getmyenv 0.12.2 → 0.14.0

package/dist/lib/confirm.js

@@ -1,25 +1,34 @@
-import pc from "picocolors";
+import { plural } from "@getmyenv/shared";
+import { pcErr as pc } from "./colors.js";
 import { promptConfirm } from "./fs.js";
+function printItems(title, items) {
+    if (items.length === 0)
+        return;
+    console.error(pc.yellow(`\n${title}:`));
+    for (const c of items.slice(0, 20)) {
+        console.error(`  ${c.name}${c.detail ? pc.dim(` - ${c.detail}`) : ""}`);
+    }
+    if (items.length > 20) {
+        console.error(pc.dim(`  …and ${items.length - 20} more`));
+    }
+}
 /**
- * Prompt only when there are conflicts. Returns true to proceed.
- * Non-TTY: requires `yes` to be true when conflicts exist.
+ * Prompt only when something would be lost. Returns true to proceed.
+ * `conflicts` are names whose value changes, `removed` names that go away.
+ * Each list is counted on its own. Non-TTY: requires `yes`.
  */
 export async function confirmDiff(opts) {
     const { conflicts, action, yes } = opts;
-    if (conflicts.length === 0)
+    const removed = opts.removed ?? [];
+    if (conflicts.length === 0 && removed.length === 0)
         return true;
-    console.error(pc.yellow(`\n${conflicts.length} conflict(s):`));
-    for (const c of conflicts.slice(0, 20)) {
-        console.error(`  ${c.name}${c.detail ? pc.dim(` - ${c.detail}`) : ""}`);
-    }
-    if (conflicts.length > 20) {
-        console.error(pc.dim(`  …and ${conflicts.length - 20} more`));
-    }
+    printItems(plural(conflicts.length, "conflict"), conflicts);
+    printItems(`${plural(removed.length, "name")} ${opts.removedLabel ?? "will be removed"}`, removed);
     console.error("");
     if (yes)
         return true;
     if (!process.stdin.isTTY) {
-        throw new Error(`Conflicts require confirmation. Re-run with --yes to ${action.toLowerCase()}.`);
+        throw new Error(`${conflicts.length > 0 ? "Conflicts require" : "Removing them requires"} confirmation. Re-run with --yes to ${action.toLowerCase()}.`);
     }
     return promptConfirm(`${action}?`, { defaultYes: false });
 }

package/dist/lib/context.js

@@ -35,7 +35,7 @@ export function resolveContext(who, meta, explicit) {
     if (found)
         return found;
     if (who.token.kind === "server") {
-        throw new Error(`This server token reads ${who.token.context ?? "one read-only context"} only.`);
+        throw new Error(`This server token reads ${who.token.context ?? "one Read-only context"} only.`);
     }
     const available = who.contexts.map((c) => c.slug).join(", ") || "none";
     const next = who.isGuest

package/dist/lib/credentials.d.ts

@@ -15,7 +15,11 @@ export type FolderToken = {
     addedAt: string;
 };
 export declare function tokenFilePath(cwd?: string): string;
+export declare const TOKEN_JSON_INVALID = ".getmyenv/token.json is not valid JSON. Fix it, or run: npx getmyenv unlink --yes, then npx getmyenv";
+/** Null when there is no token.json. Throws TOKEN_JSON_INVALID when it is not JSON. */
 export declare function readFolderToken(cwd?: string): FolderToken | null;
+/** `readFolderToken`, with an invalid token.json read as none. For unlink and the API URL only. */
+export declare function readFolderTokenLenient(cwd?: string): FolderToken | null;
 export declare function writeFolderToken(entry: {
     token: string;
     apiUrl?: string;

