getmyenv 0.5.2 → 0.6.0

package/dist/lib/run-env.js

@@ -0,0 +1,114 @@
+/**
+ * Pure pieces of `getmyenv run`: validate and merge. Names only in any output.
+ */
+/** The child never sees the CLI's own settings (token, API URL, config dir). */
+export function withoutOwnEnv(parent) {
+    const env = {};
+    for (const [k, v] of Object.entries(parent)) {
+        if (!k.toUpperCase().startsWith("GETMYENV_"))
+            env[k] = v;
+    }
+    return env;
+}
+function present(parent, name) {
+    const v = parent[name];
+    return v !== undefined && v !== "";
+}
+/**
+ * Merge context values into the parent env.
+ * The context wins unless keepExisting is set. A key missing in the context is
+ * satisfied when the parent env already has it (for example from `op run`).
+ */
+export function mergeEnv(parent, values, missing, keepExisting) {
+    const env = withoutOwnEnv(parent);
+    const applied = [];
+    const overridden = [];
+    const kept = [];
+    const entries = [];
+    for (const name of Object.keys(values).sort()) {
+        if (present(parent, name)) {
+            if (keepExisting) {
+                kept.push(name);
+                entries.push({ name, origin: "parent-kept" });
+                continue;
+            }
+            if (parent[name] !== values[name]) {
+                overridden.push(name);
+                entries.push({ name, origin: "context-overrides-parent" });
+            }
+            else {
+                entries.push({ name, origin: "context" });
+            }
+        }
+        else {
+            entries.push({ name, origin: "context" });
+        }
+        env[name] = values[name];
+        applied.push(name);
+    }
+    const filledByParent = [];
+    const unresolved = [];
+    for (const m of [...missing].sort((a, b) => a.name.localeCompare(b.name))) {
+        if (present(parent, m.name)) {
+            filledByParent.push(m.name);
+            entries.push({ name: m.name, origin: "parent-fills-missing", reason: m.reason });
+        }
+        else {
+            unresolved.push(m);
+            entries.push({ name: m.name, origin: "missing", reason: m.reason });
+        }
+    }
+    entries.sort((a, b) => a.name.localeCompare(b.name));
+    return { env, applied, overridden, kept, filledByParent, unresolved, entries };
+}
+/** Error text when keys are unresolved and --allow-missing is not set. Null when fine. */
+export function validationError(result, contextSlug, allowMissing) {
+    if (allowMissing || result.unresolved.length === 0)
+        return null;
+    const lines = result.unresolved.map((m) => `  ${m.name}${m.reason === "expired" ? " (expired)" : ""}`);
+    return [
+        `${result.unresolved.length} variable(s) have no value in ${contextSlug}:`,
+        ...lines,
+        `Set them: npx getmyenv set NAME -c ${contextSlug}`,
+        "Or run anyway: --allow-missing",
+    ].join("\n");
+}
+const ORIGIN_TEXT = {
+    context: (ctx) => `getmyenv (${ctx})`,
+    "context-overrides-parent": (ctx) => `getmyenv (${ctx}), replaces parent env`,
+    "parent-kept": () => "parent env (--keep-existing)",
+    "parent-fills-missing": (ctx, reason) => `parent env (${reason === "expired" ? "expired" : "missing"} in ${ctx})`,
+    missing: (ctx, reason) => `not set (${reason === "expired" ? "expired" : "missing"} in ${ctx})`,
+};
+/**
+ * One cmd.exe command line from argv. Windows needs the shell to find `npm.cmd`
+ * and friends, and Node does not quote args passed alongside `shell: true`.
+ * cmd expands %VAR% even inside quotes, so each % is closed out of the quotes
+ * and escaped with ^.
+ */
+export function windowsCommandLine(args) {
+    return args
+        .map((a) => {
+        if (a === "")
+            return '""';
+        if (!/[\s"&|<>^()%]/.test(a))
+            return a;
+        const escaped = a.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, "$1$1");
+        return `"${escaped.replace(/%/g, '"^%"')}"`;
+    })
+        .join(" ");
+}
+/** Exit code for a child that ended by signal: 128 + signal number, like a shell. */
+export function signalExitCode(signal, numbers) {
+    const n = numbers[signal];
+    return typeof n === "number" ? 128 + n : 1;
+}
+/** `--explain` output. Names and origins only, never values. */
+export function explainLines(result, contextSlug) {
+    const width = Math.max(4, ...result.entries.map((e) => e.name.length));
+    const lines = result.entries.map((e) => `  ${e.name.padEnd(width)}  ${ORIGIN_TEXT[e.origin](contextSlug, e.reason)}`);
+    lines.push("");
+    lines.push(`  ${result.applied.length} from getmyenv, ${result.overridden.length} replaced, ${result.kept.length} kept, ${result.filledByParent.length} from parent env, ${result.unresolved.length} not set`);
+    return lines;
+}
+//# sourceMappingURL=run-env.js.map

