+      console.log(`${name2}: kept, values differ from noenv for ${result.conflicts.join(", ")}`);
+      outcomes.push({ path, status: "conflict", names: result.conflicts });
+      continue;
+    }
+    if (!result.verified) {
+      console.log(`${name2}: kept, could not verify the upload`);
+      outcomes.push({ path, status: "failed", names: [] });
+      continue;
+    }
+    console.log(`${name2}: ${Object.keys(file.values).length} values are stored in noenv`);
+    if (!await confirm(`Delete ${name2}?`)) {
+      outcomes.push({ path, status: "migrated", names: [] });
+      continue;
+    }
+    const deleted = await removeIfUnchanged(file);
+    console.log(deleted ? `${name2}: deleted` : `${name2}: kept, the file changed`);
+    outcomes.push({ path, status: deleted ? "deleted" : "changed", names: [] });
+  }
+  await markChanged(deployment, target.repo, target.environment);
+  await reportCompliance(deployment, token, target, {
+    blocked: outcomes.some((outcome) => outcome.status !== "deleted"),
+    files: outcomes
+  });
+}
+
+// src/commands/project.ts
+import { basename } from "node:path";
+var ROLES = ["reader", "editor", "admin"];
+async function initCommand() {
+  const { deployment, token, identity, target } = await inProject();
+  try {
+    await api(deployment, "POST", "/v1/projects", { token, body: { name: basename(target.root), repo: target.repo } });
+    console.log(`Created project ${target.repo}`);
+  } catch (error) {
+    if (!(error instanceof ApiError && error.status === 409)) throw error;
+  }
+  const environmentKeys = await generateKeyPair();
+  const wrappedKey = await wrapPrivateKey(environmentKeys.privateKey, await importPublicKey(identity.publicKey));
+  try {
+    await api(deployment, "POST", `${repoPath(target.repo)}/environments/${target.environment}`, {
+      token,
+      body: { publicKey: await exportPublicKey(environmentKeys.publicKey), wrappedKey }
+    });
+    console.log(`Created environment ${target.environment}`);
+  } catch (error) {
+    if (!(error instanceof ApiError && error.status === 409)) throw error;
+    console.log(`Environment ${target.environment} already exists`);
+  }
+}
+async function inviteCommand([email]) {
+  if (!email) throw new Error("usage: noenv invite EMAIL");
+  const { deployment, token } = await signedIn();
+  const invite = await api(deployment, "POST", "/v1/users", { token, body: { email } });
+  console.log(invite.emailed ? `Invite emailed to ${email}. The link, in case they need it:` : `Invited ${email}. Send them this link:`);
+  console.log(`  ${invite.inviteUrl}`);
+}
+async function grantCommand([email, role]) {
+  if (!email || !ROLES.includes(role ?? "")) {
+    throw new Error("usage: noenv grant EMAIL reader|editor|admin");
+  }
+  const { deployment, token, identity, target } = await inProject();
+  const user = await findUser(deployment, token, email);
+  await api(deployment, "PUT", `${repoPath(target.repo)}/members/${user.id}`, { token, body: { role } });
+  console.log(`${email} is now ${role} of ${target.repo}`);
+  if (!user.publicKey) {
+    console.log(`${email} has not signed in yet. Run this command again after they sign in to share the key.`);
+    return;
+  }
+  const bundle = await fetchBundle(deployment, token, identity.privateKey, target.repo, target.environment);
+  const wrappedKey = await wrapPrivateKey(bundle.environmentPrivateKey, await importPublicKey(user.publicKey));
+  await api(deployment, "PUT", `${environmentPath(target.repo, target.environment)}/keys/${user.id}`, {
+    token,
+    body: { wrappedKey }
+  });
+  console.log(`Shared the ${target.environment} key with ${email}`);
+}
+async function revokeCommand([email]) {
+  if (!email) throw new Error("usage: noenv revoke EMAIL");
+  const { deployment, token, target } = await inProject();
+  const user = await findUser(deployment, token, email);
+  await api(deployment, "DELETE", `${repoPath(target.repo)}/members/${user.id}`, { token });
+  console.log(`Removed ${email} from ${target.repo}. Rotate secrets they could read.`);
+}
+async function findUser(deployment, token, email) {
+  return api(deployment, "GET", `/v1/users/lookup?email=${encodeURIComponent(email)}`, { token });
+}
+
+// src/commands/secret.ts
+async function secretCommand([action, ...args2]) {
+  const handlers = {
+    set: setSecret,
+    list: listSecrets,
+    history: secretHistory,
+    rollback: rollbackSecret
+  };
+  const handler = handlers[action ?? ""];
+  if (!handler) {
+    throw new Error("usage: noenv secret set|list|history|rollback");
+  }
