getmyenv 0.6.2 → 0.8.0

package/dist/commands/guest.js

@@ -1,18 +1,17 @@
 import { randomBytes } from "node:crypto";
 import path from "node:path";
 import pc from "picocolors";
-import { createWrappedProjectKey, serializeWrappedKey, } from "@getmyenv/crypto";
+import { createUserKeys, wipe } from "@getmyenv/crypto";
 import { ensureGitignoreHasEnv, readProjectMeta, writeClaimFile, writeProjectMeta, } from "../lib/fs.js";
 import { readFolderToken, writeFolderToken } from "../lib/credentials.js";
-import { writeCachedKey } from "../lib/pek.js";
 import { ApiClient, resolveApiUrl } from "../lib/api.js";
 export function folderNameHint() {
     return path.basename(process.cwd()) || "project";
 }
 /**
  * Create an unclaimed guest project with one open context, Development.
- * Writes token.json and key.json (gitignored), project.json and claim.json (committed).
- * claim.json holds the guest passphrase inside the project folder until claim.
+ * Writes token.json and claim.json (gitignored) and project.json (committed).
+ * claim.json holds the guest passphrase that wraps the guest key until claim.
  */
 export async function createGuestProject(opts = {}) {
     if (readFolderToken() || readProjectMeta()?.projectId) {
@@ -21,13 +20,13 @@ export async function createGuestProject(opts = {}) {
     const apiUrl = resolveApiUrl(opts.apiUrl);
     const name = (opts.name?.trim() || folderNameHint()).slice(0, 120);
     const passphrase = randomBytes(32).toString("base64url");
-    const { wrapped } = await createWrappedProjectKey(passphrase);
-    const wrappedRaw = serializeWrappedKey(wrapped);
+    const guestKeys = await createUserKeys(passphrase);
+    wipe(guestKeys.privateKey);
     let created;
     try {
         created = await new ApiClient(apiUrl).request("POST", "/api/anon-projects", {
             name,
-            wrappedProjectKey: wrappedRaw,
+            keys: { publicKey: guestKeys.publicKey, wrappedPrivateKey: guestKeys.wrapped },
         });
     }
     catch (err) {
@@ -47,12 +46,13 @@ export async function createGuestProject(opts = {}) {
         projectName: created.projectName,
         guestExpiresAt: created.guestExpiresAt,
     });
-    writeCachedKey(wrappedRaw);
     ensureGitignoreHasEnv();
     const daysLeft = Math.max(0, Math.ceil((new Date(created.guestExpiresAt).getTime() - Date.now()) / 86_400_000));
     console.error(`${pc.green("✓")} Guest project ${pc.bold(created.projectName)}. Context: development.`);
-    console.error(pc.dim(`Expires in ${daysLeft} days unless claimed. Commit .getmyenv/project.json. Commit claim.json to private repos only. token.json and key.json stay local.`));
-    console.error(pc.dim("claim.json holds the guest passphrase until you claim.\n"));
+    console.error(pc.dim(`Expires in ${daysLeft} days unless claimed. Commit .getmyenv/project.json. token.json and claim.json stay local.`));
+    console.error(pc.dim("claim.json holds the claim code and guest passphrase. Shown once, save them to claim later:"));
+    console.error(`  ${pc.dim("Claim code:")}       ${created.claimCode}`);
+    console.error(`  ${pc.dim("Guest passphrase:")} ${passphrase}\n`);
     return created;
 }
 export async function guestCommand(opts = {}) {
@@ -65,4 +65,3 @@ export async function guestCommand(opts = {}) {
     console.error(pc.cyan("  npx getmyenv claim             ") + pc.dim("# keep it, with an account"));
     console.error("");
 }
-//# sourceMappingURL=guest.js.map