package/dist/lib/run-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-env.js","sourceRoot":"","sources":["../../src/lib/run-env.ts"],"names":[],"mappings":"AAAA;;GAEG;AA8BH,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,MAAiB;IAC7C,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,MAAiB,EAAE,IAAY;IAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CACtB,MAAiB,EACjB,MAA8B,EAC9B,OAAqB,EACrB,YAAqB;IAErB,MAAM,GAAG,GAAc,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;gBAC9C,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC7D,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,UAAU,GAAiB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACjF,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,eAAe,CAC7B,MAAuC,EACvC,WAAmB,EACnB,YAAqB;IAErB,IAAI,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CACjC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAClE,CAAC;IACF,OAAO;QACL,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,iCAAiC,WAAW,GAAG;QAC1E,GAAG,KAAK;QACR,sCAAsC,WAAW,EAAE;QACnD,gCAAgC;KACjC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,WAAW,GAA6D;IAC5E,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,GAAG,GAAG;IACrC,0BAA0B,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,GAAG,wBAAwB;IAC7E,aAAa,EAAE,GAAG,EAAE,CAAC,8BAA8B;IACnD,sBAAsB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CACtC,eAAe,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,OAAO,GAAG,GAAG;IAC1E,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,OAAO,GAAG,GAAG;CAChG,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAc;IAC/C,OAAO,IAAI;SACR,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1E,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC;IAC9C,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAAC,MAAsB,EAAE,OAA+B;IACpF,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,YAAY,CAAC,MAAmB,EAAE,WAAmB;IACnE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CACpF,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,mBAAmB,MAAM,CAAC,UAAU,CAAC,MAAM,cAAc,MAAM,CAAC,IAAI,CAAC,MAAM,UAAU,MAAM,CAAC,cAAc,CAAC,MAAM,qBAAqB,MAAM,CAAC,UAAU,CAAC,MAAM,UAAU,CACnM,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lib/unlock.d.ts

@@ -0,0 +1,24 @@
+export type UnlockOpts = {
+    isGuest: boolean;
+    /** Enables the OS keychain cache for open contexts. */
+    projectId?: string;
+    /** Wrapped key from the server, or null when the project has none yet. */
+    wrapped: unknown | null;
+    /** Open contexts only: read and refresh `.getmyenv/key.json`. */
+    cache: boolean;
+    /** Create a project key when none exists (first `set` / `import`). */
+    allowCreate?: boolean;
+    vaultPasswordStdin?: boolean;
+    /** --api-url, so the keychain entry matches the one `lock --api-url` clears. */
+    apiUrl?: string;
+};
+/**
+ * Unwrap the project key with the Vault password (or the guest passphrase in
+ * claim.json). Retries a wrong password up to 3 times in a terminal.
+ */
+export declare function unlockProjectKey(opts: UnlockOpts): Promise<{
+    pek: Uint8Array;
+    wrappedRaw: string;
+    created: boolean;
+}>;
+//# sourceMappingURL=unlock.d.ts.map

package/dist/lib/unlock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unlock.d.ts","sourceRoot":"","sources":["../../src/lib/unlock.ts"],"names":[],"mappings":"AAYA,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,iEAAiE;IACjE,KAAK,EAAE,OAAO,CAAC;IACf,sEAAsE;IACtE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,UAAU,GACf,OAAO,CAAC;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAsCpE"}

