envpass-cli 0.1.6 → 0.2.7

package/README.md

@@ -1,6 +1,6 @@
 # envpass-cli
 
-Client library and CLI for [envpass](https://envpass.dev): encrypted environment variables for every project, service and environment.
+Client library and CLI for [envpass](https://envpass.dev): encrypted environment variables for every project and environment.
 
 ## CLI
 
@@ -10,6 +10,8 @@ bunx envpass-cli link -w acme -p shop -e dev   # save defaults to .envpass.json
 bunx envpass-cli pull                          # write .env
 bunx envpass-cli pull -e prod -o -             # print to stdout
 bunx envpass-cli run -e dev -- bun dev         # run with values injected, masked in output
+bunx envpass-cli webhooks list                 # webhooks and syncs need `login`
+bunx envpass-cli syncs run <id>                # push a sync now
 ```
 
 `npx envpass-cli …` works the same way.
@@ -25,7 +27,6 @@ ENVPASS_TOKEN=ep_live_… npx envpass-cli pull -e prod
 | `-w, --workspace` | `ENVPASS_WORKSPACE` | Workspace slug (not needed with a service token) |
 | `-p, --project` | `ENVPASS_PROJECT` | Project slug (not needed with a service token) |
 | `-e, --env` | `ENVPASS_ENV` | Environment slug |
-| `-s, --service` | `ENVPASS_SERVICE` | Service slug, or `shared` |
 | `--url` | `ENVPASS_URL` | Server, default `https://envpass.dev` |
 | | `ENVPASS_TOKEN` | Service token or CLI session token |
 
@@ -37,7 +38,8 @@ import { createEnvpass, loadEnv } from "envpass-cli"
 await loadEnv({ environment: "prod" })
 
 const envpass = createEnvpass({ token: process.env.ENVPASS_TOKEN })
-const entries = await envpass.resolve({ environment: "prod", service: "api" })
+const entries = await envpass.resolve({ environment: "prod" })
+const webhooks = await envpass.listWebhooks({ workspace: "acme" })
 
 const { data } = await envpass.api.GET("/api/v1/workspaces")
 ```

package/dist/cli.js

@@ -6,9 +6,10 @@ import { parseArgs } from "node:util";
 import { createEnvpass, EnvpassError } from "./client.js";
 import { baseUrl, forgetToken, resolveScope, saveToken, storedToken, writeProjectLink, } from "./config.js";
 import { deviceLogin, openBrowser } from "./device.js";
+import { syncsCommand, webhooksCommand } from "./integrations.js";
 import { maskingStream } from "./mask.js";
 const { version } = createRequire(import.meta.url)("../package.json");
-const HELP = `envpass ${version}: encrypted environment variables for every project, service and environment
+const HELP = `envpass ${version}: encrypted environment variables for every project and environment
 
 Usage
   envpass login                      Sign in through your browser
@@ -18,20 +19,41 @@ Usage
   envpass pull [-e env] [-o .env]    Write resolved values to a file ("-" for stdout)
   envpass run [-e env] -- <command>  Run a command with the values injected
 
+Webhooks and syncs (need \`envpass login\`, not a service token)
+  envpass webhooks list              List the workspace's webhooks
+  envpass webhooks add --url <url>   Register a webhook and print its signing secret once
+  envpass webhooks remove <id>       Delete a webhook
+  envpass webhooks test <id>         Send a test event (exit code 1 if it fails)
+  envpass webhooks deliveries <id>   Show a webhook's recent deliveries
+  envpass syncs list [-p project]    List the project's syncs
+  envpass syncs run <id>             Push a sync now
+  envpass syncs pause <id>           Stop a sync from running
+  envpass syncs resume <id>          Turn a paused sync back on
+
 Options
   -w, --workspace <slug>   Workspace (not needed with a service token)
   -p, --project <slug>     Project (not needed with a service token)
   -e, --env <slug>         Environment, e.g. dev or prod
-  -s, --service <slug>     Service layer, or "shared"
   -o, --out <file>         pull: output file (default .env)
   -f, --format <format>    pull: dotenv, shell or json (default dotenv)
       --no-mask            run: show secret values in the command's output
       --no-browser         login: print the link instead of opening a browser
+      --json               webhooks list, webhooks deliveries, syncs list: print raw JSON
+      --limit <n>          webhooks deliveries: how many to show, 1-100 (default 25)
       --url <url>          envpass server (default https://envpass.dev, or ENVPASS_URL)
 
