getmyenv 0.1.1

package/dist/commands/migrate.js

@@ -0,0 +1,127 @@
+import fs from "node:fs";
+import path from "node:path";
+import pc from "picocolors";
+import { createWrappedProjectKey, encryptSecret, serializePayload, serializeWrappedKey, } from "@getmyenv/crypto";
+import { detectLanguages, ensureGitignoreHasEnv, envReadSnippet, inferEnvNameFromFile, isEnvSampleFile, listEnvFiles, parseEnvFile, promptChoice, promptConfirm, promptHidden, readProjectMeta, writeProjectMeta, } from "../lib/fs.js";
+import { ApiClient, ensureSessionToken, resolveApiUrl } from "../lib/api.js";
+async function resolveEnvPath(file) {
+    if (file) {
+        const resolved = path.resolve(process.cwd(), file);
+        if (!fs.existsSync(resolved)) {
+            throw new Error(`Env file not found: ${file}`);
+        }
+        return resolved;
+    }
+    const candidates = listEnvFiles();
+    if (candidates.length === 0) {
+        throw new Error("No .env* files found under this folder (including .example / .sample). Pass --file <path> or create one first.");
+    }
+    const labels = candidates.map((p) => path.relative(process.cwd(), p) || p);
+    if (candidates.length === 1) {
+        console.log(`Using ${labels[0]}\n`);
+        return candidates[0];
+    }
+    if (!process.stdin.isTTY) {
+        throw new Error(`Multiple env files found. Pass --file <path>:\n${labels.map((l) => `  ${l}`).join("\n")}`);
+    }
+    console.log("Found env files:\n");
+    const idx = await promptChoice("Migrate which file?", labels, 0);
+    console.log("");
+    return candidates[idx];
+}
+export async function migrateCommand(opts) {
+    console.log(pc.bold("\ngetmyenv migrate\n"));
+    const envPath = await resolveEnvPath(opts.file);
+    const baseName = path.basename(envPath);
+    const rel = path.relative(process.cwd(), envPath) || baseName;
+    let environment = opts.env;
+    if (opts.envWasDefault !== false && opts.env === "development") {
+        environment = inferEnvNameFromFile(envPath);
+    }
+    if (isEnvSampleFile(envPath)) {
+        console.log(pc.dim("This looks like a repo sample file. Values may be placeholders.\n"));
+    }
+    const pairs = parseEnvFile(envPath);
+    const keys = Object.keys(pairs);
+    if (keys.length === 0) {
+        throw new Error(`No variables found in ${rel}`);
+    }
+    console.log(`Found ${keys.length} variables in ${rel}:\n`);
+    for (const k of keys) {
+        console.log(`  ${pc.green("✓")} ${k}`);
+    }
+    console.log("");
+    console.log(pc.dim(`Environment: ${environment}\n`));
+    const password = await promptHidden("Vault password (used for local encryption): ", { allowStdin: opts.vaultPasswordStdin });
+    if (password.length < 12 || !/[a-zA-Z]/.test(password) || !/\d/.test(password)) {
+        throw new Error("Vault password must be at least 12 characters and include a letter and a number");
+    }
+    if (!opts.vaultPasswordStdin) {
+        const confirm = await promptHidden("Confirm vault password: ");
+        if (password !== confirm) {
+            throw new Error("Passwords do not match");
+        }
+    }
+    console.log("\nEncrypting locally...\n");
+    const { pek, wrapped } = await createWrappedProjectKey(password);
+    const encrypted = keys.map((name) => ({
+        name,
+        ciphertext: serializePayload(encryptSecret(pek, pairs[name])),
+    }));
+    for (const item of encrypted) {
+        console.log(`  ${pc.green("✓")} ${item.name}`);
+    }
+    console.log(`\n${pc.green("✓")} Encrypted locally`);
+    const token = await ensureSessionToken();
+    const meta = readProjectMeta() ?? {};
+    const client = new ApiClient(opts.apiUrl, token);
+    const result = await client.request("POST", "/api/cli/migrate", {
+        environment,
+        wrappedProjectKey: JSON.parse(serializeWrappedKey(wrapped)),
+        secrets: encrypted,
+        projectName: meta.projectName,
+    });
+    writeProjectMeta({
+        ...meta,
+        projectId: result.projectId,
+        projectName: result.projectName,
+        protectionMode: "advanced",
+        apiUrl: opts.apiUrl,
+    });
+    console.log(`${pc.green("✓")} Uploaded securely\n`);
+    ensureGitignoreHasEnv();
+    console.log(`${pc.green("✓")} Ensured .env is in .gitignore\n`);
+    const sample = keys[0] ?? "MY_SECRET";
+    const languages = detectLanguages();
+    const primary = languages[0]?.language ?? null;
+    console.log("Your application still reads it from the environment:\n");
+    if (languages.length > 1) {
+        for (const lang of languages.slice(0, 4)) {
+            console.log(pc.cyan(`  ${lang.label}: ${envReadSnippet(lang.language, sample)}`));
+        }
+    }
+    else {
+        console.log(pc.cyan(`  ${envReadSnippet(primary, sample)}`));
+    }
+    console.log("");
+    const migratedName = `${baseName}.migrated.local`;
+    const remove = await promptConfirm(`Rename plaintext ${baseName} to ${migratedName}? (never deleted silently)`);
+    if (remove) {
+        const dest = envPath + ".migrated.local";
+        fs.renameSync(envPath, dest);
+        console.log(`${pc.green("✓")} Renamed to ${path.basename(dest)}`);
+    }
+    else {
+        console.log(pc.dim(`Kept plaintext ${baseName} in place.`));
+    }
+    console.log("");
+}
+/** Shared entry for login → migrate offer. */
+export async function runMigrateFromLogin(apiUrl) {
+    await migrateCommand({
+        env: "development",
+        envWasDefault: true,
+        apiUrl: resolveApiUrl(apiUrl),
+    });
+}
+//# sourceMappingURL=migrate.js.map

