getmyenv 0.12.2 → 0.13.0

package/README.md

@@ -49,7 +49,7 @@ my-app/
 ```
 
 <!-- cli:help -->
-Output of `npx getmyenv --help` (0.12.2):
+Output of `npx getmyenv --help` (0.13.0):
 
 ```text
 Usage: getmyenv [options] [command]
@@ -77,6 +77,8 @@ Commands:
                               goes to that context)
   export [options]            Write a context to a plaintext .env file, for
                               tools that need one
+  push [options] <provider>   Copy a context to Vercel or Netlify with your
+                              platform token (VERCEL_TOKEN, NETLIFY_AUTH_TOKEN)
   guest [options]             Create a guest project without an account. It
                               works for 30 days. Claim it within 60.
   claim [options]             Claim a guest project (reads .getmyenv/claim.json,
@@ -118,6 +120,15 @@ export GETMYENV_TOKEN=...   # server token from the dashboard
 npx getmyenv run -- node server.js
 ```
 
+Windows PowerShell:
+
+```powershell
+$env:GETMYENV_TOKEN="..."
+npx getmyenv run -- node server.js
+```
+
+Check it works: `npx getmyenv run --explain` lists each name and where its value comes from. Never values.
+
 Server tokens are read-only. `set` needs the folder token from browser sign-in, or a guest project. `printf %s "$VALUE" | npx getmyenv set API_KEY --stdin` keeps the value out of argv.
 
 - `GETMYENV_TOKEN`: a server token from Project settings, Tokens.

package/dist/cli.js

@@ -6,6 +6,7 @@ import { contextCreateCommand, contextListCommand, contextUseCommand, } from "./
 import { exportCommand } from "./commands/export.js";
 import { guestCommand } from "./commands/guest.js";
 import { importCommand } from "./commands/import.js";
+import { pushCommand } from "./commands/push.js";
 import { lockCommand } from "./commands/lock.js";
 import { lsCommand } from "./commands/ls.js";
 import { restoreCommand } from "./commands/restore.js";
@@ -88,6 +89,7 @@ export function buildProgram(argv) {
     define(program, "ls").action((opts) => lsCommand(opts));
     define(program, "import").action((file, opts) => importCommand(file, opts));
     define(program, "export").action((opts) => exportCommand(opts));
+    define(program, "push").action((provider, opts) => pushCommand(provider, opts));
     define(program, "guest").action((opts) => guestCommand(opts));
     define(program, "claim").action((opts) => claimCommand(opts));
     define(program, "backup").action((opts) => backupCommand(opts));

package/dist/commands/export.js

@@ -1,14 +1,12 @@
 import fs from "node:fs";
 import pc from "picocolors";
-import { decryptSecret, parsePayload } from "@getmyenv/crypto";
 import { EXPORT_WARNING, formatDotenvValue } from "@getmyenv/shared";
 import { ensureGitignoreHas, ensureGitignoreHasEnv, parseEnvFile, writePrivateFile, } from "../lib/fs.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { resolveContext } from "../lib/context.js";
 import { confirmDiff } from "../lib/confirm.js";
+import { decryptContext } from "../lib/read-context.js";
 import { resolveValues } from "../lib/resolve.js";
-import { contextKey } from "../lib/vault.js";
-import { assertVariableNames } from "../lib/run-env.js";
 /**
  * `export`: write one context to a plaintext file, for tools that need one.
  * Read-only contexts go through the same checks as `run`: server token,
@@ -22,14 +20,7 @@ export async function exportCommand(opts) {
     const data = ctx.protection === "locked"
         ? await resolveValues(linked.client, linked.who.project.id, ctx.slug, "export")
         : await linked.client.request("GET", `/api/cli/values?context=${encodeURIComponent(ctx.slug)}`);
-    assertVariableNames([...data.values.map((v) => v.name), ...data.missing.map((m) => m.name)]);
-    const remote = {};
-    if (data.values.length > 0) {
-        const key = await contextKey(linked, { ...ctx, sealedKey: data.sealedKey });
-        for (const v of data.values) {
-            remote[v.name] = decryptSecret(key, v.name, parsePayload(v.ciphertext));
-        }
-    }
+    const { values: remote } = await decryptContext(linked, ctx, data);
     const lines = [
         `# Exported by getmyenv from ${ctx.slug}. Plaintext. Do not commit.`,
         ...Object.entries(remote).map(([k, v]) => `${k}=${formatDotenvValue(v)}`),

package/dist/commands/import.js

@@ -6,7 +6,8 @@ import { contextSlugFromEnvFile, ensureGitignoreHasEnv, parseEnvFile, promptConf
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { defaultContextSlug, findContext, resolveContext } from "../lib/context.js";
 import { confirmDiff } from "../lib/confirm.js";
-import { printDidYouMean } from "../lib/known-keys.js";
+import { printDidYouMean, printPublicSecretWarnings } from "../lib/known-keys.js";
+import { refreshKnownKeys } from "../lib/known-keys-cache.js";
 import { syncFromLinked } from "../lib/template-file.js";
 import { uploadValues } from "../lib/upload.js";
 import { runLine } from "./start.js";
@@ -69,6 +70,7 @@ async function ensureTargetContext(linked, slug, opts) {
 /** `import [file]`: encrypt .env values locally and upload them to contexts. */
 export async function importCommand(file, opts) {
     const linked = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
+    await refreshKnownKeys(linked.apiUrl);
     const { who, meta } = linked;
     const explicitContext = opts.context ? resolveContext(who, meta, opts.context).slug : undefined;
     let files;
@@ -131,6 +133,7 @@ export async function importCommand(file, opts) {
             console.error(`  ${opts.prune ? pc.red("-") : pc.dim("=")} ${name}${pc.dim(opts.prune ? " (unset, not in file)" : " (kept, not in file)")}`);
         }
         printDidYouMean(names, "  ");
+        printPublicSecretWarnings(pairs, "  ");
         if (opts.dryRun) {
             console.error("");
             continue;

package/dist/commands/push.d.ts

@@ -0,0 +1,25 @@
+import type { PlannedVar, PushAdapter, PushProviderId } from "../providers/types.js";
+export type PushOpts = {
+    context?: string;
+    apiUrl?: string;
+    project?: string;
+    team?: string;
+    site?: string;
+    target?: string;
+    prune?: boolean;
+    dryRun?: boolean;
+    yes?: boolean;
+};
+export declare function createAdapter(provider: PushProviderId, token: string, opts: PushOpts): PushAdapter;
+/** Names-only plan. Values never leave this function except to the platform. */
+export declare function buildPlan(adapter: PushAdapter, values: Record<string, string>, remote: string[], prune: boolean): {
+    upserts: PlannedVar[];
+    prune: string[];
+    reserved: string[];
+};
+export declare function formatPlan(upserts: PlannedVar[], prune: string[]): string[];
+/**
+ * `push vercel|netlify`: decrypt one context on this machine and write it to
+ * the platform with the user's own token. The token never reaches getmyenv.
