browse 0.10.0 → 0.11.0

package/dist/commands/cloud/secrets/create.js

@@ -0,0 +1,33 @@
+import { Args } from "@oclif/core";
+import { BrowseCommand } from "../../../base.js";
+import { apiCommonFlags, toApiOptions } from "../../../lib/cloud/flags.js";
+import { createSecret } from "../../../lib/secrets/api.js";
+import { readSecretValue } from "../../../lib/secrets/input.js";
+import { secretInputFlags } from "../../../lib/secrets/flags.js";
+import { outputJson } from "../../../lib/output.js";
+export default class SecretsCreate extends BrowseCommand {
+    static description = "Create a project secret. Encrypts the value locally with the project public key.";
+    static examples = [
+        "browse cloud secrets create SERVICE_TOKEN",
+        "browse cloud secrets create SERVICE_TOKEN --env MY_SERVICE_TOKEN",
+        "browse cloud secrets create SERVICE_TOKEN --stdin < ./secret.txt",
+    ];
+    static args = {
+        key: Args.string({
+            description: "Name exposed in the function context.secrets object.",
+            required: true,
+        }),
+    };
+    static flags = { ...apiCommonFlags, ...secretInputFlags };
+    async run() {
+        const { args, flags } = await this.parse(SecretsCreate);
+        const options = toApiOptions(flags);
+        const value = await readSecretValue({ stdin: flags.stdin, env: flags.env });
+        try {
+            outputJson(await createSecret(options, args.key, value));
+        }
+        finally {
+            value.fill(0);
+        }
+    }
+}

package/dist/commands/cloud/secrets/delete.js

@@ -0,0 +1,23 @@
+import { Args } from "@oclif/core";
+import { BrowseCommand } from "../../../base.js";
+import { apiCommonFlags, toApiOptions } from "../../../lib/cloud/flags.js";
+import { deleteSecret } from "../../../lib/secrets/api.js";
+export default class SecretsDelete extends BrowseCommand {
+    static description = "Delete a project secret.";
+    static examples = [
+        "browse cloud secrets delete <secretId>",
+        "browse cloud secrets delete d2c4f48f-38e9-4b82-a36a-2b373fd14a65",
+    ];
+    static args = {
+        secretId: Args.string({
+            description: "Project secret ID (e.g. d2c4f48f-38e9-4b82-a36a-2b373fd14a65).",
+            required: true,
+        }),
+    };
+    static flags = { ...apiCommonFlags };
+    async run() {
+        const { args, flags } = await this.parse(SecretsDelete);
+        const options = toApiOptions(flags);
+        await deleteSecret(options, args.secretId);
+    }
+}

package/dist/commands/cloud/secrets/get.js

@@ -0,0 +1,24 @@
+import { Args } from "@oclif/core";
+import { BrowseCommand } from "../../../base.js";
+import { apiCommonFlags, toApiOptions } from "../../../lib/cloud/flags.js";
+import { getSecret } from "../../../lib/secrets/api.js";
+import { outputJson } from "../../../lib/output.js";
+export default class SecretsGet extends BrowseCommand {
+    static description = "Get project secret metadata. Does not return the secret value.";
+    static examples = [
+        "browse cloud secrets get <secretId>",
+        "browse cloud secrets get d2c4f48f-38e9-4b82-a36a-2b373fd14a65",
+    ];
+    static args = {
+        secretId: Args.string({
+            description: "Project secret ID (e.g. d2c4f48f-38e9-4b82-a36a-2b373fd14a65).",
+            required: true,
+        }),
+    };
+    static flags = { ...apiCommonFlags };
+    async run() {
+        const { args, flags } = await this.parse(SecretsGet);
+        const options = toApiOptions(flags);
+        outputJson(await getSecret(options, args.secretId));
+    }
+}

package/dist/commands/cloud/secrets/list.js

@@ -0,0 +1,20 @@
+import { BrowseCommand } from "../../../base.js";
+import { apiCommonFlags, toApiOptions } from "../../../lib/cloud/flags.js";
+import { listSecrets } from "../../../lib/secrets/api.js";
+import { listSecretsFlags, toListSecretsOptions, } from "../../../lib/secrets/flags.js";
+import { outputJson } from "../../../lib/output.js";
+export default class SecretsList extends BrowseCommand {
+    static description = "List project secret metadata with cursor pagination.";
+    static examples = [
+        "browse cloud secrets list",
+        "browse cloud secrets list --start-at 2026-01-01T00:00:00Z",
+        "browse cloud secrets list --start-at 2026-01-01T00:00:00Z --end-at 2026-02-01T00:00:00Z",
+        "browse cloud secrets list --limit 10",
+    ];
+    static flags = { ...apiCommonFlags, ...listSecretsFlags };
+    async run() {
+        const { flags } = await this.parse(SecretsList);
+        const options = toApiOptions(flags);
+        outputJson(await listSecrets(options, toListSecretsOptions(flags)));
+    }
+}

