getmyenv 0.1.1 → 0.3.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 getenv.dev
+Copyright (c) 2026 getmyenv
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -3,11 +3,19 @@
 CLI for [getmyenv](https://getmyenv.com) - encrypted environment variables for any language.
 
 ```bash
-npx getmyenv login
-npx getmyenv migrate
-npx getmyenv run -- npm start
+npx getmyenv token               # paste per-project token
+npx getmyenv link                # link this folder to the project
+npx getmyenv run -- npm run dev  # start app with secrets as env vars
 ```
 
-Create a token at https://getmyenv.com/cli, then `login` (or paste when a command asks). Login may offer to run `migrate`. Migrate searches this folder tree for `.env*` files (including `.env.example` / `.env.sample`) and lists candidates. Use `--file` to pick a path. Defaults to `https://getmyenv.com`. Use `login --api-url` or `--api-url` for another origin.
+Create a project at https://getmyenv.com/projects/new, create a per-project CLI token at https://getmyenv.com/cli, then paste it with `token`. Not a full account login. Daily Development work prefers `run`. `push` and `pull` ask for token and link if missing.
+
+- Development token: push / pull / restore / run. Push lists `.env*` files and skips any basename containing `production`.
+- Production token: read-only (`run` / `backup`). Set Production values in the dashboard.
+- Environment comes from token scope. Omit `-e` day to day.
+
+API defaults to `https://getmyenv.com`. Use `token --api-url` or `--api-url` for another origin.
+
+Commands: `token`, `link`, `push`, `pull`, `run`, `whoami`, `backup`, `restore`.
 
 See https://getmyenv.com/docs

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AA0BA,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAmI1D"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAgCA,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAmK1D"}

