envpass-cli 0.0.0-stage → 0.2.7

package/README.md

@@ -1,3 +1,47 @@
-# Temporary Holding Version
+# envpass-cli
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Client library and CLI for [envpass](https://envpass.dev): encrypted environment variables for every project and environment.
+
+## CLI
+
+```bash
+bunx envpass-cli login                         # sign in through your browser
+bunx envpass-cli link -w acme -p shop -e dev   # save defaults to .envpass.json (no secrets inside)
+bunx envpass-cli pull                          # write .env
+bunx envpass-cli pull -e prod -o -             # print to stdout
+bunx envpass-cli run -e dev -- bun dev         # run with values injected, masked in output
+bunx envpass-cli webhooks list                 # webhooks and syncs need `login`
+bunx envpass-cli syncs run <id>                # push a sync now
+```
+
+`npx envpass-cli …` works the same way.
+
+In CI, use a service token instead of `login`:
+
+```bash
+ENVPASS_TOKEN=ep_live_… npx envpass-cli pull -e prod
+```
+
+| Option | Environment variable | |
+|---|---|---|
+| `-w, --workspace` | `ENVPASS_WORKSPACE` | Workspace slug (not needed with a service token) |
+| `-p, --project` | `ENVPASS_PROJECT` | Project slug (not needed with a service token) |
+| `-e, --env` | `ENVPASS_ENV` | Environment slug |
+| `--url` | `ENVPASS_URL` | Server, default `https://envpass.dev` |
+| | `ENVPASS_TOKEN` | Service token or CLI session token |
+
+## Library
+
+```ts
+import { createEnvpass, loadEnv } from "envpass-cli"
+
+await loadEnv({ environment: "prod" })
+
+const envpass = createEnvpass({ token: process.env.ENVPASS_TOKEN })
+const entries = await envpass.resolve({ environment: "prod" })
+const webhooks = await envpass.listWebhooks({ workspace: "acme" })
+
+const { data } = await envpass.api.GET("/api/v1/workspaces")
+```
+
+`envpass.api` is a fully typed client for the whole REST API, generated from the OpenAPI spec.

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,231 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+import { writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { parseArgs } from "node:util";
+import { createEnvpass, EnvpassError } from "./client.js";
+import { baseUrl, forgetToken, resolveScope, saveToken, storedToken, writeProjectLink, } from "./config.js";
+import { deviceLogin, openBrowser } from "./device.js";
+import { syncsCommand, webhooksCommand } from "./integrations.js";
+import { maskingStream } from "./mask.js";
+const { version } = createRequire(import.meta.url)("../package.json");
+const HELP = `envpass ${version}: encrypted environment variables for every project and environment
+
+Usage
+  envpass login                      Sign in through your browser
+  envpass logout                     Forget the saved login
+  envpass whoami                     Show who the current token belongs to
+  envpass link -w <ws> -p <project>  Save defaults to .envpass.json in this directory
+  envpass pull [-e env] [-o .env]    Write resolved values to a file ("-" for stdout)
+  envpass run [-e env] -- <command>  Run a command with the values injected
+
+Webhooks and syncs (need \`envpass login\`, not a service token)
+  envpass webhooks list              List the workspace's webhooks
+  envpass webhooks add --url <url>   Register a webhook and print its signing secret once
+  envpass webhooks remove <id>       Delete a webhook
+  envpass webhooks test <id>         Send a test event (exit code 1 if it fails)
+  envpass webhooks deliveries <id>   Show a webhook's recent deliveries
+  envpass syncs list [-p project]    List the project's syncs
+  envpass syncs run <id>             Push a sync now
+  envpass syncs pause <id>           Stop a sync from running
+  envpass syncs resume <id>          Turn a paused sync back on
+
+Options
+  -w, --workspace <slug>   Workspace (not needed with a service token)
+  -p, --project <slug>     Project (not needed with a service token)
+  -e, --env <slug>         Environment, e.g. dev or prod
+  -o, --out <file>         pull: output file (default .env)
+  -f, --format <format>    pull: dotenv, shell or json (default dotenv)
+      --no-mask            run: show secret values in the command's output
+      --no-browser         login: print the link instead of opening a browser
+      --json               webhooks list, webhooks deliveries, syncs list: print raw JSON
+      --limit <n>          webhooks deliveries: how many to show, 1-100 (default 25)
