getmyenv 0.7.0 → 0.9.0

package/README.md

@@ -1,9 +1,9 @@
 # getmyenv
 
-CLI for [getmyenv](https://getmyenv.com) - encrypted environment variables for any language.
-
 Keep using environment variables. Stop managing them as files.
 
+[getmyenv](https://getmyenv.com) is an encrypted store for environment variables and secrets. Use it from the dashboard or with `npx getmyenv`. We store ciphertext only.
+
 ```bash
 cd your-project
 npx getmyenv                          # Start without an account, or Sign in
@@ -22,35 +22,37 @@ npx getmyenv run staging -- npm start # or pick one
 - `import [file] [--prune] [--dry-run] [--yes]`: `.env.<slug>` goes to that context.
 - `export [-o file | --stdout] [--yes]`: for tools that need a file. The file is added to `.gitignore` and gets owner-only permissions on macOS and Linux.
 - `guest [--name <name>]`: a project without an account. It works for 30 days. Claim it within 60.
-- `claim`: claim a guest project from `.getmyenv/claim.json`.
-- `backup [-o file]`: encrypted backup of open contexts (default `<project>.getmyenv`).
-- `restore <file> [--dry-run] [--yes]`
-- `lock`, `unlink [--yes]`, `help [command]`
-
-`run`, `set`, `unset`, `ls`, `import` and `export` take `-c, --context <slug>`. The default is the server token's context, then `context` in `.getmyenv/project.json`, then `development`.
+- `claim`: claim a guest project. Reads `.getmyenv/claim.json`, or asks for the claim code and guest passphrase that `guest` printed once.
+- `backup [-o file]`: encrypted backup of open contexts (default `<project>.getmyenv-backup`). It opens with the Vault password in effect when it was made.
+- `restore <file> [--dry-run] [--yes]`: restore a backup into this folder's project. Values go into open contexts with the same slug and replace values with the same name. Read-only and missing contexts are skipped.
+- `start`: same as bare `getmyenv`. `start --template <id or link>` adds a template's variable names and asks for each value.
+- `lock`: forget every unlocked context key on this machine. `unlink [--yes]`, `help [command]`
 
-`run`, `set`, `import`, `export` and `restore` take `--vault-password-stdin`. Every command takes `--api-url <url>`.
+`run`, `set`, `unset`, `ls`, `import` and `export` take `-c, --context <slug>`. The default is the server token's context, then `context` in `.getmyenv/project.json`, then `development`. Every command takes `--api-url <url>`.
 
 Prompts and status lines go to stderr, so `export --stdout > .env` stays clean.
 
+Commit `.getmyenv/project.json`. `token.json` and `claim.json` stay local and are gitignored.
+
 ## Vault password
 
-For open contexts, after you enter the Vault password in a terminal, the unlocked project key stays in your OS keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service) for 8 hours. The password itself is never stored.
+Each context has its own key, sealed to your account. Your Vault password opens your account key. For open contexts, after you enter the Vault password in a terminal, the unlocked context keys stay in your OS keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service) for 8 hours. The password is never stored.
 
-- `npx getmyenv lock` removes it. `unlink` removes it too.
-- Read-only contexts, CI and `--vault-password-stdin` ask on each run.
+- `npx getmyenv lock` removes every entry. `unlink` removes this project's.
+- Server tokens hold their context key and never ask.
 - Guest projects unlock with the passphrase in `.getmyenv/claim.json` and never ask.
 - `GETMYENV_KEYCHAIN=0` always asks.
 
 ## CI and servers
 
+Create a server token for one context on the dashboard CLI page. It holds that context's key.
+
 ```bash
-printf %s "$VAULT_PASSWORD" | npx getmyenv run --vault-password-stdin -- node server.js
-printf %s "$VALUE" | npx getmyenv set API_KEY --stdin
-printf '%s\n%s' "$VAULT_PASSWORD" "$VALUE" | npx getmyenv set API_KEY --stdin --vault-password-stdin
+export GETMYENV_TOKEN=...   # server token from the dashboard
+npx getmyenv run -- node server.js
 ```
 
-Server tokens are read-only, so `set` needs the folder token from browser sign-in (or a guest project). With both `--stdin` and `--vault-password-stdin`, send the password on the first line and the value after it.