package/dist/cli.js

@@ -1,77 +1,102 @@
 import { Command } from "commander";
-import { initCommand } from "./commands/init.js";
-import { migrateCommand } from "./commands/migrate.js";
-import { addCommand } from "./commands/add.js";
-import { statusCommand } from "./commands/status.js";
-import { exportCommand } from "./commands/export.js";
 import { backupCommand } from "./commands/backup.js";
 import { restoreCommand } from "./commands/restore.js";
 import { runCommand } from "./commands/run.js";
-import { loginCommand } from "./commands/login.js";
-import { logoutCommand } from "./commands/logout.js";
+import { tokenCommand, tokenListCommand, tokenRemoveCommand, tokenUseCommand, } from "./commands/token.js";
+import { linkCommand } from "./commands/link.js";
+import { pushCommand } from "./commands/push.js";
+import { pullCommand } from "./commands/pull.js";
+import { whoamiCommand } from "./commands/whoami.js";
 import { normalizeEnvName } from "./lib/env-name.js";
 import { resolveApiUrl } from "./lib/api.js";
+import { readProjectMeta } from "./lib/fs.js";
+function envWasDefaultFromArgv() {
+    return !process.argv.includes("-e") && !process.argv.includes("--env");
+}
+function defaultEnvOption() {
+    const meta = readProjectMeta();
+    return meta?.defaultEnv ?? "development";
+}
 const ENV_OPTION = [
     "-e, --env <name>",
-    "Environment (lowercase, e.g. development or production)",
-    "development",
+    "Environment (must match token scope; omit to use the token)",
 ];
-function withNormalizedEnv(fn) {
-    return (opts) => fn({ ...opts, env: normalizeEnvName(opts.env) });
-}
 export async function runCli(argv) {
     const apiDefault = resolveApiUrl();
     const program = new Command();
     program
         .name("getmyenv")
         .description("Keep using environment variables. Stop managing them as files.")
-        .version("0.1.1");
-    program
-        .command("login")
-        .description("Save a dashboard CLI token (paste once; no shell env needed)")
+        .version("0.3.0");
+    const token = program
+        .command("token")
+        .description("Save a per-project CLI token on this machine (not a full account login)")
         .option("--api-url <url>", "API base URL to remember (default production)")
-        .action(loginCommand);
+        .action((opts) => tokenCommand(opts));
+    token
+        .command("list")
+        .description("List saved per-project tokens")
+        .action(() => tokenListCommand());
+    token
+        .command("use <nameOrId>")
+        .description("Set the default saved token")
+        .action((nameOrId) => tokenUseCommand(nameOrId));
+    token
+        .command("remove")
+        .description("Remove a saved per-project token")
+        .option("--project <name|id>", "Remove token for a specific project")
+        .option("--all", "Remove all saved tokens")
+        .option("--fresh", "Also clear local .getmyenv/wrapped-key.json")
+        .action(tokenRemoveCommand);
     program
-        .command("logout")
-        .description("Clear the saved CLI token")
-        .action(logoutCommand);
-    program
-        .command("init")
-        .description("Detect expected environment variable names across languages (never collects values)")
-        .action(initCommand);
+        .command("link [projectId]")
+        .description("Link this folder to the token's project")
+        .option("--name <name>", "Expect project name (exact or unique substring)")
+        .option("--expect <name>", "Alias for --name")
+        .option("--env <name>", "Set defaultEnv (must match token scope)")
+        .option("--force", "Replace an existing link without prompting")
+        .option("--clear", "Remove the linked project from this folder")
+        .option("--api-url <url>", "API base URL", apiDefault)
+        .action((projectId, opts) => linkCommand(projectId, opts));
     program
-        .command("migrate")
-        .description("Encrypt an .env* file locally and upload (searches this folder tree)")
+        .command("push")
+        .description("Encrypt local secrets and upload to the linked token project")
         .option(...ENV_OPTION)
-        .option("-f, --file <path>", "Path to .env file to migrate")
+        .option("-f, --file <path>", "Path to .env file to push")
+        .option("-k, --key <NAME=VALUE>", "Push a single secret (NAME or NAME=VALUE)")
+        .option("--create", "If unlinked, write project.json from the token then upload")
+        .option("--prune", "Delete hosted secrets that are not in the local file")
