getmyenv 0.7.0 → 0.8.0

package/dist/lib/identity.d.ts

@@ -2,9 +2,8 @@ import { type MachineKeypair } from "@getmyenv/crypto";
 import { type MachineProof } from "@getmyenv/shared";
 /**
  * Machine identity per project, stored in the OS user config (never the repo).
- * It identifies this machine for locked contexts. It does not decrypt values.
+ * It identifies this machine for read-only contexts. It does not decrypt values.
  */
 export declare function loadOrCreateIdentity(projectId: string): MachineKeypair;
 export declare function machineLabel(): string;
 export declare function signMachineProof(projectId: string, contextSlug: string): MachineProof;
-//# sourceMappingURL=identity.d.ts.map

package/dist/lib/identity.js

@@ -6,7 +6,7 @@ import { machineProofMessage } from "@getmyenv/shared";
 import { getConfigDir } from "./fs.js";
 /**
  * Machine identity per project, stored in the OS user config (never the repo).
- * It identifies this machine for locked contexts. It does not decrypt values.
+ * It identifies this machine for read-only contexts. It does not decrypt values.
  */
 export function loadOrCreateIdentity(projectId) {
     const dir = path.join(getConfigDir(), "machines");
@@ -45,4 +45,3 @@ export function signMachineProof(projectId, contextSlug) {
         timestamp,
     };
 }
-//# sourceMappingURL=identity.js.map

package/dist/lib/keychain.d.ts

@@ -5,17 +5,30 @@ type KeyringEntry = {
     deletePassword(): boolean;
 };
 export type KeyringFactory = (service: string, account: string) => KeyringEntry;
+export type KeyringAccounts = (service: string) => string[];
 /** Tests swap in an in-memory keyring. `null` means no keyring available. */
-export declare function setKeyringForTests(factory: KeyringFactory | null | undefined): void;
+export declare function setKeyringForTests(factory: KeyringFactory | null | undefined, accounts?: KeyringAccounts): void;
 /** Off with `GETMYENV_KEYCHAIN=0` or in CI (`CI` set to anything but `false` or `0`). */
 export declare function keychainEnabled(env?: NodeJS.ProcessEnv): boolean;
 /** One keychain entry per server origin and project, so staging and production keys never mix. */
 export declare function keychainAccount(apiUrl: string, projectId: string): string;
-/** The cached key, only if it has not expired and matches the server's wrapped key. */
-export declare function readCachedPek(account: string, wrappedRaw: string, now?: number): Promise<Uint8Array | null>;
+/**
+ * The cached key of one context, only if it has not expired and matches the
+ * sealed key the server holds now. A new sealed key (rotation) misses.
+ */
+export declare function readCachedContextKey(account: string, contextId: number, sealedRaw: string, now?: number): Promise<Uint8Array | null>;
 /** Returns false when no keychain is available; the CLI then keeps asking. */
-export declare function storeCachedPek(account: string, wrappedRaw: string, pek: Uint8Array, now?: number): Promise<boolean>;
+export declare function storeCachedContextKeys(account: string, entries: Array<{
+    contextId: number;
+    sealedRaw: string;
+    key: Uint8Array;
+}>, now?: number): Promise<boolean>;
 /** True when an entry was removed. False when there was none or no keychain is available. */
-export declare function clearCachedPek(account: string): Promise<boolean>;
+export declare function clearCachedKeys(account: string): Promise<boolean>;
+/**
+ * Removes every getmyenv entry on this machine, for all servers and projects.
+ * `fallback` accounts are cleared too, for keychains that cannot list entries.
+ * Returns how many entries were removed.
+ */
+export declare function clearAllCachedKeys(fallback?: string[]): Promise<number>;
 export {};
-//# sourceMappingURL=keychain.d.ts.map