package/dist/commands/cloud/secrets/update.js

@@ -0,0 +1,34 @@
+import { Args } from "@oclif/core";
+import { BrowseCommand } from "../../../base.js";
+import { apiCommonFlags, toApiOptions } from "../../../lib/cloud/flags.js";
+import { updateSecret } from "../../../lib/secrets/api.js";
+import { readSecretValue } from "../../../lib/secrets/input.js";
+import { secretInputFlags } from "../../../lib/secrets/flags.js";
+import { outputJson } from "../../../lib/output.js";
+export default class SecretsUpdate extends BrowseCommand {
+    static description = "Replace a secret value, encrypting it locally with the current project public key.";
+    static examples = [
+        "browse cloud secrets update <secretId>",
+        "browse cloud secrets update d2c4f48f-38e9-4b82-a36a-2b373fd14a65",
+        "browse cloud secrets update <secretId> --env MY_SERVICE_TOKEN",
+        "browse cloud secrets update <secretId> --stdin < ./secret.txt",
+    ];
+    static args = {
+        secretId: Args.string({
+            description: "Project secret ID (e.g. d2c4f48f-38e9-4b82-a36a-2b373fd14a65).",
+            required: true,
+        }),
+    };
+    static flags = { ...apiCommonFlags, ...secretInputFlags };
+    async run() {
+        const { args, flags } = await this.parse(SecretsUpdate);
+        const options = toApiOptions(flags);
+        const value = await readSecretValue({ stdin: flags.stdin, env: flags.env });
+        try {
+            outputJson(await updateSecret(options, args.secretId, value));
+        }
+        finally {
+            value.fill(0);
+        }
+    }
+}

package/dist/commands/functions/secrets/attach.js

@@ -0,0 +1,27 @@
+import { Args } from "@oclif/core";
+import { BrowseCommand } from "../../../base.js";
+import { apiCommonFlags, toApiOptions } from "../../../lib/cloud/flags.js";
+import { attachFunctionSecret } from "../../../lib/secrets/api.js";
+export default class FunctionSecretsAttach extends BrowseCommand {
+    static description = "Attach an existing project secret to a function.";
+    static examples = [
+        "browse functions secrets attach <functionId> <secretId>",
+        "browse functions secrets attach 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041 d2c4f48f-38e9-4b82-a36a-2b373fd14a65",
+    ];
+    static args = {
+        functionId: Args.string({
+            description: "Function ID (e.g. 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041).",
+            required: true,
+        }),
+        secretId: Args.string({
+            description: "Project secret ID (e.g. d2c4f48f-38e9-4b82-a36a-2b373fd14a65).",
+            required: true,
+        }),
+    };
+    static flags = { ...apiCommonFlags };
+    async run() {
+        const { args, flags } = await this.parse(FunctionSecretsAttach);
+        const options = toApiOptions(flags);
+        await attachFunctionSecret(options, args.functionId, args.secretId);
+    }
+}

package/dist/commands/functions/secrets/detach.js

@@ -0,0 +1,27 @@
+import { Args } from "@oclif/core";
+import { BrowseCommand } from "../../../base.js";
+import { apiCommonFlags, toApiOptions } from "../../../lib/cloud/flags.js";
+import { detachFunctionSecret } from "../../../lib/secrets/api.js";
+export default class FunctionSecretsDetach extends BrowseCommand {
+    static description = "Detach a secret from a function without deleting the secret.";
+    static examples = [
+        "browse functions secrets detach <functionId> <secretId>",
+        "browse functions secrets detach 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041 d2c4f48f-38e9-4b82-a36a-2b373fd14a65",
+    ];
+    static args = {
+        functionId: Args.string({
+            description: "Function ID (e.g. 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041).",
+            required: true,
+        }),
+        secretId: Args.string({
+            description: "Project secret ID (e.g. d2c4f48f-38e9-4b82-a36a-2b373fd14a65).",
+            required: true,
+        }),
+    };
+    static flags = { ...apiCommonFlags };
+    async run() {
+        const { args, flags } = await this.parse(FunctionSecretsDetach);
+        const options = toApiOptions(flags);
+        await detachFunctionSecret(options, args.functionId, args.secretId);
+    }
+}