+        .option("--yes", "Apply changes without prompting on conflicts")
+        .option("--dry-run", "Show what would change without uploading")
         .option("--api-url <url>", "API base URL", apiDefault)
         .option("--vault-password-stdin", "Read vault password from stdin (non-interactive)")
-        .action((opts) => migrateCommand({
+        .action((opts) => pushCommand({
         ...opts,
-        env: normalizeEnvName(opts.env),
-        envWasDefault: !process.argv.includes("-e") && !process.argv.includes("--env"),
+        env: normalizeEnvName(opts.env ?? defaultEnvOption()),
+        envWasDefault: envWasDefaultFromArgv(),
     }));
     program
-        .command("add <name>")
-        .description("Add a secret via secure interactive input (never pass values on the CLI)")
-        .option(...ENV_OPTION)
-        .option("--api-url <url>", "API base URL", apiDefault)
-        .option("--vault-password-stdin", "Read vault password from stdin (non-interactive)")
-        .action((name, opts) => addCommand(name, { ...opts, env: normalizeEnvName(opts.env) }));
-    program
-        .command("status")
-        .description("Show secret status for the current project")
-        .option(...ENV_OPTION)
-        .option("--api-url <url>", "API base URL", apiDefault)
-        .action(withNormalizedEnv(statusCommand));
-    program
-        .command("export")
-        .description("Export secrets to a plaintext .env file")
+        .command("pull")
+        .description("Download secrets to a plaintext .env file")
         .option(...ENV_OPTION)
         .option("-o, --output <file>", "Output file", ".env")
+        .option("--to <file>", "Alias for --output")
+        .option("--stdout", "Write to stdout instead of a file")
+        .option("--yes", "Overwrite conflicting local values without prompting")
+        .option("--merge", "Only fill missing keys; keep local values")
+        .option("--dry-run", "Show what would change without writing")
         .option("--api-url <url>", "API base URL", apiDefault)
         .option("--vault-password-stdin", "Read vault password from stdin (non-interactive)")
-        .action(withNormalizedEnv(exportCommand));
+        .action((opts) => pullCommand({
+        ...opts,
+        env: normalizeEnvName(opts.env ?? defaultEnvOption()),
+        envWasDefault: envWasDefaultFromArgv(),
+    }));
+    program
+        .command("whoami")
+        .description("Show the active CLI token, project, and defaults")
+        .option("--api-url <url>", "API base URL")
+        .action(whoamiCommand);
     program
         .command("backup")
         .description("Create a portable encrypted .getmyenv backup")
@@ -80,14 +105,14 @@ export async function runCli(argv) {
         .action(backupCommand);
     program
         .command("restore <file>")
-        .description("Restore from an encrypted .getmyenv backup (creates a new project by default)")
+        .description("Restore from an encrypted .getmyenv backup into the token's project")
         .option("--api-url <url>", "API base URL", apiDefault)
-        .option("--into-linked", "Overwrite the project linked in the current directory")
+        .option("--into-linked", "Require a linked folder (restore still targets the token project)")
         .option("--vault-password-stdin", "Read vault password from stdin (non-interactive)")
         .action(restoreCommand);
     program
         .command("run")
-        .description("Decrypt authorized secrets and run a command with the secrets available as environment variables")
+        .description("Decrypt authorized secrets and run a command (token picks Development or Production)")
         .option(...ENV_OPTION)
         .option("--api-url <url>", "API base URL", apiDefault)
         .option("--vault-password-stdin", "Read vault password from stdin (non-interactive)")
@@ -95,10 +120,15 @@ export async function runCli(argv) {
         .allowExcessArguments(true)
         .action(async (opts, cmd) => {
         const args = cmd.args;
-        // Support: getmyenv run -- npm start
+        // Support: getmyenv run -- npm run dev
         const dashIdx = process.argv.indexOf("--");
         const childArgs = dashIdx >= 0 ? process.argv.slice(dashIdx + 1) : args;
-        await runCommand({ ...opts, env: normalizeEnvName(opts.env) }, childArgs);
+        await runCommand({
+            ...opts,
+            env: normalizeEnvName(opts.env ?? defaultEnvOption()),
+            envWasDefault: envWasDefaultFromArgv(),
+            apiUrl: opts.apiUrl ?? apiDefault,
+        }, childArgs);
     });
     await program.parseAsync(argv);
 }

