getmyenv 0.7.0 → 0.9.0

package/dist/lib/guest-key.js

@@ -1,46 +1,38 @@
+import { VAULT_PASSWORD_HELP, validateVaultPassword } from "@getmyenv/shared";
 import { promptHidden, readClaimFile } from "./fs.js";
+/** Ask for a new Vault password twice. Same rule as the dashboard. */
+export async function promptNewVaultPassword() {
+    if (process.stdin.isTTY)
+        console.error(VAULT_PASSWORD_HELP);
+    const password = await promptHidden("New Vault password (hidden): ");
+    if (!password)
+        throw new Error("Vault password required.");
+    const check = validateVaultPassword(password);
+    if (!check.ok)
+        throw new Error(check.error ?? VAULT_PASSWORD_HELP);
+    const confirm = await promptHidden("Confirm Vault password (hidden): ");
+    if (password !== confirm)
+        throw new Error("Passwords did not match.");
+    return password;
+}
 /**
- * Guest projects wrap the PEK with the passphrase in claim.json.
+ * Guest projects wrap the guest private key with the passphrase in claim.json.
  * Use that silently so guest, set and run need no Vault password prompt.
- * Claimed / human projects still prompt for the Vault password.
+ * Claimed projects prompt for the Vault password in a terminal.
  */
-let presetPassword = null;
-/** Password already read from stdin by the command (for example `set --stdin`). */
-export function presetVaultPassword(password) {
-    presetPassword = password;
-}
 export async function resolveVaultPassword(opts) {
-    if (!opts.isGuest && presetPassword)
-        return presetPassword;
     if (opts.isGuest) {
         const claim = readClaimFile();
         if (claim?.passphrase) {
             return claim.passphrase;
         }
-        throw new Error("Guest project is missing .getmyenv/claim.json. Restore it from your repo or a copy.");
-    }
-    if (opts.create) {
-        const password = await promptHidden("New Vault password (hidden): ", {
-            allowStdin: opts.vaultPasswordStdin,
-        });
-        if (!password) {
-            throw new Error("Vault password required.");
-        }
-        if (opts.vaultPasswordStdin) {
-            return password;
-        }
-        const confirm = await promptHidden("Confirm Vault password (hidden): ");
-        if (password !== confirm) {
-            throw new Error("Passwords did not match.");
-        }
-        return password;
+        throw new Error("Guest project is missing .getmyenv/claim.json. Run it from the folder that created the project, or run: npx getmyenv claim");
     }
-    const password = await promptHidden(opts.prompt ?? "Vault password (hidden): ", {
-        allowStdin: opts.vaultPasswordStdin,
-    });
+    if (opts.create)
+        return promptNewVaultPassword();
+    const password = await promptHidden(opts.prompt ?? "Vault password (hidden): ");
     if (!password) {
         throw new Error("Vault password required.");
     }
     return password;
 }
-//# sourceMappingURL=guest-key.js.map

package/dist/lib/identity.d.ts

@@ -2,9 +2,8 @@ import { type MachineKeypair } from "@getmyenv/crypto";
 import { type MachineProof } from "@getmyenv/shared";
 /**
  * Machine identity per project, stored in the OS user config (never the repo).
- * It identifies this machine for locked contexts. It does not decrypt values.
+ * It identifies this machine for read-only contexts. It does not decrypt values.
  */
 export declare function loadOrCreateIdentity(projectId: string): MachineKeypair;
 export declare function machineLabel(): string;
 export declare function signMachineProof(projectId: string, contextSlug: string): MachineProof;
-//# sourceMappingURL=identity.d.ts.map

package/dist/lib/identity.js

@@ -6,7 +6,7 @@ import { machineProofMessage } from "@getmyenv/shared";
 import { getConfigDir } from "./fs.js";
 /**
  * Machine identity per project, stored in the OS user config (never the repo).
- * It identifies this machine for locked contexts. It does not decrypt values.
+ * It identifies this machine for read-only contexts. It does not decrypt values.
  */
 export function loadOrCreateIdentity(projectId) {
     const dir = path.join(getConfigDir(), "machines");
@@ -45,4 +45,3 @@ export function signMachineProof(projectId, contextSlug) {
         timestamp,
     };
 }
-//# sourceMappingURL=identity.js.map