package/dist/lib/keychain.js

@@ -1,16 +1,18 @@
 import { createHash } from "node:crypto";
 /**
- * The unlocked project key, remembered in the OS keychain (macOS Keychain,
+ * Unlocked open context keys, remembered in the OS keychain (macOS Keychain,
  * Windows Credential Manager, Linux Secret Service) for a few hours so `run`
  * on an open context does not ask for the Vault password every time.
- * Never the Vault password itself.
+ * Never the Vault password or the private key.
  */
 const SERVICE = "getmyenv";
 export const KEYCHAIN_TTL_MS = 8 * 60 * 60 * 1000;
 let factoryOverride;
+let accountsOverride;
 /** Tests swap in an in-memory keyring. `null` means no keyring available. */
-export function setKeyringForTests(factory) {
+export function setKeyringForTests(factory, accounts) {
     factoryOverride = factory;
+    accountsOverride = accounts;
 }
 async function loadFactory() {
     if (factoryOverride !== undefined)
@@ -23,6 +25,17 @@ async function loadFactory() {
         return null;
     }
 }
+async function loadAccounts() {
+    if (factoryOverride !== undefined)
+        return accountsOverride ?? null;
+    try {
+        const { findCredentials } = await import("@napi-rs/keyring");
+        return (service) => findCredentials(service).map((c) => c.account);
+    }
+    catch {
+        return null;
+    }
+}
 /** Off with `GETMYENV_KEYCHAIN=0` or in CI (`CI` set to anything but `false` or `0`). */
 export function keychainEnabled(env = process.env) {
     if (env.GETMYENV_KEYCHAIN === "0")
@@ -43,8 +56,8 @@ export function keychainAccount(apiUrl, projectId) {
     }
     return `${origin}|project:${projectId}`;
 }
-function hashWrapped(wrappedRaw) {
-    return createHash("sha256").update(wrappedRaw).digest("hex");
+function hashSealed(sealedRaw) {
+    return createHash("sha256").update(sealedRaw).digest("hex");
 }
 async function entryFor(account) {
     const factory = await loadFactory();
@@ -57,11 +70,7 @@ async function entryFor(account) {
         return null;
     }
 }
-/** The cached key, only if it has not expired and matches the server's wrapped key. */
-export async function readCachedPek(account, wrappedRaw, now = Date.now()) {
-    const entry = await entryFor(account);
-    if (!entry)
-        return null;
+function readStored(entry, now) {
     let raw;
     try {
         raw = entry.getPassword();
@@ -79,24 +88,43 @@ export async function readCachedPek(account, wrappedRaw, now = Date.now()) {
         safeDelete(entry);
         return null;
     }
-    if (typeof stored.pek !== "string" ||
-        stored.wrappedHash !== hashWrapped(wrappedRaw) ||
+    if (stored.version !== 2 ||
         typeof stored.expiresAt !== "number" ||
-        stored.expiresAt <= now) {
+        stored.expiresAt <= now ||
+        !stored.keys ||
+        typeof stored.keys !== "object") {
         safeDelete(entry);
         return null;
     }
-    return new Uint8Array(Buffer.from(stored.pek, "base64"));
+    return stored;
+}
+/**
+ * The cached key of one context, only if it has not expired and matches the
+ * sealed key the server holds now. A new sealed key (rotation) misses.
+ */
+export async function readCachedContextKey(account, contextId, sealedRaw, now = Date.now()) {
+    const entry = await entryFor(account);
+    if (!entry)
+        return null;
+    const stored = readStored(entry, now);
+    const hit = stored?.keys[String(contextId)];
+    if (!hit || typeof hit.key !== "string" || hit.sealedHash !== hashSealed(sealedRaw))
+        return null;
+    const key = new Uint8Array(Buffer.from(hit.key, "base64"));
+    return key.length === 32 ? key : null;
 }
 /** Returns false when no keychain is available; the CLI then keeps asking. */
-export async function storeCachedPek(account, wrappedRaw, pek, now = Date.now()) {
+export async function storeCachedContextKeys(account, entries, now = Date.now()) {
     const entry = await entryFor(account);
     if (!entry)
         return false;
     const stored = {
-        pek: Buffer.from(pek).toString("base64"),
-        wrappedHash: hashWrapped(wrappedRaw),
+        version: 2,
         expiresAt: now + KEYCHAIN_TTL_MS,
+        keys: Object.fromEntries(entries.map((e) => [
+            String(e.contextId),
+            { key: Buffer.from(e.key).toString("base64"), sealedHash: hashSealed(e.sealedRaw) },
+        ])),
     };
     try {
         entry.setPassword(JSON.stringify(stored));
@@ -107,12 +135,35 @@ export async function storeCachedPek(account, wrappedRaw, pek, now = Date.now())
     }
 }
 /** True when an entry was removed. False when there was none or no keychain is available. */
-export async function clearCachedPek(account) {
+export async function clearCachedKeys(account) {
     const entry = await entryFor(account);
     if (!entry)
         return false;
     return safeDelete(entry);
 }
+/**
+ * Removes every getmyenv entry on this machine, for all servers and projects.
+ * `fallback` accounts are cleared too, for keychains that cannot list entries.
+ * Returns how many entries were removed.
+ */
+export async function clearAllCachedKeys(fallback = []) {
+    let accounts = [];
+    const list = await loadAccounts();
+    if (list) {
+        try {
+            accounts = list(SERVICE);
+        }
+        catch {
+            accounts = [];
+        }
+    }
+    let removed = 0;
+    for (const account of new Set([...accounts, ...fallback])) {
+        if (await clearCachedKeys(account))
+            removed++;
+    }
+    return removed;
+}
 function safeDelete(entry) {
     try {
         return entry.deletePassword();
@@ -121,4 +172,3 @@ function safeDelete(entry) {
         return false;
     }
 }
-//# sourceMappingURL=keychain.js.map