+ */
+export declare function pushCommand(providerArg: string, opts: PushOpts): Promise<void>;

package/dist/commands/push.js

@@ -0,0 +1,188 @@
+import pc from "picocolors";
+import { pushFingerprint } from "@getmyenv/crypto";
+import { describePushDestination, PUSH_PROVIDER_TARGETS, PUSH_PROVIDER_TITLES, PUSH_TOKEN_ENV, publicSecretWarning, } from "@getmyenv/shared";
+import { ensureTokenAndLink } from "../lib/bootstrap.js";
+import { resolveContext } from "../lib/context.js";
+import { promptConfirm } from "../lib/fs.js";
+import { readContextValues } from "../lib/read-context.js";
+import { createNetlifyAdapter } from "../providers/netlify.js";
+import { createVercelAdapter } from "../providers/vercel.js";
+const TOKEN_URLS = {
+    vercel: "https://vercel.com/account/tokens",
+    netlify: "https://app.netlify.com/user/applications#personal-access-tokens",
+};
+function variables(n) {
+    return `${n} ${n === 1 ? "variable" : "variables"}`;
+}
+export function createAdapter(provider, token, opts) {
+    const target = opts.target ?? "production";
+    if (provider === "vercel") {
+        return createVercelAdapter({ token, target, project: opts.project, team: opts.team });
+    }
+    return createNetlifyAdapter({ token, target, site: opts.site });
+}
+/** Names-only plan. Values never leave this function except to the platform. */
+export function buildPlan(adapter, values, remote, prune) {
+    const remoteSet = new Set(remote);
+    const reserved = [];
+    const upserts = [];
+    for (const name of Object.keys(values).sort()) {
+        if (adapter.isReserved(name)) {
+            reserved.push(name);
+            continue;
+        }
+        upserts.push({
+            name,
+            value: values[name],
+            type: adapter.typeFor(name),
+            change: remoteSet.has(name) ? "update" : "add",
+        });
+    }
+    const local = new Set(Object.keys(values));
+    const toPrune = prune ? remote.filter((n) => !local.has(n) && !adapter.isReserved(n)).sort() : [];
+    return { upserts, prune: toPrune, reserved };
+}
+export function formatPlan(upserts, prune) {
+    const width = Math.max(0, ...upserts.map((u) => u.name.length), ...prune.map((n) => n.length));
+    return [
+        ...upserts.map((u) => {
+            const mark = u.change === "add" ? pc.green("+") : pc.yellow("~");
+            return `  ${mark} ${u.name.padEnd(width)}  ${pc.dim(u.type)}`;
+        }),
+        ...prune.map((n) => `  ${pc.red("-")} ${n.padEnd(width)}  ${pc.dim("(prune)")}`),
+    ];
+}
+function printSkipped(title, items) {
+    if (items.length === 0)
+        return;
+    console.log(pc.yellow(title));
+    for (const s of items)
+        console.log(`  ${s.name} ${pc.dim(`- ${s.reason}`)}`);
+}
+/**
+ * `push vercel|netlify`: decrypt one context on this machine and write it to
+ * the platform with the user's own token. The token never reaches getmyenv.
+ */
+export async function pushCommand(providerArg, opts) {
+    const provider = providerArg.toLowerCase();
+    if (provider !== "vercel" && provider !== "netlify") {
+        throw new Error(`Unknown provider: ${providerArg}. Use vercel or netlify.`);
+    }
+    const title = PUSH_PROVIDER_TITLES[provider];
+    const targets = PUSH_PROVIDER_TARGETS[provider];
+    const target = opts.target ?? "production";
+    if (!targets.includes(target)) {
+        throw new Error(`--target for ${provider} is one of: ${targets.join(", ")}.`);
+    }
+    if (provider === "vercel" && opts.site)
+        throw new Error("--site is for netlify. Use --project for vercel.");
+    if (provider === "netlify" && (opts.project || opts.team)) {
+        throw new Error("--project and --team are for vercel. Use --site for netlify.");
+    }
+    const tokenEnv = PUSH_TOKEN_ENV[provider];
+    const token = process.env[tokenEnv]?.trim();
+    if (!token) {
+        throw new Error(`Set ${tokenEnv} to your ${title} token. Create one at ${TOKEN_URLS[provider]}`);
+    }
+    const linked = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
+    if (linked.who.isGuest) {
+        throw new Error("Push needs an account. Claim this project first: npx getmyenv claim");
+    }
+    const ctx = resolveContext(linked.who, linked.meta, opts.context);
+    const adapter = createAdapter(provider, token, { ...opts, target });
+    const dest = await adapter.destination();
+    const where = describePushDestination(dest);
+    const read = await readContextValues(linked, ctx.slug, "push");
+    if (Object.keys(read.values).length === 0 || !read.key) {
+        throw new Error(`${ctx.slug} has no values to push.`);
+    }
+    const contextKey = read.key;
+    const { skip, warnings } = adapter.check(read.values);
+    const skipNames = new Set(skip.map((s) => s.name));
+    const values = Object.fromEntries(Object.entries(read.values).filter(([n]) => !skipNames.has(n)));
+    const remote = await adapter.remoteNames();
+    const plan = buildPlan(adapter, values, remote, Boolean(opts.prune));
+    const pushed = Object.fromEntries(plan.upserts.map((u) => [u.name, u.value]));
+    if (plan.upserts.length === 0)
+        throw new Error(`Nothing to push from ${ctx.slug}.`);
+    console.log(`${pc.bold(ctx.slug)} to ${where}`);
+    for (const line of formatPlan(plan.upserts, plan.prune))
+        console.log(line);
+    console.log("");
+    if (plan.reserved.length > 0) {
+        console.log(pc.dim(`Not pushed, ${dest.title} sets or reserves these names: ${plan.reserved.join(", ")}`));
+    }
+    printSkipped("Not pushed:", skip);
+    if (read.missing.length > 0) {