package/dist/commands/functions/secrets/list.js

@@ -0,0 +1,28 @@
+import { Args } from "@oclif/core";
+import { BrowseCommand } from "../../../base.js";
+import { apiCommonFlags, toApiOptions } from "../../../lib/cloud/flags.js";
+import { listFunctionSecrets } from "../../../lib/secrets/api.js";
+import { listSecretsFlags, toListSecretsOptions, } from "../../../lib/secrets/flags.js";
+import { outputJson } from "../../../lib/output.js";
+export default class FunctionSecretsList extends BrowseCommand {
+    static description = "List metadata for secrets attached to a function with cursor pagination.";
+    static examples = [
+        "browse functions secrets list <functionId>",
+        "browse functions secrets list 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041",
+        "browse functions secrets list <functionId> --start-at 2026-01-01T00:00:00Z",
+        "browse functions secrets list <functionId> --start-at 2026-01-01T00:00:00Z --end-at 2026-02-01T00:00:00Z",
+        "browse functions secrets list <functionId> --limit 10",
+    ];
+    static args = {
+        functionId: Args.string({
+            description: "Function ID (e.g. 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041).",
+            required: true,
+        }),
+    };
+    static flags = { ...apiCommonFlags, ...listSecretsFlags };
+    async run() {
+        const { args, flags } = await this.parse(FunctionSecretsList);
+        const options = toApiOptions(flags);
+        outputJson(await listFunctionSecrets(options, args.functionId, toListSecretsOptions(flags)));
+    }
+}

package/dist/lib/cloud/api.js

@@ -328,6 +328,9 @@ function resolveCommandFromPathname(pathname) {
     if (pathname.startsWith("/v1/extensions")) {
         return "extensions";
     }
+    if (pathname.startsWith("/v1/secrets")) {
+        return "secrets";
+    }
     if (pathname.startsWith("/v1/functions")) {
         return "functions";
     }

package/dist/lib/secrets/api.js

@@ -0,0 +1,60 @@
+import { sealSecret } from "./seal.js";
+import { requestBrowserbase, requestBrowserbaseJson } from "../cloud/api.js";
+export function listSecrets(options, query) {
+    return requestBrowserbaseJson(options, withQuery("/v1/secrets", query));
+}
+function withQuery(path, query) {
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(query)) {
+        if (value !== undefined)
+            params.set(key, String(value));
+    }
+    const search = params.toString();
+    return search ? `${path}?${search}` : path;
+}
+export function getSecret(options, secretId) {
+    return requestBrowserbaseJson(options, secretPath(secretId));
+}
+export async function deleteSecret(options, secretId) {
+    await requestBrowserbase(options, secretPath(secretId), { method: "DELETE" });
+}
+function secretPath(id) {
+    return `/v1/secrets/${encodeURIComponent(id)}`;
+}
+export async function createSecret(options, secretKey, value) {
+    const sealed = await encryptValue(options, value);
+    return requestBrowserbaseJson(options, "/v1/secrets", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+            secretKey,
+            ...sealed,
+        }),
+    });
+}
+export async function updateSecret(options, secretId, value) {
+    const sealed = await encryptValue(options, value);
+    return requestBrowserbaseJson(options, secretPath(secretId), {
+        method: "PATCH",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(sealed),
+    });
+}
+async function encryptValue(options, value) {
+    const keypair = await requestBrowserbaseJson(options, "/v1/secrets/keypair");
+    const sealedSecretValue = await sealSecret(keypair.publicKey, value);
+    return { keypairId: keypair.id, sealedSecretValue };
+}
+export async function attachFunctionSecret(options, functionId, secretId) {
+    await requestBrowserbase(options, `/v1/functions/${encodeURIComponent(functionId)}/secrets`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ secretId }),
+    });
+}
+export async function detachFunctionSecret(options, functionId, secretId) {
+    await requestBrowserbase(options, `/v1/functions/${encodeURIComponent(functionId)}/secrets/${encodeURIComponent(secretId)}`, { method: "DELETE" });
+}
+export function listFunctionSecrets(options, functionId, query) {
+    return requestBrowserbaseJson(options, withQuery(`/v1/functions/${encodeURIComponent(functionId)}/secrets`, query));
+}

package/dist/lib/secrets/flags.js

@@ -0,0 +1,36 @@
+import { Flags } from "@oclif/core";
+export const listSecretsFlags = {
+    limit: Flags.integer({
+        min: 1,
+        max: 1000,
+        description: "Maximum results per page (API default: 20).",
+    }),
+    cursor: Flags.string({
+        description: "nextCursor from the previous page. Keep the same filters.",
+    }),
+    "start-at": Flags.string({
+        description: "Include secrets created on or after this RFC 3339 timestamp.",
+    }),
+    "end-at": Flags.string({
+        description: "Include secrets created on or before this RFC 3339 timestamp.",
+    }),
+};
+export function toListSecretsOptions(flags) {
+    return {
+        limit: flags.limit,
+        cursor: flags.cursor,
+        startAt: flags["start-at"],
+        endAt: flags["end-at"],
+    };
+}
+export const secretInputFlags = {
+    env: Flags.string({
+        description: "Read the secret value from the named environment variable.",
+        helpValue: "VARIABLE_NAME",
+        exclusive: ["stdin"],
+    }),
+    stdin: Flags.boolean({
+        description: "Read the exact secret value from stdin, preserving whitespace.",
+        exclusive: ["env"],
+    }),
+};