package/dist/lib/known-keys.d.ts

@@ -0,0 +1,3 @@
+/** "Did you mean OPENAI_API_KEY?" for names close to a known one. Nothing is renamed. */
+export declare function didYouMean(name: string): string | null;
+export declare function printDidYouMean(names: string[], indent?: string): void;

package/dist/lib/known-keys.js

@@ -0,0 +1,17 @@
+import pc from "picocolors";
+import { nearMissKnownKey } from "@getmyenv/shared";
+/** "Did you mean OPENAI_API_KEY?" for names close to a known one. Nothing is renamed. */
+export function didYouMean(name) {
+    const near = nearMissKnownKey(name);
+    if (!near)
+        return null;
+    const why = near.source === "sdk" ? `${near.provider} SDKs read that name.` : "That is the common name.";
+    return `Did you mean ${near.name}? ${why}`;
+}
+export function printDidYouMean(names, indent = "") {
+    for (const name of names) {
+        const hint = didYouMean(name);
+        if (hint)
+            console.error(pc.yellow(`${indent}${name}: ${hint}`));
+    }
+}

package/dist/lib/run-env.d.ts

@@ -1,6 +1,5 @@
-/**
- * Pure pieces of `getmyenv run`: validate and merge. Names only in any output.
- */
+/** Names from the server go into an environment or a file. Refuse any that are not variable names. */
+export declare function assertVariableNames(names: Iterable<string>): void;
 export type MissingKey = {
     name: string;
     reason: "missing" | "expired";
@@ -47,4 +46,3 @@ export declare function windowsCommandLine(args: string[]): string;
 export declare function signalExitCode(signal: NodeJS.Signals, numbers: Record<string, number>): number;
 /** `--explain` output. Names and origins only, never values. */
 export declare function explainLines(result: MergeResult, contextSlug: string): string[];
-//# sourceMappingURL=run-env.d.ts.map

package/dist/lib/run-env.js

@@ -1,6 +1,15 @@
 /**
  * Pure pieces of `getmyenv run`: validate and merge. Names only in any output.
  */
+import { isValidVariableName } from "@getmyenv/shared";
+/** Names from the server go into an environment or a file. Refuse any that are not variable names. */
+export function assertVariableNames(names) {
+    for (const name of names) {
+        if (!isValidVariableName(name)) {
+            throw new Error("The server sent a name that is not a valid variable name. Nothing was run or written.");
+        }
+    }
+}
 /** The child never sees the CLI's own settings (token, API URL, config dir). */
 export function withoutOwnEnv(parent) {
     const env = {};
@@ -111,4 +120,3 @@ export function explainLines(result, contextSlug) {
     lines.push(`  ${result.applied.length} from getmyenv, ${result.overridden.length} replaced, ${result.kept.length} kept, ${result.filledByParent.length} from parent env, ${result.unresolved.length} not set`);
     return lines;
 }
-//# sourceMappingURL=run-env.js.map

