@thisisamank/noenv-cli 0.1.1 → 0.2.1

package/dist/noenv.js

@@ -1,16 +1,93 @@
 #!/usr/bin/env node
 
+// ../packages/config/src/names.ts
+var IDENTIFIER = /^[A-Za-z0-9_-]+$/;
+var ENV_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var REPO = /^[a-z0-9.-]+(\/[a-z0-9._~-]+)+$/;
+
+// src/deployment.ts
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+// src/files.ts
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+async function readJsonFile(path) {
+  try {
+    return JSON.parse(await readFile(path, "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+async function writeJsonFile(path, value, flag = "w") {
+  await mkdir(dirname(path), { recursive: true, mode: 448 });
+  await writeFile(path, JSON.stringify(value), { mode: 384, flag });
+}
+async function removeFile(path) {
+  await rm(path, { force: true });
+}
+
+// src/deployment.ts
+function configDir(env = process.env) {
+  return env.NOENV_CONFIG_DIR ?? join(env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "noenv");
+}
+function deploymentAt(value, env = process.env, account) {
+  const url = URL.parse(value);
+  if (!url || url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new Error(`${value} is not an http or https URL`);
+  }
+  return { url: url.origin, dir: join(configDir(env), url.host.replace(":", "_")), fetch: globalThis.fetch, account };
+}
+async function readAccounts(env = process.env) {
+  return await readJsonFile(accountsPath(env)) ?? { accounts: {} };
+}
+async function writeAccounts(accounts, env = process.env) {
+  await writeJsonFile(accountsPath(env), accounts);
+}
+function matchAccount(accounts, repo) {
+  let best;
+  for (const [name2, account] of Object.entries(accounts.accounts)) {
+    for (const prefix of account.match) {
+      const clean = prefix.toLowerCase().replace(/\/+$/, "");
+      if ((repo === clean || repo.startsWith(`${clean}/`)) && clean.length > (best?.length ?? -1)) {
+        best = { name: name2, length: clean.length };
+      }
+    }
+  }
+  return best?.name;
+}
+async function resolveDeployment(repo, env = process.env) {
+  const accounts = await readAccounts(env);
+  const name2 = env.NOENV_ACCOUNT || (repo ? matchAccount(accounts, repo) : void 0) || accounts.default;
+  if (name2) {
+    const account = accounts.accounts[name2];
+    if (!account) throw new Error(`there is no account named "${name2}", run \`noenv account list\``);
+    return deploymentAt(account.url, env, name2);
+  }
+  return env.NOENV_URL ? deploymentAt(env.NOENV_URL, env) : null;
+}
+function accountsPath(env) {
+  return join(configDir(env), "accounts.json");
+}
+
+// src/session.ts
+import { spawn } from "node:child_process";
+import { hostname } from "node:os";
+import { join as join3 } from "node:path";
+
 // package.json
 var package_default = {
   name: "@thisisamank/noenv-cli",
-  version: "0.1.1",
+  version: "0.2.1",
   description: "Encrypted environment variables that load when you cd into a repo. CLI for noenv.",
   type: "module",
   bin: {
     noenv: "dist/noenv.js"
   },
   files: [
-    "dist"
+    "dist",
+    "CHANGELOG.md"
   ],
   engines: {
     node: ">=22"
@@ -87,19 +164,6 @@ function environmentPath(repo, environment) {
   return `${repoPath(repo)}/environments/${environment}`;
 }
 
-// src/deployment.ts
-import { homedir } from "node:os";
-import { join } from "node:path";
-function currentDeployment(env = process.env) {
-  if (!env.NOENV_URL) return null;
-  const url = URL.parse(env.NOENV_URL);
-  if (!url || url.protocol !== "https:" && url.protocol !== "http:") {
-    throw new Error("NOENV_URL must be an http or https URL");
-  }
-  const base = env.NOENV_CONFIG_DIR ?? join(env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "noenv");
-  return { url: url.origin, dir: join(base, url.host.replace(":", "_")), fetch: globalThis.fetch };
-}
-
 // src/identity.ts
 import { join as join2 } from "node:path";
 
@@ -206,25 +270,6 @@ async function unwrapPrivateKey(wrapped, recipientPrivateKey) {
   return crypto.subtle.importKey("pkcs8", pkcs8, ECDH, true, ["deriveBits"]);
 }
 
-// src/files.ts
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { dirname } from "node:path";
-async function readJsonFile(path) {
-  try {
-    return JSON.parse(await readFile(path, "utf8"));
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-}
-async function writeJsonFile(path, value, flag = "w") {
-  await mkdir(dirname(path), { recursive: true, mode: 448 });
-  await writeFile(path, JSON.stringify(value), { mode: 384, flag });
-}
-async function removeFile(path) {
-  await rm(path, { force: true });
-}
-
 // src/identity.ts
 async function loadIdentity(deployment) {
   const stored = await readJsonFile(identityPath(deployment));
@@ -256,9 +301,6 @@ function identityPath(deployment) {
 }
 
