getmyenv 0.5.2 → 0.6.0

package/README.md

@@ -2,31 +2,75 @@
 
 CLI for [getmyenv](https://getmyenv.com) - encrypted environment variables for any language.
 
-AI-first .env alternative:
+Keep using environment variables. Stop managing them as files.
 
 ```bash
 cd your-project
-npx getmyenv guest --name my-app
+npx getmyenv                          # Start without an account, or Sign in
+npx getmyenv import                   # encrypt and upload your .env
+npx getmyenv run -- npm run dev       # start with the default context
+npx getmyenv run staging -- npm start # or pick one
 ```
 
-Human account (Development laptop):
+## Commands
+
+- `getmyenv`: setup in a new folder, status in a linked one. Without a TTY it prints next steps and exits.
+- `run [context] -- <cmd>`: resolve, validate, merge, spawn. A missing value stops the run and prints its name (`--allow-missing` to run anyway). getmyenv values replace the parent env and replaced names are printed (`--keep-existing` to keep parent values). `--explain` lists names and origins, never values.
+- `status`: project, token, contexts and the run command.
+- `context list | create "<name>" [--from <slug>] [--use] | use <slug>`
+- `set KEY[=VALUE]... [--expires <date|never>]`, `set KEY --stdin`, `unset KEY... [--all]`, `ls`
+- `import [file] [--prune] [--dry-run] [--yes]`: `.env.<slug>` goes to that context.
+- `export [-o file | --stdout] [--yes]`: for tools that need a file. The file is added to `.gitignore` and gets owner-only permissions on macOS and Linux.
+- `guest [--name <name>]`: a project without an account. It works for 30 days. Claim it within 60.
+- `claim`: claim a guest project from `.getmyenv/claim.json`.
+- `backup [-o file]`: encrypted backup of open contexts (default `<project>.getmyenv`).
+- `restore <file> [--dry-run] [--yes]`
+- `lock`, `unlink [--yes]`, `help [command]`
+
+`run`, `set`, `unset`, `ls`, `import` and `export` take `-c, --context <slug>`. The default is the server token's context, then `context` in `.getmyenv/project.json`, then `development`.
+
+`run`, `set`, `import`, `export` and `restore` take `--vault-password-stdin`. Every command takes `--api-url <url>`.
+
+Prompts and status lines go to stderr, so `export --stdout > .env` stays clean.
+
+## Vault password
+
+For open contexts, after you enter the Vault password in a terminal, the unlocked project key stays in your OS keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service) for 8 hours. The password itself is never stored.
+
+- `npx getmyenv lock` removes it. `unlink` removes it too.
+- Locked contexts, CI and `--vault-password-stdin` ask on each run.
+- Guest projects unlock with the passphrase in `.getmyenv/claim.json` and never ask.
+- `GETMYENV_KEYCHAIN=0` always asks.
+
+## CI and servers
 
 ```bash
-npx getmyenv run -- npm run dev  # opens browser on first run, then runs
+printf %s "$VAULT_PASSWORD" | npx getmyenv run --vault-password-stdin -- node server.js
+printf %s "$VALUE" | npx getmyenv set API_KEY --stdin
+printf '%s\n%s' "$VAULT_PASSWORD" "$VALUE" | npx getmyenv set API_KEY --stdin --vault-password-stdin
 ```
 
-The first verb you run in a folder opens the browser to create a per-project CLI token, stores it in `.getmyenv/token.json`, and continues. Six primary commands. No separate authorize step. One folder = one project = one token. Token name is project + scope.
+Server tokens are read-only, so `set` needs the folder token from browser sign-in (or a guest project). With both `--stdin` and `--vault-password-stdin`, send the password on the first line and the value after it.
+
+- `GETMYENV_TOKEN`: a token from the dashboard CLI page.
+- `GETMYENV_CONFIG_DIR`: machine key and cache (default `~/.config/getmyenv`). Use a persistent volume in containers.
+- `GETMYENV_API_URL`: API origin. https only, http for localhost.
+- `GETMYENV_MACHINE_LABEL`: the machine name shown in approval requests.
+- `GETMYENV_SKIP_UPDATE=1`: skip the update notice.
+- `GETMYENV_KEYCHAIN=0`: never use the OS keychain.
+- The update check and the keychain are skipped when `CI` is set (unless it is `false` or `0`).
 
-- Development token: `run`, `push`, `pull`, `remove`, `restore`. `push` skips `.env*` basenames containing `production`.
-- Production token: read-only (`run`, `backup`). Set Production values in the dashboard. Create the token with an IP allowlist; set `GETMYENV_TOKEN`. No browser day to day.
-- Environment comes from token scope. Omit `-e` day to day.
-- Forget this folder: `npx getmyenv delete` (local `.getmyenv/` only; vault stays on the server). Then re-run `run` or `push` to authorize again.
-- CI: set `GETMYENV_TOKEN`.
+## Open and Locked
 
-Primary: `guest`, `run`, `push`, `remove`, `delete`, `claim`. Also: `pull`, `backup`, `restore`, `whoami`.
+- Open contexts: the CLI can read and write. Browser sign-in gives the folder a token in `.getmyenv/token.json`.
+- Locked contexts: the CLI is read-only. Set values in the dashboard. Use a server token from the CLI page (one context, IP allowlist) with `GETMYENV_TOKEN`. New machines need approval unless trusted.
 
