getmyenv 0.12.2 → 0.14.0

package/dist/lib/run-env.js

@@ -2,6 +2,8 @@
  * Pure pieces of `getmyenv run`. Merge, validate and explain live in
  * @getmyenv/shared so the homepage demo prints the same text.
  */
+import fs from "node:fs";
+import path from "node:path";
 import { isValidVariableName } from "@getmyenv/shared";
 export { explainLines, mergeEnv, runContextLabel, validationError } from "@getmyenv/shared";
 /** Names from the server go into an environment or a file. Refuse any that are not variable names. */
@@ -12,23 +14,74 @@ export function assertVariableNames(names) {
         }
     }
 }
+/** Characters cmd.exe treats as special. Each one gets a ^ in front, outside or inside quotes. */
+const CMD_META = /([()\][%!^"`<>&|;, *?])/g;
+/** Args made only of these go through as they are. */
+const PLAIN_ARG = /^[\w\-.:/\\+@]+$/;
+/**
+ * One argument for a Windows program: quoted by the MSVCRT rules (backslashes
+ * before a quote or the end are doubled, inner quotes become \"), then every
+ * cmd.exe metacharacter, quotes included, is escaped with ^ so cmd passes the
+ * text through untouched and never expands %VAR%. A .cmd or .bat file reads
+ * its arguments through cmd a second time, so those get a second ^.
+ */
+export function windowsArgument(arg, batch = false) {
+    if (arg !== "" && PLAIN_ARG.test(arg))
+        return arg;
+    let quoted = arg.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\*)$/, "$1$1");
+    quoted = `"${quoted}"`.replace(CMD_META, "^$1");
+    return batch ? quoted.replace(CMD_META, "^$1") : quoted;
+}
 /**
  * One cmd.exe command line from argv. Windows needs the shell to find `npm.cmd`
  * and friends, and Node does not quote args passed alongside `shell: true`.
- * cmd expands %VAR% even inside quotes, so each % is closed out of the quotes
- * and escaped with ^.
+ * Arguments follow cross-spawn's rules (see `windowsArgument`). The command
+ * is quoted when it holds a space, so a path like C:\Program Files works.
+ */
+export function windowsCommandLine(args, opts = {}) {
+    const [command = "", ...rest] = args;
+    return [windowsCommandName(command), ...rest.map((a) => windowsArgument(a, opts.batch === true))].join(" ");
+}
+/**
+ * The program to start. cmd finds it by its own quote rules, and the program
+ * reads its own name from the same text, so a path with spaces is plainly
+ * quoted. A % is closed out of the quotes and escaped, so cmd does not expand it.
  */
-export function windowsCommandLine(args) {
-    return args
-        .map((a) => {
-        if (a === "")
-            return '""';
-        if (!/[\s"&|<>^()%]/.test(a))
-            return a;
-        const escaped = a.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, "$1$1");
-        return `"${escaped.replace(/%/g, '"^%"')}"`;
-    })
-        .join(" ");
+function windowsCommandName(command) {
+    if (PLAIN_ARG.test(command))
+        return command;
+    return `"${command.replace(/"/g, "").replace(/%/g, '"^%"')}"`;
+}
+function envValue(env, name) {
+    const key = Object.keys(env).find((k) => k.toUpperCase() === name);
+    return key ? env[key] : undefined;
+}
+/**
+ * True when cmd.exe would start `command` from a .cmd or .bat file (npm, npx,
+ * pnpm and most node_modules/.bin shims). Looks in the current folder, then
+ * PATH, with PATHEXT, the way cmd does.
+ */
+export function isWindowsBatch(command, env, cwd = process.cwd()) {
+    if (/\.(cmd|bat)$/i.test(command))
+        return true;
+    if (path.extname(command))
+        return false;
+    const exts = (envValue(env, "PATHEXT") ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
+    const hasDir = /[\\/]/.test(command);
+    const dirs = hasDir ? [""] : [cwd, ...(envValue(env, "PATH") ?? "").split(";").filter(Boolean)];
+    for (const dir of dirs) {
+        for (const ext of exts) {
+            const file = path.resolve(dir || cwd, `${command}${ext}`);
+            try {
+                if (fs.statSync(file).isFile())
+                    return /^\.(cmd|bat)$/i.test(ext);
+            }
+            catch {
+                /* not here */
+            }
+        }
+    }
+    return false;
 }
 /** Exit code for a child that ended by signal: 128 + signal number, like a shell. */
 export function signalExitCode(signal, numbers) {