+Server tokens are read-only. `set` needs the folder token from browser sign-in, or a guest project. `printf %s "$VALUE" | npx getmyenv set API_KEY --stdin` keeps the value out of argv.
 
 - `GETMYENV_TOKEN`: a token from the dashboard CLI page.
 - `GETMYENV_CONFIG_DIR`: machine key and cache (default `~/.config/getmyenv`). Use a persistent volume in containers.
@@ -63,7 +65,7 @@ Server tokens are read-only, so `set` needs the folder token from browser sign-i
 ## Open and Read-only
 
 - Open contexts: the CLI can read and write. Browser sign-in gives the folder a token in `.getmyenv/token.json`.
-- Read-only contexts: the CLI can only read. Set values in the dashboard. Use a server token from the CLI page (one context, IP allowlist) with `GETMYENV_TOKEN`. Each server token has a new machines rule: ask you on Requests (default), trust machines from its allowed IPs on first read (each entry /24 or narrower, IPv6 /64), or block them. Trusted machines read without asking. `status` shows the rule.
+- Read-only contexts: the CLI can read and export, never write. Set values in the dashboard. Use a server token from Project settings, Tokens (one context, IP allowlist) with `GETMYENV_TOKEN`. Each server token has a new machines rule: ask you on Requests (default), trust machines from its allowed IPs on first read (each entry /24 or narrower, IPv6 /64), or block them. Trusted machines read without asking. `status` shows the rule.
 
 ## Chaining
 

package/dist/bin.d.ts

@@ -1,3 +1,2 @@
 #!/usr/bin/env node
 export {};
-//# sourceMappingURL=bin.d.ts.map

package/dist/bin.js

@@ -9,6 +9,6 @@ main().catch((err) => {
     const message = err instanceof Error ? err.message : "Unexpected error";
     // Never print secret values - sanitize to message only
     console.error(`getmyenv: ${message}`);
-    process.exit(process.exitCode ? Number(process.exitCode) : 1);
+    // Not process.exit(): on Windows it can abort while sockets are still closing.
+    process.exitCode = process.exitCode ? Number(process.exitCode) : 1;
 });
-//# sourceMappingURL=bin.js.map

package/dist/cli.d.ts

@@ -9,4 +9,3 @@ export declare function splitRunArgs(operands: string[], argv: string[], explain
     command: string[];
 };
 export declare function runCli(argv: string[]): Promise<void>;
-//# sourceMappingURL=cli.d.ts.map

package/dist/cli.js

@@ -16,13 +16,9 @@ import { unlinkCommand } from "./commands/unlink.js";
 import { CLI_VERSION } from "./lib/api.js";
 const CONTEXT_OPTION = [
     "-c, --context <slug>",
-    "Context to use (default: project.json context, then development)",
+    "Context to use (default: the server token's context, then project.json, then development)",
 ];
 const API_OPTION = ["--api-url <url>", "API base URL"];
-const STDIN_OPTION = [
-    "--vault-password-stdin",
-    "Read the Vault password from stdin (non-interactive)",
-];
 /**
  * Split `run` operands around `--`.
  * `run staging -- npm start`: context staging, command npm start.
@@ -50,7 +46,7 @@ export async function runCli(argv) {
         .addHelpText("after", [
         "",
         "Environment:",
-        "  GETMYENV_TOKEN          Token for CI and servers (instead of .getmyenv/token.json)",
+        "  GETMYENV_TOKEN          Token for CI and servers (instead of .getmyenv/token.json). A server token holds its context key.",
         "  GETMYENV_API_URL        API base URL (https, or http://localhost)",
         "  GETMYENV_CONFIG_DIR     Machine identity and cache dir (default ~/.config/getmyenv)",
         "  GETMYENV_SKIP_UPDATE    Set to 1 to skip the update notice",
@@ -66,6 +62,12 @@ export async function runCli(argv) {
             actionCommand.setOptionValue("apiUrl", apiUrl);
         }
     });
+    program
+        .command("start")
+        .description("Set up this folder (same as bare npx getmyenv). Status when already linked.")