package/dist/commands/import.d.ts

@@ -4,7 +4,8 @@ export type ImportOpts = {
     prune?: boolean;
     dryRun?: boolean;
     yes?: boolean;
-    vaultPasswordStdin?: boolean;
+    /** The caller prints its own run line. */
+    noRunLine?: boolean;
 };
 type Target = {
     slug: string;
@@ -23,4 +24,3 @@ export declare function planImport(files: string[], opts: {
 /** `import [file]`: encrypt .env values locally and upload them to contexts. */
 export declare function importCommand(file: string | undefined, opts: ImportOpts): Promise<void>;
 export {};
-//# sourceMappingURL=import.d.ts.map

package/dist/commands/import.js

@@ -5,6 +5,7 @@ import { contextSlugFromEnvFile, ensureGitignoreHasEnv, parseEnvFile, promptConf
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { defaultContextSlug, findContext, resolveContext } from "../lib/context.js";
 import { confirmDiff } from "../lib/confirm.js";
+import { printDidYouMean } from "../lib/known-keys.js";
 import { uploadValues } from "../lib/upload.js";
 import { runLine } from "./start.js";
 /** `.env` before `.env.local`, so local files win on merge. */
@@ -126,6 +127,7 @@ export async function importCommand(file, opts) {
         for (const name of hostedOnly) {
             console.error(`  ${opts.prune ? pc.red("-") : pc.dim("=")} ${name}${pc.dim(opts.prune ? " (unset, not in file)" : " (kept, not in file)")}`);
         }
+        printDidYouMean(names, "  ");
         if (opts.dryRun) {
             console.error("");
             continue;
@@ -147,7 +149,6 @@ export async function importCommand(file, opts) {
             context: ctx,
             pairs,
             prune: opts.prune,
-            vaultPasswordStdin: opts.vaultPasswordStdin,
         });
         imported += res.set.length;
         changed += res.set.length + res.declared.length + res.pruned.length;
@@ -161,8 +162,9 @@ export async function importCommand(file, opts) {
     ensureGitignoreHasEnv();
     if (imported > 0) {
         console.error(pc.dim("Your .env files are unchanged. getmyenv run does not need them. Delete them when you are ready.\n"));
-        console.error("Start your app with:");
-        console.error(pc.cyan(`  ${runLine(explicitContext ?? defaultContextSlug(who, meta))}\n`));
+        if (!opts.noRunLine) {
+            console.error("Start your app with:");
+            console.error(pc.cyan(`  ${runLine(explicitContext ?? defaultContextSlug(who, meta))}\n`));
+        }
     }
 }
-//# sourceMappingURL=import.js.map

package/dist/commands/lock.d.ts

@@ -1,5 +1,4 @@
-/** Forget the unlocked project key on this machine. The next run asks for the Vault password. */
+/** Forget every unlocked context key on this machine. The next run asks for the Vault password. */
 export declare function lockCommand(opts: {
     apiUrl?: string;
 }): Promise<void>;
-//# sourceMappingURL=lock.d.ts.map

package/dist/commands/lock.js

@@ -2,17 +2,13 @@ import pc from "picocolors";
 import { readProjectMeta } from "../lib/fs.js";
 import { readFolderToken } from "../lib/credentials.js";
 import { resolveApiUrl } from "../lib/api.js";
-import { clearCachedPek, keychainAccount } from "../lib/keychain.js";
-/** Forget the unlocked project key on this machine. The next run asks for the Vault password. */
+import { clearAllCachedKeys, keychainAccount } from "../lib/keychain.js";
+/** Forget every unlocked context key on this machine. The next run asks for the Vault password. */
 export async function lockCommand(opts) {
     const projectId = readProjectMeta()?.projectId ?? readFolderToken()?.projectId;
-    if (!projectId) {
-        console.log(pc.dim("This folder is not linked."));
-        return;
-    }
-    const removed = await clearCachedPek(keychainAccount(resolveApiUrl(opts.apiUrl), projectId));
-    console.log(removed
+    const fallback = projectId ? [keychainAccount(resolveApiUrl(opts.apiUrl), projectId)] : [];
+    const removed = await clearAllCachedKeys(fallback);
+    console.log(removed > 0
         ? `${pc.green("✓")} Locked. The next run asks for the Vault password.`
         : pc.dim("Already locked."));
 }
-//# sourceMappingURL=lock.js.map