package/dist/lib/update-check.d.ts

@@ -11,4 +11,3 @@ export declare function updateLine(current: string, latest: string | null): stri
  * cached npm version, refreshed in the background once a day. Skipped in CI.
  */
 export declare function maybeSuggestUpdate(): Promise<void>;
-//# sourceMappingURL=update-check.d.ts.map

package/dist/lib/update-check.js

@@ -90,7 +90,10 @@ async function fetchAndCache(file, timeoutMs) {
     const ctrl = new AbortController();
     setTimeout(() => ctrl.abort(), timeoutMs).unref();
     try {
-        const res = await fetch("https://registry.npmjs.org/getmyenv/latest", { signal: ctrl.signal });
+        const res = await fetch("https://registry.npmjs.org/getmyenv/latest", {
+            signal: ctrl.signal,
+            redirect: "error",
+        });
         if (!res.ok)
             return;
         const data = (await res.json());
@@ -132,4 +135,3 @@ export async function maybeSuggestUpdate() {
     if (line)
         console.error(pc.yellow(line));
 }
-//# sourceMappingURL=update-check.js.map

package/dist/lib/upload.d.ts

@@ -12,10 +12,8 @@ export declare function uploadValues(input: {
     pairs: Record<string, string>;
     prune?: boolean;
     expiresAt?: string | null;
-    vaultPasswordStdin?: boolean;
 }): Promise<{
     set: string[];
     pruned: string[];
     declared: string[];
 }>;
-//# sourceMappingURL=upload.d.ts.map

package/dist/lib/upload.js

@@ -1,5 +1,5 @@
 import { encryptSecret, serializePayload } from "@getmyenv/crypto";
-import { unlockProjectKey } from "./unlock.js";
+import { contextKey } from "./vault.js";
 /** Fail fast before prompting or encrypting. Mirrors the server's `checkWrite`, which still enforces it. */
 export function assertWritable(linked, ctx) {
     if (linked.who.token.kind === "server") {
@@ -21,33 +21,24 @@ export async function uploadValues(input) {
         .filter(([, v]) => v === "")
         .map(([k]) => k);
     let values = [];
-    let wrappedProjectKey;
     if (filled.length > 0) {
-        const { wrappedProjectKey: serverWrapped } = await linked.client.request("GET", "/api/cli/vault");
-        const { pek, wrappedRaw, created } = await unlockProjectKey({
-            isGuest: linked.who.isGuest,
-            projectId: linked.who.project.id,
-            wrapped: serverWrapped,
-            cache: true,
-            allowCreate: true,
-            vaultPasswordStdin: input.vaultPasswordStdin,
-            apiUrl: linked.apiUrl,
-        });
-        if (serverWrapped == null || created) {
-            wrappedProjectKey = JSON.parse(wrappedRaw);
-        }
+        const key = await contextKey(linked, context, { create: true });
         values = filled.map(([name, value]) => ({
             name,
-            ciphertext: serializePayload(encryptSecret(pek, value)),
+            ciphertext: serializePayload(encryptSecret(key, name, value)),
             ...(input.expiresAt !== undefined ? { expiresAt: input.expiresAt } : {}),
         }));
     }
-    return linked.client.request("POST", "/api/cli/values", {
+    const body = {
         context: context.slug,
-        ...(wrappedProjectKey ? { wrappedProjectKey } : {}),
         values,
         ...(input.prune ? { prune: true } : {}),
         ...(declare.length > 0 ? { declare } : {}),
-    });
+    };
+    if (Buffer.byteLength(JSON.stringify(body)) > UPLOAD_MAX_BYTES) {
+        throw new Error("Too much to upload at once (max 1 MB encrypted). Split the file and import each part.");
+    }
+    return linked.client.request("POST", "/api/cli/values", body);
 }
-//# sourceMappingURL=upload.js.map
+/** Matches the server limit on `/api/cli/values`. */
+const UPLOAD_MAX_BYTES = 1024 * 1024;

