@zincapp/zn-vault-agent 1.3.1 → 1.5.0

package/README.md

@@ -21,6 +21,12 @@ Real-time certificate distribution agent for ZN-Vault. Automatically syncs TLS c
 - **No file writes**: Secrets exist only in process memory
 - **Signal forwarding**: Graceful shutdown of child processes
 
+### Combined Mode (NEW)
+- **Daemon + Exec**: Single instance handles both cert sync and child process management
+- **Auto-restart**: Child process restarts automatically when certs or secrets change
+- **Crash recovery**: Automatic restart with rate limiting on child crashes
+- **Unified health**: Single health endpoint showing daemon and child status
+
 ### General
 - **Prometheus metrics**: Full observability via `/metrics` endpoint
 - **Graceful shutdown**: Completes in-flight deployments before exit
@@ -370,10 +376,16 @@ Environment variables override config file values:
 zn-vault-agent start [options]
 
 Options:
-  -v, --verbose         Enable debug logging
-  --health-port <port>  Enable health/metrics HTTP server
-  --validate            Validate config before starting
-  --auto-update         Enable automatic updates
+  -v, --verbose              Enable debug logging
+  --health-port <port>       Enable health/metrics HTTP server
+  --validate                 Validate config before starting
+  --auto-update              Enable automatic updates
+  --exec <command>           Command to execute (combined mode)
+  -s, --secret <mapping>     Secret mapping for exec (repeatable)
+  --restart-on-change        Restart child on cert/secret changes
+  --restart-delay <ms>       Delay before restart (default: 5000)
+  --max-restarts <n>         Max restarts in window (default: 10)
+  --restart-window <ms>      Restart count window (default: 300000)
 ```
 
 ## Secret Sync
@@ -454,17 +466,59 @@ zn-vault-agent exec \
 zn-vault-agent exec \
   -s CONFIG=alias:app/config \
   -- node -e "console.log(JSON.parse(process.env.CONFIG))"
+
+# Use a managed API key (auto-rotating)
+zn-vault-agent exec \
+  -s VAULT_API_KEY=api-key:my-service-key \
+  -- ./my-app
+
+# Mix secrets, managed keys, and literal values
+zn-vault-agent exec \
+  -s DB_PASSWORD=alias:db/prod.password \
+  -s VAULT_KEY=api-key:my-managed-key \
+  -s ENV_NAME=literal:production \
+  -- ./start.sh
 ```
 
-### Mapping Format
+### Mapping Formats
+
+| Format | Description | Example |
+|--------|-------------|---------|
+| `alias:path/to/secret` | Entire secret as JSON | `CONFIG=alias:app/config` |
+| `alias:path/to/secret.key` | Specific field from secret | `DB_PASS=alias:db/creds.password` |
+| `uuid.key` | UUID with specific field | `DB_PASS=abc123.password` |
+| `api-key:name` | Managed API key (binds and gets current value) | `VAULT_KEY=api-key:my-key` |
+| `literal:value` | Literal value (no vault fetch) | `ENV=literal:production` |
+
+#### Managed API Keys (`api-key:`)
+
+Managed API keys are auto-rotating keys created in the vault. When you use `api-key:name`:
+
+1. The agent calls the vault's `/auth/api-keys/managed/:name/bind` endpoint
+2. Returns the current key value based on rotation mode (scheduled, on-use, on-bind)
+3. The key is injected as an environment variable
+
+This is useful for applications that need to authenticate with the vault themselves:
 
+```bash
+# Your app gets a fresh vault API key at startup
+zn-vault-agent exec \
+  -s ZINC_CONFIG_VAULT_API_KEY=api-key:my-app-key \
+  -- ./my-app
 ```
-ENV_VAR=secret-id[.key]
 
-Examples:
-  DB_PASS=alias:db/credentials.password    # Specific key
-  DB_PASS=abc123.password                  # UUID with key
-  CONFIG=alias:app/config                  # Entire secret as JSON
+#### Literal Values (`literal:`)
+
+Literal values are passed through without any vault fetch. Useful for:
+- Static configuration values
+- Feature flags
+- Environment identifiers
+
+```bash
+zn-vault-agent exec \
+  -s DEBUG=literal:true \
+  -s ENV=literal:production \
+  -- ./my-app
 ```
 
