@vaultic-dev/cli 0.1.0

package/dist/index.js

@@ -0,0 +1,2034 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Command } from "commander";
+
+// src/commands/init.ts
+import prompts from "prompts";
+
+// src/lib/credentials.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from "fs";
+import path from "path";
+import os from "os";
+var CONFIG_DIR = path.join(os.homedir(), ".vaultic");
+var CREDENTIALS_PATH = path.join(CONFIG_DIR, "credentials.json");
+var DEFAULT_SERVER_URL = "https://vaultic.dev/api";
+function loadCredentials() {
+  if (!existsSync(CREDENTIALS_PATH)) return null;
+  try {
+    return JSON.parse(readFileSync(CREDENTIALS_PATH, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function saveCredentials(creds) {
+  mkdirSync(CONFIG_DIR, { recursive: true });
+  writeFileSync(CREDENTIALS_PATH, JSON.stringify(creds, null, 2), { mode: 384 });
+}
+function clearCredentials() {
+  if (existsSync(CREDENTIALS_PATH)) rmSync(CREDENTIALS_PATH);
+}
+function requireCredentials() {
+  const creds = loadCredentials();
+  if (!creds) {
+    console.error("Not logged in. Run `vaultic login` first.");
+    process.exit(1);
+  }
+  return creds;
+}
+
+// src/lib/api.ts
+var ApiError = class extends Error {
+  status;
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+  }
+};
+var ApiClient = class {
+  serverUrl;
+  token;
+  constructor(opts = {}) {
+    const creds = loadCredentials();
+    this.serverUrl = opts.serverUrl ?? creds?.serverUrl ?? process.env.VAULTIC_API_URL ?? DEFAULT_SERVER_URL;
+    this.token = opts.token ?? creds?.token ?? "";
+  }
+  async request(method, urlPath, body) {
+    const headers = { "x-vaultic-source": "cli" };
+    if (this.token) headers.authorization = `Bearer ${this.token}`;
+    if (body !== void 0) headers["content-type"] = "application/json";
+    const res = await fetch(`${this.serverUrl}${urlPath}`, {
+      method,
+      headers,
+      body: body !== void 0 ? JSON.stringify(body) : void 0
+    });
+    if (res.status === 204) return void 0;
+    const text = await res.text();
+    const data = text ? JSON.parse(text) : void 0;
+    if (!res.ok) {
+      throw new ApiError(res.status, data?.error ?? `Request failed with status ${res.status}`);
+    }
+    return data;
+  }
+  get(urlPath) {
+    return this.request("GET", urlPath);
+  }
+  post(urlPath, body) {
+    return this.request("POST", urlPath, body ?? {});
+  }
+  put(urlPath, body) {
+    return this.request("PUT", urlPath, body ?? {});
+  }
+  patch(urlPath, body) {
+    return this.request("PATCH", urlPath, body ?? {});
+  }
+  delete(urlPath) {
+    return this.request("DELETE", urlPath);
+  }
+  getServerUrl() {
+    return this.serverUrl;
+  }
+};
+
+// src/lib/project-config.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import path2 from "path";
+import yaml from "js-yaml";
+
+// ../shared/dist/index.js
+import { z } from "zod";
+var SECRET_KEY_REGEX = /^[A-Z][A-Z0-9_]*$/;
+var SlugSchema = z.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9-]*$/, "must be lowercase alphanumeric with dashes");
+var SecretKeySchema = z.string().min(1).max(256).regex(SECRET_KEY_REGEX, "keys must be UPPER_SNAKE_CASE (e.g. DATABASE_URL)");
+var RoleSchema = z.enum(["owner", "admin", "developer", "read-only"]);
+var TokenAccessSchema = z.enum(["read", "write"]);
+var SecretTypeHintSchema = z.enum([
+  "string",
+  "multiline",
+  "json",
+  "url",
+  "boolean",
+  "number",
+  "certificate",
+  "private-key"
+]);
+var WorkspaceSchema = z.object({
+  id: z.string(),
+  slug: SlugSchema,
+  name: z.string(),
+  createdAt: z.string()
+});
+var ProjectSchema = z.object({
+  id: z.string(),
+  workspaceId: z.string(),
+  slug: SlugSchema,
+  name: z.string(),
+  createdAt: z.string()
+});
+var EnvironmentSchema = z.object({
+  id: z.string(),
+  projectId: z.string(),
+  slug: SlugSchema,
+  name: z.string(),
+  parentId: z.string().nullable(),
+  parentSlug: z.string().nullable().optional(),
+  lockedAt: z.string().nullable(),
+  createdAt: z.string(),
+  /** ephemeral/preview environments auto-expire — see Rotation/Environments in the spec */
+  isEphemeral: z.boolean().default(false),
+  expiresAt: z.string().nullable().default(null),
+  sourceBranch: z.string().nullable().optional(),
+  /** live count of non-deleted secrets defined directly in this environment; only populated
+   *  by the environments-list endpoint (cheap to compute there), not on single-environment reads */
+  secretCount: z.number().int().optional()
+});
+var WorkspaceMemberSchema = z.object({
+  id: z.string(),
+  workspaceId: z.string(),
+  userId: z.string(),
+  email: z.string(),
+  name: z.string(),
+  role: RoleSchema,
+  createdAt: z.string()
+});
+var InviteRoleSchema = z.enum(["admin", "developer", "read-only"]);
+var CreateInviteRequestSchema = z.object({
+  email: z.string().email(),
+  role: InviteRoleSchema
+});
+var WorkspaceInviteSchema = z.object({
+  id: z.string(),
+  workspaceId: z.string(),
+  email: z.string(),
+  role: RoleSchema,
+  status: z.enum(["pending", "accepted", "revoked"]),
+  invitedByEmail: z.string().nullable(),
+  createdAt: z.string(),
+  expiresAt: z.string().nullable()
+});
+var WorkspaceInviteCreatedSchema = WorkspaceInviteSchema.extend({
+  token: z.string()
+});
+var PublicInviteSchema = z.object({
+  workspaceSlug: z.string(),
+  workspaceName: z.string(),
+  email: z.string(),
+  role: RoleSchema,
+  expiresAt: z.string().nullable()
+});
+var ChangeMemberRoleRequestSchema = z.object({
+  role: RoleSchema
+});
+var GrantRoleSchema = z.enum(["developer", "read-only"]);
+var CreateAccessGrantRequestSchema = z.object({
+  memberId: z.string(),
+  /** omit for a project-wide grant; set to scope the grant to one environment */
+  environmentSlug: z.string().optional(),
+  role: GrantRoleSchema
+});
+var AccessGrantSchema = z.object({
+  id: z.string(),
+  memberId: z.string(),
+  memberEmail: z.string(),
+  projectId: z.string(),
+  environmentId: z.string().nullable(),
+  environmentSlug: z.string().nullable(),
+  role: GrantRoleSchema,
+  createdAt: z.string()
+});
+var SecretSummarySchema = z.object({
+  id: z.string(),
+  environmentId: z.string(),
+  key: z.string(),
+  maskedValue: z.string(),
+  // e.g. "••••••••"
+  typeHint: SecretTypeHintSchema,
+  note: z.string().nullable(),
+  version: z.number().int(),
+  createdBy: z.string().nullable(),
+  updatedAt: z.string(),
+  createdAt: z.string(),
+  /** set when this key isn't defined directly in the requested environment but falls
+   *  through from a parent via inheritance */
+  inheritedFrom: z.string().nullable().optional(),
+  /** set when this key's value is `${...}` reference syntax rather than a literal */
+  isReference: z.boolean().optional(),
+  /** set when the current user has a personal override active for this key */
+  hasPersonalOverride: z.boolean().optional(),
+  /** set when this secret has a previous version fetchable via `--previous` (see Rotation) */
+  hasPreviousVersion: z.boolean().optional(),
+  /** ISO timestamp after which `--previous` stops serving the pre-rotation value; null means
+   *  no time limit was set on the grace window */
+  rotationGraceUntil: z.string().nullable().optional(),
+  /** optional expiry date (spec: "Expiring secrets") — warnings only, never enforced */
+  expiresAt: z.string().nullable().optional(),
+  /** optional rotation-reminder cadence in days (spec: "Rotation reminders per secret") */
+  rotationReminderIntervalDays: z.number().int().nullable().optional(),
+  /** when this secret's value was last changed — `rotatedAt` if it's ever gone through
+   *  `rotate`, otherwise the most recent version's createdAt. Used to compute rotation-due
+   *  state (see `isRotationDue`) client-side, in the CLI, and by the scheduled lifecycle job. */
+  lastRotatedAt: z.string().nullable().optional()
+});
+var SecretRevealedSchema = SecretSummarySchema.extend({
+  value: z.string()
+}).omit({ maskedValue: true });
+var SecretVersionSchema = z.object({
+  id: z.string(),
+  secretId: z.string(),
+  version: z.number().int(),
+  value: z.string().optional(),
+  // only present when explicitly revealed
+  createdBy: z.string().nullable(),
+  createdAt: z.string(),
+  changeType: z.enum(["create", "update", "rollback", "rename", "delete", "rotate"])
+});
+var TrashedSecretSchema = z.object({
+  id: z.string(),
+  environmentId: z.string(),
+  key: z.string(),
+  typeHint: SecretTypeHintSchema,
+  note: z.string().nullable(),
+  version: z.number().int(),
+  deletedAt: z.string(),
+  /** ISO timestamp after which the background job hard-deletes this secret for good */
+  purgesAt: z.string()
+});
+var RotateSecretRequestSchema = z.object({
+  value: z.string(),
+  /** e.g. "1h", "30m", "2d" — how long the pre-rotation value stays fetchable via
+   *  `secrets get KEY --previous`. Omit for no time limit. */
+  graceWindow: z.string().optional()
+});
+function parseDurationMs(spec) {
+  const match = /^(\d+)(s|m|h|d)$/.exec(spec.trim());
+  if (!match)
+    throw new Error(`Invalid duration "${spec}" (expected e.g. "30m", "1h", "2d")`);
+  const value = Number(match[1]);
+  const unitMs = { s: 1e3, m: 6e4, h: 36e5, d: 864e5 }[match[2]];
+  return value * unitMs;
+}
+var DEFAULT_SECRET_EXPIRY_WARNING_DAYS = 7;
+function secretExpiryState(expiresAt, now = /* @__PURE__ */ new Date(), warningDays = DEFAULT_SECRET_EXPIRY_WARNING_DAYS) {
+  if (!expiresAt)
+    return null;
+  const expiresAtMs = new Date(expiresAt).getTime();
+  const nowMs = now.getTime();
+  if (expiresAtMs <= nowMs)
+    return "expired";
+  if (expiresAtMs - nowMs <= warningDays * 864e5)
+    return "expiring";
+  return null;
+}
+function isRotationDue(rotationReminderIntervalDays, lastRotatedAt, now = /* @__PURE__ */ new Date()) {
+  if (!rotationReminderIntervalDays || !lastRotatedAt)
+    return false;
+  const lastRotatedMs = new Date(lastRotatedAt).getTime();
+  return now.getTime() - lastRotatedMs >= rotationReminderIntervalDays * 864e5;
+}
+var ServiceTokenSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  workspaceId: z.string(),
+  projectId: z.string().nullable(),
+  environmentId: z.string().nullable(),
+  access: TokenAccessSchema,
+  expiresAt: z.string().nullable(),
+  createdAt: z.string(),
+  lastUsedAt: z.string().nullable(),
+  revokedAt: z.string().nullable()
+});
+var ServiceTokenCreatedSchema = ServiceTokenSchema.extend({
+  token: z.string()
+});
+var AuditLogEntrySchema = z.object({
+  id: z.string(),
+  workspaceId: z.string(),
+  projectId: z.string().nullable(),