package/dist/lib/vault.d.ts

@@ -0,0 +1,54 @@
+import { type SealedKey, type WrappedPrivateKey } from "@getmyenv/crypto";
+import { type Protection } from "./api.js";
+import type { Linked } from "./bootstrap.js";
+/**
+ * Context keys for the CLI.
+ *
+ * Folder and guest tokens: the account (or guest) private key is wrapped with
+ * the Vault password (or the guest passphrase in claim.json). It is unwrapped
+ * here, opens the sealed context keys, and is wiped. Open context keys may
+ * stay in the OS keychain for 8 hours. The private key is never stored.
+ *
+ * Server tokens: GETMYENV_TOKEN holds the token's own private key. It opens
+ * the one context key sealed to that token. No Vault password.
+ */
+export type VaultContext = {
+    id: number;
+    slug: string;
+    protection: Protection;
+    hasKey: boolean;
+    sealedKey: SealedKey | null;
+};
+export type VaultInfo = {
+    holder: "user" | "guest" | "token";
+    publicKey: string | null;
+    wrappedPrivateKey: WrappedPrivateKey | null;
+    contexts: VaultContext[];
+    claim: {
+        publicKey: string;
+        wrappedPrivateKey: WrappedPrivateKey;
+        shares: Array<{
+            contextId: number;
+            sealedKey: SealedKey;
+        }>;
+    } | null;
+};
+export type KeyTarget = {
+    id: number;
+    slug: string;
+    protection: Protection;
+    /** Sealed key already sent by the server, so no extra request is needed. */
+    sealedKey?: SealedKey | null;
+};
+export type KeyOpts = {
+    /** Make the Vault password and the context key when they do not exist yet. */
+    create?: boolean;
+};
+export declare function fetchVault(linked: Linked): Promise<VaultInfo>;
+/** The context key, unlocking with the Vault password when needed. */
+export declare function contextKey(linked: Linked, target: KeyTarget, opts?: KeyOpts): Promise<Uint8Array>;
+/** Unlock with the Vault password and return the private key. Caller wipes it. */
+export declare function unlockPrivateKey(linked: Linked, opts?: KeyOpts): Promise<{
+    vault: VaultInfo;
+    privateKey: Uint8Array;
+}>;