+Options for webhooks add
+      --url <url>          Endpoint to POST to (point at your server with ENVPASS_URL)
+      --event <event>      secrets.changed, sync.succeeded or sync.failed; repeat for more
+                           (default secrets.changed and sync.failed)
+  -e, --env <slug>         Only these environments; repeat for more (default all)
+  -p, --project <slug>     Only these projects; repeat for more (default all)
+  -f, --format <format>    json or slack (default slack for Slack URLs, json otherwise)
+      --description <text> A note to tell webhooks apart
+
 Environment
   ENVPASS_TOKEN            A service token (ep_live_…) or CLI session token
-  ENVPASS_WORKSPACE, ENVPASS_PROJECT, ENVPASS_ENV, ENVPASS_SERVICE
+  ENVPASS_WORKSPACE, ENVPASS_PROJECT, ENVPASS_ENV
 `;
 function fail(message, code = 1) {
     process.stderr.write(`envpass: ${message}\n`);
@@ -43,12 +65,15 @@ async function main(argv) {
         allowPositionals: true,
         options: {
             workspace: { type: "string", short: "w" },
-            project: { type: "string", short: "p" },
-            env: { type: "string", short: "e" },
-            service: { type: "string", short: "s" },
+            project: { type: "string", short: "p", multiple: true },
+            env: { type: "string", short: "e", multiple: true },
             out: { type: "string", short: "o" },
             format: { type: "string", short: "f" },
             url: { type: "string" },
+            event: { type: "string", multiple: true },
+            description: { type: "string" },
+            limit: { type: "string" },
+            json: { type: "boolean" },
             "no-mask": { type: "boolean" },
             "no-browser": { type: "boolean" },
             help: { type: "boolean", short: "h" },
@@ -60,12 +85,12 @@ async function main(argv) {
         return void process.stdout.write(`${version}\n`);
     if (values.help || !command || command === "help")
         return void process.stdout.write(HELP);
-    const url = baseUrl(values.url);
+    const endpointUrl = command === "webhooks" && rest[0] === "add";
+    const url = baseUrl(endpointUrl ? undefined : values.url);
     const flags = {
         workspace: values.workspace,
-        project: values.project,
-        environment: values.env,
-        service: values.service,
+        project: values.project?.at(-1),
+        environment: values.env?.at(-1),
     };
     switch (command) {
         case "login": {
@@ -172,6 +197,29 @@ async function main(argv) {
             });
             return;
         }
+        case "webhooks":
+        case "syncs": {
+            const client = createEnvpass({ baseUrl: url });
+            if (!client.hasToken)
+                fail("Not signed in. Run `envpass login` or set ENVPASS_TOKEN.");
+            const run = command === "webhooks" ? webhooksCommand : syncsCommand;
+            process.exitCode = await run(client, {
+                scope: flags,
+                args: rest,
+                json: values.json,
+                url: endpointUrl ? values.url : undefined,
+                events: values.event,
+                environments: values.env,
+                projects: values.project,
+                format: values.format,
+                description: values.description,
+                limit: values.limit,
+            }, {
+                out: (text) => process.stdout.write(text),
+                err: (text) => process.stderr.write(text),
+            });
+            return;
+        }
         default:
             fail(`Unknown command "${command}". Run \`envpass --help\`.`);
     }