-AI scaffolding without an account: `npx getmyenv guest --name <project>`. Commit `.getmyenv/project.json` and `.getmyenv/claim.json`. Human takeover: `npx getmyenv claim` within 30 days.
+## Chaining
+
+```bash
+op run -- npx getmyenv run staging -- npm start
+```
 
-License: MIT (see [LICENSE](./LICENSE)). The hosted service at getmyenv.com is governed by its Terms, not this file.
+License: MIT (see [LICENSE](./LICENSE)). The hosted service at getmyenv.com has its own Terms.
 
 See https://getmyenv.com/docs

package/dist/bin.js

@@ -1,30 +1,7 @@
 #!/usr/bin/env node
-import fs from "node:fs";
-import path from "node:path";
-import os from "node:os";
 import { runCli } from "./cli.js";
 import { maybeSuggestUpdate } from "./lib/update-check.js";
-/**
- * One-shot retire of the machine-global credentials store from before 0.3.4.
- * Silent: delete the file (secrets do not linger) and print one honest line so
- * the user knows why the first verb in a folder asks to authorize.
- */
-function retireLegacyCredentials() {
-    const base = process.env.GETMYENV_CONFIG_DIR?.trim() ||
-        path.join(os.homedir(), ".config", "getmyenv");
-    const file = path.join(base, "credentials.json");
-    if (!fs.existsSync(file))
-        return;
-    try {
-        fs.unlinkSync(file);
-        console.error("getmyenv: retired old ~/.config/getmyenv/credentials.json. Tokens now live in .getmyenv/token.json per folder.");
-    }
-    catch {
-        /* ignore */
-    }
-}
 async function main() {
-    retireLegacyCredentials();
     await maybeSuggestUpdate();
     await runCli(process.argv);
 }
@@ -32,6 +9,6 @@ main().catch((err) => {
     const message = err instanceof Error ? err.message : "Unexpected error";
     // Never print secret values - sanitize to message only
     console.error(`getmyenv: ${message}`);
-    process.exit(1);
+    process.exit(process.exitCode ? Number(process.exitCode) : 1);
 });
 //# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -1 +1 @@
-{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D;;;;GAIG;AACH,SAAS,uBAAuB;IAC9B,MAAM,IAAI,GACR,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE;QACvC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IACjC,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,gHAAgH,CACjH,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,uBAAuB,EAAE,CAAC;IAC1B,MAAM,kBAAkB,EAAE,CAAC;IAC3B,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACxE,uDAAuD;IACvD,OAAO,CAAC,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,KAAK,UAAU,IAAI;IACjB,MAAM,kBAAkB,EAAE,CAAC;IAC3B,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACxE,uDAAuD;IACvD,OAAO,CAAC,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC"}

package/dist/cli.d.ts

@@ -1,2 +1,12 @@
+/**
+ * Split `run` operands around `--`.
+ * `run staging -- npm start`: context staging, command npm start.
+ * `run -- npm start`: default context.
+ * `run npm start` (no `--`): the whole thing is the command.
+ */
+export declare function splitRunArgs(operands: string[], argv: string[], explain: boolean): {
+    context?: string;
+    command: string[];
+};
 export declare function runCli(argv: string[]): Promise<void>;
 //# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AA6BA,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA2J1D"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AA+BA;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAAE,EAClB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,OAAO,GACf;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CASzC;AAED,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA8L1D"}

