getmyenv 0.1.1 → 0.3.0

package/dist/commands/pull.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pull.js","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EACL,aAAa,EACb,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAgBzD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAc;IAC9C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC;QACjE,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM,EAAE,MAAM;KACf,CAAC,CAAC;IAEH,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb;YACE,8BAA8B;YAC9B,gFAAgF;YAChF,mDAAmD;SACpD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC;QAC3C,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC;IAChC,CAAC;IACD,IAAI,WAAW,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb;gBACE,kBAAkB,GAAG,CAAC,QAAQ,uBAAuB,WAAW,GAAG;gBACnE,kCAAkC;aACnC,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,kBAAkB,EAAE;QACtD,UAAU,EAAE,IAAI,CAAC,kBAAkB;KACpC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAE5C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAI/B,KAAK,EACL,qBAAqB,SAAS,uBAAuB,kBAAkB,CAAC,WAAW,CAAC,EAAE,CACvF,CAAC;IAEF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;QAC1B,QAAQ;QACR,KAAK,EAAE,GAAG,CAAC,QAAQ;QACnB,OAAO,EAAE,IAAI,CAAC,iBAAiB;KAChC,CAAC,CAAC;IAEH,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAa;QACtB,0CAA0C;QAC1C,kBAAkB,WAAW,EAAE;QAC/B,4BAA4B;QAC5B,EAAE;KACH,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YACzD,SAAS;QACX,CAAC;QACD,IACE,MAAM,CAAC,MAAM,KAAK,aAAa;YAC/B,MAAM,CAAC,UAAU,IAAI,IAAI;YACzB,MAAM,CAAC,UAAU,KAAK,EAAE,EACxB,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CACzB,GAAG,EACH,YAAY,CAAC,MAAM,CAAC,UAAoB,CAAC,CAC1C,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;IACjD,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,yBAAyB,OAAO,IAAI,CAAC,CAAC,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;iBAC5C,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;;gBAC7D,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7C,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YACvB,CAAC;QACH,CAAC;QACD,MAAM,WAAW,GAAG;YAClB,mDAAmD;YACnD,kBAAkB,WAAW,EAAE;YAC/B,4BAA4B;YAC5B,EAAE;YACF,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;SACvD,CAAC;QACF,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAwC,EAAE,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,IAAI,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;YAC3C,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC;YAC3B,SAAS;YACT,MAAM,EAAE,oCAAoC;YAC5C,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;IACH,CAAC;IAED,IAAI,MAAM,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACtC,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC;gBAC3B,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAClC,IAAI;oBACJ,MAAM,EAAE,oDAAoD;iBAC7D,CAAC,CAAC;gBACH,MAAM,EAAE,oBAAoB;gBAC5B,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAC;YACH,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAED,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC,CAAC;AACtE,CAAC"}

package/dist/commands/push.d.ts

@@ -0,0 +1,15 @@
+type PushOpts = {
+    env: string;
+    apiUrl: string;
+    file?: string;
+    key?: string;
+    create?: boolean;
+    prune?: boolean;
+    yes?: boolean;
+    dryRun?: boolean;
+    vaultPasswordStdin?: boolean;
+    envWasDefault?: boolean;
+};
+export declare function pushCommand(opts: PushOpts): Promise<void>;
+export {};
+//# sourceMappingURL=push.d.ts.map

package/dist/commands/push.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../src/commands/push.ts"],"names":[],"mappings":"AA6BA,KAAK,QAAQ,GAAG;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AA+LF,wBAAsB,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CA8I/D"}