package/dist/client.d.ts

@@ -1,16 +1,36 @@
 import { type ProjectLink } from "./config.js";
 import type { components, paths } from "./schema.js";
-export type Source = components["schemas"]["SecretSource"];
+type Schemas = components["schemas"];
+export type Source = Schemas["SecretSource"];
 export type ResolvedEntry = {
     key: string;
     value: string;
     source: Source;
 };
 export type ExportFormat = "dotenv" | "json" | "shell";
+export type Workspace = Schemas["Workspace"];
+export type Environment = Schemas["Environment"];
+export type Webhook = Schemas["Webhook"];
+export type WebhookEvent = Schemas["WebhookEvent"];
+export type WebhookFormat = Webhook["format"];
+export type WebhookDelivery = Schemas["WebhookDelivery"];
+export type WebhookTestResult = Schemas["WebhookTestResult"];
+export type Connection = Schemas["Connection"];
+export type Sync = Schemas["Sync"];
+export type NewWebhook = {
+    url: string;
+    events?: WebhookEvent[];
+    environments?: string[];
+    projects?: string[];
+    format?: WebhookFormat;
+    description?: string | null;
+};
+export declare const WEBHOOK_EVENTS: readonly WebhookEvent[];
 export type EnvpassOptions = {
     baseUrl?: string;
     token?: string;
     userAgent?: string;
+    fetch?: typeof fetch;
 };
 export declare class EnvpassError extends Error {
     readonly status: number;
@@ -28,7 +48,6 @@ export declare function createEnvpass(options?: EnvpassOptions): {
             id: string;
             workspaceId: string;
             projectId: string;
-            serviceId: string | null;
             access: "read" | "write";
         } | null;
         workspaces: {
@@ -40,6 +59,23 @@ export declare function createEnvpass(options?: EnvpassOptions): {
     }>;
     resolve(scope?: ProjectLink): Promise<ResolvedEntry[]>;
     resolveText(scope?: ProjectLink, format?: Exclude<ExportFormat, "json">): Promise<string>;
+    workspace(scope?: ProjectLink): Promise<Workspace>;
+    listEnvironments(scope?: ProjectLink): Promise<Environment[]>;
+    listWebhooks(scope?: ProjectLink): Promise<Webhook[]>;
+    createWebhook(input: NewWebhook, scope?: ProjectLink): Promise<{
+        webhook: Webhook;
+        secret: string;
+    }>;
+    deleteWebhook(id: string, scope?: ProjectLink): Promise<void>;
+    testWebhook(id: string, scope?: ProjectLink): Promise<WebhookTestResult>;
+    listWebhookDeliveries(id: string, options?: {
+        limit?: number;
+        before?: string;
+    }, scope?: ProjectLink): Promise<WebhookDelivery[]>;
+    listConnections(scope?: ProjectLink): Promise<Connection[]>;
+    listSyncs(scope?: ProjectLink): Promise<Sync[]>;
+    runSync(id: string, scope?: ProjectLink): Promise<void>;
+    setSyncEnabled(id: string, enabled: boolean, scope?: ProjectLink): Promise<void>;
 };
 export type Envpass = ReturnType<typeof createEnvpass>;
 export declare function loadEnv(scope?: ProjectLink & EnvpassOptions & {
@@ -47,3 +83,4 @@ export declare function loadEnv(scope?: ProjectLink & EnvpassOptions & {
 }): Promise<{
     [k: string]: string;
 }>;
+export {};