+  await handler(args2);
+}
+async function setSecret([name2]) {
+  requireName(name2);
+  const { deployment, token, identity, target } = await inProject();
+  const value = await readSecretValue(`Value for ${name2}: `);
+  if (value === "") {
+    throw new Error("the value is empty, nothing was saved");
+  }
+  const store = remoteSecretStore(deployment, token, identity, target.repo, target.environment);
+  const version = await store.set(name2, value);
+  await markChanged(deployment, target.repo, target.environment);
+  console.log(`Saved ${name2} as version ${version} in ${target.repo} (${target.environment})`);
+}
+async function listSecrets() {
+  const { deployment, token, target } = await inProject();
+  const { secrets } = await api(
+    deployment,
+    "GET",
+    `${environmentPath(target.repo, target.environment)}/secrets`,
+    { token }
+  );
+  for (const secret of secrets) {
+    console.log(`${secret.name}	v${secret.version}	${secret.updatedAt}	${secret.author}`);
+  }
+}
+async function secretHistory([name2]) {
+  requireName(name2);
+  const { deployment, token, target } = await inProject();
+  const { versions } = await api(
+    deployment,
+    "GET",
+    `${environmentPath(target.repo, target.environment)}/secrets/${name2}/versions`,
+    { token }
+  );
+  for (const version of versions) {
+    const restored = version.restoredFrom ? `	restored from v${version.restoredFrom}` : "";
+    console.log(`v${version.version}	${version.createdAt}	${version.author}${restored}`);
+  }
+}
+async function rollbackSecret([name2, version]) {
+  requireName(name2);
+  if (!/^\d+$/.test(version ?? "")) {
+    throw new Error("usage: noenv secret rollback KEY VERSION");
+  }
+  const { deployment, token, target } = await inProject();
+  const result = await api(
+    deployment,
+    "POST",
+    `${environmentPath(target.repo, target.environment)}/secrets/${name2}/rollback`,
+    { token, body: { version: Number(version) } }
+  );
+  await markChanged(deployment, target.repo, target.environment);
+  console.log(`Restored ${name2} v${version} as v${result.version}`);
+}
+function requireName(name2) {
+  if (!name2 || !ENV_VAR_NAME.test(name2)) {
+    throw new Error("the secret name must be a valid environment variable name");
+  }
+}
+
+// src/commands/shell.ts
+import { text as text2 } from "node:stream/consumers";
+
+// src/shell.ts
+var HOOKS = {
+  zsh: `_noenv_hook() {
+  local revision=""
+  [[ -n "$_NOENV_REV_FILE" && -r "$_NOENV_REV_FILE" ]] && revision="$(<"$_NOENV_REV_FILE")"
+  if [[ "$PWD" != "$_NOENV_PWD" || -n "$_NOENV_RETRY" || "$revision" != "$_NOENV_REV" ]]; then
+    _NOENV_PWD="$PWD"
+    eval "$(printf '%s' "$_NOENV_STATE" | command noenv hook-env zsh)"
+  fi
+}
+typeset -ag precmd_functions chpwd_functions
+if (( ! \${precmd_functions[(I)_noenv_hook]} )); then precmd_functions=(_noenv_hook $precmd_functions); fi
+if (( ! \${chpwd_functions[(I)_noenv_hook]} )); then chpwd_functions=(_noenv_hook $chpwd_functions); fi
+`,
+  bash: `_noenv_hook() {
+  local previous_exit=$? revision=""
+  [[ -n "$_NOENV_REV_FILE" && -r "$_NOENV_REV_FILE" ]] && revision="$(<"$_NOENV_REV_FILE")"
+  if [[ "$PWD" != "$_NOENV_PWD" || -n "$_NOENV_RETRY" || "$revision" != "$_NOENV_REV" ]]; then
+    _NOENV_PWD="$PWD"
+    eval "$(printf '%s' "$_NOENV_STATE" | command noenv hook-env bash)"
+  fi
+  return $previous_exit
+}
+if [[ ";\${PROMPT_COMMAND:-};" != *";_noenv_hook;"* ]]; then
+  PROMPT_COMMAND="_noenv_hook\${PROMPT_COMMAND:+;$PROMPT_COMMAND}"
+fi
+`
+};
+function parseShell(value) {
+  if (value !== "zsh" && value !== "bash") {
+    throw new Error("shell must be zsh or bash");
+  }
+  return value;
+}
+function hookScript(shell) {
+  return HOOKS[shell];
+}
+function quote(value) {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function exportLine(name2, value) {
+  return `export ${name2}=${quote(value)}`;
+}
+function setLine(name2, value) {
+  return `${name2}=${quote(value)}`;
+}
+function unsetLine(name2) {
+  return `unset ${name2}`;
+}
+
+// src/hook-env.ts
+async function hookEnv(input) {
+  const state = decodeState(input.state);
+  const messages = [];
+  const target = input.deployment ? await findTargetOrReport(input, messages) : null;
+  if (state && target && !state.retry && sameTarget(state, target) && await isCurrent(input, state)) {
+    return { lines: [], messages };
+  }
+  const lines = state ? restoreLines(state) : [];
+  if (!target) {
+    if (state) lines.push(...["_NOENV_STATE", "_NOENV_RETRY", "_NOENV_REV_FILE", "_NOENV_REV"].map(unsetLine));
+    return { lines, messages };