package/dist/commands/push.js

@@ -0,0 +1,259 @@
+import fs from "node:fs";
+import path from "node:path";
+import pc from "picocolors";
+import { encryptSecret, serializePayload } from "@getmyenv/crypto";
+import { secretNameSchema } from "@getmyenv/shared";
+import { detectLanguages, ensureGitignoreHasEnv, envReadSnippet, inferEnvNameFromFile, isEnvSampleFile, isProductionEnvFilename, listPushEnvFiles, parseEnvFile, promptChoice, promptConfirm, promptHidden, readProjectMeta, writeProjectMeta, } from "../lib/fs.js";
+import { ApiClient, ensureSessionToken, } from "../lib/api.js";
+import { loadPek } from "../lib/pek.js";
+import { confirmDiff } from "../lib/confirm.js";
+import { ensureTokenAndLink } from "../lib/bootstrap.js";
+import { normalizeEnvName } from "../lib/env-name.js";
+async function resolveEnvPath(file) {
+    if (file) {
+        const resolved = path.resolve(process.cwd(), file);
+        if (!fs.existsSync(resolved)) {
+            throw new Error(`Env file not found: ${file}`);
+        }
+        if (isProductionEnvFilename(resolved)) {
+            throw new Error([
+                `Refusing to push ${path.basename(resolved)}.`,
+                "Production-named env files are not uploaded from the CLI.",
+                "Set Production values in the dashboard, or use run with a Production token.",
+            ].join("\n"));
+        }
+        return resolved;
+    }
+    const candidates = listPushEnvFiles();
+    if (candidates.length === 0) {
+        throw new Error([
+            "No pushable .env* files found under this folder.",
+            "Files whose names contain \"production\" are skipped.",
+            "Pass --file <path>, or create a .env file in this folder.",
+        ].join("\n"));
+    }
+    const labels = candidates.map((p) => path.relative(process.cwd(), p) || p);
+    if (candidates.length === 1) {
+        console.log(`Using ${labels[0]}\n`);
+        return candidates[0];
+    }
+    if (!process.stdin.isTTY) {
+        throw new Error(`Multiple env files found. Pass --file <path>:\n${labels.map((l) => `  ${l}`).join("\n")}`);
+    }
+    console.log("Found env files (production* skipped):\n");
+    const idx = await promptChoice("Push which file?", labels, 0);
+    console.log("");
+    return candidates[idx];
+}
+function parseKeyOpt(key) {
+    const eq = key.indexOf("=");
+    if (eq <= 0) {
+        return { name: key.trim() };
+    }
+    return {
+        name: key.slice(0, eq).trim(),
+        value: key.slice(eq + 1),
+    };
+}
+async function uploadPairs(pairs, opts) {
+    const keys = Object.keys(pairs);
+    if (keys.length === 0) {
+        throw new Error("No variables to push.");
+    }
+    const token = await ensureSessionToken(opts.projectId);
+    const client = new ApiClient(opts.apiUrl, token);
+    const remoteList = await client.request("GET", `/api/cli/projects/${opts.projectId}/secrets?environment=${encodeURIComponent(opts.environment)}`);
+    const remoteNames = new Set(remoteList.secrets.map((s) => s.name));
+    const localNames = new Set(keys);
+    const hostedOnly = [...remoteNames].filter((n) => !localNames.has(n));
+    if (opts.dryRun) {
+        console.log(pc.dim("Dry run - no changes uploaded.\n"));
+        for (const name of keys) {
+            const empty = !pairs[name];
+            console.log(`  ${remoteNames.has(name) ? "~" : "+"} ${name}${empty ? " (placeholder)" : ""}`);
+        }
+        for (const name of hostedOnly) {
+            console.log(`  - ${name}${opts.prune ? " (would prune)" : " (kept)"}`);
+        }
+        console.log("");
+        return;
+    }
+    if (hostedOnly.length > 0 && opts.prune) {
+        const ok = await confirmDiff({
+            conflicts: hostedOnly.map((name) => ({
+                name,
+                detail: "hosted only",
+            })),
+            action: "Delete hosted secrets missing from local file",
+            yes: opts.yes,
+        });
+        if (!ok) {
+            console.log(pc.dim("Push cancelled.\n"));
+            return;
+        }
+    }
+    console.log(`Encrypting ${keys.length} secret(s) for ${opts.environment}...\n`);
+    const password = await promptHidden("Vault password: ", {
+        allowStdin: opts.vaultPasswordStdin,
+    });
+    const { pek, wrappedRaw } = await loadPek({
+        password,
+        scope: opts.scope,
+        allowCreate: true,
+    });
+    for (const name of keys) {
+        const value = pairs[name] ?? "";
+        if (!value) {
+            await client.request("POST", `/api/cli/projects/${opts.projectId}/secrets`, {
+                name,
+                environment: opts.environment,
+                placeholder: true,
+                wrappedProjectKey: JSON.parse(wrappedRaw),
+            });
+            console.log(`  ${pc.green("✓")} ${name} (placeholder)`);
+            continue;
+        }
+        const ciphertext = serializePayload(encryptSecret(pek, value));
+        await client.request("POST", `/api/cli/projects/${opts.projectId}/secrets`, {
+            name,
+            environment: opts.environment,
+            ciphertext,
+            wrappedProjectKey: JSON.parse(wrappedRaw),
+        });