 // src/session.ts
-import { spawn } from "node:child_process";
-import { hostname } from "node:os";
-import { join as join3 } from "node:path";
 async function loadSession(deployment) {
   const session = await readJsonFile(sessionPath(deployment));
   if (!session) return null;
@@ -270,7 +312,7 @@ async function clearSession(deployment) {
 async function requireSession(deployment) {
   const token = await loadSession(deployment);
   if (!token) {
-    throw new Error("you are not signed in, open a new shell or run `noenv auth`");
+    throw new Error(`you are not signed in to ${deployment.account ?? deployment.url}, open a new shell or run \`noenv auth${deployment.account ? ` ${deployment.account}` : ""}\``);
   }
   return token;
 }
@@ -300,6 +342,25 @@ async function startSignIn(deployment) {
   return { pending, started: true };
 }
 async function waitForSignIn(deployment, pending) {
+  await writeJsonFile(pollerPath(deployment), { pid: process.pid });
+  try {
+    return await poll(deployment, pending);
+  } finally {
+    const poller = await readJsonFile(pollerPath(deployment));
+    if (poller?.pid === process.pid) await removeFile(pollerPath(deployment));
+  }
+}
+async function pollerRunning(deployment) {
+  const poller = await readJsonFile(pollerPath(deployment));
+  if (!poller) return false;
+  try {
+    process.kill(poller.pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+async function poll(deployment, pending) {
   while (pending.expiresAt > Date.now()) {
     await sleep(pending.interval * 1e3);
     try {
@@ -311,7 +372,7 @@ async function waitForSignIn(deployment, pending) {
       await ensureIdentity(deployment, session.token);
       return true;
     } catch (error) {
-      if (!(error instanceof ApiError) || error.message !== "authorization_pending") break;
+      if (!isRetryable(error)) break;
     }
   }
   await removeFile(pendingPath(deployment));
@@ -325,12 +386,19 @@ function openBrowser(url) {
   spawn(command2, [url], { detached: true, stdio: "ignore" }).on("error", () => {
   }).unref();
 }
-function startBackgroundPoller() {
-  spawn(process.execPath, [...process.execArgv, process.argv[1], "auth", "--wait"], {
+function startBackgroundPoller(deployment) {
+  spawn(process.execPath, [...process.execArgv, process.argv[1], "auth", "--wait", deployment.url], {
     detached: true,
     stdio: "ignore"
   }).unref();
 }
+function isRetryable(error) {
+  if (!(error instanceof ApiError)) return true;
+  return error.message === "authorization_pending" || error.status === 429 || error.status >= 500;
+}
+function pollerPath(deployment) {
+  return join3(deployment.dir, "sign-in-poller.json");
+}
 function sessionPath(deployment) {
   return join3(deployment.dir, "session.json");
 }
@@ -338,7 +406,67 @@ function pendingPath(deployment) {
   return join3(deployment.dir, "pending-sign-in.json");
 }
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+
+// src/commands/account.ts
+var USAGE = "usage: noenv account add NAME URL [REPO_PREFIX...] | list | default NAME | remove NAME";
+var PREFIX = /^[a-z0-9.-]+(\/[a-z0-9._~-]+)*\/?$/;
+async function accountCommand([action, ...args2]) {
+  const handlers = {
+    add: addAccount,
+    list: listAccounts,
+    default: setDefault,
+    remove: removeAccount
+  };
+  const handler = handlers[action ?? ""];
+  if (!handler) throw new Error(USAGE);
+  await handler(args2);
+}
+async function addAccount([name2, url, ...match]) {
+  if (!name2 || !url) throw new Error(USAGE);
+  if (!IDENTIFIER.test(name2)) throw new Error('the account name must contain only letters, digits, "_" or "-"');
+  const deployment = deploymentAt(url);
+  const prefixes = match.map((prefix) => prefix.toLowerCase());
+  const invalid = prefixes.find((prefix) => !PREFIX.test(prefix));
+  if (invalid) throw new Error(`${invalid} is not a repository prefix such as github.com/acme`);
+  const accounts = await readAccounts();
+  const clash = Object.entries(accounts.accounts).find(([other, account]) => other !== name2 && deploymentAt(account.url).url === deployment.url);
+  if (clash) throw new Error(`the account "${clash[0]}" already uses ${deployment.url}`);
+  accounts.accounts[name2] = { url: deployment.url, match: prefixes };
+  accounts.default ??= name2;
+  await writeAccounts(accounts);
+  console.log(`Saved account ${name2} (${deployment.url})${accounts.default === name2 ? " as the default" : ""}`);
+  if (!await loadSession(deployment)) console.log(`Run \`noenv auth ${name2}\` to sign in`);
+}
+async function listAccounts() {
+  const accounts = await readAccounts();
+  const entries = Object.entries(accounts.accounts);
+  if (entries.length === 0) {
+    console.log("No accounts. Add one with `noenv account add NAME URL [REPO_PREFIX...]`");
+    return;
+  }
+  for (const [name2, account] of entries) {
+    const signedIn2 = await loadSession(deploymentAt(account.url)) ? "signed in" : "signed out";
+    const marker = accounts.default === name2 ? "*" : " ";
+    const match = account.match.length > 0 ? `  ${account.match.join(", ")}` : "";
+    console.log(`${marker} ${name2}  ${account.url}  ${signedIn2}${match}`);
+  }
+}
+async function setDefault([name2]) {
+  const accounts = await readAccounts();
+  if (!name2 || !accounts.accounts[name2]) throw new Error(`there is no account named "${name2 ?? ""}"`);
+  accounts.default = name2;
+  await writeAccounts(accounts);
+  console.log(`${name2} is now the default account`);
+}
+async function removeAccount([name2]) {
+  const accounts = await readAccounts();
+  if (!name2 || !accounts.accounts[name2]) throw new Error(`there is no account named "${name2 ?? ""}"`);
+  delete accounts.accounts[name2];
+  if (accounts.default === name2) delete accounts.default;
+  await writeAccounts(accounts);
+  console.log(`Removed account ${name2}. Its key stays on this machine, so adding it again keeps your access.`);
 }
 
 // ../packages/config/src/errors.ts
@@ -1103,15 +1231,11 @@ function parse(toml, options = {}) {
 // ../node_modules/smol-toml/dist/stringify.js
 var HAS_WELLFORMED = !!"".isWellFormed;
 
-// ../packages/config/src/names.ts
-var IDENTIFIER = /^[A-Za-z0-9_-]+$/;
-var ENV_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-var REPO = /^[a-z0-9.-]+(\/[a-z0-9._~-]+)+$/;
-
 // ../packages/config/src/parse.ts
 var DEFAULT_CONFIG = {
   environment: "development",
-  requiredSecrets: []
+  requiredSecrets: [],
+  wrangler: { secrets: [] }
 };
 function parseConfig(text3) {
   const raw = parse(text3);
@@ -1127,7 +1251,24 @@ function parseConfig(text3) {
   if (!Array.isArray(required) || !required.every(isEnvVarName)) {
     throw new ConfigError("secrets.required must be a list of valid variable names");
   }
-  return { environment, requiredSecrets: required };
+  return { environment, requiredSecrets: required, wrangler: parseWrangler(raw.wrangler) };
+}
+function parseWrangler(value) {
+  const raw = value ?? {};
+  const secrets = raw.secrets ?? [];
+  if (!Array.isArray(secrets) || !secrets.every(isEnvVarName)) {
+    throw new ConfigError("wrangler.secrets must be a list of valid variable names");
+  }
+  const config = { secrets };
+  for (const key of ["environment", "env"]) {
+    const field = raw[key];
+    if (field === void 0) continue;
+    if (typeof field !== "string" || !IDENTIFIER.test(field)) {
+      throw new ConfigError(`wrangler.${key} must contain only letters, digits, "_" or "-"`);
+    }
+    config[key] = field;
+  }
+  return config;
 }
 function isEnvVarName(value) {
   return typeof value === "string" && ENV_VAR_NAME.test(value);
@@ -1167,8 +1308,7 @@ import { promisify } from "node:util";
 var run = promisify(execFile);
 async function readGitOrigin(dir) {
   try {
-    const root = await git(dir, "rev-parse", "--show-toplevel");
-    const url = await git(dir, "config", "--get", "remote.origin.url");
+    const [root, url] = await Promise.all([git(dir, "rev-parse", "--show-toplevel"), git(dir, "config", "--get", "remote.origin.url")]);
     return { root, url };
   } catch {
     return null;
@@ -1219,30 +1359,33 @@ async function requireTarget(cwd = process.cwd(), env = process.env) {
 }
 
 // src/context.ts
-function requireDeployment() {
-  const deployment = currentDeployment();
+async function requireDeployment(repo) {
+  const found = repo ?? (await findTarget(process.cwd(), process.env).catch(() => null))?.repo ?? null;
+  const deployment = await resolveDeployment(found);
   if (!deployment) {
-    throw new Error("NOENV_URL is not set, add the lines from your noenv landing page to your shell profile");
+    throw new Error("no noenv account is set up, run `noenv account add NAME URL` or set NOENV_URL");
   }
   return deployment;
 }
-async function signedIn() {
-  const deployment = requireDeployment();
+async function signedIn(repo) {
+  const deployment = await requireDeployment(repo);
   const token = await requireSession(deployment);
   return { deployment, token, identity: await ensureIdentity(deployment, token) };
 }
 async function inProject() {
-  return { ...await signedIn(), target: await requireTarget() };
+  const target = await requireTarget();
+  return { ...await signedIn(target.repo), target };
 }
 