package/dist/lib/keychain.d.ts

@@ -5,17 +5,30 @@ type KeyringEntry = {
     deletePassword(): boolean;
 };
 export type KeyringFactory = (service: string, account: string) => KeyringEntry;
+export type KeyringAccounts = (service: string) => string[];
 /** Tests swap in an in-memory keyring. `null` means no keyring available. */
-export declare function setKeyringForTests(factory: KeyringFactory | null | undefined): void;
+export declare function setKeyringForTests(factory: KeyringFactory | null | undefined, accounts?: KeyringAccounts): void;
 /** Off with `GETMYENV_KEYCHAIN=0` or in CI (`CI` set to anything but `false` or `0`). */
 export declare function keychainEnabled(env?: NodeJS.ProcessEnv): boolean;
 /** One keychain entry per server origin and project, so staging and production keys never mix. */
 export declare function keychainAccount(apiUrl: string, projectId: string): string;
-/** The cached key, only if it has not expired and matches the server's wrapped key. */
-export declare function readCachedPek(account: string, wrappedRaw: string, now?: number): Promise<Uint8Array | null>;
+/**
+ * The cached key of one context, only if it has not expired and matches the
+ * sealed key the server holds now. A new sealed key (rotation) misses.
+ */
+export declare function readCachedContextKey(account: string, contextId: number, sealedRaw: string, now?: number): Promise<Uint8Array | null>;
 /** Returns false when no keychain is available; the CLI then keeps asking. */
-export declare function storeCachedPek(account: string, wrappedRaw: string, pek: Uint8Array, now?: number): Promise<boolean>;
+export declare function storeCachedContextKeys(account: string, entries: Array<{
+    contextId: number;
+    sealedRaw: string;
+    key: Uint8Array;
+}>, now?: number): Promise<boolean>;
 /** True when an entry was removed. False when there was none or no keychain is available. */
-export declare function clearCachedPek(account: string): Promise<boolean>;
+export declare function clearCachedKeys(account: string): Promise<boolean>;
+/**
+ * Removes every getmyenv entry on this machine, for all servers and projects.
+ * `fallback` accounts are cleared too, for keychains that cannot list entries.
+ * Returns how many entries were removed.
+ */
+export declare function clearAllCachedKeys(fallback?: string[]): Promise<number>;
 export {};
-//# sourceMappingURL=keychain.d.ts.map