+        .option("--template <id>", "Add a template's variables and ask for their values (id or link)")
+        .option(...API_OPTION)
+        .action((opts) => startCommand(opts));
     program
         .command("run")
         .description("Run a command with a context's variables in its environment")
@@ -75,14 +77,13 @@ export async function runCli(argv) {
         "Examples:",
         "  npx getmyenv run -- npm run dev",
         "  npx getmyenv run staging -- node server.js",
-        '  printf %s "$VAULT_PASSWORD" | npx getmyenv run production --vault-password-stdin -- node server.js',
+        "  GETMYENV_TOKEN=<server token> npx getmyenv run production -- node server.js",
     ].join("\n"))
         .argument("[context]", "Context slug (same as -c)")
         .option(...CONTEXT_OPTION)
         .option("--explain", "List each variable and where its value comes from (names only)")
         .option("--keep-existing", "Keep variables already set in the parent environment")
         .option("--allow-missing", "Run even when some variables have no value in this context")
-        .option(...STDIN_OPTION)
         .option(...API_OPTION)
         .allowUnknownOption(true)
         .allowExcessArguments(true)
@@ -123,7 +124,6 @@ export async function runCli(argv) {
         .option(...CONTEXT_OPTION)
         .option("--expires <date>", "Expiry date, e.g. 2026-12-31, or never")
         .option("--stdin", "Read the value of one KEY from stdin (keeps it out of argv)")
-        .option(...STDIN_OPTION)
         .option(...API_OPTION)
         .action((pairs, opts) => setCommand(pairs, opts));
     program
@@ -148,7 +148,6 @@ export async function runCli(argv) {
         .option("--prune", "Unset values in the context that are not in the file")
         .option("--dry-run", "Show what would change without uploading")
         .option("--yes", "Do not ask for confirmation")
-        .option(...STDIN_OPTION)
         .option(...API_OPTION)
         .action((file, opts) => importCommand(file, opts));
     program
@@ -158,7 +157,6 @@ export async function runCli(argv) {
         .option("-o, --output <file>", "Output file", ".env")
         .option("--stdout", "Write to stdout instead of a file")
         .option("--yes", "Change an existing file without asking")
-        .option(...STDIN_OPTION)
         .option(...API_OPTION)
         .action((opts) => exportCommand(opts));
     program
@@ -169,26 +167,25 @@ export async function runCli(argv) {
         .action((opts) => guestCommand(opts));
     program
         .command("claim")
-        .description("Claim a guest project from .getmyenv/claim.json")
+        .description("Claim a guest project (reads .getmyenv/claim.json, or asks for the claim code)")
         .option(...API_OPTION)
         .action((opts) => claimCommand(opts));
     program
         .command("backup")
         .description("Write an encrypted backup of open contexts")
-        .option("-o, --output <file>", "Output file (default: <project>.getmyenv)")
+        .option("-o, --output <file>", "Output file (default: <project>.getmyenv-backup)")
         .option(...API_OPTION)
         .action((opts) => backupCommand(opts));
     program
         .command("restore <file>")
-        .description("Restore an encrypted backup into this folder's project")
+        .description("Restore a backup into this folder's project (open contexts with the same slug)")
         .option("--dry-run", "Check the backup and show what would be restored")
         .option("--yes", "Do not ask for confirmation")
-        .option(...STDIN_OPTION)
         .option(...API_OPTION)
         .action((file, opts) => restoreCommand(file, opts));
     program
         .command("lock")
-        .description("Forget the unlocked project key on this machine (OS keychain)")
+        .description("Forget every unlocked context key on this machine (OS keychain)")
         .option(...API_OPTION)
         .action((opts) => lockCommand(opts));
     program
@@ -206,4 +203,3 @@ export async function runCli(argv) {
     }
     await program.parseAsync(argv);
 }
-//# sourceMappingURL=cli.js.map

package/dist/commands/backup.d.ts

@@ -2,7 +2,6 @@ type BackupOpts = {
     output?: string;
     apiUrl?: string;
 };
-/** Encrypted backup of open contexts. Readable offline with the Vault password. */
+/** Encrypted backup of open contexts. Opens offline with the current Vault password. */
 export declare function backupCommand(opts: BackupOpts): Promise<void>;
 export {};
-//# sourceMappingURL=backup.d.ts.map

package/dist/commands/backup.js

@@ -1,16 +1,20 @@
-import fs from "node:fs";
 import path from "node:path";
 import pc from "picocolors";
 import { createBackupEnvelope, parsePayload, parseWrappedKey, serializeBackup, } from "@getmyenv/crypto";
