@getmyenv/crypto 0.1.0 → 0.2.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 getenv.dev
+Copyright (c) 2026 getmyenv
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,3 +1,5 @@
 # @getmyenv/crypto
 
 Envelope encryption for [getmyenv](https://getmyenv.com) (Argon2id + AES-256-GCM).
+
+License: MIT (see [LICENSE](./LICENSE)).

package/dist/backup.d.ts

@@ -1,29 +1,28 @@
-import type { EncryptedBackupEnvelope, EncryptedSecretPayload, WrappedProjectKey } from "./types.js";
+import type { BackupContext, BackupValue, EncryptedBackupEnvelope, WrappedProjectKey } from "./types.js";
 import { encryptSecret, decryptSecret } from "./envelope.js";
 export declare function createBackupEnvelope(input: {
     projectName: string;
     wrappedProjectKey: WrappedProjectKey;
-    secrets: Array<{
-        name: string;
-        environment: string;
-        status: "active" | "revoked" | "placeholder";
-        expiresAt: string | null;
-        payload: EncryptedSecretPayload | null;
-    }>;
+    contexts: BackupContext[];
+    keys: string[];
+    tags?: Record<string, string>;
+    values: BackupValue[];
 }): EncryptedBackupEnvelope;
 export declare function serializeBackup(envelope: EncryptedBackupEnvelope): string;
 export declare function parseBackup(raw: string): EncryptedBackupEnvelope;
 /**
- * Decrypt all secrets from a backup using the vault password.
- * Does not require getmyenv SaaS availability.
- * Placeholders (null payload) restore as empty values.
+ * Decrypt every value in a backup with the Vault password.
+ * Works without getmyenv being reachable.
  */
-export declare function restoreSecretsFromBackup(vaultPassword: string, envelope: EncryptedBackupEnvelope): Promise<Array<{
-    name: string;
-    environment: string;
-    value: string;
-    status: "active" | "revoked" | "placeholder";
-    expiresAt: string | null;
-}>>;
+export declare function restoreValuesFromBackup(vaultPassword: string, envelope: EncryptedBackupEnvelope): Promise<{
+    contexts: BackupContext[];
+    keys: string[];
+    values: Array<{
+        key: string;
+        context: string;
+        value: string;
+        expiresAt: string | null;
+    }>;
+}>;
 export { encryptSecret, decryptSecret };
 //# sourceMappingURL=backup.d.ts.map

package/dist/backup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../src/backup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAErG,OAAO,EAAE,aAAa,EAAE,aAAa,EAAoB,MAAM,eAAe,CAAC;AAE/E,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;QAC7C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;KACxC,CAAC,CAAC;CACJ,GAAG,uBAAuB,CAS1B;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,uBAAuB,GAAG,MAAM,CAEzE;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,uBAAuB,CAShE;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,uBAAuB,GAChC,OAAO,CACR,KAAK,CAAC;IACJ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;IAC7C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC,CACH,CASA;AAED,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC"}
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../src/backup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,WAAW,EACX,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAoB,MAAM,eAAe,CAAC;AAE/E,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,MAAM,EAAE,WAAW,EAAE,CAAC;CACvB,GAAG,uBAAuB,CAa1B;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,uBAAuB,GAAG,MAAM,CAEzE;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,uBAAuB,CAShE;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,uBAAuB,GAChC,OAAO,CAAC;IACT,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,KAAK,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC,CAAC;CACJ,CAAC,CAYD;AAED,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC"}