 ### Export to File
@@ -473,9 +527,49 @@ Examples:
 # Write secrets to env file (without running a command)
 zn-vault-agent exec \
   -s DB_PASSWORD=alias:db/prod.password \
+  -s VAULT_KEY=api-key:my-key \
+  -s ENV=literal:prod \
   -o /tmp/secrets.env
 ```
 
+## Combined Mode
+
+Run the daemon (cert/secret sync) AND manage a child process with injected secrets in a single instance. This eliminates the need for two separate services.
+
+### Quick Start
+
+```bash
+# Combined mode: daemon + exec in one
+zn-vault-agent start \
+  --exec "payara start-domain domain1" \
+  -s ZINC_CONFIG_USE_VAULT=literal:true \
+  -s ZINC_CONFIG_API_KEY=alias:infra/prod.apiKey \
+  --restart-on-change \
+  --health-port 9100
+```
+
+### Benefits
+
+- **Single WebSocket connection** to vault (reduced load)
+- **Automatic child restart** when certs or exec secrets change
+- **Unified health endpoint** showing both daemon and child status
+- **Simpler systemd config** (one service instead of two)
+- **Signal forwarding** to child process
+- **Crash recovery** with rate limiting
+
+### Options
+
+| Option | Default | Description |
+|--------|---------|-------------|
+| `--exec <cmd>` | - | Command to execute with secrets |
+| `-s <mapping>` | - | Secret mapping (repeatable) |
+| `--restart-on-change` | true | Restart child on changes |
+| `--restart-delay <ms>` | 5000 | Delay before restart |
+| `--max-restarts <n>` | 10 | Max restarts in window |
+| `--restart-window <ms>` | 300000 | Restart count reset window (5 min) |
+
+See [Combined Mode in GUIDE.md](docs/GUIDE.md#combined-mode) for complete documentation.
+
 ### CLI Commands (`znvault agent`)
 
 The CLI provides the same configuration commands:
@@ -696,6 +790,51 @@ npm test             # Test
 npm run test:coverage
 ```
 
+## Releases
+
+This package uses GitHub Actions for CI/CD with npm's OIDC trusted publishing.
+
+### CI Pipeline
+
+On every push to `main` or pull request:
+- Linting and type checking
+- Build verification
+- Unit tests on Node.js 18, 20, 22
+
+### Publishing to npm
+
+Releases are automated via git tags:
+
+```bash
+# 1. Bump version in package.json
+npm version patch   # or minor/major
+
+# 2. Push changes and tag
+git push && git push --tags
+
+# GitHub Actions will automatically:
+# - Run tests
+# - Build the package
+# - Publish to npm with provenance
+```
+
+**Available channels (npm dist-tags):**
+
+| Tag | Purpose | Install Command |
+|-----|---------|-----------------|
+| `latest` | Stable releases | `npm install -g @zincapp/zn-vault-agent` |
+| `beta` | Pre-release testing | `npm install -g @zincapp/zn-vault-agent@beta` |
+| `next` | Development builds | `npm install -g @zincapp/zn-vault-agent@next` |
+
+Pre-release versions (e.g., `1.3.0-beta.1`) are automatically tagged as `beta` or `next`.
+
+### Manual Release (if needed)
+
+```bash
+npm login
+npm publish --access public
+```
+
 ## License
 
 MIT

package/dist/commands/certs.d.ts

@@ -1,3 +1,3 @@
-import { Command } from 'commander';
+import type { Command } from 'commander';
 export declare function registerCertsCommands(program: Command): void;
 //# sourceMappingURL=certs.d.ts.map

package/dist/commands/certs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"certs.d.ts","sourceRoot":"","sources":["../../src/commands/certs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAcpC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsY5D"}
+{"version":3,"file":"certs.d.ts","sourceRoot":"","sources":["../../src/commands/certs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAczC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsY5D"}

package/dist/commands/exec.d.ts

@@ -1,3 +1,3 @@
-import { Command } from 'commander';
+import type { Command } from 'commander';
 export declare function registerExecCommand(program: Command): void;
 //# sourceMappingURL=exec.d.ts.map

package/dist/commands/exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../src/commands/exec.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAoGpC,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAoH1D"}
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../src/commands/exec.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+H1D"}