package/dist/client.js

@@ -1,5 +1,11 @@
 import createFetchClient from "openapi-fetch";
 import { baseUrl, resolveScope, resolveToken } from "./config.js";
+export const WEBHOOK_EVENTS = [
+    "secrets.changed",
+    "sync.succeeded",
+    "sync.failed",
+];
+const DEFAULT_WEBHOOK_EVENTS = ["secrets.changed", "sync.failed"];
 export class EnvpassError extends Error {
     status;
     code;
@@ -14,13 +20,27 @@ function errorFrom(status, body) {
     const error = body?.error;
     return new EnvpassError(error?.message ?? `Request failed with status ${status}`, status, error?.code);
 }
+function unwrap(result) {
+    if (result.data === undefined)
+        throw errorFrom(result.response.status, result.error);
+    return result.data;
+}
+function pickIds(items, refs, kind, workspace) {
+    return refs.map((ref) => {
+        const item = items.find((candidate) => candidate.slug === ref || candidate.id === ref);
+        if (!item)
+            throw new EnvpassError(`No ${kind} "${ref}" in ${workspace.slug}`, 404, "not_found");
+        return item.id;
+    });
+}
 export function createEnvpass(options = {}) {
     const url = baseUrl(options.baseUrl);
     const token = resolveToken(url, options.token);
     const headers = { "user-agent": options.userAgent ?? "envpass-node" };
     if (token)
         headers.authorization = `Bearer ${token}`;
-    const api = createFetchClient({ baseUrl: url, headers });
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const api = createFetchClient({ baseUrl: url, headers, fetch: fetcher });
     function scopeQuery(scope) {
         if (!scope.environment) {
             throw new EnvpassError("No environment. Pass --env, set ENVPASS_ENV, or run `envpass link`.", 400, "invalid");
@@ -29,9 +49,52 @@ export function createEnvpass(options = {}) {
             workspace: scope.workspace,
             project: scope.project,
             environment: scope.environment,
-            service: scope.service,
         };
     }
+    function requireUser() {
+        if (token?.startsWith("ep_")) {
+            throw new EnvpassError("Webhooks and syncs need a user login, not a service token. Run `envpass login` and unset ENVPASS_TOKEN.", 403, "forbidden");
+        }
+    }
+    async function workspaceFor(scope) {
+        requireUser();
+        const ref = resolveScope(scope).workspace;
+        const { workspaces } = unwrap(await api.GET("/api/v1/workspaces"));
+        if (ref) {
+            const match = workspaces.find((w) => w.slug === ref || w.id === ref);
+            if (!match)
+                throw new EnvpassError(`No workspace "${ref}" for this login`, 404, "not_found");
+            return match;
+        }
+        const [only] = workspaces;
+        if (only && workspaces.length === 1)
+            return only;
+        throw new EnvpassError("No workspace. Pass --workspace, set ENVPASS_WORKSPACE, or run `envpass link`.", 400, "invalid");
+    }
+    async function projectsOf(workspaceId) {
+        const path = { workspaceId };
+        return unwrap(await api.GET("/api/v1/workspaces/{workspaceId}/projects", { params: { path } }))
+            .projects;
+    }
+    async function environmentsOf(workspaceId) {
+        const path = { workspaceId };
+        return unwrap(await api.GET("/api/v1/workspaces/{workspaceId}/environments", { params: { path } })).environments;
+    }
+    async function projectFor(scope) {
+        const workspace = await workspaceFor(scope);
+        const ref = resolveScope(scope).project;
+        if (!ref) {
+            throw new EnvpassError("No project. Pass --project, set ENVPASS_PROJECT, or run `envpass link`.", 400, "invalid");
+        }
+        const [projectId = ref] = pickIds(await projectsOf(workspace.id), [ref], "project", workspace);
+        return { workspaceId: workspace.id, projectId };
+    }
+    async function webhookPath(webhookId, scope) {
+        return { workspaceId: (await workspaceFor(scope)).id, webhookId };
+    }
+    async function syncPath(syncId, scope) {
+        return { ...(await projectFor(scope)), syncId };
+    }
     return {
         url,
         hasToken: Boolean(token),
@@ -53,7 +116,7 @@ export function createEnvpass(options = {}) {
         },
         async resolveText(scope = {}, format = "dotenv") {
             const query = scopeQuery(resolveScope(scope));
-            const response = await fetch(`${url}/api/v1/resolve?${new URLSearchParams(Object.entries({ ...query, format }).filter((entry) => Boolean(entry[1])))}`, { headers });
+            const response = await fetcher(`${url}/api/v1/resolve?${new URLSearchParams(Object.entries({ ...query, format }).filter((entry) => Boolean(entry[1])))}`, { headers });
             const text = await response.text();
             if (!response.ok) {
                 let body;
@@ -67,6 +130,81 @@ export function createEnvpass(options = {}) {
             }
             return text;
         },
+        async workspace(scope = {}) {
+            return workspaceFor(scope);
+        },
+        async listEnvironments(scope = {}) {
+            return environmentsOf((await workspaceFor(scope)).id);
+        },
+        async listWebhooks(scope = {}) {
+            const path = { workspaceId: (await workspaceFor(scope)).id };
+            return unwrap(await api.GET("/api/v1/workspaces/{workspaceId}/webhooks", { params: { path } })).webhooks;
+        },
+        async createWebhook(input, scope = {}) {
+            const workspace = await workspaceFor(scope);
+            const environments = input.environments ?? [];
+            const projects = input.projects ?? [];
+            const [environmentIds, projectIds] = await Promise.all([
+                environments.length
+                    ? environmentsOf(workspace.id).then((all) => pickIds(all, environments, "environment", workspace))
+                    : [],
+                projects.length
+                    ? projectsOf(workspace.id).then((all) => pickIds(all, projects, "project", workspace))
+                    : [],
+            ]);
+            return unwrap(await api.POST("/api/v1/workspaces/{workspaceId}/webhooks", {
+                params: { path: { workspaceId: workspace.id } },
+                body: {
+                    url: input.url,
+                    events: input.events?.length ? input.events : DEFAULT_WEBHOOK_EVENTS,
+                    environmentIds,
+                    projectIds,
+                    format: input.format,
+                    description: input.description,
+                },
+            }));
+        },
+        async deleteWebhook(id, scope = {}) {
+            const path = await webhookPath(id, scope);
+            unwrap(await api.DELETE("/api/v1/workspaces/{workspaceId}/webhooks/{webhookId}", {
+                params: { path },
+            }));
+        },
+        async testWebhook(id, scope = {}) {
+            const path = await webhookPath(id, scope);
+            return unwrap(await api.POST("/api/v1/workspaces/{workspaceId}/webhooks/{webhookId}/test", {
+                params: { path },
+            }));
+        },
+        async listWebhookDeliveries(id, options = {}, scope = {}) {
+            const path = await webhookPath(id, scope);
+            return unwrap(await api.GET("/api/v1/workspaces/{workspaceId}/webhooks/{webhookId}/deliveries", {
+                params: { path, query: options },
+            })).deliveries;
+        },
+        async listConnections(scope = {}) {
+            const path = { workspaceId: (await workspaceFor(scope)).id };
+            return unwrap(await api.GET("/api/v1/workspaces/{workspaceId}/connections", { params: { path } })).connections;
+        },
+        async listSyncs(scope = {}) {
+            const path = await projectFor(scope);
+            return unwrap(await api.GET("/api/v1/workspaces/{workspaceId}/projects/{projectId}/syncs", {
+                params: { path },
+            })).syncs;
+        },
+        async runSync(id, scope = {}) {
+            const path = await syncPath(id, scope);
+            unwrap(await api.POST("/api/v1/workspaces/{workspaceId}/projects/{projectId}/syncs/{syncId}/run", {
+                params: { path },
+            }));
+        },
+        async setSyncEnabled(id, enabled, scope = {}) {
+            const path = await syncPath(id, scope);
+            unwrap(await api.PATCH("/api/v1/workspaces/{workspaceId}/projects/{projectId}/syncs/{syncId}", {
+                params: { path },
+                body: { enabled },
+            }));
+        },
     };
 }
 export async function loadEnv(scope = {}) {

