getmyenv 0.5.3 → 0.6.0

package/dist/lib/guest-key.d.ts

@@ -10,10 +10,7 @@ export type ResolveVaultPasswordOpts = {
      */
     create?: boolean;
 };
-/**
- * Guest projects wrap the PEK with the passphrase in claim.json.
- * Use that silently so guest → push → run needs no Vault password prompt.
- * Claimed / human projects still prompt for the Vault password.
- */
+/** Password already read from stdin by the command (for example `set --stdin`). */
+export declare function presetVaultPassword(password: string): void;
 export declare function resolveVaultPassword(opts: ResolveVaultPasswordOpts): Promise<string>;
 //# sourceMappingURL=guest-key.d.ts.map

package/dist/lib/guest-key.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guest-key.d.ts","sourceRoot":"","sources":["../../src/lib/guest-key.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,wBAAwB,GAAG;IACrC,wCAAwC;IACxC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,MAAM,CAAC,CAsCjB"}
+{"version":3,"file":"guest-key.d.ts","sourceRoot":"","sources":["../../src/lib/guest-key.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,wBAAwB,GAAG;IACrC,wCAAwC;IACxC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AASF,mFAAmF;AACnF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE1D;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,MAAM,CAAC,CAuCjB"}

package/dist/lib/guest-key.js

@@ -1,16 +1,23 @@
 import { promptHidden, readClaimFile } from "./fs.js";
 /**
  * Guest projects wrap the PEK with the passphrase in claim.json.
- * Use that silently so guest → push → run needs no Vault password prompt.
+ * Use that silently so guest, set and run need no Vault password prompt.
  * Claimed / human projects still prompt for the Vault password.
  */
+let presetPassword = null;
+/** Password already read from stdin by the command (for example `set --stdin`). */
+export function presetVaultPassword(password) {
+    presetPassword = password;
+}
 export async function resolveVaultPassword(opts) {
+    if (!opts.isGuest && presetPassword)
+        return presetPassword;
     if (opts.isGuest) {
         const claim = readClaimFile();
         if (claim?.passphrase) {
             return claim.passphrase;
         }
-        throw new Error("Guest project is missing .getmyenv/claim.json. Restore it, or run: npx getmyenv claim");
+        throw new Error("Guest project is missing .getmyenv/claim.json. Restore it from your repo or a copy.");
     }
     if (opts.create) {
         const password = await promptHidden("New Vault password (hidden): ", {

package/dist/lib/guest-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"guest-key.js","sourceRoot":"","sources":["../../src/lib/guest-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAetD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAA8B;IAE9B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,IAAI,KAAK,EAAE,UAAU,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,UAAU,CAAC;QAC1B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,+BAA+B,EAAE;YACnE,UAAU,EAAE,IAAI,CAAC,kBAAkB;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,mCAAmC,CAAC,CAAC;QACxE,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CACjC,IAAI,CAAC,MAAM,IAAI,2BAA2B,EAC1C;QACE,UAAU,EAAE,IAAI,CAAC,kBAAkB;KACpC,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"guest-key.js","sourceRoot":"","sources":["../../src/lib/guest-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAetD;;;;GAIG;AACH,IAAI,cAAc,GAAkB,IAAI,CAAC;AAEzC,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,cAAc,GAAG,QAAQ,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAA8B;IAE9B,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAC3D,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,IAAI,KAAK,EAAE,UAAU,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,UAAU,CAAC;QAC1B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,+BAA+B,EAAE;YACnE,UAAU,EAAE,IAAI,CAAC,kBAAkB;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,mCAAmC,CAAC,CAAC;QACxE,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CACjC,IAAI,CAAC,MAAM,IAAI,2BAA2B,EAC1C;QACE,UAAU,EAAE,IAAI,CAAC,kBAAkB;KACpC,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/lib/identity.d.ts

