getmyenv 0.12.2 → 0.14.0

package/dist/commands/template.js

@@ -1,9 +1,10 @@
-import pc from "picocolors";
-import { knownKey, knownKeyFormatHint, linkDomain, parseTemplateRef, } from "@getmyenv/shared";
+import { pcErr as pc } from "../lib/colors.js";
+import { linkDomain, parseTemplateRef, } from "@getmyenv/shared";
 import { promptHidden } from "../lib/fs.js";
 import { ApiClient, getSessionToken, resolveApiUrl } from "../lib/api.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { resolveContext } from "../lib/context.js";
+import { knownKeys, refreshKnownKeys } from "../lib/known-keys-cache.js";
 import { syncFromLinked } from "../lib/template-file.js";
 import { assertWritable, uploadValues } from "../lib/upload.js";
 /** Load a public template by id or URL. No token needed. */
@@ -61,7 +62,7 @@ export async function applyTemplateFile(file, opts) {
     const todo = missingIn(file.keys, linked, ctx);
     if (todo.length > 0) {
         console.error(`No value yet in ${ctx.slug}: ${todo.map((k) => k.name).join(", ")}`);
-        console.error("Set each one: npx getmyenv set NAME\n");
+        console.error(`Set ${todo.length === 1 ? "it" : "them"} in a terminal: npx getmyenv set --missing\n`);
     }
     return { context: ctx.slug };
 }
@@ -79,10 +80,12 @@ export async function askMissingValues(keys, linked, ctx) {
         console.error(`${pc.green("✓")} Every template variable has a value in ${ctx.slug}.`);
         return;
     }
+    await refreshKnownKeys(linked.apiUrl);
+    const catalog = knownKeys();
     console.error(`Values for ${pc.bold(ctx.slug)}. Hidden as you type. Enter skips one.\n`);
     const pairs = {};
     for (const key of todo) {
-        const known = knownKey(key.name);
+        const known = catalog.get(key.name);
         const description = key.description || known?.description;
         const link = key.link || known?.docsUrl;
         console.error(`${pc.bold(key.name)}${key.optional ? pc.dim(" (optional)") : ""}`);
@@ -92,7 +95,7 @@ export async function askMissingValues(keys, linked, ctx) {
             console.error(pc.dim(`  Get it on ${linkDomain(link) ?? link}: ${link}`));
         const value = await promptHidden(`  ${key.name}: `);
         if (value) {
-            const hint = knownKeyFormatHint(key.name, value);
+            const hint = catalog.formatHint(key.name, value);
             if (hint)
                 console.error(pc.yellow(`  ${hint}`));
             pairs[key.name] = value;
@@ -106,7 +109,7 @@ export async function askMissingValues(keys, linked, ctx) {
     }
     const skipped = todo.filter((k) => !pairs[k.name]).map((k) => k.name);
     if (skipped.length > 0) {
-        console.error(pc.dim(`No value yet: ${skipped.join(", ")}. Set later with npx getmyenv set NAME`));
+        console.error(pc.dim(`No value yet: ${skipped.join(", ")}. Set later in a terminal: npx getmyenv set --missing`));
     }
     console.error("");
 }

package/dist/commands/unlink.d.ts

@@ -1,8 +1,17 @@
+export type UnlinkOpts = {
+    apiUrl?: string;
+    yes?: boolean;
+    local?: boolean;
+};
+/** Why the revoke failed, and the ways on. Nothing was removed. */
+export declare function revokeFailedMessage(opts: {
+    unreachable: boolean;
+    guest: boolean;
+}): string;
 /**
  * Unlink this folder: revoke its token and remove local getmyenv files.
- * The project, its contexts and values stay.
+ * The project, its contexts and values stay. A committed project.json stays
+ * when this machine has no token: it belongs to the repo, not to this machine.
+ * --local removes the files without revoking the token.
  */
-export declare function unlinkCommand(opts: {
-    apiUrl?: string;
-    yes?: boolean;
-}): Promise<void>;
+export declare function unlinkCommand(opts: UnlinkOpts): Promise<void>;