package/dist/cli.js

@@ -1,131 +1,209 @@
 import { Command } from "commander";
 import { backupCommand } from "./commands/backup.js";
+import { claimCommand } from "./commands/claim.js";
+import { contextCreateCommand, contextListCommand, contextUseCommand, } from "./commands/context.js";
+import { exportCommand } from "./commands/export.js";
+import { guestCommand } from "./commands/guest.js";
+import { importCommand } from "./commands/import.js";
+import { lockCommand } from "./commands/lock.js";
+import { lsCommand } from "./commands/ls.js";
 import { restoreCommand } from "./commands/restore.js";
 import { runCommand } from "./commands/run.js";
-import { pushCommand } from "./commands/push.js";
-import { pullCommand } from "./commands/pull.js";
-import { whoamiCommand } from "./commands/whoami.js";
-import { guestCommand } from "./commands/guest.js";
-import { claimCommand } from "./commands/claim.js";
-import { removeCommand } from "./commands/remove.js";
-import { deleteCommand } from "./commands/delete.js";
-import { normalizeEnvName } from "./lib/env-name.js";
-import { CLI_VERSION, resolveApiUrl } from "./lib/api.js";
-import { readProjectMeta } from "./lib/fs.js";
-function envWasDefaultFromArgv() {
-    return !process.argv.includes("-e") && !process.argv.includes("--env");
-}
-function folderEnvOption() {
-    const meta = readProjectMeta();
-    return meta?.environment ?? "development";
-}
-const ENV_OPTION = [
-    "-e, --env <name>",
-    "Environment (must match token scope; omit to use the token)",
+import { setCommand, unsetCommand } from "./commands/set.js";
+import { startCommand } from "./commands/start.js";
+import { statusCommand } from "./commands/status.js";
+import { unlinkCommand } from "./commands/unlink.js";
+import { CLI_VERSION } from "./lib/api.js";
+const CONTEXT_OPTION = [
+    "-c, --context <slug>",
+    "Context to use (default: project.json context, then development)",
+];
+const API_OPTION = ["--api-url <url>", "API base URL"];
+const STDIN_OPTION = [
+    "--vault-password-stdin",
+    "Read the Vault password from stdin (non-interactive)",
 ];
+/**
+ * Split `run` operands around `--`.
+ * `run staging -- npm start`: context staging, command npm start.
+ * `run -- npm start`: default context.
+ * `run npm start` (no `--`): the whole thing is the command.
+ */
+export function splitRunArgs(operands, argv, explain) {
+    const dash = argv.indexOf("--");
+    if (dash >= 0) {
+        const command = argv.slice(dash + 1);
+        const before = operands.slice(0, Math.max(0, operands.length - command.length));
+        return { context: before[0], command };
+    }
+    if (explain && operands.length <= 1)
+        return { context: operands[0], command: [] };
+    return { command: operands };
+}
 export async function runCli(argv) {
-    const apiDefault = resolveApiUrl();
     const program = new Command();
     program
         .name("getmyenv")
         .description("Keep using environment variables. Stop managing them as files.")
-        .version(CLI_VERSION);
-    program
-        .command("guest")
-        .description("Create a guest project without an account. Claim within 30 days.")
-        .option("--name <name>", "Project name (default: folder name)")
-        .option("--api-url <url>", "API base URL to remember (default production)")
-        .action((opts) => guestCommand(opts));
+        .version(CLI_VERSION)
+        .option(...API_OPTION)
+        .addHelpText("after", [
+        "",
+        "Environment:",
+        "  GETMYENV_TOKEN          Token for CI and servers (instead of .getmyenv/token.json)",
+        "  GETMYENV_API_URL        API base URL (https, or http://localhost)",
+        "  GETMYENV_CONFIG_DIR     Machine identity and cache dir (default ~/.config/getmyenv)",
+        "  GETMYENV_SKIP_UPDATE    Set to 1 to skip the update notice",
+        "  GETMYENV_KEYCHAIN       Set to 0 to always ask for the Vault password",
+        "  GETMYENV_MACHINE_LABEL  Name shown for this machine in access requests",
+    ].join("\n"))
+        .helpCommand(true)
+        .action((opts) => startCommand(opts));
+    // The root owns --api-url wherever it appears, so hand it to the command that runs.
+    program.hook("preAction", (_root, actionCommand) => {
+        const apiUrl = program.opts().apiUrl;
+        if (apiUrl && actionCommand !== program && !actionCommand.opts().apiUrl) {
+            actionCommand.setOptionValue("apiUrl", apiUrl);
+        }
+    });
     program
         .command("run")
-        .description("Decrypt authorized secrets and run a command (opens browser on first use)")
-        .option(...ENV_OPTION)
-        .option("--api-url <url>", "API base URL", apiDefault)
-        .option("--vault-password-stdin", "Read vault password from stdin (non-interactive)")
+        .description("Run a command with a context's variables in its environment")