@@ -1,12 +1,10 @@
-import { type DevelopmentKeypair } from "@getmyenv/crypto";
-export declare function loadOrCreateIdentity(projectId: string): DevelopmentKeypair;
-export type StoredGrant = {
-    grantToken: string;
-    expiresAt: string;
-    projectId: string;
-    environmentId: string;
-};
-export declare function loadGrant(projectId: string, environmentId: string): StoredGrant | null;
-export declare function saveGrant(grant: StoredGrant): void;
-export declare function clearGrant(projectId: string, environmentId: string): void;
+import { type MachineKeypair } from "@getmyenv/crypto";
+import { type MachineProof } from "@getmyenv/shared";
+/**
+ * Machine identity per project, stored in the OS user config (never the repo).
+ * It identifies this machine for locked contexts. It does not decrypt values.
+ */
+export declare function loadOrCreateIdentity(projectId: string): MachineKeypair;
+export declare function machineLabel(): string;
+export declare function signMachineProof(projectId: string, contextSlug: string): MachineProof;
 //# sourceMappingURL=identity.d.ts.map

package/dist/lib/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/lib/identity.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAG1B,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAU1E;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,wBAAgB,SAAS,CACvB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GACpB,WAAW,GAAG,IAAI,CASpB;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAQlD;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAGzE"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/lib/identity.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAG1E;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,CAiBtE;AAED,wBAAgB,YAAY,IAAI,MAAM,CAKrC;AAED,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,YAAY,CAed"}

package/dist/lib/identity.js

@@ -1,38 +1,48 @@
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
-import { generateDevelopmentIdentity, } from "@getmyenv/crypto";
+import { generateMachineIdentity, signAccessRequest, } from "@getmyenv/crypto";
+import { machineProofMessage } from "@getmyenv/shared";
 import { getConfigDir } from "./fs.js";
+/**
+ * Machine identity per project, stored in the OS user config (never the repo).
+ * It identifies this machine for locked contexts. It does not decrypt values.
+ */
 export function loadOrCreateIdentity(projectId) {
-    const dir = path.join(getConfigDir(), "identities");
+    const dir = path.join(getConfigDir(), "machines");
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
     const file = path.join(dir, `${projectId}.json`);
     if (fs.existsSync(file)) {
-        return JSON.parse(fs.readFileSync(file, "utf8"));
+        try {
+            const data = JSON.parse(fs.readFileSync(file, "utf8"));
+            if (typeof data.publicKey === "string" && typeof data.privateKey === "string") {
+                return { publicKey: data.publicKey, privateKey: data.privateKey };
+            }
+        }
+        catch {
+            /* regenerate below */
+        }
     }
-    const identity = generateDevelopmentIdentity();
+    const identity = generateMachineIdentity();
     fs.writeFileSync(file, JSON.stringify(identity, null, 2), { mode: 0o600 });
     return identity;
 }
-export function loadGrant(projectId, environmentId) {
-    const file = path.join(getConfigDir(), "grants", `${projectId}-${environmentId}.json`);
-    if (!fs.existsSync(file))
-        return null;
-    const grant = JSON.parse(fs.readFileSync(file, "utf8"));
-    if (new Date(grant.expiresAt).getTime() <= Date.now()) {
-        fs.unlinkSync(file);
-        return null;
-    }
-    return grant;
-}
-export function saveGrant(grant) {
-    const dir = path.join(getConfigDir(), "grants");
-    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    const file = path.join(dir, `${grant.projectId}-${grant.environmentId}.json`);
-    fs.writeFileSync(file, JSON.stringify(grant, null, 2), { mode: 0o600 });
+export function machineLabel() {
+    const fromEnv = process.env.GETMYENV_MACHINE_LABEL?.trim();
+    if (fromEnv)
+        return fromEnv.slice(0, 120);
+    const user = process.env.USERNAME ?? process.env.USER ?? "user";
+    return `${user}@${os.hostname()}`.slice(0, 120);
 }
-export function clearGrant(projectId, environmentId) {
-    const file = path.join(getConfigDir(), "grants", `${projectId}-${environmentId}.json`);
-    if (fs.existsSync(file))
-        fs.unlinkSync(file);
+export function signMachineProof(projectId, contextSlug) {
+    const identity = loadOrCreateIdentity(projectId);
+    const timestamp = String(Date.now());
+    const message = machineProofMessage(projectId, contextSlug, identity.publicKey, timestamp);
+    return {
+        publicKey: identity.publicKey,
+        label: machineLabel(),
+        signature: signAccessRequest(identity.privateKey, message),
+        timestamp,
+    };
 }
 //# sourceMappingURL=identity.js.map