package/dist/backup.js

@@ -1,13 +1,17 @@
-import { CRYPTO_FORMAT_VERSION } from "./types.js";
+import { BACKUP_FORMAT_VERSION } from "./types.js";
 import { encryptSecret, decryptSecret, unwrapProjectKey } from "./envelope.js";
 export function createBackupEnvelope(input) {
+    const hasTags = input.tags && Object.keys(input.tags).length > 0;
     return {
         format: "getmyenv-backup",
-        version: CRYPTO_FORMAT_VERSION,
+        version: BACKUP_FORMAT_VERSION,
         createdAt: new Date().toISOString(),
         projectName: input.projectName,
         wrappedProjectKey: input.wrappedProjectKey,
-        secrets: input.secrets,
+        contexts: input.contexts,
+        keys: input.keys,
+        ...(hasTags ? { tags: input.tags } : {}),
+        values: input.values,
     };
 }
 export function serializeBackup(envelope) {
@@ -18,25 +22,27 @@ export function parseBackup(raw) {
     if (parsed.format !== "getmyenv-backup") {
         throw new Error("Not a getmyenv backup file");
     }
-    if (parsed.version !== CRYPTO_FORMAT_VERSION) {
-        throw new Error(`Unsupported backup version: ${parsed.version}`);
+    if (parsed.version !== BACKUP_FORMAT_VERSION) {
+        throw new Error(`Unsupported backup version: ${String(parsed.version)}`);
     }
     return parsed;
 }
 /**
- * Decrypt all secrets from a backup using the vault password.
- * Does not require getmyenv SaaS availability.
- * Placeholders (null payload) restore as empty values.
+ * Decrypt every value in a backup with the Vault password.
+ * Works without getmyenv being reachable.
  */
-export async function restoreSecretsFromBackup(vaultPassword, envelope) {
+export async function restoreValuesFromBackup(vaultPassword, envelope) {
     const pek = await unwrapProjectKey(vaultPassword, envelope.wrappedProjectKey);
-    return envelope.secrets.map((s) => ({
-        name: s.name,
-        environment: s.environment,
-        value: s.payload ? decryptSecret(pek, s.payload) : "",
-        status: s.status === "placeholder" || !s.payload ? "placeholder" : s.status,
-        expiresAt: s.expiresAt,
-    }));
+    return {
+        contexts: envelope.contexts,
+        keys: envelope.keys,
+        values: envelope.values.map((v) => ({
+            key: v.key,
+            context: v.context,
+            value: decryptSecret(pek, v.payload),
+            expiresAt: v.expiresAt,
+        })),
+    };
 }
 export { encryptSecret, decryptSecret };
 //# sourceMappingURL=backup.js.map

package/dist/backup.js.map

@@ -1 +1 @@
-{"version":3,"file":"backup.js","sourceRoot":"","sources":["../src/backup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE/E,MAAM,UAAU,oBAAoB,CAAC,KAUpC;IACC,OAAO;QACL,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,qBAAqB;QAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAiC;IAC/D,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IAC1D,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,qBAAqB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,aAAqB,EACrB,QAAiC;IAUjC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,aAAa,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;QACrD,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;QAC3E,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC"}
+{"version":3,"file":"backup.js","sourceRoot":"","sources":["../src/backup.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE/E,MAAM,UAAU,oBAAoB,CAAC,KAOpC;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACjE,OAAO;QACL,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,qBAAqB;QAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAiC;IAC/D,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4C,CAAC;IAC1E,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,qBAAqB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,aAAqB,EACrB,QAAiC;IAWjC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,aAAa,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC9E,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,KAAK,EAAE,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC;YACpC,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC"}

package/dist/identity.d.ts

@@ -1,12 +1,12 @@
 /**
- * Development machine identity keypair.
- * Identifies the environment  -  does NOT decrypt secrets or grant permanent access.
+ * Machine identity keypair.
+ * Identifies a machine for access requests. It does not decrypt values.
  */
-export type DevelopmentKeypair = {
+export type MachineKeypair = {
     publicKey: string;
     privateKey: string;
 };
-export declare function generateDevelopmentIdentity(): DevelopmentKeypair;
+export declare function generateMachineIdentity(): MachineKeypair;
 export declare function signAccessRequest(privateKeyB64: string, message: string): string;
 export declare function verifyAccessRequest(publicKeyB64: string, message: string, signatureB64: string): boolean;
 //# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wBAAgB,2BAA2B,IAAI,kBAAkB,CAOhE;AAED,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,GACd,MAAM,CAIR;AAED,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GACnB,OAAO,CAUT"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wBAAgB,uBAAuB,IAAI,cAAc,CAOxD;AAED,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,GACd,MAAM,CAIR;AAED,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GACnB,OAAO,CAUT"}

package/dist/identity.js

@@ -1,6 +1,6 @@
 import { ed25519 } from "@noble/curves/ed25519.js";
 import { bytesToBase64, base64ToBytes, getRandomBytes, utf8Encode } from "./bytes.js";
-export function generateDevelopmentIdentity() {
+export function generateMachineIdentity() {
     const privateKey = getRandomBytes(32);
     const publicKey = ed25519.getPublicKey(privateKey);
     return {

package/dist/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAWtF,MAAM,UAAU,2BAA2B;IACzC,MAAM,UAAU,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO;QACL,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC;QACnC,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,aAAqB,EACrB,OAAe;IAEf,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC;IAC1D,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,YAAoB,EACpB,OAAe,EACf,YAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CACnB,aAAa,CAAC,YAAY,CAAC,EAC3B,UAAU,CAAC,OAAO,CAAC,EACnB,aAAa,CAAC,YAAY,CAAC,CAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAWtF,MAAM,UAAU,uBAAuB;IACrC,MAAM,UAAU,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO;QACL,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC;QACnC,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,aAAqB,EACrB,OAAe;IAEf,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC;IAC1D,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,YAAoB,EACpB,OAAe,EACf,YAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CACnB,aAAa,CAAC,YAAY,CAAC,EAC3B,UAAU,CAAC,OAAO,CAAC,EACnB,aAAa,CAAC,YAAY,CAAC,CAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/types.d.ts