package/dist/lib/secrets/input.js

@@ -0,0 +1,33 @@
+import password from "@inquirer/password";
+import { fail } from "../errors.js";
+export async function readSecretValue(options) {
+    if (options.env !== undefined) {
+        if (options.stdin)
+            fail("--env and --stdin cannot be used together.");
+        if (!options.env)
+            fail("--env requires an environment variable name.");
+        const value = Object.prototype.hasOwnProperty.call(process.env, options.env)
+            ? process.env[options.env]
+            : undefined;
+        if (value === undefined)
+            fail("The environment variable selected by --env is not set.");
+        return Buffer.from(value, "utf8");
+    }
+    if (options.stdin) {
+        if (process.stdin.isTTY)
+            fail("--stdin requires piped input or file redirection.");
+        const chunks = [];
+        for await (const chunk of process.stdin) {
+            chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+        }
+        return Buffer.concat(chunks);
+    }
+    if (!process.stdin.isTTY)
+        fail("Use --stdin for piped input or --env to read an environment variable.");
+    try {
+        return Buffer.from(await password({ message: "Secret value:" }, { output: process.stderr }), "utf8");
+    }
+    catch {
+        fail("Secret input cancelled.");
+    }
+}

package/dist/lib/secrets/seal.js

@@ -0,0 +1,30 @@
+import { Aes256Gcm, CipherSuite, HkdfSha256 } from "@hpke/core";
+import { DhkemX25519HkdfSha256 } from "@hpke/dhkem-x25519";
+import { fail } from "../errors.js";
+export async function sealSecret(publicKey, value) {
+    if (typeof publicKey !== "string") {
+        fail("The secrets API returned an invalid X25519 public key.");
+    }
+    const rawKey = Buffer.from(publicKey, "base64");
+    if (rawKey.length !== 32 || rawKey.toString("base64") !== publicKey) {
+        fail("The secrets API returned an invalid X25519 public key.");
+    }
+    const suite = new CipherSuite({
+        kem: new DhkemX25519HkdfSha256(),
+        kdf: new HkdfSha256(),
+        aead: new Aes256Gcm(),
+    });
+    try {
+        const recipientPublicKey = await suite.kem.deserializePublicKey(new Uint8Array(rawKey).buffer);
+        const sender = await suite.createSenderContext({ recipientPublicKey });
+        const ciphertext = await sender.seal(new Uint8Array(value).buffer);
+        // Go's crypto/hpke.Open expects the encapsulated key followed by ciphertext.
+        return Buffer.concat([
+            Buffer.from(sender.enc),
+            Buffer.from(ciphertext),
+        ]).toString("base64");
+    }
+    catch {
+        fail("Failed to encrypt the secret with the project's public key.");
+    }
+}

package/dist/lib/templates/api.js

@@ -107,6 +107,7 @@ function parseTemplate(payload, context) {
         description: optionalString(payload.description, context, "description"),
         descriptionTitle: optionalString(payload.descriptionTitle, context, "descriptionTitle"),
         source: optionalString(payload.source, context, "source"),
+        sourcePath: optionalString(payload.sourcePath, context, "sourcePath"),
         category: optionalStringArray(payload.category, context, "category"),
         tags: optionalStringArray(payload.tags, context, "tags"),
         commands: optionalStringArray(payload.commands, context, "commands"),