+        console.log(pc.dim(`No value in ${ctx.slug}, not pushed: ${read.missing.map((m) => m.name).join(", ")}`));
+    }
+    for (const w of warnings)
+        console.log(pc.yellow(w));
+    for (const u of plan.upserts) {
+        const warn = publicSecretWarning(u.name, u.value);
+        if (warn)
+            console.log(pc.yellow(warn));
+    }
+    for (const note of adapter.planNotes(plan.upserts))
+        console.log(pc.dim(note));
+    if (opts.dryRun) {
+        const past = await linked.client
+            .request("GET", `/api/cli/push?context=${encodeURIComponent(ctx.slug)}`)
+            .catch(() => ({ pushes: [] }));
+        const last = past.pushes.find((p) => p.provider === dest.provider && p.externalId === dest.externalId && p.target === dest.target);
+        if (last) {
+            const same = last.fingerprint === pushFingerprint(contextKey, pushed);
+            console.log(same
+                ? `No changes in getmyenv since the last push to ${where}.`
+                : `Changed in getmyenv since the last push to ${where}.`);
+        }
+        console.log(pc.dim("Dry run. Nothing was written."));
+        return;
+    }
+    const question = `Push ${variables(plan.upserts.length)} to ${where}?`;
+    if (plan.prune.length > 0) {
+        console.log(pc.red(`Removes from ${where}: ${plan.prune.join(", ")}`));
+    }
+    if (!opts.yes) {
+        if (!process.stdin.isTTY)
+            throw new Error(`${question} Re-run with --yes to confirm.`);
+        if (!(await promptConfirm(question, { defaultYes: false }))) {
+            console.log(pc.dim("Nothing was written."));
+            return;
+        }
+    }
+    const result = await adapter.apply(plan.upserts, plan.prune);
+    const readable = result.written.filter((w) => w.type === "readable").length;
+    const sensitive = result.written.length - readable;
+    if (result.written.length > 0) {
+        console.log(`${pc.green("✓")} Pushed ${variables(result.written.length)} to ${where}. Readable: ${readable}. Sensitive: ${sensitive}.`);
+        console.log(`That copy lives in ${dest.title}.`);
+        console.log("Future changes in getmyenv are not pushed automatically.");
+    }
+    if (result.pruned.length > 0)
+        console.log(`Removed: ${result.pruned.join(", ")}`);
+    for (const note of result.notes)
+        console.log(pc.yellow(note));
+    printSkipped("Not pruned:", result.notPruned);
+    printSkipped("Not pushed:", result.notWritten);
+    if (result.written.length > 0) {
+        const written = Object.fromEntries(result.written.map((w) => [w.name, pushed[w.name]]));
+        try {
+            await linked.client.request("POST", "/api/cli/push", {
+                context: ctx.slug,
+                provider: dest.provider,
+                target: dest.target,
+                externalId: dest.externalId,
+                externalName: dest.externalName,
+                ownerSlug: dest.ownerSlug,
+                names: Object.keys(written).sort(),
+                fingerprint: pushFingerprint(contextKey, written),
+            });
+        }
+        catch (err) {
+            console.log(pc.yellow(`The push worked, but getmyenv could not record it: ${err.message}`));
+        }
+    }
+    if (result.notWritten.length > 0)
+        process.exitCode = 1;
+}

package/dist/commands/run.js

@@ -1,13 +1,11 @@
 import { spawn } from "node:child_process";
 import os from "node:os";
 import pc from "picocolors";
-import { decryptSecret, parsePayload } from "@getmyenv/crypto";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { resolveContext } from "../lib/context.js";
 import { pendingFirstRunHints } from "../lib/first-run.js";
-import { resolveValues } from "../lib/resolve.js";
-import { contextKey } from "../lib/vault.js";
-import { assertVariableNames, explainLines, mergeEnv, runContextLabel, signalExitCode, validationError, windowsCommandLine, } from "../lib/run-env.js";
+import { readContextValues } from "../lib/read-context.js";
+import { explainLines, mergeEnv, runContextLabel, signalExitCode, validationError, windowsCommandLine, } from "../lib/run-env.js";
 /** Status lines go to stderr so the child's stdout stays clean for pipes. */
 const log = (line = "") => console.error(line);
 /** Resolve, validate, merge, spawn. */
@@ -16,18 +14,10 @@ export async function runCommand(opts, childArgs) {
         throw new Error("Usage: npx getmyenv run [context] -- <command>");
     }
     const linked = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
-    const { who, client, meta } = linked;
+    const { who, meta } = linked;
     const ctx = resolveContext(who, meta, opts.context);
-    const res = await resolveValues(client, who.project.id, ctx.slug, "run");
-    assertVariableNames([...res.values.map((v) => v.name), ...res.missing.map((m) => m.name)]);
-    const values = {};
-    if (res.values.length > 0) {
-        const key = await contextKey(linked, { ...res.context, sealedKey: res.sealedKey });
-        for (const v of res.values) {
-            values[v.name] = decryptSecret(key, v.name, parsePayload(v.ciphertext));
-        }
-    }
-    const merged = mergeEnv(process.env, values, res.missing, opts.keepExisting === true);
+    const res = await readContextValues(linked, ctx.slug, "run");
+    const merged = mergeEnv(process.env, res.values, res.missing, opts.keepExisting === true);
     const label = runContextLabel(res.context);
     if (opts.explain) {
         log(pc.bold(`${who.project.name} / ${label}`));

package/dist/commands/set.js

@@ -3,7 +3,8 @@ import { variableNameSchema } from "@getmyenv/shared";