+      --url <url>          envpass server (default https://envpass.dev, or ENVPASS_URL)
+
+Options for webhooks add
+      --url <url>          Endpoint to POST to (point at your server with ENVPASS_URL)
+      --event <event>      secrets.changed, sync.succeeded or sync.failed; repeat for more
+                           (default secrets.changed and sync.failed)
+  -e, --env <slug>         Only these environments; repeat for more (default all)
+  -p, --project <slug>     Only these projects; repeat for more (default all)
+  -f, --format <format>    json or slack (default slack for Slack URLs, json otherwise)
+      --description <text> A note to tell webhooks apart
+
+Environment
+  ENVPASS_TOKEN            A service token (ep_live_…) or CLI session token
+  ENVPASS_WORKSPACE, ENVPASS_PROJECT, ENVPASS_ENV
+`;
+function fail(message, code = 1) {
+    process.stderr.write(`envpass: ${message}\n`);
+    process.exit(code);
+}
+async function main(argv) {
+    const { values, positionals } = parseArgs({
+        args: argv,
+        allowPositionals: true,
+        options: {
+            workspace: { type: "string", short: "w" },
+            project: { type: "string", short: "p", multiple: true },
+            env: { type: "string", short: "e", multiple: true },
+            out: { type: "string", short: "o" },
+            format: { type: "string", short: "f" },
+            url: { type: "string" },
+            event: { type: "string", multiple: true },
+            description: { type: "string" },
+            limit: { type: "string" },
+            json: { type: "boolean" },
+            "no-mask": { type: "boolean" },
+            "no-browser": { type: "boolean" },
+            help: { type: "boolean", short: "h" },
+            version: { type: "boolean", short: "v" },
+        },
+    });
+    const [command, ...rest] = positionals;
+    if (values.version)
+        return void process.stdout.write(`${version}\n`);
+    if (values.help || !command || command === "help")
+        return void process.stdout.write(HELP);
+    const endpointUrl = command === "webhooks" && rest[0] === "add";
+    const url = baseUrl(endpointUrl ? undefined : values.url);
+    const flags = {
+        workspace: values.workspace,
+        project: values.project?.at(-1),
+        environment: values.env?.at(-1),
+    };
+    switch (command) {
+        case "login": {
+            const token = await deviceLogin(url, (code) => {
+                const link = code.verification_uri_complete ?? code.verification_uri;
+                process.stderr.write(`\nOpen ${link}\nand confirm the code: ${code.user_code}\n\nWaiting for approval…\n`);
+                if (!values["no-browser"])
+                    openBrowser(link);
+            });
+            const path = saveToken(url, token);
+            const me = await createEnvpass({ baseUrl: url, token }).me();
+            process.stderr.write(`Signed in. Token saved to ${path}\n`);
+            if (me.workspaces.length) {
+                process.stderr.write(`Workspaces: ${me.workspaces.map((w) => w.slug).join(", ")}\n`);
+            }
+            return;
+        }
+        case "logout": {
+            const token = storedToken(url);
+            if (token) {
+                await fetch(`${url}/api/auth/sign-out`, {
+                    method: "POST",
+                    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+                    body: "{}",
+                }).catch(() => undefined);
+            }
+            const removed = forgetToken(url);
+            process.stderr.write(removed ? `Signed out of ${url}\n` : `No saved login for ${url}\n`);
+            return;
+        }
+        case "whoami": {
+            const client = createEnvpass({ baseUrl: url });
+            if (!client.hasToken)
+                fail("Not signed in. Run `envpass login` or set ENVPASS_TOKEN.");
+            const me = await client.me();
+            if (me.token) {
+                process.stdout.write(`Service token ${me.token.id} (${me.token.access}) for project ${me.token.projectId}\n`);
+            }
+            else {
+                process.stdout.write(`User ${me.userId}\n`);
+                for (const ws of me.workspaces)
+                    process.stdout.write(`  ${ws.slug}${ws.isOwner ? " (owner)" : ""}\n`);
+            }
+            return;
+        }
+        case "link": {
+            const scope = resolveScope(flags);