 // src/commands/auth.ts
 async function authCommand(args2) {
-  const deployment = requireDeployment();
-  if (args2.includes("--wait")) {
-    const pending2 = await readPendingSignIn(deployment);
-    if (pending2) await waitForSignIn(deployment, pending2);
+  if (args2[0] === "--wait") {
+    const deployment2 = args2[1] ? deploymentAt(args2[1]) : await requireDeployment();
+    const pending2 = await readPendingSignIn(deployment2);
+    if (pending2) await waitForSignIn(deployment2, pending2);
     return;
   }
+  const deployment = await accountOrCurrent(args2[0]);
   const { pending, started } = await startSignIn(deployment);
   console.log(`Open ${pending.url} and confirm the code ${pending.userCode}`);
   if (started) openBrowser(pending.url);
@@ -1250,10 +1393,12 @@ async function authCommand(args2) {
     throw new Error("sign-in was not completed");
   }
   const me = await api(deployment, "GET", "/v1/me", { token: await loadSession(deployment) });
-  console.log(`Signed in as ${me.email}`);
+  console.log(`Signed in to ${label(deployment)} as ${me.email}`);
 }
 async function statusCommand() {
-  const deployment = requireDeployment();
+  const target = await findTarget(process.cwd(), process.env);
+  const deployment = await requireDeployment(target?.repo);
+  if (deployment.account) console.log(`Account:     ${deployment.account}`);
   console.log(`Deployment:  ${deployment.url}`);
   const token = await loadSession(deployment);
   if (!token) {
@@ -1262,7 +1407,6 @@ async function statusCommand() {
   }
   const me = await api(deployment, "GET", "/v1/me", { token });
   console.log(`Signed in:   ${me.email}${me.isAdmin ? " (organization admin)" : ""}`);
-  const target = await findTarget(process.cwd(), process.env);
   if (!target) {
     console.log("Project:     none (not in a git repository with an origin)");
     return;
@@ -1277,6 +1421,44 @@ async function statusCommand() {
     console.log("Secrets:     no access");
   }
 }
+async function accountOrCurrent(name2) {
+  if (!name2) return requireDeployment();
+  return await resolveDeployment(null, { ...process.env, NOENV_ACCOUNT: name2 });
+}
+function label(deployment) {
+  return deployment.account ?? deployment.url;
+}
+
+// src/commands/exec.ts
+import { spawn as spawn3 } from "node:child_process";
+import { constants } from "node:os";
+
+// src/bundle.ts
+async function fetchRawBundle(deployment, token, repo, environment) {
+  return api(deployment, "GET", `${environmentPath(repo, environment)}/bundle`, { token });
+}
+async function openBundle(raw, privateKey, environment) {
+  const environmentPrivateKey = await unwrapPrivateKey(raw.wrappedKey, privateKey);
+  const secrets = {};
+  for (const { name: name2, sealed } of raw.secrets) {
+    secrets[name2] = await decryptSecret(environmentPrivateKey, sealed, { projectId: raw.projectId, environment, name: name2 });
+  }
+  return {
+    projectId: raw.projectId,
+    revision: raw.revision,
+    policies: raw.policies,
+    environmentPublicKey: await importPublicKey(raw.publicKey),
+    environmentPrivateKey,
+    secrets
+  };
+}
+async function fetchBundle(deployment, token, privateKey, repo, environment) {
+  return openBundle(await fetchRawBundle(deployment, token, repo, environment), privateKey, environment);
+}
+
+// src/refresh.ts
+import { createHash as createHash2 } from "node:crypto";
+import { join as join7 } from "node:path";
 
 // ../packages/policy/src/defaults.ts
 var DEFAULT_POLICIES = {
@@ -1397,27 +1579,6 @@ async function deleteAfterMigration(path, store) {
   }
 }
 
-// src/commands/migrate.ts
-import { relative as relative2 } from "node:path";
-
-// src/bundle.ts
-async function fetchBundle(deployment, token, privateKey, repo, environment) {
-  const raw = await api(deployment, "GET", `${environmentPath(repo, environment)}/bundle`, { token });
-  const environmentPrivateKey = await unwrapPrivateKey(raw.wrappedKey, privateKey);
-  const secrets = {};
-  for (const { name: name2, sealed } of raw.secrets) {
-    secrets[name2] = await decryptSecret(environmentPrivateKey, sealed, { projectId: raw.projectId, environment, name: name2 });
-  }
-  return {
-    projectId: raw.projectId,
-    revision: raw.revision,
-    policies: raw.policies,
-    environmentPublicKey: await importPublicKey(raw.publicKey),
-    environmentPrivateKey,
-    secrets
-  };
-}
-
 // src/compliance.ts
 import { relative } from "node:path";
 var DESCRIPTIONS = {
@@ -1443,48 +1604,6 @@ async function reportCompliance(deployment, token, target, result) {
   });
 }
 
-// src/prompt.ts
-import { createInterface } from "node:readline/promises";
-import { text } from "node:stream/consumers";
-async function readSecretValue(label) {
-  if (!process.stdin.isTTY) {
-    return (await text(process.stdin)).replace(/\r?\n$/, "");
-  }
-  process.stderr.write(label);
-  process.stdin.setRawMode(true);
-  process.stdin.resume();
-  return new Promise((resolve) => {
-    let value = "";
-    const onData = (chunk) => {
-      for (const char of chunk.toString("utf8")) {
-        if (char === "\r" || char === "\n") {
-          finish();
-          return resolve(value);
-        }
-        if (char === "") {
-          finish();
-          process.exit(130);
-        }
-        value = char === "\x7F" ? value.slice(0, -1) : value + char;
-      }
-    };
-    const finish = () => {
-      process.stdin.off("data", onData);
-      process.stdin.setRawMode(false);
-      process.stdin.pause();
-      process.stderr.write("\n");
-    };
-    process.stdin.on("data", onData);
-  });
-}
-async function confirm(question) {
-  if (!process.stdin.isTTY) return false;
-  const readline = createInterface({ input: process.stdin, output: process.stderr });
-  const answer = await readline.question(`${question} [y/N] `);
-  readline.close();
-  return answer.trim().toLowerCase() === "y";
-}
-
 // src/secret-store.ts
 function remoteSecretStore(deployment, token, identity, repo, environment, initial = null) {
   let cached = initial;
@@ -1533,7 +1652,7 @@ async function watchEnvironment(deployment, repo, environment) {
 }
 async function startWatcher(deployment) {
   if (await isWatcherRunning(deployment)) return;
-  spawn2(process.execPath, [...process.execArgv, process.argv[1], "watch"], { detached: true, stdio: "ignore" }).unref();
+  spawn2(process.execPath, [...process.execArgv, process.argv[1], "watch", deployment.url], { detached: true, stdio: "ignore" }).unref();
 }
 async function runWatcher(deployment) {
   try {
@@ -1544,7 +1663,7 @@ async function runWatcher(deployment) {
   }
   try {
     while (await checkForUpdates(deployment)) {
-      await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+      await new Promise((resolve2) => setTimeout(resolve2, POLL_INTERVAL_MS));
     }
   } finally {
     await removeFile(pidPath(deployment));
@@ -1566,7 +1685,8 @@ async function refreshMarkers(deployment, token, entries) {
   });
   for (const { repo, environment, revision } of revisions) {
     const path = markerPath(deployment, repo, environment);
-    if (await readMarker(path) !== String(revision)) await writeMarker(path, String(revision));
+    const marker = await readMarker(path);
+    if (marker !== CHANGED && marker.split(":")[0] !== String(revision)) await writeMarker(path, CHANGED);
   }
 }
 async function isWatcherRunning(deployment) {
@@ -1586,7 +1706,478 @@ function pidPath(deployment) {
   return join6(deployment.dir, "watcher.pid");
 }
 