package/dist/lib/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/lib/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,2BAA2B,GAE5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;IACpD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC;IACjD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAuB,CAAC;IACzE,CAAC;IACD,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;IAC/C,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,OAAO,QAAQ,CAAC;AAClB,CAAC;AASD,MAAM,UAAU,SAAS,CACvB,SAAiB,EACjB,aAAqB;IAErB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,GAAG,SAAS,IAAI,aAAa,OAAO,CAAC,CAAC;IACvF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAgB,CAAC;IACvE,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACtD,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAkB;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC,CAAC;IAChD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CACpB,GAAG,EACH,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,aAAa,OAAO,CACjD,CAAC;IACF,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAiB,EAAE,aAAqB;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,GAAG,SAAS,IAAI,aAAa,OAAO,CAAC,CAAC;IACvF,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/lib/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,iBAAiB,GAElB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAqB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,UAAU,CAAC,CAAC;IAClD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC;IACjD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;YAClF,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAC9E,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;YACpE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAC;IAC3C,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC;IAC3D,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC;IAChE,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,WAAmB;IAEnB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,mBAAmB,CACjC,SAAS,EACT,WAAW,EACX,QAAQ,CAAC,SAAS,EAClB,SAAS,CACV,CAAC;IACF,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,KAAK,EAAE,YAAY,EAAE;QACrB,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;QAC1D,SAAS;KACV,CAAC;AACJ,CAAC"}

package/dist/lib/keychain.d.ts

@@ -0,0 +1,21 @@
+export declare const KEYCHAIN_TTL_MS: number;
+type KeyringEntry = {
+    getPassword(): string | null;
+    setPassword(password: string): void;
+    deletePassword(): boolean;
+};
+export type KeyringFactory = (service: string, account: string) => KeyringEntry;
+/** Tests swap in an in-memory keyring. `null` means no keyring available. */
+export declare function setKeyringForTests(factory: KeyringFactory | null | undefined): void;
+/** Off with `GETMYENV_KEYCHAIN=0` or in CI (`CI` set to anything but `false` or `0`). */
+export declare function keychainEnabled(env?: NodeJS.ProcessEnv): boolean;
+/** One keychain entry per server origin and project, so staging and production keys never mix. */
+export declare function keychainAccount(apiUrl: string, projectId: string): string;
+/** The cached key, only if it has not expired and matches the server's wrapped key. */
+export declare function readCachedPek(account: string, wrappedRaw: string, now?: number): Promise<Uint8Array | null>;
+/** Returns false when no keychain is available; the CLI then keeps asking. */
+export declare function storeCachedPek(account: string, wrappedRaw: string, pek: Uint8Array, now?: number): Promise<boolean>;
+/** True when an entry was removed. False when there was none or no keychain is available. */
+export declare function clearCachedPek(account: string): Promise<boolean>;
+export {};
+//# sourceMappingURL=keychain.d.ts.map

package/dist/lib/keychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../../src/lib/keychain.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,eAAe,QAAqB,CAAC;AAElD,KAAK,YAAY,GAAG;IAClB,WAAW,IAAI,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,cAAc,IAAI,OAAO,CAAC;CAC3B,CAAC;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,YAAY,CAAC;AAMhF,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAEnF;AAYD,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAK7E;AAED,kGAAkG;AAClG,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAQzE;AAgBD,uFAAuF;AACvF,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,GAAG,SAAa,GACf,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA2B5B;AAED,8EAA8E;AAC9E,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,UAAU,EACf,GAAG,SAAa,GACf,OAAO,CAAC,OAAO,CAAC,CAclB;AAED,6FAA6F;AAC7F,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAItE"}