package/dist/commands/exec.js

@@ -3,85 +3,7 @@
 import chalk from 'chalk';
 import { spawn } from 'node:child_process';
 import { isConfigured } from '../lib/config.js';
-import { getSecret } from '../lib/api.js';
-/**
- * Parse secret mapping from CLI argument
- * Formats:
- *   ENV_VAR=alias:secret/path           -> entire secret as JSON
- *   ENV_VAR=alias:secret/path.key       -> specific key from secret
- *   ENV_VAR=uuid                        -> entire secret as JSON
- *   ENV_VAR=uuid.key                    -> specific key from secret
- */
-function parseSecretMapping(mapping) {
-    const eqIndex = mapping.indexOf('=');
-    if (eqIndex === -1) {
-        throw new Error(`Invalid mapping format: ${mapping}. Expected: ENV_VAR=secret-id[.key]`);
-    }
-    const envVar = mapping.substring(0, eqIndex);
-    let secretPath = mapping.substring(eqIndex + 1);
-    if (!envVar || !secretPath) {
-        throw new Error(`Invalid mapping format: ${mapping}. Expected: ENV_VAR=secret-id[.key]`);
-    }
-    // Check if there's a key after the secret ID
-    // For alias format: alias:path/to/secret.key
-    // For UUID format: uuid.key
-    let key;
-    if (secretPath.startsWith('alias:')) {
-        // Handle alias:path/to/secret.key
-        const lastDotIndex = secretPath.lastIndexOf('.');
-        if (lastDotIndex > secretPath.indexOf(':') + 1) {
-            // There's a dot after the alias prefix
-            const potentialKey = secretPath.substring(lastDotIndex + 1);
-            // Check if this looks like a key (not a file extension or path segment)
-            if (potentialKey && !potentialKey.includes('/')) {
-                key = potentialKey;
-                secretPath = secretPath.substring(0, lastDotIndex);
-            }
-        }
-    }
-    else {
-        // Handle uuid.key or uuid
-        const dotIndex = secretPath.indexOf('.');
-        if (dotIndex !== -1) {
-            key = secretPath.substring(dotIndex + 1);
-            secretPath = secretPath.substring(0, dotIndex);
-        }
-    }
-    return {
-        envVar,
-        secretId: secretPath,
-        key,
-    };
-}
-/**
- * Fetch secrets and build environment variables
- */
-async function buildSecretEnv(mappings) {
-    const env = {};
-    // Group by secretId to minimize API calls
-    const secretCache = new Map();
-    for (const mapping of mappings) {
-        let data = secretCache.get(mapping.secretId);
-        if (!data) {
-            const secret = await getSecret(mapping.secretId);
-            data = secret.data;
-            secretCache.set(mapping.secretId, data);
-        }
-        if (mapping.key) {
-            // Get specific key
-            const value = data[mapping.key];
-            if (value === undefined) {
-                throw new Error(`Key "${mapping.key}" not found in secret "${mapping.secretId}"`);
-            }
-            env[mapping.envVar] = typeof value === 'string' ? value : JSON.stringify(value);
-        }
-        else {
-            // Get entire secret as JSON
-            env[mapping.envVar] = JSON.stringify(data);
-        }
-    }
-    return env;
-}
+import { parseSecretMapping, buildSecretEnv } from '../lib/secret-env.js';
 export function registerExecCommand(program) {
     program
         .command('exec')
@@ -95,6 +17,12 @@ export function registerExecCommand(program) {
         .option('--no-inherit', 'Do not inherit current environment variables')
         .argument('[command...]', 'Command to execute')
         .addHelpText('after', `
+Secret Mapping Formats:
+  ENV_VAR=alias:path/to/secret       Entire secret as JSON
+  ENV_VAR=alias:path/to/secret.key   Specific field from secret
+  ENV_VAR=api-key:name               Managed API key (binds and gets current value)
+  ENV_VAR=literal:value              Literal value (no vault fetch)
+
 Examples:
   # Run node with database password
   zn-vault-agent exec -s DB_PASSWORD=alias:db/prod.password -- node server.js
@@ -106,6 +34,11 @@ Examples:
     -s API_KEY=alias:api/key.value \\
     -- ./start.sh
 