 import { promptHidden } from "../lib/fs.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { resolveContext } from "../lib/context.js";
-import { printDidYouMean } from "../lib/known-keys.js";
+import { printDidYouMean, printPublicSecretWarnings } from "../lib/known-keys.js";
+import { refreshKnownKeys } from "../lib/known-keys-cache.js";
 import { syncFromLinked } from "../lib/template-file.js";
 import { assertWritable, uploadValues } from "../lib/upload.js";
 async function readStdinValue() {
@@ -75,7 +76,11 @@ export async function setCommand(args, opts) {
         console.log(`${pc.green("✓")} ${name} ${pc.dim(`set in ${ctx.slug}`)}`);
     for (const name of res.declared)
         console.log(`${pc.yellow("○")} ${name} ${pc.dim(`declared, no value in ${ctx.slug}`)}`);
-    printDidYouMean(pairs.map((p) => p.name).filter((n) => !linked.who.keys.some((k) => k.name === n)));
+    const newNames = pairs.map((p) => p.name).filter((n) => !linked.who.keys.some((k) => k.name === n));
+    if (newNames.length > 0)
+        await refreshKnownKeys(linked.apiUrl);
+    printDidYouMean(newNames);
+    printPublicSecretWarnings(values);
     syncFromLinked(linked, { added: [...res.set, ...res.declared] });
 }
 export async function unsetCommand(names, opts) {

package/dist/commands/template.js

@@ -1,9 +1,10 @@
 import pc from "picocolors";
-import { knownKey, knownKeyFormatHint, linkDomain, parseTemplateRef, } from "@getmyenv/shared";
+import { linkDomain, parseTemplateRef, } from "@getmyenv/shared";
 import { promptHidden } from "../lib/fs.js";
 import { ApiClient, getSessionToken, resolveApiUrl } from "../lib/api.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { resolveContext } from "../lib/context.js";
+import { knownKeys, refreshKnownKeys } from "../lib/known-keys-cache.js";
 import { syncFromLinked } from "../lib/template-file.js";
 import { assertWritable, uploadValues } from "../lib/upload.js";
 /** Load a public template by id or URL. No token needed. */
@@ -79,10 +80,12 @@ export async function askMissingValues(keys, linked, ctx) {
         console.error(`${pc.green("✓")} Every template variable has a value in ${ctx.slug}.`);
         return;
     }
+    await refreshKnownKeys(linked.apiUrl);
+    const catalog = knownKeys();
     console.error(`Values for ${pc.bold(ctx.slug)}. Hidden as you type. Enter skips one.\n`);
     const pairs = {};
     for (const key of todo) {
-        const known = knownKey(key.name);
+        const known = catalog.get(key.name);
         const description = key.description || known?.description;
         const link = key.link || known?.docsUrl;
         console.error(`${pc.bold(key.name)}${key.optional ? pc.dim(" (optional)") : ""}`);
@@ -92,7 +95,7 @@ export async function askMissingValues(keys, linked, ctx) {
             console.error(pc.dim(`  Get it on ${linkDomain(link) ?? link}: ${link}`));
         const value = await promptHidden(`  ${key.name}: `);
         if (value) {
-            const hint = knownKeyFormatHint(key.name, value);
+            const hint = catalog.formatHint(key.name, value);
             if (hint)
                 console.error(pc.yellow(`  ${hint}`));
             pairs[key.name] = value;

package/dist/lib/known-keys-cache.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Staff additions to the known keys list, cached in the config dir and
+ * refreshed once a day. Any failure keeps the bundled list.
+ */
+import { type KnownKeyIndex } from "@getmyenv/shared";
+/** The bundled list plus the cached additions. No network. */
+export declare function knownKeys(): KnownKeyIndex;
+/**
+ * Refresh the cache when it is older than a day or from another server.
+ * Waits at most 2 seconds. Never throws.
+ */
+export declare function refreshKnownKeys(apiUrl: string): Promise<void>;
+/** Tests only. */
+export declare function resetKnownKeysForTests(): void;

package/dist/lib/known-keys-cache.js

@@ -0,0 +1,90 @@
+/**
+ * Staff additions to the known keys list, cached in the config dir and
+ * refreshed once a day. Any failure keeps the bundled list.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { BUNDLED_KNOWN_KEYS, createKnownKeyIndex, KNOWN_KEYS } from "@getmyenv/shared";
+import { getConfigDir } from "./fs.js";
+const CACHE_FILE = "known-keys.json";
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+const FETCH_TIMEOUT_MS = 2000;
+const MAX_BODY_CHARS = 2 * 1024 * 1024;
+let index = null;
+function cachePath() {
+    return path.join(getConfigDir(), CACHE_FILE);
+}
+function readCache() {
+    try {
+        const data = JSON.parse(fs.readFileSync(cachePath(), "utf8"));
+        if (typeof data.apiUrl !== "string" || typeof data.checkedAt !== "string" || !Array.isArray(data.entries)) {
+            return null;
+        }
+        return {
+            apiUrl: data.apiUrl,
+            etag: typeof data.etag === "string" ? data.etag : null,
+            checkedAt: data.checkedAt,
+            entries: data.entries,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function writeCache(data) {
+    try {
+        fs.writeFileSync(cachePath(), JSON.stringify(data), { mode: 0o600 });
+    }
+    catch {
+        /* keep going without a cache */
+    }
+}
+/** The bundled list plus the cached additions. No network. */
+export function knownKeys() {
+    if (index)
+        return index;
+    const cached = readCache();
+    index = cached?.entries.length ? createKnownKeyIndex(KNOWN_KEYS, cached.entries) : BUNDLED_KNOWN_KEYS;
+    return index;
+}
+/**
+ * Refresh the cache when it is older than a day or from another server.
+ * Waits at most 2 seconds. Never throws.