+        .usage("[context] [options] -- <command...>")
+        .addHelpText("after", [
+        "",
+        "Examples:",
+        "  npx getmyenv run -- npm run dev",
+        "  npx getmyenv run staging -- node server.js",
+        '  printf %s "$VAULT_PASSWORD" | npx getmyenv run production --vault-password-stdin -- node server.js',
+    ].join("\n"))
+        .argument("[context]", "Context slug (same as -c)")
+        .option(...CONTEXT_OPTION)
+        .option("--explain", "List each variable and where its value comes from (names only)")
+        .option("--keep-existing", "Keep variables already set in the parent environment")
+        .option("--allow-missing", "Run even when some variables have no value in this context")
+        .option(...STDIN_OPTION)
+        .option(...API_OPTION)
         .allowUnknownOption(true)
         .allowExcessArguments(true)
-        .action(async (opts, cmd) => {
-        const args = cmd.args;
-        const dashIdx = process.argv.indexOf("--");
-        const childArgs = dashIdx >= 0 ? process.argv.slice(dashIdx + 1) : args;
-        await runCommand({
-            ...opts,
-            env: normalizeEnvName(opts.env ?? folderEnvOption()),
-            envWasDefault: envWasDefaultFromArgv(),
-            apiUrl: opts.apiUrl ?? apiDefault,
-        }, childArgs);
+        .action(async (_ctx, opts, cmd) => {
+        const split = splitRunArgs(cmd.args, argv, opts.explain === true);
+        if (opts.context && split.context && opts.context !== split.context) {
+            throw new Error(`Two contexts given: ${split.context} and -c ${opts.context}. Pick one.`);
+        }
+        await runCommand({ ...opts, context: opts.context ?? split.context }, split.command);
     });
     program
-        .command("push")
-        .description("Encrypt local secrets and upload to the linked project")
-        .option(...ENV_OPTION)
-        .option("-f, --file <path>", "Path to .env file to push")
-        .option("-k, --key <NAME=VALUE>", "Push a single secret (NAME or NAME=VALUE)")
-        .option("--prune", "Delete hosted secrets that are not in the local file")
-        .option("--yes", "Apply changes without prompting on conflicts")
-        .option("--dry-run", "Show what would change without uploading")
-        .option("--api-url <url>", "API base URL", apiDefault)
-        .option("--vault-password-stdin", "Read vault password from stdin (non-interactive)")
-        .action((opts) => pushCommand({
-        ...opts,
-        env: normalizeEnvName(opts.env ?? folderEnvOption()),
-        envWasDefault: envWasDefaultFromArgv(),
-    }));
+        .command("status")
+        .description("Show project, token, contexts and the run command")
+        .option(...API_OPTION)
+        .action((opts) => statusCommand(opts));
+    const context = program.command("context").description("List, create or pick contexts");
+    context
+        .command("list", { isDefault: true })
+        .description("List contexts (* marks this folder's default)")
+        .option(...API_OPTION)
+        .action((opts) => contextListCommand(opts));
+    context
+        .command("create <name>")
+        .description('Create an open context, e.g. context create "Customer Acme"')
+        .option("--from <slug>", "Copy values from an open context")
+        .option("--use", "Make it this folder's default")
+        .option(...API_OPTION)
+        .action((name, opts) => contextCreateCommand(name, opts));
+    context
+        .command("use <slug>")
+        .description("Set this folder's default context (saved in project.json)")
+        .option(...API_OPTION)
+        .action((slug, opts) => contextUseCommand(slug, opts));
     program
-        .command("claim")
-        .description("Claim a guest project from .getmyenv/claim.json (browser + Vault password)")
-        .option("--api-url <url>", "API base URL")
-        .action((opts) => claimCommand(opts));
+        .command("set")
+        .description("Set values: set KEY=VALUE, or set KEY to be prompted")
+        .argument("<pairs...>", "KEY or KEY=VALUE")
+        .option(...CONTEXT_OPTION)
+        .option("--expires <date>", "Expiry date, e.g. 2026-12-31, or never")
+        .option("--stdin", "Read the value of one KEY from stdin (keeps it out of argv)")
+        .option(...STDIN_OPTION)
+        .option(...API_OPTION)
+        .action((pairs, opts) => setCommand(pairs, opts));
+    program
+        .command("unset")
+        .description("Remove values from a context")
+        .argument("<names...>", "Variable names")
+        .option(...CONTEXT_OPTION)
+        .option("--all", "Delete the variable from every context")
+        .option(...API_OPTION)
+        .action((names, opts) => unsetCommand(names, opts));
+    program
+        .command("ls")
+        .description("Variable names by context with status (never values)")