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,UAAU,GAAG;IACjB,kBAAkB;IAClB,yDAAyD;IACzD,aAAa;CACL,CAAC;AAEX,SAAS,iBAAiB,CACxB,EAA8B;IAE9B,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc;IACzC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO;SACJ,IAAI,CAAC,UAAU,CAAC;SAChB,WAAW,CACV,gEAAgE,CACjE;SACA,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,8DAA8D,CAAC;SAC3E,MAAM,CAAC,iBAAiB,EAAE,+CAA+C,CAAC;SAC1E,MAAM,CAAC,YAAY,CAAC,CAAC;IAExB,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,2BAA2B,CAAC;SACxC,MAAM,CAAC,aAAa,CAAC,CAAC;IAEzB,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,qFAAqF,CACtF;SACA,MAAM,CAAC,WAAW,CAAC,CAAC;IAEvB,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CACV,sEAAsE,CACvE;SACA,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,mBAAmB,EAAE,8BAA8B,CAAC;SAC3D,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC;SACrD,MAAM,CACL,wBAAwB,EACxB,kDAAkD,CACnD;SACA,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACf,cAAc,CAAC;QACb,GAAG,IAAI;QACP,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/B,aAAa,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;KAC/E,CAAC,CACH,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CACV,0EAA0E,CAC3E;SACA,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC;SACrD,MAAM,CACL,wBAAwB,EACxB,kDAAkD,CACnD;SACA,MAAM,CAAC,CAAC,IAAY,EAAE,IAAmE,EAAE,EAAE,CAC5F,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAC/D,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4CAA4C,CAAC;SACzD,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC;SACrD,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC;IAE5C,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,yCAAyC,CAAC;SACtD,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,qBAAqB,EAAE,aAAa,EAAE,MAAM,CAAC;SACpD,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC;SACrD,MAAM,CACL,wBAAwB,EACxB,kDAAkD,CACnD;SACA,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC;IAE5C,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,8CAA8C,CAAC;SAC3D,MAAM,CAAC,qBAAqB,EAAE,aAAa,CAAC;SAC5C,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC;SACrD,MAAM,CAAC,aAAa,CAAC,CAAC;IAEzB,OAAO;SACJ,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CACV,+EAA+E,CAChF;SACA,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC;SACrD,MAAM,CACL,eAAe,EACf,uDAAuD,CACxD;SACA,MAAM,CACL,wBAAwB,EACxB,kDAAkD,CACnD;SACA,MAAM,CAAC,cAAc,CAAC,CAAC;IAE1B,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CACV,kGAAkG,CACnG;SACA,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC;SACrD,MAAM,CACL,wBAAwB,EACxB,kDAAkD,CACnD;SACA,kBAAkB,CAAC,IAAI,CAAC;SACxB,oBAAoB,CAAC,IAAI,CAAC;SAC1B,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAgB,CAAC;QAClC,qCAAqC;QACrC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,MAAM,UAAU,CACd,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAC5C,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,SAAS,qBAAqB;IAC5B,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,OAAO,IAAI,EAAE,UAAU,IAAI,aAAa,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,GAAG;IACjB,kBAAkB;IAClB,6DAA6D;CACrD,CAAC;AAEX,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc;IACzC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO;SACJ,IAAI,CAAC,UAAU,CAAC;SAChB,WAAW,CACV,gEAAgE,CACjE;SACA,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB,MAAM,KAAK,GAAG,OAAO;SAClB,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CACV,yEAAyE,CAC1E;SACA,MAAM,CAAC,iBAAiB,EAAE,+CAA+C,CAAC;SAC1E,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAExC,KAAK;SACF,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAEpC,KAAK;SACF,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,6BAA6B,CAAC;SAC1C,MAAM,CAAC,CAAC,QAAgB,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE3D,KAAK;SACF,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,qBAAqB,EAAE,qCAAqC,CAAC;SACpE,MAAM,CAAC,OAAO,EAAE,yBAAyB,CAAC;SAC1C,MAAM,CAAC,SAAS,EAAE,6CAA6C,CAAC;SAChE,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAE9B,OAAO;SACJ,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,yCAAyC,CAAC;SACtD,MAAM,CAAC,eAAe,EAAE,iDAAiD,CAAC;SAC1E,MAAM,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;SAC7C,MAAM,CAAC,cAAc,EAAE,yCAAyC,CAAC;SACjE,MAAM,CAAC,SAAS,EAAE,4CAA4C,CAAC;SAC/D,MAAM,CAAC,SAAS,EAAE,4CAA4C,CAAC;SAC/D,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC;SACrD,MAAM,CAAC,CAAC,SAA6B,EAAE,IAAI,EAAE,EAAE,CAC9C,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAC7B,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,8DAA8D,CAC/D;SACA,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;SACxD,MAAM,CAAC,wBAAwB,EAAE,2CAA2C,CAAC;SAC7E,MAAM,CACL,UAAU,EACV,4DAA4D,CAC7D;SACA,MAAM,CACL,SAAS,EACT,sDAAsD,CACvD;SACA,MAAM,CAAC,OAAO,EAAE,8CAA8C,CAAC;SAC/D,MAAM,CAAC,WAAW,EAAE,0CAA0C,CAAC;SAC/D,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC;SACrD,MAAM,CACL,wBAAwB,EACxB,kDAAkD,CACnD;SACA,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACf,WAAW,CAAC;QACV,GAAG,IAAI;QACP,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACrD,aAAa,EAAE,qBAAqB,EAAE;KACvC,CAAC,CACH,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,2CAA2C,CAAC;SACxD,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,qBAAqB,EAAE,aAAa,EAAE,MAAM,CAAC;SACpD,MAAM,CAAC,aAAa,EAAE,oBAAoB,CAAC;SAC3C,MAAM,CAAC,UAAU,EAAE,mCAAmC,CAAC;SACvD,MAAM,CAAC,OAAO,EAAE,sDAAsD,CAAC;SACvE,MAAM,CAAC,SAAS,EAAE,2CAA2C,CAAC;SAC9D,MAAM,CAAC,WAAW,EAAE,wCAAwC,CAAC;SAC7D,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC;SACrD,MAAM,CACL,wBAAwB,EACxB,kDAAkD,CACnD;SACA,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACf,WAAW,CAAC;QACV,GAAG,IAAI;QACP,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACrD,aAAa,EAAE,qBAAqB,EAAE;KACvC,CAAC,CACH,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,kDAAkD,CAAC;SAC/D,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC;SACzC,MAAM,CAAC,aAAa,CAAC,CAAC;IAEzB,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,8CAA8C,CAAC;SAC3D,MAAM,CAAC,qBAAqB,EAAE,aAAa,CAAC;SAC5C,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC;SACrD,MAAM,CAAC,aAAa,CAAC,CAAC;IAEzB,OAAO;SACJ,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CACV,qEAAqE,CACtE;SACA,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC;SACrD,MAAM,CACL,eAAe,EACf,mEAAmE,CACpE;SACA,MAAM,CACL,wBAAwB,EACxB,kDAAkD,CACnD;SACA,MAAM,CAAC,cAAc,CAAC,CAAC;IAE1B,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CACV,sFAAsF,CACvF;SACA,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC;SACrD,MAAM,CACL,wBAAwB,EACxB,kDAAkD,CACnD;SACA,kBAAkB,CAAC,IAAI,CAAC;SACxB,oBAAoB,CAAC,IAAI,CAAC;SAC1B,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAgB,CAAC;QAClC,uCAAuC;QACvC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,MAAM,UAAU,CACd;YACE,GAAG,IAAI;YACP,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,IAAI,gBAAgB,EAAE,CAAC;YACrD,aAAa,EAAE,qBAAqB,EAAE;YACtC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,UAAU;SAClC,EACD,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC"}