package/dist/commands/unlink.js

@@ -1,37 +1,85 @@
 import fs from "node:fs";
 import path from "node:path";
-import pc from "picocolors";
-import { getLocalDir, promptConfirm, readClaimFile, readProjectMeta } from "../lib/fs.js";
-import { clearFolderToken, readFolderToken } from "../lib/credentials.js";
+import { pc } from "../lib/colors.js";
+import { TOKEN_ENDED_CODE } from "@getmyenv/shared";
+import { clearClaimFile, getLocalDir, promptConfirm, readClaimFile, readProjectMeta, } from "../lib/fs.js";
+import { clearFolderToken, isTrackedByGit, readFolderToken, readFolderTokenLenient, tokenFilePath, } from "../lib/credentials.js";
 import { clearCachedKeys, keychainAccount } from "../lib/keychain.js";
 import { ApiClient, ApiError, resolveApiUrl } from "../lib/api.js";
+/** project.json as far as it can be read. A broken one is still removed with the token. */
+function readMetaLenient() {
+    try {
+        return readProjectMeta();
+    }
+    catch {
+        return null;
+    }
+}
+/** token.json that exists but cannot be read as a token. Its token cannot be revoked from here. */
+function tokenFileIsBroken() {
+    if (!fs.existsSync(tokenFilePath()))
+        return false;
+    try {
+        return readFolderToken() === null;
+    }
+    catch {
+        return true;
+    }
+}
+/** Why the revoke failed, and the ways on. Nothing was removed. */
+export function revokeFailedMessage(opts) {
+    const first = opts.unreachable
+        ? "Could not reach the server to revoke this folder's token. Nothing was removed."
+        : "Could not revoke the token on the server. Nothing was removed.";
+    const retry = opts.guest
+        ? "Try again when the server is reachable."
+        : "Try again, or revoke it in Project settings, Tokens first.";
+    return `${first} ${retry} To remove only the local files: npx getmyenv unlink --local`;
+}
 /**
  * Unlink this folder: revoke its token and remove local getmyenv files.
- * The project, its contexts and values stay.
+ * The project, its contexts and values stay. A committed project.json stays
+ * when this machine has no token: it belongs to the repo, not to this machine.
+ * --local removes the files without revoking the token.
  */
 export async function unlinkCommand(opts) {
-    const meta = readProjectMeta();
-    const folder = readFolderToken();
+    const meta = readMetaLenient();
+    const folder = readFolderTokenLenient();
+    const brokenToken = tokenFileIsBroken();
     const projectFile = path.join(getLocalDir(), "project.json");
-    if (!folder && !meta?.projectId && !fs.existsSync(projectFile)) {
+    const hasToken = Boolean(folder) || brokenToken;
+    const keepProjectFile = !hasToken && fs.existsSync(projectFile) && isTrackedByGit(projectFile);
+    if (!hasToken && !meta?.projectId && !fs.existsSync(projectFile)) {
         console.log(pc.dim("This folder is not linked."));
         return;
     }
     if (!opts.yes && !process.stdin.isTTY) {
-        throw new Error("Unlink revokes this folder's token. Without a terminal, pass --yes.");
+        throw new Error(folder && !opts.local
+            ? "Unlink revokes this folder's token. Without a terminal, pass --yes."
+            : "Unlink removes this folder's .getmyenv files. Without a terminal, pass --yes.");
     }
     if (!opts.yes) {
         const label = meta?.projectName ?? meta?.projectId ?? "this folder";
-        const tokenLine = readClaimFile()
-            ? "Removes .getmyenv files except claim.json. The guest token stays, so claim still works."
-            : "Revokes this folder's token and removes .getmyenv files.";
-        const ok = await promptConfirm(`Unlink ${label}? ${tokenLine} The project and its values stay.`, { defaultYes: false });
+        const tokenLine = !hasToken
+            ? "This machine has no token for it. Removes the local .getmyenv files."
+            : readClaimFile()
+                ? "Removes .getmyenv files except claim.json. The guest token stays, so claim still works."
+                : opts.local
+                    ? "Removes .getmyenv files without revoking the token."
+                    : "Revokes this folder's token and removes .getmyenv files.";
+        const ok = await promptConfirm(`Unlink ${label}? ${tokenLine} The project and its values stay.`, {
+            defaultYes: false,
+        });
         if (!ok) {
             console.log(pc.dim("Kept."));
             return;
         }
     }
-    if (folder) {
+    let guestEnded = false;
+    if (folder && opts.local) {
+        console.log(pc.yellow("The token was not revoked. It keeps working on the server until it expires or its project ends. Revoke it in Project settings, Tokens."));
+    }
+    else if (folder) {
         try {
             const res = await new ApiClient(resolveApiUrl(opts.apiUrl), folder.token).request("DELETE", "/api/cli/token");
             if (res?.revoked === false) {
@@ -45,22 +93,36 @@ export async function unlinkCommand(opts) {
             // 401/404: the token is already gone on the server. Anything else keeps
             // token.json, so a still-valid token is never left without a local copy.
             if (!(err instanceof ApiError && (err.status === 401 || err.status === 404))) {
-                throw new Error("Could not revoke the token on the server. Nothing was removed. Try again, or revoke it in Project settings, Tokens first.");
+                throw new Error(revokeFailedMessage({
+                    unreachable: err instanceof ApiError && err.status === 0,
+                    guest: readClaimFile() !== null,
+                }));
             }
-            console.log(pc.dim("Token was already revoked."));
+            console.log(pc.dim("The token already no longer works on the server."));
+            // A guest token only ends when its project was claimed or deleted. claim.json is no use then.
+            guestEnded = err.code === TOKEN_ENDED_CODE && readClaimFile() !== null;
         }
     }
+    else if (brokenToken) {
+        console.log(pc.yellow("token.json was not valid, so its token could not be revoked from here. If it held one, revoke it in Project settings, Tokens."));
+    }
     const projectId = meta?.projectId ?? folder?.projectId;
     if (projectId && (await clearCachedKeys(keychainAccount(resolveApiUrl(opts.apiUrl), projectId)))) {
         console.log(`${pc.green("✓")} Removed the unlocked keys from the OS keychain`);
     }
     if (clearFolderToken())
         console.log(`${pc.green("✓")} Removed token.json`);
-    if (fs.existsSync(projectFile)) {
+    if (keepProjectFile) {
+        console.log(pc.dim("Kept project.json. It is committed, so every clone knows its project."));
+    }
+    else if (fs.existsSync(projectFile)) {
         fs.unlinkSync(projectFile);
         console.log(`${pc.green("✓")} Removed project.json`);
     }
-    if (readClaimFile()) {
+    if (guestEnded && clearClaimFile()) {
+        console.log(`${pc.green("✓")} Removed claim.json. The guest project was claimed or deleted, so it has no use.`);
+    }
+    else if (readClaimFile()) {
         console.log(pc.yellow("Kept claim.json. It holds the claim code and guest passphrase. Delete it if you do not need the project."));
     }
     try {