+        .option(...CONTEXT_OPTION)
+        .option(...API_OPTION)
+        .action((opts) => lsCommand(opts));
+    program
+        .command("import")
+        .description("Encrypt a .env file and upload it (.env.<slug> goes to that context)")
+        .argument("[file]", "Env file (default: .env files in this folder)")
+        .option(...CONTEXT_OPTION)
+        .option("--prune", "Unset values in the context that are not in the file")
+        .option("--dry-run", "Show what would change without uploading")
+        .option("--yes", "Do not ask for confirmation")
+        .option(...STDIN_OPTION)
+        .option(...API_OPTION)
+        .action((file, opts) => importCommand(file, opts));
     program
-        .command("pull")
-        .description("Download secrets to a plaintext .env file")
-        .option(...ENV_OPTION)
+        .command("export")
+        .description("Write a context to a plaintext .env file, for tools that need one")
+        .option(...CONTEXT_OPTION)
         .option("-o, --output <file>", "Output file", ".env")
-        .option("--to <file>", "Alias for --output")
         .option("--stdout", "Write to stdout instead of a file")
-        .option("--yes", "Overwrite conflicting local values without prompting")
-        .option("--merge", "Only fill missing keys; keep local values")
-        .option("--dry-run", "Show what would change without writing")
-        .option("--api-url <url>", "API base URL", apiDefault)
-        .option("--vault-password-stdin", "Read vault password from stdin (non-interactive)")
-        .action((opts) => pullCommand({
-        ...opts,
-        env: normalizeEnvName(opts.env ?? folderEnvOption()),
-        envWasDefault: envWasDefaultFromArgv(),
-    }));
+        .option("--yes", "Change an existing file without asking")
+        .option(...STDIN_OPTION)
+        .option(...API_OPTION)
+        .action((opts) => exportCommand(opts));
     program
-        .command("whoami")
-        .description("Show the folder's CLI token, project, and defaults")
-        .option("--api-url <url>", "API base URL")
-        .action(whoamiCommand);
+        .command("guest")
+        .description("Create a guest project without an account. It works for 30 days. Claim it within 60.")
+        .option("--name <name>", "Project name (default: folder name)")
+        .option(...API_OPTION)
+        .action((opts) => guestCommand(opts));
+    program
+        .command("claim")
+        .description("Claim a guest project from .getmyenv/claim.json")
+        .option(...API_OPTION)
+        .action((opts) => claimCommand(opts));
     program
         .command("backup")
-        .description("Create a portable encrypted .getmyenv backup")
-        .option("-o, --output <file>", "Output file")
-        .option("--api-url <url>", "API base URL", apiDefault)
-        .action(backupCommand);
+        .description("Write an encrypted backup of open contexts")
+        .option("-o, --output <file>", "Output file (default: <project>.getmyenv)")
+        .option(...API_OPTION)
+        .action((opts) => backupCommand(opts));
     program
         .command("restore <file>")
-        .description("Restore from an encrypted .getmyenv backup into the linked project")
-        .option("--api-url <url>", "API base URL", apiDefault)
-        .option("--into-linked", "Require a linked folder (restore still targets the token project)")
-        .option("--vault-password-stdin", "Read vault password from stdin (non-interactive)")
-        .action(restoreCommand);
+        .description("Restore an encrypted backup into this folder's project")
+        .option("--dry-run", "Check the backup and show what would be restored")
+        .option("--yes", "Do not ask for confirmation")
+        .option(...STDIN_OPTION)
+        .option(...API_OPTION)
+        .action((file, opts) => restoreCommand(file, opts));
     program
-        .command("remove")
-        .description("Delete named secret(s) from the linked project")
-        .argument("<names...>", "Secret name(s) to remove")
-        .option(...ENV_OPTION)
-        .option("--api-url <url>", "API base URL", apiDefault)
-        .action((names, opts) => removeCommand(names, {
-        ...opts,
-        env: normalizeEnvName(opts.env ?? folderEnvOption()),
-        envWasDefault: envWasDefaultFromArgv(),
-    }));
+        .command("lock")
+        .description("Forget the unlocked project key on this machine (OS keychain)")
+        .option(...API_OPTION)
+        .action((opts) => lockCommand(opts));
     program
-        .command("delete")
-        .description("Forget this folder: remove .getmyenv/ locally (cloud project stays)")
-        .action(() => deleteCommand());
+        .command("unlink")
+        .description("Revoke this folder's token and remove local .getmyenv files")
+        .option("--yes", "Do not ask for confirmation")