+  environmentId: z.string().nullable(),
+  actorType: z.enum(["user", "token"]),
+  actorId: z.string().nullable(),
+  actorLabel: z.string(),
+  action: z.string(),
+  // e.g. "secret.created", "secret.revealed"
+  targetKey: z.string().nullable(),
+  source: z.enum(["ui", "cli", "api", "token"]),
+  ip: z.string().nullable(),
+  createdAt: z.string()
+});
+var RegisterRequestSchema = z.object({
+  email: z.string().email(),
+  password: z.string().min(8),
+  name: z.string().min(1).max(128)
+});
+var LoginRequestSchema = z.object({
+  email: z.string().email(),
+  password: z.string().min(1)
+});
+var AuthResponseSchema = z.object({
+  token: z.string(),
+  user: z.object({
+    id: z.string(),
+    email: z.string(),
+    name: z.string()
+  })
+});
+var CreateWorkspaceRequestSchema = z.object({
+  slug: SlugSchema,
+  name: z.string().min(1)
+});
+var CreateProjectRequestSchema = z.object({
+  slug: SlugSchema,
+  name: z.string().min(1),
+  /** defaults to development/staging/production if omitted */
+  environments: z.array(z.string()).optional()
+});
+var CreateEnvironmentRequestSchema = z.object({
+  slug: SlugSchema,
+  name: z.string().min(1).optional(),
+  /** slug of an existing environment in the same project to inherit unset keys from */
+  inherits: z.string().optional(),
+  /** flags this as an ephemeral/preview environment; pair with ttlDays and/or expiresAt */
+  ephemeral: z.boolean().optional(),
+  /** convenience: sets expiresAt to now + ttlDays */
+  ttlDays: z.number().positive().optional(),
+  /** explicit expiry timestamp (ISO), takes precedence over ttlDays if both are given */
+  expiresAt: z.string().datetime().optional()
+});
+var DuplicateEnvironmentRequestSchema = z.object({
+  targetSlug: SlugSchema,
+  mode: z.enum(["values", "keys-only", "link"]).default("values")
+});
+var PromoteEnvironmentRequestSchema = z.object({
+  to: z.string().min(1)
+});
+var PromoteEnvironmentResultSchema = z.object({
+  promoted: z.array(z.string()),
+  created: z.array(z.string()),
+  updated: z.array(z.string()),
+  targetOnly: z.array(z.string()),
+  unchanged: z.array(z.string())
+});
+var SetSecretRequestSchema = z.object({
+  value: z.string(),
+  typeHint: SecretTypeHintSchema.optional(),
+  note: z.string().optional(),
+  /** omit to leave unchanged, null to clear, an ISO datetime string to set (see "Expiring
+   *  secrets" in the spec) */
+  expiresAt: z.string().datetime().nullable().optional(),
+  /** omit to leave unchanged, null to clear, a positive integer (days) to set (see
+   *  "Rotation reminders" in the spec) */
+  rotationReminderIntervalDays: z.number().int().positive().nullable().optional()
+});
+var UpdateSecretMetadataRequestSchema = z.object({
+  expiresAt: z.string().datetime().nullable().optional(),
+  rotationReminderIntervalDays: z.number().int().positive().nullable().optional()
+});
+var RenameSecretRequestSchema = z.object({
+  newKey: SecretKeySchema
+});
+var SetPersonalOverrideRequestSchema = z.object({
+  value: z.string()
+});
+var CreateShareLinkRequestSchema = z.object({
+  /** e.g. "1h", "30m", "2d" */
+  expiresIn: z.string().optional(),
+  maxViews: z.number().int().positive().optional()
+});
+var ShareLinkCreatedSchema = z.object({
+  token: z.string(),
+  key: z.string(),
+  expiresAt: z.string().nullable(),
+  maxViews: z.number().nullable()
+});
+var WEBHOOK_EVENTS = [
+  "secret.created",
+  "secret.updated",
+  "secret.deleted",
+  "secret.restored",
+  "secret.revealed",
+  "secret.rotated",
+  "secret.expiring",
+  "secret.expired",
+  "secret.rotation_due",
+  "environment.created",
+  "environment.duplicated",
+  "environment.promoted",
+  "environment.expired",
+  "token.created",
+  "token.revoked",
+  "member.invited",
+  "member.joined",
+  "member.removed",
+  "member.role_changed"
+];
+var CreateWebhookRequestSchema = z.object({
+  url: z.string().url(),
+  events: z.array(z.enum(WEBHOOK_EVENTS)).min(1),
+  kind: z.enum(["generic", "slack"]).default("generic")
+});
+var WebhookSchema = z.object({
+  id: z.string(),
+  workspaceId: z.string(),
+  kind: z.enum(["generic", "slack"]),
+  url: z.string(),
+  events: z.array(z.string()),
+  disabledAt: z.string().nullable(),
+  createdAt: z.string()
+});
+var WebhookCreatedSchema = WebhookSchema.extend({
+  /** the HMAC signing secret — returned once, at creation, for GENERIC webhooks only */
+  secret: z.string().nullable()
+});
+var WebhookDeliverySchema = z.object({
+  id: z.string(),
+  event: z.string(),
+  statusCode: z.number().nullable(),
+  success: z.boolean(),
+  error: z.string().nullable(),
+  durationMs: z.number().nullable(),
+  createdAt: z.string()
+});
+var RollbackSecretRequestSchema = z.object({
+  version: z.number().int().positive()
+});
+var CreateServiceTokenRequestSchema = z.object({
+  name: z.string().min(1),
+  projectSlug: z.string().optional(),
+  environmentSlug: z.string().optional(),
+  access: TokenAccessSchema.default("read"),
+  expiresInDays: z.number().int().positive().optional()
+});
+var ImportSecretsRequestSchema = z.object({
+  secrets: z.record(z.string(), z.string()),
+  prefix: z.string().optional(),
+  overwrite: z.boolean().default(false)
+});
+var CreateGitIntegrationRequestSchema = z.object({
+  owner: z.string().min(1),
+  repo: z.string().min(1),
+  /** glob-style, single `*` wildcard, e.g. "preview/*" (default) */
+  branchPattern: z.string().min(1).default("preview/*"),
+  /** slug of an existing environment new preview environments inherit unset keys from */
+  previewEnvironmentTemplate: z.string().optional(),
+  defaultTtlDays: z.number().int().positive().default(7)
+});
+var GitIntegrationSchema = z.object({
+  id: z.string(),
+  projectId: z.string(),
+  provider: z.literal("github"),
+  owner: z.string(),
+  repo: z.string(),
+  branchPattern: z.string(),
+  previewEnvironmentTemplate: z.string().nullable(),
+  defaultTtlDays: z.number(),
+  /** the webhook URL to configure on GitHub (Settings -> Webhooks -> Add webhook) */
+  webhookUrl: z.string(),
+  createdAt: z.string()
+});
+var GitIntegrationCreatedSchema = GitIntegrationSchema.extend({
+  /** the HMAC signing secret (GitHub's "Secret" field) — returned once, at creation only */
+  webhookSecret: z.string()
+});
+var EnvironmentMatrixSchema = z.object({
+  environments: z.array(EnvironmentSchema),
+  rows: z.array(z.object({
+    key: z.string(),
+    cells: z.record(
+      z.string(),
+      // environmentId
+      z.object({
+        maskedValue: z.string(),
+        secretId: z.string(),
+        version: z.number(),
+        isReference: z.boolean().optional()
+      }).nullable()
+    )
+  }))
+});
+var EnvironmentDiffSchema = z.object({
+  added: z.array(z.string()),
+  removed: z.array(z.string()),
+  changed: z.array(z.string()),
+  unchanged: z.array(z.string())
+});
+var ProjectConfigSchema = z.object({
+  version: z.literal(1),
+  workspace: z.string(),
+  project: z.string(),
+  default_environment: z.string().default("development"),
+  branch_mapping: z.record(z.string(), z.string()).optional(),
+  export: z.object({
+    format: z.enum(["dotenv", "json", "yaml", "shell"]).default("dotenv"),
+    path: z.string().default(".env"),
+    include: z.array(z.string()).default(["*"]),
+    exclude: z.array(z.string()).default([])
+  }).partial().optional(),
+  hooks: z.object({
+    post_sync: z.string().optional()
+  }).optional()
+});
+var SecretsHealthLocationSchema = z.object({
+  projectSlug: SlugSchema,
+  projectName: z.string(),
+  environmentSlug: SlugSchema,
+  environmentName: z.string()
+});
+var StaleSecretSchema = SecretsHealthLocationSchema.extend({
+  key: z.string(),
+  /** rotatedAt if ever rotated, otherwise the most recent version's createdAt — same
+   *  definition as `SecretSummary.lastRotatedAt`. */
+  lastChangedAt: z.string()
+});
+var ExpiredReminderSchema = SecretsHealthLocationSchema.extend({
+  key: z.string(),
+  state: z.enum(["expired", "rotation_due"]),
+  expiresAt: z.string().nullable(),
+  rotationReminderIntervalDays: z.number().int().nullable(),
+  lastChangedAt: z.string()
+});
+var InactiveConfigSchema = SecretsHealthLocationSchema.extend({
+  environmentId: z.string(),
+  /** null means no audit log activity has ever been recorded for this environment. */
+  lastActivityAt: z.string().nullable()
+});
+var SecretsHealthSchema = z.object({
+  staleDays: z.number().int(),
+  inactiveDays: z.number().int(),
+  stale: z.array(StaleSecretSchema),
+  expiredReminders: z.array(ExpiredReminderSchema),
+  inactiveConfigs: z.array(InactiveConfigSchema)
+});
+
+// src/lib/project-config.ts
+var CONFIG_FILE = ".vaultic.yaml";
+var LOCAL_CONFIG_FILE = ".vaultic.local.yaml";
+function configPath(cwd = process.cwd()) {
+  return path2.join(cwd, CONFIG_FILE);
+}
+function loadProjectConfig(cwd = process.cwd()) {
+  const p = configPath(cwd);
+  if (!existsSync2(p)) return null;
+  const raw = yaml.load(readFileSync2(p, "utf8"));
+  return ProjectConfigSchema.parse(raw);
+}
+function requireProjectConfig(cwd = process.cwd()) {
+  const cfg = loadProjectConfig(cwd);
+  if (!cfg) {
+    console.error(`No ${CONFIG_FILE} found in this directory. Run \`vaultic init\` first.`);
+    process.exit(1);
+  }
+  return cfg;
+}
+function writeProjectConfig(config, cwd = process.cwd()) {
+  const header = "# .vaultic.yaml \u2014 safe to commit, contains no secrets\n";
+  writeFileSync2(configPath(cwd), header + yaml.dump(config, { noRefs: true }));
+}
+function loadLocalOverrides(cwd = process.cwd()) {
+  const p = path2.join(cwd, LOCAL_CONFIG_FILE);
+  if (!existsSync2(p)) return {};
+  return yaml.load(readFileSync2(p, "utf8")) ?? {};
+}
+function resolveEnvironment(cliFlag, cwd = process.cwd()) {
+  if (cliFlag) return cliFlag;
+  const local = loadLocalOverrides(cwd);
+  if (local.default_environment) return local.default_environment;
+  const cfg = requireProjectConfig(cwd);
+  return cfg.default_environment;
+}
+function ensureGitignoreEntries(entries, cwd = process.cwd()) {
+  const gitignorePath = path2.join(cwd, ".gitignore");
+  let content = existsSync2(gitignorePath) ? readFileSync2(gitignorePath, "utf8") : "";
+  const existingLines = new Set(content.split("\n").map((l) => l.trim()));
+  const toAdd = entries.filter((e) => !existingLines.has(e));
+  if (toAdd.length === 0) return;
+  if (content.length > 0 && !content.endsWith("\n")) content += "\n";
+  content += toAdd.join("\n") + "\n";
+  writeFileSync2(gitignorePath, content);
+}
+
+// src/commands/init.ts
+import { existsSync as existsSync3 } from "fs";
+async function initCommand() {