+// src/refresh.ts
+async function readCache(deployment, target) {
+  return readJsonFile(cachePath(deployment, target)).catch(() => null);
+}
+async function refresh(deployment, target) {
+  const entry = await fetchEntry(deployment, target);
+  if (!entry) return null;
+  await writeJsonFile(cachePath(deployment, target), entry);
+  await writeMarker(markerPath(deployment, target.repo, target.environment), `${"raw" in entry ? entry.raw.revision : "x"}:${Date.now()}`);
+  return entry;
+}
+async function fetchEntry(deployment, target) {
+  try {
+    const token = await loadSession(deployment);
+    if (!token) return { error: "you are not signed in", status: 401 };
+    const identity = await loadIdentity(deployment) ?? await ensureIdentity(deployment, token);
+    let raw = await fetchRawBundle(deployment, token, target.repo, target.environment);
+    const bundle = await openBundle(raw, identity.privateKey, target.environment);
+    const policy = bundle.policies.dotenv;
+    const store = remoteSecretStore(deployment, token, identity, target.repo, target.environment, bundle);
+    const result = await enforceDotenvPolicy(target.root, policy, store);
+    const notes = result.files.map((file) => describeOutcome(target, file));
+    if (result.files.length > 0) {
+      await reportCompliance(deployment, token, target, result).catch(() => notes.push("could not report compliance"));
+    }
+    if (result.blocked) {
+      notes.push(`secrets were not loaded: the "${policy.mode}" policy does not allow .env files, run \`noenv migrate\``);
+    }
+    if (result.files.some((file) => file.status === "deleted")) {
+      raw = await fetchRawBundle(deployment, token, target.repo, target.environment);
+    }
+    return { raw, notes, blocked: result.blocked };
+  } catch (error) {
+    if (!(error instanceof ApiError)) return null;
+    if (error.status === 401) await clearSession(deployment);
+    return { error: error.message, status: error.status };
+  }
+}
+function cachePath(deployment, target) {
+  const name2 = createHash2("sha256").update(`${target.repo}\0${target.environment}`).digest("hex").slice(0, 32);
+  return join7(deployment.dir, "bundles", `${name2}.json`);
+}
+
+// src/shell.ts
+var FIND_ROOT = `_noenv_root() {
+  local dir="$PWD"
+  until [[ -e "$dir/.git" || "$dir" == "/" ]]; do dir="\${dir%/*}"; dir="\${dir:-/}"; done
+  if [[ -e "$dir/.git" ]]; then REPLY="$dir"; else REPLY=""; fi
+}
+`;
+var HOOKS = {
+  zsh: `${FIND_ROOT}_noenv_hook() {
+  local revision="" REPLY
+  _noenv_root
+  [[ -n "$_NOENV_REV_FILE" && -r "$_NOENV_REV_FILE" ]] && revision="$(<"$_NOENV_REV_FILE")"
+  if [[ "$REPLY" != "$_NOENV_ROOT" || -n "$_NOENV_RETRY" || "$revision" != "$_NOENV_REV" ]]; then
+    _NOENV_ROOT="$REPLY"
+    if [[ -z "$REPLY" && ( -n "$_NOENV_RESTORE" || -z "$_NOENV_STATE" ) ]]; then
+      eval "$_NOENV_RESTORE"
+    else
+      eval "$(printf '%s' "$_NOENV_STATE" | command noenv hook-env zsh)"
+    fi
+  fi
+}
+_noenv_refresh() {
+  local fd
+  exec {fd}< <(command noenv refresh "$@" 2>/dev/null; print)
+  zle -F -w "$fd" _noenv_ready 2>/dev/null || exec {fd}<&-
+}
+_noenv_ready() {
+  local fd="$1"
+  zle -F "$fd"
+  exec {fd}<&-
+  zle -I
+  _noenv_hook
+  zle reset-prompt
+}
+zle -N _noenv_ready 2>/dev/null
+typeset -ag precmd_functions chpwd_functions
+if (( ! \${precmd_functions[(I)_noenv_hook]} )); then precmd_functions=(_noenv_hook $precmd_functions); fi
+if (( ! \${chpwd_functions[(I)_noenv_hook]} )); then chpwd_functions=(_noenv_hook $chpwd_functions); fi
+`,
+  bash: `${FIND_ROOT}_noenv_hook() {
+  local previous_exit=$? revision="" REPLY
+  _noenv_root
+  [[ -n "$_NOENV_REV_FILE" && -r "$_NOENV_REV_FILE" ]] && revision="$(<"$_NOENV_REV_FILE")"
+  if [[ "$REPLY" != "$_NOENV_ROOT" || -n "$_NOENV_RETRY" || "$revision" != "$_NOENV_REV" ]]; then
+    _NOENV_ROOT="$REPLY"
+    if [[ -z "$REPLY" && ( -n "$_NOENV_RESTORE" || -z "$_NOENV_STATE" ) ]]; then
+      eval "$_NOENV_RESTORE"
+    else
+      eval "$(printf '%s' "$_NOENV_STATE" | command noenv hook-env bash)"
+    fi
+  fi
+  return $previous_exit
+}
+_noenv_refresh() {
+  (command noenv refresh "$@" >/dev/null 2>&1 &)
+}
+if [[ ";\${PROMPT_COMMAND:-};" != *";_noenv_hook;"* ]]; then
+  PROMPT_COMMAND="_noenv_hook\${PROMPT_COMMAND:+;$PROMPT_COMMAND}"
+fi
+`
+};
+function parseShell(value) {
+  if (value !== "zsh" && value !== "bash") {
+    throw new Error("shell must be zsh or bash");
+  }
+  return value;
+}
+function hookScript(shell) {
+  return HOOKS[shell];
+}
+function quote(value) {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function exportLine(name2, value) {
+  return `export ${name2}=${quote(value)}`;
+}
+function setLine(name2, value) {
+  return `${name2}=${quote(value)}`;
+}
+function unsetLine(name2) {
+  return `unset ${name2}`;
+}
+
+// src/hook-env.ts
+var STATE_VARIABLES = ["_NOENV_STATE", "_NOENV_RETRY", "_NOENV_REV_FILE", "_NOENV_REV", "_NOENV_RESTORE"];
+async function hookEnv(input) {
+  const state = decodeState(input.state);
+  const messages = [];
+  const resolved = await resolve(input, messages);
+  if (!resolved) {
+    return { lines: state ? [...restoreLines(state), ...STATE_VARIABLES.map(unsetLine)] : [], messages };
+  }
+  const { target, deployment } = resolved;
+  const marker = markerPath(deployment, target.repo, target.environment);
+  const revision = await readMarker(marker);
+  const step = await load(input, resolved, state, revision, messages);
+  return {
+    lines: [
+      ...step.lines,
+      exportLine("_NOENV_STATE", encodeState(step.state)),
+      step.state.retry ? setLine("_NOENV_RETRY", "1") : unsetLine("_NOENV_RETRY"),
+      setLine("_NOENV_REV_FILE", marker),
+      setLine("_NOENV_REV", revision),
+      setLine("_NOENV_RESTORE", [...restoreLines(step.state), ...STATE_VARIABLES.map(unsetLine)].join("\n"))
+    ],
+    messages,
+    refresh: step.refresh ? { url: deployment.url, root: target.root, environment: target.environment } : void 0
+  };
+}
+async function load(input, resolved, state, revision, messages) {
+  const { target, deployment } = resolved;
+  const entering = state === null || !sameTarget(state, resolved);
+  const empty = { url: deployment.url, repo: target.repo, environment: target.environment, previous: {}, retry: false };
+  const restore = state ? restoreLines(state) : [];
+  if (!await loadSession(deployment)) {
+    return { lines: restore, state: await signIn(input, deployment, empty, state, entering, messages), refresh: false };
+  }
+  const entry = await readCache(deployment, target);
+  const identity = await loadIdentity(deployment);
+  const refresh2 = entering || state.retry || revision === CHANGED || !entry || !identity;
+  if (!entering && !state.retry && (!entry || !identity || "raw" in entry && entry.raw.revision === state.revision)) {
+    return { lines: [], state, refresh: refresh2 };
+  }
+  if (!entry || !identity) {
+    return { lines: restore, state: empty, refresh: refresh2 };
+  }
+  const opened = await openEntry(entry, identity.privateKey, target, messages);
+  if (!opened) {
+    return { lines: restore, state: empty, refresh: refresh2 };
+  }
+  const lines = [...restore];
+  const previous = {};
+  for (const [name2, value] of Object.entries(opened.secrets)) {
+    previous[name2] = state && name2 in state.previous ? state.previous[name2] : input.env[name2] ?? null;
+    lines.push(exportLine(name2, value));
+  }
+  const count = Object.keys(opened.secrets).length;
+  const updated = !entering && state.revision !== void 0;
+  messages.push(`${updated ? "updated" : "loaded"} ${count} secrets for ${target.repo} (${target.environment})`);
+  const missing = target.requiredSecrets.filter((name2) => !(name2 in opened.secrets));
+  if (missing.length > 0) messages.push(`missing required secrets: ${missing.join(", ")}`);
+  await watchEnvironment(deployment, target.repo, target.environment);
+  input.startWatcher(deployment);
+  return { lines, state: { ...empty, previous, revision: opened.revision }, refresh: refresh2 };
+}
+async function openEntry(entry, privateKey, target, messages) {
+  if ("error" in entry) {
+    if (!(entry.status === 403 && !target.hasConfig) && entry.status !== 401) {
+      messages.push(`could not load secrets for ${target.repo} (${target.environment}): ${entry.error}`);
+    }
+    return null;
+  }
+  messages.push(...entry.notes);
+  if (entry.blocked) return null;
+  try {
+    const bundle = await openBundle(entry.raw, privateKey, target.environment);
+    return { secrets: bundle.secrets, revision: bundle.revision };
+  } catch (error) {
+    messages.push(`could not decrypt secrets for ${target.repo} (${target.environment}): ${describe(error)}`);
+    return null;
+  }
+}
+function sameTarget(state, { target, deployment }) {
+  return state.url === deployment.url && state.repo === target.repo && state.environment === target.environment;
+}
+async function signIn(input, deployment, empty, state, entering, messages) {
+  const waiting = await readPendingSignIn(deployment);
+  if (state?.notified && !entering && !(waiting && waiting.expiresAt > Date.now())) {
+    messages.push("sign-in was not completed, enter the repository again or run `noenv auth` to retry");
+    return empty;
+  }
+  try {
+    const { pending, started } = await startSignIn(deployment);
+    if (started) input.openBrowser(pending.url);
+    if (started || !await input.pollerRunning(deployment)) input.startPoller(deployment);
+    if (started || state?.notified !== pending.userCode) {
+      const account = deployment.account ? ` to ${deployment.account}` : "";
+      messages.push(`sign in${account} to load secrets: open ${pending.url} and confirm the code ${pending.userCode}`);
+    }
+    return { ...empty, retry: true, notified: pending.userCode };
+  } catch (error) {
+    messages.push(`could not start sign-in: ${describe(error)}`);
+    return empty;
+  }
+}
+async function resolve(input, messages) {
+  try {
+    const target = await findTarget(input.cwd, input.env);
+    const deployment = target && await input.resolveDeployment(target.repo);
+    return target && deployment ? { target, deployment } : null;
+  } catch (error) {
+    messages.push(describe(error));
+    return null;
+  }
+}
+function restoreLines(state) {
+  return Object.entries(state.previous).map(([name2, value]) => value === null ? unsetLine(name2) : exportLine(name2, value));
+}
+function encodeState(state) {