+            if (!scope.workspace || !scope.project)
+                fail("Pass --workspace and --project.");
+            const path = writeProjectLink(scope);
+            process.stderr.write(`Saved ${path}. It holds no secrets and is safe to commit.\n`);
+            return;
+        }
+        case "pull": {
+            const format = (values.format ?? "dotenv");
+            if (!["dotenv", "shell", "json"].includes(format))
+                fail("--format must be dotenv, shell or json");
+            const client = createEnvpass({ baseUrl: url });
+            if (!client.hasToken)
+                fail("Not signed in. Run `envpass login` or set ENVPASS_TOKEN.");
+            const text = format === "json"
+                ? `${JSON.stringify(Object.fromEntries((await client.resolve(flags)).map((e) => [e.key, e.value])), null, 2)}\n`
+                : await client.resolveText(flags, format);
+            const out = values.out ?? ".env";
+            if (out === "-")
+                return void process.stdout.write(text);
+            writeFileSync(out, text, { mode: 0o600 });
+            const count = text
+                .split("\n")
+                .filter((line) => line.includes("=") || line.includes(":")).length;
+            process.stderr.write(`Wrote ${out} (${count} values). Keep it out of git.\n`);
+            return;
+        }
+        case "run": {
+            const separator = argv.indexOf("--");
+            const commandArgs = separator === -1 ? rest : argv.slice(separator + 1);
+            const [program, ...programArgs] = commandArgs;
+            if (!program)
+                fail("Usage: envpass run [-e env] -- <command> [args…]");
+            const client = createEnvpass({ baseUrl: url });
+            if (!client.hasToken)
+                fail("Not signed in. Run `envpass login` or set ENVPASS_TOKEN.");
+            const entries = await client.resolve(flags);
+            const env = { ...process.env, ...Object.fromEntries(entries.map((e) => [e.key, e.value])) };
+            const mask = !values["no-mask"];
+            const child = spawn(program, programArgs, {
+                env,
+                stdio: mask ? ["inherit", "pipe", "pipe"] : "inherit",
+            });
+            if (mask) {
+                const secrets = entries.map((e) => e.value);
+                child.stdout?.pipe(maskingStream(secrets)).pipe(process.stdout);
+                child.stderr?.pipe(maskingStream(secrets)).pipe(process.stderr);
+            }
+            for (const signal of ["SIGINT", "SIGTERM"]) {
+                process.on(signal, () => child.kill(signal));
+            }
+            child.on("error", (error) => fail(`Could not start ${program}: ${error.message}`, 127));
+            child.on("exit", (code, signal) => {
+                if (signal)
+                    process.kill(process.pid, signal);
+                else
+                    process.exit(code ?? 0);
+            });
+            return;
+        }
+        case "webhooks":
+        case "syncs": {
+            const client = createEnvpass({ baseUrl: url });
+            if (!client.hasToken)
+                fail("Not signed in. Run `envpass login` or set ENVPASS_TOKEN.");
+            const run = command === "webhooks" ? webhooksCommand : syncsCommand;
+            process.exitCode = await run(client, {
+                scope: flags,
+                args: rest,
+                json: values.json,
+                url: endpointUrl ? values.url : undefined,
+                events: values.event,
+                environments: values.env,
+                projects: values.project,
+                format: values.format,
+                description: values.description,
+                limit: values.limit,
+            }, {
+                out: (text) => process.stdout.write(text),
+                err: (text) => process.stderr.write(text),
+            });
+            return;
+        }
+        default:
+            fail(`Unknown command "${command}". Run \`envpass --help\`.`);
+    }
+}
+main(process.argv.slice(2)).catch((error) => {
+    if (error instanceof EnvpassError)
+        fail(`${error.message}${error.code ? ` (${error.code})` : ""}`);
+    fail(error instanceof Error ? error.message : String(error));
+});

package/dist/client.d.ts

@@ -0,0 +1,86 @@
+import { type ProjectLink } from "./config.js";
+import type { components, paths } from "./schema.js";
+type Schemas = components["schemas"];