+  requireCredentials();
+  const api = new ApiClient();
+  if (existsSync3(configPath())) {
+    const { overwrite } = await prompts({
+      type: "confirm",
+      name: "overwrite",
+      message: `${configPath()} already exists. Overwrite?`,
+      initial: false
+    });
+    if (!overwrite) {
+      console.log("Aborted.");
+      return;
+    }
+  }
+  const workspaces = await api.get("/workspaces");
+  let workspaceSlug;
+  if (workspaces.length > 0) {
+    const { choice } = await prompts({
+      type: "select",
+      name: "choice",
+      message: "Pick a workspace",
+      choices: [
+        ...workspaces.map((w) => ({ title: `${w.name} (${w.slug})`, value: w.slug })),
+        { title: "+ Create new workspace", value: "__new__" }
+      ]
+    });
+    if (choice === void 0) return exitCancelled();
+    if (choice === "__new__") {
+      workspaceSlug = await createWorkspace(api);
+    } else {
+      workspaceSlug = choice;
+    }
+  } else {
+    console.log("No workspaces yet \u2014 let's create your first one.");
+    workspaceSlug = await createWorkspace(api);
+  }
+  const projects = await api.get(`/workspaces/${workspaceSlug}/projects`);
+  let projectSlug;
+  if (projects.length > 0) {
+    const { choice } = await prompts({
+      type: "select",
+      name: "choice",
+      message: "Pick a project",
+      choices: [
+        ...projects.map((p) => ({ title: `${p.name} (${p.slug})`, value: p.slug })),
+        { title: "+ Create new project", value: "__new__" }
+      ]
+    });
+    if (choice === void 0) return exitCancelled();
+    if (choice === "__new__") {
+      projectSlug = await createProject(api, workspaceSlug);
+    } else {
+      projectSlug = choice;
+    }
+  } else {
+    console.log("No projects yet in this workspace \u2014 let's create one.");
+    projectSlug = await createProject(api, workspaceSlug);
+  }
+  const environments = await api.get(
+    `/workspaces/${workspaceSlug}/projects/${projectSlug}/environments`
+  );
+  const { defaultEnv } = await prompts({
+    type: "select",
+    name: "defaultEnv",
+    message: "Pick your default environment",
+    choices: environments.map((e) => ({ title: e.slug, value: e.slug }))
+  });
+  if (defaultEnv === void 0) return exitCancelled();
+  writeProjectConfig({
+    version: 1,
+    workspace: workspaceSlug,
+    project: projectSlug,
+    default_environment: defaultEnv,
+    export: { format: "dotenv", path: ".env", include: ["*"], exclude: [] }
+  });
+  console.log(`Wrote ${configPath()}`);
+  const { addGitignore } = await prompts({
+    type: "confirm",
+    name: "addGitignore",
+    message: "Add .env, .env.*, and .vaultic.local.yaml to .gitignore?",
+    initial: true
+  });
+  if (addGitignore) {
+    ensureGitignoreEntries([".env", ".env.*", ".vaultic.local.yaml"]);
+    console.log("Updated .gitignore");
+  }
+  console.log("\nAll set! Try:");
+  console.log("  vaultic secrets set FOO bar");
+  console.log("  vaultic run -- printenv FOO");
+}
+async function createWorkspace(api) {
+  const { name, slug } = await prompts([
+    { type: "text", name: "name", message: "Workspace name" },
+    { type: "text", name: "slug", message: "Workspace slug", initial: (prev) => slugify(prev) }
+  ]);
+  await api.post("/workspaces", { slug, name });
+  return slug;
+}
+async function createProject(api, workspaceSlug) {
+  const { name, slug } = await prompts([
+    { type: "text", name: "name", message: "Project name" },
+    { type: "text", name: "slug", message: "Project slug", initial: (prev) => slugify(prev) }
+  ]);
+  await api.post(`/workspaces/${workspaceSlug}/projects`, { slug, name });
+  return slug;
+}
+function slugify(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/(^-|-$)/g, "");
+}
+function exitCancelled() {
+  console.log("Cancelled.");
+}
+
+// src/commands/auth.ts
+import prompts2 from "prompts";
+async function loginCommand(opts) {
+  const serverUrl = opts.server ?? process.env.VAULTIC_API_URL ?? DEFAULT_SERVER_URL;
+  if (opts.token) {
+    saveCredentials({ serverUrl, token: opts.token });
+    console.log(`Saved credentials for ${serverUrl}`);
+    return;
+  }
+  const email = opts.email ?? (await prompts2({ type: "text", name: "email", message: "Email" })).email;
+  const password = opts.password ?? (await prompts2({ type: "password", name: "password", message: "Password" })).password;
+  if (!email || !password) {
+    console.error("Email and password are required.");
+    process.exit(1);
+  }
+  const api = new ApiClient({ serverUrl, token: "" });
+  try {
+    const res = await api.post("/auth/login", { email, password });
+    saveCredentials({ serverUrl, token: res.token, email: res.user.email });
+    console.log(`Logged in as ${res.user.email}`);
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 401) {
+      console.log("No account found or wrong password. Register now?");
+      const { register } = await prompts2({ type: "confirm", name: "register", message: "Create a new account?", initial: true });
+      if (!register) process.exit(1);
+      const { name } = await prompts2({ type: "text", name: "name", message: "Your name" });
+      const res = await api.post("/auth/register", { email, password, name });
+      saveCredentials({ serverUrl, token: res.token, email: res.user.email });
+      console.log(`Account created. Logged in as ${res.user.email}`);
+      return;
+    }
+    throw err;
+  }
+}
+async function logoutCommand() {
+  clearCredentials();
+  console.log("Logged out.");
+}
+async function whoamiCommand() {
+  const creds = loadCredentials();
+  if (!creds) {
+    console.log("Not logged in.");
+    return;
+  }
+  if (creds.token.startsWith("vlt_")) {
+    console.log(`Authenticated with a service token against ${creds.serverUrl}`);
+    return;
+  }
+  const api = new ApiClient();
+  const me = await api.get("/auth/me");
+  console.log(`${me.name} <${me.email}> (${creds.serverUrl})`);
+}
+
+// src/commands/run.ts
+import { spawn } from "child_process";
+
+// src/lib/context.ts
+function envBase(cfg, env2) {
+  return `/workspaces/${cfg.workspace}/projects/${cfg.project}/environments/${env2}`;
+}
+
+// src/commands/run.ts
+function secretsEqual(a, b) {
+  const aKeys = Object.keys(a).sort();
+  const bKeys = Object.keys(b).sort();
+  if (aKeys.length !== bKeys.length) return false;
+  return aKeys.every((k, i) => k === bKeys[i] && a[k] === b[k]);
+}
+async function runCommand(commandParts, opts) {
+  if (commandParts.length === 0) {
+    console.error("Usage: vaultic run [-e <environment>] [--watch] -- <command> [args...]");
+    process.exit(1);
+  }
+  const cfg = requireProjectConfig();
+  const env2 = resolveEnvironment(opts.env);
+  const api = new ApiClient();
+  const [cmd, ...args] = commandParts;
+  const fetchSecrets = () => api.get(`${envBase(cfg, env2)}/export`);
+  if (!opts.watch) {
+    const secrets2 = await fetchSecrets();
+    const child2 = spawn(cmd, args, { stdio: "inherit", env: { ...process.env, ...secrets2 } });
+    child2.on("exit", (code, signal) => {
+      if (signal) process.kill(process.pid, signal);
+      else process.exit(code ?? 0);
+    });
+    child2.on("error", (err) => {
+      console.error(`Failed to run "${cmd}": ${err.message}`);
+      process.exit(1);
+    });
+    return;
+  }
+  const pollIntervalMs = Math.max(500, Number(opts.pollInterval ?? "2000"));
+  let current = await fetchSecrets();
+  let child = null;
+  let stopped = false;
+  let restarting = false;
+  function spawnChild() {
+    child = spawn(cmd, args, { stdio: "inherit", env: { ...process.env, ...current } });
+    child.on("exit", (code, signal) => {
+      if (stopped || restarting) return;
+      stopped = true;
+      clearInterval(poller);
+      if (signal) process.kill(process.pid, signal);
+      else process.exit(code ?? 0);
+    });
+    child.on("error", (err) => {
+      console.error(`Failed to run "${cmd}": ${err.message}`);
+      process.exit(1);
+    });
+  }
+  async function killChild() {
+    if (!child || child.exitCode !== null || child.signalCode !== null) return;
+    await new Promise((resolve) => {
+      child.once("exit", () => resolve());
+      child.kill("SIGTERM");
+    });
+  }
+  console.log(`vaultic: watching "${env2}" for secret changes (polling every ${pollIntervalMs}ms)`);
+  spawnChild();
+  const poller = setInterval(async () => {
+    if (stopped || restarting) return;
+    let next;
+    try {
+      next = await fetchSecrets();
+    } catch (err) {
+      console.error(`vaultic: watch poll failed: ${err instanceof Error ? err.message : String(err)}`);
+      return;
+    }
+    if (secretsEqual(current, next)) return;
+    restarting = true;
+    console.log(`vaultic: secrets changed in "${env2}" -> restarting "${cmd}"`);
+    current = next;
+    await killChild();
+    restarting = false;
+    if (!stopped) spawnChild();
+  }, pollIntervalMs);
+  const shutdown = async (signal) => {
+    if (stopped) return;
+    stopped = true;
+    clearInterval(poller);
+    await killChild();
+    process.kill(process.pid, signal);
+  };
+  process.on("SIGINT", () => void shutdown("SIGINT"));
+  process.on("SIGTERM", () => void shutdown("SIGTERM"));
+}
+
+// src/commands/export.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import path3 from "path";
+
+// src/lib/formats.ts
+import { createHash } from "crypto";
+import yaml2 from "js-yaml";
+var GENERATED_HEADER = "# Generated by Vaultic \u2014 do not commit";
+function dotenvEscape(value) {
+  if (/^[A-Za-z0-9_.:/@-]*$/.test(value)) return value;
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n")}"`;
+}
+function checksum(values) {
+  const sorted = Object.keys(values).sort().map((k) => `${k}=${values[k]}`).join("\n");
+  return createHash("sha256").update(sorted).digest("hex");
+}
+function renderBody(values, format) {
+  const keys = Object.keys(values).sort();
+  switch (format) {
+    case "dotenv":
+      return keys.map((k) => `${k}=${dotenvEscape(values[k])}`).join("\n") + "\n";
+    case "shell":
+      return keys.map((k) => `export ${k}=${dotenvEscape(values[k])}`).join("\n") + "\n";
+    case "json":
+      return JSON.stringify(values, null, 2) + "\n";
+    case "yaml":
+      return yaml2.dump(values, { noRefs: true });
+    default:
+      throw new Error(`Unknown format: ${format}`);
+  }
+}
+function renderFile(values, format, includeHeader = true) {
+  const body = renderBody(values, format);
+  if (!includeHeader || format === "json") return body;
+  const header = `${GENERATED_HEADER}