package/dist/lib/keychain.js

@@ -0,0 +1,124 @@
+import { createHash } from "node:crypto";
+/**
+ * The unlocked project key, remembered in the OS keychain (macOS Keychain,
+ * Windows Credential Manager, Linux Secret Service) for a few hours so `run`
+ * on an open context does not ask for the Vault password every time.
+ * Never the Vault password itself.
+ */
+const SERVICE = "getmyenv";
+export const KEYCHAIN_TTL_MS = 8 * 60 * 60 * 1000;
+let factoryOverride;
+/** Tests swap in an in-memory keyring. `null` means no keyring available. */
+export function setKeyringForTests(factory) {
+    factoryOverride = factory;
+}
+async function loadFactory() {
+    if (factoryOverride !== undefined)
+        return factoryOverride;
+    try {
+        const { Entry } = await import("@napi-rs/keyring");
+        return (service, account) => new Entry(service, account);
+    }
+    catch {
+        return null;
+    }
+}
+/** Off with `GETMYENV_KEYCHAIN=0` or in CI (`CI` set to anything but `false` or `0`). */
+export function keychainEnabled(env = process.env) {
+    if (env.GETMYENV_KEYCHAIN === "0")
+        return false;
+    const ci = env.CI?.trim().toLowerCase();
+    if (ci && ci !== "false" && ci !== "0")
+        return false;
+    return true;
+}
+/** One keychain entry per server origin and project, so staging and production keys never mix. */
+export function keychainAccount(apiUrl, projectId) {
+    let origin = apiUrl;
+    try {
+        origin = new URL(apiUrl).origin;
+    }
+    catch {
+        /* keep as given */
+    }
+    return `${origin}|project:${projectId}`;
+}
+function hashWrapped(wrappedRaw) {
+    return createHash("sha256").update(wrappedRaw).digest("hex");
+}
+async function entryFor(account) {
+    const factory = await loadFactory();
+    if (!factory)
+        return null;
+    try {
+        return factory(SERVICE, account);
+    }
+    catch {
+        return null;
+    }
+}
+/** The cached key, only if it has not expired and matches the server's wrapped key. */
+export async function readCachedPek(account, wrappedRaw, now = Date.now()) {
+    const entry = await entryFor(account);
+    if (!entry)
+        return null;
+    let raw;
+    try {
+        raw = entry.getPassword();
+    }
+    catch {
+        return null;
+    }
+    if (!raw)
+        return null;
+    let stored;
+    try {
+        stored = JSON.parse(raw);
+    }
+    catch {
+        safeDelete(entry);
+        return null;
+    }
+    if (typeof stored.pek !== "string" ||
+        stored.wrappedHash !== hashWrapped(wrappedRaw) ||
+        typeof stored.expiresAt !== "number" ||
+        stored.expiresAt <= now) {
+        safeDelete(entry);
+        return null;
+    }
+    return new Uint8Array(Buffer.from(stored.pek, "base64"));
+}
+/** Returns false when no keychain is available; the CLI then keeps asking. */
+export async function storeCachedPek(account, wrappedRaw, pek, now = Date.now()) {
+    const entry = await entryFor(account);
+    if (!entry)
+        return false;
+    const stored = {
+        pek: Buffer.from(pek).toString("base64"),
+        wrappedHash: hashWrapped(wrappedRaw),
+        expiresAt: now + KEYCHAIN_TTL_MS,
+    };
+    try {
+        entry.setPassword(JSON.stringify(stored));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** True when an entry was removed. False when there was none or no keychain is available. */
+export async function clearCachedPek(account) {
+    const entry = await entryFor(account);
+    if (!entry)
+        return false;
+    return safeDelete(entry);
+}
+function safeDelete(entry) {
+    try {
+        return entry.deletePassword();
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=keychain.js.map