package/dist/lib/keychain.js

@@ -1,16 +1,18 @@
 import { createHash } from "node:crypto";
 /**
- * The unlocked project key, remembered in the OS keychain (macOS Keychain,
+ * Unlocked open context keys, remembered in the OS keychain (macOS Keychain,
  * Windows Credential Manager, Linux Secret Service) for a few hours so `run`
  * on an open context does not ask for the Vault password every time.
- * Never the Vault password itself.
+ * Never the Vault password or the private key.
  */
 const SERVICE = "getmyenv";
 export const KEYCHAIN_TTL_MS = 8 * 60 * 60 * 1000;
 let factoryOverride;
+let accountsOverride;
 /** Tests swap in an in-memory keyring. `null` means no keyring available. */
-export function setKeyringForTests(factory) {
+export function setKeyringForTests(factory, accounts) {
     factoryOverride = factory;
+    accountsOverride = accounts;
 }
 async function loadFactory() {
     if (factoryOverride !== undefined)
@@ -23,6 +25,17 @@ async function loadFactory() {
         return null;
     }
 }
+async function loadAccounts() {
+    if (factoryOverride !== undefined)
+        return accountsOverride ?? null;
+    try {
+        const { findCredentials } = await import("@napi-rs/keyring");
+        return (service) => findCredentials(service).map((c) => c.account);
+    }
+    catch {
+        return null;
+    }
+}
 /** Off with `GETMYENV_KEYCHAIN=0` or in CI (`CI` set to anything but `false` or `0`). */
 export function keychainEnabled(env = process.env) {
     if (env.GETMYENV_KEYCHAIN === "0")
@@ -43,8 +56,8 @@ export function keychainAccount(apiUrl, projectId) {
     }
     return `${origin}|project:${projectId}`;
 }
-function hashWrapped(wrappedRaw) {
-    return createHash("sha256").update(wrappedRaw).digest("hex");
+function hashSealed(sealedRaw) {
+    return createHash("sha256").update(sealedRaw).digest("hex");
 }
 async function entryFor(account) {
     const factory = await loadFactory();
@@ -57,11 +70,7 @@ async function entryFor(account) {
         return null;
     }
 }
-/** The cached key, only if it has not expired and matches the server's wrapped key. */
-export async function readCachedPek(account, wrappedRaw, now = Date.now()) {
-    const entry = await entryFor(account);
-    if (!entry)
-        return null;
+function readStored(entry, now) {
     let raw;
     try {
         raw = entry.getPassword();
@@ -79,24 +88,43 @@ export async function readCachedPek(account, wrappedRaw, now = Date.now()) {
         safeDelete(entry);
         return null;
     }
-    if (typeof stored.pek !== "string" ||
-        stored.wrappedHash !== hashWrapped(wrappedRaw) ||
+    if (stored.version !== 2 ||
         typeof stored.expiresAt !== "number" ||
-        stored.expiresAt <= now) {
+        stored.expiresAt <= now ||
+        !stored.keys ||
+        typeof stored.keys !== "object") {
         safeDelete(entry);
         return null;
     }
-    return new Uint8Array(Buffer.from(stored.pek, "base64"));
+    return stored;
+}
+/**
+ * The cached key of one context, only if it has not expired and matches the
+ * sealed key the server holds now. A new sealed key (rotation) misses.
+ */
+export async function readCachedContextKey(account, contextId, sealedRaw, now = Date.now()) {
+    const entry = await entryFor(account);
+    if (!entry)
+        return null;
+    const stored = readStored(entry, now);
+    const hit = stored?.keys[String(contextId)];
+    if (!hit || typeof hit.key !== "string" || hit.sealedHash !== hashSealed(sealedRaw))
+        return null;
+    const key = new Uint8Array(Buffer.from(hit.key, "base64"));
+    return key.length === 32 ? key : null;
 }
 /** Returns false when no keychain is available; the CLI then keeps asking. */
-export async function storeCachedPek(account, wrappedRaw, pek, now = Date.now()) {
+export async function storeCachedContextKeys(account, entries, now = Date.now()) {
     const entry = await entryFor(account);
     if (!entry)
         return false;
     const stored = {
-        pek: Buffer.from(pek).toString("base64"),
-        wrappedHash: hashWrapped(wrappedRaw),
+        version: 2,
         expiresAt: now + KEYCHAIN_TTL_MS,
+        keys: Object.fromEntries(entries.map((e) => [
+            String(e.contextId),
+            { key: Buffer.from(e.key).toString("base64"), sealedHash: hashSealed(e.sealedRaw) },
+        ])),
     };
     try {
         entry.setPassword(JSON.stringify(stored));
@@ -107,12 +135,35 @@ export async function storeCachedPek(account, wrappedRaw, pek, now = Date.now())
     }
 }
 /** True when an entry was removed. False when there was none or no keychain is available. */
-export async function clearCachedPek(account) {
+export async function clearCachedKeys(account) {
     const entry = await entryFor(account);
     if (!entry)
         return false;
     return safeDelete(entry);
 }
+/**
+ * Removes every getmyenv entry on this machine, for all servers and projects.
+ * `fallback` accounts are cleared too, for keychains that cannot list entries.
+ * Returns how many entries were removed.
+ */
+export async function clearAllCachedKeys(fallback = []) {
+    let accounts = [];
+    const list = await loadAccounts();
+    if (list) {
+        try {
+            accounts = list(SERVICE);
+        }
+        catch {
+            accounts = [];
+        }
+    }
+    let removed = 0;
+    for (const account of new Set([...accounts, ...fallback])) {
+        if (await clearCachedKeys(account))
+            removed++;
+    }
+    return removed;
+}
 function safeDelete(entry) {
     try {
         return entry.deletePassword();
@@ -121,4 +172,3 @@ function safeDelete(entry) {
         return false;
     }
 }
-//# sourceMappingURL=keychain.js.map

package/dist/lib/known-keys.d.ts

@@ -0,0 +1,3 @@
+/** "Did you mean OPENAI_API_KEY?" for names close to a known one. Nothing is renamed. */
+export declare function didYouMean(name: string): string | null;
+export declare function printDidYouMean(names: string[], indent?: string): void;