package/dist/commands/backup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/commands/backup.ts"],"names":[],"mappings":"AAYA,KAAK,UAAU,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA4CnE"}
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/commands/backup.ts"],"names":[],"mappings":"AAiBA,KAAK,UAAU,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA2DnE"}

package/dist/commands/backup.js

@@ -2,16 +2,22 @@ import fs from "node:fs";
 import path from "node:path";
 import pc from "picocolors";
 import { createBackupEnvelope, parsePayload, parseWrappedKey, serializeBackup, } from "@getmyenv/crypto";
-import { readProjectMeta } from "../lib/fs.js";
-import { ApiClient, ensureSessionToken } from "../lib/api.js";
+import { readProjectMeta, requireLinkedProject } from "../lib/fs.js";
+import { ApiClient, ensureSessionToken, resolveApiUrl, } from "../lib/api.js";
 export async function backupCommand(opts) {
     console.log(pc.bold("\ngetmyenv backup\n"));
     const meta = readProjectMeta();
-    if (!meta?.projectId) {
-        throw new Error("Linked project required for backup. Run migrate first, then npx getmyenv login if needed.");
+    requireLinkedProject(meta);
+    const token = await ensureSessionToken(meta.projectId);
+    const apiUrl = resolveApiUrl(opts.apiUrl, meta.projectId);
+    const client = new ApiClient(apiUrl, token);
+    const who = await client.request("GET", "/api/cli/whoami");
+    if (String(meta.projectId) !== String(who.projectId)) {
+        throw new Error([
+            `Linked project (${meta.projectName ?? meta.projectId}) does not match this token (${who.projectName}, ${who.projectId}).`,
+            "Run: npx getmyenv link",
+        ].join("\n"));
     }
-    const token = await ensureSessionToken();
-    const client = new ApiClient(opts.apiUrl, token);
     const data = await client.request("GET", `/api/cli/projects/${meta.projectId}/backup`);
     const envelope = createBackupEnvelope({
         projectName: data.projectName,
@@ -30,6 +36,9 @@ export async function backupCommand(opts) {
         path.join(process.cwd(), `${data.projectName.replace(/\s+/g, "-").toLowerCase()}.getmyenv`);
     fs.writeFileSync(out, serializeBackup(envelope), { mode: 0o600 });
     console.log(`${pc.green("✓")} Wrote encrypted backup: ${out}`);
+    if (meta.defaultEnv) {
+        console.log(pc.dim(`Linked defaultEnv: ${meta.defaultEnv}`));
+    }
     console.log(pc.dim("Portable. No plaintext. Usable offline with your vault password.\n"));
 }
 //# sourceMappingURL=backup.js.map

package/dist/commands/backup.js.map

@@ -1 +1 @@
-{"version":3,"file":"backup.js","sourceRoot":"","sources":["../../src/commands/backup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAI9D,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAgB;IAClD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAEzC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAU9B,KAAK,EAAE,qBAAqB,IAAI,CAAC,SAAS,SAAS,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACpC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC1E,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,OAAO,EACL,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa;gBAChD,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC;gBAC5B,CAAC,CAAC,IAAI;SACX,CAAC,CAAC;KACJ,CAAC,CAAC;IAEH,MAAM,GAAG,GACP,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC9F,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC,CAAC;AAC5F,CAAC"}
+{"version":3,"file":"backup.js","sourceRoot":"","sources":["../../src/commands/backup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EACL,SAAS,EACT,kBAAkB,EAClB,aAAa,GAEd,MAAM,eAAe,CAAC;AAIvB,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAgB;IAClD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAE1D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAiB,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb;YACE,mBAAmB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,SAAS,gCAAgC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,SAAS,IAAI;YAC1H,wBAAwB;SACzB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAU9B,KAAK,EAAE,qBAAqB,IAAI,CAAC,SAAS,SAAS,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACpC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC1E,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,OAAO,EACL,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa;gBAChD,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC;gBAC5B,CAAC,CAAC,IAAI;SACX,CAAC,CAAC;KACJ,CAAC,CAAC;IAEH,MAAM,GAAG,GACP,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,IAAI,CACP,OAAO,CAAC,GAAG,EAAE,EACb,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAClE,CAAC;IACJ,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAC7E,CAAC;AACJ,CAAC"}

package/dist/commands/link.d.ts

@@ -0,0 +1,16 @@
+type LinkOpts = {
+    apiUrl?: string;
+    name?: string;
+    expect?: string;
+    force?: boolean;
+    clear?: boolean;
+    env?: string;
+    /** When true, do not offer push after link (caller is already pushing). */
+    skipPushOffer?: boolean;
+};
+/** Clear the linked project from this folder (link --clear). */
+export declare function clearLink(): Promise<void>;
+/** Link this folder to the project bound to the saved CLI token. */
+export declare function linkCommand(_projectIdArg: string | undefined, opts: LinkOpts): Promise<void>;
+export {};
+//# sourceMappingURL=link.d.ts.map

package/dist/commands/link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link.d.ts","sourceRoot":"","sources":["../../src/commands/link.ts"],"names":[],"mappings":"AAmBA,KAAK,QAAQ,GAAG;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,gEAAgE;AAChE,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAqB/C;AAED,oEAAoE;AACpE,wBAAsB,WAAW,CAC/B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC,IAAI,CAAC,CA6If"}