package/dist/lib/template-file.js

@@ -1,6 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
-import pc from "picocolors";
+import { pcErr as pc } from "./colors.js";
 import { mergeTemplateFile, templateFileSchema, TEMPLATE_FILE, TEMPLATE_FILE_MAX_KEYS, } from "@getmyenv/shared";
 import { getLocalDir } from "./fs.js";
 export function templateFilePath(cwd = process.cwd()) {

package/dist/lib/update-check.js

@@ -6,7 +6,7 @@ import { spawn } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import pc from "picocolors";
+import { pcErr as pc } from "./colors.js";
 import { CLI_VERSION } from "./api.js";
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 const FETCH_TIMEOUT_MS = 2500;

package/dist/lib/upload.js

@@ -5,10 +5,10 @@ import { writeKey } from "./vault.js";
 /** Fail fast before prompting or encrypting. Mirrors the server's `checkWrite`, which still enforces it. */
 export function assertWritable(linked, ctx) {
     if (linked.who.token.kind === "server") {
-        throw new Error(`Server tokens are read-only. ${FACTS.readOnlyWho}`);
+        throw new Error(`Server tokens cannot change values. ${FACTS.readOnlyWho}`);
     }
     if (ctx.protection === "locked") {
-        throw new Error(`${ctx.slug} is read-only. ${FACTS.readOnlyWho}`);
+        throw new Error(`${ctx.slug} is Read-only. ${FACTS.readOnlyWho}`);
     }
 }
 /**

package/dist/lib/vault.js

@@ -1,4 +1,4 @@
-import pc from "picocolors";
+import { pcErr as pc } from "./colors.js";
 import { createUserKeys, generateContextKey, openSealedKey, sealContextKey, splitServerToken, unwrapPrivateKey, wipe, } from "@getmyenv/crypto";
 import { VAULT_UNLOCK_DURATION } from "@getmyenv/shared";
 import { ApiError } from "./api.js";

package/dist/providers/http.d.ts

@@ -0,0 +1,16 @@
+export declare class PlatformError extends Error {
+    status: number;
+    constructor(message: string, status: number);
+}
+/**
+ * One request to a platform API with the user's own token. No redirects,
+ * fixed timeout. Error messages never include values we sent.
+ */
+export declare function platformRequest<T>(opts: {
+    title: string;
+    base: string;
+    token: string;
+    method: "GET" | "POST" | "PATCH" | "DELETE";
+    path: string;
+    body?: unknown;
+}): Promise<T>;