 import { slugify } from "@getmyenv/shared";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
-/** Encrypted backup of open contexts. Readable offline with the Vault password. */
+import { writePrivateFile } from "../lib/fs.js";
+/** Encrypted backup of open contexts. Opens offline with the current Vault password. */
 export async function backupCommand(opts) {
     const { client } = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
     const data = await client.request("GET", "/api/cli/backup");
+    if (!data.publicKey || !data.wrappedPrivateKey) {
+        throw new Error("No Vault password yet, so there is nothing to back up. Set a value first: npx getmyenv set KEY");
+    }
     const envelope = createBackupEnvelope({
         projectName: data.projectName,
-        wrappedProjectKey: parseWrappedKey(JSON.stringify(data.wrappedProjectKey)),
+        publicKey: data.publicKey,
+        wrappedPrivateKey: parseWrappedKey(JSON.stringify(data.wrappedPrivateKey)),
         contexts: data.contexts,
         keys: data.keys,
         tags: data.tags,
@@ -21,9 +25,9 @@ export async function backupCommand(opts) {
             payload: parsePayload(v.ciphertext),
         })),
     });
-    const out = opts.output ?? path.join(process.cwd(), `${slugify(data.projectName) || "project"}.getmyenv`);
-    fs.writeFileSync(out, serializeBackup(envelope), { mode: 0o600 });
+    const out = opts.output ??
+        path.join(process.cwd(), `${slugify(data.projectName) || "project"}.getmyenv-backup`);
+    writePrivateFile(out, serializeBackup(envelope), { overwrite: false });
     console.log(`${pc.green("✓")} Encrypted backup: ${out} (${data.values.length} values, ${data.contexts.length} open contexts)`);
-    console.log(pc.dim("Read-only contexts are backed up from the dashboard."));
+    console.log(pc.dim("It opens with your current Vault password. Read-only contexts are backed up from the dashboard."));
 }
-//# sourceMappingURL=backup.js.map

package/dist/commands/claim.d.ts

@@ -3,7 +3,6 @@ export type ClaimOpts = {
 };
 /**
  * Claim a guest project: sign in and take ownership in the browser, then
- * rewrap the project key with a Vault password.
+ * hand the context keys to the owner's account.
  */
 export declare function claimCommand(opts?: ClaimOpts): Promise<void>;
-//# sourceMappingURL=claim.d.ts.map

package/dist/commands/claim.js

@@ -1,35 +1,69 @@
 import pc from "picocolors";
-import { parseWrappedKey, rewrapProjectKey, serializeWrappedKey, } from "@getmyenv/crypto";
-import { clearClaimFile, ensureGitignoreHasEnv, promptHidden, readClaimFile, readProjectMeta, writeProjectMeta, } from "../lib/fs.js";
+import { createUserKeys, openSealedKey, sealContextKey, unwrapPrivateKey, wipe, } from "@getmyenv/crypto";
+import { clearClaimFile, ensureGitignoreHasEnv, promptHidden, readClaimFile, readLine, readProjectMeta, writeClaimFile, writeProjectMeta, } from "../lib/fs.js";
 import { readFolderToken, writeFolderToken } from "../lib/credentials.js";
-import { writeCachedKey } from "../lib/pek.js";
 import { ApiClient, ApiError, resolveApiUrl } from "../lib/api.js";
 import { authorizeFolder, openBrowser, sleep } from "../lib/authorize.js";
+import { promptNewVaultPassword } from "../lib/guest-key.js";
 async function askNewVaultPassword() {
-    console.error(pc.dim("Choose a Vault password. It stays on this machine. We store an encrypted key only.\n"));
-    const password = await promptHidden("New Vault password (hidden): ");
-    if (!password)
-        throw new Error("Vault password required to claim.");
-    const confirm = await promptHidden("Confirm Vault password (hidden): ");
-    if (password !== confirm)
-        throw new Error("Passwords did not match. Run claim again.");
-    return password;
+    console.error(pc.dim("Choose a Vault password. It stays on this machine. We store an encrypted key blob only.\n"));
+    try {
+        return await promptNewVaultPassword();
+    }
+    catch (err) {
+        throw new Error(`${err instanceof Error ? err.message : "Vault password required."} Run claim again.`);
+    }
 }
-/** Swap the guest-passphrase wrap for a Vault password wrap. Ciphertext stays the same. */
-async function finishRewrap(owned, claim, password) {
-    const { wrappedProjectKey } = await owned.request("GET", "/api/cli/vault");
-    if (wrappedProjectKey != null) {
-        const rewrapped = serializeWrappedKey(await rewrapProjectKey(claim.passphrase, password, parseWrappedKey(JSON.stringify(wrappedProjectKey))));
-        await owned.request("POST", "/api/cli/vault", {
-            wrappedProjectKey: JSON.parse(rewrapped),
+/**
+ * Hand the context keys to the owner. The guest key opens them with the
+ * claim.json passphrase, they are sealed to the owner's public key, and the
+ * guest keys are deleted. Values stay as they are.