package/dist/lib/unlock.js

@@ -0,0 +1,87 @@
+import pc from "picocolors";
+import { hasCachedKey, loadPek } from "./pek.js";
+import { resolveVaultPassword } from "./guest-key.js";
+import { resolveApiUrl } from "./api.js";
+import { KEYCHAIN_TTL_MS, keychainAccount, keychainEnabled, readCachedPek, storeCachedPek, } from "./keychain.js";
+/**
+ * Unwrap the project key with the Vault password (or the guest passphrase in
+ * claim.json). Retries a wrong password up to 3 times in a terminal.
+ */
+export async function unlockProjectKey(opts) {
+    const known = opts.wrapped != null
+        ? typeof opts.wrapped === "string"
+            ? opts.wrapped
+            : JSON.stringify(opts.wrapped)
+        : null;
+    if (memo && (known === memo.wrappedRaw || (known == null && opts.cache))) {
+        return { pek: memo.pek, wrappedRaw: memo.wrappedRaw, created: false };
+    }
+    const account = canUseKeychain(opts)
+        ? keychainAccount(resolveApiUrl(opts.apiUrl), opts.projectId)
+        : null;
+    if (account && known != null) {
+        const pek = await readCachedPek(account, known);
+        if (pek) {
+            memo = { pek, wrappedRaw: known };
+            return { pek, wrappedRaw: known, created: false };
+        }
+    }
+    const result = await unlockWithPassword(opts);
+    memo = { pek: result.pek, wrappedRaw: result.wrappedRaw };
+    // Stored only after a password typed at a terminal. Reading also works when
+    // stdin is piped, e.g. `printf %s "$VALUE" | getmyenv set KEY --stdin`.
+    if (account &&
+        process.stdin.isTTY === true &&
+        (await storeCachedPek(account, result.wrappedRaw, result.pek))) {
+        console.error(pc.dim(`Unlocked on this machine for ${KEYCHAIN_TTL_MS / 3_600_000} hours (OS keychain). Forget it with: npx getmyenv lock\n`));
+    }
+    return result;
+}
+/** Open contexts on a real account. Never CI, servers, guests or --vault-password-stdin. */
+function canUseKeychain(opts) {
+    return (opts.cache &&
+        !opts.isGuest &&
+        !opts.vaultPasswordStdin &&
+        Boolean(opts.projectId) &&
+        keychainEnabled());
+}
+/** One unlock per process: several uploads in one command prompt once. */
+let memo = null;
+async function unlockWithPassword(opts) {
+    const creating = opts.allowCreate === true &&
+        opts.wrapped == null &&
+        !(opts.cache && hasCachedKey());
+    if (creating && !opts.isGuest) {
+        console.error(pc.dim("Choose a Vault password. It stays on this machine. We store an encrypted key only.\n"));
+    }
+    const interactive = process.stdin.isTTY && !opts.vaultPasswordStdin && !opts.isGuest;
+    const maxAttempts = creating || !interactive ? 1 : 3;
+    for (let attempt = 1;; attempt++) {
+        const password = await resolveVaultPassword({
+            isGuest: opts.isGuest,
+            vaultPasswordStdin: opts.vaultPasswordStdin,
+            create: creating,
+        });
+        try {
+            return await loadPek({
+                password,
+                cache: opts.cache,
+                wrapped: opts.wrapped ?? undefined,
+                allowCreate: opts.allowCreate,
+            });
+        }
+        catch (err) {
+            if (err instanceof Error && /no key yet/i.test(err.message))
+                throw err;
+            if (opts.isGuest) {
+                throw new Error("Could not unlock with the claim.json passphrase. Restore claim.json from the repo.");
+            }
+            if (attempt < maxAttempts) {
+                console.error(pc.red("Wrong Vault password. Try again.\n"));
+                continue;
+            }
+            throw new Error("Could not unlock. Check your Vault password.");
+        }
+    }
+}
+//# sourceMappingURL=unlock.js.map