package/dist/lib/credentials.js

@@ -1,7 +1,7 @@
 import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
-import { getLocalDir, getProjectRoot } from "./fs.js";
+import { getLocalDir, getProjectRoot, readJsonFile } from "./fs.js";
 import { apiUrlForDisk } from "./api-url.js";
 /** True when git tracks this file. False without git or outside a repo. */
 export function isTrackedByGit(file, cwd = process.cwd()) {
@@ -31,17 +31,10 @@ export function assertTokenNotCommitted(cwd = process.cwd()) {
 export function tokenFilePath(cwd = process.cwd()) {
     return path.join(getLocalDir(cwd), "token.json");
 }
+export const TOKEN_JSON_INVALID = ".getmyenv/token.json is not valid JSON. Fix it, or run: npx getmyenv unlink --yes, then npx getmyenv";
+/** Null when there is no token.json. Throws TOKEN_JSON_INVALID when it is not JSON. */
 export function readFolderToken(cwd = process.cwd()) {
-    const file = tokenFilePath(cwd);
-    if (!fs.existsSync(file))
-        return null;
-    let raw;
-    try {
-        raw = JSON.parse(fs.readFileSync(file, "utf8"));
-    }
-    catch {
-        return null;
-    }
+    const raw = readJsonFile(tokenFilePath(cwd), TOKEN_JSON_INVALID);
     if (!raw || typeof raw !== "object")
         return null;
     const d = raw;
@@ -63,6 +56,15 @@ export function readFolderToken(cwd = process.cwd()) {
         addedAt: d.addedAt,
     };
 }
+/** `readFolderToken`, with an invalid token.json read as none. For unlink and the API URL only. */
+export function readFolderTokenLenient(cwd = process.cwd()) {
+    try {
+        return readFolderToken(cwd);
+    }
+    catch {
+        return null;
+    }
+}
 export function writeFolderToken(entry, cwd = process.cwd()) {
     const file = tokenFilePath(cwd);
     fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });

package/dist/lib/fs.d.ts

@@ -1,3 +1,4 @@
+import fs from "node:fs";
 /**
  * `.getmyenv/project.json`, committed so a clone knows its project.
  * Holds no API URL: a committed file must not redirect where tokens go.
@@ -15,8 +16,22 @@ export type ProjectMeta = {
  */
 export declare function getProjectRoot(cwd?: string): string;
 export declare function getLocalDir(cwd?: string): string;
+/** Text of a file as UTF-8, without a byte order mark (Notepad and PowerShell 5.1 add one). */
+export declare function readTextFile(file: string): string;
+/**
+ * Parse a JSON file. Null when it does not exist. Invalid JSON throws
+ * `invalid`: a broken file is never read as missing, so it is never
+ * silently replaced.
+ */
+export declare function readJsonFile(file: string, invalid: string): unknown;
+export declare const PROJECT_JSON_INVALID = ".getmyenv/project.json is not valid JSON. Fix it, or restore it: git checkout -- .getmyenv/project.json";
 export declare function readProjectMeta(cwd?: string): ProjectMeta | null;
 export declare function writeProjectMeta(meta: ProjectMeta, cwd?: string): void;
+/**
+ * Check that `file` can be written as a plain file: not a symlink, not a
+ * folder, and its folder exists. Returns its stats, or null when it is new.
+ */
+export declare function assertFileTarget(file: string): fs.Stats | null;
 /**
  * Write a file only this user can read. Never through a symlink. A new file
  * is created with `wx`; an existing one is replaced only when `overwrite`.
@@ -58,8 +73,28 @@ export declare function claimFilePath(cwd?: string): string;
 export declare function readClaimFile(cwd?: string): ClaimFile | null;
 export declare function writeClaimFile(data: Omit<ClaimFile, "version">, cwd?: string): string;
 export declare function clearClaimFile(cwd?: string): boolean;
-/** dotenv rules (multiline values, inline comments, BOM), valid names only. */
+/** dotenv rules (multiline values, inline comments, BOM). Invalid names land in `skipped`. */
+export declare function readEnvText(text: string): {
+    values: Record<string, string>;
+    skipped: string[];
+};
+/** `readEnvText`, valid names only. */
 export declare function parseEnvText(text: string): Record<string, string>;
+/**
+ * Text from bytes, by byte order mark: UTF-16 LE or BE (PowerShell 5.1 `>`
+ * writes UTF-16 LE), else UTF-8 without its BOM.
+ */
+export declare function decodeText(buf: Buffer): string;
+/** `readEnvText` for a file, UTF-8 or UTF-16. A missing file reads as empty. */
+export declare function readEnvFile(filePath: string): {
+    values: Record<string, string>;
+    skipped: string[];
+};
+/** Names that appear more than once in an env file, with their count. dotenv keeps the last one. */
+export declare function duplicateEnvNames(filePath: string): Array<{
+    name: string;
+    count: number;
+}>;
 /** `parseEnvText` for a file. A missing file reads as empty. */
 export declare function parseEnvFile(filePath: string): Record<string, string>;
 /** `.example`, `.sample` and `.template` files hold placeholders, not values. */