package/dist/config.d.ts

@@ -3,7 +3,6 @@ export type ProjectLink = {
     workspace?: string;
     project?: string;
     environment?: string;
-    service?: string;
 };
 export declare function baseUrl(explicit?: string): string;
 export declare function saveToken(url: string, token: string): string;

package/dist/config.js

@@ -82,6 +82,5 @@ export function resolveScope(flags, start) {
         workspace: flags.workspace ?? process.env.ENVPASS_WORKSPACE ?? file.workspace,
         project: flags.project ?? process.env.ENVPASS_PROJECT ?? file.project,
         environment: flags.environment ?? process.env.ENVPASS_ENV ?? file.environment,
-        service: flags.service ?? process.env.ENVPASS_SERVICE ?? file.service,
     };
 }

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { createEnvpass, type Envpass, EnvpassError, type EnvpassOptions, type ExportFormat, loadEnv, type ResolvedEntry, type Source, } from "./client.js";
+export { type Connection, createEnvpass, type Envpass, EnvpassError, type EnvpassOptions, type Environment, type ExportFormat, loadEnv, type NewWebhook, type ResolvedEntry, type Source, type Sync, WEBHOOK_EVENTS, type Webhook, type WebhookDelivery, type WebhookEvent, type WebhookFormat, type WebhookTestResult, type Workspace, } from "./client.js";
 export { DEFAULT_URL, type ProjectLink } from "./config.js";
 export { maskText } from "./mask.js";
 export type { components, paths } from "./schema.js";