package/dist/lib/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../src/lib/keychain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,OAAO,GAAG,UAAU,CAAC;AAC3B,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAWlD,IAAI,eAAkD,CAAC;AAEvD,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB,CAAC,OAA0C;IAC3E,eAAe,GAAG,OAAO,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,IAAI,eAAe,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACnD,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,IAAI,GAAG,CAAC,iBAAiB,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,EAAE,IAAI,EAAE,KAAK,OAAO,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACrD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,SAAiB;IAC/D,IAAI,MAAM,GAAG,MAAM,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,mBAAmB;IACrB,CAAC;IACD,OAAO,GAAG,MAAM,YAAY,SAAS,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,OAAe;IACrC,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,UAAkB,EAClB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,CAAC,KAAK,CAAC,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,MAAM,CAAC,WAAW,KAAK,WAAW,CAAC,UAAU,CAAC;QAC9C,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,MAAM,CAAC,SAAS,IAAI,GAAG,EACvB,CAAC;QACD,UAAU,CAAC,KAAK,CAAC,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAe,EACf,UAAkB,EAClB,GAAe,EACf,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,MAAM,GAAW;QACrB,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxC,WAAW,EAAE,WAAW,CAAC,UAAU,CAAC;QACpC,SAAS,EAAE,GAAG,GAAG,eAAe;KACjC,CAAC;IACF,IAAI,CAAC;QACH,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAe;IAClD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,KAAmB;IACrC,IAAI,CAAC;QACH,OAAO,KAAK,CAAC,cAAc,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/lib/pek.d.ts

@@ -1,36 +1,27 @@
-import type { CliScope } from "./credentials.js";
-export declare function wrappedKeyPath(cwd?: string): string;
-/** Remove cached wrapped PEK for this folder (getmyenv delete). */
-export declare function clearWrappedKey(cwd?: string): boolean;
-/** True when `.getmyenv/wrapped-key.json` exists (development cache). */
-export declare function hasLocalWrappedKey(cwd?: string): boolean;
-/** Write development wrapped-key cache (guest + push). */
-export declare function writeCachedWrappedKey(wrappedRaw: string, cwd?: string): void;
 /**
- * Load / unwrap PEK.
- * - Development: may read/write `.getmyenv/wrapped-key.json`
- * - Production: never reads or writes the cache; always uses password + provided wrapped key
+ * `.getmyenv/key.json` (gitignored): the wrapped project key, cached for open
+ * contexts. It is useless without the Vault password. Locked reads never
+ * read or write it.
+ */
+export declare function keyFilePath(cwd?: string): string;
+export declare function clearCachedKey(cwd?: string): boolean;
+export declare function hasCachedKey(cwd?: string): boolean;
+export declare function writeCachedKey(wrappedRaw: string, cwd?: string): void;
+/**
+ * Unwrap the project key.
+ * - `wrapped` from the server wins over the cache (it may have been rewrapped).
+ * - `cache: true` (open contexts) reads and refreshes key.json.
+ * - `allowCreate` makes a new project key when none exists yet.
  */
 export declare function loadPek(opts: {
     password: string;
-    scope: CliScope;
-    /** Server or previously known wrapped key (required for production). */
+    cache: boolean;
     wrapped?: unknown;
-    /** Allow creating a new wrapped key when none exists (push / first upload). */
     allowCreate?: boolean;
     cwd?: string;
 }): Promise<{
     pek: Uint8Array;
     wrappedRaw: string;
+    created: boolean;
 }>;
-/**
- * Unwrap a known wrapped key (e.g. from export / grant).
- * Writes development cache only; production never caches.
- */
-export declare function unwrapPek(opts: {
-    password: string;
-    scope: CliScope;
-    wrapped: unknown;
-    cwd?: string;
-}): Promise<Uint8Array>;
 //# sourceMappingURL=pek.d.ts.map