+  return Buffer.from(JSON.stringify(state)).toString("base64");
+}
+function decodeState(text3) {
+  if (!text3?.trim()) return null;
+  try {
+    return JSON.parse(Buffer.from(text3.trim(), "base64").toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+function describe(error) {
+  return error instanceof Error ? error.message : "unknown error";
+}
+
+// src/commands/exec.ts
+var SHELL_STATE = ["_NOENV_STATE", "_NOENV_RETRY", "_NOENV_REV_FILE", "_NOENV_REV", "_NOENV_ROOT"];
+async function execCommand(args2) {
+  const command2 = args2[0] === "--" ? args2.slice(1) : args2;
+  if (command2.length === 0) throw new Error("usage: noenv exec -- COMMAND [ARGS...]");
+  const env = withoutLoadedSecrets(process.env);
+  const secrets = await projectSecrets(env);
+  const child = spawn3(command2[0], command2.slice(1), { stdio: "inherit", env: { ...env, ...secrets } });
+  for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) process.on(signal, () => child.kill(signal));
+  const code = await new Promise((resolve2, reject) => {
+    child.on("error", reject);
+    child.on("exit", (exitCode, signal) => resolve2(exitCode ?? 128 + (signal ? constants.signals[signal] : 0)));
+  });
+  process.exit(code);
+}
+function withoutLoadedSecrets(env) {
+  const state = decodeState(env._NOENV_STATE);
+  const clean = { ...env };
+  for (const name2 of SHELL_STATE) delete clean[name2];
+  for (const [name2, value] of Object.entries(state?.previous ?? {})) {
+    if (value === null) delete clean[name2];
+    else clean[name2] = value;
+  }
+  return clean;
+}
+async function projectSecrets(env) {
+  const target = await findTarget(process.cwd(), env);
+  if (!target) return note("not in a git repository with an origin, running without secrets");
+  const deployment = await resolveDeployment(target.repo, env);
+  if (!deployment) return note("no account is set up, running without secrets");
+  const token = await requireSession(deployment);
+  const identity = await loadIdentity(deployment) ?? await ensureIdentity(deployment, token);
+  const label2 = `${target.repo} (${target.environment})`;
+  let entry = await refresh(deployment, target);
+  if (!entry) {
+    entry = await readCache(deployment, target);
+    if (!entry) throw new Error(`could not reach ${deployment.url} and there are no cached secrets for ${label2}`);
+    note(`could not reach ${deployment.url}, using cached secrets`);
+  }
+  if ("error" in entry) {
+    if ((entry.status === 403 || entry.status === 404) && !target.hasConfig) {
+      return note(`you have no noenv project for ${target.repo} on ${deployment.account ?? deployment.url}, running without secrets`);
+    }
+    throw new Error(`could not load secrets for ${label2}: ${entry.error}`);
+  }
+  for (const line of entry.notes) note(line);
+  if (entry.blocked) throw new Error(`secrets for ${label2} were not loaded because of the .env policy`);
+  const { secrets } = await openBundle(entry.raw, identity.privateKey, target.environment);
+  note(`loaded ${Object.keys(secrets).length} secrets for ${label2}${deployment.account ? ` from ${deployment.account}` : ""}`);
+  const missing = target.requiredSecrets.filter((name2) => !(name2 in secrets));
+  if (missing.length > 0) note(`missing required secrets: ${missing.join(", ")}`);
+  return secrets;
+}
+function note(message) {
+  process.stderr.write(`noenv: ${message}
+`);
+  return {};
+}
+
+// src/prompt.ts
+import { emitKeypressEvents } from "node:readline";
+import { createInterface } from "node:readline/promises";
+import { text } from "node:stream/consumers";
+async function readSecretValue(label2) {
+  if (!process.stdin.isTTY) {
+    return (await text(process.stdin)).replace(/\r?\n$/, "");
+  }
+  process.stderr.write(label2);
+  process.stdin.setRawMode(true);
+  process.stdin.resume();
+  return new Promise((resolve2) => {
+    let value = "";
+    const onData = (chunk) => {
+      for (const char of chunk.toString("utf8")) {
+        if (char === "\r" || char === "\n") {
+          finish();
+          return resolve2(value);
+        }
+        if (char === "") {
+          finish();
+          process.exit(130);
+        }
+        value = char === "\x7F" ? value.slice(0, -1) : value + char;
+      }
+    };
+    const finish = () => {
+      process.stdin.off("data", onData);
+      process.stdin.setRawMode(false);
+      process.stdin.pause();
+      process.stderr.write("\n");
+    };
+    process.stdin.on("data", onData);
+  });
+}
+async function confirm(question) {
+  if (!process.stdin.isTTY) return false;
+  const readline = createInterface({ input: process.stdin, output: process.stderr });
+  const answer = await readline.question(`${question} [y/N] `);
+  readline.close();
+  return answer.trim().toLowerCase() === "y";
+}
+async function checklist(title, items, checked) {
+  const input = process.stdin;
+  const output = process.stderr;
+  const selected = new Set([...checked].filter((item) => items.includes(item)));
+  const height = Math.min(items.length, Math.max(5, (output.rows ?? 24) - 3));
+  let cursor = 0;
+  let top = 0;
+  let drawn = 0;
+  const render = () => {
+    top = Math.min(Math.max(top, cursor - height + 1), cursor);
+    const rows = items.slice(top, top + height).map((item, offset) => {
+      const active = top + offset === cursor;
+      const line = `${active ? "\u203A" : " "} ${selected.has(item) ? "[x]" : "[ ]"} ${item}`;
+      return active ? `\x1B[1m${line}\x1B[22m` : line;
+    });
+    const help = `\x1B[2m${selected.size} of ${items.length} selected \xB7 space select \xB7 a all \xB7 enter confirm \xB7 esc cancel\x1B[22m`;
+    const lines = [title, ...rows, help];
+    output.write((drawn > 0 ? `\x1B[${drawn}A` : "") + lines.map((line) => `\x1B[2K${line}
+`).join(""));
+    drawn = lines.length;
+  };
+  emitKeypressEvents(input);
+  input.setRawMode(true);
+  input.resume();
+  output.write("\x1B[?25l");
+  return new Promise((resolve2) => {
+    const finish = (result) => {
+      input.off("keypress", onKey);
+      input.setRawMode(false);
+      input.pause();
+      output.write("\x1B[?25h");
+      resolve2(result);
+    };
+    const onKey = (_text, key = {}) => {
+      if (key.ctrl && key.name === "c" || key.name === "escape" || key.name === "q") return finish(null);
+      if (key.name === "return") return finish(items.filter((item) => selected.has(item)));
+      if (key.name === "up" || key.name === "k") cursor = (cursor - 1 + items.length) % items.length;
+      if (key.name === "down" || key.name === "j") cursor = (cursor + 1) % items.length;
+      if (key.name === "space") {
+        const item = items[cursor];
+        if (selected.has(item)) selected.delete(item);
+        else selected.add(item);
+      }
+      if (key.name === "a") {
+        const all = items.every((item) => selected.has(item));
+        for (const item of items) all ? selected.delete(item) : selected.add(item);
+      }
+      render();
+    };
+    input.on("keypress", onKey);
+    render();
+  });
+}
+
+// src/wrangler.ts
+import { spawn as spawn4 } from "node:child_process";
+import { access } from "node:fs/promises";
+import { dirname as dirname2, join as join8 } from "node:path";
+function wranglerSource(target) {
+  return target.wrangler.environment ?? target.environment;
+}
+async function putWranglerSecrets(target, secrets) {
+  const names = Object.keys(secrets);
+  const env = target.wrangler.env ? ` --env ${target.wrangler.env}` : "";
+  console.log(`Pushing ${names.length} secrets from noenv (${wranglerSource(target)}) to Wrangler${env}: ${names.join(", ")}`);
+  const args2 = ["secret", "bulk", ...target.wrangler.env ? ["--env", target.wrangler.env] : []];
+  const child = spawn4(await findWrangler(target.root), args2, { cwd: target.root, stdio: ["pipe", "inherit", "inherit"] });
+  child.stdin.end(JSON.stringify(secrets));
+  const code = await new Promise((resolve2, reject) => {
+    child.on(
+      "error",
+      (error) => reject(error.code === "ENOENT" ? new Error("wrangler is not installed, run `npm install -D wrangler`") : error)
+    );
+    child.on("exit", (exitCode) => resolve2(exitCode ?? 1));
+  });
+  if (code !== 0) throw new Error(`wrangler secret bulk failed with exit code ${code}`);
+}
+async function findWrangler(root) {
+  for (let dir = root; ; dir = dirname2(dir)) {
+    const local = join8(dir, "node_modules", ".bin", "wrangler");
+    if (await access(local).then(() => true, () => false)) return local;
+    if (dirname2(dir) === dir) return "wrangler";
+  }
+}
+
+// src/commands/wrangler.ts
+async function wranglerCommand(args2) {
+  const invalid = args2.find((name2) => !ENV_VAR_NAME.test(name2));
+  if (invalid) throw new Error(`usage: noenv wrangler [KEY...] (${invalid} is not a variable name)`);
+  const { deployment, token, identity, target } = await inProject();
+  const environment = wranglerSource(target);
+  const label2 = `${target.repo} (${environment})`;
+  const { secrets } = await fetchBundle(deployment, token, identity.privateKey, target.repo, environment);
+  const names = Object.keys(secrets).sort();
+  if (names.length === 0) throw new Error(`there are no secrets in ${label2}`);
+  const selected = await choose(args2, names, target.wrangler.secrets, label2);
+  if (!selected) return console.log("Cancelled, nothing was pushed");
+  if (selected.length === 0) return console.log("Nothing selected, nothing was pushed");
+  const missing = selected.filter((name2) => !(name2 in secrets));
+  if (missing.length > 0) throw new Error(`${label2} has no secret named ${missing.join(", ")}`);
+  await putWranglerSecrets(target, Object.fromEntries(selected.map((name2) => [name2, secrets[name2]])));
+}
+async function choose(args2, names, configured, label2) {
+  if (args2.length > 0) return args2;
+  if (process.stdin.isTTY && process.stderr.isTTY) {
+    return checklist(`Push secrets from ${label2} to Wrangler`, names, configured);
+  }
+  if (configured.length === 0) {
+    throw new Error("pass the KEY names, or list them under [wrangler] secrets in .noenv");
+  }
+  return configured;
+}
+
 // src/commands/migrate.ts
+import { relative as relative2 } from "node:path";
 async function migrateCommand() {
   const { deployment, token, identity, target } = await inProject();
   const bundle = await fetchBundle(deployment, token, identity.privateKey, target.repo, target.environment);
@@ -1633,7 +2224,8 @@ async function migrateCommand() {
 }
 
