browse 0.10.0 → 0.11.1

package/dist/commands/cloud/secrets/create.js

@@ -0,0 +1,33 @@
+import { Args } from "@oclif/core";
+import { BrowseCommand } from "../../../base.js";
+import { apiCommonFlags, toApiOptions } from "../../../lib/cloud/flags.js";
+import { createSecret } from "../../../lib/secrets/api.js";
+import { readSecretValue } from "../../../lib/secrets/input.js";
+import { secretInputFlags } from "../../../lib/secrets/flags.js";
+import { outputJson } from "../../../lib/output.js";
+export default class SecretsCreate extends BrowseCommand {
+    static description = "Create a project secret. Encrypts the value locally with the project public key.";
+    static examples = [
+        "browse cloud secrets create SERVICE_TOKEN",
+        "browse cloud secrets create SERVICE_TOKEN --env MY_SERVICE_TOKEN",
+        "browse cloud secrets create SERVICE_TOKEN --stdin < ./secret.txt",
+    ];
+    static args = {
+        key: Args.string({
+            description: "Name exposed in the function context.secrets object.",
+            required: true,
+        }),
+    };
+    static flags = { ...apiCommonFlags, ...secretInputFlags };
+    async run() {
+        const { args, flags } = await this.parse(SecretsCreate);
+        const options = toApiOptions(flags);
+        const value = await readSecretValue({ stdin: flags.stdin, env: flags.env });
+        try {
+            outputJson(await createSecret(options, args.key, value));
+        }
+        finally {
+            value.fill(0);
+        }
+    }
+}

package/dist/commands/cloud/secrets/delete.js

@@ -0,0 +1,23 @@
+import { Args } from "@oclif/core";
+import { BrowseCommand } from "../../../base.js";
+import { apiCommonFlags, toApiOptions } from "../../../lib/cloud/flags.js";
+import { deleteSecret } from "../../../lib/secrets/api.js";
+export default class SecretsDelete extends BrowseCommand {
+    static description = "Delete a project secret.";
+    static examples = [
+        "browse cloud secrets delete <secretId>",
+        "browse cloud secrets delete d2c4f48f-38e9-4b82-a36a-2b373fd14a65",
+    ];
+    static args = {
+        secretId: Args.string({
+            description: "Project secret ID (e.g. d2c4f48f-38e9-4b82-a36a-2b373fd14a65).",
+            required: true,
+        }),
+    };
+    static flags = { ...apiCommonFlags };
+    async run() {
+        const { args, flags } = await this.parse(SecretsDelete);
+        const options = toApiOptions(flags);
+        await deleteSecret(options, args.secretId);
+    }
+}

package/dist/commands/cloud/secrets/get.js

@@ -0,0 +1,24 @@
+import { Args } from "@oclif/core";
+import { BrowseCommand } from "../../../base.js";
+import { apiCommonFlags, toApiOptions } from "../../../lib/cloud/flags.js";
+import { getSecret } from "../../../lib/secrets/api.js";
+import { outputJson } from "../../../lib/output.js";
+export default class SecretsGet extends BrowseCommand {
+    static description = "Get project secret metadata. Does not return the secret value.";
+    static examples = [
+        "browse cloud secrets get <secretId>",
+        "browse cloud secrets get d2c4f48f-38e9-4b82-a36a-2b373fd14a65",
+    ];
+    static args = {
+        secretId: Args.string({
+            description: "Project secret ID (e.g. d2c4f48f-38e9-4b82-a36a-2b373fd14a65).",
+            required: true,
+        }),
+    };
+    static flags = { ...apiCommonFlags };
+    async run() {
+        const { args, flags } = await this.parse(SecretsGet);
+        const options = toApiOptions(flags);
+        outputJson(await getSecret(options, args.secretId));
+    }
+}