+export type Source = Schemas["SecretSource"];
+export type ResolvedEntry = {
+    key: string;
+    value: string;
+    source: Source;
+};
+export type ExportFormat = "dotenv" | "json" | "shell";
+export type Workspace = Schemas["Workspace"];
+export type Environment = Schemas["Environment"];
+export type Webhook = Schemas["Webhook"];
+export type WebhookEvent = Schemas["WebhookEvent"];
+export type WebhookFormat = Webhook["format"];
+export type WebhookDelivery = Schemas["WebhookDelivery"];
+export type WebhookTestResult = Schemas["WebhookTestResult"];
+export type Connection = Schemas["Connection"];
+export type Sync = Schemas["Sync"];
+export type NewWebhook = {
+    url: string;
+    events?: WebhookEvent[];
+    environments?: string[];
+    projects?: string[];
+    format?: WebhookFormat;
+    description?: string | null;
+};
+export declare const WEBHOOK_EVENTS: readonly WebhookEvent[];
+export type EnvpassOptions = {
+    baseUrl?: string;
+    token?: string;
+    userAgent?: string;
+    fetch?: typeof fetch;
+};
+export declare class EnvpassError extends Error {
+    readonly status: number;
+    readonly code?: string | undefined;
+    constructor(message: string, status: number, code?: string | undefined);
+}
+export declare function createEnvpass(options?: EnvpassOptions): {
+    url: string;
+    hasToken: boolean;
+    api: import("openapi-fetch").Client<paths, `${string}/${string}`>;
+    me(): Promise<{
+        actor: "user" | "token";
+        userId: string;
+        token: {
+            id: string;
+            workspaceId: string;
+            projectId: string;
+            access: "read" | "write";
+        } | null;
+        workspaces: {
+            id: string;
+            name: string;
+            slug: string;
+            isOwner: boolean;
+        }[];
+    }>;
+    resolve(scope?: ProjectLink): Promise<ResolvedEntry[]>;
+    resolveText(scope?: ProjectLink, format?: Exclude<ExportFormat, "json">): Promise<string>;
+    workspace(scope?: ProjectLink): Promise<Workspace>;
+    listEnvironments(scope?: ProjectLink): Promise<Environment[]>;
+    listWebhooks(scope?: ProjectLink): Promise<Webhook[]>;
+    createWebhook(input: NewWebhook, scope?: ProjectLink): Promise<{
+        webhook: Webhook;
+        secret: string;
+    }>;
+    deleteWebhook(id: string, scope?: ProjectLink): Promise<void>;
+    testWebhook(id: string, scope?: ProjectLink): Promise<WebhookTestResult>;
+    listWebhookDeliveries(id: string, options?: {
+        limit?: number;
+        before?: string;
+    }, scope?: ProjectLink): Promise<WebhookDelivery[]>;
+    listConnections(scope?: ProjectLink): Promise<Connection[]>;
+    listSyncs(scope?: ProjectLink): Promise<Sync[]>;
+    runSync(id: string, scope?: ProjectLink): Promise<void>;
+    setSyncEnabled(id: string, enabled: boolean, scope?: ProjectLink): Promise<void>;
+};
+export type Envpass = ReturnType<typeof createEnvpass>;
+export declare function loadEnv(scope?: ProjectLink & EnvpassOptions & {
+    override?: boolean;
+}): Promise<{
+    [k: string]: string;
+}>;
+export {};

package/dist/client.js

@@ -0,0 +1,219 @@
+import createFetchClient from "openapi-fetch";
+import { baseUrl, resolveScope, resolveToken } from "./config.js";
+export const WEBHOOK_EVENTS = [
+    "secrets.changed",
+    "sync.succeeded",
+    "sync.failed",
+];
+const DEFAULT_WEBHOOK_EVENTS = ["secrets.changed", "sync.failed"];
+export class EnvpassError extends Error {
+    status;
+    code;
+    constructor(message, status, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = "EnvpassError";
+    }
+}
+function errorFrom(status, body) {
+    const error = body?.error;
+    return new EnvpassError(error?.message ?? `Request failed with status ${status}`, status, error?.code);
+}
+function unwrap(result) {
+    if (result.data === undefined)
+        throw errorFrom(result.response.status, result.error);
+    return result.data;
+}
+function pickIds(items, refs, kind, workspace) {
+    return refs.map((ref) => {
+        const item = items.find((candidate) => candidate.slug === ref || candidate.id === ref);
+        if (!item)
+            throw new EnvpassError(`No ${kind} "${ref}" in ${workspace.slug}`, 404, "not_found");
+        return item.id;
+    });
+}
+export function createEnvpass(options = {}) {
+    const url = baseUrl(options.baseUrl);
+    const token = resolveToken(url, options.token);
+    const headers = { "user-agent": options.userAgent ?? "envpass-node" };