package/dist/lib/templates/scaffold.js

@@ -28,18 +28,15 @@ export async function cloneTemplate(options) {
     const parentDir = dirname(dest);
     const projectName = basename(dest);
     const scaffolder = getScaffolder(language);
+    // create-browser-app identifies a template by its final source directory.
+    const scaffolderTemplate = basename(options.template.sourcePath || options.template.slug);
     await mkdir(parentDir, { recursive: true });
     const existingEntries = await getDirectoryEntryNames(parentDir);
     if (!options.quiet) {
         console.log(`Scaffolding ${language}/${options.template.slug} into ${dest}...`);
     }
     try {
-        runCommand(scaffolder.command, [
-            ...scaffolder.argsPrefix,
-            projectName,
-            "--template",
-            options.template.slug,
-        ], parentDir);
+        runCommand(scaffolder.command, [...scaffolder.argsPrefix, projectName, "--template", scaffolderTemplate], parentDir);
         const createdDir = await findCreatedProjectDir(parentDir, existingEntries, projectName);
         if (!createdDir) {
             throw new Error(`Scaffolder did not create a project directory in ${parentDir}.`);
@@ -151,22 +148,23 @@ async function findCreatedProjectDir(parentDir, existingEntries, requestedName)
     }
     return null;
 }
-async function buildNextSteps(dest, displayPath, language) {
+export async function buildNextSteps(dest, displayPath, language) {
     const nextSteps = [`cd ${displayPath}`];
     if (language === "typescript") {
-        if (existsSync(join(dest, "package.json"))) {
-            nextSteps.push("npm install");
+        const packageJson = await readPackageJson(dest);
+        const packageManager = resolvePackageManager(packageJson?.packageManager);
+        if (packageJson) {
+            nextSteps.push(`${packageManager} install`);
         }
         if (existsSync(join(dest, ".env.example"))) {
             nextSteps.push("cp .env.example .env");
         }
-        const packageJson = await readPackageJson(dest);
         if (packageJson?.scripts?.dev) {
-            nextSteps.push("npm run dev");
+            nextSteps.push(runPackageScript(packageManager, "dev"));
             return nextSteps;
         }
         if (packageJson?.scripts?.start) {
-            nextSteps.push("npm start");
+            nextSteps.push(runPackageScript(packageManager, "start"));
             return nextSteps;
         }
         if (existsSync(join(dest, "index.ts"))) {
@@ -174,17 +172,19 @@ async function buildNextSteps(dest, displayPath, language) {
         }
         return nextSteps;
     }
-    if (existsSync(join(dest, "pyproject.toml"))) {
+    const hasPyproject = existsSync(join(dest, "pyproject.toml"));
+    const hasRequirements = existsSync(join(dest, "requirements.txt"));
+    if (hasPyproject) {
         nextSteps.push("uv sync");
     }
-    else if (existsSync(join(dest, "requirements.txt"))) {
-        nextSteps.push("pip install -r requirements.txt");
+    else if (hasRequirements) {
+        nextSteps.push("uv venv && uv pip install -r requirements.txt");
     }
     if (existsSync(join(dest, ".env.example"))) {
         nextSteps.push("cp .env.example .env");
     }
     if (existsSync(join(dest, "main.py"))) {
-        nextSteps.push("python main.py");
+        nextSteps.push("uv run python main.py");
     }
     return nextSteps;
 }
@@ -201,3 +201,16 @@ async function readPackageJson(dest) {
         return null;
     }
 }
+function resolvePackageManager(packageManager) {
+    const name = packageManager?.split("@")[0];
+    if (name === "bun" || name === "pnpm" || name === "yarn") {
+        return name;
+    }
+    return "npm";
+}
+function runPackageScript(packageManager, script) {
+    if (packageManager === "npm" || packageManager === "bun") {
+        return `${packageManager} run ${script}`;
+    }
+    return `${packageManager} ${script}`;
+}