package/dist/lib/vault.js

@@ -0,0 +1,174 @@
+import pc from "picocolors";
+import { createUserKeys, generateContextKey, openSealedKey, sealContextKey, splitServerToken, unwrapPrivateKey, wipe, } from "@getmyenv/crypto";
+import { ApiError } from "./api.js";
+import { resolveVaultPassword } from "./guest-key.js";
+import { KEYCHAIN_TTL_MS, keychainAccount, keychainEnabled, readCachedContextKey, storeCachedContextKeys, } from "./keychain.js";
+/** One unlock per process: several contexts in one command prompt once. */
+const memo = new Map();
+export function fetchVault(linked) {
+    return linked.client.request("GET", "/api/cli/vault");
+}
+/** The context key, unlocking with the Vault password when needed. */
+export async function contextKey(linked, target, opts = {}) {
+    const cached = memo.get(target.id);
+    if (cached)
+        return cached;
+    if (linked.who.token.kind === "server")
+        return serverContextKey(linked, target);
+    const account = keychainFor(linked);
+    if (account && target.protection === "open" && target.sealedKey) {
+        const key = await readCachedContextKey(account, target.id, JSON.stringify(target.sealedKey));
+        if (key) {
+            memo.set(target.id, key);
+            return key;
+        }
+    }
+    let vault = await fetchVault(linked);
+    const privateKey = await holderPrivateKey(linked, vault, opts);
+    try {
+        let ctx = vault.contexts.find((c) => c.id === target.id);
+        if (!ctx)
+            throw new Error(`This token cannot read ${target.slug}.`);
+        const member = linked.who.token.member === true;
+        if (!ctx.hasKey) {
+            if (member)
+                throw new Error(`${target.slug} has no values yet. The project owner sets the first one.`);
+            if (!opts.create || ctx.protection !== "open") {
+                throw new Error(`${target.slug} has no values yet.`);
+            }
+            vault = await initContextKey(linked, vault, ctx);
+            ctx = vault.contexts.find((c) => c.id === target.id);
+        }
+        const opened = openAll(vault, privateKey);
+        const key = opened.get(target.id);
+        if (!key) {
+            throw new Error(member
+                ? `The owner has not sent you the key for ${target.slug} yet. Ask them to open Members in the dashboard.`
+                : `No key for ${target.slug} on this account. Open the project in the dashboard once.`);
+        }
+        for (const [id, k] of opened)
+            memo.set(id, k);
+        if (account)
+            await remember(account, vault, opened);
+        return key;
+    }
+    finally {
+        wipe(privateKey);
+    }
+}
+async function serverContextKey(linked, target) {
+    const { privateKey } = splitServerToken(process.env.GETMYENV_TOKEN?.trim() ?? "");
+    if (!privateKey) {
+        throw new Error("This server token has no key. Create a new server token on the CLI page.");
+    }
+    try {
+        let sealed = target.sealedKey;
+        if (sealed === undefined) {
+            sealed = (await fetchVault(linked)).contexts.find((c) => c.id === target.id)?.sealedKey ?? null;
+        }
+        if (!sealed) {
+            throw new Error(`This server token has no key for ${target.slug}. Create a new server token on the CLI page.`);
+        }
+        const key = openSealedKey(sealed, privateKey, target.id);
+        memo.set(target.id, key);
+        return key;
+    }
+    finally {
+        wipe(privateKey);
+    }
+}
+/** Open contexts on a signed-in account, with a password typed at a terminal. */
+function keychainFor(linked) {
+    if (linked.who.isGuest || !keychainEnabled())
+        return null;
+    return keychainAccount(linked.apiUrl, linked.who.project.id);
+}
+async function remember(account, vault, opened) {
+    if (process.stdin.isTTY !== true)
+        return;
+    const entries = vault.contexts
+        .filter((c) => c.protection === "open" && c.sealedKey && opened.has(c.id))
+        .map((c) => ({ contextId: c.id, sealedRaw: JSON.stringify(c.sealedKey), key: opened.get(c.id) }));