+        .option(...API_OPTION)
+        .action((opts) => unlinkCommand(opts));
+    const first = argv[2];
+    if (first &&
+        !first.startsWith("-") &&
+        first !== "help" &&
+        !program.commands.some((c) => c.name() === first || c.aliases().includes(first))) {
+        throw new Error(`Unknown command "${first}". See: npx getmyenv --help`);
+    }
     await program.parseAsync(argv);
 }
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,SAAS,qBAAqB;IAC5B,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,OAAO,IAAI,EAAE,WAAW,IAAI,aAAa,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,GAAG;IACjB,kBAAkB;IAClB,6DAA6D;CACrD,CAAC;AAEX,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc;IACzC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO;SACJ,IAAI,CAAC,UAAU,CAAC;SAChB,WAAW,CACV,gEAAgE,CACjE;SACA,OAAO,CAAC,WAAW,CAAC,CAAC;IAExB,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CACV,kEAAkE,CACnE;SACA,MAAM,CAAC,eAAe,EAAE,qCAAqC,CAAC;SAC9D,MAAM,CAAC,iBAAiB,EAAE,+CAA+C,CAAC;SAC1E,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAExC,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CACV,2EAA2E,CAC5E;SACA,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC;SACrD,MAAM,CACL,wBAAwB,EACxB,kDAAkD,CACnD;SACA,kBAAkB,CAAC,IAAI,CAAC;SACxB,oBAAoB,CAAC,IAAI,CAAC;SAC1B,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAgB,CAAC;QAClC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,MAAM,UAAU,CACd;YACE,GAAG,IAAI;YACP,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;YACpD,aAAa,EAAE,qBAAqB,EAAE;YACtC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,UAAU;SAClC,EACD,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,wDAAwD,CAAC;SACrE,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;SACxD,MAAM,CAAC,wBAAwB,EAAE,2CAA2C,CAAC;SAC7E,MAAM,CACL,SAAS,EACT,sDAAsD,CACvD;SACA,MAAM,CAAC,OAAO,EAAE,8CAA8C,CAAC;SAC/D,MAAM,CAAC,WAAW,EAAE,0CAA0C,CAAC;SAC/D,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC;SACrD,MAAM,CACL,wBAAwB,EACxB,kDAAkD,CACnD;SACA,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACf,WAAW,CAAC;QACV,GAAG,IAAI;QACP,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QACpD,aAAa,EAAE,qBAAqB,EAAE;KACvC,CAAC,CACH,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CACV,4EAA4E,CAC7E;SACA,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC;SACzC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAExC,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,2CAA2C,CAAC;SACxD,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,qBAAqB,EAAE,aAAa,EAAE,MAAM,CAAC;SACpD,MAAM,CAAC,aAAa,EAAE,oBAAoB,CAAC;SAC3C,MAAM,CAAC,UAAU,EAAE,mCAAmC,CAAC;SACvD,MAAM,CAAC,OAAO,EAAE,sDAAsD,CAAC;SACvE,MAAM,CAAC,SAAS,EAAE,2CAA2C,CAAC;SAC9D,MAAM,CAAC,WAAW,EAAE,wCAAwC,CAAC;SAC7D,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC;SACrD,MAAM,CACL,wBAAwB,EACxB,kDAAkD,CACnD;SACA,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACf,WAAW,CAAC;QACV,GAAG,IAAI;QACP,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QACpD,aAAa,EAAE,qBAAqB,EAAE;KACvC,CAAC,CACH,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,oDAAoD,CAAC;SACjE,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC;SACzC,MAAM,CAAC,aAAa,CAAC,CAAC;IAEzB,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,8CAA8C,CAAC;SAC3D,MAAM,CAAC,qBAAqB,EAAE,aAAa,CAAC;SAC5C,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC;SACrD,MAAM,CAAC,aAAa,CAAC,CAAC;IAEzB,OAAO;SACJ,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CACV,oEAAoE,CACrE;SACA,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC;SACrD,MAAM,CACL,eAAe,EACf,mEAAmE,CACpE;SACA,MAAM,CACL,wBAAwB,EACxB,kDAAkD,CACnD;SACA,MAAM,CAAC,cAAc,CAAC,CAAC;IAE1B,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,gDAAgD,CAAC;SAC7D,QAAQ,CAAC,YAAY,EAAE,0BAA0B,CAAC;SAClD,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC;SACrD,MAAM,CAAC,CAAC,KAAe,EAAE,IAAI,EAAE,EAAE,CAChC,aAAa,CAAC,KAAK,EAAE;QACnB,GAAG,IAAI;QACP,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QACpD,aAAa,EAAE,qBAAqB,EAAE;KACvC,CAAC,CACH,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CACV,qEAAqE,CACtE;SACA,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;IAEjC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,cAAc,GAAG;IACrB,sBAAsB;IACtB,kEAAkE;CAC1D,CAAC;AACX,MAAM,UAAU,GAAG,CAAC,iBAAiB,EAAE,cAAc,CAAU,CAAC;AAChE,MAAM,YAAY,GAAG;IACnB,wBAAwB;IACxB,sDAAsD;CAC9C,CAAC;AAEX;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,QAAkB,EAClB,IAAc,EACd,OAAgB;IAEhB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAClF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc;IACzC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO;SACJ,IAAI,CAAC,UAAU,CAAC;SAChB,WAAW,CAAC,gEAAgE,CAAC;SAC7E,OAAO,CAAC,WAAW,CAAC;SACpB,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,WAAW,CACV,OAAO,EACP;QACE,EAAE;QACF,cAAc;QACd,sFAAsF;QACtF,qEAAqE;QACrE,uFAAuF;QACvF,8DAA8D;QAC9D,yEAAyE;QACzE,0EAA0E;KAC3E