package/dist/commands/cloud/secrets/list.js

@@ -0,0 +1,20 @@
+import { BrowseCommand } from "../../../base.js";
+import { apiCommonFlags, toApiOptions } from "../../../lib/cloud/flags.js";
+import { listSecrets } from "../../../lib/secrets/api.js";
+import { listSecretsFlags, toListSecretsOptions, } from "../../../lib/secrets/flags.js";
+import { outputJson } from "../../../lib/output.js";
+export default class SecretsList extends BrowseCommand {
+    static description = "List project secret metadata with cursor pagination.";
+    static examples = [
+        "browse cloud secrets list",
+        "browse cloud secrets list --start-at 2026-01-01T00:00:00Z",
+        "browse cloud secrets list --start-at 2026-01-01T00:00:00Z --end-at 2026-02-01T00:00:00Z",
+        "browse cloud secrets list --limit 10",
+    ];
+    static flags = { ...apiCommonFlags, ...listSecretsFlags };
+    async run() {
+        const { flags } = await this.parse(SecretsList);
+        const options = toApiOptions(flags);
+        outputJson(await listSecrets(options, toListSecretsOptions(flags)));
+    }
+}

package/dist/commands/cloud/secrets/update.js

@@ -0,0 +1,34 @@
+import { Args } from "@oclif/core";
+import { BrowseCommand } from "../../../base.js";
+import { apiCommonFlags, toApiOptions } from "../../../lib/cloud/flags.js";
+import { updateSecret } from "../../../lib/secrets/api.js";
+import { readSecretValue } from "../../../lib/secrets/input.js";
+import { secretInputFlags } from "../../../lib/secrets/flags.js";
+import { outputJson } from "../../../lib/output.js";
+export default class SecretsUpdate extends BrowseCommand {
+    static description = "Replace a secret value, encrypting it locally with the current project public key.";
+    static examples = [
+        "browse cloud secrets update <secretId>",
+        "browse cloud secrets update d2c4f48f-38e9-4b82-a36a-2b373fd14a65",
+        "browse cloud secrets update <secretId> --env MY_SERVICE_TOKEN",
+        "browse cloud secrets update <secretId> --stdin < ./secret.txt",
+    ];
+    static args = {
+        secretId: Args.string({
+            description: "Project secret ID (e.g. d2c4f48f-38e9-4b82-a36a-2b373fd14a65).",
+            required: true,
+        }),
+    };
+    static flags = { ...apiCommonFlags, ...secretInputFlags };
+    async run() {
+        const { args, flags } = await this.parse(SecretsUpdate);
+        const options = toApiOptions(flags);
+        const value = await readSecretValue({ stdin: flags.stdin, env: flags.env });
+        try {
+            outputJson(await updateSecret(options, args.secretId, value));
+        }
+        finally {
+            value.fill(0);
+        }
+    }
+}

package/dist/commands/functions/secrets/attach.js

@@ -0,0 +1,27 @@
+import { Args } from "@oclif/core";
+import { BrowseCommand } from "../../../base.js";
+import { apiCommonFlags, toApiOptions } from "../../../lib/cloud/flags.js";
+import { attachFunctionSecret } from "../../../lib/secrets/api.js";
+export default class FunctionSecretsAttach extends BrowseCommand {
+    static description = "Attach an existing project secret to a function.";
+    static examples = [
+        "browse functions secrets attach <functionId> <secretId>",
+        "browse functions secrets attach 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041 d2c4f48f-38e9-4b82-a36a-2b373fd14a65",
+    ];
+    static args = {
+        functionId: Args.string({
+            description: "Function ID (e.g. 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041).",
+            required: true,
+        }),
+        secretId: Args.string({
+            description: "Project secret ID (e.g. d2c4f48f-38e9-4b82-a36a-2b373fd14a65).",
+            required: true,
+        }),
+    };
+    static flags = { ...apiCommonFlags };
+    async run() {
+        const { args, flags } = await this.parse(FunctionSecretsAttach);
+        const options = toApiOptions(flags);
+        await attachFunctionSecret(options, args.functionId, args.secretId);
+    }
+}