@@ -31,20 +31,31 @@ export type EncryptedSecretPayload = {
     nonce: string;
     ciphertext: string;
 };
+export declare const BACKUP_FORMAT_VERSION: 2;
+export type BackupContext = {
+    slug: string;
+    name: string;
+    protection: "open" | "locked";
+};
+export type BackupValue = {
+    key: string;
+    /** Context slug. */
+    context: string;
+    expiresAt: string | null;
+    payload: EncryptedSecretPayload;
+};
 /** Portable encrypted backup envelope. */
 export type EncryptedBackupEnvelope = {
     format: "getmyenv-backup";
-    version: typeof CRYPTO_FORMAT_VERSION;
+    version: typeof BACKUP_FORMAT_VERSION;
     createdAt: string;
     projectName: string;
     wrappedProjectKey: WrappedProjectKey;
-    secrets: Array<{
-        name: string;
-        environment: string;
-        status: "active" | "revoked" | "placeholder";
-        expiresAt: string | null;
-        /** Null for name-only placeholders. */
-        payload: EncryptedSecretPayload | null;
-    }>;
+    contexts: BackupContext[];
+    /** Every variable name in the project, including ones with no values. */
+    keys: string[];
+    /** Key name -> tag, for tagged keys only. Absent when nothing is tagged. */
+    tags?: Record<string, string>;
+    values: BackupValue[];
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,EAAG,CAAU,CAAC;AAChD,eAAO,MAAM,SAAS,EAAG,aAAsB,CAAC;AAChD,eAAO,MAAM,GAAG,EAAG,UAAmB,CAAC;AAEvC,wDAAwD;AACxD,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wEAAwE;AACxE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,OAAO,qBAAqB,CAAC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,GAAG,EAAE,OAAO,GAAG,CAAC;IAChB,SAAS,EAAE,SAAS,CAAC;CACtB,CAAC;AAEF,sCAAsC;AACtC,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,EAAE,OAAO,qBAAqB,CAAC;IACtC,SAAS,EAAE,OAAO,SAAS,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,0CAA0C;AAC1C,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,EAAE,OAAO,qBAAqB,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;QAC7C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,uCAAuC;QACvC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;KACxC,CAAC,CAAC;CACJ,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,EAAG,CAAU,CAAC;AAChD,eAAO,MAAM,SAAS,EAAG,aAAsB,CAAC;AAChD,eAAO,MAAM,GAAG,EAAG,UAAmB,CAAC;AAEvC,wDAAwD;AACxD,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wEAAwE;AACxE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,OAAO,qBAAqB,CAAC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,GAAG,EAAE,OAAO,GAAG,CAAC;IAChB,SAAS,EAAE,SAAS,CAAC;CACtB,CAAC;AAEF,sCAAsC;AACtC,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,EAAE,OAAO,qBAAqB,CAAC;IACtC,SAAS,EAAE,OAAO,SAAS,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,qBAAqB,EAAG,CAAU,CAAC;AAEhD,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,GAAG,QAAQ,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,oBAAoB;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,sBAAsB,CAAC;CACjC,CAAC;AAEF,0CAA0C;AAC1C,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,EAAE,OAAO,qBAAqB,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,yEAAyE;IACzE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,MAAM,EAAE,WAAW,EAAE,CAAC;CACvB,CAAC"}

package/dist/types.js

@@ -9,4 +9,5 @@ export const DEFAULT_KDF_PARAMS = {
     parallelism: 1,
     hashLength: 32,
 };
+export const BACKUP_FORMAT_VERSION = 2;
 //# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAU,CAAC;AAChD,MAAM,CAAC,MAAM,SAAS,GAAG,aAAsB,CAAC;AAChD,MAAM,CAAC,MAAM,GAAG,GAAG,UAAmB,CAAC;AAEvC,wDAAwD;AACxD,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM;IACzB,UAAU,EAAE,CAAC;IACb,WAAW,EAAE,CAAC;IACd,UAAU,EAAE,EAAE;CACN,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAU,CAAC;AAChD,MAAM,CAAC,MAAM,SAAS,GAAG,aAAsB,CAAC;AAChD,MAAM,CAAC,MAAM,GAAG,GAAG,UAAmB,CAAC;AAEvC,wDAAwD;AACxD,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM;IACzB,UAAU,EAAE,CAAC;IACb,WAAW,EAAE,CAAC;IACd,UAAU,EAAE,EAAE;CACN,CAAC;AA2BX,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAU,CAAC"}