,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;SACA,WAAW,CAAC,IAAI,CAAC;SACjB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAExC,oFAAoF;IACpF,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,MAA4B,CAAC;QAC3D,IAAI,MAAM,IAAI,aAAa,KAAK,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;YACxE,aAAa,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,6DAA6D,CAAC;SAC1E,KAAK,CAAC,qCAAqC,CAAC;SAC5C,WAAW,CACV,OAAO,EACP;QACE,EAAE;QACF,WAAW;QACX,mCAAmC;QACnC,8CAA8C;QAC9C,sGAAsG;KACvG,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;SACA,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAAC;SAClD,MAAM,CAAC,GAAG,cAAc,CAAC;SACzB,MAAM,CAAC,WAAW,EAAE,gEAAgE,CAAC;SACrF,MAAM,CAAC,iBAAiB,EAAE,sDAAsD,CAAC;SACjF,MAAM,CAAC,iBAAiB,EAAE,4DAA4D,CAAC;SACvF,MAAM,CAAC,GAAG,YAAY,CAAC;SACvB,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,kBAAkB,CAAC,IAAI,CAAC;SACxB,oBAAoB,CAAC,IAAI,CAAC;SAC1B,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,IAAI,EAAE,GAAY,EAAE,EAAE;QAC7D,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,CAAC,OAAO,WAAW,IAAI,CAAC,OAAO,aAAa,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,mDAAmD,CAAC;SAChE,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAEzC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,+BAA+B,CAAC,CAAC;IACxF,OAAO;SACJ,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;SACpC,WAAW,CAAC,+CAA+C,CAAC;SAC5D,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,OAAO;SACJ,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,6DAA6D,CAAC;SAC1E,MAAM,CAAC,eAAe,EAAE,kCAAkC,CAAC;SAC3D,MAAM,CAAC,OAAO,EAAE,+BAA+B,CAAC;SAChD,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAY,EAAE,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACpE,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,2DAA2D,CAAC;SACxE,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAY,EAAE,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAEjE,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,sDAAsD,CAAC;SACnE,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;SAC1C,MAAM,CAAC,GAAG,cAAc,CAAC;SACzB,MAAM,CAAC,kBAAkB,EAAE,wCAAwC,CAAC;SACpE,MAAM,CAAC,SAAS,EAAE,6DAA6D,CAAC;SAChF,MAAM,CAAC,GAAG,YAAY,CAAC;SACvB,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,KAAe,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAE9D,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,8BAA8B,CAAC;SAC3C,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;SACxC,MAAM,CAAC,GAAG,cAAc,CAAC;SACzB,MAAM,CAAC,OAAO,EAAE,wCAAwC,CAAC;SACzD,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,KAAe,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAEhE,OAAO;SACJ,OAAO,CAAC,IAAI,CAAC;SACb,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,GAAG,cAAc,CAAC;SACzB,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAErC,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,sEAAsE,CAAC;SACnF,QAAQ,CAAC,QAAQ,EAAE,+CAA+C,CAAC;SACnE,MAAM,CAAC,GAAG,cAAc,CAAC;SACzB,MAAM,CAAC,SAAS,EAAE,sDAAsD,CAAC;SACzE,MAAM,CAAC,WAAW,EAAE,0CAA0C,CAAC;SAC/D,MAAM,CAAC,OAAO,EAAE,6BAA6B,CAAC;SAC9C,MAAM,CAAC,GAAG,YAAY,CAAC;SACvB,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAwB,EAAE,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAEzE,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,mEAAmE,CAAC;SAChF,MAAM,CAAC,GAAG,cAAc,CAAC;SACzB,MAAM,CAAC,qBAAqB,EAAE,aAAa,EAAE,MAAM,CAAC;SACpD,MAAM,CAAC,UAAU,EAAE,mCAAmC,CAAC;SACvD,MAAM,CAAC,OAAO,EAAE,wCAAwC,CAAC;SACzD,MAAM,CAAC,GAAG,YAAY,CAAC;SACvB,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAEzC,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,sFAAsF,CAAC;SACnG,MAAM,CAAC,eAAe,EAAE,qCAAqC,CAAC;SAC9D,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAExC,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,iDAAiD,CAAC;SAC9D,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAExC,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4CAA4C,CAAC;SACzD,MAAM,CAAC,qBAAqB,EAAE,2CAA2C,CAAC;SAC1E,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAEzC,OAAO;SACJ,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,wDAAwD,CAAC;SACrE,MAAM,CAAC,WAAW,EAAE,kDAAkD,CAAC;SACvE,MAAM,CAAC,OAAO,EAAE,6BAA6B,CAAC;SAC9C,MAAM,CAAC,GAAG,YAAY,CAAC;SACvB,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAY,EAAE,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAE9D,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+DAA+D,CAAC;SAC5E,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvC,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,6DAA6D,CAAC;SAC1E,MAAM,CAAC,OAAO,EAAE,6BAA6B,CAAC;SAC9C,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAEzC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IACE,KAAK;QACL,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACtB,KAAK,KAAK,MAAM;QAChB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAChF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,6BAA6B,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC"}