package/dist/lib/unlock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unlock.js","sourceRoot":"","sources":["../../src/lib/unlock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,EACf,aAAa,EACb,cAAc,GACf,MAAM,eAAe,CAAC;AAiBvB;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAgB;IAEhB,MAAM,KAAK,GACT,IAAI,CAAC,OAAO,IAAI,IAAI;QAClB,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAChC,CAAC,CAAC,IAAI,CAAC,OAAO;YACd,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC;QAClC,CAAC,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,SAAU,CAAC;QAC9D,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,OAAO,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;YAClC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;IAC1D,4EAA4E;IAC5E,wEAAwE;IACxE,IACE,OAAO;QACP,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;QAC5B,CAAC,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAC9D,CAAC;QACD,OAAO,CAAC,KAAK,CACX,EAAE,CAAC,GAAG,CACJ,gCAAgC,eAAe,GAAG,SAAS,2DAA2D,CACvH,CACF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4FAA4F;AAC5F,SAAS,cAAc,CAAC,IAAgB;IACtC,OAAO,CACL,IAAI,CAAC,KAAK;QACV,CAAC,IAAI,CAAC,OAAO;QACb,CAAC,IAAI,CAAC,kBAAkB;QACxB,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;QACvB,eAAe,EAAE,CAClB,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,IAAI,IAAI,GAAmD,IAAI,CAAC;AAEhE,KAAK,UAAU,kBAAkB,CAC/B,IAAgB;IAEhB,MAAM,QAAQ,GACZ,IAAI,CAAC,WAAW,KAAK,IAAI;QACzB,IAAI,CAAC,OAAO,IAAI,IAAI;QACpB,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,YAAY,EAAE,CAAC,CAAC;IAElC,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CACX,EAAE,CAAC,GAAG,CACJ,sFAAsF,CACvF,CACF,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;IACrF,MAAM,WAAW,GAAG,QAAQ,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErD,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC;YAC1C,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC;gBACnB,QAAQ;gBACR,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS;gBAClC,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,MAAM,GAAG,CAAC;YACvE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,GAAG,WAAW,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC,CAAC;gBAC5D,SAAS;YACX,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/lib/update-check.d.ts

@@ -4,9 +4,11 @@
  */
 /** Simple semver compare for x.y.z (no prerelease). Returns -1 / 0 / 1. */
 export declare function compareSemver(a: string, b: string): number;
+/** One line for the nudge, or null when up to date or unknown. */
+export declare function updateLine(current: string, latest: string | null): string | null;
 /**
- * If a newer version exists, suggest updating first.
- * TTY: default No on continue (exit 0). Non-TTY: warn and continue.
+ * Soft update nudge. Never blocks and never exits: one line on stderr from the
+ * cached npm version, refreshed in the background once a day. Skipped in CI.
  */
 export declare function maybeSuggestUpdate(): Promise<void>;
 //# sourceMappingURL=update-check.d.ts.map

package/dist/lib/update-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update-check.d.ts","sourceRoot":"","sources":["../../src/lib/update-check.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA4BH,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAU1D;AA6ED;;;GAGG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CA0CxD"}
+{"version":3,"file":"update-check.d.ts","sourceRoot":"","sources":["../../src/lib/update-check.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA4BH,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAU1D;AA8ED,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAGhF;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAgBxD"}