+    if (entries.length === 0)
+        return;
+    if (await storeCachedContextKeys(account, entries)) {
+        console.error(pc.dim(`Unlocked on this machine for ${KEYCHAIN_TTL_MS / 3_600_000} hours (OS keychain). Forget it with: npx getmyenv lock\n`));
+    }
+}
+function openAll(vault, privateKey) {
+    const out = new Map();
+    for (const c of vault.contexts) {
+        if (c.sealedKey)
+            out.set(c.id, openSealedKey(c.sealedKey, privateKey, c.id));
+    }
+    return out;
+}
+/** First key of an open context. Another client may win the race: then use theirs. */
+async function initContextKey(linked, vault, ctx) {
+    const key = generateContextKey();
+    try {
+        await linked.client.request("POST", "/api/cli/vault", {
+            shares: [{ contextId: ctx.id, sealedKey: sealContextKey(key, vault.publicKey, ctx.id) }],
+        });
+    }
+    catch (err) {
+        if (!(err instanceof ApiError && err.status === 409))
+            throw err;
+    }
+    finally {
+        wipe(key);
+    }
+    return fetchVault(linked);
+}
+/**
+ * The holder's private key. Creates the keys on first use when allowed:
+ * a new Vault password for an account, the claim.json passphrase for a guest.
+ */
+async function holderPrivateKey(linked, vault, opts) {
+    const isGuest = vault.holder === "guest";
+    if (!vault.publicKey || !vault.wrappedPrivateKey) {
+        if (!opts.create) {
+            throw new Error("No Vault password yet. Set a value first: npx getmyenv set KEY");
+        }
+        if (!isGuest) {
+            console.error(pc.dim("Choose a Vault password. It stays on this machine. We store an encrypted key blob only.\n"));
+        }
+        const password = await resolveVaultPassword({ isGuest, create: true });
+        const created = await createUserKeys(password);
+        try {
+            await linked.client.request("POST", "/api/cli/vault", {
+                keys: { publicKey: created.publicKey, wrappedPrivateKey: created.wrapped },
+            });
+        }
+        catch (err) {
+            wipe(created.privateKey);
+            throw err;
+        }
+        vault.publicKey = created.publicKey;
+        vault.wrappedPrivateKey = created.wrapped;
+        return created.privateKey;
+    }
+    const interactive = process.stdin.isTTY && !isGuest;
+    const maxAttempts = interactive ? 3 : 1;
+    for (let attempt = 1;; attempt++) {
+        const password = await resolveVaultPassword({ isGuest });
+        try {
+            return await unwrapPrivateKey(password, vault.wrappedPrivateKey);
+        }
+        catch {
+            if (isGuest) {
+                throw new Error("Could not unlock with the claim.json passphrase. Check .getmyenv/claim.json against the passphrase shown at creation.");
+            }
+            if (attempt < maxAttempts) {
+                console.error(pc.red("Wrong Vault password. Try again.\n"));
+                continue;
+            }
+            throw new Error("Could not unlock. Check your Vault password.");
+        }
+    }
+}
+/** Unlock with the Vault password and return the private key. Caller wipes it. */
+export async function unlockPrivateKey(linked, opts = {}) {
+    const vault = await fetchVault(linked);
+    return { vault, privateKey: await holderPrivateKey(linked, vault, opts) };
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "getmyenv",
-  "version": "0.7.0",
-  "description": "CLI for getmyenv - encrypted environment variables for any language",
+  "version": "0.8.0",
+  "description": "CLI for getmyenv, an encrypted store for environment variables and secrets. We store ciphertext only.",
   "type": "module",
   "bin": {
     "getmyenv": "./dist/bin.js"
@@ -33,12 +33,11 @@
     "access": "public"
   },
   "dependencies": {
-    "@getmyenv/crypto": "0.3.0",
-    "@getmyenv/shared": "0.4.0",
+    "@getmyenv/crypto": "0.4.0",
+    "@getmyenv/shared": "0.5.0",
     "@napi-rs/keyring": "^2.1.0",
     "commander": "^13.1.0",
     "dotenv": "^16.4.7",
-    "ora": "^8.2.0",
     "picocolors": "^1.1.1"
   },
   "devDependencies": {