+ */
+export async function refreshKnownKeys(apiUrl) {
+    if (!apiUrl)
+        return;
+    const cached = readCache();
+    const same = cached && cached.apiUrl === apiUrl ? cached : null;
+    if (same && Date.now() - new Date(same.checkedAt).getTime() < CACHE_TTL_MS)
+        return;
+    try {
+        const res = await fetch(`${apiUrl}/api/known-keys`, {
+            headers: same?.etag ? { "If-None-Match": same.etag } : {},
+            redirect: "error",
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        const checkedAt = new Date().toISOString();
+        if (res.status === 304 && same) {
+            writeCache({ ...same, checkedAt });
+            return;
+        }
+        if (!res.ok)
+            return;
+        const text = await res.text();
+        if (text.length > MAX_BODY_CHARS)
+            return;
+        const data = JSON.parse(text);
+        if (!Array.isArray(data.entries))
+            return;
+        writeCache({ apiUrl, etag: res.headers.get("etag"), checkedAt, entries: data.entries });
+        index = null;
+    }
+    catch {
+        /* fail open: bundled or stale cache */
+    }
+}
+/** Tests only. */
+export function resetKnownKeysForTests() {
+    index = null;
+}

package/dist/lib/known-keys.d.ts

@@ -1,3 +1,5 @@
 /** "Did you mean OPENAI_API_KEY?" for names close to a known one. Nothing is renamed. */
 export declare function didYouMean(name: string): string | null;
 export declare function printDidYouMean(names: string[], indent?: string): void;
+/** A public prefix (NEXT_PUBLIC_, VITE_, ...) on a value that looks secret. Nothing is blocked. */
+export declare function printPublicSecretWarnings(pairs: Record<string, string>, indent?: string): void;

package/dist/lib/known-keys.js

@@ -1,8 +1,9 @@
 import pc from "picocolors";
-import { nearMissKnownKey } from "@getmyenv/shared";
+import { publicSecretWarning } from "@getmyenv/shared";
+import { knownKeys } from "./known-keys-cache.js";
 /** "Did you mean OPENAI_API_KEY?" for names close to a known one. Nothing is renamed. */
 export function didYouMean(name) {
-    const near = nearMissKnownKey(name);
+    const near = knownKeys().nearMiss(name);
     if (!near)
         return null;
     const why = near.source === "sdk" ? `${near.provider} SDKs read that name.` : "That is the common name.";
@@ -15,3 +16,11 @@ export function printDidYouMean(names, indent = "") {
             console.error(pc.yellow(`${indent}${name}: ${hint}`));
     }
 }
+/** A public prefix (NEXT_PUBLIC_, VITE_, ...) on a value that looks secret. Nothing is blocked. */
+export function printPublicSecretWarnings(pairs, indent = "") {
+    for (const [name, value] of Object.entries(pairs)) {
+        const warn = publicSecretWarning(name, value);
+        if (warn)
+            console.error(pc.yellow(`${indent}${warn}`));
+    }
+}

package/dist/lib/read-context.d.ts

@@ -0,0 +1,26 @@
+import { type SealedKey } from "@getmyenv/crypto";
+import type { ContextInfo } from "./api.js";
+import type { Linked } from "./bootstrap.js";
+import { type ResolveOk, type ResolvePurpose } from "./resolve.js";
+import { type MissingKey } from "./run-env.js";
+export type ContextData = {
+    sealedKey: SealedKey | null;
+    values: Array<{
+        name: string;
+        ciphertext: string;
+    }>;
+    missing: MissingKey[];
+};
+export type DecryptedContext = {
+    values: Record<string, string>;
+    missing: MissingKey[];
+    /** Null when the context has no values yet. */
+    key: Uint8Array | null;
+};
+/** Check names, open the context key and decrypt every value. Runs on this machine only. */
+export declare function decryptContext(linked: Linked, ctx: ContextInfo, data: ContextData): Promise<DecryptedContext>;
+/** Resolve one context (approval for Read-only ones, as `run` does) and decrypt it. */
+export declare function readContextValues(linked: Linked, slug: string, purpose: ResolvePurpose): Promise<DecryptedContext & {
+    context: ResolveOk["context"];
+    via: ResolveOk["via"];
+}>;

package/dist/lib/read-context.js

@@ -0,0 +1,22 @@
+import { decryptSecret, parsePayload } from "@getmyenv/crypto";
+import { resolveValues } from "./resolve.js";
+import { assertVariableNames } from "./run-env.js";
+import { contextKey } from "./vault.js";
+/** Check names, open the context key and decrypt every value. Runs on this machine only. */
+export async function decryptContext(linked, ctx, data) {
+    assertVariableNames([...data.values.map((v) => v.name), ...data.missing.map((m) => m.name)]);
+    const values = {};
+    if (data.values.length === 0)
+        return { values, missing: data.missing, key: null };
+    const key = await contextKey(linked, { ...ctx, sealedKey: data.sealedKey });
+    for (const v of data.values) {
+        values[v.name] = decryptSecret(key, v.name, parsePayload(v.ciphertext));
+    }
+    return { values, missing: data.missing, key };
+}
+/** Resolve one context (approval for Read-only ones, as `run` does) and decrypt it. */
+export async function readContextValues(linked, slug, purpose) {
+    const res = await resolveValues(linked.client, linked.who.project.id, slug, purpose);
+    const decrypted = await decryptContext(linked, res.context, res);
+    return { ...decrypted, context: res.context, via: res.via };
+}

package/dist/lib/resolve.d.ts

@@ -18,8 +18,9 @@ export type ResolveOk = {
     }>;
     missing: MissingKey[];
 };
+export type ResolvePurpose = "run" | "export" | "push";
 /**
  * Ciphertext for one context. Read-only contexts need a server token, an
  * allowed IP, and a trusted machine or an approval in the dashboard.
  */
-export declare function resolveValues(client: ApiClient, projectId: string, slug: string, purpose: "run" | "export"): Promise<ResolveOk>;
+export declare function resolveValues(client: ApiClient, projectId: string, slug: string, purpose: ResolvePurpose): Promise<ResolveOk>;

package/dist/providers/http.d.ts

@@ -0,0 +1,16 @@
+export declare class PlatformError extends Error {
+    status: number;
+    constructor(message: string, status: number);
+}
+/**
+ * One request to a platform API with the user's own token. No redirects,
+ * fixed timeout. Error messages never include values we sent.
+ */
+export declare function platformRequest<T>(opts: {
+    title: string;
+    base: string;
+    token: string;
+    method: "GET" | "POST" | "PATCH" | "DELETE";
+    path: string;
+    body?: unknown;
+}): Promise<T>;

package/dist/providers/http.js

@@ -0,0 +1,66 @@
+import { API_TIMEOUT_MS } from "../lib/api.js";
+export class PlatformError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+    }
+}
+function errorMessage(body) {
+    if (!body || typeof body !== "object")
+        return null;
+    const b = body;
+    if (typeof b.message === "string")
+        return b.message;
+    if (b.error && typeof b.error === "object") {
+        const e = b.error;
+        if (typeof e.message === "string")
+            return e.message;
+        if (typeof e.code === "string")
+            return e.code;
+    }
+    if (typeof b.error === "string")
+        return b.error;
+    return null;
+}
+/**
+ * One request to a platform API with the user's own token. No redirects,
+ * fixed timeout. Error messages never include values we sent.