package/dist/commands/functions/secrets/detach.js

@@ -0,0 +1,27 @@
+import { Args } from "@oclif/core";
+import { BrowseCommand } from "../../../base.js";
+import { apiCommonFlags, toApiOptions } from "../../../lib/cloud/flags.js";
+import { detachFunctionSecret } from "../../../lib/secrets/api.js";
+export default class FunctionSecretsDetach extends BrowseCommand {
+    static description = "Detach a secret from a function without deleting the secret.";
+    static examples = [
+        "browse functions secrets detach <functionId> <secretId>",
+        "browse functions secrets detach 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041 d2c4f48f-38e9-4b82-a36a-2b373fd14a65",
+    ];
+    static args = {
+        functionId: Args.string({
+            description: "Function ID (e.g. 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041).",
+            required: true,
+        }),
+        secretId: Args.string({
+            description: "Project secret ID (e.g. d2c4f48f-38e9-4b82-a36a-2b373fd14a65).",
+            required: true,
+        }),
+    };
+    static flags = { ...apiCommonFlags };
+    async run() {
+        const { args, flags } = await this.parse(FunctionSecretsDetach);
+        const options = toApiOptions(flags);
+        await detachFunctionSecret(options, args.functionId, args.secretId);
+    }
+}

package/dist/commands/functions/secrets/list.js

@@ -0,0 +1,28 @@
+import { Args } from "@oclif/core";
+import { BrowseCommand } from "../../../base.js";
+import { apiCommonFlags, toApiOptions } from "../../../lib/cloud/flags.js";
+import { listFunctionSecrets } from "../../../lib/secrets/api.js";
+import { listSecretsFlags, toListSecretsOptions, } from "../../../lib/secrets/flags.js";
+import { outputJson } from "../../../lib/output.js";
+export default class FunctionSecretsList extends BrowseCommand {
+    static description = "List metadata for secrets attached to a function with cursor pagination.";
+    static examples = [
+        "browse functions secrets list <functionId>",
+        "browse functions secrets list 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041",
+        "browse functions secrets list <functionId> --start-at 2026-01-01T00:00:00Z",
+        "browse functions secrets list <functionId> --start-at 2026-01-01T00:00:00Z --end-at 2026-02-01T00:00:00Z",
+        "browse functions secrets list <functionId> --limit 10",
+    ];
+    static args = {
+        functionId: Args.string({
+            description: "Function ID (e.g. 7b6e1c42-8d93-4a15-b2f0-9c6d3e8a5041).",
+            required: true,
+        }),
+    };
+    static flags = { ...apiCommonFlags, ...listSecretsFlags };
+    async run() {
+        const { args, flags } = await this.parse(FunctionSecretsList);
+        const options = toApiOptions(flags);
+        outputJson(await listFunctionSecrets(options, args.functionId, toListSecretsOptions(flags)));
+    }
+}

package/dist/lib/cloud/api.js

@@ -328,6 +328,9 @@ function resolveCommandFromPathname(pathname) {
     if (pathname.startsWith("/v1/extensions")) {
         return "extensions";
     }
+    if (pathname.startsWith("/v1/secrets")) {
+        return "secrets";
+    }
     if (pathname.startsWith("/v1/functions")) {
         return "functions";
     }