package/dist/commands/link.js

@@ -0,0 +1,116 @@
+import pc from "picocolors";
+import { ensureGitignoreHasEnv, listPushEnvFiles, promptConfirm, readProjectMeta, writeProjectMeta, } from "../lib/fs.js";
+import { ApiClient, ensureSessionToken, getSessionToken, resolveApiUrl, } from "../lib/api.js";
+import { normalizeEnvName } from "../lib/env-name.js";
+import { tokenCommand } from "./token.js";
+import { pushCommand } from "./push.js";
+/** Clear the linked project from this folder (link --clear). */
+export async function clearLink() {
+    console.log(pc.bold("\ngetmyenv link --clear\n"));
+    const meta = readProjectMeta();
+    if (!meta?.projectId) {
+        console.log(pc.dim("No project is linked to this folder.\n"));
+        return;
+    }
+    if (process.stdin.isTTY) {
+        const ok = await promptConfirm(`Unlink ${meta.projectName ?? meta.projectId}?`, { defaultYes: false });
+        if (!ok) {
+            console.log(pc.dim("Kept link.\n"));
+            return;
+        }
+    }
+    const { projectId: _id, projectName: _name, defaultEnv: _env, ...rest } = meta;
+    writeProjectMeta(rest);
+    console.log(`${pc.green("✓")} Unlinked. Local .getmyenv metadata kept.\n`);
+}
+/** Link this folder to the project bound to the saved CLI token. */
+export async function linkCommand(_projectIdArg, opts) {
+    if (opts.clear) {
+        await clearLink();
+        return;
+    }
+    console.log(pc.bold("\ngetmyenv link\n"));
+    if (!getSessionToken()) {
+        if (!process.stdin.isTTY) {
+            throw new Error("No CLI token. Run: npx getmyenv token");
+        }
+        await tokenCommand({
+            apiUrl: opts.apiUrl,
+            skipLinkOffer: true,
+        });
+    }
+    const token = await ensureSessionToken();
+    const apiUrl = resolveApiUrl(opts.apiUrl);
+    const client = new ApiClient(apiUrl, token);
+    const who = await client.request("GET", "/api/cli/whoami");
+    const expectName = opts.expect?.trim() || opts.name?.trim();
+    if (expectName) {
+        const needle = expectName.toLowerCase();
+        const matches = who.projectName.toLowerCase() === needle ||
+            who.projectName.toLowerCase().includes(needle) ||
+            String(who.projectId) === expectName;
+        if (!matches) {
+            throw new Error(`Token project "${who.projectName}" (${who.projectId}) does not match --expect ${expectName}`);
+        }
+    }
+    let defaultEnv = who.cliScope === "production" ? "production" : "development";
+    if (opts.env?.trim()) {
+        const requested = normalizeEnvName(opts.env);
+        if (requested !== who.cliScope) {
+            throw new Error(`Token scope is ${who.cliScope}, but --env ${requested} was passed. Use a matching token or omit --env.`);
+        }
+        defaultEnv = requested;
+    }
+    const meta = readProjectMeta() ?? {};
+    if (meta.projectId && String(meta.projectId) !== String(who.projectId)) {
+        console.log(pc.yellow(`This folder is linked to ${meta.projectName ?? meta.projectId}.`));
+        console.log(pc.dim(`Token is for ${who.projectName} (${who.projectId}, ${who.cliScope}).\n`));
+        if (!opts.force) {
+            if (!process.stdin.isTTY) {
+                throw new Error("Already linked to a different project. Re-run with --force, or: npx getmyenv link --clear");
+            }
+            const ok = await promptConfirm("Replace with token project?", {
+                defaultYes: false,
+            });
+            if (!ok) {
+                console.log(pc.dim("Kept existing link.\n"));
+                return;
+            }
+        }
+    }
+    writeProjectMeta({
+        ...meta,
+        projectId: who.projectId,
+        projectName: who.projectName,
+        apiUrl,
+        defaultEnv,
+    });
+    ensureGitignoreHasEnv();
+    console.log(`${pc.green("✓")} Linked to ${pc.bold(who.projectName)} (${who.projectId})`);
+    console.log(pc.dim(`Token scope: ${who.cliScope}`));
+    console.log(pc.dim(`defaultEnv: ${defaultEnv}`));
+    if (who.cliScope === "production") {
+        console.log(pc.dim("Next: npx getmyenv run -- <cmd>  # start app with secrets as env vars (Production is read-only)\n"));
+        return;
+    }
+    if (opts.skipPushOffer || !process.stdin.isTTY) {
+        console.log(pc.dim("Next: npx getmyenv run -- <cmd>  # start app with secrets as env vars\n"));
+        return;
+    }
+    const pushable = listPushEnvFiles();
+    if (pushable.length === 0) {
+        console.log(pc.dim("Next: npx getmyenv run -- <cmd>  # start app with secrets as env vars\n"));
+        return;
+    }
+    const doPush = await promptConfirm("Push and migrate a local .env file now?", { defaultYes: true });
+    if (!doPush) {
+        console.log(pc.dim("When you are ready: npx getmyenv run -- <cmd>  # start app with secrets as env vars\n"));
+        return;
+    }
+    await pushCommand({
+        env: who.cliScope,
+        apiUrl,
+        envWasDefault: true,
+    });
+}
+//# sourceMappingURL=link.js.map