+# checksum: ${checksum(values)}
+`;
+  return header + body;
+}
+function extractChecksum(fileContents) {
+  const match = fileContents.match(/^#\s*checksum:\s*([a-f0-9]{64})\s*$/m);
+  return match ? match[1] : null;
+}
+function parseDotenv(contents) {
+  const values = {};
+  for (const rawLine of contents.split("\n")) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq === -1) continue;
+    const key = line.slice(0, eq).trim().replace(/^export\s+/, "");
+    let value = line.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1).replace(/\\n/g, "\n").replace(/\\"/g, '"');
+    }
+    values[key] = value;
+  }
+  return values;
+}
+
+// src/lib/glob.ts
+function globToRegExp(glob) {
+  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`);
+}
+function filterKeys(keys, include, exclude) {
+  const includeRe = include.length > 0 ? include.map(globToRegExp) : [/.*/];
+  const excludeRe = exclude.map(globToRegExp);
+  return keys.filter((k) => includeRe.some((re) => re.test(k)) && !excludeRe.some((re) => re.test(k)));
+}
+
+// src/commands/export.ts
+async function exportCommand(opts) {
+  const cfg = requireProjectConfig();
+  const env2 = resolveEnvironment(opts.env);
+  const api = new ApiClient();
+  const all = await api.get(`${envBase(cfg, env2)}/export`);
+  const exportCfg = cfg.export ?? {};
+  const format = opts.format ?? exportCfg.format ?? "dotenv";
+  const outPath = opts.path ?? exportCfg.path ?? ".env";
+  const include = exportCfg.include ?? ["*"];
+  const exclude = exportCfg.exclude ?? [];
+  const keys = filterKeys(Object.keys(all), include, exclude);
+  const values = Object.fromEntries(keys.map((k) => [k, all[k]]));
+  if (opts.check) {
+    if (!existsSync4(outPath)) {
+      console.error(`${outPath} does not exist locally. Run \`vaultic export\` or \`vaultic sync\`.`);
+      process.exit(1);
+    }
+    const local = readFileSync3(outPath, "utf8");
+    const localChecksum = extractChecksum(local);
+    const serverChecksum = checksum(values);
+    if (localChecksum !== serverChecksum) {
+      console.error(`${outPath} is stale vs server for environment "${env2}". Run \`vaultic sync\`.`);
+      process.exit(1);
+    }
+    console.log(`${outPath} is up to date.`);
+    return;
+  }
+  const content = renderFile(values, format, !opts.noHeader);
+  if (opts.format && !opts.path) {
+    process.stdout.write(content);
+    return;
+  }
+  writeFileSync3(path3.resolve(outPath), content);
+  console.error(`Wrote ${keys.length} secrets to ${outPath} (${format}) for environment "${env2}"`);
+}
+
+// src/commands/import.ts
+import { readFileSync as readFileSync4, unlinkSync, existsSync as existsSync5 } from "fs";
+import prompts3 from "prompts";
+async function importCommand(file, opts) {
+  const cfg = requireProjectConfig();
+  const env2 = resolveEnvironment(opts.env);
+  const raw = readFileSync4(file, "utf8");
+  const useJson = opts.fromJson || file.endsWith(".json");
+  const secrets2 = useJson ? JSON.parse(raw) : parseDotenv(raw);
+  if (Object.keys(secrets2).length === 0) {
+    console.log("No key/value pairs found to import.");
+    return;
+  }
+  if (opts.dryRun) {
+    console.log(`Would import ${Object.keys(secrets2).length} keys into "${env2}":`);
+    for (const key of Object.keys(secrets2)) {
+      const finalKey = (opts.prefix ? `${opts.prefix}${key}` : key).toUpperCase();
+      console.log(`  ${finalKey}`);
+    }
+    return;
+  }
+  const api = new ApiClient();
+  const result = await api.post(
+    `${envBase(cfg, env2)}/secrets/import`,
+    { secrets: secrets2, prefix: opts.prefix, overwrite: opts.overwrite ?? false }
+  );
+  console.log(`Created: ${result.created.length}, Updated: ${result.updated.length}, Skipped: ${result.skipped.length}`);
+  if (result.skipped.length > 0) {
+    console.log(`Skipped (already exist, rerun with --overwrite to replace): ${result.skipped.join(", ")}`);
+  }
+  if (!useJson && existsSync5(file) && process.stdout.isTTY) {
+    const { del } = await prompts3({
+      type: "confirm",
+      name: "del",
+      message: `Delete local ${file} and switch to \`vaultic run\`?`,
+      initial: false
+    });
+    if (del) {
+      unlinkSync(file);
+      console.log(`Deleted ${file}. Use \`vaultic run -- <cmd>\` from now on.`);
+    }
+  }
+}
+
+// src/commands/status.ts
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+function lifecycleWarnings(secrets2) {
+  const lines = [];
+  for (const s of secrets2) {
+    const expiry = secretExpiryState(s.expiresAt);
+    if (expiry === "expired") lines.push(`  [expired]        ${s.key} \u2014 expired ${s.expiresAt}`);
+    else if (expiry === "expiring") lines.push(`  [expiring soon]  ${s.key} \u2014 expires ${s.expiresAt}`);
+    if (isRotationDue(s.rotationReminderIntervalDays, s.lastRotatedAt)) {
+      lines.push(`  [rotation due]   ${s.key} \u2014 overdue for rotation (every ${s.rotationReminderIntervalDays}d)`);
+    }
+  }
+  return lines;
+}
+async function statusCommand(opts) {
+  const cfg = requireProjectConfig();
+  const env2 = resolveEnvironment(opts.env);
+  const outPath = cfg.export?.path ?? ".env";
+  console.log(`On environment "${env2}" (${cfg.workspace}/${cfg.project})`);
+  const api = new ApiClient();
+  const server = await api.get(`${envBase(cfg, env2)}/export`);
+  const secrets2 = await api.get(`${envBase(cfg, env2)}/secrets`);
+  const warnings = lifecycleWarnings(secrets2);
+  function printWarnings() {
+    if (warnings.length === 0) return;
+    console.log("");
+    console.log("Attention needed:");
+    for (const line of warnings) console.log(line);
+  }
+  if (!existsSync6(outPath)) {
+    console.log(`No local ${outPath} \u2014 run \`vaultic sync\` or \`vaultic export\` to generate one.`);
+    console.log(`Server has ${Object.keys(server).length} keys.`);
+    printWarnings();
+    return;
+  }
+  const local = parseDotenv(readFileSync5(outPath, "utf8"));
+  const localKeys = new Set(Object.keys(local));
+  const serverKeys = new Set(Object.keys(server));
+  const added = [];
+  const removed = [];
+  const changed = [];
+  for (const k of serverKeys) if (!localKeys.has(k)) added.push(k);
+  for (const k of localKeys) if (!serverKeys.has(k)) removed.push(k);
+  for (const k of serverKeys) if (localKeys.has(k) && local[k] !== server[k]) changed.push(k);
+  if (added.length === 0 && removed.length === 0 && changed.length === 0) {
+    console.log(`${outPath} is up to date with the server.`);
+    printWarnings();
+    return;
+  }
+  console.log(`${outPath} differs from the server:`);
+  if (added.length) console.log(`  new on server: ${added.join(", ")}`);
+  if (removed.length) console.log(`  only local:    ${removed.join(", ")}`);
+  if (changed.length) console.log(`  changed:       ${changed.join(", ")}`);
+  console.log("Run `vaultic sync` to pull the latest values.");
+  printWarnings();
+}
+
+// src/commands/sync.ts
+import { execSync } from "child_process";
+async function syncCommand(opts) {
+  const cfg = requireProjectConfig();
+  await exportCommand({ env: opts.env });
+  const hook = cfg.hooks?.post_sync;
+  if (hook) {
+    console.log(`Running post_sync hook: ${hook}`);
+    execSync(hook, { stdio: "inherit" });
+  }
+}
+
+// src/commands/secrets.ts
+import readline from "readline";
+
+// src/rotation/postgres.ts
+import { randomBytes } from "crypto";
+import { Client } from "pg";
+var ROLE_NAME_REGEX = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function generatePassword(bytes = 24) {
+  return randomBytes(bytes).toString("base64url");
+}
+function sqlLiteral(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+var postgresRotationPlugin = {
+  name: "postgres",
+  describe() {
+    return "Rotates a PostgreSQL role's password via `ALTER ROLE ... WITH PASSWORD ...`. Treats the secret's current value as a postgres://user:password@host:port/db connection string. Options: --role <name> (defaults to the connection string's user), --admin-conn-string <url> (connect with different credentials than the value being rotated, e.g. a superuser, when the target role can't alter its own password), --new-password <value> (defaults to a random 32-character password).";
+  },
+  async rotate(ctx) {
+    let targetUrl;
+    try {
+      targetUrl = new URL(ctx.currentValue);
+    } catch {
+      throw new Error(
+        `Current value for "${ctx.key}" isn't a valid URL \u2014 expected a postgres://user:password@host:port/db connection string.`
+      );
+    }
+    if (targetUrl.protocol !== "postgres:" && targetUrl.protocol !== "postgresql:") {
+      throw new Error(
+        `Current value for "${ctx.key}" has scheme "${targetUrl.protocol}", expected postgres:// or postgresql://.`
+      );
+    }
+    const role = ctx.options.role ?? decodeURIComponent(targetUrl.username);
+    if (!role) throw new Error(`Could not determine the role to rotate for "${ctx.key}"; pass --role explicitly.`);
+    if (!ROLE_NAME_REGEX.test(role)) {
+      throw new Error(`Refusing to rotate role "${role}": expected [A-Za-z_][A-Za-z0-9_]* (use --role to override).`);
+    }
+    const connectionString = ctx.options.adminConnString ?? ctx.currentValue;
+    const newPassword = ctx.options.newPassword ?? generatePassword();
+    const client = new Client({ connectionString });
+    await client.connect();
+    try {
+      await client.query(`ALTER ROLE "${role}" WITH PASSWORD ${sqlLiteral(newPassword)}`);
+    } finally {
+      await client.end();
+    }
+    const newUrl = new URL(targetUrl.toString());
+    newUrl.password = newPassword;
+    return {
+      newValue: newUrl.toString(),
+      summary: `Rotated PostgreSQL role "${role}"'s password (ALTER ROLE) on ${targetUrl.hostname}:${targetUrl.port || "5432"}/${targetUrl.pathname.replace(/^\//, "")}`
+    };
+  }
+};
+
+// src/rotation/types.ts
+var RotationNotImplementedError = class extends Error {
+};
+
+// src/rotation/stripe.ts
+var stripeRotationPlugin = {
+  name: "stripe",
+  describe() {
+    return "STUB \u2014 not exercised against a live Stripe account in this environment. Documents the interface for restricted-key rotation (create new key with same scopes, store it, revoke the old one after the grace window). See packages/cli/src/rotation/stripe.ts for what a real implementation needs.";
+  },
+  async rotate() {
+    throw new RotationNotImplementedError(
+      "The stripe rotation plugin is a documented stub (no Stripe credentials available in this environment to build/verify a real integration) \u2014 see `packages/cli/src/rotation/stripe.ts`."