package/dist/lib/driver/local-cdp-discovery.js

@@ -59,24 +59,6 @@ export async function readDevToolsActivePort(userDataDir) {
         return null;
     }
 }
-function isPortReachable(port, timeoutMs = 500) {
-    return new Promise((resolve) => {
-        const socket = net.createConnection({ host: "127.0.0.1", port });
-        const timer = setTimeout(() => {
-            socket.destroy();
-            resolve(false);
-        }, timeoutMs);
-        socket.on("connect", () => {
-            clearTimeout(timer);
-            socket.destroy();
-            resolve(true);
-        });
-        socket.on("error", () => {
-            clearTimeout(timer);
-            resolve(false);
-        });
-    });
-}
 async function probeJsonVersion(port) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), 2000);
@@ -97,6 +79,46 @@ async function probeJsonVersion(port) {
         clearTimeout(timer);
     }
 }
+/**
+ * Multiple candidates (several profile dirs, or a profile dir and a fallback
+ * port) can reference the same port within one discovery call. Memoize the
+ * live /json/version probe per port so that port is only actually hit once.
+ */
+function createJsonVersionProbe() {
+    const cache = new Map();
+    return (port) => {
+        let pending = cache.get(port);
+        if (!pending) {
+            pending = probeJsonVersion(port);
+            cache.set(port, pending);
+        }
+        return pending;
+    };
+}
+function wsPathname(wsUrl) {
+    try {
+        return new URL(wsUrl).pathname;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * A DevToolsActivePort file only reflects the browser instance that wrote it.
+ * If a different process later binds the same port (a very likely collision,
+ * since 9222 is the near-universal default debugging port), the cached
+ * port+wsPath pair points at a target that no longer exists. Confirm the
+ * port's live /json/version still reports this exact target before trusting
+ * it. Compare pathnames only (not the full URL) since Chrome can report the
+ * host as "127.0.0.1" or "localhost" depending on version/platform.
+ */
+async function isDevToolsActivePortFresh(info, probe = probeJsonVersion) {
+    const liveWsUrl = await probe(info.port);
+    if (!liveWsUrl)
+        return false;
+    const expectedPathname = wsPathname(buildDevToolsWsUrl(info.port, info.wsPath));
+    return (expectedPathname !== null && wsPathname(liveWsUrl) === expectedPathname);
+}
 async function verifyCdpWebSocket(wsUrl) {
     return new Promise((resolve) => {
         const url = new URL(wsUrl);
@@ -135,12 +157,12 @@ async function verifyCdpWebSocket(wsUrl) {
         });
     });
 }
-async function resolveDevToolsActivePortUrl(port, userDataDirs) {
+async function resolveDevToolsActivePortUrl(port, userDataDirs, probe) {
     for (const dir of userDataDirs) {
         const info = await readDevToolsActivePort(dir);
         if (!info || info.port !== port)
             continue;
-        if (!(await isPortReachable(info.port)))
+        if (!(await isDevToolsActivePortFresh(info, probe)))
             continue;
         return buildDevToolsWsUrl(info.port, info.wsPath);
     }
@@ -148,10 +170,11 @@ async function resolveDevToolsActivePortUrl(port, userDataDirs) {
 }
 export async function resolveWsTargetFromPort(port, options = {}) {
     const userDataDirs = options.userDataDirs ?? getChromeUserDataDirs();
-    const devToolsUrl = await resolveDevToolsActivePortUrl(port, userDataDirs);
+    const probe = createJsonVersionProbe();
+    const devToolsUrl = await resolveDevToolsActivePortUrl(port, userDataDirs, probe);
     if (devToolsUrl)
         return devToolsUrl;
-    const jsonVersionUrl = await probeJsonVersion(port);
+    const jsonVersionUrl = await probe(port);
     if (jsonVersionUrl)
         return jsonVersionUrl;
     const fallback = buildDevToolsWsUrl(port, "/devtools/browser");
@@ -162,9 +185,10 @@ export async function resolveWsTargetFromPort(port, options = {}) {
 export async function discoverLocalCdp(options = {}) {
     const candidates = [];
     const userDataDirs = options.userDataDirs ?? getChromeUserDataDirs();
+    const probe = createJsonVersionProbe();
     for (const dir of userDataDirs) {
         const info = await readDevToolsActivePort(dir);
-        if (!info || !(await isPortReachable(info.port)))
+        if (!info || !(await isDevToolsActivePortFresh(info, probe)))
             continue;
         candidates.push({
             source: `DevToolsActivePort:${dir}`,
@@ -172,7 +196,7 @@ export async function discoverLocalCdp(options = {}) {
         });
     }
     for (const port of options.fallbackPorts ?? DEFAULT_FALLBACK_PORTS) {
-        const wsUrl = await probeJsonVersion(port);
+        const wsUrl = await probe(port);
         if (!wsUrl)
             continue;
         if (!candidates.some((candidate) => candidate.wsUrl === wsUrl)) {