package/dist/lib/api-url.d.ts

@@ -8,6 +8,8 @@ export declare function apiUrlForDisk(url: string | undefined | null): string |
 export declare function isLocalHost(hostname: string): boolean;
 /** https anywhere, http only for localhost. Returns the parsed URL or null. */
 export declare function parseSafeUrl(raw: string): URL | null;
+/** GETMYENV_PUSH_API_URL replaces the Vercel or Netlify API base, for tests. */
+export declare function pushApiBase(fallback: string, env?: string | undefined): string;
 /**
  * Pick the API base: --api-url, then GETMYENV_API_URL, then the gitignored
  * token.json, then production. project.json is committed, so it is never read.

package/dist/lib/api-url.js

@@ -36,6 +36,16 @@ export function parseSafeUrl(raw) {
         return url;
     return null;
 }
+/** GETMYENV_PUSH_API_URL replaces the Vercel or Netlify API base, for tests. */
+export function pushApiBase(fallback, env = process.env.GETMYENV_PUSH_API_URL) {
+    const raw = env?.trim();
+    if (!raw)
+        return fallback;
+    if (!parseSafeUrl(raw)) {
+        throw new Error(`Refusing GETMYENV_PUSH_API_URL ${raw}. Use https, or http://localhost for local tests.`);
+    }
+    return normalizeApiBase(raw);
+}
 /**
  * Pick the API base: --api-url, then GETMYENV_API_URL, then the gitignored
  * token.json, then production. project.json is committed, so it is never read.