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@getmyenv/crypto",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Envelope encryption for getmyenv (Argon2id + AES-256-GCM)",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
     "dist",
+    "!dist/**/*.test.*",
     "README.md",
     "LICENSE"
   ],
@@ -38,6 +39,7 @@
     "vitest": "^4.1.11"
   },
   "scripts": {
+    "prebuild": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
     "build": "tsc -p tsconfig.json",
     "dev": "tsc -p tsconfig.json --watch",
     "test": "vitest run",

package/dist/envelope.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=envelope.test.d.ts.map

package/dist/envelope.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"envelope.test.d.ts","sourceRoot":"","sources":["../src/envelope.test.ts"],"names":[],"mappings":""}

package/dist/envelope.test.js

@@ -1,66 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { createWrappedProjectKey, unwrapProjectKey, rewrapProjectKey, encryptSecret, decryptSecret, createBackupEnvelope, parseBackup, serializeBackup, restoreSecretsFromBackup, generateDevelopmentIdentity, signAccessRequest, verifyAccessRequest, } from "./index.js";
-describe("envelope encryption", () => {
-    it("encrypts and decrypts a secret with PEK", async () => {
-        const { pek, wrapped } = await createWrappedProjectKey("test-vault-password");
-        const payload = encryptSecret(pek, "sk-live-example");
-        expect(payload.version).toBe(1);
-        expect(decryptSecret(pek, payload)).toBe("sk-live-example");
-        const unwrapped = await unwrapProjectKey("test-vault-password", wrapped);
-        expect(decryptSecret(unwrapped, payload)).toBe("sk-live-example");
-    });
-    it("rewraps PEK on password change without re-encrypting secrets", async () => {
-        const { pek, wrapped } = await createWrappedProjectKey("old-password");
-        const payload = encryptSecret(pek, "DATABASE_URL=postgres://...");
-        const rewrapped = await rewrapProjectKey("old-password", "new-password", wrapped);
-        const newPek = await unwrapProjectKey("new-password", rewrapped);
-        expect(decryptSecret(newPek, payload)).toBe("DATABASE_URL=postgres://...");
-    });
-    it("rejects wrong password", async () => {
-        const { wrapped } = await createWrappedProjectKey("correct");
-        await expect(unwrapProjectKey("wrong", wrapped)).rejects.toThrow();
-    });
-});
-describe("backup", () => {
-    it("creates portable encrypted backup and restores", async () => {
-        const { pek, wrapped } = await createWrappedProjectKey("backup-pass");
-        const payload = encryptSecret(pek, "secret-value");
-        const envelope = createBackupEnvelope({
-            projectName: "my-app",
-            wrappedProjectKey: wrapped,
-            secrets: [
-                {
-                    name: "API_KEY",
-                    environment: "Development",
-                    status: "active",
-                    expiresAt: null,
-                    payload,
-                },
-                {
-                    name: "PENDING_KEY",
-                    environment: "Production",
-                    status: "placeholder",
-                    expiresAt: null,
-                    payload: null,
-                },
-            ],
-        });
-        const raw = serializeBackup(envelope);
-        const parsed = parseBackup(raw);
-        const restored = await restoreSecretsFromBackup("backup-pass", parsed);
-        expect(restored[0]?.value).toBe("secret-value");
-        expect(restored[1]?.status).toBe("placeholder");
-        expect(restored[1]?.value).toBe("");
-        expect(raw).not.toContain("secret-value");
-    });
-});
-describe("development identity", () => {
-    it("signs and verifies access requests", () => {
-        const id = generateDevelopmentIdentity();
-        const msg = "request:abc:project:env";
-        const sig = signAccessRequest(id.privateKey, msg);
-        expect(verifyAccessRequest(id.publicKey, msg, sig)).toBe(true);
-        expect(verifyAccessRequest(id.publicKey, "tampered", sig)).toBe(false);
-    });
-});
-//# sourceMappingURL=envelope.test.js.map

package/dist/envelope.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"envelope.test.js","sourceRoot":"","sources":["../src/envelope.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,uBAAuB,CAAC,qBAAqB,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACtD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAE5D,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;QACzE,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,uBAAuB,CAAC,cAAc,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,cAAc,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QACjE,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;QACtC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,uBAAuB,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;IACtB,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,uBAAuB,CAAC,aAAa,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,WAAW,EAAE,QAAQ;YACrB,iBAAiB,EAAE,OAAO;YAC1B,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,aAAa;oBAC1B,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,IAAI;oBACf,OAAO;iBACR;gBACD;oBACE,IAAI,EAAE,aAAa;oBACnB,WAAW,EAAE,YAAY;oBACzB,MAAM,EAAE,aAAa;oBACrB,SAAS,EAAE,IAAI;oBACf,OAAO,EAAE,IAAI;iBACd;aACF;SACF,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACvE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAChD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,EAAE,GAAG,2BAA2B,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,yBAAyB,CAAC;QACtC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAClD,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}