+    );
+  }
+};
+
+// src/rotation/aws.ts
+var awsIamRotationPlugin = {
+  name: "aws-iam",
+  describe() {
+    return "STUB \u2014 not exercised against a live AWS account in this environment. Documents the interface for IAM access-key rotation (CreateAccessKey for a new key while the old one stays active, then deactivate/delete the old key after the grace window). See packages/cli/src/rotation/aws.ts for what a real implementation needs.";
+  },
+  async rotate() {
+    throw new RotationNotImplementedError(
+      "The aws-iam rotation plugin is a documented stub (no AWS credentials available in this environment to build/verify a real integration) \u2014 see `packages/cli/src/rotation/aws.ts`."
+    );
+  }
+};
+
+// src/rotation/index.ts
+var PLUGINS = [postgresRotationPlugin, stripeRotationPlugin, awsIamRotationPlugin];
+function getRotationPlugin(name) {
+  const plugin = PLUGINS.find((p) => p.name === name);
+  if (!plugin) {
+    throw new Error(
+      `Unknown rotation provider "${name}". Available: ${PLUGINS.map((p) => p.name).join(", ")}.`
+    );
+  }
+  return plugin;
+}
+function listRotationPlugins() {
+  return PLUGINS;
+}
+
+// src/commands/secrets.ts
+function readStdin() {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({ input: process.stdin });
+    const lines = [];
+    rl.on("line", (l) => lines.push(l));
+    rl.on("close", () => resolve(lines.join("\n")));
+  });
+}
+function annotate(s) {
+  const tags = [];
+  if (s.inheritedFrom) tags.push(`inherited from ${s.inheritedFrom}`);
+  if (s.hasPersonalOverride) tags.push("personal override active");
+  if (s.isReference) tags.push("reference");
+  const expiry = secretExpiryState(s.expiresAt);
+  if (expiry === "expired") tags.push(`EXPIRED ${s.expiresAt}`);
+  else if (expiry === "expiring") tags.push(`expiring ${s.expiresAt}`);
+  if (isRotationDue(s.rotationReminderIntervalDays, s.lastRotatedAt)) {
+    tags.push(`rotation overdue (every ${s.rotationReminderIntervalDays}d)`);
+  }
+  return tags.length ? `  (${tags.join(", ")})` : "";
+}
+function buildExpiryMetadata(opts) {
+  const meta = {};
+  let any = false;
+  if (opts.clearExpiry) {
+    meta.expiresAt = null;
+    any = true;
+  } else if (opts.expiresAt) {
+    const parsed = new Date(opts.expiresAt);
+    if (Number.isNaN(parsed.getTime())) {
+      console.error(`Invalid --expires-at date: "${opts.expiresAt}"`);
+      process.exit(1);
+    }
+    meta.expiresAt = parsed.toISOString();
+    any = true;
+  } else if (opts.expiresIn) {
+    meta.expiresAt = new Date(Date.now() + parseDurationMs(opts.expiresIn)).toISOString();
+    any = true;
+  }
+  if (opts.clearRemind) {
+    meta.rotationReminderIntervalDays = null;
+    any = true;
+  } else if (opts.remindEvery) {
+    meta.rotationReminderIntervalDays = Math.max(1, Math.round(parseDurationMs(opts.remindEvery) / 864e5));
+    any = true;
+  }
+  return any ? meta : void 0;
+}
+function describeMetadata(secret) {
+  const parts = [];
+  if (secret.expiresAt) parts.push(`expires ${secret.expiresAt}`);
+  if (secret.rotationReminderIntervalDays) parts.push(`remind every ${secret.rotationReminderIntervalDays}d`);
+  return parts.length ? ` (${parts.join(", ")})` : "";
+}
+async function secretsListCommand(opts) {
+  const cfg = requireProjectConfig();
+  const env2 = resolveEnvironment(opts.env);
+  const api = new ApiClient();
+  const secrets2 = await api.get(`${envBase(cfg, env2)}/secrets`);
+  if (opts.reveal) {
+    const revealed = await Promise.all(
+      secrets2.map((s) => api.post(`${envBase(cfg, env2)}/secrets/${s.key}/reveal`))
+    );
+    if (opts.json) {
+      console.log(JSON.stringify(revealed, null, 2));
+      return;
+    }
+    for (const s of revealed) console.log(`${s.key}=${s.value}${annotate(s)}`);
+    return;
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(secrets2, null, 2));
+    return;
+  }
+  for (const s of secrets2) console.log(`${s.key}=${s.maskedValue}${annotate(s)}`);
+}
+async function secretsGetCommand(key, opts) {
+  const cfg = requireProjectConfig();
+  const env2 = resolveEnvironment(opts.env);
+  const api = new ApiClient();
+  const suffix = opts.previous ? "?previous=true" : "";
+  const secret = opts.reveal ? await api.post(`${envBase(cfg, env2)}/secrets/${key}/reveal${suffix}`) : await api.get(`${envBase(cfg, env2)}/secrets/${key}${suffix}`);
+  if (opts.json) {
+    console.log(JSON.stringify(secret, null, 2));
+    return;
+  }
+  console.log("value" in secret ? secret.value : secret.maskedValue);
+}
+async function secretsRotateCommand(key, value, opts) {
+  const cfg = requireProjectConfig();
+  const env2 = resolveEnvironment(opts.env);
+  const api = new ApiClient();
+  let resolvedValue = value;
+  if (opts.provider) {
+    if (value !== void 0) {
+      console.error(`Don't pass both a value and --provider \u2014 the plugin computes the new value itself.`);
+      process.exit(1);
+    }
+    const plugin = getRotationPlugin(opts.provider);
+    const current = await api.post(`${envBase(cfg, env2)}/secrets/${key}/reveal`);
+    const result = await plugin.rotate({
+      key,
+      currentValue: current.value,
+      options: { role: opts.role, adminConnString: opts.adminConnString, newPassword: opts.newPassword }
+    });
+    console.log(result.summary);
+    resolvedValue = result.newValue;
+  } else if (opts.fromFile) {
+    const { readFileSync: readFileSync6 } = await import("fs");
+    resolvedValue = readFileSync6(opts.fromFile, "utf8").replace(/\n$/, "");
+  } else if (value === "-") {
+    resolvedValue = await readStdin();
+  }
+  if (resolvedValue === void 0) {
+    console.error("Provide a new value, use --from-file <path>, --provider <name>, or pass '-' to read from stdin.");
+    process.exit(1);
+  }
+  const secret = await api.post(`${envBase(cfg, env2)}/secrets/${key}/rotate`, {
+    value: resolvedValue,
+    graceWindow: opts.grace
+  });
+  console.log(
+    `Rotated ${secret.key} in ${env2} (now v${secret.version}). ` + (opts.grace ? `Previous value fetchable via 'vaultic secrets get ${key} --previous' until ${secret.rotationGraceUntil}.` : `Previous value fetchable indefinitely via 'vaultic secrets get ${key} --previous' (no --grace given).`)
+  );
+}
+function rotationProvidersCommand() {
+  for (const plugin of listRotationPlugins()) {
+    console.log(`${plugin.name}
+  ${plugin.describe()}
+`);
+  }
+}
+async function secretsSetCommand(key, value, opts) {
+  const cfg = requireProjectConfig();
+  const env2 = resolveEnvironment(opts.env);
+  const api = new ApiClient();
+  let resolvedValue = value;
+  if (opts.fromFile) {
+    const { readFileSync: readFileSync6 } = await import("fs");
+    resolvedValue = readFileSync6(opts.fromFile, "utf8").replace(/\n$/, "");
+  } else if (value === "-") {
+    resolvedValue = await readStdin();
+  }
+  const metadata = buildExpiryMetadata(opts);
+  if (resolvedValue === void 0) {
+    if (!metadata) {
+      console.error(
+        "Provide a value, use --from-file <path>, pass '-' to read from stdin, or set --expires-in/--expires-at/--remind-every/--clear-expiry/--clear-remind to update metadata only."