package/dist/lib/update-check.js

@@ -2,12 +2,12 @@
  * Soft update nudge: compare running CLI_VERSION to npm latest.
  * Cache under ~/.config/getmyenv. Fail-open on network errors.
  */
+import { spawn } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import pc from "picocolors";
 import { CLI_VERSION } from "./api.js";
-import { promptConfirm } from "./fs.js";
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 const FETCH_TIMEOUT_MS = 2500;
 function configDir() {
@@ -46,43 +46,6 @@ function readCache() {
         return null;
     }
 }
-function writeCache(latest) {
-    try {
-        const dir = configDir();
-        fs.mkdirSync(dir, { recursive: true });
-        const payload = {
-            latest,
-            checkedAt: new Date().toISOString(),
-        };
-        fs.writeFileSync(cachePath(), JSON.stringify(payload, null, 2), {
-            mode: 0o600,
-        });
-    }
-    catch {
-        /* ignore */
-    }
-}
-async function fetchLatestFromNpm() {
-    const ctrl = new AbortController();
-    const timer = setTimeout(() => ctrl.abort(), FETCH_TIMEOUT_MS);
-    try {
-        const res = await fetch("https://registry.npmjs.org/getmyenv/latest", {
-            signal: ctrl.signal,
-            headers: { Accept: "application/json" },
-        });
-        if (!res.ok)
-            return null;
-        const data = (await res.json());
-        const v = data.version?.trim();
-        return v || null;
-    }
-    catch {
-        return null;
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
 function looksLikeGlobalBin() {
     const argv1 = (process.argv[1] ?? "").toLowerCase();
     if (argv1.includes(`${path.sep}npx${path.sep}`) || argv1.includes("npm-cache")) {
@@ -104,46 +67,69 @@ function updateCommand() {
         ? "npm i -g getmyenv@latest"
         : "npx getmyenv@latest";
 }
+/** Refresh the cache in a detached process so the command never waits on npm. */
+function refreshInBackground() {
+    const script = `(${fetchAndCache.toString()})(${JSON.stringify(cachePath())}, ${FETCH_TIMEOUT_MS})`;
+    try {
+        const child = spawn(process.execPath, ["-e", script], {
+            detached: true,
+            stdio: "ignore",
+            windowsHide: true,
+        });
+        child.on("error", () => undefined);
+        child.unref();
+    }
+    catch {
+        /* fail open */
+    }
+}
+/** Runs in the background child. Self-contained: no imports from this module. */
+async function fetchAndCache(file, timeoutMs) {
+    const fs = await import("node:fs");
+    const path = await import("node:path");
+    const ctrl = new AbortController();
+    setTimeout(() => ctrl.abort(), timeoutMs).unref();
+    try {
+        const res = await fetch("https://registry.npmjs.org/getmyenv/latest", { signal: ctrl.signal });
+        if (!res.ok)
+            return;
+        const data = (await res.json());
+        if (!data.version)
+            return;
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, JSON.stringify({ latest: data.version, checkedAt: new Date().toISOString() }), {
+            mode: 0o600,
+        });
+    }
+    catch {
+        /* fail open */
+    }
+}
+/** One line for the nudge, or null when up to date or unknown. */
+export function updateLine(current, latest) {
+    if (!latest || compareSemver(current, latest) >= 0)
+        return null;
+    return `getmyenv ${latest} is available (you have ${current}). Update: ${updateCommand()}`;
+}
 /**
- * If a newer version exists, suggest updating first.
- * TTY: default No on continue (exit 0). Non-TTY: warn and continue.
+ * Soft update nudge. Never blocks and never exits: one line on stderr from the
+ * cached npm version, refreshed in the background once a day. Skipped in CI.
  */
 export async function maybeSuggestUpdate() {
-    if (process.env.GETMYENV_SKIP_UPDATE === "1")
+    const ci = process.env.CI?.trim().toLowerCase();
+    if (process.env.GETMYENV_SKIP_UPDATE === "1" || (ci && ci !== "false" && ci !== "0"))
         return;
-    // --version / -V only: skip nudge noise
     if (process.argv.includes("-V") ||
         process.argv.includes("--version") ||
         process.argv.includes("-h") ||
         process.argv.includes("--help")) {
         return;
     }
-    let latest = null;
     const cached = readCache();
-    if (cached) {
-        latest = cached.latest;
-    }
-    else {
-        latest = await fetchLatestFromNpm();
-        if (latest)
-            writeCache(latest);
-    }
-    if (!latest)
-        return;
-    if (compareSemver(CLI_VERSION, latest) >= 0)
-        return;
-    const cmd = updateCommand();
-    const line = `Newer getmyenv: ${latest} (you have ${CLI_VERSION}). Update first: ${cmd}`;
-    if (!process.stdin.isTTY || !process.stdout.isTTY) {
-        console.error(pc.yellow(`getmyenv: ${line}`));
-        return;
-    }
-    console.log(pc.yellow(`\n${line}\n`));
-    const cont = await promptConfirm(`Continue with ${CLI_VERSION} anyway?`, { defaultYes: false });
-    if (!cont) {
-        console.log(pc.dim(`Run: ${cmd}\n`));
-        process.exit(0);
-    }
-    console.log("");
+    if (!cached)
+        refreshInBackground();
+    const line = updateLine(CLI_VERSION, cached?.latest ?? null);
+    if (line)
+        console.error(pc.yellow(line));
 }
 //# sourceMappingURL=update-check.js.map