+ */
+export async function platformRequest(opts) {
+    let res;
+    try {
+        res = await fetch(`${opts.base}${opts.path}`, {
+            method: opts.method,
+            headers: {
+                authorization: `Bearer ${opts.token}`,
+                ...(opts.body !== undefined ? { "content-type": "application/json" } : {}),
+            },
+            body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,
+            redirect: "error",
+            signal: AbortSignal.timeout(API_TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        const why = err instanceof Error && err.name === "TimeoutError" ? "timed out" : "is unreachable";
+        throw new PlatformError(`${opts.title} ${why}.`, 0);
+    }
+    const text = await res.text();
+    let parsed = null;
+    if (text) {
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            parsed = null;
+        }
+    }
+    if (!res.ok) {
+        if (res.status === 401 || res.status === 403) {
+            throw new PlatformError(`${opts.title} refused the token (${res.status}). Check that it is valid and can reach this project.`, res.status);
+        }
+        const msg = errorMessage(parsed) ?? res.statusText ?? "request failed";
+        throw new PlatformError(`${opts.title} returned ${res.status}: ${msg}`, res.status);
+    }
+    return parsed;
+}

package/dist/providers/netlify.d.ts

@@ -0,0 +1,11 @@
+import type { PushAdapter } from "./types.js";
+export declare const NETLIFY_API = "https://api.netlify.com";
+export declare const isNetlifyReserved: (name: string) => boolean;
+/** `.netlify/state.json`, written by `netlify link`. */
+export declare function readNetlifyStateFile(cwd?: string): string | null;
+export declare function createNetlifyAdapter(opts: {
+    token: string;
+    target: string;
+    site?: string;
+    cwd?: string;
+}): PushAdapter;

package/dist/providers/netlify.js

@@ -0,0 +1,182 @@
+import fs from "node:fs";
+import path from "node:path";
+import { isPublicEnvName, isReservedPushName } from "@getmyenv/shared";
+import { PlatformError, platformRequest } from "./http.js";
+export const NETLIFY_API = "https://api.netlify.com";
+const MAX_VALUE_CHARS = 5000;
+const LAMBDA_TOTAL_BYTES = 4 * 1024;
+export const isNetlifyReserved = (name) => isReservedPushName("netlify", name);
+/** `.netlify/state.json`, written by `netlify link`. */
+export function readNetlifyStateFile(cwd = process.cwd()) {
+    const file = path.join(cwd, ".netlify", "state.json");
+    if (!fs.existsSync(file))
+        return null;
+    try {
+        const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+        return typeof raw.siteId === "string" && raw.siteId ? raw.siteId : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function createNetlifyAdapter(opts) {
+    const target = opts.target;
+    let siteId = "";
+    let accountId = "";
+    let vars = null;
+    const secretRefused = [];
+    const request = (method, p, body) => platformRequest({ title: "Netlify", base: NETLIFY_API, token: opts.token, method, path: p, body });
+    const envPath = (suffix = "") => `/api/v1/accounts/${encodeURIComponent(accountId)}/env${suffix}?site_id=${encodeURIComponent(siteId)}`;
+    const valuesOf = (v) => v.values ?? [];
+    const find = (name) => (vars ?? []).find((v) => v.key === name);
+    const ownValue = (v) => valuesOf(v).find((x) => x.context === target);
+    const hasAll = (v) => valuesOf(v).some((x) => x.context === "all");
+    async function loadVars() {
+        if (!vars)
+            vars = (await request("GET", envPath())) ?? [];
+        return vars;
+    }
+    async function create(name, value, secret) {
+        try {
+            await request("POST", envPath(), [{ key: name, values: [{ context: target, value }], is_secret: secret }]);
+            return secret;
+        }
+        catch (err) {
+            if (secret && err instanceof PlatformError && err.status >= 400 && err.status < 500 && /secret/i.test(err.message)) {
+                await request("POST", envPath(), [{ key: name, values: [{ context: target, value }], is_secret: false }]);
+                secretRefused.push(name);
+                return false;
+            }
+            throw err;
+        }
+    }
+    async function write(v, result) {
+        const existing = find(v.name);
+        const secret = v.type === "sensitive";
+        if (!existing) {
+            return (await create(v.name, v.value, secret)) ? "sensitive" : "readable";
+        }
+        if (hasAll(existing)) {
+            result.notWritten.push({
+                name: v.name,
+                reason: "it has one value for all deploy contexts in Netlify. Give it per-context values there, or remove it, then push again",
+            });
+            return null;
+        }
+        const onlyOurs = valuesOf(existing).every((x) => x.context === target);
+        if (Boolean(existing.is_secret) !== secret && onlyOurs) {
+            // Netlify sets is_secret for the whole variable. It only serves this target, so replace it.
+            await request("DELETE", envPath(`/${encodeURIComponent(v.name)}`));
+            try {
+                return (await create(v.name, v.value, secret)) ? "sensitive" : "readable";
+            }
+            catch (err) {
+                throw new Error(`${v.name} was removed from Netlify to change its type, then adding it again failed: ${err.message} Run push again.`);
+            }
+        }
+        await request("PATCH", envPath(`/${encodeURIComponent(v.name)}`), { context: target, value: v.value });
+        const kept = existing.is_secret ? "sensitive" : "readable";
+        if (kept !== v.type) {
+            result.notes.push(`${v.name} keeps its Netlify type (${kept}). Netlify sets it for every deploy context of the variable.`);
+        }
+        return kept;
+    }
+    return {
+        id: "netlify",
+        title: "Netlify",
+        target,
+        isReserved: isNetlifyReserved,
+        typeFor: (name) => (isPublicEnvName(name) || target === "dev" ? "readable" : "sensitive"),
+        check(values) {
+            const skip = [];
+            const warnings = [];
+            let total = 0;
+            for (const [name, value] of Object.entries(values)) {
+                if (value.length > MAX_VALUE_CHARS) {
+                    skip.push({ name, reason: `longer than ${MAX_VALUE_CHARS} characters, the Netlify limit` });
+                    continue;
+                }
+                total += Buffer.byteLength(name) + Buffer.byteLength(value) + 1;
+            }
+            if (total > LAMBDA_TOTAL_BYTES) {
+                warnings.push(`These values add up to ${Math.ceil(total / 1024)} KB. Netlify Functions in Lambda compatibility mode get at most 4 KB of variables.`);
+            }
+            return { skip, warnings };
+        },
+        planNotes() {
+            if (target !== "dev")
+                return [];
+            return ["Netlify does not keep secret values for local development. Values for dev are readable."];
+        },
+        async destination() {
+            const id = opts.site ?? readNetlifyStateFile(opts.cwd);
+            if (!id) {
+                throw new Error("No Netlify site. Run `netlify link` in this folder, or pass --site <id>.");
+            }
+            const site = await request("GET", `/api/v1/sites/${encodeURIComponent(id)}`);
+            siteId = site.id;
+            accountId = site.account_id;
+            return {
+                provider: "netlify",
+                title: "Netlify",
+                externalId: site.id,
+                externalName: site.name,
+                ownerSlug: site.account_slug,
+                label: `${site.account_slug}/${site.name}`,
+                target,
+            };
+        },
+        async remoteNames() {
+            await loadVars();
+            return (vars ?? [])
+                .filter((v) => !isNetlifyReserved(v.key) && (ownValue(v) || hasAll(v)))
+                .map((v) => v.key);
+        },