+      );
+      process.exit(1);
+    }
+    const secret2 = await api.patch(`${envBase(cfg, env2)}/secrets/${key}/metadata`, metadata);
+    console.log(`Updated ${secret2.key} in ${env2}${describeMetadata(secret2)}`);
+    return;
+  }
+  const secret = await api.post(
+    `${envBase(cfg, env2)}/secrets`,
+    { key, value: resolvedValue, ...metadata }
+  );
+  if (secret.status === "pending") {
+    console.log(`"${env2}" is locked \u2014 proposed change for ${key} (proposal ${secret.proposalId}), awaiting approval.`);
+    return;
+  }
+  console.log(`Set ${secret.key} in ${env2} (v${secret.version})${describeMetadata(secret)}`);
+}
+async function secretsDeleteCommand(key, opts) {
+  const cfg = requireProjectConfig();
+  const env2 = resolveEnvironment(opts.env);
+  const api = new ApiClient();
+  const result = await api.delete(
+    `${envBase(cfg, env2)}/secrets/${key}`
+  );
+  if (result?.status === "pending") {
+    console.log(`"${env2}" is locked \u2014 proposed deletion of ${key} (proposal ${result.proposalId}), awaiting approval.`);
+    return;
+  }
+  console.log(`Deleted ${key} from ${env2}`);
+}
+async function secretsHistoryCommand(key, opts) {
+  const cfg = requireProjectConfig();
+  const env2 = resolveEnvironment(opts.env);
+  const api = new ApiClient();
+  const versions = await api.get(
+    `${envBase(cfg, env2)}/secrets/${key}/history${opts.reveal ? "?reveal=true" : ""}`
+  );
+  for (const v of versions) {
+    console.log(`v${v.version}  ${v.changeType}  ${v.createdAt}${v.value !== void 0 ? `  ${v.value}` : ""}`);
+  }
+}
+async function secretsRollbackCommand(key, opts) {
+  const cfg = requireProjectConfig();
+  const env2 = resolveEnvironment(opts.env);
+  const api = new ApiClient();
+  const secret = await api.post(`${envBase(cfg, env2)}/secrets/${key}/rollback`, {
+    version: Number(opts.version)
+  });
+  console.log(`Rolled back ${secret.key} to v${opts.version} (now v${secret.version})`);
+}
+async function secretsRenameCommand(oldKey, newKey, opts) {
+  const cfg = requireProjectConfig();
+  const env2 = resolveEnvironment(opts.env);
+  const api = new ApiClient();
+  await api.post(`${envBase(cfg, env2)}/secrets/${oldKey}/rename`, { newKey });
+  console.log(`Renamed ${oldKey} -> ${newKey} in ${env2}`);
+}
+async function secretsOverrideSetCommand(key, value, opts) {
+  const cfg = requireProjectConfig();
+  const env2 = resolveEnvironment(opts.env);
+  const api = new ApiClient();
+  let resolvedValue = value;
+  if (opts.fromFile) {
+    const { readFileSync: readFileSync6 } = await import("fs");
+    resolvedValue = readFileSync6(opts.fromFile, "utf8").replace(/\n$/, "");
+  } else if (value === "-") {
+    resolvedValue = await readStdin();
+  }
+  if (resolvedValue === void 0) {
+    console.error("Provide a value, use --from-file <path>, or pass '-' to read from stdin.");
+    process.exit(1);
+  }
+  await api.put(`${envBase(cfg, env2)}/secrets/${key}/override`, { value: resolvedValue });
+  console.log(`Set personal override for ${key} in ${env2} (visible only to you)`);
+}
+async function secretsOverrideClearCommand(key, opts) {
+  const cfg = requireProjectConfig();
+  const env2 = resolveEnvironment(opts.env);
+  const api = new ApiClient();
+  await api.delete(`${envBase(cfg, env2)}/secrets/${key}/override`);
+  console.log(`Cleared personal override for ${key} in ${env2}`);
+}
+
+// src/commands/env.ts
+import prompts4 from "prompts";
+function projectBase(workspace2, project) {
+  return `/workspaces/${workspace2}/projects/${project}`;
+}
+async function envListCommand() {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  const envs = await api.get(`${projectBase(cfg.workspace, cfg.project)}/environments`);
+  for (const e of envs) {
+    const marker = e.slug === cfg.default_environment ? "*" : " ";
+    const tags = [];
+    if (e.parentSlug) tags.push(`inherits ${e.parentSlug}`);
+    if (e.lockedAt) tags.push("locked");
+    if (e.isEphemeral) tags.push(`ephemeral, expires ${e.expiresAt ?? "?"}`);
+    console.log(`${marker} ${e.slug}${tags.length ? `  (${tags.join(", ")})` : ""}`);
+  }
+}
+async function envCreateCommand(slug, opts = {}) {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  await api.post(`${projectBase(cfg.workspace, cfg.project)}/environments`, {
+    slug,
+    inherits: opts.inherits,
+    ephemeral: opts.ephemeral,
+    ttlDays: opts.ttlDays ? Number(opts.ttlDays) : void 0,
+    expiresAt: opts.expiresAt
+  });
+  const tags = [];
+  if (opts.inherits) tags.push(`inherits from "${opts.inherits}"`);
+  if (opts.ephemeral) tags.push(`ephemeral, ttl ${opts.ttlDays ?? "?"}d`);
+  console.log(`Created environment "${slug}"${tags.length ? ` (${tags.join(", ")})` : ""}`);
+}
+async function envDuplicateCommand(source, target, opts) {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  const mode = opts.link ? "link" : opts.keysOnly ? "keys-only" : "values";
+  await api.post(`${projectBase(cfg.workspace, cfg.project)}/environments/${source}/duplicate`, {
+    targetSlug: target,
+    mode
+  });
+  console.log(`Duplicated "${source}" -> "${target}" (${mode})`);
+}
+async function envDiffCommand(from, to, opts) {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  const diff = await api.get(
+    `${projectBase(cfg.workspace, cfg.project)}/diff?from=${from}&to=${to}${opts.reveal ? "&reveal=true" : ""}`
+  );
+  console.log(`Diff ${from} -> ${to}`);
+  console.log(`  added:     ${diff.added.join(", ") || "(none)"}`);
+  console.log(`  removed:   ${diff.removed.join(", ") || "(none)"}`);
+  console.log(`  changed:   ${diff.changed.join(", ") || "(none)"}`);
+  console.log(`  unchanged: ${diff.unchanged.join(", ") || "(none)"}`);
+}
+async function envPromoteCommand(from, to, opts) {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  const base2 = projectBase(cfg.workspace, cfg.project);
+  const diff = await api.get(`${base2}/diff?from=${from}&to=${to}`);
+  const toCreate = diff.removed;
+  const toUpdate = diff.changed;
+  if (toCreate.length === 0 && toUpdate.length === 0) {
+    console.log(`"${to}" is already up to date with "${from}" \u2014 nothing to promote.`);
+    return;
+  }
+  console.log(`Promoting ${from} -> ${to}:`);
+  console.log(`  create: ${toCreate.join(", ") || "(none)"}`);
+  console.log(`  update: ${toUpdate.join(", ") || "(none)"}`);
+  console.log(`(values masked; ${diff.added.length} key(s) only in "${to}" are left untouched)`);
+  if (!opts.yes) {
+    const { proceed } = await prompts4({
+      type: "confirm",
+      name: "proceed",
+      message: `Apply these ${toCreate.length + toUpdate.length} change(s) to "${to}"?`,
+      initial: false
+    });
+    if (!proceed) {
+      console.log("Aborted.");
+      return;
+    }
+  }
+  const result = await api.post(`${base2}/environments/${from}/promote`, { to });
+  console.log(`Promoted ${result.promoted.length} key(s) to "${to}".`);
+}
+async function envLockCommand(slug) {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  await api.post(`${projectBase(cfg.workspace, cfg.project)}/environments/${slug}/lock`);
+  console.log(`Locked "${slug}" \u2014 direct writes now require approval (see \`vaultic env proposals ${slug}\`).`);
+}
+async function envUnlockCommand(slug) {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  await api.post(`${projectBase(cfg.workspace, cfg.project)}/environments/${slug}/unlock`);
+  console.log(`Unlocked "${slug}" \u2014 direct writes are allowed again.`);
+}
+async function envProposalsCommand(slug, opts = {}) {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  const status = opts.status ?? "pending";
+  const proposals = await api.get(
+    `${projectBase(cfg.workspace, cfg.project)}/environments/${slug}/proposals?status=${status}`
+  );
+  if (proposals.length === 0) {
+    console.log(`No ${status} proposals for "${slug}".`);
+    return;
+  }
+  for (const p of proposals) {
+    console.log(`${p.id}  ${p.type.padEnd(6)} ${p.key.padEnd(30)} ${p.status}  ${p.createdAt}`);
+  }
+}
+async function envApproveCommand(slug, proposalId) {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  await api.post(
+    `${projectBase(cfg.workspace, cfg.project)}/environments/${slug}/proposals/${proposalId}/approve`
+  );
+  console.log(`Approved proposal ${proposalId} \u2014 change applied to "${slug}".`);
+}
+async function envRejectCommand(slug, proposalId) {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  await api.post(
+    `${projectBase(cfg.workspace, cfg.project)}/environments/${slug}/proposals/${proposalId}/reject`
+  );
+  console.log(`Rejected proposal ${proposalId}.`);
+}
+
+// src/commands/tokens.ts
+async function tokensCreateCommand(name, opts) {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  const expiresInDays = opts.expires ? parseDays(opts.expires) : void 0;
+  const token = await api.post(`/workspaces/${cfg.workspace}/tokens`, {
+    name,
+    projectSlug: cfg.project,
+    environmentSlug: opts.env,
+    access: opts.readOnly ? "read" : "write",
+    expiresInDays
+  });
+  console.log(`Created token "${name}" (${token.access}):`);
+  console.log(token.token);
+  console.log("\nStore this now \u2014 it will not be shown again.");
+}
+async function tokensListCommand() {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  const tokens2 = await api.get(`/workspaces/${cfg.workspace}/tokens`);
+  for (const t of tokens2) {
+    const status = t.revokedAt ? "revoked" : t.expiresAt && new Date(t.expiresAt) < /* @__PURE__ */ new Date() ? "expired" : "active";
+    console.log(`${t.id}  ${t.name}  ${t.access}  ${status}`);
+  }
+}
+async function tokensRevokeCommand(tokenId) {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  await api.post(`/workspaces/${cfg.workspace}/tokens/${tokenId}/revoke`);
+  console.log(`Revoked token ${tokenId}`);
+}
+function parseDays(expr) {
+  const match = expr.match(/^(\d+)d?$/);
+  if (!match) throw new Error(`Invalid --expires value "${expr}", expected e.g. "90d"`);
+  return Number(match[1]);
+}
+
+// src/commands/workspace.ts
+function webUrl() {
+  return process.env.VAULTIC_WEB_URL ?? "http://localhost:5173";
+}
+async function workspaceInviteCommand(email, opts) {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  const invite = await api.post(`/workspaces/${cfg.workspace}/invites`, {
+    email,
+    role: opts.role ?? "developer"
+  });
+  console.log(`Invited ${email} as ${invite.role}. Share this link:`);
+  console.log(`${webUrl()}/accept-invite/${invite.token}`);
+  if (invite.expiresAt) console.log(`(expires ${invite.expiresAt})`);
+}
+async function workspaceInvitesCommand() {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  const invites = await api.get(`/workspaces/${cfg.workspace}/invites`);
+  if (invites.length === 0) {
+    console.log("No pending invites.");
+    return;
+  }
+  for (const i of invites) {
+    console.log(`${i.id}  ${i.email}  ${i.role}  invited by ${i.invitedByEmail ?? "?"}  expires ${i.expiresAt ?? "never"}`);
+  }
+}
+async function workspaceRevokeInviteCommand(inviteId) {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  await api.post(`/workspaces/${cfg.workspace}/invites/${inviteId}/revoke`);
+  console.log(`Revoked invite ${inviteId}`);
+}
+async function workspaceMembersCommand() {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  const members = await api.get(`/workspaces/${cfg.workspace}/members`);
+  for (const m of members) {
+    console.log(`${m.id}  ${m.name} <${m.email}>  ${m.role}`);
+  }
+}
+async function findMemberByEmail(api, workspace2, email) {
+  const members = await api.get(`/workspaces/${workspace2}/members`);
+  const member = members.find((m) => m.email.toLowerCase() === email.toLowerCase());
+  if (!member) {
+    console.error(`No member with email ${email} in this workspace.`);
+    process.exit(1);
+  }
+  return member;
+}
+async function workspaceSetRoleCommand(email, role) {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  const member = await findMemberByEmail(api, cfg.workspace, email);
+  const updated = await api.patch(`/workspaces/${cfg.workspace}/members/${member.id}`, { role });
+  console.log(`${email} is now ${updated.role}`);
+}
+async function workspaceRemoveMemberCommand(email) {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  const member = await findMemberByEmail(api, cfg.workspace, email);
+  await api.delete(`/workspaces/${cfg.workspace}/members/${member.id}`);