package/dist/lib/fs.js

@@ -27,17 +27,29 @@ export function getProjectRoot(cwd = process.cwd()) {
 export function getLocalDir(cwd = process.cwd()) {
     return path.join(getProjectRoot(cwd), LOCAL_DIR);
 }
-export function readProjectMeta(cwd = process.cwd()) {
-    const file = path.join(getLocalDir(cwd), "project.json");
+/** Text of a file as UTF-8, without a byte order mark (Notepad and PowerShell 5.1 add one). */
+export function readTextFile(file) {
+    return fs.readFileSync(file, "utf8").replace(/^/, "");
+}
+/**
+ * Parse a JSON file. Null when it does not exist. Invalid JSON throws
+ * `invalid`: a broken file is never read as missing, so it is never
+ * silently replaced.
+ */
+export function readJsonFile(file, invalid) {
     if (!fs.existsSync(file))
         return null;
-    let raw;
     try {
-        raw = JSON.parse(fs.readFileSync(file, "utf8"));
+        return JSON.parse(readTextFile(file));
     }
     catch {
-        return null;
+        throw new Error(invalid);
     }
+}
+export const PROJECT_JSON_INVALID = ".getmyenv/project.json is not valid JSON. Fix it, or restore it: git checkout -- .getmyenv/project.json";
+export function readProjectMeta(cwd = process.cwd()) {
+    const file = path.join(getLocalDir(cwd), "project.json");
+    const raw = readJsonFile(file, PROJECT_JSON_INVALID);
     if (!raw || typeof raw !== "object")
         return null;
     const d = raw;
@@ -69,21 +81,32 @@ export function writeProjectMeta(meta, cwd = process.cwd()) {
     fs.writeFileSync(path.join(dir, "project.json"), JSON.stringify(payload, null, 2) + "\n", { mode: 0o600 });
 }
 /**
- * Write a file only this user can read. Never through a symlink. A new file
- * is created with `wx`; an existing one is replaced only when `overwrite`.
+ * Check that `file` can be written as a plain file: not a symlink, not a
+ * folder, and its folder exists. Returns its stats, or null when it is new.
  */
-export function writePrivateFile(file, content, opts) {
-    let stat = null;
-    try {
-        stat = fs.lstatSync(file);
-    }
-    catch {
-        /* does not exist */
-    }
+export function assertFileTarget(file) {
+    const stat = fs.lstatSync(file, { throwIfNoEntry: false }) ?? null;
     if (stat?.isSymbolicLink())
         throw new Error(`${file} is a symlink. Refusing to write through it.`);
+    if (stat?.isDirectory()) {
+        throw new Error(`${file} is a folder. Pass a file name with -o.`);
+    }
     if (stat && !stat.isFile())
         throw new Error(`${file} is not a regular file.`);
+    if (!stat) {
+        const dir = path.dirname(path.resolve(file));
+        if (!fs.statSync(dir, { throwIfNoEntry: false })?.isDirectory()) {
+            throw new Error(`The folder ${path.dirname(file)} does not exist. Create it first, or pick another path with -o.`);
+        }
+    }
+    return stat;
+}
+/**
+ * Write a file only this user can read. Never through a symlink. A new file
+ * is created with `wx`; an existing one is replaced only when `overwrite`.
+ */
+export function writePrivateFile(file, content, opts) {
+    const stat = assertFileTarget(file);
     if (stat && !opts.overwrite)
         throw new Error(`${file} already exists. Pick another name with -o.`);
     fs.writeFileSync(file, content, { mode: 0o600, flag: stat ? "w" : "wx" });
@@ -265,7 +288,7 @@ export function readClaimFile(cwd = process.cwd()) {
     if (!fs.existsSync(file))
         return null;
     try {