package/dist/lib/pek.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pek.d.ts","sourceRoot":"","sources":["../../src/lib/pek.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEjD,wBAAgB,cAAc,CAAC,GAAG,SAAgB,GAAG,MAAM,CAE1D;AAED,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,GAAG,SAAgB,GAAG,OAAO,CAK5D;AAQD,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,GAAG,SAAgB,GAAG,OAAO,CAE/D;AAQD,0DAA0D;AAC1D,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,GAAG,SAAgB,GAClB,IAAI,CAEN;AAOD;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,QAAQ,CAAC;IAChB,wEAAwE;IACxE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAyCnD;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,UAAU,CAAC,CAStB"}
+{"version":3,"file":"pek.d.ts","sourceRoot":"","sources":["../../src/lib/pek.ts"],"names":[],"mappings":"AAUA;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,SAAgB,GAAG,MAAM,CAEvD;AAED,wBAAgB,cAAc,CAAC,GAAG,SAAgB,GAAG,OAAO,CAK3D;AAQD,wBAAgB,YAAY,CAAC,GAAG,SAAgB,GAAG,OAAO,CAEzD;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,SAAgB,GAAG,IAAI,CAI5E;AAOD;;;;;GAKG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAoBrE"}

package/dist/lib/pek.js

@@ -2,88 +2,64 @@ import fs from "node:fs";
 import path from "node:path";
 import { createWrappedProjectKey, parseWrappedKey, serializeWrappedKey, unwrapProjectKey, } from "@getmyenv/crypto";
 import { getGetenvDir } from "./fs.js";
-export function wrappedKeyPath(cwd = process.cwd()) {
-    return path.join(getGetenvDir(cwd), "wrapped-key.json");
+/**
+ * `.getmyenv/key.json` (gitignored): the wrapped project key, cached for open
+ * contexts. It is useless without the Vault password. Locked reads never
+ * read or write it.
+ */
+export function keyFilePath(cwd = process.cwd()) {
+    return path.join(getGetenvDir(cwd), "key.json");
 }
-/** Remove cached wrapped PEK for this folder (getmyenv delete). */
-export function clearWrappedKey(cwd = process.cwd()) {
-    const file = wrappedKeyPath(cwd);
+export function clearCachedKey(cwd = process.cwd()) {
+    const file = keyFilePath(cwd);
     if (!fs.existsSync(file))
         return false;
     fs.unlinkSync(file);
     return true;
 }
-function readCachedWrapped(cwd) {
-    const file = wrappedKeyPath(cwd);
+function readCachedKey(cwd) {
+    const file = keyFilePath(cwd);
     if (!fs.existsSync(file))
         return null;
     return fs.readFileSync(file, "utf8");
 }
-/** True when `.getmyenv/wrapped-key.json` exists (development cache). */
-export function hasLocalWrappedKey(cwd = process.cwd()) {
-    return fs.existsSync(wrappedKeyPath(cwd));
+export function hasCachedKey(cwd = process.cwd()) {
+    return fs.existsSync(keyFilePath(cwd));
 }
-function writeCachedWrapped(wrappedRaw, cwd) {
-    const file = wrappedKeyPath(cwd);
-    fs.mkdirSync(path.dirname(file), { recursive: true });
+export function writeCachedKey(wrappedRaw, cwd = process.cwd()) {
+    const file = keyFilePath(cwd);
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
     fs.writeFileSync(file, wrappedRaw, { mode: 0o600 });
 }
-/** Write development wrapped-key cache (guest + push). */
-export function writeCachedWrappedKey(wrappedRaw, cwd = process.cwd()) {
-    writeCachedWrapped(wrappedRaw, cwd);
-}
 function normalizeWrappedRaw(wrapped) {
     if (typeof wrapped === "string")
         return wrapped;
     return JSON.stringify(wrapped);
 }
 /**
- * Load / unwrap PEK.
- * - Development: may read/write `.getmyenv/wrapped-key.json`
- * - Production: never reads or writes the cache; always uses password + provided wrapped key
+ * Unwrap the project key.
+ * - `wrapped` from the server wins over the cache (it may have been rewrapped).
+ * - `cache: true` (open contexts) reads and refreshes key.json.
+ * - `allowCreate` makes a new project key when none exists yet.
  */
 export async function loadPek(opts) {
     const cwd = opts.cwd ?? process.cwd();
-    const isProd = opts.scope === "production";
-    let wrappedRaw = null;
-    if (!isProd) {
-        wrappedRaw = readCachedWrapped(cwd);
-    }
-    if (!wrappedRaw && opts.wrapped != null) {
-        wrappedRaw = normalizeWrappedRaw(opts.wrapped);
-    }
+    let wrappedRaw = opts.wrapped != null ? normalizeWrappedRaw(opts.wrapped) : null;
+    if (!wrappedRaw && opts.cache)
+        wrappedRaw = readCachedKey(cwd);
     if (!wrappedRaw) {
         if (!opts.allowCreate) {
-            throw new Error(isProd
-                ? "No project key available. Pull or push once after unlocking with your vault password."
-                : "No local wrapped key. Push secrets first, or pass the server key.");
+            throw new Error("This project has no key yet. Set a value first: npx getmyenv set KEY");
         }
         const created = await createWrappedProjectKey(opts.password);
         wrappedRaw = serializeWrappedKey(created.wrapped);
-        if (!isProd) {
-            writeCachedWrapped(wrappedRaw, cwd);
-        }
-        return { pek: created.pek, wrappedRaw };
+        if (opts.cache)
+            writeCachedKey(wrappedRaw, cwd);
+        return { pek: created.pek, wrappedRaw, created: true };
     }
     const pek = await unwrapProjectKey(opts.password, parseWrappedKey(wrappedRaw));
-    // Cache only for development after a successful unwrap from remote.
-    if (!isProd && opts.wrapped != null) {
-        writeCachedWrapped(wrappedRaw, cwd);
-    }
-    return { pek, wrappedRaw };
-}
-/**
- * Unwrap a known wrapped key (e.g. from export / grant).
- * Writes development cache only; production never caches.
- */
-export async function unwrapPek(opts) {
-    const { pek } = await loadPek({
-        password: opts.password,
-        scope: opts.scope,
-        wrapped: opts.wrapped,
-        allowCreate: false,
-        cwd: opts.cwd,
-    });
-    return pek;
+    if (opts.cache)
+        writeCachedKey(wrappedRaw, cwd);
+    return { pek, wrappedRaw, created: false };
 }
 //# sourceMappingURL=pek.js.map