+ */
+async function finishClaim(owned, claim) {
+    const vault = await owned.request("GET", "/api/cli/vault");
+    if (!vault.claim) {
+        clearClaimFile();
+        console.error(`${pc.green("✓")} ${pc.bold(claim.projectName)} is already set up. claim.json was removed.\n`);
+        return;
+    }
+    let guestKey;
+    try {
+        guestKey = await unwrapPrivateKey(claim.passphrase, vault.claim.wrappedPrivateKey);
+    }
+    catch {
+        throw new Error("The guest passphrase does not open this project. Delete .getmyenv/claim.json and run claim again with the passphrase shown at creation.");
+    }
+    let ownerPublicKey = vault.publicKey;
+    let keys;
+    try {
+        if (!ownerPublicKey) {
+            const created = await createUserKeys(await askNewVaultPassword());
+            wipe(created.privateKey);
+            ownerPublicKey = created.publicKey;
+            keys = { publicKey: created.publicKey, wrappedPrivateKey: created.wrapped };
+        }
+        const shares = vault.claim.shares.map((s) => {
+            const key = openSealedKey(s.sealedKey, guestKey, s.contextId);
+            try {
+                return { contextId: s.contextId, sealedKey: sealContextKey(key, ownerPublicKey, s.contextId) };
+            }
+            finally {
+                wipe(key);
+            }
+        });
+        await owned.request("POST", "/api/cli/vault/claim", {
             claimCode: claim.claimCode,
+            ...(keys ? { keys } : {}),
+            shares,
         });
-        writeCachedKey(rewrapped);
+    }
+    finally {
+        wipe(guestKey);
     }
     clearClaimFile();
     ensureGitignoreHasEnv();
-    console.error(`\n${pc.green("✓")} Claimed ${pc.bold(claim.projectName)}. Vault password set.`);
-    console.error(pc.dim("claim.json was removed. Commit that change. Production (read-only) is now available in the dashboard.\n"));
+    console.error(`\n${pc.green("✓")} Claimed ${pc.bold(claim.projectName)}. ${keys ? "Vault password set." : "It opens with your Vault password."}`);
+    console.error(pc.dim("claim.json was removed. Read-only contexts like Production are now available in the dashboard.\n"));
 }
 /** A signed-in folder token for the claimed project: reuse this folder's, or sign in. */
 async function ownerClient(apiUrl, claim) {
@@ -58,37 +92,48 @@ async function ownerClient(apiUrl, claim) {
 }
 /** Claimed in the browser, but the CLI never finished. Finish with claim.json. */
 async function resumeClaim(apiUrl, claim) {
-    console.error(pc.dim("This project is already claimed. Finishing the Vault password setup.\n"));
-    const owned = await ownerClient(apiUrl, claim);
-    const vault = await owned.request("GET", "/api/cli/vault");
-    if (!vault.rewrapPending) {
-        clearClaimFile();
-        console.error(`${pc.green("✓")} ${pc.bold(claim.projectName)} is already set up. claim.json was removed.\n`);
-        return;
+    console.error(pc.dim("This project is already claimed. Handing its keys to your account.\n"));
+    await finishClaim(await ownerClient(apiUrl, claim), claim);
+}
+/** No claim.json here: ask for the claim code and guest passphrase printed when the project was created. */
+async function askClaimDetails() {
+    const meta = readProjectMeta();
+    if (!meta?.projectId) {
+        throw new Error("No .getmyenv/claim.json or project.json in this folder. Run claim in the folder that created the guest project.");
     }
-    const password = await askNewVaultPassword();
-    await finishRewrap(owned, claim, password);
+    console.error(pc.dim("No .getmyenv/claim.json here. Enter the claim code and guest passphrase shown when the project was created.\n"));
+    const claimCode = (await readLine("Claim code: ")).trim();
+    const passphrase = (await promptHidden("Guest passphrase (hidden): ")).trim();