+        console.log(`  ${pc.green("✓")} ${name}`);
+    }
+    if (opts.prune && hostedOnly.length > 0) {
+        await client.request("DELETE", `/api/cli/projects/${opts.projectId}/secrets`, {
+            environment: opts.environment,
+            names: hostedOnly,
+        });
+        for (const name of hostedOnly) {
+            console.log(`  ${pc.yellow("-")} ${name} (pruned)`);
+        }
+    }
+    const meta = readProjectMeta() ?? {};
+    writeProjectMeta({
+        ...meta,
+        projectId: opts.projectId,
+        apiUrl: opts.apiUrl,
+        defaultEnv: meta.defaultEnv ??
+            (opts.scope === "production" ? "production" : "development"),
+    });
+    console.log(`\n${pc.green("✓")} Pushed ${keys.length} secret(s)\n`);
+}
+export async function pushCommand(opts) {
+    console.log(pc.bold("\ngetmyenv push\n"));
+    const { who, apiUrl, projectId } = await ensureTokenAndLink({
+        apiUrl: opts.apiUrl,
+        forceLink: opts.create,
+        action: "push",
+    });
+    if (who.cliScope === "production") {
+        throw new Error([
+            "Production CLI is read-only.",
+            "Set Production values in the dashboard, or use a Development token to push.",
+            "Use npx getmyenv run to pass Production secrets as env vars without writing them to disk.",
+        ].join("\n"));
+    }
+    const linked = { projectId, projectName: who.projectName };
+    let environment = normalizeEnvName(opts.env);
+    if (environment !== who.cliScope) {
+        if (opts.envWasDefault) {
+            environment = who.cliScope;
+        }
+        else {
+            throw new Error([
+                `Token scope is ${who.cliScope}, but you passed -e ${environment}.`,
+                "Use a matching Development/Production token, or omit -e.",
+            ].join("\n"));
+        }
+    }
+    if (opts.key?.trim()) {
+        const parsed = parseKeyOpt(opts.key.trim());
+        const nameCheck = secretNameSchema.safeParse(parsed.name);
+        if (!nameCheck.success) {
+            throw new Error("Invalid secret name. Use a valid environment variable name.");
+        }
+        let value = parsed.value;
+        if (value === undefined) {
+            value = await promptHidden(`Value for ${parsed.name}: `);
+        }
+        if (!value)
+            throw new Error("Value required");
+        console.log(pc.dim(`Environment: ${environment}\n`));
+        await uploadPairs({ [parsed.name]: value }, {
+            environment,
+            apiUrl,
+            projectId: linked.projectId,
+            scope: who.cliScope,
+            vaultPasswordStdin: opts.vaultPasswordStdin,
+            prune: false,
+            yes: opts.yes,
+            dryRun: opts.dryRun,
+        });
+        return;
+    }
+    const envPath = await resolveEnvPath(opts.file);
+    const baseName = path.basename(envPath);
+    const rel = path.relative(process.cwd(), envPath) || baseName;
+    if (opts.envWasDefault && opts.env === "development") {
+        const inferred = inferEnvNameFromFile(envPath);
+        if (inferred === who.cliScope) {
+            environment = inferred;
+        }
+    }
+    if (isEnvSampleFile(envPath)) {
+        console.log(pc.dim("This looks like a repo sample file. Values may be placeholders.\n"));
+    }
+    const pairs = parseEnvFile(envPath);
+    const keys = Object.keys(pairs);
+    if (keys.length === 0) {
+        throw new Error(`No variables found in ${rel}`);
+    }
+    console.log(`Found ${keys.length} variables in ${rel}:\n`);
+    for (const k of keys) {
+        console.log(`  ${pc.green("✓")} ${k}`);
+    }
+    console.log("");
+    console.log(pc.dim(`Environment: ${environment}\n`));
+    await uploadPairs(pairs, {
+        environment,
+        apiUrl,
+        projectId: linked.projectId,
+        scope: who.cliScope,
+        vaultPasswordStdin: opts.vaultPasswordStdin,
+        prune: opts.prune,
+        yes: opts.yes,
+        dryRun: opts.dryRun,
+    });
+    if (opts.dryRun)
+        return;
+    ensureGitignoreHasEnv();
+    const sample = keys[0] ?? "MY_SECRET";
+    const languages = detectLanguages();
+    const primary = languages[0]?.language ?? null;
+    console.log("Your application still reads it from the environment:\n");
+    if (languages.length > 1) {
+        for (const lang of languages.slice(0, 4)) {
+            console.log(pc.cyan(`  ${lang.label}: ${envReadSnippet(lang.language, sample)}`));
+        }
+    }
+    else {
+        console.log(pc.cyan(`  ${envReadSnippet(primary, sample)}`));
+    }
+    console.log("");
+    if (process.stdin.isTTY) {
+        const migratedName = `${baseName}.migrated.local`;
+        const remove = await promptConfirm(`Rename plaintext ${baseName} to ${migratedName}? (never deleted silently)`);
+        if (remove) {
+            const dest = envPath + ".migrated.local";
+            fs.renameSync(envPath, dest);
+            console.log(`${pc.green("✓")} Renamed to ${path.basename(dest)}`);
+        }
+        else {
+            console.log(pc.dim(`Kept plaintext ${baseName} in place.`));
+        }
+        console.log("");
+    }
+}
+//# sourceMappingURL=push.js.map