 // src/commands/project.ts
-import { basename } from "node:path";
+import { writeFile as writeFile3 } from "node:fs/promises";
+import { basename, join as join9 } from "node:path";
 var ROLES = ["reader", "editor", "admin"];
 async function initCommand() {
   const { deployment, token, identity, target } = await inProject();
@@ -1655,6 +2247,14 @@ async function initCommand() {
     if (!(error instanceof ApiError && error.status === 409)) throw error;
     console.log(`Environment ${target.environment} already exists`);
   }
+  try {
+    await writeFile3(join9(target.root, CONFIG_FILE), `version = 1
+environment = "${target.environment}"
+`, { flag: "wx" });
+    console.log(`Created ${CONFIG_FILE}, commit it so teammates load this project`);
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+  }
 }
 async function inviteCommand([email]) {
   if (!email) throw new Error("usage: noenv invite EMAIL");
@@ -1719,6 +2319,7 @@ async function setSecret([name2]) {
   const version = await store.set(name2, value);
   await markChanged(deployment, target.repo, target.environment);
   console.log(`Saved ${name2} as version ${version} in ${target.repo} (${target.environment})`);
+  await syncToWrangler(target, name2, async () => value);
 }
 async function listSecrets() {
   const { deployment, token, target } = await inProject();
@@ -1751,7 +2352,7 @@ async function rollbackSecret([name2, version]) {
   if (!/^\d+$/.test(version ?? "")) {
     throw new Error("usage: noenv secret rollback KEY VERSION");
   }
-  const { deployment, token, target } = await inProject();
+  const { deployment, token, identity, target } = await inProject();
   const result = await api(
     deployment,
     "POST",
@@ -1760,250 +2361,104 @@ async function rollbackSecret([name2, version]) {
   );
   await markChanged(deployment, target.repo, target.environment);
   console.log(`Restored ${name2} v${version} as v${result.version}`);
+  await syncToWrangler(target, name2, async () => {
+    const { secrets } = await fetchBundle(deployment, token, identity.privateKey, target.repo, target.environment);
+    return secrets[name2];
+  });
 }
-function requireName(name2) {
-  if (!name2 || !ENV_VAR_NAME.test(name2)) {
-    throw new Error("the secret name must be a valid environment variable name");
-  }
-}
-
-// src/commands/shell.ts
-import { text as text2 } from "node:stream/consumers";
-
-// src/shell.ts
-var HOOKS = {
-  zsh: `_noenv_hook() {
-  local revision=""
-  [[ -n "$_NOENV_REV_FILE" && -r "$_NOENV_REV_FILE" ]] && revision="$(<"$_NOENV_REV_FILE")"
-  if [[ "$PWD" != "$_NOENV_PWD" || -n "$_NOENV_RETRY" || "$revision" != "$_NOENV_REV" ]]; then
-    _NOENV_PWD="$PWD"
-    eval "$(printf '%s' "$_NOENV_STATE" | command noenv hook-env zsh)"
-  fi
-}
-typeset -ag precmd_functions chpwd_functions
-if (( ! \${precmd_functions[(I)_noenv_hook]} )); then precmd_functions=(_noenv_hook $precmd_functions); fi
-if (( ! \${chpwd_functions[(I)_noenv_hook]} )); then chpwd_functions=(_noenv_hook $chpwd_functions); fi
-`,
-  bash: `_noenv_hook() {
-  local previous_exit=$? revision=""
-  [[ -n "$_NOENV_REV_FILE" && -r "$_NOENV_REV_FILE" ]] && revision="$(<"$_NOENV_REV_FILE")"
-  if [[ "$PWD" != "$_NOENV_PWD" || -n "$_NOENV_RETRY" || "$revision" != "$_NOENV_REV" ]]; then
-    _NOENV_PWD="$PWD"
-    eval "$(printf '%s' "$_NOENV_STATE" | command noenv hook-env bash)"
-  fi
-  return $previous_exit
-}
-if [[ ";\${PROMPT_COMMAND:-};" != *";_noenv_hook;"* ]]; then
-  PROMPT_COMMAND="_noenv_hook\${PROMPT_COMMAND:+;$PROMPT_COMMAND}"
-fi
-`
-};
-function parseShell(value) {
-  if (value !== "zsh" && value !== "bash") {
-    throw new Error("shell must be zsh or bash");
-  }
-  return value;
-}
-function hookScript(shell) {
-  return HOOKS[shell];
-}
-function quote(value) {
-  return `'${value.replaceAll("'", `'\\''`)}'`;
-}
-function exportLine(name2, value) {
-  return `export ${name2}=${quote(value)}`;
-}
-function setLine(name2, value) {
-  return `${name2}=${quote(value)}`;
-}
-function unsetLine(name2) {
-  return `unset ${name2}`;
-}
-
-// src/hook-env.ts
-async function hookEnv(input) {
-  const state = decodeState(input.state);
-  const messages = [];
-  const target = input.deployment ? await findTargetOrReport(input, messages) : null;
-  if (state && target && !state.retry && sameTarget(state, target) && await isCurrent(input, state)) {
-    return { lines: [], messages };
-  }
-  const lines = state ? restoreLines(state) : [];
-  if (!target) {
-    if (state) lines.push(...["_NOENV_STATE", "_NOENV_RETRY", "_NOENV_REV_FILE", "_NOENV_REV"].map(unsetLine));
-    return { lines, messages };
-  }
-  const loaded = await load(input, target, state, messages);
-  lines.push(
-    ...loaded.lines,
-    setLine("_NOENV_STATE", encodeState(loaded.state)),
-    loaded.state.retry ? setLine("_NOENV_RETRY", "1") : unsetLine("_NOENV_RETRY"),
-    ...revisionLines(input, target, loaded.state.revision)
-  );
-  return { lines, messages };
-}
-function sameTarget(state, target) {
-  return state.repo === target.repo && state.environment === target.environment;
-}
-async function isCurrent(input, state) {
-  if (state.revision === void 0 || !input.deployment) return true;
-  return await readMarker(markerPath(input.deployment, state.repo, state.environment)) === String(state.revision);
-}
-function revisionLines(input, target, revision) {
-  if (revision === void 0 || !input.deployment) return [unsetLine("_NOENV_REV_FILE"), unsetLine("_NOENV_REV")];
-  return [setLine("_NOENV_REV_FILE", markerPath(input.deployment, target.repo, target.environment)), setLine("_NOENV_REV", String(revision))];
-}
-async function load(input, target, state, messages) {
-  const { deployment } = input;
-  const empty = { repo: target.repo, environment: target.environment, previous: {}, retry: false };
-  try {
-    const token = await loadSession(deployment);
-    if (!token) {
-      return { lines: [], state: await signIn(input, empty, state, messages) };
-    }
-    const identity = await loadIdentity(deployment) ?? await ensureIdentity(deployment, token);
-    let bundle = await fetchBundle(deployment, token, identity.privateKey, target.repo, target.environment);
-    const dotenv = await enforceDotenv({ deployment, token, identity, target, bundle }, messages);
-    if (dotenv.blocked) {
-      return { lines: [], state: empty };
-    }
-    if (dotenv.changed) {
-      bundle = await fetchBundle(deployment, token, identity.privateKey, target.repo, target.environment);
-    }
-    const lines = [];
-    const previous = {};
-    for (const [name2, value] of Object.entries(bundle.secrets)) {
-      previous[name2] = state && name2 in state.previous ? state.previous[name2] : input.env[name2] ?? null;
-      lines.push(exportLine(name2, value));
-    }
-    const reloaded = state !== null && sameTarget(state, target) && state.revision !== void 0;
-    messages.push(`${reloaded ? "updated" : "loaded"} ${lines.length} secrets for ${target.repo} (${target.environment})`);
-    const missing = target.requiredSecrets.filter((name2) => !(name2 in bundle.secrets));
-    if (missing.length > 0) {
-      messages.push(`missing required secrets: ${missing.join(", ")}`);
-    }
-    await writeMarker(markerPath(deployment, target.repo, target.environment), String(bundle.revision));
-    await watchEnvironment(deployment, target.repo, target.environment);
-    input.startWatcher();
-    return { lines, state: { ...empty, previous, revision: bundle.revision } };
-  } catch (error) {
-    if (error instanceof ApiError && error.status === 401) {
-      await clearSession(deployment);
-      return { lines: [], state: { ...empty, retry: true } };
-    }
-    if (!(error instanceof ApiError && error.status === 403 && !target.hasConfig)) {
-      messages.push(`could not load secrets for ${target.repo} (${target.environment}): ${describe(error)}`);
-    }
-    return { lines: [], state: empty };
-  }
-}
-async function enforceDotenv(loaded, messages) {
-  const { deployment, token, identity, target, bundle } = loaded;
-  const policy = bundle.policies.dotenv;
-  const store = remoteSecretStore(deployment, token, identity, target.repo, target.environment, bundle);
-  const result = await enforceDotenvPolicy(target.root, policy, store);
-  if (result.files.length === 0) {
-    return { blocked: false, changed: false };
-  }
-  messages.push(...result.files.map((file) => describeOutcome(target, file)));
-  if (result.blocked) {
-    messages.push(`secrets were not loaded: the "${policy.mode}" policy does not allow .env files, run \`noenv migrate\``);
-  }
-  await reportCompliance(deployment, token, target, result).catch(() => messages.push("could not report compliance"));
-  return { blocked: result.blocked, changed: result.files.some((file) => file.status === "deleted") };
-}
-async function signIn(input, empty, state, messages) {
-  const waiting = await readPendingSignIn(input.deployment);
-  if (state?.notified && !(waiting && waiting.expiresAt > Date.now())) {
-    messages.push("sign-in was not completed, run `noenv auth` to try again");
-    return empty;
-  }
-  const { pending, started } = await startSignIn(input.deployment);
-  if (started) {
-    input.startPoller();
-    input.openBrowser(pending.url);
-  }
-  if (started || state?.notified !== pending.userCode) {
-    messages.push(`sign in to load secrets: open ${pending.url} and confirm the code ${pending.userCode}`);
+async function syncToWrangler(target, name2, value) {
+  if (!target.wrangler.secrets.includes(name2)) return;
+  if (wranglerSource(target) !== target.environment) {
+    console.log(`Not pushed to Wrangler: .noenv pushes values from ${wranglerSource(target)}, not ${target.environment}`);
+    return;
   }
-  return { ...empty, retry: true, notified: pending.userCode };
-}
-async function findTargetOrReport(input, messages) {
   try {
-    return await findTarget(input.cwd, input.env);
+    await putWranglerSecrets(target, { [name2]: await value() });
   } catch (error) {
-    messages.push(describe(error));
-    return null;
+    const reason = error instanceof Error ? error.message : "unknown error";
+    throw new Error(`${name2} is saved in noenv, but the Wrangler update failed: ${reason}. Run \`noenv wrangler ${name2}\` to try again`);
   }
 }
-function restoreLines(state) {
-  return Object.entries(state.previous).map(([name2, value]) => value === null ? unsetLine(name2) : exportLine(name2, value));
-}
-function encodeState(state) {
-  return Buffer.from(JSON.stringify(state)).toString("base64");
-}
-function decodeState(text3) {
-  if (!text3.trim()) return null;
-  try {
-    return JSON.parse(Buffer.from(text3.trim(), "base64").toString("utf8"));
-  } catch {
-    return null;
+function requireName(name2) {
+  if (!name2 || !ENV_VAR_NAME.test(name2)) {
+    throw new Error("the secret name must be a valid environment variable name");
   }
 }
-function describe(error) {
-  return error instanceof Error ? error.message : "unknown error";
-}
 