package/dist/lib/functions/dev.js

@@ -377,7 +377,9 @@ async function routeRequest(request, response, bridge, manifestStore, sessionMan
             ? body.params || {}
             : {};
         const session = await sessionManager.createSession(manifest.config?.sessionConfig);
-        const accepted = bridge.triggerInvocation(functionName, params, { session }, corsHeaders, response);
+        const accepted = bridge.triggerInvocation(functionName, params, 
+        // Match production, which always sends secrets.
+        { session, secrets: {} }, corsHeaders, response);
         if (!accepted) {
             await sessionManager.closeSession(session.id);
             sendJson(response, 503, { error: "No runtime is connected yet." }, corsHeaders);

package/dist/lib/functions/init.js

@@ -1,5 +1,5 @@
 import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { fail } from "../errors.js";
@@ -17,24 +17,49 @@ dist/
 .DS_Store
 `;
 const starterFunctionTemplate = `import { defineFn } from "@browserbasehq/sdk-functions";
-import { chromium } from "playwright-core";
+import { browserbase, Stagehand } from "@browserbasehq/stagehand";
+import { z } from "zod/v4";
 
-defineFn("my-function", async (context) => {
-  const browser = await chromium.connectOverCDP(context.session.connectUrl);
-  const page = browser.contexts()[0]!.pages()[0]!;
-
-  await page.goto("https://news.ycombinator.com");
-  await page.waitForSelector(".athing", { timeout: 30_000 });
+defineFn(
+  "my-function",
+  async (context) => {
+    const browser = await browserbase.connect({
+      // The local dev server has no secrets, so fall back to .env.
+      apiKey:
+        context.secrets.BROWSERBASE_API_KEY ?? process.env.BROWSERBASE_API_KEY!,
+      sessionId: context.session.id,
+    });
+    // In this example, Stagehand uses the Model Gateway where Browserbase charges for the tokens
+    const stagehand = await Stagehand.create({ browser });
+    const page = (await browser.context.activePage())!;
 
-  const titles = await page.$$eval(".athing .titleline > a", (elements) =>
-    elements.slice(0, 3).map((element) => element.textContent),
-  );
+    await page.goto("https://news.ycombinator.com");
+    const { data } = await stagehand.extract(
+      "Extract the top 3 stories with their rank, title, and link URL.",
+      z.object({
+        stories: z
+          .array(z.object({ rank: z.number(), title: z.string(), url: z.string() }))
+          .max(3),
+      }),
+    );
 