package/dist/commands/push.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push.js","sourceRoot":"","sources":["../../src/commands/push.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,eAAe,EACf,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,SAAS,EACT,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAetD,KAAK,UAAU,cAAc,CAAC,IAAa;IACzC,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb;gBACE,oBAAoB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG;gBAC9C,2DAA2D;gBAC3D,6EAA6E;aAC9E,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;IACtC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb;YACE,kDAAkD;YAClD,uDAAuD;YACvD,2DAA2D;SAC5D,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAE3E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,UAAU,CAAC,CAAC,CAAE,CAAC;IACxB,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,kDAAkD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3F,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,UAAU,CAAC,GAAG,CAAE,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;QAC7B,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;KACzB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,KAA6B,EAC7B,IASC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAEjD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,OAAO,CAGrC,KAAK,EACL,qBAAqB,IAAI,CAAC,SAAS,wBAAwB,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAClG,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAAC;QACxD,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,CAAC,GAAG,CACT,KAAK,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CACjF,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC;YAC3B,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACnC,IAAI;gBACJ,MAAM,EAAE,aAAa;aACtB,CAAC,CAAC;YACH,MAAM,EAAE,+CAA+C;YACvD,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,MAAM,kBAAkB,IAAI,CAAC,WAAW,OAAO,CAAC,CAAC;IAEhF,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,kBAAkB,EAAE;QACtD,UAAU,EAAE,IAAI,CAAC,kBAAkB;KACpC,CAAC,CAAC;IAEH,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,CAAC;QACxC,QAAQ;QACR,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,MAAM,CAAC,OAAO,CAClB,MAAM,EACN,qBAAqB,IAAI,CAAC,SAAS,UAAU,EAC7C;gBACE,IAAI;gBACJ,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,IAAI;gBACjB,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;aAC1C,CACF,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,gBAAgB,CAAC,CAAC;YACxD,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,CAAC,OAAO,CAClB,MAAM,EACN,qBAAqB,IAAI,CAAC,SAAS,UAAU,EAC7C;YACE,IAAI;YACJ,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU;YACV,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;SAC1C,CACF,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,MAAM,CAAC,OAAO,CAClB,QAAQ,EACR,qBAAqB,IAAI,CAAC,SAAS,UAAU,EAC7C;YACE,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,KAAK,EAAE,UAAU;SAClB,CACF,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC;IACrC,gBAAgB,CAAC;QACf,GAAG,IAAI;QACP,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EACR,IAAI,CAAC,UAAU;YACf,CAAC,IAAI,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC;KAC/D,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,MAAM,cAAc,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAc;IAC9C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAE1C,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC;QAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,MAAM;QACtB,MAAM,EAAE,MAAM;KACf,CAAC,CAAC;IAEH,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb;YACE,8BAA8B;YAC9B,6EAA6E;YAC7E,2FAA2F;SAC5F,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;IAE3D,IAAI,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,WAAW,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb;gBACE,kBAAkB,GAAG,CAAC,QAAQ,uBAAuB,WAAW,GAAG;gBACnE,0DAA0D;aAC3D,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,KAAK,GAAG,MAAM,YAAY,CAAC,aAAa,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAE9C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,WAAW,IAAI,CAAC,CAAC,CAAC;QACrD,MAAM,WAAW,CACf,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EACxB;YACE,WAAW;YACX,MAAM;YACN,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,GAAG,CAAC,QAAQ;YACnB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,KAAK,EAAE,KAAK;YACZ,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CACF,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC;IAE9D,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG,KAAK,aAAa,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC9B,WAAW,GAAG,QAAQ,CAAC;QACzB,CAAC;IACH,CAAC;IAED,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CACJ,mEAAmE,CACpE,CACF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,WAAW,IAAI,CAAC,CAAC,CAAC;IAErD,MAAM,WAAW,CAAC,KAAK,EAAE;QACvB,WAAW;QACX,MAAM;QACN,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,GAAG,CAAC,QAAQ;QACnB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO;IAExB,qBAAqB,EAAE,CAAC;IAExB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC;IACtC,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,IAAI,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACvE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,KAAK,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CACrE,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,YAAY,GAAG,GAAG,QAAQ,iBAAiB,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,oBAAoB,QAAQ,OAAO,YAAY,4BAA4B,CAC5E,CAAC;QACF,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,OAAO,GAAG,iBAAiB,CAAC;YACzC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,kBAAkB,QAAQ,YAAY,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/commands/restore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"restore.d.ts","sourceRoot":"","sources":["../../src/commands/restore.ts"],"names":[],"mappings":"AAYA,KAAK,WAAW,GAAG;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,IAAI,CAAC,CAqEf"}
+{"version":3,"file":"restore.d.ts","sourceRoot":"","sources":["../../src/commands/restore.ts"],"names":[],"mappings":"AAkBA,KAAK,WAAW,GAAG;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,IAAI,CAAC,CA2Ff"}