 // src/commands/shell.ts
+import { text as text2 } from "node:stream/consumers";
 async function shellCommand([shell]) {
   process.stdout.write(hookScript(parseShell(shell)));
 }
 async function hookEnvCommand([shell]) {
   parseShell(shell);
   const state = process.stdin.isTTY ? "" : await text2(process.stdin);
-  const deployment = currentDeployment();
-  const { lines, messages } = await hookEnv({
+  const { lines, messages, refresh: job } = await hookEnv({
     cwd: process.cwd(),
     env: process.env,
     state,
-    deployment,
+    resolveDeployment: (repo) => resolveDeployment(repo),
     startPoller: startBackgroundPoller,
-    startWatcher: () => void (deployment && startWatcher(deployment)),
+    pollerRunning,
+    startWatcher: (deployment) => void startWatcher(deployment),
     openBrowser
   });
   for (const message of messages) process.stderr.write(`noenv: ${message}
 `);
+  if (job) lines.push(`_noenv_refresh ${quote(job.url)} ${quote(job.root)} ${quote(job.environment)}`);
   process.stdout.write(lines.join("\n"));
 }
-async function watchCommand() {
-  await runWatcher(requireDeployment());
+async function refreshCommand([url, root, environment]) {
+  if (!url || !root || !environment) throw new Error("usage: noenv refresh URL ROOT ENVIRONMENT");
+  const target = await findTarget(root, { ...process.env, NOENV_ENVIRONMENT: environment });
+  if (target) await refresh(deploymentAt(url), target);
+}
+async function watchCommand([url]) {
+  if (!url) throw new Error("usage: noenv watch URL");
+  await runWatcher(deploymentAt(url));
 }
 