package/dist/commands/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../src/commands/migrate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,eAAe,EACf,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAW7E,KAAK,UAAU,cAAc,CAAC,IAAa;IACzC,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,YAAY,EAAE,CAAC;IAClC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAE3E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,UAAU,CAAC,CAAC,CAAE,CAAC;IACxB,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,kDAAkD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3F,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,UAAU,CAAC,GAAG,CAAE,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAiB;IACpD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,GAAG,GACP,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC;IAEpD,IAAI,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC;IAC3B,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK,IAAI,IAAI,CAAC,GAAG,KAAK,aAAa,EAAE,CAAC;QAC/D,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CACJ,mEAAmE,CACpE,CACF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,WAAW,IAAI,CAAC,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAG,MAAM,YAAY,CACjC,8CAA8C,EAC9C,EAAE,UAAU,EAAE,IAAI,CAAC,kBAAkB,EAAE,CACxC,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,0BAA0B,CAAC,CAAC;QAC/D,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI;QACJ,UAAU,EAAE,gBAAgB,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAE,CAAC,CAAC;KAC/D,CAAC,CAAC,CAAC;IAEJ,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAEpD,MAAM,KAAK,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAEjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAGhC,MAAM,EAAE,kBAAkB,EAAE;QAC7B,WAAW;QACX,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC3D,OAAO,EAAE,SAAS;QAClB,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;IACH,gBAAgB,CAAC;QACf,GAAG,IAAI;QACP,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,UAAU;QAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAEpD,qBAAqB,EAAE,CAAC;IACxB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAEhE,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC;IACtC,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,IAAI,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACvE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,KAAK,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CACrE,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,MAAM,YAAY,GAAG,GAAG,QAAQ,iBAAiB,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,oBAAoB,QAAQ,OAAO,YAAY,4BAA4B,CAC5E,CAAC;IACF,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,OAAO,GAAG,iBAAiB,CAAC;QACzC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,kBAAkB,QAAQ,YAAY,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,8CAA8C;AAC9C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAe;IACvD,MAAM,cAAc,CAAC;QACnB,GAAG,EAAE,aAAa;QAClB,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/restore.d.ts

@@ -0,0 +1,8 @@
+type RestoreOpts = {
+    apiUrl: string;
+    intoLinked?: boolean;
+    vaultPasswordStdin?: boolean;
+};
+export declare function restoreCommand(file: string, opts: RestoreOpts): Promise<void>;
+export {};
+//# sourceMappingURL=restore.d.ts.map

package/dist/commands/restore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore.d.ts","sourceRoot":"","sources":["../../src/commands/restore.ts"],"names":[],"mappings":"AAYA,KAAK,WAAW,GAAG;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,IAAI,CAAC,CAqEf"}