package/dist/providers/http.js

@@ -0,0 +1,69 @@
+import { withDeadline } from "../lib/api.js";
+export class PlatformError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+    }
+}
+function errorMessage(body) {
+    if (!body || typeof body !== "object")
+        return null;
+    const b = body;
+    if (typeof b.message === "string")
+        return b.message;
+    if (b.error && typeof b.error === "object") {
+        const e = b.error;
+        if (typeof e.message === "string")
+            return e.message;
+        if (typeof e.code === "string")
+            return e.code;
+    }
+    if (typeof b.error === "string")
+        return b.error;
+    return null;
+}
+/**
+ * One request to a platform API with the user's own token. No redirects,
+ * fixed timeout. Error messages never include values we sent.
+ */
+export async function platformRequest(opts) {
+    let res;
+    let text;
+    try {
+        ({ res, text } = await withDeadline(async (signal) => {
+            const res = await fetch(`${opts.base}${opts.path}`, {
+                method: opts.method,
+                headers: {
+                    authorization: `Bearer ${opts.token}`,
+                    ...(opts.body !== undefined ? { "content-type": "application/json" } : {}),
+                },
+                body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,
+                redirect: "error",
+                signal,
+            });
+            return { res, text: await res.text() };
+        }));
+    }
+    catch (err) {
+        const why = err instanceof Error && err.name === "TimeoutError" ? "timed out" : "is unreachable";
+        throw new PlatformError(`${opts.title} ${why}.`, 0);
+    }
+    let parsed = null;
+    if (text) {
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            parsed = null;
+        }
+    }
+    if (!res.ok) {
+        if (res.status === 401 || res.status === 403) {
+            throw new PlatformError(`${opts.title} refused the token (${res.status}). Check that it is valid and can reach this project.`, res.status);
+        }
+        const msg = errorMessage(parsed) ?? res.statusText ?? "request failed";
+        throw new PlatformError(`${opts.title} returned ${res.status}: ${msg}`, res.status);
+    }
+    return parsed;
+}

package/dist/providers/netlify.d.ts

@@ -0,0 +1,11 @@
+import type { PushAdapter } from "./types.js";
+export declare const NETLIFY_API = "https://api.netlify.com";
+export declare const isNetlifyReserved: (name: string) => boolean;
+/** `.netlify/state.json`, written by `netlify link`. */
+export declare function readNetlifyStateFile(cwd?: string): string | null;
+export declare function createNetlifyAdapter(opts: {
+    token: string;
+    target: string;
+    site?: string;
+    cwd?: string;
+}): PushAdapter;