+  # Use a managed API key (auto-rotating)
+  zn-vault-agent exec \\
+    -s ZINC_CONFIG_VAULT_API_KEY=api-key:my-api-key \\
+    -- ./my-app
+
   # Export to env file
   zn-vault-agent exec \\
     -s DB_PASSWORD=alias:db/prod.password \\

package/dist/commands/exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../src/commands/exec.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kEAAkE;AAGlE,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAQ1C;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,qCAAqC,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IAEhD,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,qCAAqC,CAAC,CAAC;IAC3F,CAAC;IAED,6CAA6C;IAC7C,6CAA6C;IAC7C,4BAA4B;IAC5B,IAAI,GAAuB,CAAC;IAE5B,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,kCAAkC;QAClC,MAAM,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,uCAAuC;YACvC,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;YAC5D,wEAAwE;YACxE,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,GAAG,GAAG,YAAY,CAAC;gBACnB,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YACpB,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YACzC,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,UAAU;QACpB,GAAG;KACJ,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,cAAc,CAAC,QAAyB;IACrD,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,0CAA0C;IAC1C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAmC,CAAC;IAE/D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE7C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjD,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACnB,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,mBAAmB;YACnB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,QAAQ,OAAO,CAAC,GAAG,0BAA0B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACpF,CAAC;YACD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAClF,CAAC;aAAM,CAAC;YACN,4BAA4B;YAC5B,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,qDAAqD,CAAC;SAClE,MAAM,CAAC,wBAAwB,EAAE,0CAA0C,EAAE,CAAC,GAAG,EAAE,GAAa,EAAE,EAAE;QACnG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,GAAG,CAAC;IACb,CAAC,EAAE,EAAE,CAAC;SACL,MAAM,CAAC,qBAAqB,EAAE,sDAAsD,CAAC;SACrF,MAAM,CAAC,WAAW,EAAE,uDAAuD,EAAE,IAAI,CAAC;SAClF,MAAM,CAAC,cAAc,EAAE,8CAA8C,CAAC;SACtE,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;SAC9C,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;CAmBzB,CAAC;SACG,MAAM,CAAC,KAAK,EAAE,OAAiB,EAAE,OAAO,EAAE,EAAE;QAC3C,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,iBAAiB;QACjB,IAAI,QAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,gBAAgB;QAChB,IAAI,SAAiC,CAAC;QACtC,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACvG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,gDAAgD;QAChD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;iBACtC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;iBACnD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YAErB,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,uBAAuB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QAED,6BAA6B;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC,CAAC;YAC7E,OAAO,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,oBAAoB;QACpB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO;YACzB,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE;YAClC,CAAC,CAAC,SAAS,CAAC;QAEd,kBAAkB;QAClB,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;QAE/B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YAC7B,GAAG;YACH,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;SACpC,CAAC,CAAC;QAEH,2BAA2B;QAC3B,MAAM,OAAO,GAAqB,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAClE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;gBACtB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;QACL,CAAC;QAED,8BAA8B;QAC9B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAChC,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../src/commands/exec.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,kEAAkE;AAGlE,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAsB,MAAM,sBAAsB,CAAC;AAE9F,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,qDAAqD,CAAC;SAClE,MAAM,CAAC,wBAAwB,EAAE,0CAA0C,EAAE,CAAC,GAAG,EAAE,GAAa,EAAE,EAAE;QACnG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,GAAG,CAAC;IACb,CAAC,EAAE,EAAE,CAAC;SACL,MAAM,CAAC,qBAAqB,EAAE,sDAAsD,CAAC;SACrF,MAAM,CAAC,WAAW,EAAE,uDAAuD,EAAE,IAAI,CAAC;SAClF,MAAM,CAAC,cAAc,EAAE,8CAA8C,CAAC;SACtE,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;SAC9C,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BzB,CAAC;SACG,MAAM,CAAC,KAAK,EAAE,OAAiB,EAAE,OAAO,EAAE,EAAE;QAC3C,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,iBAAiB;QACjB,IAAI,QAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,gBAAgB;QAChB,IAAI,SAAiC,CAAC;QACtC,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACvG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,gDAAgD;QAChD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;iBACtC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;iBACnD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YAErB,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,uBAAuB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QAED,6BAA6B;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC,CAAC;YAC7E,OAAO,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,oBAAoB;QACpB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO;YACzB,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE;YAClC,CAAC,CAAC,SAAS,CAAC;QAEd,kBAAkB;QAClB,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;QAE/B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YAC7B,GAAG;YACH,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;SACpC,CAAC,CAAC;QAEH,2BAA2B;QAC3B,MAAM,OAAO,GAAqB,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAClE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;gBACtB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;QACL,CAAC;QAED,8BAA8B;QAC9B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAChC,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/login.d.ts