package/dist/commands/restore.js

@@ -0,0 +1,61 @@
+import fs from "node:fs";
+import pc from "picocolors";
+import { parseBackup, restoreSecretsFromBackup } from "@getmyenv/crypto";
+import { promptHidden, readProjectMeta, writeProjectMeta } from "../lib/fs.js";
+import { ApiClient, ensureSessionToken } from "../lib/api.js";
+import { createWrappedProjectKey, encryptSecret, serializePayload, serializeWrappedKey, } from "@getmyenv/crypto";
+export async function restoreCommand(file, opts) {
+    console.log(pc.bold("\ngetmyenv restore\n"));
+    if (!fs.existsSync(file))
+        throw new Error(`File not found: ${file}`);
+    const envelope = parseBackup(fs.readFileSync(file, "utf8"));
+    const password = await promptHidden("Vault password for this backup: ", {
+        allowStdin: opts.vaultPasswordStdin,
+    });
+    // Verify decryption works offline first
+    const restored = await restoreSecretsFromBackup(password, envelope);
+    console.log(`Verified ${restored.length} secrets from backup (offline).\n`);
+    const token = await ensureSessionToken();
+    const meta = readProjectMeta();
+    // Re-encrypt under a fresh wrapped key for upload (same password)
+    const { pek, wrapped } = await createWrappedProjectKey(password);
+    const secrets = restored.map((s) => {
+        if (s.status === "placeholder") {
+            return {
+                name: s.name,
+                environment: s.environment,
+                status: "placeholder",
+                expiresAt: s.expiresAt,
+                ciphertext: null,
+            };
+        }
+        return {
+            name: s.name,
+            environment: s.environment,
+            status: s.status,
+            expiresAt: s.expiresAt,
+            ciphertext: serializePayload(encryptSecret(pek, s.value)),
+        };
+    });
+    const intoLinked = Boolean(opts.intoLinked && meta?.projectId);
+    if (meta?.projectId && !opts.intoLinked) {
+        console.log(pc.dim("Creating a new project (default). Pass --into-linked to overwrite the linked project.\n"));
+    }
+    const client = new ApiClient(opts.apiUrl, token);
+    const result = await client.request("POST", "/api/cli/restore", {
+        projectName: envelope.projectName,
+        projectId: intoLinked ? meta?.projectId : undefined,
+        wrappedProjectKey: JSON.parse(serializeWrappedKey(wrapped)),
+        secrets,
+    });
+    writeProjectMeta({
+        ...(meta ?? {}),
+        projectId: result.projectId,
+        projectName: result.projectName,
+        protectionMode: "advanced",
+        apiUrl: opts.apiUrl,
+    });
+    console.log(`${pc.green("✓")} Restored encrypted secrets to getmyenv` +
+        (intoLinked ? " (linked project)\n" : ` as "${result.projectName}"\n`));
+}
+//# sourceMappingURL=restore.js.map

package/dist/commands/restore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore.js","sourceRoot":"","sources":["../../src/commands/restore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAQ1B,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAY,EACZ,IAAiB;IAEjB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;IAErE,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,kCAAkC,EAAE;QACtE,UAAU,EAAE,IAAI,CAAC,kBAAkB;KACpC,CAAC,CAAC;IAEH,wCAAwC;IACxC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,CAAC,MAAM,mCAAmC,CAAC,CAAC;IAE5E,MAAM,KAAK,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAE/B,kEAAkE;IAClE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACjC,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YAC/B,OAAO;gBACL,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,MAAM,EAAE,aAAsB;gBAC9B,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,UAAU,EAAE,IAAI;aACjB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,gBAAgB,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;SAC1D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/D,IAAI,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CACJ,yFAAyF,CAC1F,CACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAGhC,MAAM,EAAE,kBAAkB,EAAE;QAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS;QACnD,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC3D,OAAO;KACR,CAAC,CAAC;IAEH,gBAAgB,CAAC;QACf,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACf,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,UAAU;QAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CACT,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,yCAAyC;QACvD,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,WAAW,KAAK,CAAC,CACzE,CAAC;AACJ,CAAC"}

package/dist/commands/run.d.ts

@@ -0,0 +1,8 @@
+type RunOpts = {
+    env: string;
+    apiUrl: string;
+    vaultPasswordStdin?: boolean;
+};
+export declare function runCommand(opts: RunOpts, childArgs: string[]): Promise<void>;
+export {};
+//# sourceMappingURL=run.d.ts.map

package/dist/commands/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAsBA,KAAK,OAAO,GAAG;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,wBAAsB,UAAU,CAC9B,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,MAAM,EAAE,GAClB,OAAO,CAAC,IAAI,CAAC,CAwNf"}