package/dist/commands/ls.d.ts

@@ -3,4 +3,3 @@ export declare function lsCommand(opts: {
     context?: string;
     apiUrl?: string;
 }): Promise<void>;
-//# sourceMappingURL=ls.d.ts.map

package/dist/commands/ls.js

@@ -34,4 +34,3 @@ export async function lsCommand(opts) {
         console.log([k.name.padEnd(nameWidth), ...cells].join("  "));
     }
 }
-//# sourceMappingURL=ls.js.map

package/dist/commands/restore.d.ts

@@ -1,13 +1,12 @@
 type RestoreOpts = {
     apiUrl?: string;
-    vaultPasswordStdin?: boolean;
     yes?: boolean;
     dryRun?: boolean;
 };
 /**
- * Restore a backup into this folder's project. The password is checked
- * locally first. Ciphertext is uploaded as is. Read-only contexts are skipped.
+ * Restore a backup into this folder's project. The backup opens locally with
+ * the Vault password it was made with. Values are encrypted again with this
+ * project's context keys. Read-only and unknown contexts are skipped.
  */
 export declare function restoreCommand(file: string, opts: RestoreOpts): Promise<void>;
 export {};
-//# sourceMappingURL=restore.d.ts.map

package/dist/commands/restore.js

@@ -1,43 +1,63 @@
 import fs from "node:fs";
 import pc from "picocolors";
-import { parseBackup, restoreValuesFromBackup, serializePayload, serializeWrappedKey, } from "@getmyenv/crypto";
+import { encryptSecret, parseBackup, restoreValuesFromBackup, serializePayload, } from "@getmyenv/crypto";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
+import { findContext } from "../lib/context.js";
 import { promptConfirm } from "../lib/fs.js";
 import { resolveVaultPassword } from "../lib/guest-key.js";
-import { writeCachedKey } from "../lib/pek.js";
+import { contextKey } from "../lib/vault.js";
 /**
- * Restore a backup into this folder's project. The password is checked
- * locally first. Ciphertext is uploaded as is. Read-only contexts are skipped.
+ * Restore a backup into this folder's project. The backup opens locally with
+ * the Vault password it was made with. Values are encrypted again with this
+ * project's context keys. Read-only and unknown contexts are skipped.
  */
 export async function restoreCommand(file, opts) {
     if (!fs.existsSync(file))
         throw new Error(`File not found: ${file}`);
-    if (!opts.yes && !opts.dryRun && (!process.stdin.isTTY || opts.vaultPasswordStdin)) {
-        throw new Error("Restore replaces values and the Vault key. Pass --yes to confirm, or --dry-run to preview.");
+    if (!opts.yes && !opts.dryRun && !process.stdin.isTTY) {
+        throw new Error("Restore replaces values with the same names. Pass --yes to confirm, or --dry-run to preview.");
     }
-    const envelope = parseBackup(fs.readFileSync(file, "utf8"));
-    const { who, client } = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
+    let envelope;
+    try {
+        envelope = parseBackup(fs.readFileSync(file, "utf8"));
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : "";
+        throw new Error(msg.startsWith("Unsupported backup version")
+            ? "This backup was made by an older version and cannot be restored."
+            : "Not a getmyenv backup file.");
+    }
+    const linked = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
+    const { who, client } = linked;
     if (who.token.kind !== "folder") {
         throw new Error("Restore needs a signed-in folder token. Guest and server tokens cannot restore.");
     }
     const password = await resolveVaultPassword({
         isGuest: false,
-        vaultPasswordStdin: opts.vaultPasswordStdin,
         prompt: "Vault password for this backup (hidden): ",
     });
+    let opened;
     try {
-        await restoreValuesFromBackup(password, envelope);
+        opened = await restoreValuesFromBackup(password, envelope);
     }
     catch {
         throw new Error("Could not open the backup. Check the Vault password.");