package/dist/commands/link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link.js","sourceRoot":"","sources":["../../src/commands/link.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,SAAS,EACT,kBAAkB,EAClB,eAAe,EACf,aAAa,GAEd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAaxC,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,MAAM,aAAa,CAC5B,UAAU,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,SAAS,GAAG,EAC/C,EAAE,UAAU,EAAE,KAAK,EAAE,CACtB,CAAC;QACF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;IACH,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GACrE,IAAI,CAAC;IACP,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;AAC7E,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,aAAiC,EACjC,IAAc;IAEd,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,SAAS,EAAE,CAAC;QAClB,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAE1C,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,YAAY,CAAC;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAiB,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAE3E,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,OAAO,GACX,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM;YACxC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,UAAU,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,CAAC,WAAW,MAAM,GAAG,CAAC,SAAS,6BAA6B,UAAU,EAAE,CAC9F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,UAAU,GACZ,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC;IAE/D,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAE3B,CAAC;QACjB,IAAI,SAAS,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,CAAC,QAAQ,eAAe,SAAS,kDAAkD,CACzG,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,SAAS,CAAC;IACzB,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC;IACrC,IAAI,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACvE,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,MAAM,CACP,4BAA4B,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,SAAS,GAAG,CAClE,CACF,CAAC;QACF,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CACJ,gBAAgB,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,QAAQ,MAAM,CACzE,CACF,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,6BAA6B,EAAE;gBAC5D,UAAU,EAAE,KAAK;aAClB,CAAC,CAAC;YACH,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC;QACf,GAAG,IAAI;QACP,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,MAAM;QACN,UAAU;KACX,CAAC,CAAC;IACH,qBAAqB,EAAE,CAAC;IAExB,OAAO,CAAC,GAAG,CACT,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,GAAG,CAAC,SAAS,GAAG,CAC5E,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,UAAU,EAAE,CAAC,CAAC,CAAC;IAEjD,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CACJ,mGAAmG,CACpG,CACF,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CACJ,yEAAyE,CAC1E,CACF,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CACJ,yEAAyE,CAC1E,CACF,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,yCAAyC,EACzC,EAAE,UAAU,EAAE,IAAI,EAAE,CACrB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CACJ,uFAAuF,CACxF,CACF,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,WAAW,CAAC;QAChB,GAAG,EAAE,GAAG,CAAC,QAAQ;QACjB,MAAM;QACN,aAAa,EAAE,IAAI;KACpB,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/pull.d.ts

@@ -0,0 +1,15 @@
+type PullOpts = {
+    env: string;
+    output?: string;
+    to?: string;
+    stdout?: boolean;
+    yes?: boolean;
+    merge?: boolean;
+    dryRun?: boolean;
+    apiUrl: string;
+    vaultPasswordStdin?: boolean;
+    envWasDefault?: boolean;
+};
+export declare function pullCommand(opts: PullOpts): Promise<void>;
+export {};
+//# sourceMappingURL=pull.d.ts.map

package/dist/commands/pull.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAmBA,KAAK,QAAQ,GAAG;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,wBAAsB,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CA4K/D"}