package/dist/commands/backup.d.ts

@@ -1,7 +1,8 @@
 type BackupOpts = {
     output?: string;
-    apiUrl: string;
+    apiUrl?: string;
 };
+/** Encrypted backup of open contexts. Readable offline with the Vault password. */
 export declare function backupCommand(opts: BackupOpts): Promise<void>;
 export {};
 //# sourceMappingURL=backup.d.ts.map

package/dist/commands/backup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/commands/backup.ts"],"names":[],"mappings":"AAaA,KAAK,UAAU,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAgDnE"}
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/commands/backup.ts"],"names":[],"mappings":"AAaA,KAAK,UAAU,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD,mFAAmF;AACnF,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAgCnE"}

package/dist/commands/backup.js

@@ -2,38 +2,28 @@ import fs from "node:fs";
 import path from "node:path";
 import pc from "picocolors";
 import { createBackupEnvelope, parsePayload, parseWrappedKey, serializeBackup, } from "@getmyenv/crypto";
-import { readProjectMeta } from "../lib/fs.js";
-import { ApiClient } from "../lib/api.js";
+import { slugify } from "@getmyenv/shared";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
+/** Encrypted backup of open contexts. Readable offline with the Vault password. */
 export async function backupCommand(opts) {
-    console.log(pc.bold("\ngetmyenv backup\n"));
-    const { apiUrl, token, projectId } = await ensureTokenAndLink({
-        apiUrl: opts.apiUrl,
-        action: "backup",
-    });
-    const meta = readProjectMeta();
-    const client = new ApiClient(apiUrl, token);
-    const data = await client.request("GET", `/api/cli/projects/${projectId}/backup`);
+    const { client } = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
+    const data = await client.request("GET", "/api/cli/backup");
     const envelope = createBackupEnvelope({
         projectName: data.projectName,
         wrappedProjectKey: parseWrappedKey(JSON.stringify(data.wrappedProjectKey)),
-        secrets: data.secrets.map((s) => ({
-            name: s.name,
-            environment: s.environment,
-            status: s.status,
-            expiresAt: s.expiresAt,
-            payload: s.ciphertext != null && s.status !== "placeholder"
-                ? parsePayload(s.ciphertext)
-                : null,
+        contexts: data.contexts,
+        keys: data.keys,
+        tags: data.tags,
+        values: data.values.map((v) => ({
+            key: v.key,
+            context: v.context,
+            expiresAt: v.expiresAt,
+            payload: parsePayload(v.ciphertext),
         })),
     });
-    const out = opts.output ??
-        path.join(process.cwd(), `${data.projectName.replace(/\s+/g, "-").toLowerCase()}.getmyenv`);
+    const out = opts.output ?? path.join(process.cwd(), `${slugify(data.projectName) || "project"}.getmyenv`);
     fs.writeFileSync(out, serializeBackup(envelope), { mode: 0o600 });
-    console.log(`${pc.green("✓")} Wrote encrypted backup: ${out}`);
-    if (meta?.environment) {
-        console.log(pc.dim(`Linked environment: ${meta.environment}`));
-    }
-    console.log(pc.dim("Encrypted. Unlock with your Vault password.\n"));
+    console.log(`${pc.green("✓")} Encrypted backup: ${out} (${data.values.length} values, ${data.contexts.length} open contexts)`);
+    console.log(pc.dim("Locked contexts are backed up from the dashboard."));
 }
 //# sourceMappingURL=backup.js.map

package/dist/commands/backup.js.map

@@ -1 +1 @@
-{"version":3,"file":"backup.js","sourceRoot":"","sources":["../../src/commands/backup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAIzD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAgB;IAClD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC5C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC;QAC5D,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAE5C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAU9B,KAAK,EAAE,qBAAqB,SAAS,SAAS,CAAC,CAAC;IAEnD,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACpC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC1E,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,OAAO,EACL,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa;gBAChD,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC;gBAC5B,CAAC,CAAC,IAAI;SACX,CAAC,CAAC;KACJ,CAAC,CAAC;IAEH,MAAM,GAAG,GACP,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,IAAI,CACP,OAAO,CAAC,GAAG,EAAE,EACb,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAClE,CAAC;IACJ,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAC;IAC/D,IAAI,IAAI,EAAE,WAAW,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,uBAAuB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC,CAAC;AACvE,CAAC"}
+{"version":3,"file":"backup.js","sourceRoot":"","sources":["../../src/commands/backup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,eAAe,GAEhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAIzD,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAgB;IAClD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAO9B,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAE7B,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACpC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC1E,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9B,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC;SACpC,CAAC,CAAC;KACJ,CAAC,CAAC;IAEH,MAAM,GAAG,GACP,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,SAAS,WAAW,CAAC,CAAC;IAChG,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CACT,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,YAAY,IAAI,CAAC,QAAQ,CAAC,MAAM,iBAAiB,CAClH,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC,CAAC;AAC3E,CAAC"}

package/dist/commands/claim.d.ts

@@ -2,7 +2,8 @@ export type ClaimOpts = {
     apiUrl?: string;
 };
 /**
- * Claim a guest project: browser ownership transfer, then rewrap vault password.
+ * Claim a guest project: sign in and take ownership in the browser, then
+ * rewrap the project key with a Vault password.
  */
 export declare function claimCommand(opts?: ClaimOpts): Promise<void>;
 //# sourceMappingURL=claim.d.ts.map

package/dist/commands/claim.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claim.d.ts","sourceRoot":"","sources":["../../src/commands/claim.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,SAAS,GAAG;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAiBF;;GAEG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE,SAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA4ItE"}
+{"version":3,"file":"claim.d.ts","sourceRoot":"","sources":["../../src/commands/claim.ts"],"names":[],"mappings":"AAoBA,MAAM,MAAM,SAAS,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAqF5C;;;GAGG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE,SAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA0EtE"}