package/dist/commands/restore.js

@@ -1,9 +1,8 @@
 import fs from "node:fs";
 import pc from "picocolors";
-import { parseBackup, restoreSecretsFromBackup } from "@getmyenv/crypto";
+import { createWrappedProjectKey, encryptSecret, parseBackup, restoreSecretsFromBackup, serializePayload, serializeWrappedKey, } from "@getmyenv/crypto";
 import { promptHidden, readProjectMeta, writeProjectMeta } from "../lib/fs.js";
-import { ApiClient, ensureSessionToken } from "../lib/api.js";
-import { createWrappedProjectKey, encryptSecret, serializePayload, serializeWrappedKey, } from "@getmyenv/crypto";
+import { ApiClient, ensureSessionToken, resolveApiUrl, } from "../lib/api.js";
 export async function restoreCommand(file, opts) {
     console.log(pc.bold("\ngetmyenv restore\n"));
     if (!fs.existsSync(file))
@@ -15,8 +14,28 @@ export async function restoreCommand(file, opts) {
     // Verify decryption works offline first
     const restored = await restoreSecretsFromBackup(password, envelope);
     console.log(`Verified ${restored.length} secrets from backup (offline).\n`);
-    const token = await ensureSessionToken();
     const meta = readProjectMeta();
+    const token = await ensureSessionToken(meta?.projectId);
+    const apiUrl = resolveApiUrl(opts.apiUrl, meta?.projectId);
+    const client = new ApiClient(apiUrl, token);
+    const who = await client.request("GET", "/api/cli/whoami");
+    if (who.cliScope === "production") {
+        throw new Error([
+            "Production CLI is read-only.",
+            "Restore with a Development token, or set values in the dashboard.",
+        ].join("\n"));
+    }
+    // CLI tokens are per-project: restore always targets the token's project.
+    if (meta?.projectId && String(meta.projectId) !== String(who.projectId)) {
+        throw new Error([
+            `Linked project (${meta.projectName ?? meta.projectId}) does not match this token (${who.projectName}, ${who.projectId}).`,
+            "Run: npx getmyenv link",
+        ].join("\n"));
+    }
+    if (opts.intoLinked && !meta?.projectId) {
+        throw new Error("No linked project. Run: npx getmyenv link");
+    }
+    console.log(pc.dim(`Restoring into token project ${who.projectName} (${who.projectId}).\n`));
     // Re-encrypt under a fresh wrapped key for upload (same password)
     const { pek, wrapped } = await createWrappedProjectKey(password);
     const secrets = restored.map((s) => {
@@ -37,14 +56,9 @@ export async function restoreCommand(file, opts) {
             ciphertext: serializePayload(encryptSecret(pek, s.value)),
         };
     });
-    const intoLinked = Boolean(opts.intoLinked && meta?.projectId);
-    if (meta?.projectId && !opts.intoLinked) {
-        console.log(pc.dim("Creating a new project (default). Pass --into-linked to overwrite the linked project.\n"));
-    }
-    const client = new ApiClient(opts.apiUrl, token);
     const result = await client.request("POST", "/api/cli/restore", {
         projectName: envelope.projectName,
-        projectId: intoLinked ? meta?.projectId : undefined,
+        projectId: who.projectId,
         wrappedProjectKey: JSON.parse(serializeWrappedKey(wrapped)),
         secrets,
     });
@@ -52,10 +66,9 @@ export async function restoreCommand(file, opts) {
         ...(meta ?? {}),
         projectId: result.projectId,
         projectName: result.projectName,
-        protectionMode: "advanced",
-        apiUrl: opts.apiUrl,
+        apiUrl,
+        defaultEnv: meta?.defaultEnv ?? "development",
     });
-    console.log(`${pc.green("✓")} Restored encrypted secrets to getmyenv` +
-        (intoLinked ? " (linked project)\n" : ` as "${result.projectName}"\n`));
+    console.log(`${pc.green("✓")} Restored encrypted secrets to ${result.projectName}\n`);
 }
 //# sourceMappingURL=restore.js.map