 // src/main.ts
-var USAGE = `usage: noenv <command>
+var USAGE2 = `usage: noenv <command>
 
   shell zsh|bash             print the shell hook for your shell profile
-  auth                       sign in to the deployment in NOENV_URL
-  status                     show the deployment, user, and project
-  init                       create the project and environment for this repository
+  account add NAME URL [PREFIX...]
+                             add an account, such as work or personal; repos
+                             under a PREFIX (github.com/acme) use it
+  account list               list accounts, * marks the default
+  account default NAME       use NAME where no prefix matches
+  account remove NAME        forget an account
+  auth [NAME]                sign in to an account (default: the one for this repo)
+  status                     show the account, user, and project
+  init                       create the project, the environment, and the .noenv file
+  exec -- COMMAND            run COMMAND with this repository's secrets, for agents,
+                             scripts, and CI; it picks the account and project from
+                             the current directory
   secret set KEY             save a secret (the value is read without echo)
   secret list                list secrets in this environment
   secret history KEY         list the versions of a secret
   secret rollback KEY VER    restore an older version of a secret
   migrate                    move .env files of this repository into noenv
+  wrangler [KEY...]          push secrets to the Worker with wrangler; without KEY,
+                             pick them in a list (keys under [wrangler] secrets in
+                             .noenv are checked; without a terminal, push those)
   invite EMAIL               invite a user to this deployment
   grant EMAIL ROLE           give a user access to this project and environment
   revoke EMAIL               remove a user from this project
 `;
 var commands = {
+  account: accountCommand,
   shell: shellCommand,
   "hook-env": hookEnvCommand,
+  refresh: refreshCommand,
+  exec: execCommand,
   watch: watchCommand,
   auth: authCommand,
   status: statusCommand,
   init: initCommand,
   secret: secretCommand,
   migrate: migrateCommand,
+  wrangler: wranglerCommand,
   invite: inviteCommand,
   grant: grantCommand,
   revoke: revokeCommand
@@ -2011,7 +2466,7 @@ var commands = {
 var [name, ...args] = process.argv.slice(2);
 var command = commands[name ?? ""];
 if (!command) {
-  process.stdout.write(USAGE);
+  process.stdout.write(USAGE2);
   process.exit(name ? 1 : 0);
 }
 try {