+    if (!claimCode || !passphrase)
+        throw new Error("Claim code and guest passphrase required.");
+    const data = {
+        claimCode,
+        passphrase,
+        projectId: meta.projectId,
+        projectName: meta.projectName ?? "this project",
+        guestExpiresAt: "",
+    };
+    ensureGitignoreHasEnv();
+    writeClaimFile(data);
+    return { version: 1, ...data };
 }
 /**
  * Claim a guest project: sign in and take ownership in the browser, then
- * rewrap the project key with a Vault password.
+ * hand the context keys to the owner's account.
  */
 export async function claimCommand(opts = {}) {
     console.error(pc.bold("\ngetmyenv claim\n"));
-    const claim = readClaimFile();
-    if (!claim) {
-        throw new Error("No .getmyenv/claim.json in this folder. Run claim in the folder that created the guest project, or in a clone that has claim.json.");
-    }
     if (!process.stdin.isTTY) {
-        throw new Error("Claim needs a terminal to set a Vault password. Run: npx getmyenv claim");
+        throw new Error("Claim needs a terminal. Run: npx getmyenv claim");
     }
+    const claim = readClaimFile() ?? (await askClaimDetails());
     const apiUrl = resolveApiUrl(opts.apiUrl);
     const client = new ApiClient(apiUrl);
     const start = await client.request("POST", "/api/claim/start", {
         claimCode: claim.claimCode,
     });
     if (start.status === "invalid") {
-        throw new Error("This claim code is not valid. Check .getmyenv/claim.json.");
+        throw new Error("This claim code is not valid. Check .getmyenv/claim.json or the code shown at creation.");
     }
     if (start.status === "expired") {
         throw new Error("This guest project expired more than 30 days ago. It can no longer be claimed.");
@@ -100,11 +145,11 @@ export async function claimCommand(opts = {}) {
     if (start.status !== "claimable")
         throw new Error("Unexpected claim status. Run claim again.");
     const session = start;
-    const password = await askNewVaultPassword();
     const base = apiUrl.replace(/\/$/, "");
     const claimUrl = `${base}/claim?code=${encodeURIComponent(claim.claimCode)}&session=${encodeURIComponent(session.sessionId)}`;
     console.error("\nOpen this URL to claim the project:\n");
     console.error(`  ${claimUrl}\n`);
+    console.error(`Enter this code on the page: ${pc.bold(session.userCode)}\n`);
     openBrowser(claimUrl);
     console.error(pc.dim("Opened in your browser. Waiting...\n"));
     const deadline = new Date(session.expiresAt).getTime();
@@ -139,6 +184,5 @@ export async function claimCommand(opts = {}) {
         projectId: claim.projectId,
         projectName: claim.projectName,
     });
-    await finishRewrap(new ApiClient(apiUrl, newToken), claim, password);
+    await finishClaim(new ApiClient(apiUrl, newToken), claim);
 }
-//# sourceMappingURL=claim.js.map

package/dist/commands/context.d.ts

@@ -8,4 +8,3 @@ export declare function contextCreateCommand(name: string, opts: Opts & {
 }): Promise<void>;
 export declare function contextUseCommand(slug: string, opts: Opts): Promise<void>;
 export {};
-//# sourceMappingURL=context.d.ts.map

package/dist/commands/context.js

@@ -1,7 +1,10 @@
 import pc from "picocolors";
+import { decryptSecret, parsePayload } from "@getmyenv/crypto";
 import { readProjectMeta, writeProjectMeta } from "../lib/fs.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { defaultContextSlug, findContext } from "../lib/context.js";
+import { uploadValues } from "../lib/upload.js";
+import { contextKey } from "../lib/vault.js";
 export async function contextListCommand(opts) {
     const { who, meta } = await ensureTokenAndLink({ apiUrl: opts.apiUrl, quiet: true });
     const current = defaultContextSlug(who, meta);
@@ -13,19 +16,33 @@ export async function contextListCommand(opts) {