-        const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+        const raw = JSON.parse(readTextFile(file));
         if (typeof raw.claimCode !== "string" ||
             typeof raw.passphrase !== "string" ||
             typeof raw.projectId !== "string") {
@@ -303,20 +326,76 @@ export function clearClaimFile(cwd = process.cwd()) {
     fs.unlinkSync(file);
     return true;
 }
-/** dotenv rules (multiline values, inline comments, BOM), valid names only. */
-export function parseEnvText(text) {
-    const out = {};
+/** dotenv rules (multiline values, inline comments, BOM). Invalid names land in `skipped`. */
+export function readEnvText(text) {
+    const values = {};
+    const skipped = [];
     for (const [key, value] of Object.entries(dotenv.parse(text))) {
         if (isValidVariableName(key))
-            out[key] = value;
+            values[key] = value;
+        else
+            skipped.push(key);
+    }
+    return { values, skipped };
+}
+/** `readEnvText`, valid names only. */
+export function parseEnvText(text) {
+    return readEnvText(text).values;
+}
+/**
+ * Text from bytes, by byte order mark: UTF-16 LE or BE (PowerShell 5.1 `>`
+ * writes UTF-16 LE), else UTF-8 without its BOM.
+ */
+export function decodeText(buf) {
+    if (buf.length >= 2 && buf[0] === 0xff && buf[1] === 0xfe) {
+        return buf.subarray(2, 2 + ((buf.length - 2) & ~1)).toString("utf16le");
+    }
+    if (buf.length >= 2 && buf[0] === 0xfe && buf[1] === 0xff) {
+        return Buffer.from(buf.subarray(2, 2 + ((buf.length - 2) & ~1))).swap16().toString("utf16le");
+    }
+    return buf.toString("utf8").replace(/^/, "");
+}
+/** `readEnvText` for a file, UTF-8 or UTF-16. A missing file reads as empty. */
+export function readEnvFile(filePath) {
+    if (!fs.existsSync(filePath))
+        return { values: {}, skipped: [] };
+    return readEnvText(decodeText(fs.readFileSync(filePath)));
+}
+/** Names that appear more than once in an env file, with their count. dotenv keeps the last one. */
+export function duplicateEnvNames(filePath) {
+    if (!fs.existsSync(filePath))
+        return [];
+    const counts = new Map();
+    const text = decodeText(fs.readFileSync(filePath));
+    for (const line of splitEnvEntries(text)) {
+        // Same line rule as dotenv: optional `export`, a name, then = or :.
+        const m = line.match(/^\s*(?:export\s+)?([\w.-]+)\s*[=:]/);
+        if (m?.[1])
+            counts.set(m[1], (counts.get(m[1]) ?? 0) + 1);
+    }
+    return [...counts.entries()].filter(([, n]) => n > 1).map(([name, count]) => ({ name, count }));
+}
+/** Lines of an env file, skipping the inside of quoted multiline values. */
+function splitEnvEntries(text) {
+    const out = [];
+    const lines = text.replace(/\r\n?/g, "\n").split("\n");
+    let open = null;
+    for (const line of lines) {
+        if (open) {
+            if (line.includes(open))
+                open = null;
+            continue;
+        }
+        out.push(line);
+        const m = line.match(/^\s*(?:export\s+)?[\w.-]+\s*[=:]\s*(["'`])(.*)$/);
+        if (m && !m[2].includes(m[1]))
+            open = m[1];
     }
     return out;
 }
 /** `parseEnvText` for a file. A missing file reads as empty. */
 export function parseEnvFile(filePath) {
-    if (!fs.existsSync(filePath))
-        return {};
-    return parseEnvText(fs.readFileSync(filePath, "utf8"));
+    return readEnvFile(filePath).values;
 }
 const ENV_SKIP_DIRS = new Set([
     "node_modules",