@@ -1,3 +1,3 @@
-import { Command } from 'commander';
+import type { Command } from 'commander';
 export declare function registerLoginCommand(program: Command): void;
 //# sourceMappingURL=login.d.ts.map

package/dist/commands/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0CpC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAyN3D"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0CzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAyN3D"}

package/dist/commands/secrets.d.ts

@@ -1,3 +1,3 @@
-import { Command } from 'commander';
+import type { Command } from 'commander';
 export declare function registerSecretsCommands(program: Command): void;
 //# sourceMappingURL=secrets.d.ts.map

package/dist/commands/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/commands/secrets.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqKpC,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0V9D"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/commands/secrets.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqKzC,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0V9D"}

package/dist/commands/setup.d.ts

@@ -4,6 +4,6 @@
  * Installs systemd service and creates necessary directories
  * for running zn-vault-agent as a system daemon.
  */
-import { Command } from 'commander';
+import type { Command } from 'commander';
 export declare function registerSetupCommand(program: Command): void;
 //# sourceMappingURL=setup.d.ts.map

package/dist/commands/setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/commands/setup.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAepC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAgC3D"}
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/commands/setup.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAezC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAgC3D"}

package/dist/commands/start.d.ts

@@ -1,3 +1,3 @@
-import { Command } from 'commander';
+import type { Command } from 'commander';
 export declare function registerStartCommand(program: Command): void;
 //# sourceMappingURL=start.d.ts.map

package/dist/commands/start.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../src/commands/start.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAiH3D"}
+{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../src/commands/start.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAoBzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAiM3D"}

package/dist/commands/start.js

@@ -1,11 +1,16 @@
 // Path: src/commands/start.ts
 // Start command - runs the agent daemon
 import chalk from 'chalk';
-import { isConfigured, loadConfig, getTargets } from '../lib/config.js';
+import { isConfigured, loadConfig, getTargets, DEFAULT_EXEC_CONFIG, } from '../lib/config.js';
 import { validateConfig, formatValidationResult } from '../lib/validation.js';
 import { startDaemon } from '../lib/websocket.js';
 import { logger } from '../lib/logger.js';
 import { NpmAutoUpdateService, loadUpdateConfig } from '../services/npm-auto-update.js';
+import { parseSecretMapping } from '../lib/secret-env.js';
+// Helper to collect repeatable options
+function collect(value, previous) {
+    return previous.concat([value]);
+}
 export function registerStartCommand(program) {
     program
         .command('start')
@@ -16,6 +21,14 @@ export function registerStartCommand(program) {
         .option('--foreground', 'Run in foreground (default)')
         .option('--auto-update', 'Enable automatic updates (uses saved config)')
         .option('--no-auto-update', 'Disable automatic updates')
+        // Exec mode options
+        .option('--exec <command>', 'Command to execute with secrets (combined mode)')
+        .option('-s, --secret <mapping>', 'Secret mapping for exec (ENV=secret, repeatable)', collect, [])
+        .option('--restart-on-change', 'Restart child on cert/secret changes (default: true)')
+        .option('--no-restart-on-change', 'Do not restart child on cert/secret changes')
+        .option('--restart-delay <ms>', 'Delay in ms before restarting child (default: 5000)', parseInt)
+        .option('--max-restarts <n>', 'Max restarts in window (default: 10)', parseInt)
+        .option('--restart-window <ms>', 'Restart count window in ms (default: 300000)', parseInt)
         .addHelpText('after', `
 Examples:
   # Start in foreground (default)
@@ -33,6 +46,13 @@ Examples:
   # With auto-updates enabled
   zn-vault-agent start --health-port 9100 --auto-update
 