     }
-    console.error(`Backup checked: ${envelope.values.length} values in ${envelope.contexts.length} contexts.\n`);
-    const locked = new Set(envelope.contexts.filter((c) => c.protection === "locked").map((c) => c.slug));
+    console.error(`Backup checked: ${opened.values.length} values in ${envelope.contexts.length} contexts.\n`);
+    const targets = new Map();
+    for (const c of envelope.contexts)
+        targets.set(c.slug, findContext(who.contexts, c.slug));
+    const writable = (slug) => targets.get(slug)?.protection === "open";
     const perContext = new Map();
-    for (const v of envelope.values)
+    for (const v of opened.values)
         perContext.set(v.context, (perContext.get(v.context) ?? 0) + 1);
     for (const [slug, count] of perContext) {
-        const note = locked.has(slug) ? pc.yellow(" (read-only, skipped)") : "";
+        const target = targets.get(slug);
+        const note = !target
+            ? pc.yellow(" (no such context here, skipped)")
+            : target.protection === "locked"
+                ? pc.yellow(" (read-only, skipped)")
+                : "";
         console.error(`  ${slug}: ${count} value${count === 1 ? "" : "s"}${note}`);
     }
     console.error("");
@@ -46,29 +66,33 @@ export async function restoreCommand(file, opts) {
         return;
     }
     if (!opts.yes) {
-        const ok = await promptConfirm(`Restore into ${who.project.name}? Existing values with the same names are replaced, and the project uses this backup's Vault password.`, { defaultYes: false });
+        const ok = await promptConfirm(`Restore into ${who.project.name}? Existing values with the same names are replaced.`, { defaultYes: false });
         if (!ok) {
             console.error(pc.dim("Nothing restored."));
             return;
         }
     }
-    const res = await client.request("POST", "/api/cli/restore", {
-        wrappedProjectKey: envelope.wrappedProjectKey,
-        contexts: envelope.contexts,
-        keys: envelope.keys,
-        ...(envelope.tags ? { tags: envelope.tags } : {}),
-        values: envelope.values.map((v) => ({
+    const values = [];
+    for (const v of opened.values) {
+        if (!writable(v.context))
+            continue;
+        const target = targets.get(v.context);
+        const key = await contextKey(linked, target, { create: true });
+        values.push({
             key: v.key,
             context: v.context,
             expiresAt: v.expiresAt,
-            ciphertext: serializePayload(v.payload),
-        })),
+            ciphertext: serializePayload(encryptSecret(key, v.key, v.value)),
+        });
+    }
+    const res = await client.request("POST", "/api/cli/restore", {
+        keys: envelope.keys,
+        tags: envelope.tags ?? {},
+        values,
     });
-    writeCachedKey(serializeWrappedKey(envelope.wrappedProjectKey));
+    const skipped = [...perContext.keys()].filter((slug) => !writable(slug));
     console.log(`${pc.green("✓")} Restored ${res.restored} values into ${res.projectName}`);
-    if (res.skippedContexts.length > 0) {
-        console.log(pc.yellow(`Skipped read-only contexts: ${res.skippedContexts.join(", ")}. Restore those in the dashboard.`));
+    if (skipped.length > 0) {
+        console.log(pc.yellow(`Skipped: ${skipped.join(", ")}. Restore read-only contexts in the dashboard.`));
     }
-    console.log(pc.dim("The project now uses this backup's Vault password."));
 }
-//# sourceMappingURL=restore.js.map

package/dist/commands/run.d.ts

@@ -4,8 +4,6 @@ export type RunOpts = {
     explain?: boolean;
     keepExisting?: boolean;
     allowMissing?: boolean;
-    vaultPasswordStdin?: boolean;
 };
 /** Resolve, validate, merge, spawn. */
 export declare function runCommand(opts: RunOpts, childArgs: string[]): Promise<void>;
-//# sourceMappingURL=run.d.ts.map