package/dist/lib/api.d.ts

@@ -5,7 +5,25 @@ import type { NewMachinePolicy } from "@getmyenv/shared";
 /** From package.json, which ships with the package: src/lib and dist/lib are both two levels down. */
 export declare const CLI_VERSION: string;
 export { isDefaultApiUrl, parseSafeUrl } from "./api-url.js";
-export declare const API_TIMEOUT_MS = 30000;
+/** Short on purpose: a stuck process keeps npx's cache lock, so a second `npx getmyenv` waits silently. */
+export declare const API_TIMEOUT_MS = 8000;
+/** A request still running after this prints one "Contacting" line on stderr. */
+export declare const CONTACTING_AFTER_MS = 1000;
+/** Error thrown when a request runs past `API_TIMEOUT_MS`, headers and body together. */
+export declare class RequestTimeoutError extends Error {
+    constructor();
+}
+/**
+ * Runs `work` with an abort signal and a hard deadline. The deadline rejects even
+ * if the socket ignores the abort, and covers reading the body, not only the
+ * headers. Timers are cleared when `work` settles, so nothing outlives the request.
+ */
+export declare function withDeadline<T>(work: (signal: AbortSignal) => Promise<T>, opts?: {
+    timeoutMs?: number;
+    contacting?: string;
+}): Promise<T>;
+/** Test hook: lets the "Contacting" line print again. */
+export declare function resetContactingForTests(): void;
 export type Protection = "open" | "locked";
 export type ValueStatus = "set" | "expiring_soon" | "expired" | "missing";
 export type ContextInfo = {
@@ -45,7 +63,9 @@ export type WhoamiResponse = {
 };
 export declare class ApiError extends Error {
     status: number;
-    constructor(message: string, status: number);
+    /** Machine-readable reason from the server, like `token_ended`. */
+    code?: string;
+    constructor(message: string, status: number, code?: string);
 }
 export declare function resolveApiUrl(cliOverride?: string): string;
 export declare class ApiClient {