+        async apply(upserts, prune) {
+            await loadVars();
+            const result = { written: [], pruned: [], notPruned: [], notWritten: [], notes: [] };
+            for (const v of upserts) {
+                try {
+                    const type = await write(v, result);
+                    if (type)
+                        result.written.push({ name: v.name, type });
+                }
+                catch (err) {
+                    result.notWritten.push({ name: v.name, reason: err.message });
+                }
+            }
+            if (secretRefused.length > 0) {
+                result.notes.push(`Netlify refused secret values for this account. Pushed as readable: ${secretRefused.join(", ")}.`);
+            }
+            for (const name of prune) {
+                const existing = find(name);
+                if (!existing)
+                    continue;
+                if (hasAll(existing)) {
+                    result.notPruned.push({ name, reason: "one value for all deploy contexts, cannot remove only " + target });
+                    continue;
+                }
+                const own = ownValue(existing);
+                if (!own)
+                    continue;
+                try {
+                    if (valuesOf(existing).length === 1) {
+                        await request("DELETE", envPath(`/${encodeURIComponent(name)}`));
+                    }
+                    else if (own.id) {
+                        await request("DELETE", envPath(`/${encodeURIComponent(name)}/value/${encodeURIComponent(own.id)}`));
+                    }
+                    else {
+                        result.notPruned.push({ name, reason: `Netlify did not return an id for its ${target} value` });
+                        continue;
+                    }
+                    result.pruned.push(name);
+                }
+                catch (err) {
+                    result.notPruned.push({ name, reason: err.message });
+                }
+            }
+            return result;
+        },
+    };
+}

package/dist/providers/types.d.ts

@@ -0,0 +1,56 @@
+import type { PushProvider } from "@getmyenv/shared";
+export type PushProviderId = PushProvider;
+/** How the platform stores a value. Readable: anyone with project access sees it. Sensitive: write-only. */
+export type VarType = "readable" | "sensitive";
+export type Destination = {
+    provider: PushProviderId;
+    /** "Vercel" or "Netlify". */
+    title: string;
+    externalId: string;
+    /** Vercel project name or Netlify site name. Used in links. */
+    externalName: string;
+    /** Vercel team or user slug, Netlify account slug. */
+    ownerSlug: string;
+    /** What we print: "acme/web". */
+    label: string;
+    target: string;
+};
+export type PlannedVar = {
+    name: string;
+    value: string;
+    type: VarType;
+    change: "add" | "update";
+};
+export type Skipped = {
+    name: string;
+    reason: string;
+};
+export type ApplyResult = {
+    written: Array<{
+        name: string;
+        type: VarType;
+    }>;
+    pruned: string[];
+    notPruned: Skipped[];
+    notWritten: Skipped[];
+    notes: string[];
+};
+export interface PushAdapter {
+    readonly id: PushProviderId;
+    readonly title: string;
+    readonly target: string;
+    /** Names the platform sets itself or refuses. Never written, never pruned. */
+    isReserved(name: string): boolean;
+    typeFor(name: string): VarType;
+    /** Local checks before any write. */
+    check(values: Record<string, string>): {
+        skip: Skipped[];
+        warnings: string[];
+    };
+    /** Extra lines printed with the plan. */
+    planNotes(plan: PlannedVar[]): string[];
+    destination(): Promise<Destination>;
+    /** Names that have a value for this target, without system or reserved names. */
+    remoteNames(): Promise<string[]>;
+    apply(upserts: PlannedVar[], prune: string[]): Promise<ApplyResult>;
+}

package/dist/providers/types.js

@@ -0,0 +1 @@
+export {};

package/dist/providers/vercel.d.ts

@@ -0,0 +1,17 @@
+import type { PushAdapter } from "./types.js";
+export declare const VERCEL_API = "https://api.vercel.com";
+export declare const isVercelReserved: (name: string) => boolean;
+type ProjectRef = {
+    projectId: string;
+    teamId?: string;
+};
+/** `.vercel/project.json`, written by `vercel link`. */
+export declare function readVercelProjectFile(cwd?: string): ProjectRef | null;
+export declare function createVercelAdapter(opts: {
+    token: string;
+    target: string;
+    project?: string;
+    team?: string;
+    cwd?: string;
+}): PushAdapter;
+export {};

package/dist/providers/vercel.js

@@ -0,0 +1,203 @@
+import fs from "node:fs";
+import path from "node:path";
+import { isPublicEnvName, isReservedPushName } from "@getmyenv/shared";
+import { PlatformError, platformRequest } from "./http.js";
+export const VERCEL_API = "https://api.vercel.com";
+const MAX_TOTAL_BYTES = 64 * 1024;
+export const isVercelReserved = (name) => isReservedPushName("vercel", name);
+/** `.vercel/project.json`, written by `vercel link`. */
+export function readVercelProjectFile(cwd = process.cwd()) {
+    const file = path.join(cwd, ".vercel", "project.json");
+    if (!fs.existsSync(file))
+        return null;
+    try {
+        const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+        if (typeof raw.projectId !== "string" || !raw.projectId)
+            return null;
+        const teamId = typeof raw.orgId === "string" && raw.orgId.startsWith("team_") ? raw.orgId : undefined;
+        return { projectId: raw.projectId, teamId };
+    }
+    catch {
+        return null;
+    }
+}
+function targetsOf(env) {
+    if (Array.isArray(env.target))
+        return env.target;
+    return env.target ? [env.target] : [];
+}
+function vercelType(type) {
+    return type === "sensitive" ? "sensitive" : "encrypted";
+}
+export function createVercelAdapter(opts) {
+    const target = opts.target;
+    let projectId = "";
+    let teamId;
+    let envs = null;
+    const request = (method, p, body) => {
+        const sep = p.includes("?") ? "&" : "?";
+        const full = teamId ? `${p}${sep}teamId=${encodeURIComponent(teamId)}` : p;
+        return platformRequest({ title: "Vercel", base: VERCEL_API, token: opts.token, method, path: full, body });
+    };
+    /** Entries that set a value for the pushed target on every branch. Branch-only entries are not ours. */
+    const forTarget = (key) => (envs ?? []).filter((e) => !e.gitBranch && targetsOf(e).includes(target) && (key === undefined || e.key === key));
+    async function loadEnvs() {
+        if (!envs) {
+            const res = await request("GET", `/v9/projects/${encodeURIComponent(projectId)}/env`);
+            envs = res.envs ?? [];
+        }
+        return envs;
+    }
+    async function create(name, value, type) {
+        await request("POST", `/v10/projects/${encodeURIComponent(projectId)}/env`, {
+            key: name,
+            value,
+            type: vercelType(type),
+            target: [target],
+        });
+    }
+    async function remove(id) {
+        await request("DELETE", `/v9/projects/${encodeURIComponent(projectId)}/env/${encodeURIComponent(id)}`);
+    }
+    async function setTargets(id, targets) {
+        await request("PATCH", `/v9/projects/${encodeURIComponent(projectId)}/env/${encodeURIComponent(id)}`, {
+            target: targets,
+        });
+    }
+    async function write(v) {
+        const [entry] = forTarget(v.name);
+        const want = vercelType(v.type);
+        if (entry && targetsOf(entry).length === 1 && entry.type === want) {
+            await request("PATCH", `/v9/projects/${encodeURIComponent(projectId)}/env/${encodeURIComponent(entry.id)}`, {
+                value: v.value,
+            });
+            return v.type;
+        }
+        if (entry && targetsOf(entry).length === 1) {
+            // Vercel does not change a variable's type in place. Remove and add it again, for this target only.