package/dist/commands/run.js

@@ -6,9 +6,9 @@ import { ApiError } from "../lib/api.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { resolveContext } from "../lib/context.js";
 import { signMachineProof } from "../lib/identity.js";
-import { unlockProjectKey } from "../lib/unlock.js";
+import { contextKey } from "../lib/vault.js";
 import { sleep } from "../lib/authorize.js";
-import { explainLines, mergeEnv, signalExitCode, validationError, windowsCommandLine, } from "../lib/run-env.js";
+import { assertVariableNames, explainLines, mergeEnv, signalExitCode, validationError, windowsCommandLine, } from "../lib/run-env.js";
 const GRANT_HEADER = "X-Getmyenv-Grant";
 /** Status lines go to stderr so the child's stdout stays clean for pipes. */
 const log = (line = "") => console.error(line);
@@ -41,7 +41,8 @@ export async function runCommand(opts, childArgs) {
     if (childArgs.length === 0 && !opts.explain) {
         throw new Error("Usage: npx getmyenv run [context] -- <command>");
     }
-    const { who, client, meta, apiUrl } = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
+    const linked = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
+    const { who, client, meta } = linked;
     const ctx = resolveContext(who, meta, opts.context);
     let res = await resolveOnce(client, who.project.id, ctx.slug);
     if (res.status === "pending") {
@@ -58,21 +59,15 @@ export async function runCommand(opts, childArgs) {
         if (res.status !== "ok")
             throw new Error("Approval did not complete. Run the command again.");
     }
+    if (res.via === "auto") {
+        log(`${pc.green("✓")} This machine is now trusted for ${res.context.slug}.`);
+    }
+    assertVariableNames([...res.values.map((v) => v.name), ...res.missing.map((m) => m.name)]);
     const values = {};
     if (res.values.length > 0) {
-        if (res.wrappedProjectKey == null) {
-            throw new Error("This project has values but no key. Restore the key from a backup.");
-        }
-        const { pek } = await unlockProjectKey({
-            isGuest: who.isGuest,
-            projectId: who.project.id,
-            wrapped: res.wrappedProjectKey,
-            cache: res.cacheKey,
-            vaultPasswordStdin: opts.vaultPasswordStdin,
-            apiUrl,
-        });
+        const key = await contextKey(linked, { ...res.context, sealedKey: res.sealedKey });
         for (const v of res.values) {
-            values[v.name] = decryptSecret(pek, parsePayload(v.ciphertext));
+            values[v.name] = decryptSecret(key, v.name, parsePayload(v.ciphertext));
         }
     }
     const merged = mergeEnv(process.env, values, res.missing, opts.keepExisting === true);
@@ -122,4 +117,3 @@ export async function runCommand(opts, childArgs) {
     });
     process.exit(code);
 }
-//# sourceMappingURL=run.js.map

package/dist/commands/set.d.ts

@@ -2,7 +2,6 @@ export type SetOpts = {
     context?: string;
     apiUrl?: string;
     expires?: string;
-    vaultPasswordStdin?: boolean;
     /** Read the one value from stdin, so it never lands in argv or shell history. */
     stdin?: boolean;
 };
@@ -13,4 +12,3 @@ export declare function unsetCommand(names: string[], opts: {
     apiUrl?: string;
     all?: boolean;
 }): Promise<void>;
-//# sourceMappingURL=set.d.ts.map