package/dist/commands/pull.js

@@ -0,0 +1,157 @@
+import fs from "node:fs";
+import pc from "picocolors";
+import { decryptSecret, parsePayload, } from "@getmyenv/crypto";
+import { EXPORT_WARNING } from "@getmyenv/shared";
+import { parseEnvFile, promptHidden, readProjectMeta, } from "../lib/fs.js";
+import { ApiClient } from "../lib/api.js";
+import { unwrapPek } from "../lib/pek.js";
+import { confirmDiff } from "../lib/confirm.js";
+import { normalizeEnvName } from "../lib/env-name.js";
+import { ensureTokenAndLink } from "../lib/bootstrap.js";
+export async function pullCommand(opts) {
+    console.log(pc.bold("\ngetmyenv pull\n"));
+    console.log(pc.yellow(EXPORT_WARNING));
+    console.log("");
+    const { who, apiUrl, token, projectId } = await ensureTokenAndLink({
+        apiUrl: opts.apiUrl,
+        action: "pull",
+    });
+    if (who.cliScope === "production") {
+        throw new Error([
+            "Production CLI is read-only.",
+            "Use npx getmyenv run to pass secrets as env vars without writing them to disk.",
+            "Set or change Production values in the dashboard.",
+        ].join("\n"));
+    }
+    const meta = readProjectMeta();
+    let environment = normalizeEnvName(opts.env);
+    if (opts.envWasDefault && meta?.defaultEnv) {
+        environment = meta.defaultEnv;
+    }
+    if (environment !== who.cliScope) {
+        if (opts.envWasDefault) {
+            environment = who.cliScope;
+        }
+        else {
+            throw new Error([
+                `Token scope is ${who.cliScope}, but you passed -e ${environment}.`,
+                "Use a matching token or omit -e.",
+            ].join("\n"));
+        }
+    }
+    const password = await promptHidden("Vault password: ", {
+        allowStdin: opts.vaultPasswordStdin,
+    });
+    const client = new ApiClient(apiUrl, token);
+    const data = await client.request("GET", `/api/cli/projects/${projectId}/export?environment=${encodeURIComponent(environment)}`);
+    const pek = await unwrapPek({
+        password,
+        scope: who.cliScope,
+        wrapped: data.wrappedProjectKey,
+    });
+    const remote = {};
+    const lines = [
+        "# Pulled by getmyenv - PLAINTEXT SECRETS",
+        `# Environment: ${environment}`,
+        "# Do not commit this file.",
+        "",
+    ];
+    for (const secret of data.secrets) {
+        if (secret.status === "revoked") {
+            lines.push("# revoked - getmyenv is not providing this");
+            continue;
+        }
+        if (secret.status === "placeholder" ||
+            secret.ciphertext == null ||
+            secret.ciphertext === "") {
+            lines.push(`# placeholder - no value yet`);
+            lines.push(`${secret.name}=`);
+            continue;
+        }
+        const value = decryptSecret(pek, parsePayload(secret.ciphertext));
+        remote[secret.name] = value;
+        lines.push(`${secret.name}=${value}`);
+    }
+    if (opts.stdout) {
+        process.stdout.write(lines.join("\n") + "\n");
+        return;
+    }
+    const outPath = opts.to || opts.output || ".env";
+    const exists = fs.existsSync(outPath);
+    const local = exists ? parseEnvFile(outPath) : {};
+    if (opts.dryRun) {
+        console.log(pc.dim(`Dry run - would write ${outPath}\n`));
+        for (const name of Object.keys(remote)) {
+            if (!(name in local))
+                console.log(`  + ${name}`);
+            else if (local[name] !== remote[name])
+                console.log(`  ~ ${name}`);
+            else
+                console.log(`  = ${name}`);
+        }
+        for (const name of Object.keys(local)) {
+            if (!(name in remote))
+                console.log(`  - ${name} (local only)`);
+        }
+        console.log("");
+        return;
+    }
+    if (opts.merge && exists) {
+        const merged = { ...local };
+        for (const [name, value] of Object.entries(remote)) {
+            if (!(name in merged) || merged[name] === "") {
+                merged[name] = value;
+            }
+        }
+        const mergedLines = [
+            "# Pulled by getmyenv - PLAINTEXT SECRETS (merged)",
+            `# Environment: ${environment}`,
+            "# Do not commit this file.",
+            "",
+            ...Object.entries(merged).map(([k, v]) => `${k}=${v}`),
+        ];
+        fs.writeFileSync(outPath, mergedLines.join("\n") + "\n", { mode: 0o600 });
+        console.log(`${pc.green("✓")} Merged into ${outPath}`);
+        console.log(pc.dim("Your secrets are yours. Protect this file.\n"));
+        return;
+    }
+    const conflicts = [];
+    for (const [name, value] of Object.entries(remote)) {
+        if (name in local && local[name] !== value) {
+            conflicts.push({ name, detail: "local differs from remote" });
+        }
+    }
+    if (conflicts.length > 0) {
+        const ok = await confirmDiff({
+            conflicts,
+            action: "Overwrite conflicting local values",
+            yes: opts.yes,
+        });
+        if (!ok) {
+            console.log(pc.dim("Pull cancelled.\n"));
+            return;
+        }
+    }
+    if (exists && conflicts.length === 0 && Object.keys(local).length > 0) {
+        const remoteKeys = new Set(Object.keys(remote));
+        const localOnly = Object.keys(local).filter((k) => !remoteKeys.has(k));
+        if (localOnly.length > 0 && !opts.yes) {
+            const ok = await confirmDiff({
+                conflicts: localOnly.map((name) => ({
+                    name,
+                    detail: "present locally, absent remotely (will be dropped)",
+                })),
+                action: "Replace local file",
+                yes: opts.yes,
+            });
+            if (!ok) {
+                console.log(pc.dim("Pull cancelled.\n"));
+                return;
+            }
+        }
+    }
+    fs.writeFileSync(outPath, lines.join("\n") + "\n", { mode: 0o600 });
+    console.log(`${pc.green("✓")} Wrote ${outPath}`);
+    console.log(pc.dim("Your secrets are yours. Protect this file.\n"));
+}
+//# sourceMappingURL=pull.js.map