+  # Combined mode: cert sync + exec with secrets
+  zn-vault-agent start \\
+    --exec "payara start-domain domain1" \\
+    -s ZINC_CONFIG_USE_VAULT=literal:true \\
+    -s ZINC_CONFIG_API_KEY=alias:infra/prod.apiKey \\
+    --health-port 9100
+
   # Production setup (systemd)
   # See docs/GUIDE.md for systemd service file
 `)
@@ -44,6 +64,50 @@ Examples:
         }
         const config = loadConfig();
         const targets = getTargets();
+        // Build exec config from CLI options or config file
+        let execConfig;
+        if (options.exec) {
+            // CLI options take precedence
+            const secrets = [];
+            // Parse -s/--secret mappings
+            for (const mapping of options.secret) {
+                try {
+                    const parsed = parseSecretMapping(mapping);
+                    if (parsed.literal !== undefined) {
+                        secrets.push({ env: parsed.envVar, literal: parsed.literal });
+                    }
+                    else {
+                        // Reconstruct the secret reference (with key if present)
+                        const secretRef = parsed.key
+                            ? `${parsed.secretId}.${parsed.key}`
+                            : parsed.secretId;
+                        secrets.push({ env: parsed.envVar, secret: secretRef });
+                    }
+                }
+                catch (err) {
+                    console.error(chalk.red('Invalid secret mapping:'), mapping);
+                    console.error(err instanceof Error ? err.message : String(err));
+                    process.exit(1);
+                }
+            }
+            // Parse exec command (split on spaces if needed)
+            const command = options.exec.includes(' ')
+                ? options.exec.split(/\s+/)
+                : [options.exec];
+            execConfig = {
+                command,
+                secrets,
+                inheritEnv: true, // Always inherit for CLI
+                restartOnChange: options.restartOnChange !== false,
+                restartDelayMs: options.restartDelay ?? DEFAULT_EXEC_CONFIG.restartDelayMs,
+                maxRestarts: options.maxRestarts ?? DEFAULT_EXEC_CONFIG.maxRestarts,
+                restartWindowMs: options.restartWindow ?? DEFAULT_EXEC_CONFIG.restartWindowMs,
+            };
+        }
+        else if (config.exec) {
+            // Use exec config from config file
+            execConfig = config.exec;
+        }
         // Validate configuration if requested
         if (options.validate) {
             const result = validateConfig(config);
@@ -54,8 +118,8 @@ Examples:
                 process.exit(1);
             }
         }
-        // Warn if no targets
-        if (targets.length === 0) {
+        // Warn if no targets and no exec
+        if (targets.length === 0 && !execConfig) {
             console.log(chalk.yellow('Warning: No certificate targets configured.'));
             console.log('Run ' + chalk.cyan('zn-vault-agent add') + ' to add certificates to sync.');
             console.log();
@@ -80,6 +144,14 @@ Examples:
         const updateConfig = loadUpdateConfig();
         const autoUpdateEnabled = options.autoUpdate !== false && updateConfig.enabled;
         console.log(`  Auto-update: ${autoUpdateEnabled ? chalk.green('enabled') : 'disabled'}`);
+        // Exec mode status
+        if (execConfig) {
+            console.log(`  Exec:        ${chalk.cyan(execConfig.command.join(' '))}`);
+            console.log(`  Exec secrets: ${execConfig.secrets.length} env var(s)`);
+            if (execConfig.restartOnChange) {
+                console.log(`  Restart:     on cert/secret change (delay: ${execConfig.restartDelayMs}ms)`);
+            }
+        }
         console.log();
         if (targets.length > 0) {
             console.log(chalk.gray('Subscribed certificates:'));
@@ -88,6 +160,14 @@ Examples:
             }
             console.log();
         }
+        if (execConfig && execConfig.secrets.length > 0) {
+            console.log(chalk.gray('Exec environment variables:'));
+            for (const s of execConfig.secrets) {
+                const source = s.literal !== undefined ? 'literal' : s.secret;
+                console.log(`  - ${s.env} = ${source}`);
+            }
+            console.log();
+        }
         console.log(chalk.gray('Starting daemon...'));
         console.log();
         // Start auto-update service if enabled
@@ -101,6 +181,7 @@ Examples:
             await startDaemon({
                 verbose: options.verbose,
                 healthPort: options.healthPort,
+                exec: execConfig,
             });
         }
         catch (err) {