package/dist/lib/pek.js.map

@@ -1 +1 @@
-{"version":3,"file":"pek.js","sourceRoot":"","sources":["../../src/lib/pek.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAGvC,MAAM,UAAU,cAAc,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAChD,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAC1D,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,eAAe,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IACjD,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACpB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IACpD,OAAO,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAkB,EAAE,GAAW;IACzD,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAEnB,kBAAkB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAQ7B;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,KAAK,YAAY,CAAC;IAE3C,IAAI,UAAU,GAAkB,IAAI,CAAC;IAErC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACxC,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,MAAM;gBACJ,CAAC,CAAC,uFAAuF;gBACzF,CAAC,CAAC,mEAAmE,CACxE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7D,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,kBAAkB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,IAAI,CAAC,QAAQ,EACb,eAAe,CAAC,UAAU,CAAC,CAC5B,CAAC;IAEF,oEAAoE;IACpE,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACpC,kBAAkB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAK/B;IACC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,OAAO,CAAC;QAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,KAAK;QAClB,GAAG,EAAE,IAAI,CAAC,GAAG;KACd,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"pek.js","sourceRoot":"","sources":["../../src/lib/pek.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAChD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACpB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAC9C,OAAO,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAAkB,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IACpE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAM7B;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEtC,IAAI,UAAU,GACZ,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK;QAAE,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAE/D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7D,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,KAAK;YAAE,cAAc,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAChD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/E,IAAI,IAAI,CAAC,KAAK;QAAE,cAAc,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC7C,CAAC"}