package/dist/lib/update-check.js.map

@@ -1 +1 @@
-{"version":3,"file":"update-check.js","sourceRoot":"","sources":["../../src/lib/update-check.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAExC,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAO9B,SAAS,SAAS;IAChB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE;QACvC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,qBAAqB,CAAC,CAAC;AACvD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3E,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,EAAE,GAAG,EAAE;YAAE,OAAO,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,GAAG,EAAE;YAAE,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5D,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,YAAY;YAAE,OAAO,IAAI,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,OAAO,GAAc;YACzB,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YAC9D,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,4CAA4C,EAAE;YACpE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;QAC/B,OAAO,CAAC,IAAI,IAAI,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,+EAA+E;IAC/E,IACE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,eAAe,IAAI,CAAC,GAAG,EAAE,CAAC;QACpD,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC;YAC/C,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,EACxC,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAC9B,GAAG,IAAI,CAAC,GAAG,eAAe,IAAI,CAAC,GAAG,OAAO,IAAI,CAAC,GAAG,EAAE,CACpD,CAAC;QACF,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,kBAAkB,EAAE;QACzB,CAAC,CAAC,0BAA0B;QAC5B,CAAC,CAAC,qBAAqB,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG;QAAE,OAAO;IACrD,wCAAwC;IACxC,IACE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAC/B,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC;QACpC,IAAI,MAAM;YAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO;IAEpD,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,mBAAmB,MAAM,cAAc,WAAW,oBAAoB,GAAG,EAAE,CAAC;IAEzF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,aAAa,CAC9B,iBAAiB,WAAW,UAAU,EACtC,EAAE,UAAU,EAAE,KAAK,EAAE,CACtB,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC"}
+{"version":3,"file":"update-check.js","sourceRoot":"","sources":["../../src/lib/update-check.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvC,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAO9B,SAAS,SAAS;IAChB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE;QACvC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,qBAAqB,CAAC,CAAC;AACvD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3E,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,EAAE,GAAG,EAAE;YAAE,OAAO,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,GAAG,EAAE;YAAE,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5D,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,YAAY;YAAE,OAAO,IAAI,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,+EAA+E;IAC/E,IACE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,eAAe,IAAI,CAAC,GAAG,EAAE,CAAC;QACpD,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC;YAC/C,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,EACxC,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAC9B,GAAG,IAAI,CAAC,GAAG,eAAe,IAAI,CAAC,GAAG,OAAO,IAAI,CAAC,GAAG,EAAE,CACpD,CAAC;QACF,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,kBAAkB,EAAE;QACzB,CAAC,CAAC,0BAA0B;QAC5B,CAAC,CAAC,qBAAqB,CAAC;AAC5B,CAAC;AAED,iFAAiF;AACjF,SAAS,mBAAmB;IAC1B,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,gBAAgB,GAAG,CAAC;IACpG,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE;YACpD,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnC,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,SAAiB;IAC1D,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC,KAAK,EAAE,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,4CAA4C,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/F,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO;QACpB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE;YACpG,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,MAAqB;IAC/D,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO,YAAY,MAAM,2BAA2B,OAAO,cAAc,aAAa,EAAE,EAAE,CAAC;AAC7F,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,OAAO,IAAI,EAAE,KAAK,GAAG,CAAC;QAAE,OAAO;IAC7F,IACE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAC/B,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM;QAAE,mBAAmB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC;IAC7D,IAAI,IAAI;QAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/lib/upload.d.ts

@@ -0,0 +1,21 @@
+import type { ContextInfo } from "./api.js";
+import type { Linked } from "./bootstrap.js";
+/** Fail fast before prompting or encrypting. Mirrors the server's `checkWrite`, which still enforces it. */
+export declare function assertWritable(linked: Linked, ctx: ContextInfo): void;
+/**
+ * Encrypt values locally and upload ciphertext to one open context.
+ * Empty values are declared as keys with no value in this context.
+ */
+export declare function uploadValues(input: {
+    linked: Linked;
+    context: ContextInfo;
+    pairs: Record<string, string>;
+    prune?: boolean;
+    expiresAt?: string | null;
+    vaultPasswordStdin?: boolean;
+}): Promise<{
+    set: string[];
+    pruned: string[];
+    declared: string[];
+}>;
+//# sourceMappingURL=upload.d.ts.map

package/dist/lib/upload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../src/lib/upload.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAG7C,4GAA4G;AAC5G,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,IAAI,CASrE;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA8CnE"}