package/dist/commands/start.js.map

@@ -1 +1 @@
-{"version":3,"file":"start.js","sourceRoot":"","sources":["../../src/commands/start.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,wCAAwC;AAGxC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAExF,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,mCAAmC,CAAC;SAChD,MAAM,CAAC,eAAe,EAAE,wBAAwB,CAAC;SACjD,MAAM,CAAC,sBAAsB,EAAE,qDAAqD,EAAE,QAAQ,CAAC;SAC/F,MAAM,CAAC,YAAY,EAAE,wCAAwC,CAAC;SAC9D,MAAM,CAAC,cAAc,EAAE,6BAA6B,CAAC;SACrD,MAAM,CAAC,eAAe,EAAE,8CAA8C,CAAC;SACvE,MAAM,CAAC,kBAAkB,EAAE,2BAA2B,CAAC;SACvD,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;CAmBzB,CAAC;SACG,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,sBAAsB;QACtB,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAE7B,sCAAsC;QACtC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,EAAE,CAAC;YAEd,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC,CAAC;gBACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC,CAAC;YACzE,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,+BAA+B,CAAC,CAAC;YACzF,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;QAED,sCAAsC;QACtC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,OAAO,CAAC;QAClC,CAAC;QAED,uBAAuB;QACvB,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,kBAAkB,OAAO,CAAC,MAAM,iBAAiB,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,YAAY,IAAI,IAAI,GAAG,CAAC,CAAC;QACpE,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,iCAAiC,OAAO,CAAC,UAAU,SAAS,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,CAAC,iCAAiC,OAAO,CAAC,UAAU,UAAU,CAAC,CAAC;QAC7E,CAAC;QAED,qBAAqB;QACrB,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAC;QACxC,MAAM,iBAAiB,GAAG,OAAO,CAAC,UAAU,KAAK,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,kBAAkB,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QACzF,OAAO,CAAC,GAAG,EAAE,CAAC;QAEd,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;YACpD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,EAAE,CAAC;QAEd,uCAAuC;QACvC,IAAI,iBAAiB,GAAgC,IAAI,CAAC;QAC1D,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;YACtD,iBAAiB,GAAG,IAAI,oBAAoB,CAAC,YAAY,CAAC,CAAC;YAC3D,iBAAiB,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC;YACH,MAAM,WAAW,CAAC;gBAChB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;YACtC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"start.js","sourceRoot":"","sources":["../../src/commands/start.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,wCAAwC;AAGxC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,UAAU,EACV,UAAU,EAEV,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAmB,MAAM,sBAAsB,CAAC;AAE3E,uCAAuC;AACvC,SAAS,OAAO,CAAC,KAAa,EAAE,QAAkB;IAChD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,mCAAmC,CAAC;SAChD,MAAM,CAAC,eAAe,EAAE,wBAAwB,CAAC;SACjD,MAAM,CAAC,sBAAsB,EAAE,qDAAqD,EAAE,QAAQ,CAAC;SAC/F,MAAM,CAAC,YAAY,EAAE,wCAAwC,CAAC;SAC9D,MAAM,CAAC,cAAc,EAAE,6BAA6B,CAAC;SACrD,MAAM,CAAC,eAAe,EAAE,8CAA8C,CAAC;SACvE,MAAM,CAAC,kBAAkB,EAAE,2BAA2B,CAAC;QACxD,oBAAoB;SACnB,MAAM,CAAC,kBAAkB,EAAE,iDAAiD,CAAC;SAC7E,MAAM,CAAC,wBAAwB,EAAE,kDAAkD,EAAE,OAAO,EAAE,EAAE,CAAC;SACjG,MAAM,CAAC,qBAAqB,EAAE,sDAAsD,CAAC;SACrF,MAAM,CAAC,wBAAwB,EAAE,6CAA6C,CAAC;SAC/E,MAAM,CAAC,sBAAsB,EAAE,qDAAqD,EAAE,QAAQ,CAAC;SAC/F,MAAM,CAAC,oBAAoB,EAAE,sCAAsC,EAAE,QAAQ,CAAC;SAC9E,MAAM,CAAC,uBAAuB,EAAE,8CAA8C,EAAE,QAAQ,CAAC;SACzF,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BzB,CAAC;SACG,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,sBAAsB;QACtB,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAE7B,oDAAoD;QACpD,IAAI,UAAkC,CAAC;QAEvC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,8BAA8B;YAC9B,MAAM,OAAO,GAAiB,EAAE,CAAC;YAEjC,6BAA6B;YAC7B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,MAAkB,EAAE,CAAC;gBACjD,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;oBAC3C,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;wBACjC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;oBAChE,CAAC;yBAAM,CAAC;wBACN,yDAAyD;wBACzD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG;4BAC1B,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE;4BACpC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;wBACpB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;oBAC1D,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC,CAAC;oBAC7D,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;oBAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,iDAAiD;YACjD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACxC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBAC3B,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAEnB,UAAU,GAAG;gBACX,OAAO;gBACP,OAAO;gBACP,UAAU,EAAE,IAAI,EAAE,yBAAyB;gBAC3C,eAAe,EAAE,OAAO,CAAC,eAAe,KAAK,KAAK;gBAClD,cAAc,EAAE,OAAO,CAAC,YAAY,IAAI,mBAAmB,CAAC,cAAc;gBAC1E,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,mBAAmB,CAAC,WAAW;gBACnE,eAAe,EAAE,OAAO,CAAC,aAAa,IAAI,mBAAmB,CAAC,eAAe;aAC9E,CAAC;QACJ,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YACvB,mCAAmC;YACnC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;QAC3B,CAAC;QAED,sCAAsC;QACtC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,EAAE,CAAC;YAEd,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC,CAAC;gBACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,iCAAiC;QACjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC,CAAC;YACzE,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,+BAA+B,CAAC,CAAC;YACzF,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;QAED,sCAAsC;QACtC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,OAAO,CAAC;QAClC,CAAC;QAED,uBAAuB;QACvB,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,kBAAkB,OAAO,CAAC,MAAM,iBAAiB,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,YAAY,IAAI,IAAI,GAAG,CAAC,CAAC;QACpE,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,iCAAiC,OAAO,CAAC,UAAU,SAAS,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,CAAC,iCAAiC,OAAO,CAAC,UAAU,UAAU,CAAC,CAAC;QAC7E,CAAC;QAED,qBAAqB;QACrB,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAC;QACxC,MAAM,iBAAiB,GAAG,OAAO,CAAC,UAAU,KAAK,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,kBAAkB,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QAEzF,mBAAmB;QACnB,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,CAAC,mBAAmB,UAAU,CAAC,OAAO,CAAC,MAAM,aAAa,CAAC,CAAC;YACvE,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;gBAC/B,OAAO,CAAC,GAAG,CAAC,gDAAgD,UAAU,CAAC,cAAc,KAAK,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;QAEd,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;YACpD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;QAED,IAAI,UAAU,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC;YACvD,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBAC9D,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,EAAE,CAAC;QAEd,uCAAuC;QACvC,IAAI,iBAAiB,GAAgC,IAAI,CAAC;QAC1D,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;YACtD,iBAAiB,GAAG,IAAI,oBAAoB,CAAC,YAAY,CAAC,CAAC;YAC3D,iBAAiB,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC;YACH,MAAM,WAAW,CAAC;gBAChB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,IAAI,EAAE,UAAU;aACjB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;YACtC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/status.d.ts