-  return {
-    message: "Fetched top Hacker News titles",
-    titles,
-  };
-});
+    await stagehand.close();
+    return {
+      message: "Successfully fetched top Hacker News stories",
+      timestamp: new Date().toISOString(),
+      results: data.stories,
+    };
+  },
+  {
+    // Upload the Stagehand extension once, then paste its ID here:
+    //   browse cloud extensions upload node_modules/@browserbasehq/stagehand/dist/assets/stagehand-extension.zip
+    sessionConfig: { extensionId: "your-extension-id" },
+  },
+);
+`;
+// pnpm 11 and later fail installs when esbuild's build script is not approved.
+const pnpmWorkspaceTemplate = `allowBuilds:
+  esbuild: true
 `;
 const tsconfigTemplate = `{
   "compilerOptions": {
@@ -71,9 +96,15 @@ export async function initFunctionsProject({ packageManager, projectName, }) {
     await writeFile(join(projectRoot, ".gitignore"), gitignoreTemplate);
     await writeFile(join(projectRoot, "index.ts"), starterFunctionTemplate);
     await writeFile(join(projectRoot, "tsconfig.json"), tsconfigTemplate);
+    if (packageManager === "pnpm") {
+        await writeFile(join(projectRoot, "pnpm-workspace.yaml"), pnpmWorkspaceTemplate);
+    }
     const install = packageManager === "pnpm" ? ["add"] : ["install"];
     const installDev = packageManager === "pnpm" ? ["add", "-D"] : ["install", "--save-dev"];
-    runPackageManager(packageManager, [...install, "@browserbasehq/sdk-functions", "playwright-core"], projectRoot);
+    runPackageManager(packageManager, [...install, "@browserbasehq/sdk-functions", "@browserbasehq/stagehand"], projectRoot);
+    // Match Stagehand's version of zod in order to pass type checks.
+    const zodVersion = readStagehandZodVersion(projectRoot);
+    runPackageManager(packageManager, [...install, zodVersion ? `zod@${zodVersion}` : "zod"], projectRoot);
     runPackageManager(packageManager, [...installDev, "typescript", "@types/node"], projectRoot);
     if (!existsSync(join(projectRoot, ".git"))) {
         spawnSync("git", ["init"], {
@@ -88,8 +119,11 @@ export async function initFunctionsProject({ packageManager, projectName, }) {
         nextSteps: [
             `cd ${projectName}`,
             "Edit .env with your Browserbase API key",
-            packageManager === "pnpm" ? "pnpm dev" : "npm run dev",
-            packageManager === "pnpm" ? "pnpm run deploy" : "npm run deploy",
+            "browse cloud extensions upload node_modules/@browserbasehq/stagehand/dist/assets/stagehand-extension.zip",
+            "Paste the uploaded extension ID into index.ts",
+            "browse functions dev index.ts",
+            "browse functions publish index.ts",
+            "Create a BROWSERBASE_API_KEY secret with browse cloud secrets create, then attach it with browse functions secrets attach",
         ],
     }, null, 2));
 }
@@ -99,6 +133,15 @@ function ensureCommand(command) {
         fail(`${command} is required but was not found on PATH.`);
     }
 }
+function readStagehandZodVersion(projectRoot) {
+    try {
+        const stagehandPackageJson = JSON.parse(readFileSync(join(projectRoot, "node_modules", "@browserbasehq", "stagehand", "package.json"), "utf8"));
+        return stagehandPackageJson.dependencies?.zod;
+    }
+    catch {
+        return undefined;
+    }
+}
 function runPackageManager(packageManager, args, cwd) {
     const result = spawnSync(packageManager, args, {
         cwd,

package/dist/lib/functions/publish.js

@@ -122,14 +122,23 @@ function ensureArchiveLockfile(root, entries) {
     }
     const tempDir = join(tmpdir(), `bb-functions-lockgen-${randomUUID()}`);
     mkdirSync(tempDir, { recursive: true });
-    copyFileSync(join(root, "package.json"), join(tempDir, "package.json"));
-    const result = spawnSync("npm", ["install", "--package-lock-only"], {
+    // Copy the files that publish uploads, so npm resolves local dependencies the same way the build does.
+    for (const entry of entries) {
+        const target = join(tempDir, entry);
+        mkdirSync(dirname(target), { recursive: true });
+        copyFileSync(join(root, entry), target);
+    }
+    // Omit resolved URLs so the builder installs from its own registry rather than the one on your machine.
+    const result = spawnSync("npm", ["install", "--package-lock-only", "--omit-lockfile-registry-resolved"], {
         cwd: tempDir,
         stdio: "pipe",
     });
     if (result.status !== 0) {
         rmSync(tempDir, { recursive: true, force: true });
-        fail("Failed to generate package-lock.json for the Functions build archive.");
+        const npmOutput = result.error
+            ? result.error.message
+            : result.stderr.toString().trim();
+        fail(`Failed to generate package-lock.json for the Functions build archive.${npmOutput ? `\n${npmOutput}` : ""}`);
     }
     return {
         entries: [...entries, "package-lock.json"].sort(),