package/dist/commands/run.js

@@ -0,0 +1,164 @@
+import { spawn } from "node:child_process";
+import pc from "picocolors";
+import { decryptSecret, parsePayload, parseWrappedKey, signAccessRequest, unwrapProjectKey, } from "@getmyenv/crypto";
+import { promptHidden, readProjectMeta, readRequirements, } from "../lib/fs.js";
+import { ApiClient, ensureSessionToken } from "../lib/api.js";
+import { clearGrant, loadGrant, loadOrCreateIdentity, saveGrant, } from "../lib/identity.js";
+export async function runCommand(opts, childArgs) {
+    if (childArgs.length === 0) {
+        throw new Error("Usage: npx getmyenv run -- <command>");
+    }
+    console.log(pc.bold("\ngetmyenv\n"));
+    const meta = readProjectMeta();
+    if (!meta?.projectId) {
+        throw new Error("Link a project (migrate) before running with protected secrets.");
+    }
+    const token = await ensureSessionToken();
+    const client = new ApiClient(opts.apiUrl, token);
+    const requestedSecretNames = readRequirements();
+    const envInfo = await client.request("GET", `/api/cli/projects/${meta.projectId}`);
+    const environment = envInfo.environments.find((e) => e.name.toLowerCase() === opts.env.toLowerCase());
+    if (!environment) {
+        throw new Error(`Environment not found: ${opts.env}`);
+    }
+    const environmentId = String(environment.id);
+    const projectId = String(meta.projectId);
+    let grant = loadGrant(projectId, environmentId);
+    if (!grant) {
+        const identity = loadOrCreateIdentity(projectId);
+        console.log("Access required\n");
+        console.log(`Project:\n  ${meta.projectName ?? projectId}`);
+        console.log(`Environment:\n  ${opts.env}`);
+        const timestamp = String(Date.now());
+        const message = [
+            projectId,
+            environmentId,
+            identity.publicKey,
+            timestamp,
+        ].join(":");
+        const signature = signAccessRequest(identity.privateKey, message);
+        let request;
+        try {
+            request = await client.request("POST", "/api/cli/requests", {
+                projectId: meta.projectId,
+                environmentId: environment.id,
+                identityPublicKey: identity.publicKey,
+                identityLabel: process.env.GETMYENV_MACHINE_LABEL ??
+                    `${process.env.USERNAME ?? process.env.USER ?? "dev"}'s development environment`,
+                signature,
+                message,
+                timestamp,
+                requestedSecretNames: requestedSecretNames.length > 0 ? requestedSecretNames : undefined,
+            });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (/access requests are disabled/i.test(msg)) {
+                console.log(`\n${pc.red("✗")} Access requests are disabled for this project.\n`);
+                console.log("Enable them in the getmyenv dashboard for this project.\n");
+                process.exit(1);
+            }
+            throw err;
+        }
+        if (request.status === "approved" &&
+            request.grantToken &&
+            request.grantExpiresAt) {
+            grant = {
+                grantToken: request.grantToken,
+                expiresAt: request.grantExpiresAt,
+                projectId,
+                environmentId,
+            };
+            saveGrant(grant);
+            console.log(`${pc.green("✓")} Trusted device - access granted\n`);
+        }
+        else {
+            console.log("\nA dashboard approval is required.\n");
+            console.log("Open getmyenv to approve access.\n");
+            console.log(pc.dim("Tip: choose Trust this device to skip approval next time on this machine.\n"));
+            console.log(pc.dim("Waiting..."));
+            const deadline = new Date(request.expiresAt).getTime();
+            let approved = false;
+            while (Date.now() < deadline) {
+                const remaining = Math.max(0, Math.ceil((deadline - Date.now()) / 1000));
+                process.stdout.write(`\r${pc.dim(`Waiting... ${String(remaining).padStart(2, "0")}s`)}   `);
+                await sleep(1500);
+                const status = await client.request("GET", `/api/cli/requests/${request.id}`);
+                if (status.status === "approved" &&
+                    status.grantToken &&
+                    status.grantExpiresAt) {
+                    grant = {
+                        grantToken: status.grantToken,
+                        expiresAt: status.grantExpiresAt,
+                        projectId,
+                        environmentId,
+                    };
+                    saveGrant(grant);
+                    approved = true;
+                    break;
+                }
+                if (status.status === "denied") {
+                    console.log(`\n\n${pc.red("✗")} Access denied\n`);
+                    console.log("The application was not started.\n");
+                    process.exit(1);
+                }
+                if (status.status === "expired" || status.status === "consumed") {
+                    break;
+                }
+            }
+            if (!approved || !grant) {
+                console.log(`\n\n${pc.red("✗")} Approval request expired\n`);
+                console.log("Run the command again to request access.\n");
+                process.exit(1);
+            }
+            console.log(`\n\n${pc.green("✓")} Access approved`);
+        }
+    }
+    console.log(`${pc.green("✓")} Environment ready\n`);
+    console.log("Loading protected environment...\n");
+    const password = await promptHidden("Vault password: ", {
+        allowStdin: opts.vaultPasswordStdin,
+    });
+    let bundle;
+    try {
+        bundle = await client.request("POST", `/api/cli/grants/secrets`, {
+            projectId: meta.projectId,
+            environmentId: environment.id,
+        }, { "X-Getmyenv-Grant": grant.grantToken });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (/grant already used|invalid grant|grant expired/i.test(msg)) {
+            clearGrant(projectId, environmentId);
+        }
+        throw err;
+    }
+    let pek;
+    try {
+        pek = await unwrapProjectKey(password, parseWrappedKey(JSON.stringify(bundle.wrappedProjectKey)));
+    }
+    catch {
+        clearGrant(projectId, environmentId);
+        throw new Error("Could not decrypt secrets. Check your vault password.");
+    }
+    const env = { ...process.env };
+    for (const secret of bundle.secrets) {
+        env[secret.name] = decryptSecret(pek, parsePayload(secret.ciphertext));
+    }
+    console.log(`${pc.green("✓")} Protected environment ready\n`);
+    console.log("Starting application...\n");
+    const [cmd, ...args] = childArgs;
+    const child = spawn(cmd, args, {
+        env,
+        stdio: "inherit",
+        shell: process.platform === "win32",
+    });
+    const code = await new Promise((resolve) => {
+        child.on("exit", (c) => resolve(c ?? 1));
+    });
+    process.exit(code);
+}
+function sleep(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
+//# sourceMappingURL=run.js.map