package/dist/commands/restore.js.map

@@ -1 +1 @@
-{"version":3,"file":"restore.js","sourceRoot":"","sources":["../../src/commands/restore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAQ1B,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAY,EACZ,IAAiB;IAEjB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;IAErE,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,kCAAkC,EAAE;QACtE,UAAU,EAAE,IAAI,CAAC,kBAAkB;KACpC,CAAC,CAAC;IAEH,wCAAwC;IACxC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,CAAC,MAAM,mCAAmC,CAAC,CAAC;IAE5E,MAAM,KAAK,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAE/B,kEAAkE;IAClE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACjC,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YAC/B,OAAO;gBACL,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,MAAM,EAAE,aAAsB;gBAC9B,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,UAAU,EAAE,IAAI;aACjB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,gBAAgB,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;SAC1D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/D,IAAI,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CACJ,yFAAyF,CAC1F,CACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAGhC,MAAM,EAAE,kBAAkB,EAAE;QAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS;QACnD,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC3D,OAAO;KACR,CAAC,CAAC;IAEH,gBAAgB,CAAC;QACf,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACf,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,UAAU;QAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CACT,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,yCAAyC;QACvD,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,WAAW,KAAK,CAAC,CACzE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"restore.js","sourceRoot":"","sources":["../../src/commands/restore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,WAAW,EACX,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EACL,SAAS,EACT,kBAAkB,EAClB,aAAa,GAEd,MAAM,eAAe,CAAC;AAQvB,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAY,EACZ,IAAiB;IAEjB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;IAErE,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,kCAAkC,EAAE;QACtE,UAAU,EAAE,IAAI,CAAC,kBAAkB;KACpC,CAAC,CAAC;IAEH,wCAAwC;IACxC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,CAAC,MAAM,mCAAmC,CAAC,CAAC;IAE5E,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAE3D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAiB,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAE3E,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb;YACE,8BAA8B;YAC9B,mEAAmE;SACpE,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,IAAI,IAAI,EAAE,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACb;YACE,mBAAmB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,SAAS,gCAAgC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,SAAS,IAAI;YAC1H,wBAAwB;SACzB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CACJ,gCAAgC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,SAAS,MAAM,CACxE,CACF,CAAC;IAEF,kEAAkE;IAClE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACjC,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YAC/B,OAAO;gBACL,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,MAAM,EAAE,aAAsB;gBAC9B,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,UAAU,EAAE,IAAI;aACjB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,gBAAgB,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;SAC1D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAGhC,MAAM,EAAE,kBAAkB,EAAE;QAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC3D,OAAO;KACR,CAAC,CAAC;IAEH,gBAAgB,CAAC;QACf,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACf,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM;QACN,UAAU,EAAE,IAAI,EAAE,UAAU,IAAI,aAAa;KAC9C,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CACT,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,kCAAkC,MAAM,CAAC,WAAW,IAAI,CACzE,CAAC;AACJ,CAAC"}

package/dist/commands/run.d.ts

@@ -2,6 +2,7 @@ type RunOpts = {
     env: string;
     apiUrl: string;
     vaultPasswordStdin?: boolean;
+    envWasDefault?: boolean;
 };
 export declare function runCommand(opts: RunOpts, childArgs: string[]): Promise<void>;
 export {};