package/dist/commands/set.js

@@ -1,9 +1,9 @@
 import pc from "picocolors";
 import { variableNameSchema } from "@getmyenv/shared";
 import { promptHidden } from "../lib/fs.js";
-import { presetVaultPassword } from "../lib/guest-key.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { resolveContext } from "../lib/context.js";
+import { printDidYouMean } from "../lib/known-keys.js";
 import { assertWritable, uploadValues } from "../lib/upload.js";
 async function readStdinValue() {
     const chunks = [];
@@ -50,20 +50,8 @@ export async function setCommand(args, opts) {
     const ctx = resolveContext(linked.who, linked.meta, opts.context);
     assertWritable(linked, ctx);
     const values = {};
-    if (opts.stdin) {
-        const input = await readStdinValue();
-        if (opts.vaultPasswordStdin) {
-            const nl = input.indexOf("\n");
-            if (nl < 0) {
-                throw new Error("With --vault-password-stdin, send the password on the first line and the value after it.");
-            }
-            presetVaultPassword(input.slice(0, nl).replace(/\r$/, ""));
-            values[pairs[0].name] = input.slice(nl + 1);
-        }
-        else {
-            values[pairs[0].name] = input;
-        }
-    }
+    if (opts.stdin)
+        values[pairs[0].name] = await readStdinValue();
     for (const p of pairs) {
         if (opts.stdin)
             break;
@@ -81,12 +69,12 @@ export async function setCommand(args, opts) {
         context: ctx,
         pairs: values,
         expiresAt,
-        vaultPasswordStdin: opts.vaultPasswordStdin,
     });
     for (const name of res.set)
         console.log(`${pc.green("✓")} ${name} ${pc.dim(`set in ${ctx.slug}`)}`);
     for (const name of res.declared)
         console.log(`${pc.yellow("○")} ${name} ${pc.dim(`declared, no value in ${ctx.slug}`)}`);
+    printDidYouMean(pairs.map((p) => p.name).filter((n) => !linked.who.keys.some((k) => k.name === n)));
 }
 export async function unsetCommand(names, opts) {
     for (const n of names) {
@@ -108,4 +96,3 @@ export async function unsetCommand(names, opts) {
     if (skipped.length > 0)
         console.log(pc.dim(`No change: ${skipped.join(", ")}`));
 }
-//# sourceMappingURL=set.js.map

package/dist/commands/start.d.ts

@@ -1,6 +1,7 @@
+import { type PublicTemplate } from "@getmyenv/shared";
 /** Best guess at the app's start command, for the printed `run` line. */
 export declare function suggestedStartCommand(cwd?: string): string;
-export declare function runLine(context: string | null, cwd?: string): string;
+export declare function runLine(context: string | null, cwd?: string, startCommand?: string | null): string;
 /**
  * Guided setup for an unlinked folder, in a terminal.
  * Start without an account, or sign in. Then offer to import a detected .env.
@@ -8,9 +9,13 @@ export declare function runLine(context: string | null, cwd?: string): string;
 export declare function startSetup(opts: {
     apiUrl?: string;
     thenContinue?: boolean;
+    template?: PublicTemplate;
 }): Promise<void>;
-/** Bare `getmyenv`: setup when unlinked (terminal only), status when linked. */
+/**
+ * Bare `getmyenv`: setup when unlinked (terminal only), status when linked.
+ * With --template, add the template's names and ask for their values.
+ */
 export declare function startCommand(opts: {
     apiUrl?: string;
+    template?: string;
 }): Promise<void>;
-//# sourceMappingURL=start.d.ts.map