package/dist/index.js

@@ -1,3 +1,3 @@
-export { createEnvpass, EnvpassError, loadEnv, } from "./client.js";
+export { createEnvpass, EnvpassError, loadEnv, WEBHOOK_EVENTS, } from "./client.js";
 export { DEFAULT_URL } from "./config.js";
 export { maskText } from "./mask.js";

package/dist/integrations.d.ts

@@ -0,0 +1,21 @@
+import { type Envpass } from "./client.js";
+import type { ProjectLink } from "./config.js";
+export type Io = {
+    out: (text: string) => void;
+    err: (text: string) => void;
+};
+export type IntegrationArgs = {
+    scope: ProjectLink;
+    args: string[];
+    json?: boolean;
+    url?: string;
+    events?: string[];
+    environments?: string[];
+    projects?: string[];
+    format?: string;
+    description?: string;
+    limit?: string;
+};
+export declare function table(header: string[], rows: string[][]): string;
+export declare function webhooksCommand(client: Envpass, options: IntegrationArgs, io: Io): Promise<number>;
+export declare function syncsCommand(client: Envpass, options: IntegrationArgs, io: Io): Promise<number>;

package/dist/integrations.js

@@ -0,0 +1,181 @@
+import { WEBHOOK_EVENTS, } from "./client.js";
+const WEBHOOKS_USAGE = "Usage: envpass webhooks <list|add|remove|test|deliveries>";
+const SYNCS_USAGE = "Usage: envpass syncs <list|run|pause|resume>";
+export function table(header, rows) {
+    const all = [header, ...rows];
+    const widths = header.map((_, i) => Math.max(...all.map((row) => (row[i] ?? "").length)));
+    return all
+        .map((row) => row.map((cell, i) => (i === row.length - 1 ? cell : cell.padEnd(widths[i] ?? 0))).join("  "))
+        .join("\n")
+        .concat("\n");
+}
+function oneLine(text) {
+    return text ? text.replace(/\s+/g, " ").trim() : "-";
+}
+function json(value) {
+    return `${JSON.stringify(value, null, 2)}\n`;
+}
+function requireId(args, usage) {
+    const [id] = args;
+    if (!id)
+        throw new Error(usage);
+    return id;
+}
+function describeTest(result) {
+    const status = result.responseStatus === null ? "no response" : `HTTP ${result.responseStatus}`;
+    const detail = result.error ? `: ${oneLine(result.error)}` : "";
+    return `${result.ok ? "Delivered" : "Failed"}: ${status} in ${result.durationMs}ms${detail}\n`;
+}
+function parseLimit(limit) {
+    if (limit === undefined)
+        return undefined;
+    const value = Number(limit);
+    if (!/^[0-9]+$/.test(limit) || value < 1 || value > 100)
+        throw new Error("--limit must be a whole number from 1 to 100");
+    return value;
+}
+function parseEvents(events) {
+    if (!events?.length)
+        return undefined;
+    return events.map((event) => {
+        const known = WEBHOOK_EVENTS.find((candidate) => candidate === event);
+        if (!known)
+            throw new Error(`--event must be one of ${WEBHOOK_EVENTS.join(", ")}`);
+        return known;
+    });
+}
+function parseFormat(format) {
+    if (format === undefined)
+        return undefined;
+    if (format !== "json" && format !== "slack")
+        throw new Error("--format must be json or slack");
+    return format;
+}
+export async function webhooksCommand(client, options, io) {
+    const [action, ...args] = options.args;
+    const scope = { workspace: options.scope.workspace };
+    switch (action) {
+        case "list": {
+            const [webhooks, environments] = await Promise.all([
+                client.listWebhooks(scope),
+                client.listEnvironments(scope),
+            ]);
+            if (options.json) {
+                io.out(json(webhooks));
+                return 0;
+            }
+            if (!webhooks.length) {
+                io.err("No webhooks.\n");
+                return 0;
+            }
+            const slugs = new Map(environments.map((e) => [e.id, e.slug]));
+            io.out(table(["ID", "URL", "EVENTS", "ENVIRONMENTS", "ENABLED", "LAST DELIVERY"], webhooks.map((hook) => [
+                hook.id,
+                hook.url,
+                hook.events.join(","),
+                hook.environmentIds.length
+                    ? hook.environmentIds.map((id) => slugs.get(id) ?? id).join(",")
+                    : "all",
+                hook.enabled ? "on" : "off",