package/dist/lib/known-keys-cache.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Staff additions to the known keys list, and the defaults staff turned off,
+ * cached in the config dir and refreshed once a day. Any failure keeps the
+ * bundled list.
+ */
+import { type KnownKeyIndex } from "@getmyenv/shared";
+/** The bundled list plus the cached additions. No network. */
+export declare function knownKeys(): KnownKeyIndex;
+/**
+ * Refresh the cache when it is older than a day or from another server.
+ * Waits at most 2 seconds. Never throws.
+ */
+export declare function refreshKnownKeys(apiUrl: string): Promise<void>;
+/** Tests only. */
+export declare function resetKnownKeysForTests(): void;

package/dist/lib/known-keys-cache.js

@@ -0,0 +1,102 @@
+/**
+ * Staff additions to the known keys list, and the defaults staff turned off,
+ * cached in the config dir and refreshed once a day. Any failure keeps the
+ * bundled list.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { BUNDLED_KNOWN_KEYS, createKnownKeyIndex, KNOWN_KEYS } from "@getmyenv/shared";
+import { getConfigDir } from "./fs.js";
+const CACHE_FILE = "known-keys.json";
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+const FETCH_TIMEOUT_MS = 2000;
+const MAX_BODY_CHARS = 2 * 1024 * 1024;
+let index = null;
+function cachePath() {
+    return path.join(getConfigDir(), CACHE_FILE);
+}
+function readCache() {
+    try {
+        const data = JSON.parse(fs.readFileSync(cachePath(), "utf8"));
+        if (typeof data.apiUrl !== "string" || typeof data.checkedAt !== "string" || !Array.isArray(data.entries)) {
+            return null;
+        }
+        return {
+            apiUrl: data.apiUrl,
+            etag: typeof data.etag === "string" ? data.etag : null,
+            checkedAt: data.checkedAt,
+            entries: data.entries,
+            // Caches from older CLIs have no disabled list.
+            disabled: Array.isArray(data.disabled) ? data.disabled : [],
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function writeCache(data) {
+    try {
+        fs.writeFileSync(cachePath(), JSON.stringify(data), { mode: 0o600 });
+    }
+    catch {
+        /* keep going without a cache */
+    }
+}
+/** The bundled list plus the cached additions. No network. */
+export function knownKeys() {
+    if (index)
+        return index;
+    const cached = readCache();
+    index =
+        cached && (cached.entries.length || cached.disabled.length)
+            ? createKnownKeyIndex(KNOWN_KEYS, cached.entries, cached.disabled)
+            : BUNDLED_KNOWN_KEYS;
+    return index;
+}
+/**
+ * Refresh the cache when it is older than a day or from another server.
+ * Waits at most 2 seconds. Never throws.
+ */
+export async function refreshKnownKeys(apiUrl) {
+    if (!apiUrl)
+        return;
+    const cached = readCache();
+    const same = cached && cached.apiUrl === apiUrl ? cached : null;
+    if (same && Date.now() - new Date(same.checkedAt).getTime() < CACHE_TTL_MS)
+        return;
+    try {
+        const res = await fetch(`${apiUrl}/api/known-keys`, {
+            headers: same?.etag ? { "If-None-Match": same.etag } : {},
+            redirect: "error",
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        const checkedAt = new Date().toISOString();
+        if (res.status === 304 && same) {
+            writeCache({ ...same, checkedAt });
+            return;
+        }
+        if (!res.ok)
+            return;
+        const text = await res.text();
+        if (text.length > MAX_BODY_CHARS)
+            return;
+        const data = JSON.parse(text);
+        if (!Array.isArray(data.entries))
+            return;
+        writeCache({
+            apiUrl,
+            etag: res.headers.get("etag"),
+            checkedAt,
+            entries: data.entries,
+            disabled: Array.isArray(data.disabled) ? data.disabled : [],
+        });
+        index = null;
+    }
+    catch {
+        /* fail open: bundled or stale cache */
+    }
+}
+/** Tests only. */
+export function resetKnownKeysForTests() {
+    index = null;
+}