     }
 }
 export async function contextCreateCommand(name, opts) {
-    const { who, client } = await ensureTokenAndLink({ apiUrl: opts.apiUrl, quiet: true });
-    let from;
+    const linked = await ensureTokenAndLink({ apiUrl: opts.apiUrl, quiet: true });
+    const { who, client } = linked;
+    let source = null;
     if (opts.from) {
-        const source = findContext(who.contexts, opts.from);
+        source = findContext(who.contexts, opts.from);
         if (!source)
             throw new Error(`No context "${opts.from}".`);
         if (source.protection === "locked") {
             throw new Error(`${source.slug} is read-only. Copy from it in the dashboard.`);
         }
-        from = source.slug;
     }
-    const created = await client.request("POST", "/api/cli/contexts", { name, ...(from ? { from } : {}) });
-    console.log(`${pc.green("✓")} Context ${pc.bold(created.name)} (${created.slug}), open${from ? `, values copied from ${from}` : ""}`);
+    const created = await client.request("POST", "/api/cli/contexts", { name });
+    let copied = 0;
+    if (source) {
+        const data = await client.request("GET", `/api/cli/values?context=${encodeURIComponent(source.slug)}`);
+        if (data.values.length > 0) {
+            const key = await contextKey(linked, { ...source, sealedKey: data.sealedKey });
+            const pairs = Object.fromEntries(data.values.map((v) => [v.name, decryptSecret(key, v.name, parsePayload(v.ciphertext))]));
+            const res = await uploadValues({
+                linked,
+                context: created,
+                pairs,
+            });
+            copied = res.set.length;
+        }
+    }
+    console.log(`${pc.green("✓")} Context ${pc.bold(created.name)} (${created.slug}), open${source ? `, ${copied} value${copied === 1 ? "" : "s"} copied from ${source.slug}` : ""}`);
     if (opts.use) {
         const meta = readProjectMeta();
         writeProjectMeta({ ...(meta ?? {}), context: created.slug });
@@ -50,4 +67,3 @@ export async function contextUseCommand(slug, opts) {
     console.log(`${pc.green("✓")} Default context for this folder: ${pc.bold(ctx.slug)}`);
     console.log(pc.dim("Saved in .getmyenv/project.json."));
 }
-//# sourceMappingURL=context.js.map

package/dist/commands/export.d.ts

@@ -4,8 +4,10 @@ export type ExportOpts = {
     output?: string;
     stdout?: boolean;
     yes?: boolean;
-    vaultPasswordStdin?: boolean;
 };
-/** `export`: write one open context to a plaintext file, for tools that need one. */
+/**
+ * `export`: write one context to a plaintext file, for tools that need one.
+ * Read-only contexts go through the same checks as `run`: server token,
+ * allowed IP, and a trusted or approved machine.
+ */
 export declare function exportCommand(opts: ExportOpts): Promise<void>;
-//# sourceMappingURL=export.d.ts.map

package/dist/commands/export.js

@@ -2,33 +2,33 @@ import fs from "node:fs";
 import pc from "picocolors";
 import { decryptSecret, parsePayload } from "@getmyenv/crypto";
 import { EXPORT_WARNING, formatDotenvValue } from "@getmyenv/shared";
-import { ensureGitignoreHas, ensureGitignoreHasEnv, parseEnvFile } from "../lib/fs.js";
+import { ensureGitignoreHas, ensureGitignoreHasEnv, parseEnvFile, writePrivateFile, } from "../lib/fs.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { resolveContext } from "../lib/context.js";
 import { confirmDiff } from "../lib/confirm.js";
-import { unlockProjectKey } from "../lib/unlock.js";
-/** `export`: write one open context to a plaintext file, for tools that need one. */
+import { resolveValues } from "../lib/resolve.js";
+import { contextKey } from "../lib/vault.js";
+import { assertVariableNames } from "../lib/run-env.js";
+/**
+ * `export`: write one context to a plaintext file, for tools that need one.