@@ -1,3 +1,3 @@
-import { Command } from 'commander';
+import type { Command } from 'commander';
 export declare function registerStatusCommand(program: Command): void;
 //# sourceMappingURL=status.d.ts.map

package/dist/commands/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAuF5D"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAuF5D"}

package/dist/commands/sync.d.ts

@@ -1,3 +1,3 @@
-import { Command } from 'commander';
+import type { Command } from 'commander';
 export declare function registerSyncCommand(program: Command): void;
 //# sourceMappingURL=sync.d.ts.map

package/dist/commands/sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/commands/sync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+H1D"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/commands/sync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+H1D"}

package/dist/lib/api.d.ts

@@ -49,6 +49,19 @@ export interface DecryptedSecret {
     version: number;
     data: Record<string, unknown>;
 }
+export interface ManagedApiKeyBindResponse {
+    id: string;
+    key: string;
+    prefix: string;
+    name: string;
+    expiresAt: string;
+    gracePeriod: string;
+    graceExpiresAt?: string;
+    rotationMode: 'scheduled' | 'on-use' | 'on-bind';
+    permissions: string[];
+    nextRotationAt?: string;
+    _notice?: string;
+}
 /**
  * Login and get access token
  */
@@ -100,5 +113,11 @@ export declare function clearToken(): void;
  * Check if we have a valid cached token
  */
 export declare function hasValidToken(): boolean;
+/**
+ * Bind to a managed API key and get the current key value
+ * @param name - Managed API key name (e.g., "my-api-key")
+ * @returns The current API key value
+ */
+export declare function bindManagedApiKey(name: string): Promise<ManagedApiKeyBindResponse>;
 export {};
 //# sourceMappingURL=api.d.ts.map

package/dist/lib/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAyBA,UAAU,aAAa;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;IACvC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;IACvC,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AA8MD;;GAEG;AACH,wBAAsB,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAmBtF;AAED;;GAEG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC;IAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAMjG;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAMjF;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAOvG;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAalG;AAED;;GAEG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC;IAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CASvF;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAqB1E;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAiBjF;AAED;;GAEG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAcpD;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,IAAI,CAIjC;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAEvC"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAyBA,UAAU,aAAa;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;IACvC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;IACvC,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;IACjD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA8MD;;GAEG;AACH,wBAAsB,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAmBtF;AAED;;GAEG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC;IAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAMjG;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAMjF;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAOvG;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAalG;AAED;;GAEG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC;IAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CASvF;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAqB1E;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAiBjF;AAED;;GAEG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAcpD;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,IAAI,CAIjC;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAQxF"}