+  console.log(`Removed ${email} from the workspace`);
+}
+async function workspaceAcceptInviteCommand(token) {
+  const api = new ApiClient();
+  const result = await api.post(`/invites/${token}/accept`);
+  console.log(`Joined "${result.workspace.name}" (${result.workspace.slug})`);
+}
+
+// src/commands/access.ts
+async function accessGrantCommand(email, opts) {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  const members = await api.get(`/workspaces/${cfg.workspace}/members`);
+  const member = members.find((m) => m.email.toLowerCase() === email.toLowerCase());
+  if (!member) {
+    console.error(`No member with email ${email} in this workspace.`);
+    process.exit(1);
+  }
+  const grant = await api.post(`/workspaces/${cfg.workspace}/projects/${cfg.project}/access-grants`, {
+    memberId: member.id,
+    environmentSlug: opts.env,
+    role: opts.role ?? "developer"
+  });
+  console.log(
+    `Granted ${email} ${grant.role} on ${cfg.project}${grant.environmentSlug ? `/${grant.environmentSlug}` : " (whole project)"}`
+  );
+}
+async function accessListCommand() {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  const grants = await api.get(`/workspaces/${cfg.workspace}/projects/${cfg.project}/access-grants`);
+  if (grants.length === 0) {
+    console.log("No access grants for this project.");
+    return;
+  }
+  for (const g of grants) {
+    console.log(`${g.id}  ${g.memberEmail}  ${g.role}  ${g.environmentSlug ?? "(whole project)"}`);
+  }
+}
+async function accessRevokeCommand(grantId) {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  await api.delete(`/workspaces/${cfg.workspace}/projects/${cfg.project}/access-grants/${grantId}`);
+  console.log(`Revoked grant ${grantId}`);
+}
+
+// src/commands/share.ts
+async function shareCommand(key, opts) {
+  const cfg = requireProjectConfig();
+  const env2 = resolveEnvironment(opts.env);
+  const api = new ApiClient();
+  const result = await api.post(`${envBase(cfg, env2)}/secrets/${key}/share`, {
+    expiresIn: opts.expires,
+    maxViews: opts.maxViews ? Number(opts.maxViews) : void 0
+  });
+  console.log(`${api.getServerUrl()}/share/${result.token}`);
+  const limits = [];
+  if (result.expiresAt) limits.push(`expires ${result.expiresAt}`);
+  if (result.maxViews !== null) limits.push(`max ${result.maxViews} view(s)`);
+  console.log(limits.length ? `(${limits.join(", ")})` : "");
+}
+
+// src/commands/webhooks.ts
+async function webhooksCreateCommand(url, opts) {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  const events = opts.events.split(",").map((e) => e.trim());
+  const result = await api.post(`/workspaces/${cfg.workspace}/webhooks`, {
+    url,
+    events,
+    kind: opts.slack ? "slack" : "generic"
+  });
+  console.log(`Created webhook ${result.id} (${result.kind})`);
+  if (result.secret) {
+    console.log(`Signing secret (shown once \u2014 save it): ${result.secret}`);
+  }
+}
+async function webhooksListCommand() {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  const webhooks2 = await api.get(`/workspaces/${cfg.workspace}/webhooks`);
+  for (const w of webhooks2) {
+    console.log(`${w.id}  ${w.kind.padEnd(7)} ${w.url}  [${w.events.join(", ")}]${w.disabledAt ? "  (disabled)" : ""}`);
+  }
+}
+async function webhooksDeleteCommand(id) {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  await api.delete(`/workspaces/${cfg.workspace}/webhooks/${id}`);
+  console.log(`Deleted webhook ${id}`);
+}
+async function webhooksDeliveriesCommand(id) {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  const deliveries = await api.get(`/workspaces/${cfg.workspace}/webhooks/${id}/deliveries`);
+  if (deliveries.length === 0) {
+    console.log("No deliveries yet.");
+    return;
+  }
+  for (const d of deliveries) {
+    console.log(
+      `${d.createdAt}  ${d.event.padEnd(24)} ${d.success ? "ok" : "FAILED"}  status=${d.statusCode ?? "-"}  ${d.durationMs}ms${d.error ? `  ${d.error}` : ""}`
+    );
+  }
+}
+
+// src/integrations/github.ts
+import sodium from "libsodium-wrappers";
+var GithubClient = class {
+  token;
+  owner;
+  repo;
+  environment;
+  fetchFn;
+  constructor(opts) {
+    this.token = opts.token;
+    this.owner = opts.owner;
+    this.repo = opts.repo;
+    this.environment = opts.environment;
+    this.fetchFn = opts.fetchFn ?? fetch;
+  }
+  base() {
+    return this.environment ? `https://api.github.com/repos/${this.owner}/${this.repo}/environments/${this.environment}/secrets` : `https://api.github.com/repos/${this.owner}/${this.repo}/actions/secrets`;
+  }
+  headers() {
+    return {
+      authorization: `Bearer ${this.token}`,
+      accept: "application/vnd.github+json",
+      "content-type": "application/json",
+      "x-github-api-version": "2022-11-28"
+    };
+  }
+  async getPublicKey() {
+    const res = await this.fetchFn(`${this.base()}/public-key`, { headers: this.headers() });
+    if (!res.ok) throw new Error(`GitHub public key fetch failed: ${res.status} ${await res.text()}`);
+    return res.json();
+  }
+  async listSecretNames() {
+    const res = await this.fetchFn(this.base(), { headers: this.headers() });
+    if (!res.ok) throw new Error(`GitHub list secrets failed: ${res.status} ${await res.text()}`);
+    const data = await res.json();
+    return (data.secrets ?? []).map((s) => s.name);
+  }
+  async putSecret(name, encryptedValue, keyId) {
+    const res = await this.fetchFn(`${this.base()}/${name}`, {
+      method: "PUT",
+      headers: this.headers(),
+      body: JSON.stringify({ encrypted_value: encryptedValue, key_id: keyId })
+    });
+    if (!res.ok) throw new Error(`GitHub set secret "${name}" failed: ${res.status} ${await res.text()}`);
+  }
+};
+async function encryptForGithub(publicKeyBase64, value) {
+  await sodium.ready;
+  const messageBytes = sodium.from_string(value);
+  const keyBytes = sodium.from_base64(publicKeyBase64, sodium.base64_variants.ORIGINAL);
+  const encryptedBytes = sodium.crypto_box_seal(messageBytes, keyBytes);
+  return sodium.to_base64(encryptedBytes, sodium.base64_variants.ORIGINAL);
+}
+
+// src/integrations/vercel.ts
+var VercelClient = class {
+  token;
+  projectId;
+  teamId;
+  target;
+  fetchFn;
+  constructor(opts) {
+    this.token = opts.token;
+    this.projectId = opts.projectId;
+    this.teamId = opts.teamId;
+    this.target = opts.target ?? ["production"];
+    this.fetchFn = opts.fetchFn ?? fetch;
+  }
+  query() {
+    return this.teamId ? `?teamId=${encodeURIComponent(this.teamId)}` : "";
+  }
+  headers() {
+    return { authorization: `Bearer ${this.token}`, "content-type": "application/json" };
+  }
+  async listEnvVars() {
+    const res = await this.fetchFn(`https://api.vercel.com/v9/projects/${this.projectId}/env${this.query()}`, {
+      headers: this.headers()
+    });
+    if (!res.ok) throw new Error(`Vercel list env vars failed: ${res.status} ${await res.text()}`);
+    const data = await res.json();
+    return data.envs ?? [];
+  }
+  async createEnvVar(key, value) {
+    const res = await this.fetchFn(`https://api.vercel.com/v10/projects/${this.projectId}/env${this.query()}`, {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify({ key, value, type: "encrypted", target: this.target })
+    });
+    if (!res.ok) throw new Error(`Vercel create env var "${key}" failed: ${res.status} ${await res.text()}`);
+  }
+  async updateEnvVar(envId, value) {
+    const res = await this.fetchFn(`https://api.vercel.com/v9/projects/${this.projectId}/env/${envId}${this.query()}`, {
+      method: "PATCH",
+      headers: this.headers(),
+      body: JSON.stringify({ value })
+    });
+    if (!res.ok) throw new Error(`Vercel update env var failed: ${res.status} ${await res.text()}`);
+  }
+};
+
+// src/integrations/sync.ts
+function planSync(existingKeys, desiredKeys) {
+  const existing = new Set(existingKeys);
+  const toCreate = [];
+  const toUpdate = [];
+  for (const key of desiredKeys) {
+    (existing.has(key) ? toUpdate : toCreate).push(key);
+  }
+  return { toCreate, toUpdate };
+}
+
+// src/commands/push.ts
+async function pushGithubCommand(opts) {
+  const cfg = requireProjectConfig();
+  const env2 = resolveEnvironment(opts.env);
+  const api = new ApiClient();
+  const secrets2 = await api.get(`${envBase(cfg, env2)}/export`);
+  const token = opts.token ?? process.env.GITHUB_TOKEN;
+  if (!token) {
+    console.error("Provide a GitHub PAT via GITHUB_TOKEN or --token (needs `secrets` write scope).");
+    process.exit(1);
+  }
+  const client = new GithubClient({ token, owner: opts.owner, repo: opts.repo, environment: opts.ghEnvironment });
+  const publicKey = await client.getPublicKey();
+  const existing = await client.listSecretNames();
+  const plan = planSync(existing, Object.keys(secrets2));
+  for (const key of [...plan.toCreate, ...plan.toUpdate]) {
+    const encrypted = await encryptForGithub(publicKey.key, secrets2[key]);
+    await client.putSecret(key, encrypted, publicKey.key_id);
+  }
+  const target = opts.ghEnvironment ? `${opts.owner}/${opts.repo} (GitHub environment: ${opts.ghEnvironment})` : `${opts.owner}/${opts.repo}`;
+  console.log(`Pushed to GitHub ${target}: ${plan.toCreate.length} new, ${plan.toUpdate.length} updated.`);
+}
+async function pushVercelCommand(opts) {
+  const cfg = requireProjectConfig();
+  const env2 = resolveEnvironment(opts.env);
+  const api = new ApiClient();
+  const secrets2 = await api.get(`${envBase(cfg, env2)}/export`);
+  const token = opts.token ?? process.env.VERCEL_TOKEN;
+  if (!token) {
+    console.error("Provide a Vercel token via VERCEL_TOKEN or --token.");
+    process.exit(1);
+  }
+  const client = new VercelClient({
+    token,
+    projectId: opts.project,
+    teamId: opts.team,
+    target: opts.target ? [opts.target] : void 0
+  });
+  const existingVars = await client.listEnvVars();
+  const existingByKey = new Map(existingVars.map((v) => [v.key, v]));
+  const plan = planSync(existingVars.map((v) => v.key), Object.keys(secrets2));
+  for (const key of plan.toCreate) await client.createEnvVar(key, secrets2[key]);
+  for (const key of plan.toUpdate) await client.updateEnvVar(existingByKey.get(key).id, secrets2[key]);
+  console.log(`Pushed to Vercel project ${opts.project}: ${plan.toCreate.length} new, ${plan.toUpdate.length} updated.`);
+}
+
+// src/commands/git-integration.ts
+function base(workspace2, project) {
+  return `/workspaces/${workspace2}/projects/${project}/git-integration`;
+}
+async function gitIntegrationSetupCommand(opts) {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  const integration = await api.post(base(cfg.workspace, cfg.project), {
+    owner: opts.owner,
+    repo: opts.repo,
+    branchPattern: opts.branchPattern,
+    previewEnvironmentTemplate: opts.template,
+    defaultTtlDays: opts.ttlDays ? Number(opts.ttlDays) : void 0
+  });
+  console.log(`Git integration configured for ${integration.owner}/${integration.repo}.`);
+  console.log(``);
+  console.log(`On GitHub: Settings -> Webhooks -> Add webhook`);
+  console.log(`  Payload URL:  ${integration.webhookUrl}`);
+  console.log(`  Content type: application/json`);
+  console.log(`  Secret:       ${integration.webhookSecret}`);
+  console.log(`  Events:       "Branches or tags" (push) and "Branch or tag deletion" (delete)`);
+  console.log(``);
+  console.log(
+    `Pushes to branches matching "${integration.branchPattern}" will spawn/renew a preview environment (auto-expires after ${integration.defaultTtlDays}d of inactivity); deleting the branch tears it down immediately.`
+  );
+}
+async function gitIntegrationShowCommand() {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  const integration = await api.get(base(cfg.workspace, cfg.project));
+  console.log(JSON.stringify(integration, null, 2));
+}
+async function gitIntegrationRemoveCommand() {
+  const cfg = requireProjectConfig();
+  const api = new ApiClient();
+  await api.delete(base(cfg.workspace, cfg.project));
+  console.log("Git integration removed.");
+}
+
+// src/index.ts
+var program = new Command();
+program.name("vaultic").description("Vaultic CLI").version("0.1.0");
+program.command("init").description("Initialize this directory as a Vaultic project (writes .vaultic.yaml)").action(wrap(initCommand));