package/dist/lib/run-env.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Pure pieces of `getmyenv run`: validate and merge. Names only in any output.
+ */
+export type MissingKey = {
+    name: string;
+    reason: "missing" | "expired";
+};
+export type ParentEnv = Record<string, string | undefined>;
+export type Origin = "context" | "context-overrides-parent" | "parent-kept" | "parent-fills-missing" | "missing";
+export type ExplainEntry = {
+    name: string;
+    origin: Origin;
+    reason?: MissingKey["reason"];
+};
+export type MergeResult = {
+    env: ParentEnv;
+    /** Names set from the context. */
+    applied: string[];
+    /** Names the context replaced in the parent env. */
+    overridden: string[];
+    /** Names the parent env kept because of --keep-existing. */
+    kept: string[];
+    /** Keys missing in the context but present in the parent env. */
+    filledByParent: string[];
+    /** Keys missing in the context and absent from the parent env. */
+    unresolved: MissingKey[];
+    entries: ExplainEntry[];
+};
+/** The child never sees the CLI's own settings (token, API URL, config dir). */
+export declare function withoutOwnEnv(parent: ParentEnv): ParentEnv;
+/**
+ * Merge context values into the parent env.
+ * The context wins unless keepExisting is set. A key missing in the context is
+ * satisfied when the parent env already has it (for example from `op run`).
+ */
+export declare function mergeEnv(parent: ParentEnv, values: Record<string, string>, missing: MissingKey[], keepExisting: boolean): MergeResult;
+/** Error text when keys are unresolved and --allow-missing is not set. Null when fine. */
+export declare function validationError(result: Pick<MergeResult, "unresolved">, contextSlug: string, allowMissing: boolean): string | null;
+/**
+ * One cmd.exe command line from argv. Windows needs the shell to find `npm.cmd`
+ * and friends, and Node does not quote args passed alongside `shell: true`.
+ * cmd expands %VAR% even inside quotes, so each % is closed out of the quotes
+ * and escaped with ^.
+ */
+export declare function windowsCommandLine(args: string[]): string;
+/** Exit code for a child that ended by signal: 128 + signal number, like a shell. */
+export declare function signalExitCode(signal: NodeJS.Signals, numbers: Record<string, number>): number;
+/** `--explain` output. Names and origins only, never values. */
+export declare function explainLines(result: MergeResult, contextSlug: string): string[];
+//# sourceMappingURL=run-env.d.ts.map

package/dist/lib/run-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-env.d.ts","sourceRoot":"","sources":["../../src/lib/run-env.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,UAAU,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AAEzE,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAE3D,MAAM,MAAM,MAAM,GACd,SAAS,GACT,0BAA0B,GAC1B,aAAa,GACb,sBAAsB,GACtB,SAAS,CAAC;AAEd,MAAM,MAAM,YAAY,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;CAAE,CAAC;AAE3F,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,SAAS,CAAC;IACf,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oDAAoD;IACpD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,4DAA4D;IAC5D,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,iEAAiE;IACjE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,kEAAkE;IAClE,UAAU,EAAE,UAAU,EAAE,CAAC;IACzB,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB,CAAC;AAEF,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAM1D;AAOD;;;;GAIG;AACH,wBAAgB,QAAQ,CACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,OAAO,EAAE,UAAU,EAAE,EACrB,YAAY,EAAE,OAAO,GACpB,WAAW,CAyCb;AAED,0FAA0F;AAC1F,wBAAgB,eAAe,CAC7B,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EACvC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,OAAO,GACpB,MAAM,GAAG,IAAI,CAWf;AAWD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CASzD;AAED,qFAAqF;AACrF,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAG9F;AAED,gEAAgE;AAChE,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAU/E"}