+                hook.lastDelivery
+                    ? [hook.lastDelivery.status, hook.lastDelivery.responseStatus ?? ""].join(" ").trim()
+                    : "-",
+            ])));
+            return 0;
+        }
+        case "add": {
+            if (!options.url)
+                throw new Error("Usage: envpass webhooks add --url <url> [options]");
+            const { webhook, secret } = await client.createWebhook({
+                url: options.url,
+                events: parseEvents(options.events),
+                environments: options.environments,
+                projects: options.projects,
+                format: parseFormat(options.format),
+                description: options.description,
+            }, scope);
+            io.out(`Webhook ${webhook.id} created for ${webhook.url}\n`);
+            io.out(`Signing secret: ${secret}\n`);
+            io.err("Store the signing secret now: it is shown only once. Use it to verify the envpass-signature header.\n");
+            return 0;
+        }
+        case "remove": {
+            const id = requireId(args, "Usage: envpass webhooks remove <id>");
+            await client.deleteWebhook(id, scope);
+            io.err(`Removed webhook ${id}\n`);
+            return 0;
+        }
+        case "test": {
+            const id = requireId(args, "Usage: envpass webhooks test <id>");
+            const result = await client.testWebhook(id, scope);
+            io.out(describeTest(result));
+            return result.ok ? 0 : 1;
+        }
+        case "deliveries": {
+            const id = requireId(args, "Usage: envpass webhooks deliveries <id> [--limit N]");
+            const deliveries = await client.listWebhookDeliveries(id, { limit: parseLimit(options.limit) }, scope);
+            if (options.json) {
+                io.out(json(deliveries));
+                return 0;
+            }
+            if (!deliveries.length) {
+                io.err("No deliveries yet.\n");
+                return 0;
+            }
+            io.out(table(["ID", "EVENT", "STATUS", "CODE", "ATTEMPTS", "DURATION", "CREATED", "ERROR"], deliveries.map((delivery) => [
+                delivery.id,
+                delivery.eventType,
+                delivery.status,
+                delivery.responseStatus === null ? "-" : String(delivery.responseStatus),
+                String(delivery.attempts),
+                delivery.durationMs === null ? "-" : `${delivery.durationMs}ms`,
+                delivery.createdAt,
+                oneLine(delivery.error),
+            ])));
+            return 0;
+        }
+        default:
+            throw new Error(WEBHOOKS_USAGE);
+    }
+}
+export async function syncsCommand(client, options, io) {
+    const [action, ...args] = options.args;
+    const scope = { workspace: options.scope.workspace, project: options.scope.project };
+    switch (action) {
+        case "list": {
+            const syncs = await client.listSyncs(scope);
+            if (options.json) {
+                io.out(json(syncs));
+                return 0;
+            }
+            if (!syncs.length) {
+                io.err("No syncs.\n");
+                return 0;
+            }
+            io.out(table(["ID", "DESTINATION", "ENVIRONMENT", "STATUS", "LAST SYNCED", "LAST ERROR"], syncs.map((sync) => [
+                sync.id,
+                sync.destination,
+                sync.environmentSlug,
+                sync.enabled ? sync.status : "paused",
+                sync.lastSyncedAt ?? "never",
+                oneLine(sync.lastError),
+            ])));
+            return 0;
+        }
+        case "run": {
+            const id = requireId(args, "Usage: envpass syncs run <id>");
+            await client.runSync(id, scope);
+            io.err(`Queued sync ${id}\n`);
+            return 0;
+        }
+        case "pause":
+        case "resume": {
+            const id = requireId(args, `Usage: envpass syncs ${action} <id>`);
+            await client.setSyncEnabled(id, action === "resume", scope);
+            io.err(`${action === "resume" ? "Resumed" : "Paused"} sync ${id}\n`);
+            return 0;
+        }
+        default:
+            throw new Error(SYNCS_USAGE);
+    }
+}