package/dist/bin.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"bin.d.ts","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":""}

package/dist/bin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,KAAK,UAAU,IAAI;IACjB,MAAM,kBAAkB,EAAE,CAAC;IAC3B,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACxE,uDAAuD;IACvD,OAAO,CAAC,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC"}

package/dist/cli.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AA+BA;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAAE,EAClB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,OAAO,GACf;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CASzC;AAED,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA8L1D"}

package/dist/cli.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,cAAc,GAAG;IACrB,sBAAsB;IACtB,kEAAkE;CAC1D,CAAC;AACX,MAAM,UAAU,GAAG,CAAC,iBAAiB,EAAE,cAAc,CAAU,CAAC;AAChE,MAAM,YAAY,GAAG;IACnB,wBAAwB;IACxB,sDAAsD;CAC9C,CAAC;AAEX;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,QAAkB,EAClB,IAAc,EACd,OAAgB;IAEhB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAClF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc;IACzC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO;SACJ,IAAI,CAAC,UAAU,CAAC;SAChB,WAAW,CAAC,gEAAgE,CAAC;SAC7E,OAAO,CAAC,WAAW,CAAC;SACpB,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,WAAW,CACV,OAAO,EACP;QACE,EAAE;QACF,cAAc;QACd,sFAAsF;QACtF,qEAAqE;QACrE,uFAAuF;QACvF,8DAA8D;QAC9D,yEAAyE;QACzE,0EAA0E;KAC3E,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;SACA,WAAW,CAAC,IAAI,CAAC;SACjB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAExC,oFAAoF;IACpF,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,MAA4B,CAAC;QAC3D,IAAI,MAAM,IAAI,aAAa,KAAK,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;YACxE,aAAa,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,6DAA6D,CAAC;SAC1E,KAAK,CAAC,qCAAqC,CAAC;SAC5C,WAAW,CACV,OAAO,EACP;QACE,EAAE;QACF,WAAW;QACX,mCAAmC;QACnC,8CAA8C;QAC9C,sGAAsG;KACvG,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;SACA,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAAC;SAClD,MAAM,CAAC,GAAG,cAAc,CAAC;SACzB,MAAM,CAAC,WAAW,EAAE,gEAAgE,CAAC;SACrF,MAAM,CAAC,iBAAiB,EAAE,sDAAsD,CAAC;SACjF,MAAM,CAAC,iBAAiB,EAAE,4DAA4D,CAAC;SACvF,MAAM,CAAC,GAAG,YAAY,CAAC;SACvB,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,kBAAkB,CAAC,IAAI,CAAC;SACxB,oBAAoB,CAAC,IAAI,CAAC;SAC1B,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,IAAI,EAAE,GAAY,EAAE,EAAE;QAC7D,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,CAAC,OAAO,WAAW,IAAI,CAAC,OAAO,aAAa,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,mDAAmD,CAAC;SAChE,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAEzC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,+BAA+B,CAAC,CAAC;IACxF,OAAO;SACJ,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;SACpC,WAAW,CAAC,+CAA+C,CAAC;SAC5D,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,OAAO;SACJ,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,6DAA6D,CAAC;SAC1E,MAAM,CAAC,eAAe,EAAE,kCAAkC,CAAC;SAC3D,MAAM,CAAC,OAAO,EAAE,+BAA+B,CAAC;SAChD,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAY,EAAE,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACpE,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,2DAA2D,CAAC;SACxE,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAY,EAAE,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAEjE,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,sDAAsD,CAAC;SACnE,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;SAC1C,MAAM,CAAC,GAAG,cAAc,CAAC;SACzB,MAAM,CAAC,kBAAkB,EAAE,wCAAwC,CAAC;SACpE,MAAM,CAAC,SAAS,EAAE,6DAA6D,CAAC;SAChF,MAAM,CAAC,GAAG,YAAY,CAAC;SACvB,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,KAAe,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAE9D,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,8BAA8B,CAAC;SAC3C,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;SACxC,MAAM,CAAC,GAAG,cAAc,CAAC;SACzB,MAAM,CAAC,OAAO,EAAE,wCAAwC,CAAC;SACzD,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,KAAe,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAEhE,OAAO;SACJ,OAAO,CAAC,IAAI,CAAC;SACb,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,GAAG,cAAc,CAAC;SACzB,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAErC,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,sEAAsE,CAAC;SACnF,QAAQ,CAAC,QAAQ,EAAE,+CAA+C,CAAC;SACnE,MAAM,CAAC,GAAG,cAAc,CAAC;SACzB,MAAM,CAAC,SAAS,EAAE,sDAAsD,CAAC;SACzE,MAAM,CAAC,WAAW,EAAE,0CAA0C,CAAC;SAC/D,MAAM,CAAC,OAAO,EAAE,6BAA6B,CAAC;SAC9C,MAAM,CAAC,GAAG,YAAY,CAAC;SACvB,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAwB,EAAE,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAEzE,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,mEAAmE,CAAC;SAChF,MAAM,CAAC,GAAG,cAAc,CAAC;SACzB,MAAM,CAAC,qBAAqB,EAAE,aAAa,EAAE,MAAM,CAAC;SACpD,MAAM,CAAC,UAAU,EAAE,mCAAmC,CAAC;SACvD,MAAM,CAAC,OAAO,EAAE,wCAAwC,CAAC;SACzD,MAAM,CAAC,GAAG,YAAY,CAAC;SACvB,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAEzC,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,sFAAsF,CAAC;SACnG,MAAM,CAAC,eAAe,EAAE,qCAAqC,CAAC;SAC9D,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAExC,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,iDAAiD,CAAC;SAC9D,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAExC,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4CAA4C,CAAC;SACzD,MAAM,CAAC,qBAAqB,EAAE,2CAA2C,CAAC;SAC1E,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAEzC,OAAO;SACJ,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,wDAAwD,CAAC;SACrE,MAAM,CAAC,WAAW,EAAE,kDAAkD,CAAC;SACvE,MAAM,CAAC,OAAO,EAAE,6BAA6B,CAAC;SAC9C,MAAM,CAAC,GAAG,YAAY,CAAC;SACvB,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAY,EAAE,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAE9D,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+DAA+D,CAAC;SAC5E,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvC,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,6DAA6D,CAAC;SAC1E,MAAM,CAAC,OAAO,EAAE,6BAA6B,CAAC;SAC9C,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAEzC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IACE,KAAK;QACL,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACtB,KAAK,KAAK,MAAM;QAChB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAChF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,6BAA6B,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC"}

package/dist/commands/backup.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/commands/backup.ts"],"names":[],"mappings":"AAaA,KAAK,UAAU,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD,mFAAmF;AACnF,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAgCnE"}