package/dist/lib/api.js

@@ -2,25 +2,79 @@
  * CLI API client. Never prints plaintext values.
  */
 import { createRequire } from "node:module";
-import { readFolderToken } from "./credentials.js";
+import { readFolderToken, readFolderTokenLenient } from "./credentials.js";
 import { pickApiUrl } from "./api-url.js";
 /** From package.json, which ships with the package: src/lib and dist/lib are both two levels down. */
 export const CLI_VERSION = createRequire(import.meta.url)("../../package.json").version;
 export { isDefaultApiUrl, parseSafeUrl } from "./api-url.js";
-export const API_TIMEOUT_MS = 30_000;
+/** Short on purpose: a stuck process keeps npx's cache lock, so a second `npx getmyenv` waits silently. */
+export const API_TIMEOUT_MS = 8_000;
+/** A request still running after this prints one "Contacting" line on stderr. */
+export const CONTACTING_AFTER_MS = 1_000;
+let contactingPrinted = false;
+/** Error thrown when a request runs past `API_TIMEOUT_MS`, headers and body together. */
+export class RequestTimeoutError extends Error {
+    constructor() {
+        super("timed out");
+        this.name = "TimeoutError";
+    }
+}
+/**
+ * Runs `work` with an abort signal and a hard deadline. The deadline rejects even
+ * if the socket ignores the abort, and covers reading the body, not only the
+ * headers. Timers are cleared when `work` settles, so nothing outlives the request.
+ */
+export async function withDeadline(work, opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? API_TIMEOUT_MS;
+    const controller = new AbortController();
+    let deadline;
+    let contacting;
+    const timedOut = new Promise((_, reject) => {
+        deadline = setTimeout(() => {
+            const err = new RequestTimeoutError();
+            controller.abort(err);
+            reject(err);
+        }, timeoutMs);
+    });
+    if (opts.contacting && !contactingPrinted) {
+        const origin = opts.contacting;
+        contacting = setTimeout(() => {
+            contactingPrinted = true;
+            process.stderr.write(`Contacting ${origin}...\n`);
+        }, CONTACTING_AFTER_MS);
+        contacting.unref?.();
+    }
+    try {
+        const running = work(controller.signal);
+        // After the deadline wins, the aborted work still rejects. Nobody awaits it then.
+        running.catch(() => { });
+        return await Promise.race([running, timedOut]);
+    }
+    finally {
+        clearTimeout(deadline);
+        clearTimeout(contacting);
+    }
+}
+/** Test hook: lets the "Contacting" line print again. */
+export function resetContactingForTests() {
+    contactingPrinted = false;
+}
 export class ApiError extends Error {
     status;
-    constructor(message, status) {
+    /** Machine-readable reason from the server, like `token_ended`. */
+    code;
+    constructor(message, status, code) {
         super(message);
         this.name = "ApiError";
         this.status = status;
+        this.code = code;
     }
 }
 export function resolveApiUrl(cliOverride) {
     return pickApiUrl({
         override: cliOverride,
         env: process.env.GETMYENV_API_URL,
-        tokenFile: readFolderToken()?.apiUrl,
+        tokenFile: readFolderTokenLenient()?.apiUrl,
     });
 }
 export class ApiClient {
@@ -42,47 +96,67 @@ export class ApiClient {
         return h;
     }
     async request(method, path, body, extraHeaders) {
-        let res;
+        const url = `${this.baseUrl.replace(/\/$/, "")}${path}`;
+        let origin = this.baseUrl;
         try {
-            res = await fetch(`${this.baseUrl.replace(/\/$/, "")}${path}`, {
-                method,
-                headers: this.headers(extraHeaders),
-                body: body === undefined ? undefined : JSON.stringify(body),
-                // The token must never follow a redirect to another host.
-                redirect: "error",
-                signal: AbortSignal.timeout(API_TIMEOUT_MS),
-            });
-        }
-        catch (err) {
-            throw networkError(err, `Could not reach ${this.baseUrl}`);
+            origin = new URL(url).origin;
         }
-        if (!res.ok) {
-            let serverMessage;
-            try {
-                const data = (await res.json());
-                serverMessage = data.error;
-            }
-            catch {
-                /* ignore */
-            }
-            const message = res.status >= 500
-                ? `The getmyenv server had an error (HTTP ${res.status}). Try again in a moment.`
-                : (serverMessage ?? `HTTP ${res.status}`);
-            throw new ApiError(message, res.status);
+        catch {
+            /* keep baseUrl */
         }
-        if (res.status === 204)
-            return undefined;
         try {
-            return (await res.json());
+            return await withDeadline(async (signal) => {
+                let res;
+                try {
+                    res = await fetch(url, {
+                        method,
+                        headers: this.headers(extraHeaders),
+                        body: body === undefined ? undefined : JSON.stringify(body),
+                        // The token must never follow a redirect to another host.
+                        redirect: "error",
+                        signal,
+                    });
+                }
+                catch (err) {
+                    throw networkError(err, `Could not reach ${this.baseUrl}. Check your connection, or the API URL (GETMYENV_API_URL or --api-url).`);
+                }
+                if (!res.ok) {
+                    let serverMessage;
+                    let code;
+                    try {
+                        const data = (await res.json());
+                        serverMessage = data.error;
+                        if (typeof data.code === "string")
+                            code = data.code;
+                    }
+                    catch {
+                        /* ignore */
+                    }
+                    const message = res.status >= 500
+                        ? `The getmyenv server had an error (HTTP ${res.status}). Try again in a moment.`
+                        : (serverMessage ?? `HTTP ${res.status}`);
+                    throw new ApiError(message, res.status, code);
+                }
+                if (res.status === 204)
+                    return undefined;
+                try {
+                    return (await res.json());
+                }
+                catch (err) {
+                    throw networkError(err, `The connection to ${this.baseUrl} closed before the answer arrived. Try again in a moment.`);
+                }
+            }, { contacting: origin });
         }
         catch (err) {
-            throw networkError(err, `The connection to ${this.baseUrl} closed before the answer arrived. Try again in a moment.`);
+            if (err instanceof RequestTimeoutError)
+                throw networkError(err, "");
+            throw err;
         }
     }
 }
 function networkError(err, fallback) {
     if (err instanceof Error && err.name === "TimeoutError") {
-        return new ApiError(`The getmyenv server did not answer within ${API_TIMEOUT_MS / 1000} seconds. Try again in a moment.`, 0);
+        return new ApiError(`The getmyenv server did not answer within ${API_TIMEOUT_MS / 1000} seconds. Try again in a moment.`, 0, "timeout");
     }
     return new ApiError(fallback, 0);
 }