package/dist/lib/upload.js

@@ -0,0 +1,53 @@
+import { encryptSecret, serializePayload } from "@getmyenv/crypto";
+import { unlockProjectKey } from "./unlock.js";
+/** Fail fast before prompting or encrypting. Mirrors the server's `checkWrite`, which still enforces it. */
+export function assertWritable(linked, ctx) {
+    if (linked.who.token.kind === "server") {
+        throw new Error("Server tokens are read-only. Set values in the dashboard.");
+    }
+    if (ctx.protection === "locked") {
+        throw new Error(`${ctx.slug} is locked. The CLI is read-only there. Set values in the dashboard.`);
+    }
+}
+/**
+ * Encrypt values locally and upload ciphertext to one open context.
+ * Empty values are declared as keys with no value in this context.
+ */
+export async function uploadValues(input) {
+    const { linked, context } = input;
+    assertWritable(linked, context);
+    const filled = Object.entries(input.pairs).filter(([, v]) => v !== "");
+    const declare = Object.entries(input.pairs)
+        .filter(([, v]) => v === "")
+        .map(([k]) => k);
+    let values = [];
+    let wrappedProjectKey;
+    if (filled.length > 0) {
+        const { wrappedProjectKey: serverWrapped } = await linked.client.request("GET", "/api/cli/vault");
+        const { pek, wrappedRaw, created } = await unlockProjectKey({
+            isGuest: linked.who.isGuest,
+            projectId: linked.who.project.id,
+            wrapped: serverWrapped,
+            cache: true,
+            allowCreate: true,
+            vaultPasswordStdin: input.vaultPasswordStdin,
+            apiUrl: linked.apiUrl,
+        });
+        if (serverWrapped == null || created) {
+            wrappedProjectKey = JSON.parse(wrappedRaw);
+        }
+        values = filled.map(([name, value]) => ({
+            name,
+            ciphertext: serializePayload(encryptSecret(pek, value)),
+            ...(input.expiresAt !== undefined ? { expiresAt: input.expiresAt } : {}),
+        }));
+    }
+    return linked.client.request("POST", "/api/cli/values", {
+        context: context.slug,
+        ...(wrappedProjectKey ? { wrappedProjectKey } : {}),
+        values,
+        ...(input.prune ? { prune: true } : {}),
+        ...(declare.length > 0 ? { declare } : {}),
+    });
+}
+//# sourceMappingURL=upload.js.map

package/dist/lib/upload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload.js","sourceRoot":"","sources":["../../src/lib/upload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,4GAA4G;AAC5G,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,GAAgB;IAC7D,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,CAAC,IAAI,sEAAsE,CAClF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAOlC;IACC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAClC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEhC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;SACxC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAEnB,IAAI,MAAM,GAA2E,EAAE,CAAC;IACxF,IAAI,iBAAsD,CAAC;IAE3D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,EAAE,iBAAiB,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAErE,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAC5B,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,gBAAgB,CAAC;YAC1D,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO;YAC3B,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;YAChC,OAAO,EAAE,aAAa;YACtB,KAAK,EAAE,IAAI;YACX,WAAW,EAAE,IAAI;YACjB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QACH,IAAI,aAAa,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;YACrC,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAA4B,CAAC;QACxE,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI;YACJ,UAAU,EAAE,gBAAgB,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACvD,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC,CAAC;IACN,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAC1B,MAAM,EACN,iBAAiB,EACjB;QACE,OAAO,EAAE,OAAO,CAAC,IAAI;QACrB,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,MAAM;QACN,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "getmyenv",
-  "version": "0.5.2",
+  "version": "0.6.0",
   "description": "CLI for getmyenv - encrypted environment variables for any language",
   "type": "module",
   "bin": {
@@ -33,8 +33,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@getmyenv/crypto": "0.1.0",
-    "@getmyenv/shared": "0.1.0",
+    "@getmyenv/crypto": "0.2.0",
+    "@getmyenv/shared": "0.2.0",
+    "@napi-rs/keyring": "^2.1.0",
     "commander": "^13.1.0",
     "dotenv": "^16.4.7",
     "ora": "^8.2.0",
@@ -49,6 +50,7 @@
     "node": ">=24"
   },
   "scripts": {
+    "prebuild": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
     "build": "tsc -p tsconfig.json",
     "dev": "tsc -p tsconfig.json --watch",
     "start": "node dist/bin.js",

package/dist/commands/delete.d.ts

@@ -1,6 +0,0 @@
-/**
- * Forget this folder: wipe local .getmyenv/ auth files.
- * Does not delete the cloud project or ciphertext.
- */
-export declare function deleteCommand(): Promise<void>;
-//# sourceMappingURL=delete.d.ts.map

package/dist/commands/delete.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../src/commands/delete.ts"],"names":[],"mappings":"AAYA;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAsDnD"}