+ * Read-only contexts go through the same checks as `run`: server token,
+ * allowed IP, and a trusted or approved machine.
+ */
 export async function exportCommand(opts) {
     const log = opts.stdout ? (l = "") => console.error(l) : (l = "") => console.log(l);
     const linked = await ensureTokenAndLink({ apiUrl: opts.apiUrl, quiet: opts.stdout });
     const ctx = resolveContext(linked.who, linked.meta, opts.context);
-    if (ctx.protection === "locked") {
-        throw new Error(`${ctx.slug} is read-only. Export it in the dashboard.`);
-    }
     log(pc.yellow(EXPORT_WARNING));
-    const data = await linked.client.request("GET", `/api/cli/values?context=${encodeURIComponent(ctx.slug)}`);
+    const data = ctx.protection === "locked"
+        ? await resolveValues(linked.client, linked.who.project.id, ctx.slug, "export")
+        : await linked.client.request("GET", `/api/cli/values?context=${encodeURIComponent(ctx.slug)}`);
+    assertVariableNames([...data.values.map((v) => v.name), ...data.missing.map((m) => m.name)]);
     const remote = {};
     if (data.values.length > 0) {
-        const { pek } = await unlockProjectKey({
-            isGuest: linked.who.isGuest,
-            projectId: linked.who.project.id,
-            wrapped: data.wrappedProjectKey,
-            cache: true,
-            vaultPasswordStdin: opts.vaultPasswordStdin,
-            apiUrl: linked.apiUrl,
-        });
-        for (const v of data.values)
-            remote[v.name] = decryptSecret(pek, parsePayload(v.ciphertext));
+        const key = await contextKey(linked, { ...ctx, sealedKey: data.sealedKey });
+        for (const v of data.values) {
+            remote[v.name] = decryptSecret(key, v.name, parsePayload(v.ciphertext));
+        }
     }
     const lines = [
         `# Exported by getmyenv from ${ctx.slug}. Plaintext. Do not commit.`,
@@ -40,6 +40,9 @@ export async function exportCommand(opts) {
         return;
     }
     const out = opts.output || ".env";
+    if (fs.lstatSync(out, { throwIfNoEntry: false })?.isSymbolicLink()) {
+        throw new Error(`${out} is a symlink. Refusing to write through it.`);
+    }
     if (fs.existsSync(out)) {
         const local = parseEnvFile(out);
         const conflicts = Object.keys(remote)
@@ -58,10 +61,8 @@ export async function exportCommand(opts) {
             return;
         }
     }
-    fs.writeFileSync(out, lines.join("\n") + "\n", { mode: 0o600 });
-    fs.chmodSync(out, 0o600);
+    writePrivateFile(out, lines.join("\n") + "\n", { overwrite: true });
     ensureGitignoreHasEnv();
     ensureGitignoreHas(out);
     log(`${pc.green("✓")} Wrote ${Object.keys(remote).length} variable(s) from ${ctx.slug} to ${out}`);
 }
-//# sourceMappingURL=export.js.map

package/dist/commands/guest.d.ts

@@ -5,8 +5,8 @@ export type GuestOpts = {
 export declare function folderNameHint(): string;
 /**
  * Create an unclaimed guest project with one open context, Development.
- * Writes token.json and key.json (gitignored), project.json and claim.json (committed).
- * claim.json holds the guest passphrase inside the project folder until claim.
+ * Writes token.json and claim.json (gitignored) and project.json (committed).
+ * claim.json holds the guest passphrase that wraps the guest key until claim.
  */
 export declare function createGuestProject(opts?: GuestOpts): Promise<{
     projectId: string;
@@ -14,4 +14,3 @@ export declare function createGuestProject(opts?: GuestOpts): Promise<{
     guestExpiresAt: string;
 }>;
 export declare function guestCommand(opts?: GuestOpts): Promise<void>;
-//# sourceMappingURL=guest.d.ts.map