package/oclif.manifest.json

@@ -5502,6 +5502,166 @@
         "update.js"
       ]
     },
+    "cloud:projects:get": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Project ID.",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Get a project by ID.",
+      "examples": [
+        "browse cloud projects get <project-id>"
+      ],
+      "flags": {
+        "api-key": {
+          "description": "Override the Browserbase API key.",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "helpValue": "<apiKey>",
+          "multiple": false,
+          "type": "option"
+        },
+        "base-url": {
+          "description": "Override the Browserbase API base URL.",
+          "name": "base-url",
+          "hasDynamicHelp": false,
+          "helpValue": "<baseUrl>",
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "cloud:projects:get",
+      "pluginAlias": "browse",
+      "pluginName": "browse",
+      "pluginType": "core",
+      "strict": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "cloud",
+        "projects",
+        "get.js"
+      ]
+    },
+    "cloud:projects:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List projects visible to the current API key.",
+      "examples": [
+        "browse cloud projects list",
+        "browse cloud projects list --json"
+      ],
+      "flags": {
+        "api-key": {
+          "description": "Override the Browserbase API key.",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "helpValue": "<apiKey>",
+          "multiple": false,
+          "type": "option"
+        },
+        "base-url": {
+          "description": "Override the Browserbase API base URL.",
+          "name": "base-url",
+          "hasDynamicHelp": false,
+          "helpValue": "<baseUrl>",
+          "multiple": false,
+          "type": "option"
+        },
+        "format": {
+          "description": "Output format. Defaults to table in a terminal and JSON when piped.",
+          "name": "format",
+          "hasDynamicHelp": false,
+          "helpValue": "<format>",
+          "multiple": false,
+          "options": [
+            "table",
+            "json"
+          ],
+          "type": "option"
+        },
+        "json": {
+          "description": "Print raw JSON output.",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "wide": {
+          "description": "Show full table values without truncation.",
+          "name": "wide",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "cloud:projects:list",
+      "pluginAlias": "browse",
+      "pluginName": "browse",
+      "pluginType": "core",
+      "strict": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "cloud",
+        "projects",
+        "list.js"
+      ]
+    },
+    "cloud:projects:usage": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Project ID.",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Get project usage.",
+      "examples": [
+        "browse cloud projects usage <project-id>"
+      ],
+      "flags": {
+        "api-key": {
+          "description": "Override the Browserbase API key.",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "helpValue": "<apiKey>",
+          "multiple": false,
+          "type": "option"
+        },
+        "base-url": {
+          "description": "Override the Browserbase API base URL.",
+          "name": "base-url",
+          "hasDynamicHelp": false,
+          "helpValue": "<baseUrl>",
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "cloud:projects:usage",
+      "pluginAlias": "browse",
+      "pluginName": "browse",
+      "pluginType": "core",
+      "strict": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "cloud",
+        "projects",
+        "usage.js"
+      ]
+    },
     "cloud:extensions:delete": {
       "aliases": [],
       "args": {
@@ -5643,18 +5803,88 @@
         "upload.js"
       ]
     },
-    "cloud:projects:get": {
+    "cloud:secrets:create": {
       "aliases": [],
       "args": {
-        "id": {
-          "description": "Project ID.",
-          "name": "id",
+        "key": {
+          "description": "Name exposed in the function context.secrets object.",
+          "name": "key",
           "required": true
         }
       },
-      "description": "Get a project by ID.",
+      "description": "Create a project secret. Encrypts the value locally with the project public key.",
       "examples": [
-        "browse cloud projects get <project-id>"
+        "browse cloud secrets create SERVICE_TOKEN",
+        "browse cloud secrets create SERVICE_TOKEN --env MY_SERVICE_TOKEN",
+        "browse cloud secrets create SERVICE_TOKEN --stdin < ./secret.txt"
+      ],
+      "flags": {
+        "api-key": {
+          "description": "Override the Browserbase API key.",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "helpValue": "<apiKey>",
+          "multiple": false,
+          "type": "option"
+        },
+        "base-url": {
+          "description": "Override the Browserbase API base URL.",
+          "name": "base-url",
+          "hasDynamicHelp": false,
+          "helpValue": "<baseUrl>",
+          "multiple": false,
+          "type": "option"
+        },
+        "env": {
+          "description": "Read the secret value from the named environment variable.",
+          "exclusive": [
+            "stdin"
+          ],
+          "name": "env",
+          "hasDynamicHelp": false,
+          "helpValue": "VARIABLE_NAME",
+          "multiple": false,
+          "type": "option"
+        },
+        "stdin": {
+          "description": "Read the exact secret value from stdin, preserving whitespace.",
+          "exclusive": [
+            "env"
+          ],
+          "name": "stdin",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "cloud:secrets:create",
+      "pluginAlias": "browse",
+      "pluginName": "browse",
+      "pluginType": "core",
+      "strict": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "cloud",
+        "secrets",
+        "create.js"
+      ]
+    },
+    "cloud:secrets:delete": {
+      "aliases": [],
+      "args": {
+        "secretId": {
+          "description": "Project secret ID (e.g. d2c4f48f-38e9-4b82-a36a-2b373fd14a65).",
+          "name": "secretId",
+          "required": true
+        }
+      },
+      "description": "Delete a project secret.",
+      "examples": [
+        "browse cloud secrets delete <secretId>",
+        "browse cloud secrets delete d2c4f48f-38e9-4b82-a36a-2b373fd14a65"
       ],