package/dist/commands/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EACL,UAAU,EACV,SAAS,EACT,oBAAoB,EACpB,SAAS,GACV,MAAM,oBAAoB,CAAC;AAQ5B,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAa,EACb,SAAmB;IAEnB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAErC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAEzC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,oBAAoB,GAAG,gBAAgB,EAAE,CAAC;IAEhD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAEjC,KAAK,EAAE,qBAAqB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAC3C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CACvD,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEzC,IAAI,KAAK,GAAG,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAEhD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,WAAW,IAAI,SAAS,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAE3C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG;YACd,SAAS;YACT,aAAa;YACb,QAAQ,CAAC,SAAS;YAClB,SAAS;SACV,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAElE,IAAI,OAMH,CAAC;QACF,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,EAAE;gBAC1D,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,aAAa,EAAE,WAAW,CAAC,EAAE;gBAC7B,iBAAiB,EAAE,QAAQ,CAAC,SAAS;gBACrC,aAAa,EACX,OAAO,CAAC,GAAG,CAAC,sBAAsB;oBAClC,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,4BAA4B;gBAClF,SAAS;gBACT,OAAO;gBACP,SAAS;gBACT,oBAAoB,EAClB,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS;aACrE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9C,OAAO,CAAC,GAAG,CACT,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,mDAAmD,CACpE,CAAC;gBACF,OAAO,CAAC,GAAG,CACT,2DAA2D,CAC5D,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IACE,OAAO,CAAC,MAAM,KAAK,UAAU;YAC7B,OAAO,CAAC,UAAU;YAClB,OAAO,CAAC,cAAc,EACtB,CAAC;YACD,KAAK,GAAG;gBACN,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,SAAS,EAAE,OAAO,CAAC,cAAc;gBACjC,SAAS;gBACT,aAAa;aACd,CAAC;YACF,SAAS,CAAC,KAAK,CAAC,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;YAClD,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CACJ,6EAA6E,CAC9E,CACF,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;YAElC,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YACvD,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gBAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,CAAC,EACD,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAC1C,CAAC;gBACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,EAAE,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CACtE,CAAC;gBACF,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAIhC,KAAK,EAAE,qBAAqB,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7C,IACE,MAAM,CAAC,MAAM,KAAK,UAAU;oBAC5B,MAAM,CAAC,UAAU;oBACjB,MAAM,CAAC,cAAc,EACrB,CAAC;oBACD,KAAK,GAAG;wBACN,UAAU,EAAE,MAAM,CAAC,UAAU;wBAC7B,SAAS,EAAE,MAAM,CAAC,cAAc;wBAChC,SAAS;wBACT,aAAa;qBACd,CAAC;oBACF,SAAS,CAAC,KAAK,CAAC,CAAC;oBACjB,QAAQ,GAAG,IAAI,CAAC;oBAChB,MAAM;gBACR,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC/B,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;oBAClD,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;oBAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBAChE,MAAM;gBACR,CAAC;YACH,CAAC;YAED,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;gBACxB,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;gBAC7D,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;gBAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAElD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,kBAAkB,EAAE;QACtD,UAAU,EAAE,IAAI,CAAC,kBAAkB;KACpC,CAAC,CAAC;IAEH,IAAI,MAGH,CAAC;IACF,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAC3B,MAAM,EACN,yBAAyB,EACzB;YACE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,WAAW,CAAC,EAAE;SAC9B,EACD,EAAE,kBAAkB,EAAE,KAAK,CAAC,UAAU,EAAE,CACzC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,iDAAiD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,UAAU,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,gBAAgB,CAC1B,QAAQ,EACR,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAC1D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAC9B,GAAG,EACH,YAAY,CAAC,MAAM,CAAC,UAAoB,CAAC,CAC1C,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAEzC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAI,EAAE,IAAI,EAAE;QAC9B,GAAG;QACH,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;KACpC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QACjD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC"}