+program.command("login").description("Log in with email/password, or paste a token with --token").option("--token <token>", "paste a session or service token instead of logging in interactively").option("--server <url>", "Vaultic server URL").option("--email <email>", "email (non-interactive)").option("--password <password>", "password (non-interactive)").action(wrap(loginCommand));
+program.command("logout").description("Clear stored credentials").action(wrap(logoutCommand));
+program.command("whoami").description("Show the current logged-in user").action(wrap(whoamiCommand));
+program.command("run").description("Inject secrets as env vars and run a command").option("-e, --env <environment>", "environment to use").option("--watch", "poll for secret changes and restart the subprocess when they change").option("--poll-interval <ms>", "watch poll interval in milliseconds (default 2000)").allowUnknownOption().argument("<command...>", "command to run, after --").action(wrap((commandParts, opts) => runCommand(commandParts, opts)));
+program.command("export").description("Generate a local secrets file from the server").option("-e, --env <environment>", "environment to use").option("--format <format>", "dotenv | json | yaml | shell").option("--path <path>", "output file path").option("--no-header", "omit the generated-by header/checksum").option("--check", "fail if the local file is stale vs the server (CI mode)").action(wrap(exportCommand));
+program.command("import").description("Import an existing .env or JSON file into Vaultic").argument("<file>", "path to .env or JSON file").option("-e, --env <environment>", "environment to import into").option("--prefix <prefix>", "prefix to prepend to every imported key").option("--dry-run", "show what would be created/changed without writing").option("--from-json", "treat the file as JSON instead of dotenv").option("--overwrite", "overwrite existing keys instead of skipping them").action(wrap(importCommand));
+program.command("status").description("Compare local secrets file vs the server").option("-e, --env <environment>").action(wrap(statusCommand));
+program.command("sync").description("Pull server -> regenerate local secrets file (runs post_sync hook)").option("-e, --env <environment>").action(wrap(syncCommand));
+var secrets = program.command("secrets").description("Manage secrets");
+secrets.command("list").option("-e, --env <environment>").option("--reveal", "show real values instead of masked").option("--json", "machine-readable output").action(wrap(secretsListCommand));
+secrets.command("get").argument("<key>").option("-e, --env <environment>").option("--reveal", "show the real value instead of masked").option("--json", "machine-readable output").option("--previous", "fetch the pre-rotation value instead of the current one (see 'secrets rotate')").action(wrap(secretsGetCommand));
+secrets.command("set").argument("<key>").argument("[value]", "value, or '-' to read from stdin (omit entirely to update only --expires-*/--remind-every)").option("-e, --env <environment>").option("--from-file <path>", "read the value from a file").option("--expires-in <duration>", 'set an expiry relative to now, e.g. "90d", "12h"').option("--expires-at <date>", "set an absolute expiry date (ISO or any Date-parseable string)").option("--remind-every <duration>", 'set a rotation-reminder cadence, e.g. "30d"').option("--clear-expiry", "remove this secret's expiry date").option("--clear-remind", "remove this secret's rotation reminder").action(wrap(secretsSetCommand));
+secrets.command("delete").argument("<key>").option("-e, --env <environment>").action(wrap(secretsDeleteCommand));
+secrets.command("history").argument("<key>").option("-e, --env <environment>").option("--reveal").action(wrap(secretsHistoryCommand));
+secrets.command("rollback").argument("<key>").requiredOption("--version <version>").option("-e, --env <environment>").action(wrap(secretsRollbackCommand));
+secrets.command("rename").argument("<oldKey>").argument("<newKey>").option("-e, --env <environment>").action(wrap(secretsRenameCommand));
+secrets.command("rotate").description("Set a new value, keeping the old one fetchable via 'secrets get KEY --previous'").argument("<key>").argument("[value]", "new value, or '-' to read from stdin (omit entirely when using --provider)").option("-e, --env <environment>").option("--from-file <path>", "read the new value from a file").option("--grace <duration>", 'how long the previous value stays fetchable, e.g. "1h", "30m" (omit for no limit)').option("--provider <name>", "have a rotation plugin compute the new value (postgres | stripe | aws-iam)").option("--role <role>", "[postgres] role to rotate (defaults to the connection string's user)").option("--admin-conn-string <url>", "[postgres] connect with different credentials than the value being rotated").option("--new-password <password>", "[postgres] use this password instead of a random one").action(wrap(secretsRotateCommand));
+program.command("rotation-providers").description("List available `secrets rotate --provider` plugins").action(wrap(rotationProvidersCommand));
+var override = secrets.command("override").description("Manage your personal, server-side value overrides");
+override.command("set").argument("<key>").argument("[value]", "value, or '-' to read from stdin").option("-e, --env <environment>").option("--from-file <path>", "read the value from a file").action(wrap(secretsOverrideSetCommand));
+override.command("clear").argument("<key>").option("-e, --env <environment>").action(wrap(secretsOverrideClearCommand));
+var env = program.command("env").description("Manage environments");
+env.command("list").action(wrap(envListCommand));
+env.command("create").argument("<slug>").option("--inherits <environment>", "inherit unset keys from this environment").option("--ephemeral", "flag as an ephemeral/preview environment (needs --ttl-days or --expires-at)").option("--ttl-days <days>", "auto-expire this many days from now").option("--expires-at <iso>", "auto-expire at this exact ISO timestamp").action(wrap(envCreateCommand));
+env.command("duplicate").argument("<source>").argument("<target>").option("--keys-only", "copy keys only, values left blank").option("--link", "link mode: inherit from source instead of copying values").action(wrap(envDuplicateCommand));
+env.command("diff").argument("<from>").argument("<to>").option("--reveal").action(wrap(envDiffCommand));
+env.command("promote").argument("<from>").argument("<to>").option("--yes", "skip the confirmation prompt").action(wrap(envPromoteCommand));
+env.command("lock").argument("<slug>").action(wrap(envLockCommand));
+env.command("unlock").argument("<slug>").action(wrap(envUnlockCommand));
+env.command("proposals").argument("<slug>").option("--status <status>", "pending | approved | rejected", "pending").action(wrap(envProposalsCommand));
+env.command("approve").argument("<slug>").argument("<proposalId>").action(wrap(envApproveCommand));
+env.command("reject").argument("<slug>").argument("<proposalId>").action(wrap(envRejectCommand));
+var workspace = program.command("workspace").description("Manage workspace members and invites");
+workspace.command("invite").argument("<email>").option("-r, --role <role>", '"admin" | "developer" | "read-only"', "developer").action(wrap((email, opts) => workspaceInviteCommand(email, opts)));
+workspace.command("invites").description("List pending invites").action(wrap(workspaceInvitesCommand));
+workspace.command("revoke-invite").argument("<inviteId>").action(wrap(workspaceRevokeInviteCommand));
+workspace.command("members").description("List workspace members").action(wrap(workspaceMembersCommand));
+workspace.command("set-role").argument("<email>").argument("<role>", '"owner" | "admin" | "developer" | "read-only"').action(wrap((email, role) => workspaceSetRoleCommand(email, role)));
+workspace.command("remove-member").argument("<email>").action(wrap(workspaceRemoveMemberCommand));
+workspace.command("accept-invite").argument("<token>").description("Redeem an invite link as the currently logged-in user").action(wrap(workspaceAcceptInviteCommand));
+var access = program.command("access").description("Manage per-project/per-environment access grants for the current project");
+access.command("grant").argument("<email>").option("-r, --role <role>", '"developer" | "read-only"', "developer").option("-e, --env <environment>", "scope the grant to a single environment (default: whole project)").action(wrap((email, opts) => accessGrantCommand(email, opts)));
+access.command("list").description("List access grants for the current project").action(wrap(accessListCommand));
+access.command("revoke").argument("<grantId>").action(wrap(accessRevokeCommand));
+var tokens = program.command("tokens").description("Manage service tokens");
+tokens.command("create").argument("<name>").option("-e, --env <environment>", "scope to a single environment").option("--read-only", "read-only token (default is read/write)").option("--expires <days>", 'e.g. "90d"').action(wrap(tokensCreateCommand));
+tokens.command("list").action(wrap(tokensListCommand));
+tokens.command("revoke").argument("<tokenId>").action(wrap(tokensRevokeCommand));
+program.command("share").description("Generate a one-time/limited-view link to a secret's current value").argument("<key>").option("-e, --env <environment>").option("--expires <duration>", 'e.g. "1h", "30m", "2d"').option("--max-views <n>", "number of times the link can be viewed").action(wrap(shareCommand));
+var webhooks = program.command("webhooks").description("Manage workspace webhook subscriptions");
+webhooks.command("create").argument("<url>").requiredOption("--events <events>", "comma-separated event names (e.g. secret.created,secret.updated)").option("--slack", "format deliveries as a Slack message instead of signed JSON").action(wrap(webhooksCreateCommand));
+webhooks.command("list").action(wrap(webhooksListCommand));
+webhooks.command("delete").argument("<id>").action(wrap(webhooksDeleteCommand));
+webhooks.command("deliveries").argument("<id>").action(wrap(webhooksDeliveriesCommand));
+var push = program.command("push").description("Sync an environment's secrets outward to a third-party target");
+push.command("github").description("Push to GitHub Actions repo (or repo-environment) secrets").option("-e, --env <environment>").requiredOption("--owner <owner>", "GitHub org/user").requiredOption("--repo <repo>", "GitHub repo name").option("-ge, --gh-environment <name>", "push to a GitHub *Environment*'s secrets instead of repo-level").option("--token <token>", "GitHub PAT (defaults to $GITHUB_TOKEN)").action(wrap(pushGithubCommand));
+push.command("vercel").description("Push to a Vercel project's environment variables").option("-e, --env <environment>").requiredOption("--project <projectId>", "Vercel project ID").option("--team <teamId>", "Vercel team ID, for team-owned projects").option("--target <target>", 'Vercel target: "production" | "preview" | "development"').option("--token <token>", "Vercel token (defaults to $VERCEL_TOKEN)").action(wrap(pushVercelCommand));
+var gitIntegration = program.command("git-integration").description("Configure the inbound Git webhook that spawns/tears down ephemeral preview environments");
+gitIntegration.command("setup").description("Configure (or reconfigure) this project's Git integration; prints the webhook URL + secret to set on GitHub").requiredOption("--owner <owner>", "GitHub org/user").requiredOption("--repo <repo>", "GitHub repo name").option("--branch-pattern <pattern>", 'glob with one "*", e.g. "preview/*" (default)').option("--template <environment>", "environment new preview environments inherit unset keys from").option("--ttl-days <days>", "days a preview environment lives before auto-expiring (default 7)").action(wrap(gitIntegrationSetupCommand));
+gitIntegration.command("show").description("Show the current Git integration config").action(wrap(gitIntegrationShowCommand));
+gitIntegration.command("remove").description("Remove the Git integration").action(wrap(gitIntegrationRemoveCommand));
+function wrap(fn) {
+  return async (...args) => {
+    try {
+      await fn(...args);
+    } catch (err) {
+      if (err instanceof ApiError) {
+        console.error(`Error: ${err.message}`);
+        process.exit(err.status === 401 ? 2 : 1);
+      }
+      console.error(err instanceof Error ? `Error: ${err.message}` : String(err));
+      process.exit(1);
+    }
+  };
+}
+program.parseAsync(process.argv);