getmyenv 0.12.1 → 0.12.2

package/README.md

@@ -49,7 +49,7 @@ my-app/
 ```
 
 <!-- cli:help -->
-Output of `npx getmyenv --help` (0.12.1):
+Output of `npx getmyenv --help` (0.12.2):
 
 ```text
 Usage: getmyenv [options] [command]

package/dist/lib/keychain.js

@@ -2,8 +2,8 @@ import { createHash } from "node:crypto";
 import { VAULT_UNLOCK_MS } from "@getmyenv/shared";
 /**
  * Unlocked open context keys, remembered in the OS keychain (macOS Keychain,
- * Windows Credential Manager, Linux Secret Service) for a few hours so `run`
- * on an open context does not ask for the Vault password every time.
+ * Windows Credential Manager, Linux Secret Service) for a few hours so `run`,
+ * `set` and `import` on an open context do not ask for the Vault password every time.
  * Never the Vault password or the private key.
  */
 const SERVICE = "getmyenv";

package/dist/lib/vault.js

@@ -20,12 +20,32 @@ export function fetchVault(linked) {
 export async function writeKey(linked, target) {
     if (!versions.has(target.id))
         memo.delete(target.id);
+    const cached = await cachedWriteKey(linked, target);
+    if (cached)
+        return cached;
     const key = await contextKey(linked, { ...target, sealedKey: undefined }, { create: true });
     const keyVersion = versions.get(target.id);
     if (keyVersion === undefined)
         throw new Error(`No key version for ${target.slug}. Run the command again.`);
     return { key, keyVersion };
 }
+/** An open context key from the keychain, with the version from a fresh vault response. No password. */
+async function cachedWriteKey(linked, target) {
+    if (memo.has(target.id) || linked.who.token.kind === "server" || target.protection !== "open")
+        return null;
+    const account = keychainFor(linked);
+    if (!account)
+        return null;
+    const ctx = (await fetchVault(linked)).contexts.find((c) => c.id === target.id);
+    if (!ctx || ctx.protection !== "open" || !ctx.hasKey || !ctx.sealedKey)
+        return null;
+    const key = await readCachedContextKey(account, ctx.id, JSON.stringify(ctx.sealedKey));
+    if (!key)
+        return null;
+    memo.set(ctx.id, key);
+    versions.set(ctx.id, ctx.keyVersion);
+    return { key, keyVersion: ctx.keyVersion };
+}
 /** The context key, unlocking with the Vault password when needed. */
 export async function contextKey(linked, target, opts = {}) {
     const cached = memo.get(target.id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "getmyenv",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "description": "CLI for getmyenv, an encrypted store for environment variables and secrets. We store ciphertext only.",
   "type": "module",
   "bin": {