package/dist/commands/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAsBA,KAAK,OAAO,GAAG;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,wBAAsB,UAAU,CAC9B,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,MAAM,EAAE,GAClB,OAAO,CAAC,IAAI,CAAC,CAwNf"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AA4BA,KAAK,OAAO,GAAG;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,wBAAsB,UAAU,CAC9B,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,MAAM,EAAE,GAClB,OAAO,CAAC,IAAI,CAAC,CA6Qf"}

package/dist/commands/run.js

@@ -1,34 +1,70 @@
 import { spawn } from "node:child_process";
 import pc from "picocolors";
-import { decryptSecret, parsePayload, parseWrappedKey, signAccessRequest, unwrapProjectKey, } from "@getmyenv/crypto";
-import { promptHidden, readProjectMeta, readRequirements, } from "../lib/fs.js";
-import { ApiClient, ensureSessionToken } from "../lib/api.js";
+import { decryptSecret, parsePayload, signAccessRequest, } from "@getmyenv/crypto";
+import { promptHidden, readProjectMeta, readRequirements, requireLinkedProject, } from "../lib/fs.js";
+import { ApiClient, ensureSessionToken, resolveApiUrl, } from "../lib/api.js";
 import { clearGrant, loadGrant, loadOrCreateIdentity, saveGrant, } from "../lib/identity.js";
+import { unwrapPek } from "../lib/pek.js";
+import { normalizeEnvName } from "../lib/env-name.js";
 export async function runCommand(opts, childArgs) {
     if (childArgs.length === 0) {
         throw new Error("Usage: npx getmyenv run -- <command>");
     }
     console.log(pc.bold("\ngetmyenv\n"));
     const meta = readProjectMeta();
-    if (!meta?.projectId) {
-        throw new Error("Link a project (migrate) before running with protected secrets.");
+    requireLinkedProject(meta);
+    const token = await ensureSessionToken(meta.projectId);
+    const apiUrl = resolveApiUrl(opts.apiUrl, meta.projectId);
+    const client = new ApiClient(apiUrl, token);
+    const who = await client.request("GET", "/api/cli/whoami");
+    if (String(meta.projectId) !== String(who.projectId)) {
+        throw new Error([
+            `Linked project (${meta.projectName ?? meta.projectId}) does not match this token (${who.projectName}, ${who.projectId}).`,
+            "Run: npx getmyenv link",
+            "Or create a CLI token for this project on /cli.",
+        ].join("\n"));
+    }
+    let environment = normalizeEnvName(opts.env);
+    if (opts.envWasDefault && meta.defaultEnv) {
+        environment = meta.defaultEnv;
+    }
+    if (environment !== who.cliScope) {
+        if (opts.envWasDefault) {
+            environment = who.cliScope;
+        }
+        else {
+            throw new Error([
+                `Token scope is ${who.cliScope}, but you passed -e ${environment}.`,
+                who.cliScope === "development"
+                    ? "Use: npx getmyenv run -e development -- <cmd>"
+                    : "Use: npx getmyenv run -e production -- <cmd>",
+                "Or create a matching Development/Production token on /cli.",
+            ].join("\n"));
+        }
     }
-    const token = await ensureSessionToken();
-    const client = new ApiClient(opts.apiUrl, token);
     const requestedSecretNames = readRequirements();
+    const secretsLine = requestedSecretNames.length > 0
+        ? requestedSecretNames.join(", ")
+        : "all active secrets in this environment";
+    const needsDashboardWait = who.cliScope === "production";
+    console.log(`Token:       ${who.label ?? who.cliScope}`);
+    console.log(`Project:     ${who.projectName} (${who.projectId})`);
+    console.log(`Environment: ${environment}`);
+    console.log(`API:         ${apiUrl}`);
+    console.log(`Secrets:     ${secretsLine}`);
+    console.log(`Access:      ${needsDashboardWait
+        ? "requesting dashboard approval (production)"
+        : "not required (development)"}\n`);
     const envInfo = await client.request("GET", `/api/cli/projects/${meta.projectId}`);
-    const environment = envInfo.environments.find((e) => e.name.toLowerCase() === opts.env.toLowerCase());
-    if (!environment) {
-        throw new Error(`Environment not found: ${opts.env}`);
+    const envRow = envInfo.environments.find((e) => e.name.toLowerCase() === environment.toLowerCase());
+    if (!envRow) {
+        throw new Error(`Environment not found: ${environment}`);
     }
-    const environmentId = String(environment.id);
+    const environmentId = String(envRow.id);
     const projectId = String(meta.projectId);
     let grant = loadGrant(projectId, environmentId);
     if (!grant) {
         const identity = loadOrCreateIdentity(projectId);
-        console.log("Access required\n");