+  }
+  const loaded = await load(input, target, state, messages);
+  lines.push(
+    ...loaded.lines,
+    setLine("_NOENV_STATE", encodeState(loaded.state)),
+    loaded.state.retry ? setLine("_NOENV_RETRY", "1") : unsetLine("_NOENV_RETRY"),
+    ...revisionLines(input, target, loaded.state.revision)
+  );
+  return { lines, messages };
+}
+function sameTarget(state, target) {
+  return state.repo === target.repo && state.environment === target.environment;
+}
+async function isCurrent(input, state) {
+  if (state.revision === void 0 || !input.deployment) return true;
+  return await readMarker(markerPath(input.deployment, state.repo, state.environment)) === String(state.revision);
+}
+function revisionLines(input, target, revision) {
+  if (revision === void 0 || !input.deployment) return [unsetLine("_NOENV_REV_FILE"), unsetLine("_NOENV_REV")];
+  return [setLine("_NOENV_REV_FILE", markerPath(input.deployment, target.repo, target.environment)), setLine("_NOENV_REV", String(revision))];
+}
+async function load(input, target, state, messages) {
+  const { deployment } = input;
+  const empty = { repo: target.repo, environment: target.environment, previous: {}, retry: false };
+  try {
+    const token = await loadSession(deployment);
+    if (!token) {
+      return { lines: [], state: await signIn(input, empty, state, messages) };
+    }
+    const identity = await loadIdentity(deployment) ?? await ensureIdentity(deployment, token);
+    let bundle = await fetchBundle(deployment, token, identity.privateKey, target.repo, target.environment);
+    const dotenv = await enforceDotenv({ deployment, token, identity, target, bundle }, messages);
+    if (dotenv.blocked) {
+      return { lines: [], state: empty };
+    }
+    if (dotenv.changed) {
+      bundle = await fetchBundle(deployment, token, identity.privateKey, target.repo, target.environment);
+    }
+    const lines = [];
+    const previous = {};
+    for (const [name2, value] of Object.entries(bundle.secrets)) {
+      previous[name2] = state && name2 in state.previous ? state.previous[name2] : input.env[name2] ?? null;
+      lines.push(exportLine(name2, value));
+    }
+    const reloaded = state !== null && sameTarget(state, target) && state.revision !== void 0;
+    messages.push(`${reloaded ? "updated" : "loaded"} ${lines.length} secrets for ${target.repo} (${target.environment})`);
+    const missing = target.requiredSecrets.filter((name2) => !(name2 in bundle.secrets));
+    if (missing.length > 0) {
+      messages.push(`missing required secrets: ${missing.join(", ")}`);
+    }
+    await writeMarker(markerPath(deployment, target.repo, target.environment), String(bundle.revision));
+    await watchEnvironment(deployment, target.repo, target.environment);
+    input.startWatcher();
+    return { lines, state: { ...empty, previous, revision: bundle.revision } };
+  } catch (error) {
+    if (error instanceof ApiError && error.status === 401) {
+      await clearSession(deployment);
+      return { lines: [], state: { ...empty, retry: true } };
+    }
+    if (!(error instanceof ApiError && error.status === 403 && !target.hasConfig)) {
+      messages.push(`could not load secrets for ${target.repo} (${target.environment}): ${describe(error)}`);
+    }
+    return { lines: [], state: empty };
+  }
+}
+async function enforceDotenv(loaded, messages) {
+  const { deployment, token, identity, target, bundle } = loaded;
+  const policy = bundle.policies.dotenv;
+  const store = remoteSecretStore(deployment, token, identity, target.repo, target.environment, bundle);
+  const result = await enforceDotenvPolicy(target.root, policy, store);
+  if (result.files.length === 0) {
+    return { blocked: false, changed: false };
+  }
+  messages.push(...result.files.map((file) => describeOutcome(target, file)));
+  if (result.blocked) {
+    messages.push(`secrets were not loaded: the "${policy.mode}" policy does not allow .env files, run \`noenv migrate\``);
+  }
+  await reportCompliance(deployment, token, target, result).catch(() => messages.push("could not report compliance"));
+  return { blocked: result.blocked, changed: result.files.some((file) => file.status === "deleted") };
+}
+async function signIn(input, empty, state, messages) {
+  const waiting = await readPendingSignIn(input.deployment);
+  if (state?.notified && !(waiting && waiting.expiresAt > Date.now())) {
+    messages.push("sign-in was not completed, run `noenv auth` to try again");
+    return empty;
+  }
+  const { pending, started } = await startSignIn(input.deployment);
+  if (started) {