package/dist/lib/secrets/api.js

@@ -0,0 +1,60 @@
+import { sealSecret } from "./seal.js";
+import { requestBrowserbase, requestBrowserbaseJson } from "../cloud/api.js";
+export function listSecrets(options, query) {
+    return requestBrowserbaseJson(options, withQuery("/v1/secrets", query));
+}
+function withQuery(path, query) {
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(query)) {
+        if (value !== undefined)
+            params.set(key, String(value));
+    }
+    const search = params.toString();
+    return search ? `${path}?${search}` : path;
+}
+export function getSecret(options, secretId) {
+    return requestBrowserbaseJson(options, secretPath(secretId));
+}
+export async function deleteSecret(options, secretId) {
+    await requestBrowserbase(options, secretPath(secretId), { method: "DELETE" });
+}
+function secretPath(id) {
+    return `/v1/secrets/${encodeURIComponent(id)}`;
+}
+export async function createSecret(options, secretKey, value) {
+    const sealed = await encryptValue(options, value);
+    return requestBrowserbaseJson(options, "/v1/secrets", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+            secretKey,
+            ...sealed,
+        }),
+    });
+}
+export async function updateSecret(options, secretId, value) {
+    const sealed = await encryptValue(options, value);
+    return requestBrowserbaseJson(options, secretPath(secretId), {
+        method: "PATCH",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(sealed),
+    });
+}
+async function encryptValue(options, value) {
+    const keypair = await requestBrowserbaseJson(options, "/v1/secrets/keypair");
+    const sealedSecretValue = await sealSecret(keypair.publicKey, value);
+    return { keypairId: keypair.id, sealedSecretValue };
+}
+export async function attachFunctionSecret(options, functionId, secretId) {
+    await requestBrowserbase(options, `/v1/functions/${encodeURIComponent(functionId)}/secrets`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ secretId }),
+    });
+}
+export async function detachFunctionSecret(options, functionId, secretId) {
+    await requestBrowserbase(options, `/v1/functions/${encodeURIComponent(functionId)}/secrets/${encodeURIComponent(secretId)}`, { method: "DELETE" });
+}
+export function listFunctionSecrets(options, functionId, query) {
+    return requestBrowserbaseJson(options, withQuery(`/v1/functions/${encodeURIComponent(functionId)}/secrets`, query));
+}

package/dist/lib/secrets/flags.js

@@ -0,0 +1,36 @@
+import { Flags } from "@oclif/core";
+export const listSecretsFlags = {
+    limit: Flags.integer({
+        min: 1,
+        max: 1000,
+        description: "Maximum results per page (API default: 20).",
+    }),
+    cursor: Flags.string({
+        description: "nextCursor from the previous page. Keep the same filters.",
+    }),
+    "start-at": Flags.string({
+        description: "Include secrets created on or after this RFC 3339 timestamp.",
+    }),
+    "end-at": Flags.string({
+        description: "Include secrets created on or before this RFC 3339 timestamp.",
+    }),
+};
+export function toListSecretsOptions(flags) {
+    return {
+        limit: flags.limit,
+        cursor: flags.cursor,
+        startAt: flags["start-at"],
+        endAt: flags["end-at"],
+    };
+}
+export const secretInputFlags = {
+    env: Flags.string({
+        description: "Read the secret value from the named environment variable.",
+        helpValue: "VARIABLE_NAME",
+        exclusive: ["stdin"],
+    }),
+    stdin: Flags.boolean({
+        description: "Read the exact secret value from stdin, preserving whitespace.",
+        exclusive: ["env"],
+    }),
+};

package/dist/lib/secrets/input.js

@@ -0,0 +1,33 @@
+import password from "@inquirer/password";
+import { fail } from "../errors.js";
+export async function readSecretValue(options) {
+    if (options.env !== undefined) {
+        if (options.stdin)
+            fail("--env and --stdin cannot be used together.");
+        if (!options.env)
+            fail("--env requires an environment variable name.");
+        const value = Object.prototype.hasOwnProperty.call(process.env, options.env)
+            ? process.env[options.env]
+            : undefined;
+        if (value === undefined)
+            fail("The environment variable selected by --env is not set.");
+        return Buffer.from(value, "utf8");
+    }
+    if (options.stdin) {
+        if (process.stdin.isTTY)
+            fail("--stdin requires piped input or file redirection.");
+        const chunks = [];
+        for await (const chunk of process.stdin) {
+            chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+        }
+        return Buffer.concat(chunks);
+    }
+    if (!process.stdin.isTTY)
+        fail("Use --stdin for piped input or --env to read an environment variable.");
+    try {
+        return Buffer.from(await password({ message: "Secret value:" }, { output: process.stderr }), "utf8");
+    }
+    catch {
+        fail("Secret input cancelled.");
+    }
+}