       "flags": {
         "api-key": {
@@ -5676,7 +5906,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "cloud:projects:get",
+      "id": "cloud:secrets:delete",
       "pluginAlias": "browse",
       "pluginName": "browse",
       "pluginType": "core",
@@ -5686,17 +5916,67 @@
         "dist",
         "commands",
         "cloud",
-        "projects",
+        "secrets",
+        "delete.js"
+      ]
+    },
+    "cloud:secrets:get": {
+      "aliases": [],
+      "args": {
+        "secretId": {
+          "description": "Project secret ID (e.g. d2c4f48f-38e9-4b82-a36a-2b373fd14a65).",
+          "name": "secretId",
+          "required": true
+        }
+      },
+      "description": "Get project secret metadata. Does not return the secret value.",
+      "examples": [
+        "browse cloud secrets get <secretId>",
+        "browse cloud secrets get d2c4f48f-38e9-4b82-a36a-2b373fd14a65"
+      ],
+      "flags": {
+        "api-key": {
+          "description": "Override the Browserbase API key.",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "helpValue": "<apiKey>",
+          "multiple": false,
+          "type": "option"
+        },
+        "base-url": {
+          "description": "Override the Browserbase API base URL.",
+          "name": "base-url",
+          "hasDynamicHelp": false,
+          "helpValue": "<baseUrl>",
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "cloud:secrets:get",
+      "pluginAlias": "browse",
+      "pluginName": "browse",
+      "pluginType": "core",
+      "strict": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "cloud",
+        "secrets",
         "get.js"
       ]
     },
-    "cloud:projects:list": {
+    "cloud:secrets:list": {
       "aliases": [],
       "args": {},
-      "description": "List projects visible to the current API key.",
+      "description": "List project secret metadata with cursor pagination.",
       "examples": [
-        "browse cloud projects list",
-        "browse cloud projects list --json"
+        "browse cloud secrets list",
+        "browse cloud secrets list --start-at 2026-01-01T00:00:00Z",
+        "browse cloud secrets list --start-at 2026-01-01T00:00:00Z --end-at 2026-02-01T00:00:00Z",
+        "browse cloud secrets list --limit 10"
       ],
       "flags": {
         "api-key": {
@@ -5715,34 +5995,38 @@
           "multiple": false,
           "type": "option"
         },
-        "format": {
-          "description": "Output format. Defaults to table in a terminal and JSON when piped.",
-          "name": "format",
+        "limit": {
+          "description": "Maximum results per page (API default: 20).",
+          "name": "limit",
           "hasDynamicHelp": false,
-          "helpValue": "<format>",
           "multiple": false,
-          "options": [
-            "table",
-            "json"
-          ],
           "type": "option"
         },
-        "json": {
-          "description": "Print raw JSON output.",
-          "name": "json",
-          "allowNo": false,
-          "type": "boolean"
+        "cursor": {
+          "description": "nextCursor from the previous page. Keep the same filters.",
+          "name": "cursor",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         },
-        "wide": {
-          "description": "Show full table values without truncation.",
-          "name": "wide",
-          "allowNo": false,
-          "type": "boolean"
+        "start-at": {
+          "description": "Include secrets created on or after this RFC 3339 timestamp.",
+          "name": "start-at",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "end-at": {
+          "description": "Include secrets created on or before this RFC 3339 timestamp.",
+          "name": "end-at",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "cloud:projects:list",
+      "id": "cloud:secrets:list",
       "pluginAlias": "browse",
       "pluginName": "browse",
       "pluginType": "core",
@@ -5752,22 +6036,25 @@
         "dist",
         "commands",
         "cloud",
-        "projects",
+        "secrets",
         "list.js"
       ]
     },
-    "cloud:projects:usage": {
+    "cloud:secrets:update": {
       "aliases": [],
       "args": {
-        "id": {
-          "description": "Project ID.",
-          "name": "id",
+        "secretId": {
+          "description": "Project secret ID (e.g. d2c4f48f-38e9-4b82-a36a-2b373fd14a65).",
+          "name": "secretId",
           "required": true
         }
       },
-      "description": "Get project usage.",
+      "description": "Replace a secret value, encrypting it locally with the current project public key.",
       "examples": [
-        "browse cloud projects usage <project-id>"
+        "browse cloud secrets update <secretId>",
+        "browse cloud secrets update d2c4f48f-38e9-4b82-a36a-2b373fd14a65",
+        "browse cloud secrets update <secretId> --env MY_SERVICE_TOKEN",
+        "browse cloud secrets update <secretId> --stdin < ./secret.txt"
       ],
       "flags": {
         "api-key": {
@@ -5785,11 +6072,31 @@
           "helpValue": "<baseUrl>",
           "multiple": false,
           "type": "option"
+        },
+        "env": {
+          "description": "Read the secret value from the named environment variable.",
+          "exclusive": [
+            "stdin"
+          ],
+          "name": "env",
+          "hasDynamicHelp": false,
+          "helpValue": "VARIABLE_NAME",
+          "multiple": false,
+          "type": "option"
+        },
+        "stdin": {
+          "description": "Read the exact secret value from stdin, preserving whitespace.",
+          "exclusive": [
+            "env"
+          ],
+          "name": "stdin",
+          "allowNo": false,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "cloud:projects:usage",
+      "id": "cloud:secrets:update",
       "pluginAlias": "browse",
       "pluginName": "browse",
       "pluginType": "core",
@@ -5799,8 +6106,8 @@
         "dist",
         "commands",
         "cloud",
-        "projects",
-        "usage.js"
+        "secrets",
+        "update.js"
       ]
     },
     "cloud:sessions:create": {
@@ -6300,6 +6607,191 @@
         "update.js"
       ]
     },
+    "functions:secrets:attach": {
+      "aliases": [],
+      "args": {
+        "functionId": {
+          "description": "Function ID (e.g. 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041).",
+          "name": "functionId",
+          "required": true
+        },