-        console.log(`Project:\n  ${meta.projectName ?? projectId}`);
-        console.log(`Environment:\n  ${opts.env}`);
         const timestamp = String(Date.now());
         const message = [
             projectId,
@@ -41,10 +77,10 @@ export async function runCommand(opts, childArgs) {
         try {
             request = await client.request("POST", "/api/cli/requests", {
                 projectId: meta.projectId,
-                environmentId: environment.id,
+                environmentId: envRow.id,
                 identityPublicKey: identity.publicKey,
                 identityLabel: process.env.GETMYENV_MACHINE_LABEL ??
-                    `${process.env.USERNAME ?? process.env.USER ?? "dev"}'s development environment`,
+                    `${process.env.USERNAME ?? process.env.USER ?? "dev"}'s machine`,
                 signature,
                 message,
                 timestamp,
@@ -55,7 +91,6 @@ export async function runCommand(opts, childArgs) {
             const msg = err instanceof Error ? err.message : String(err);
             if (/access requests are disabled/i.test(msg)) {
                 console.log(`\n${pc.red("✗")} Access requests are disabled for this project.\n`);
-                console.log("Enable them in the getmyenv dashboard for this project.\n");
                 process.exit(1);
             }
             throw err;
@@ -70,10 +105,11 @@ export async function runCommand(opts, childArgs) {
                 environmentId,
             };
             saveGrant(grant);
-            console.log(`${pc.green("✓")} Trusted device - access granted\n`);
+            console.log(`${pc.green("✓")} ${needsDashboardWait
+                ? "Trusted device - access granted"
+                : "Access granted (development)"}\n`);
         }
         else {
-            console.log("\nA dashboard approval is required.\n");
             console.log("Open getmyenv to approve access.\n");
             console.log(pc.dim("Tip: choose Trust this device to skip approval next time on this machine.\n"));
             console.log(pc.dim("Waiting..."));
@@ -99,7 +135,6 @@ export async function runCommand(opts, childArgs) {
                 }
                 if (status.status === "denied") {
                     console.log(`\n\n${pc.red("✗")} Access denied\n`);
-                    console.log("The application was not started.\n");
                     process.exit(1);
                 }
                 if (status.status === "expired" || status.status === "consumed") {
@@ -111,11 +146,11 @@ export async function runCommand(opts, childArgs) {
                 console.log("Run the command again to request access.\n");
                 process.exit(1);
             }
-            console.log(`\n\n${pc.green("✓")} Access approved`);
+            console.log(`\n\n${pc.green("✓")} Access approved\n`);
         }
     }
-    console.log(`${pc.green("✓")} Environment ready\n`);
     console.log("Loading protected environment...\n");
+    // Production always prompts; development also prompts (PEK cache is wrapped key only).
     const password = await promptHidden("Vault password: ", {
         allowStdin: opts.vaultPasswordStdin,
     });
@@ -123,7 +158,7 @@ export async function runCommand(opts, childArgs) {
     try {
         bundle = await client.request("POST", `/api/cli/grants/secrets`, {
             projectId: meta.projectId,
-            environmentId: environment.id,
+            environmentId: envRow.id,
         }, { "X-Getmyenv-Grant": grant.grantToken });
     }
     catch (err) {
@@ -135,17 +170,23 @@ export async function runCommand(opts, childArgs) {
     }
     let pek;
     try {
-        pek = await unwrapProjectKey(password, parseWrappedKey(JSON.stringify(bundle.wrappedProjectKey)));
+        pek = await unwrapPek({
+            password,
+            scope: who.cliScope,
+            wrapped: bundle.wrappedProjectKey,
+        });
     }
     catch {
         clearGrant(projectId, environmentId);
         throw new Error("Could not decrypt secrets. Check your vault password.");
     }
     const env = { ...process.env };
+    const loadedNames = [];
     for (const secret of bundle.secrets) {
         env[secret.name] = decryptSecret(pek, parsePayload(secret.ciphertext));
+        loadedNames.push(secret.name);
     }
-    console.log(`${pc.green("✓")} Protected environment ready\n`);
+    console.log(`${pc.green("✓")} Loaded ${loadedNames.length} secret${loadedNames.length === 1 ? "" : "s"}: ${loadedNames.join(", ") || "(none)"}\n`);
     console.log("Starting application...\n");
     const [cmd, ...args] = childArgs;
     const child = spawn(cmd, args, {