+    input.startPoller();
+    input.openBrowser(pending.url);
+  }
+  if (started || state?.notified !== pending.userCode) {
+    messages.push(`sign in to load secrets: open ${pending.url} and confirm the code ${pending.userCode}`);
+  }
+  return { ...empty, retry: true, notified: pending.userCode };
+}
+async function findTargetOrReport(input, messages) {
+  try {
+    return await findTarget(input.cwd, input.env);
+  } catch (error) {
+    messages.push(describe(error));
+    return null;
+  }
+}
+function restoreLines(state) {
+  return Object.entries(state.previous).map(([name2, value]) => value === null ? unsetLine(name2) : exportLine(name2, value));
+}
+function encodeState(state) {
+  return Buffer.from(JSON.stringify(state)).toString("base64");
+}
+function decodeState(text3) {
+  if (!text3.trim()) return null;
+  try {
+    return JSON.parse(Buffer.from(text3.trim(), "base64").toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+function describe(error) {
+  return error instanceof Error ? error.message : "unknown error";
+}
+
+// src/commands/shell.ts
+async function shellCommand([shell]) {
+  process.stdout.write(hookScript(parseShell(shell)));
+}
+async function hookEnvCommand([shell]) {
+  parseShell(shell);
+  const state = process.stdin.isTTY ? "" : await text2(process.stdin);
+  const deployment = currentDeployment();
+  const { lines, messages } = await hookEnv({
+    cwd: process.cwd(),
+    env: process.env,
+    state,
+    deployment,
+    startPoller: startBackgroundPoller,
+    startWatcher: () => void (deployment && startWatcher(deployment)),
+    openBrowser
+  });
+  for (const message of messages) process.stderr.write(`noenv: ${message}
+`);
+  process.stdout.write(lines.join("\n"));
+}
+async function watchCommand() {
+  await runWatcher(requireDeployment());
+}
+
+// src/main.ts
+var USAGE = `usage: noenv <command>
+
+  shell zsh|bash             print the shell hook for your shell profile
+  auth                       sign in to the deployment in NOENV_URL
+  status                     show the deployment, user, and project
+  init                       create the project and environment for this repository
+  secret set KEY             save a secret (the value is read without echo)
+  secret list                list secrets in this environment
+  secret history KEY         list the versions of a secret
+  secret rollback KEY VER    restore an older version of a secret
+  migrate                    move .env files of this repository into noenv
+  invite EMAIL               invite a user to this deployment
+  grant EMAIL ROLE           give a user access to this project and environment
+  revoke EMAIL               remove a user from this project
+`;
+var commands = {
+  shell: shellCommand,
+  "hook-env": hookEnvCommand,
+  watch: watchCommand,
+  auth: authCommand,
+  status: statusCommand,
+  init: initCommand,
+  secret: secretCommand,
+  migrate: migrateCommand,
+  invite: inviteCommand,
+  grant: grantCommand,
+  revoke: revokeCommand
+};
+var [name, ...args] = process.argv.slice(2);
+var command = commands[name ?? ""];
+if (!command) {
+  process.stdout.write(USAGE);
+  process.exit(name ? 1 : 0);
+}
+try {
+  await command(args);
+} catch (error) {
+  process.stderr.write(`noenv: ${error instanceof Error ? error.message : "unknown error"}
+`);
+  process.exit(1);
+}
+/*! Bundled license information:
+
+smol-toml/dist/error.js:
+smol-toml/dist/primitive.js:
+smol-toml/dist/date.js:
+smol-toml/dist/extract.js:
+smol-toml/dist/util.js:
+smol-toml/dist/struct.js:
+smol-toml/dist/parse.js:
+smol-toml/dist/stringify.js:
+smol-toml/dist/index.js:
+  (*!
+   * Copyright (c) Squirrel Chat et al., All rights reserved.
+   * SPDX-License-Identifier: BSD-3-Clause
+   *
+   * Redistribution and use in source and binary forms, with or without
+   * modification, are permitted provided that the following conditions are met:
+   *
+   * 1. Redistributions of source code must retain the above copyright notice, this
+   *    list of conditions and the following disclaimer.
+   * 2. Redistributions in binary form must reproduce the above copyright notice,
+   *    this list of conditions and the following disclaimer in the
+   *    documentation and/or other materials provided with the distribution.
+   * 3. Neither the name of the copyright holder nor the names of its contributors
+   *    may be used to endorse or promote products derived from this software without
+   *    specific prior written permission.
+   *
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   *)
+*/