+            await remove(entry.id);
+        }
+        else if (entry) {
+            // The entry also serves other targets. They keep it. This target gets its own entry.
+            await setTargets(entry.id, targetsOf(entry).filter((t) => t !== target));
+        }
+        try {
+            await create(v.name, v.value, v.type);
+            return v.type;
+        }
+        catch (err) {
+            if (v.type === "sensitive" && target === "development" && err instanceof PlatformError && err.status === 400) {
+                await create(v.name, v.value, "readable");
+                return "readable";
+            }
+            if (entry) {
+                throw new Error(`${v.name} was taken off Vercel ${target} to write it again, then adding it failed: ${err.message} Run push again.`);
+            }
+            throw err;
+        }
+    }
+    return {
+        id: "vercel",
+        title: "Vercel",
+        target,
+        isReserved: isVercelReserved,
+        typeFor: (name) => (isPublicEnvName(name) ? "readable" : "sensitive"),
+        check(values) {
+            const skip = [];
+            const warnings = [];
+            let total = 0;
+            for (const [name, value] of Object.entries(values)) {
+                const bytes = Buffer.byteLength(name) + Buffer.byteLength(value);
+                if (bytes > MAX_TOTAL_BYTES) {
+                    skip.push({ name, reason: "larger than 64 KB, the Vercel limit" });
+                    continue;
+                }
+                total += bytes;
+            }
+            if (total > MAX_TOTAL_BYTES) {
+                warnings.push(`These values add up to ${Math.ceil(total / 1024)} KB. Vercel allows 64 KB of variables per deployment.`);
+            }
+            return { skip, warnings };
+        },
+        planNotes(plan) {
+            if (target !== "development" || !plan.some((p) => p.type === "sensitive"))
+                return [];
+            return [
+                "If Vercel refuses Sensitive for Development, those variables are pushed as readable and listed after the push.",
+            ];
+        },
+        async destination() {
+            const file = opts.project ? null : readVercelProjectFile(opts.cwd);
+            const ref = opts.project ? { projectId: opts.project, teamId: opts.team } : file;
+            if (!ref) {
+                throw new Error("No Vercel project. Run `vercel link` in this folder, or pass --project <id> (and --team <id> for a team project).");
+            }
+            projectId = ref.projectId;
+            teamId = opts.team ?? ref.teamId;
+            const project = await request("GET", `/v9/projects/${encodeURIComponent(projectId)}`);
+            projectId = project.id;
+            if (!teamId && project.accountId?.startsWith("team_"))
+                teamId = project.accountId;
+            let ownerSlug;
+            if (teamId) {
+                const team = await request("GET", `/v2/teams/${encodeURIComponent(teamId)}`);
+                ownerSlug = team.slug;
+            }
+            else {
+                const me = await request("GET", "/v2/user");
+                ownerSlug = me.user.username;
+            }
+            return {
+                provider: "vercel",
+                title: "Vercel",
+                externalId: project.id,
+                externalName: project.name,
+                ownerSlug,
+                label: `${ownerSlug}/${project.name}`,
+                target,
+            };
+        },
+        async remoteNames() {
+            await loadEnvs();
+            return [
+                ...new Set(forTarget()
+                    .filter((e) => e.type !== "system" && !isVercelReserved(e.key))
+                    .map((e) => e.key)),
+            ];
+        },
+        async apply(upserts, prune) {
+            await loadEnvs();
+            const result = { written: [], pruned: [], notPruned: [], notWritten: [], notes: [] };
+            for (const v of upserts) {
+                try {
+                    const type = await write(v);
+                    result.written.push({ name: v.name, type });
+                }
+                catch (err) {
+                    result.notWritten.push({ name: v.name, reason: err.message });
+                }
+            }
+            const fellBack = result.written.filter((w) => w.type === "readable" && upserts.find((u) => u.name === w.name)?.type === "sensitive");
+            if (fellBack.length > 0) {
+                result.notes.push(`Vercel refused Sensitive for Development. Pushed as readable: ${fellBack.map((w) => w.name).join(", ")}.`);
+            }
+            for (const name of prune) {
+                for (const entry of forTarget(name)) {
+                    const targets = targetsOf(entry);
+                    try {
+                        if (targets.length === 1)
+                            await remove(entry.id);
+                        else
+                            await setTargets(entry.id, targets.filter((t) => t !== target));
+                        if (!result.pruned.includes(name))
+                            result.pruned.push(name);
+                    }
+                    catch (err) {
+                        result.notPruned.push({ name, reason: err.message });
+                    }
+                }
+            }
+            return result;
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "getmyenv",
-  "version": "0.12.2",
+  "version": "0.13.0",
   "description": "CLI for getmyenv, an encrypted store for environment variables and secrets. We store ciphertext only.",
   "type": "module",
   "bin": {
@@ -33,8 +33,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@getmyenv/crypto": "0.5.0",
-    "@getmyenv/shared": "0.11.0",
+    "@getmyenv/crypto": "0.6.0",
+    "@getmyenv/shared": "0.12.0",
     "@napi-rs/keyring": "^2.1.0",
     "commander": "^15.0.0",
     "dotenv": "^16.4.7",