package/dist/commands/start.js

@@ -8,6 +8,7 @@ import { authorizeFolder } from "../lib/authorize.js";
 import { NOT_LINKED_STEPS } from "../lib/bootstrap.js";
 import { createGuestProject, folderNameHint } from "./guest.js";
 import { statusCommand } from "./status.js";
+import { applyTemplate, fetchTemplate, printTemplate } from "./template.js";
 /** Best guess at the app's start command, for the printed `run` line. */
 export function suggestedStartCommand(cwd = process.cwd()) {
     const pkgFile = path.join(cwd, "package.json");
@@ -32,9 +33,9 @@ export function suggestedStartCommand(cwd = process.cwd()) {
         return "cargo run";
     return "<your start command>";
 }
-export function runLine(context, cwd = process.cwd()) {
+export function runLine(context, cwd = process.cwd(), startCommand) {
     const ctx = context && context !== DEFAULT_CONTEXT_SLUG ? ` ${context}` : "";
-    return `npx getmyenv run${ctx} -- ${suggestedStartCommand(cwd)}`;
+    return `npx getmyenv run${ctx} -- ${startCommand || suggestedStartCommand(cwd)}`;
 }
 async function nameFirstContext(apiUrl) {
     const answer = (await readLine(`Name your first context ${pc.dim("[Development]")}: `)).trim();
@@ -47,7 +48,7 @@ async function nameFirstContext(apiUrl) {
 }
 /** A project that already has keys or its own contexts is set up. Do not ask for a first context. */
 function isFreshProject(who) {
-    if (who.keys.length > 0)
+    if (who.token.member || who.keys.length > 0)
         return false;
     return who.contexts.every((c) => c.slug === DEFAULT_CONTEXT_SLUG || c.protection === "locked");
 }
@@ -62,6 +63,8 @@ function defaultContextFor(who) {
 export async function startSetup(opts) {
     console.error(pc.bold("\ngetmyenv"));
     console.error(pc.dim("Keep using environment variables. Stop managing them as files.\n"));
+    if (opts.template)
+        printTemplate(opts.template);
     const apiUrl = resolveApiUrl(opts.apiUrl);
     const existing = readProjectMeta();
     if (readClaimFile()) {
@@ -70,11 +73,17 @@ export async function startSetup(opts) {
     if (existing?.projectId) {
         console.error(`This folder uses ${pc.bold(existing.projectName ?? existing.projectId)}. Sign in to get a token.\n`);
         await authorizeFolder({ apiUrl });
+        if (opts.template) {
+            const { context } = await applyTemplate(opts.template, { apiUrl });
+            if (!opts.thenContinue)
+                printRunLine(context, opts.template.startCommand);
+        }
         return;
     }
     const choice = await promptChoice("How do you want to start?", ["Start without an account (guest project, claim within 60 days)", "Sign in"], 0);
     console.error("");
     let context = DEFAULT_CONTEXT_SLUG;
+    let dashboardUrl = null;
     if (choice === 0) {
         const name = (await readLine(`Project name ${pc.dim(`[${folderNameHint()}]`)}: `)).trim() ||
             folderNameHint();
@@ -82,10 +91,18 @@ export async function startSetup(opts) {
     }
     else {
         const who = await authorizeFolder({ apiUrl });
-        context = isFreshProject(who) ? await nameFirstContext(apiUrl) : defaultContextFor(who);
+        context =
+            isFreshProject(who) && !opts.template ? await nameFirstContext(apiUrl) : defaultContextFor(who);
         const meta = readProjectMeta();
         if (meta)
             writeProjectMeta({ ...meta, context });
+        dashboardUrl = `${apiUrl.replace(/\/$/, "")}/projects/${who.project.id}/${context}`;
+    }
+    if (opts.template) {
+        const applied = await applyTemplate(opts.template, { apiUrl });
+        if (!opts.thenContinue)
+            printRunLine(applied.context, opts.template.startCommand);
+        return;
     }
     const files = rootEnvFiles();
     if (files.length > 0) {
@@ -95,17 +112,39 @@ export async function startSetup(opts) {
         });
         if (ok) {
             const { importCommand } = await import("./import.js");
-            await importCommand(undefined, { apiUrl, yes: true });
+            await importCommand(undefined, { apiUrl, yes: true, noRunLine: true });
         }
     }
-    if (!opts.thenContinue) {
-        console.error("Start your app with:\n");
-        console.error(pc.cyan(`  ${runLine(context)}\n`));
+    else {
+        console.error("No .env file in this folder. Add values with:\n");
+        console.error(pc.cyan("  npx getmyenv set API_KEY"));
+        if (dashboardUrl)
+            console.error(pc.dim(`  or in the dashboard: ${dashboardUrl}`));
+        console.error("");
     }
+    if (!opts.thenContinue)
+        printRunLine(context);
+}
+function printRunLine(context, startCommand) {
+    console.error("Start your app with:\n");
+    console.error(pc.cyan(`  ${runLine(context, process.cwd(), startCommand)}\n`));
 }
-/** Bare `getmyenv`: setup when unlinked (terminal only), status when linked. */
+/**
+ * Bare `getmyenv`: setup when unlinked (terminal only), status when linked.
+ * With --template, add the template's names and ask for their values.
+ */
 export async function startCommand(opts) {
+    const template = opts.template ? await fetchTemplate(opts.template, opts.apiUrl) : undefined;
+    if (template && !process.stdin.isTTY) {
+        throw new Error("start --template asks for values. Run it in a terminal.");
+    }
     if (getSessionToken()) {
+        if (template) {
+            printTemplate(template);
+            const { context } = await applyTemplate(template, opts);
+            printRunLine(context, template.startCommand);
+            return;
+        }
         await statusCommand(opts);
         return;
     }
@@ -113,6 +152,5 @@ export async function startCommand(opts) {
         console.log(NOT_LINKED_STEPS);
         return;
     }
-    await startSetup({ apiUrl: opts.apiUrl });
+    await startSetup({ apiUrl: opts.apiUrl, template });
 }
-//# sourceMappingURL=start.js.map