+    if (token)
+        headers.authorization = `Bearer ${token}`;
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const api = createFetchClient({ baseUrl: url, headers, fetch: fetcher });
+    function scopeQuery(scope) {
+        if (!scope.environment) {
+            throw new EnvpassError("No environment. Pass --env, set ENVPASS_ENV, or run `envpass link`.", 400, "invalid");
+        }
+        return {
+            workspace: scope.workspace,
+            project: scope.project,
+            environment: scope.environment,
+        };
+    }
+    function requireUser() {
+        if (token?.startsWith("ep_")) {
+            throw new EnvpassError("Webhooks and syncs need a user login, not a service token. Run `envpass login` and unset ENVPASS_TOKEN.", 403, "forbidden");
+        }
+    }
+    async function workspaceFor(scope) {
+        requireUser();
+        const ref = resolveScope(scope).workspace;
+        const { workspaces } = unwrap(await api.GET("/api/v1/workspaces"));
+        if (ref) {
+            const match = workspaces.find((w) => w.slug === ref || w.id === ref);
+            if (!match)
+                throw new EnvpassError(`No workspace "${ref}" for this login`, 404, "not_found");
+            return match;
+        }
+        const [only] = workspaces;
+        if (only && workspaces.length === 1)
+            return only;
+        throw new EnvpassError("No workspace. Pass --workspace, set ENVPASS_WORKSPACE, or run `envpass link`.", 400, "invalid");
+    }
+    async function projectsOf(workspaceId) {
+        const path = { workspaceId };
+        return unwrap(await api.GET("/api/v1/workspaces/{workspaceId}/projects", { params: { path } }))
+            .projects;
+    }
+    async function environmentsOf(workspaceId) {
+        const path = { workspaceId };
+        return unwrap(await api.GET("/api/v1/workspaces/{workspaceId}/environments", { params: { path } })).environments;
+    }
+    async function projectFor(scope) {
+        const workspace = await workspaceFor(scope);
+        const ref = resolveScope(scope).project;
+        if (!ref) {
+            throw new EnvpassError("No project. Pass --project, set ENVPASS_PROJECT, or run `envpass link`.", 400, "invalid");
+        }
+        const [projectId = ref] = pickIds(await projectsOf(workspace.id), [ref], "project", workspace);
+        return { workspaceId: workspace.id, projectId };
+    }
+    async function webhookPath(webhookId, scope) {
+        return { workspaceId: (await workspaceFor(scope)).id, webhookId };
+    }
+    async function syncPath(syncId, scope) {
+        return { ...(await projectFor(scope)), syncId };
+    }
+    return {
+        url,
+        hasToken: Boolean(token),
+        api,
+        async me() {
+            const { data, error, response } = await api.GET("/api/v1/me");
+            if (!data)
+                throw errorFrom(response.status, error);
+            return data;
+        },
+        async resolve(scope = {}) {
+            const query = scopeQuery(resolveScope(scope));
+            const { data, error, response } = await api.GET("/api/v1/resolve", {
+                params: { query: { ...query, format: "json" } },
+            });
+            if (!data || typeof data === "string")
+                throw errorFrom(response.status, error);
+            return data.entries;
+        },
+        async resolveText(scope = {}, format = "dotenv") {
+            const query = scopeQuery(resolveScope(scope));
+            const response = await fetcher(`${url}/api/v1/resolve?${new URLSearchParams(Object.entries({ ...query, format }).filter((entry) => Boolean(entry[1])))}`, { headers });
+            const text = await response.text();
+            if (!response.ok) {
+                let body;
+                try {
+                    body = JSON.parse(text);
+                }
+                catch {
+                    body = undefined;
+                }
+                throw errorFrom(response.status, body);
+            }
+            return text;
+        },
+        async workspace(scope = {}) {
+            return workspaceFor(scope);
+        },
+        async listEnvironments(scope = {}) {
+            return environmentsOf((await workspaceFor(scope)).id);
+        },
+        async listWebhooks(scope = {}) {
+            const path = { workspaceId: (await workspaceFor(scope)).id };