package/dist/lib/known-keys.d.ts

@@ -1,3 +1,5 @@
 /** "Did you mean OPENAI_API_KEY?" for names close to a known one. Nothing is renamed. */
 export declare function didYouMean(name: string): string | null;
 export declare function printDidYouMean(names: string[], indent?: string): void;
+/** A public prefix (NEXT_PUBLIC_, VITE_, ...) on a value that looks secret. Nothing is blocked. */
+export declare function printPublicSecretWarnings(pairs: Record<string, string>, indent?: string): void;

package/dist/lib/known-keys.js

@@ -1,8 +1,9 @@
-import pc from "picocolors";
-import { nearMissKnownKey } from "@getmyenv/shared";
+import { pcErr as pc } from "./colors.js";
+import { publicSecretWarning } from "@getmyenv/shared";
+import { knownKeys } from "./known-keys-cache.js";
 /** "Did you mean OPENAI_API_KEY?" for names close to a known one. Nothing is renamed. */
 export function didYouMean(name) {
-    const near = nearMissKnownKey(name);
+    const near = knownKeys().nearMiss(name);
     if (!near)
         return null;
     const why = near.source === "sdk" ? `${near.provider} SDKs read that name.` : "That is the common name.";
@@ -15,3 +16,11 @@ export function printDidYouMean(names, indent = "") {
             console.error(pc.yellow(`${indent}${name}: ${hint}`));
     }
 }
+/** A public prefix (NEXT_PUBLIC_, VITE_, ...) on a value that looks secret. Nothing is blocked. */
+export function printPublicSecretWarnings(pairs, indent = "") {
+    for (const [name, value] of Object.entries(pairs)) {
+        const warn = publicSecretWarning(name, value);
+        if (warn)
+            console.error(pc.yellow(`${indent}${warn}`));
+    }
+}

package/dist/lib/read-context.d.ts

@@ -0,0 +1,26 @@
+import { type SealedKey } from "@getmyenv/crypto";
+import type { ContextInfo } from "./api.js";
+import type { Linked } from "./bootstrap.js";
+import { type ResolveOk, type ResolvePurpose } from "./resolve.js";
+import { type MissingKey } from "./run-env.js";
+export type ContextData = {
+    sealedKey: SealedKey | null;
+    values: Array<{
+        name: string;
+        ciphertext: string;
+    }>;
+    missing: MissingKey[];
+};
+export type DecryptedContext = {
+    values: Record<string, string>;
+    missing: MissingKey[];
+    /** Null when the context has no values yet. */
+    key: Uint8Array | null;
+};
+/** Check names, open the context key and decrypt every value. Runs on this machine only. */
+export declare function decryptContext(linked: Linked, ctx: ContextInfo, data: ContextData): Promise<DecryptedContext>;
+/** Resolve one context (approval for Read-only ones, as `run` does) and decrypt it. */
+export declare function readContextValues(linked: Linked, slug: string, purpose: ResolvePurpose): Promise<DecryptedContext & {
+    context: ResolveOk["context"];
+    via: ResolveOk["via"];
+}>;