package/dist/commands/status.d.ts

@@ -2,4 +2,3 @@
 export declare function statusCommand(opts?: {
     apiUrl?: string;
 }): Promise<void>;
-//# sourceMappingURL=status.d.ts.map

package/dist/commands/status.js

@@ -1,4 +1,5 @@
 import pc from "picocolors";
+import { NEW_MACHINE_POLICY_LABELS } from "@getmyenv/shared";
 import { isDefaultApiUrl } from "../lib/api.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { defaultContextSlug } from "../lib/context.js";
@@ -13,7 +14,12 @@ export async function statusCommand(opts = {}) {
     const { who, apiUrl, meta } = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
     const current = defaultContextSlug(who, meta);
     console.log(`${pc.bold(who.project.name)}${who.user ? pc.dim(`  ${who.user.email}`) : ""}`);
-    console.log(pc.dim(`Token: ${TOKEN_KIND[who.token.kind] ?? who.token.kind}`));
+    console.log(pc.dim(who.token.member
+        ? "Token: folder, shared project (the contexts the owner shared with you)"
+        : `Token: ${TOKEN_KIND[who.token.kind] ?? who.token.kind}`));
+    if (who.token.kind === "server" && who.token.newMachinePolicy) {
+        console.log(pc.dim(`New machines: ${NEW_MACHINE_POLICY_LABELS[who.token.newMachinePolicy]}`));
+    }
     if (process.env.GETMYENV_TOKEN?.trim())
         console.log(pc.dim("Source: GETMYENV_TOKEN"));
     if (!isDefaultApiUrl(apiUrl))
@@ -37,4 +43,3 @@ export async function statusCommand(opts = {}) {
     console.log(pc.cyan(`  ${runLine(current)}`));
     console.log("");
 }
-//# sourceMappingURL=status.js.map

package/dist/commands/template.d.ts

@@ -0,0 +1,13 @@
+import { type PublicTemplate } from "@getmyenv/shared";
+/** Load a public template by id or URL. No token needed. */
+export declare function fetchTemplate(ref: string, apiUrl?: string): Promise<PublicTemplate>;
+export declare function printTemplate(template: PublicTemplate): void;
+/**
+ * Add the template's names to the linked project, then ask for each value
+ * that is still missing in the folder's default context. Enter skips one.
+ */
+export declare function applyTemplate(template: PublicTemplate, opts: {
+    apiUrl?: string;
+}): Promise<{
+    context: string;
+}>;