package/dist/providers/netlify.js

@@ -0,0 +1,184 @@
+import fs from "node:fs";
+import path from "node:path";
+import { isPublicEnvName, isReservedPushName } from "@getmyenv/shared";
+import { pushApiBase } from "../lib/api-url.js";
+import { PlatformError, platformRequest } from "./http.js";
+export const NETLIFY_API = "https://api.netlify.com";
+const MAX_VALUE_CHARS = 5000;
+const LAMBDA_TOTAL_BYTES = 4 * 1024;
+export const isNetlifyReserved = (name) => isReservedPushName("netlify", name);
+/** `.netlify/state.json`, written by `netlify link`. */
+export function readNetlifyStateFile(cwd = process.cwd()) {
+    const file = path.join(cwd, ".netlify", "state.json");
+    if (!fs.existsSync(file))
+        return null;
+    try {
+        const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+        return typeof raw.siteId === "string" && raw.siteId ? raw.siteId : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function createNetlifyAdapter(opts) {
+    const target = opts.target;
+    const base = pushApiBase(NETLIFY_API);
+    let siteId = "";
+    let accountId = "";
+    let vars = null;
+    const secretRefused = [];
+    const request = (method, p, body) => platformRequest({ title: "Netlify", base, token: opts.token, method, path: p, body });
+    const envPath = (suffix = "") => `/api/v1/accounts/${encodeURIComponent(accountId)}/env${suffix}?site_id=${encodeURIComponent(siteId)}`;
+    const valuesOf = (v) => v.values ?? [];
+    const find = (name) => (vars ?? []).find((v) => v.key === name);
+    const ownValue = (v) => valuesOf(v).find((x) => x.context === target);
+    const hasAll = (v) => valuesOf(v).some((x) => x.context === "all");
+    async function loadVars() {
+        if (!vars)
+            vars = (await request("GET", envPath())) ?? [];
+        return vars;
+    }
+    async function create(name, value, secret) {
+        try {
+            await request("POST", envPath(), [{ key: name, values: [{ context: target, value }], is_secret: secret }]);
+            return secret;
+        }
+        catch (err) {
+            if (secret && err instanceof PlatformError && err.status >= 400 && err.status < 500 && /secret/i.test(err.message)) {
+                await request("POST", envPath(), [{ key: name, values: [{ context: target, value }], is_secret: false }]);
+                secretRefused.push(name);
+                return false;
+            }
+            throw err;
+        }
+    }
+    async function write(v, result) {
+        const existing = find(v.name);
+        const secret = v.type === "sensitive";
+        if (!existing) {
+            return (await create(v.name, v.value, secret)) ? "sensitive" : "readable";
+        }
+        if (hasAll(existing)) {
+            result.notWritten.push({
+                name: v.name,
+                reason: "it has one value for all deploy contexts in Netlify. Give it per-context values there, or remove it, then push again",
+            });
+            return null;
+        }
+        const onlyOurs = valuesOf(existing).every((x) => x.context === target);
+        if (Boolean(existing.is_secret) !== secret && onlyOurs) {
+            // Netlify sets is_secret for the whole variable. It only serves this target, so replace it.
+            await request("DELETE", envPath(`/${encodeURIComponent(v.name)}`));
+            try {
+                return (await create(v.name, v.value, secret)) ? "sensitive" : "readable";
+            }
+            catch (err) {
+                throw new Error(`${v.name} was removed from Netlify to change its type, then adding it again failed: ${err.message} Run push again.`);
+            }
+        }
+        await request("PATCH", envPath(`/${encodeURIComponent(v.name)}`), { context: target, value: v.value });
+        const kept = existing.is_secret ? "sensitive" : "readable";
+        if (kept !== v.type) {
+            result.notes.push(`${v.name} keeps its Netlify type (${kept}). Netlify sets it for every deploy context of the variable.`);
+        }
+        return kept;
+    }
+    return {
+        id: "netlify",
+        title: "Netlify",
+        target,
+        isReserved: isNetlifyReserved,
+        typeFor: (name) => (isPublicEnvName(name) || target === "dev" ? "readable" : "sensitive"),
+        check(values) {
+            const skip = [];
+            const warnings = [];
+            let total = 0;
+            for (const [name, value] of Object.entries(values)) {
+                if (value.length > MAX_VALUE_CHARS) {
+                    skip.push({ name, reason: `longer than ${MAX_VALUE_CHARS} characters, the Netlify limit` });
+                    continue;
+                }
+                total += Buffer.byteLength(name) + Buffer.byteLength(value) + 1;
+            }
+            if (total > LAMBDA_TOTAL_BYTES) {
+                warnings.push(`These values add up to ${Math.ceil(total / 1024)} KB. Netlify Functions in Lambda compatibility mode get at most 4 KB of variables.`);
+            }
+            return { skip, warnings };
+        },
+        planNotes() {
+            if (target !== "dev")
+                return [];
+            return ["Netlify does not keep secret values for local development. Values for dev are readable."];
+        },
+        async destination() {
+            const id = opts.site ?? readNetlifyStateFile(opts.cwd);
+            if (!id) {
+                throw new Error("No Netlify site. Run `netlify link` in this folder, or pass --site <id>.");
+            }
+            const site = await request("GET", `/api/v1/sites/${encodeURIComponent(id)}`);
+            siteId = site.id;
+            accountId = site.account_id;
+            return {
+                provider: "netlify",
+                title: "Netlify",
+                externalId: site.id,
+                externalName: site.name,
+                ownerSlug: site.account_slug,
+                label: `${site.account_slug}/${site.name}`,
+                target,
+            };
+        },
+        async remoteNames() {
+            await loadVars();
+            return (vars ?? [])
+                .filter((v) => !isNetlifyReserved(v.key) && (ownValue(v) || hasAll(v)))
+                .map((v) => v.key);
+        },
+        async apply(upserts, prune) {
+            await loadVars();
+            const result = { written: [], pruned: [], notPruned: [], notWritten: [], notes: [] };
+            for (const v of upserts) {
+                try {
+                    const type = await write(v, result);
+                    if (type)
+                        result.written.push({ name: v.name, type });
+                }
+                catch (err) {
+                    result.notWritten.push({ name: v.name, reason: err.message });
+                }
+            }
+            if (secretRefused.length > 0) {
+                result.notes.push(`Netlify refused secret values for this account. Pushed as readable: ${secretRefused.join(", ")}.`);
+            }
+            for (const name of prune) {
+                const existing = find(name);
+                if (!existing)
+                    continue;
+                if (hasAll(existing)) {
+                    result.notPruned.push({ name, reason: "one value for all deploy contexts, cannot remove only " + target });
+                    continue;
+                }
+                const own = ownValue(existing);
+                if (!own)
+                    continue;
+                try {
+                    if (valuesOf(existing).length === 1) {
+                        await request("DELETE", envPath(`/${encodeURIComponent(name)}`));
+                    }
+                    else if (own.id) {
+                        await request("DELETE", envPath(`/${encodeURIComponent(name)}/value/${encodeURIComponent(own.id)}`));
+                    }
+                    else {
+                        result.notPruned.push({ name, reason: `Netlify did not return an id for its ${target} value` });
+                        continue;
+                    }
+                    result.pruned.push(name);
+                }
+                catch (err) {
+                    result.notPruned.push({ name, reason: err.message });
+                }
+            }
+            return result;
+        },
+    };
+}