+        "secretId": {
+          "description": "Project secret ID (e.g. d2c4f48f-38e9-4b82-a36a-2b373fd14a65).",
+          "name": "secretId",
+          "required": true
+        }
+      },
+      "description": "Attach an existing project secret to a function.",
+      "examples": [
+        "browse functions secrets attach <functionId> <secretId>",
+        "browse functions secrets attach 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041 d2c4f48f-38e9-4b82-a36a-2b373fd14a65"
+      ],
+      "flags": {
+        "api-key": {
+          "description": "Override the Browserbase API key.",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "helpValue": "<apiKey>",
+          "multiple": false,
+          "type": "option"
+        },
+        "base-url": {
+          "description": "Override the Browserbase API base URL.",
+          "name": "base-url",
+          "hasDynamicHelp": false,
+          "helpValue": "<baseUrl>",
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "functions:secrets:attach",
+      "pluginAlias": "browse",
+      "pluginName": "browse",
+      "pluginType": "core",
+      "strict": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "functions",
+        "secrets",
+        "attach.js"
+      ]
+    },
+    "functions:secrets:detach": {
+      "aliases": [],
+      "args": {
+        "functionId": {
+          "description": "Function ID (e.g. 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041).",
+          "name": "functionId",
+          "required": true
+        },
+        "secretId": {
+          "description": "Project secret ID (e.g. d2c4f48f-38e9-4b82-a36a-2b373fd14a65).",
+          "name": "secretId",
+          "required": true
+        }
+      },
+      "description": "Detach a secret from a function without deleting the secret.",
+      "examples": [
+        "browse functions secrets detach <functionId> <secretId>",
+        "browse functions secrets detach 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041 d2c4f48f-38e9-4b82-a36a-2b373fd14a65"
+      ],
+      "flags": {
+        "api-key": {
+          "description": "Override the Browserbase API key.",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "helpValue": "<apiKey>",
+          "multiple": false,
+          "type": "option"
+        },
+        "base-url": {
+          "description": "Override the Browserbase API base URL.",
+          "name": "base-url",
+          "hasDynamicHelp": false,
+          "helpValue": "<baseUrl>",
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "functions:secrets:detach",
+      "pluginAlias": "browse",
+      "pluginName": "browse",
+      "pluginType": "core",
+      "strict": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "functions",
+        "secrets",
+        "detach.js"
+      ]
+    },
+    "functions:secrets:list": {
+      "aliases": [],
+      "args": {
+        "functionId": {
+          "description": "Function ID (e.g. 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041).",
+          "name": "functionId",
+          "required": true
+        }
+      },
+      "description": "List metadata for secrets attached to a function with cursor pagination.",
+      "examples": [
+        "browse functions secrets list <functionId>",
+        "browse functions secrets list 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041",
+        "browse functions secrets list <functionId> --start-at 2026-01-01T00:00:00Z",
+        "browse functions secrets list <functionId> --start-at 2026-01-01T00:00:00Z --end-at 2026-02-01T00:00:00Z",
+        "browse functions secrets list <functionId> --limit 10"
+      ],
+      "flags": {
+        "api-key": {
+          "description": "Override the Browserbase API key.",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "helpValue": "<apiKey>",
+          "multiple": false,
+          "type": "option"
+        },
+        "base-url": {
+          "description": "Override the Browserbase API base URL.",
+          "name": "base-url",
+          "hasDynamicHelp": false,
+          "helpValue": "<baseUrl>",
+          "multiple": false,
+          "type": "option"
+        },
+        "limit": {
+          "description": "Maximum results per page (API default: 20).",
+          "name": "limit",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "cursor": {
+          "description": "nextCursor from the previous page. Keep the same filters.",
+          "name": "cursor",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "start-at": {
+          "description": "Include secrets created on or after this RFC 3339 timestamp.",
+          "name": "start-at",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "end-at": {
+          "description": "Include secrets created on or before this RFC 3339 timestamp.",
+          "name": "end-at",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "functions:secrets:list",
+      "pluginAlias": "browse",
+      "pluginName": "browse",
+      "pluginType": "core",
+      "strict": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "functions",
+        "secrets",
+        "list.js"
+      ]
+    },
     "cloud:sessions:downloads:get": {
       "aliases": [],
       "args": {
@@ -6411,5 +6903,5 @@
       ]
     }
   },
-  "version": "0.10.0"
+  "version": "0.11.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "browse",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Unified Browserbase CLI for browser automation and cloud APIs.",
   "type": "module",
   "private": false,
@@ -36,6 +36,9 @@
       "cloud": {
         "description": "Manage Browserbase cloud resources and APIs."
       },
+      "cloud:secrets": {
+        "description": "Create, list, retrieve, update, and delete project secrets."
+      },
       "cloud:projects": {
         "description": "Manage Browserbase projects."
       },
@@ -54,6 +57,9 @@
       "cloud:sessions:uploads": {
         "description": "Upload files to Browserbase sessions."
       },
+      "functions:secrets": {
+        "description": "List, attach, and detach project secrets for functions."
+      },
       "functions": {
         "description": "Develop, publish, and invoke Browserbase Functions."
       },
@@ -88,6 +94,9 @@
   },
   "dependencies": {
     "@browserbasehq/sdk": "^2.14.0",
+    "@hpke/core": "^1.9.0",
+    "@hpke/dhkem-x25519": "^1.8.0",
+    "@inquirer/password": "^4.0.23",
     "@oclif/core": "^4.11.0",
     "@vercel/detect-agent": "^1.2.3",
     "archiver": "^7.0.1",