package/dist/lib/authorize.js

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import pc from "picocolors";
+import { pcErr as pc } from "./colors.js";
 import { ensureGitignoreHasEnv, readLine, readProjectMeta, writeProjectMeta, } from "./fs.js";
 import { writeFolderToken } from "./credentials.js";
 import { ApiClient, parseSafeUrl, resolveApiUrl } from "./api.js";
@@ -97,7 +97,7 @@ async function authorizeViaBrowser(apiUrl, newProject) {
     });
     console.error("Open this URL to sign in and pick a project:\n");
     console.error(`  ${verifyUrl}\n`);
-    console.error(`Check the page shows this code: ${pc.bold(start.userCode)}\n`);
+    console.error(`Enter this code on the page: ${pc.bold(start.userCode)}\n`);
     openBrowser(verifyUrl);
     console.error(pc.dim("Opened in your browser. Waiting...\n"));
     const deadline = new Date(start.expiresAt).getTime();

package/dist/lib/bootstrap.d.ts

@@ -8,6 +8,11 @@ export type Linked = {
     meta: ProjectMeta | null;
 };
 export declare const NOT_LINKED_STEPS: string;
+/**
+ * Next steps for a folder with no token on this machine. A clone with a
+ * committed project.json gets its project named: it is not a new folder.
+ */
+export declare function notLinkedMessage(meta?: ProjectMeta | null): string;
 export declare function printGuestBanner(who: WhoamiResponse): void;
 export declare function fetchWhoami(client: ApiClient): Promise<WhoamiResponse>;
 /**

package/dist/lib/bootstrap.js

@@ -1,6 +1,8 @@
-import pc from "picocolors";
-import { GUEST_GRACE_MS } from "@getmyenv/shared";
-import { ensureGitignoreHasEnv, readClaimFile, readProjectMeta, writeProjectMeta, } from "./fs.js";
+import { pcErr as pc } from "./colors.js";
+import fs from "node:fs";
+import path from "node:path";
+import { GUEST_ACTIVE_DAYS, GUEST_GRACE_MS, TEMPLATE_FILE, TOKEN_ENDED_CODE } from "@getmyenv/shared";
+import { ensureGitignoreHasEnv, getLocalDir, readClaimFile, readProjectMeta, writeProjectMeta, } from "./fs.js";
 import { ApiClient, ApiError, getSessionToken, resolveApiUrl, } from "./api.js";
 import { assertTokenNotCommitted } from "./credentials.js";
 export const NOT_LINKED_STEPS = [
@@ -9,6 +11,21 @@ export const NOT_LINKED_STEPS = [
     "Without an account: npx getmyenv guest",
     "In CI: set GETMYENV_TOKEN",
 ].join("\n");
+/**
+ * Next steps for a folder with no token on this machine. A clone with a
+ * committed project.json gets its project named: it is not a new folder.
+ */
+export function notLinkedMessage(meta = readProjectMeta()) {
+    if (!meta?.projectId)
+        return NOT_LINKED_STEPS;
+    const hasTemplate = fs.existsSync(path.join(getLocalDir(), "template.json"));
+    return [
+        `This folder belongs to ${meta.projectName ?? meta.projectId}, but this machine has no token for it.`,
+        "In a terminal: npx getmyenv (sign in)",
+        ...(hasTemplate ? [`Or start your own project from ${TEMPLATE_FILE}: npx getmyenv guest`] : []),
+        "In CI: set GETMYENV_TOKEN",
+    ].join("\n");
+}
 export function printGuestBanner(who) {
     if (!who.isGuest)
         return;
@@ -22,8 +39,12 @@ export function printGuestBanner(who) {
         return;
     }
     const daysLeft = Number.isFinite(expires) ? Math.max(0, Math.ceil((expires - Date.now()) / DAY)) : null;
-    const days = daysLeft == null ? "soon" : plural(daysLeft);
-    console.error(pc.yellow(`Guest project. Expires in ${days}. Keep it: npx getmyenv claim.${needClaim}\n`));
+    // Each use moves the date to GUEST_ACTIVE_DAYS from now, so a countdown only means
+    // something once the cap after creation is closer than that.
+    const when = daysLeft != null && daysLeft < GUEST_ACTIVE_DAYS
+        ? `Expires in ${plural(daysLeft)}.`
+        : `Expires after ${plural(GUEST_ACTIVE_DAYS)} without use.`;
+    console.error(pc.yellow(`Guest project. ${when} Keep it: npx getmyenv claim.${needClaim}\n`));
 }
 export async function fetchWhoami(client) {
     try {
@@ -33,6 +54,9 @@ export async function fetchWhoami(client) {
         if (err instanceof ApiError && err.status === 410) {
             throw new Error(err.message);
         }
+        if (err instanceof ApiError && err.status === 401 && err.code === TOKEN_ENDED_CODE) {
+            throw new Error(err.message);
+        }
         if (err instanceof ApiError && err.status === 401) {
             throw new Error(process.env.GETMYENV_TOKEN?.trim()
                 ? "GETMYENV_TOKEN no longer works. It was revoked or expired. Create a new token in Project settings, Tokens."
@@ -49,14 +73,14 @@ export async function fetchWhoami(client) {
 export async function ensureTokenAndLink(opts = {}) {
     if (!getSessionToken()) {
         if (!process.stdin.isTTY) {
-            throw new Error(NOT_LINKED_STEPS);
+            throw new Error(notLinkedMessage());
         }
         const { startSetup } = await import("../commands/start.js");
         await startSetup({ apiUrl: opts.apiUrl, thenContinue: true });
     }
     const token = getSessionToken();
     if (!token)
-        throw new Error(NOT_LINKED_STEPS);
+        throw new Error(notLinkedMessage());
     if (!process.env.GETMYENV_TOKEN?.trim())
         assertTokenNotCommitted();
     const apiUrl = resolveApiUrl(opts.apiUrl);
@@ -68,7 +92,7 @@ export async function ensureTokenAndLink(opts = {}) {
     if (meta?.projectId && meta.projectId !== who.project.id) {
         throw new Error([
             `project.json points at ${meta.projectName ?? meta.projectId}, but the token is for ${who.project.name}.`,
-            "Run: npx getmyenv unlink   (then run the command again)",
+            "Run: npx getmyenv unlink, then run the command again.",
         ].join("\n"));
     }
     const usingEnvToken = Boolean(process.env.GETMYENV_TOKEN?.trim());