package/dist/commands/status.d.ts

@@ -0,0 +1,7 @@
+type StatusOpts = {
+    env: string;
+    apiUrl: string;
+};
+export declare function statusCommand(opts: StatusOpts): Promise<void>;
+export {};
+//# sourceMappingURL=status.d.ts.map

package/dist/commands/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAQA,KAAK,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAmBlD,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAyEnE"}

package/dist/commands/status.js

@@ -0,0 +1,76 @@
+import pc from "picocolors";
+import { getSecretPresentationStatus, } from "@getmyenv/shared";
+import { readProjectMeta, readRequirements } from "../lib/fs.js";
+import { ApiClient, ensureSessionToken } from "../lib/api.js";
+function icon(status) {
+    switch (status) {
+        case "active":
+            return pc.green("✓");
+        case "expiring_soon":
+            return pc.yellow("!");
+        case "expired":
+            return pc.red("✗");
+        case "revoked":
+            return pc.red("✗");
+        case "placeholder":
+            return pc.yellow("?");
+        case "missing":
+            return pc.red("✗");
+    }
+}
+export async function statusCommand(opts) {
+    console.log(pc.bold(`\n${opts.env}\n`));
+    const required = readRequirements();
+    const meta = readProjectMeta();
+    if (!meta?.projectId) {
+        if (required.length === 0) {
+            console.log(pc.dim("Run npx getmyenv init first.\n"));
+            return;
+        }
+        for (const name of required) {
+            console.log(`  ${pc.yellow("?")} ${name}`);
+            console.log(pc.dim("    Not synced (run migrate to link a project)"));
+        }
+        console.log("");
+        return;
+    }
+    const token = await ensureSessionToken();
+    const client = new ApiClient(opts.apiUrl, token);
+    const data = await client.request("GET", `/api/cli/projects/${meta.projectId}/secrets?environment=${encodeURIComponent(opts.env)}`);
+    const byName = new Map(data.secrets.map((s) => [s.name, s]));
+    const names = required.length
+        ? required
+        : data.secrets.map((s) => s.name).sort();
+    for (const name of names) {
+        const secret = byName.get(name);
+        if (!secret) {
+            console.log(`  ${icon("missing")} ${name}`);
+            console.log(pc.dim("    Missing"));
+            continue;
+        }
+        const hasValue = secret.hasValue ??
+            (secret.status !== "placeholder");
+        if (!hasValue || secret.status === "placeholder") {
+            console.log(`  ${icon("placeholder")} ${name}`);
+            console.log(pc.dim("    Placeholder - no value yet"));
+            continue;
+        }
+        const presentation = getSecretPresentationStatus({
+            status: secret.status,
+            expiresAt: secret.expiresAt,
+            ciphertext: "present",
+        });
+        console.log(`  ${icon(presentation)} ${name}`);
+        if (presentation === "expiring_soon") {
+            console.log(pc.yellow("    Expiring soon"));
+        }
+        else if (presentation === "expired") {
+            console.log(pc.red("    Expired - getmyenv will no longer provide this secret"));
+        }
+        else if (presentation === "revoked") {
+            console.log(pc.red("    Revoked - getmyenv will no longer provide this secret (external credential unchanged)"));
+        }
+    }
+    console.log("");
+}
+//# sourceMappingURL=status.js.map