package/dist/lib/read-context.js

@@ -0,0 +1,22 @@
+import { decryptSecret, parsePayload } from "@getmyenv/crypto";
+import { resolveValues } from "./resolve.js";
+import { assertVariableNames } from "./run-env.js";
+import { contextKey } from "./vault.js";
+/** Check names, open the context key and decrypt every value. Runs on this machine only. */
+export async function decryptContext(linked, ctx, data) {
+    assertVariableNames([...data.values.map((v) => v.name), ...data.missing.map((m) => m.name)]);
+    const values = {};
+    if (data.values.length === 0)
+        return { values, missing: data.missing, key: null };
+    const key = await contextKey(linked, { ...ctx, sealedKey: data.sealedKey });
+    for (const v of data.values) {
+        values[v.name] = decryptSecret(key, v.name, parsePayload(v.ciphertext));
+    }
+    return { values, missing: data.missing, key };
+}
+/** Resolve one context (approval for Read-only ones, as `run` does) and decrypt it. */
+export async function readContextValues(linked, slug, purpose) {
+    const res = await resolveValues(linked.client, linked.who.project.id, slug, purpose);
+    const decrypted = await decryptContext(linked, res.context, res);
+    return { ...decrypted, context: res.context, via: res.via };
+}

package/dist/lib/recovery-code.js

@@ -1,4 +1,4 @@
-import pc from "picocolors";
+import { pcErr as pc } from "./colors.js";
 import { assertRecoveryWrap, createRecoveryWrap, createUserKeys, formatRecoveryCode, recoveryCodesMatch, wipe, } from "@getmyenv/crypto";
 import { FACTS } from "@getmyenv/shared";
 import { readLine } from "./fs.js";

package/dist/lib/resolve.d.ts

@@ -18,8 +18,9 @@ export type ResolveOk = {
     }>;
     missing: MissingKey[];
 };
+export type ResolvePurpose = "run" | "export" | "push";
 /**
  * Ciphertext for one context. Read-only contexts need a server token, an
  * allowed IP, and a trusted machine or an approval in the dashboard.
  */
-export declare function resolveValues(client: ApiClient, projectId: string, slug: string, purpose: "run" | "export"): Promise<ResolveOk>;
+export declare function resolveValues(client: ApiClient, projectId: string, slug: string, purpose: ResolvePurpose): Promise<ResolveOk>;

package/dist/lib/resolve.js

@@ -1,4 +1,4 @@
-import pc from "picocolors";
+import { pcErr as pc } from "./colors.js";
 import { ApiError } from "./api.js";
 import { sleep } from "./authorize.js";
 import { signMachineProof } from "./identity.js";

package/dist/lib/run-env.d.ts

@@ -1,12 +1,28 @@
 export { explainLines, mergeEnv, runContextLabel, validationError, type MissingKey } from "@getmyenv/shared";
 /** Names from the server go into an environment or a file. Refuse any that are not variable names. */
 export declare function assertVariableNames(names: Iterable<string>): void;
+/**
+ * One argument for a Windows program: quoted by the MSVCRT rules (backslashes
+ * before a quote or the end are doubled, inner quotes become \"), then every
+ * cmd.exe metacharacter, quotes included, is escaped with ^ so cmd passes the
+ * text through untouched and never expands %VAR%. A .cmd or .bat file reads
+ * its arguments through cmd a second time, so those get a second ^.
+ */
+export declare function windowsArgument(arg: string, batch?: boolean): string;
 /**
  * One cmd.exe command line from argv. Windows needs the shell to find `npm.cmd`
  * and friends, and Node does not quote args passed alongside `shell: true`.
- * cmd expands %VAR% even inside quotes, so each % is closed out of the quotes
- * and escaped with ^.
+ * Arguments follow cross-spawn's rules (see `windowsArgument`). The command
+ * is quoted when it holds a space, so a path like C:\Program Files works.
+ */
+export declare function windowsCommandLine(args: string[], opts?: {
+    batch?: boolean;
+}): string;
+/**
+ * True when cmd.exe would start `command` from a .cmd or .bat file (npm, npx,
+ * pnpm and most node_modules/.bin shims). Looks in the current folder, then
+ * PATH, with PATHEXT, the way cmd does.
  */
-export declare function windowsCommandLine(args: string[]): string;
+export declare function isWindowsBatch(command: string, env: Record<string, string | undefined>, cwd?: string): boolean;
 /** Exit code for a child that ended by signal: 128 + signal number, like a shell. */
 export declare function signalExitCode(signal: NodeJS.Signals, numbers: Record<string, number>): number;