package/dist/lib/colors.d.ts

@@ -0,0 +1,14 @@
+type Stream = {
+    isTTY?: boolean;
+};
+/**
+ * Color only for a terminal. picocolors alone turns color on for every Windows
+ * process, so piped or redirected output would hold escape codes.
+ * NO_COLOR turns it off, FORCE_COLOR turns it on.
+ */
+export declare function colorEnabled(stream: Stream, env?: Record<string, string | undefined>): boolean;
+/** Colors for text written to stdout. */
+export declare const pc: import("picocolors/types").Colors;
+/** Colors for text written to stderr: prompts, status lines and warnings. */
+export declare const pcErr: import("picocolors/types").Colors;
+export {};

package/dist/lib/colors.js

@@ -0,0 +1,17 @@
+import picocolors from "picocolors";
+/**
+ * Color only for a terminal. picocolors alone turns color on for every Windows
+ * process, so piped or redirected output would hold escape codes.
+ * NO_COLOR turns it off, FORCE_COLOR turns it on.
+ */
+export function colorEnabled(stream, env = process.env) {
+    if (env.NO_COLOR)
+        return false;
+    if (env.FORCE_COLOR && env.FORCE_COLOR !== "0")
+        return true;
+    return Boolean(stream.isTTY) && env.TERM !== "dumb";
+}
+/** Colors for text written to stdout. */
+export const pc = picocolors.createColors(colorEnabled(process.stdout));
+/** Colors for text written to stderr: prompts, status lines and warnings. */
+export const pcErr = picocolors.createColors(colorEnabled(process.stderr));

package/dist/lib/confirm.d.ts

@@ -4,13 +4,17 @@ export type ConflictItem = {
     detail?: string;
 };
 /**
- * Prompt only when there are conflicts. Returns true to proceed.
- * Non-TTY: requires `yes` to be true when conflicts exist.
+ * Prompt only when something would be lost. Returns true to proceed.
+ * `conflicts` are names whose value changes, `removed` names that go away.
+ * Each list is counted on its own. Non-TTY: requires `yes`.
  */
 export declare function confirmDiff(opts: {
     conflicts: ConflictItem[];
+    removed?: ConflictItem[];
+    /** Heading after the count of `removed`. */
+    removedLabel?: string;
     /** What will happen if the user confirms, e.g. "Overwrite local values". */
     action: string;
-    /** Skip the prompt when true (still returns false if conflicts and non-TTY without yes). */
+    /** Skip the prompt when true. */
     yes?: boolean;
 }): Promise<boolean>;