package/dist/commands/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EACL,2BAA2B,GAE5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAI9D,SAAS,IAAI,CAAC,MAA4C;IACxD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvB,KAAK,eAAe;YAClB,OAAO,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,KAAK,SAAS;YACZ,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,KAAK,aAAa;YAChB,OAAO,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,KAAK,SAAS;YACZ,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAgB;IAClD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAE/B,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAQ/B,KAAK,EACL,qBAAqB,IAAI,CAAC,SAAS,wBAAwB,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC1F,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM;QAC3B,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAE3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;YACnC,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GACZ,MAAM,CAAC,QAAQ;YACf,CAAC,MAAM,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;YACtD,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG,2BAA2B,CAAC;YAC/C,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC/C,IAAI,YAAY,KAAK,eAAe,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CAAC,2DAA2D,CAAC,CACpE,CAAC;QACJ,CAAC;aAAM,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CACJ,2FAA2F,CAC5F,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC"}

package/dist/lib/api.d.ts

@@ -0,0 +1,27 @@
+/**
+ * CLI API client. Never logs response bodies that may contain ciphertext details
+ * beyond what is needed; never prints secret plaintext.
+ */
+import { clearCredentials, credentialsFilePath, readCredentials, writeCredentials } from "./credentials.js";
+/** Keep in sync with packages/cli/package.json version. */
+export declare const CLI_VERSION = "0.1.1";
+/** Resolve API base: env → saved credentials → production. */
+export declare function resolveApiUrl(cliOverride?: string): string;
+/** @deprecated Use resolveApiUrl() - kept for callers that read at module load. */
+export declare const API_URL_DEFAULT: string;
+export declare class ApiClient {
+    private baseUrl;
+    private token?;
+    constructor(baseUrl: string, token?: string | undefined);
+    private headers;
+    request<T>(method: string, path: string, body?: unknown, extraHeaders?: Record<string, string>): Promise<T>;
+}
+/** Env only (no prompt). Prefer ensureSessionToken for interactive commands. */
+export declare function getSessionToken(): string | undefined;
+/**
+ * Env → credentials file → interactive paste (TTY) saved for next time.
+ * Non-TTY without a token throws with login instructions.
+ */
+export declare function ensureSessionToken(): Promise<string>;
+export { clearCredentials, credentialsFilePath, writeCredentials, readCredentials };
+//# sourceMappingURL=api.d.ts.map

package/dist/lib/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAE1B,2DAA2D;AAC3D,eAAO,MAAM,WAAW,UAAU,CAAC;AAInC,8DAA8D;AAC9D,wBAAgB,aAAa,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ1D;AAED,mFAAmF;AACnF,eAAO,MAAM,eAAe,QAAkB,CAAC;AAE/C,qBAAa,SAAS;IAElB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,KAAK,CAAC;gBADN,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,YAAA;IAGxB,OAAO,CAAC,OAAO;IAWT,OAAO,CAAC,CAAC,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,EACd,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACpC,OAAO,CAAC,CAAC,CAAC;CAmBd;AAED,gFAAgF;AAChF,wBAAgB,eAAe,IAAI,MAAM,GAAG,SAAS,CAIpD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,CA4B1D;AAED,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC"}