+            return unwrap(await api.GET("/api/v1/workspaces/{workspaceId}/webhooks", { params: { path } })).webhooks;
+        },
+        async createWebhook(input, scope = {}) {
+            const workspace = await workspaceFor(scope);
+            const environments = input.environments ?? [];
+            const projects = input.projects ?? [];
+            const [environmentIds, projectIds] = await Promise.all([
+                environments.length
+                    ? environmentsOf(workspace.id).then((all) => pickIds(all, environments, "environment", workspace))
+                    : [],
+                projects.length
+                    ? projectsOf(workspace.id).then((all) => pickIds(all, projects, "project", workspace))
+                    : [],
+            ]);
+            return unwrap(await api.POST("/api/v1/workspaces/{workspaceId}/webhooks", {
+                params: { path: { workspaceId: workspace.id } },
+                body: {
+                    url: input.url,
+                    events: input.events?.length ? input.events : DEFAULT_WEBHOOK_EVENTS,
+                    environmentIds,
+                    projectIds,
+                    format: input.format,
+                    description: input.description,
+                },
+            }));
+        },
+        async deleteWebhook(id, scope = {}) {
+            const path = await webhookPath(id, scope);
+            unwrap(await api.DELETE("/api/v1/workspaces/{workspaceId}/webhooks/{webhookId}", {
+                params: { path },
+            }));
+        },
+        async testWebhook(id, scope = {}) {
+            const path = await webhookPath(id, scope);
+            return unwrap(await api.POST("/api/v1/workspaces/{workspaceId}/webhooks/{webhookId}/test", {
+                params: { path },
+            }));
+        },
+        async listWebhookDeliveries(id, options = {}, scope = {}) {
+            const path = await webhookPath(id, scope);
+            return unwrap(await api.GET("/api/v1/workspaces/{workspaceId}/webhooks/{webhookId}/deliveries", {
+                params: { path, query: options },
+            })).deliveries;
+        },
+        async listConnections(scope = {}) {
+            const path = { workspaceId: (await workspaceFor(scope)).id };
+            return unwrap(await api.GET("/api/v1/workspaces/{workspaceId}/connections", { params: { path } })).connections;
+        },
+        async listSyncs(scope = {}) {
+            const path = await projectFor(scope);
+            return unwrap(await api.GET("/api/v1/workspaces/{workspaceId}/projects/{projectId}/syncs", {
+                params: { path },
+            })).syncs;
+        },
+        async runSync(id, scope = {}) {
+            const path = await syncPath(id, scope);
+            unwrap(await api.POST("/api/v1/workspaces/{workspaceId}/projects/{projectId}/syncs/{syncId}/run", {
+                params: { path },
+            }));
+        },
+        async setSyncEnabled(id, enabled, scope = {}) {
+            const path = await syncPath(id, scope);
+            unwrap(await api.PATCH("/api/v1/workspaces/{workspaceId}/projects/{projectId}/syncs/{syncId}", {
+                params: { path },
+                body: { enabled },
+            }));
+        },
+    };
+}
+export async function loadEnv(scope = {}) {
+    const { baseUrl: url, token, userAgent, override = false, ...link } = scope;
+    const client = createEnvpass({ baseUrl: url, token, userAgent });
+    const entries = await client.resolve(link);
+    for (const entry of entries) {
+        if (override || process.env[entry.key] === undefined)
+            process.env[entry.key] = entry.value;
+    }
+    return Object.fromEntries(entries.map((entry) => [entry.key, entry.value]));
+}

package/dist/config.d.ts

@@ -0,0 +1,13 @@
+export declare const DEFAULT_URL = "https://envpass.dev";
+export type ProjectLink = {
+    workspace?: string;
+    project?: string;
+    environment?: string;
+};
+export declare function baseUrl(explicit?: string): string;
+export declare function saveToken(url: string, token: string): string;
+export declare function forgetToken(url: string): boolean;
+export declare function storedToken(url: string): string | undefined;
+export declare function resolveToken(url: string, explicit?: string): string | undefined;
+export declare function writeProjectLink(link: ProjectLink, dir?: string): string;
+export declare function resolveScope(flags: ProjectLink, start?: string): ProjectLink;