package/dist/providers/types.d.ts

@@ -0,0 +1,56 @@
+import type { PushProvider } from "@getmyenv/shared";
+export type PushProviderId = PushProvider;
+/** How the platform stores a value. Readable: anyone with project access sees it. Sensitive: write-only. */
+export type VarType = "readable" | "sensitive";
+export type Destination = {
+    provider: PushProviderId;
+    /** "Vercel" or "Netlify". */
+    title: string;
+    externalId: string;
+    /** Vercel project name or Netlify site name. Used in links. */
+    externalName: string;
+    /** Vercel team or user slug, Netlify account slug. */
+    ownerSlug: string;
+    /** What we print: "acme/web". */
+    label: string;
+    target: string;
+};
+export type PlannedVar = {
+    name: string;
+    value: string;
+    type: VarType;
+    change: "add" | "update";
+};
+export type Skipped = {
+    name: string;
+    reason: string;
+};
+export type ApplyResult = {
+    written: Array<{
+        name: string;
+        type: VarType;
+    }>;
+    pruned: string[];
+    notPruned: Skipped[];
+    notWritten: Skipped[];
+    notes: string[];
+};
+export interface PushAdapter {
+    readonly id: PushProviderId;
+    readonly title: string;
+    readonly target: string;
+    /** Names the platform sets itself or refuses. Never written, never pruned. */
+    isReserved(name: string): boolean;
+    typeFor(name: string): VarType;
+    /** Local checks before any write. */
+    check(values: Record<string, string>): {
+        skip: Skipped[];
+        warnings: string[];
+    };
+    /** Extra lines printed with the plan. */
+    planNotes(plan: PlannedVar[]): string[];
+    destination(): Promise<Destination>;
+    /** Names that have a value for this target, without system or reserved names. */
+    remoteNames(): Promise<string[]>;
+    apply(upserts: PlannedVar[], prune: string[]): Promise<ApplyResult>;
+}

package/dist/providers/types.js

@@ -0,0 +1 @@
+export {};

package/dist/providers/vercel.d.ts

@@ -0,0 +1,17 @@
+import type { PushAdapter } from "./types.js";
+export declare const VERCEL_API = "https://api.vercel.com";
+export declare const isVercelReserved: (name: string) => boolean;
+type ProjectRef = {
+    projectId: string;
+    teamId?: string;
+};
+/** `.vercel/project.json`, written by `vercel link`. */
+export declare function readVercelProjectFile(cwd?: string): ProjectRef | null;
+export declare function createVercelAdapter(opts: {
+    token: string;
+    target: string;
+    project?: string;
+    team?: string;
+    cwd?: string;
+}): PushAdapter;
+export {};