package/dist/lib/api.js

@@ -0,0 +1,97 @@
+/**
+ * CLI API client. Never logs response bodies that may contain ciphertext details
+ * beyond what is needed; never prints secret plaintext.
+ */
+import pc from "picocolors";
+import { promptHidden } from "./fs.js";
+import { clearCredentials, credentialsFilePath, readCredentials, writeCredentials, } from "./credentials.js";
+/** Keep in sync with packages/cli/package.json version. */
+export const CLI_VERSION = "0.1.1";
+const PRODUCTION_API = "https://getmyenv.com";
+/** Resolve API base: env → saved credentials → production. */
+export function resolveApiUrl(cliOverride) {
+    if (cliOverride?.trim())
+        return cliOverride.trim();
+    if (process.env.GETMYENV_API_URL?.trim()) {
+        return process.env.GETMYENV_API_URL.trim();
+    }
+    const saved = readCredentials()?.apiUrl;
+    if (saved)
+        return saved;
+    return PRODUCTION_API;
+}
+/** @deprecated Use resolveApiUrl() - kept for callers that read at module load. */
+export const API_URL_DEFAULT = resolveApiUrl();
+export class ApiClient {
+    baseUrl;
+    token;
+    constructor(baseUrl, token) {
+        this.baseUrl = baseUrl;
+        this.token = token;
+    }
+    headers(extra) {
+        const h = {
+            "Content-Type": "application/json",
+            Accept: "application/json",
+            "X-Getmyenv-CLI-Version": CLI_VERSION,
+            ...extra,
+        };
+        if (this.token)
+            h.Authorization = `Bearer ${this.token}`;
+        return h;
+    }
+    async request(method, path, body, extraHeaders) {
+        const res = await fetch(`${this.baseUrl.replace(/\/$/, "")}${path}`, {
+            method,
+            headers: this.headers(extraHeaders),
+            body: body === undefined ? undefined : JSON.stringify(body),
+        });
+        if (!res.ok) {
+            let message = `HTTP ${res.status}`;
+            try {
+                const data = (await res.json());
+                if (data.error)
+                    message = data.error;
+            }
+            catch {
+                /* ignore */
+            }
+            throw new Error(message);
+        }
+        if (res.status === 204)
+            return undefined;
+        return (await res.json());
+    }
+}
+/** Env only (no prompt). Prefer ensureSessionToken for interactive commands. */
+export function getSessionToken() {
+    const fromEnv = process.env.GETMYENV_TOKEN?.trim();
+    if (fromEnv)
+        return fromEnv;
+    return readCredentials()?.token;
+}
+/**
+ * Env → credentials file → interactive paste (TTY) saved for next time.
+ * Non-TTY without a token throws with login instructions.
+ */
+export async function ensureSessionToken() {
+    const existing = getSessionToken();
+    if (existing)
+        return existing;
+    if (!process.stdin.isTTY) {
+        throw new Error("No CLI token. Run: npx getmyenv login  (or set GETMYENV_TOKEN for CI)");
+    }
+    console.log(pc.dim("Create a token at https://getmyenv.com/cli (or your local /cli), then paste it."));
+    const token = (await promptHidden("Paste CLI token: ")).trim();
+    if (!token) {
+        throw new Error("No token entered. Run: npx getmyenv login");
+    }
+    const file = writeCredentials({
+        token,
+        apiUrl: readCredentials()?.apiUrl,
+    });
+    console.log(`${pc.green("✓")} Saved CLI token to ${file}\n`);
+    return token;
+}
+export { clearCredentials, credentialsFilePath, writeCredentials, readCredentials };
+//# sourceMappingURL=api.js.map

package/dist/lib/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAE1B,2DAA2D;AAC3D,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AAEnC,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAE9C,8DAA8D;AAC9D,MAAM,UAAU,aAAa,CAAC,WAAoB;IAChD,IAAI,WAAW,EAAE,IAAI,EAAE;QAAE,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC;IACnD,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;QACzC,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,KAAK,GAAG,eAAe,EAAE,EAAE,MAAM,CAAC;IACxC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,EAAE,CAAC;AAE/C,MAAM,OAAO,SAAS;IAEV;IACA;IAFV,YACU,OAAe,EACf,KAAc;QADd,YAAO,GAAP,OAAO,CAAQ;QACf,UAAK,GAAL,KAAK,CAAS;IACrB,CAAC;IAEI,OAAO,CAAC,KAA8B;QAC5C,MAAM,CAAC,GAA2B;YAChC,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;YAC1B,wBAAwB,EAAE,WAAW;YACrC,GAAG,KAAK;SACT,CAAC;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,CAAC,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;QACzD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAc,EACd,IAAY,EACZ,IAAc,EACd,YAAqC;QAErC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YACnE,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;YACnC,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC5D,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,OAAO,GAAG,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;gBACtD,IAAI,IAAI,CAAC,KAAK;oBAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC;CACF;AAED,gFAAgF;AAChF,MAAM,UAAU,eAAe;IAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,eAAe,EAAE,EAAE,KAAK,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CACJ,iFAAiF,CAClF,CACF,CAAC;IACF,MAAM,KAAK,GAAG,CACZ,MAAM,YAAY,CAAC,mBAAmB,CAAC,CACxC,CAAC,IAAI,EAAE,CAAC;IACT,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC5B,KAAK;QACL,MAAM,EAAE,eAAe,EAAE,EAAE,MAAM;KAClC,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,IAAI,IAAI,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC"}