package/dist/lib/known-keys.js

@@ -0,0 +1,17 @@
+import pc from "picocolors";
+import { nearMissKnownKey } from "@getmyenv/shared";
+/** "Did you mean OPENAI_API_KEY?" for names close to a known one. Nothing is renamed. */
+export function didYouMean(name) {
+    const near = nearMissKnownKey(name);
+    if (!near)
+        return null;
+    const why = near.source === "sdk" ? `${near.provider} SDKs read that name.` : "That is the common name.";
+    return `Did you mean ${near.name}? ${why}`;
+}
+export function printDidYouMean(names, indent = "") {
+    for (const name of names) {
+        const hint = didYouMean(name);
+        if (hint)
+            console.error(pc.yellow(`${indent}${name}: ${hint}`));
+    }
+}

package/dist/lib/resolve.d.ts

@@ -0,0 +1,25 @@
+import type { SealedKey } from "@getmyenv/crypto";
+import { ApiClient, type Protection } from "./api.js";
+import type { MissingKey } from "./run-env.js";
+export type ResolveOk = {
+    status: "ok";
+    /** How the read was allowed. */
+    via: "open" | "trusted" | "auto" | "grant";
+    context: {
+        id: number;
+        slug: string;
+        name: string;
+        protection: Protection;
+    };
+    sealedKey: SealedKey | null;
+    values: Array<{
+        name: string;
+        ciphertext: string;
+    }>;
+    missing: MissingKey[];
+};
+/**
+ * Ciphertext for one context. Read-only contexts need a server token, an
+ * allowed IP, and a trusted machine or an approval in the dashboard.
+ */
+export declare function resolveValues(client: ApiClient, projectId: string, slug: string, purpose: "run" | "export"): Promise<ResolveOk>;

package/dist/lib/resolve.js

@@ -0,0 +1,56 @@
+import pc from "picocolors";
+import { ApiError } from "./api.js";
+import { sleep } from "./authorize.js";
+import { signMachineProof } from "./identity.js";
+const GRANT_HEADER = "X-Getmyenv-Grant";
+/** Status lines go to stderr so stdout stays clean for pipes. */
+const log = (line = "") => console.error(line);
+async function resolveOnce(client, projectId, slug, purpose, grant) {
+    return client.request("POST", "/api/cli/resolve", { context: slug, machine: signMachineProof(projectId, slug), purpose }, grant ? { [GRANT_HEADER]: grant } : undefined);
+}
+async function waitForGrant(client, pending) {
+    log(`Waiting for approval in the dashboard: ${pending.reviewUrl}`);
+    log(pc.dim("Trust this machine there to skip approval next time.\n"));
+    const deadline = new Date(pending.expiresAt).getTime();
+    while (Date.now() < deadline) {
+        await sleep(1500);
+        const s = await client.request("GET", `/api/cli/requests/${pending.requestId}`);
+        if (s.status === "approved" && s.grantToken) {
+            log(`${pc.green("✓")} Approved\n`);
+            return s.grantToken;
+        }
+        if (s.status === "approved") {
+            throw new Error("This approval was already used. Run the command again.");
+        }
+        if (s.status === "denied")
+            throw new Error("Access denied in the dashboard.");
+        if (s.status === "expired")
+            break;
+    }
+    throw new Error("Approval request expired. Run the command again.");
+}
+/**
+ * Ciphertext for one context. Read-only contexts need a server token, an
+ * allowed IP, and a trusted machine or an approval in the dashboard.
+ */
+export async function resolveValues(client, projectId, slug, purpose) {
+    let res = await resolveOnce(client, projectId, slug, purpose);
+    if (res.status === "pending") {
+        const grant = await waitForGrant(client, res);
+        try {
+            res = await resolveOnce(client, projectId, slug, purpose, grant);
+        }
+        catch (err) {
+            if (err instanceof ApiError && err.status === 401) {
+                throw new Error(`${err.message}. Run the command again.`);
+            }
+            throw err;
+        }
+        if (res.status !== "ok")
+            throw new Error("Approval did not complete. Run the command again.");
+    }
+    if (res.via === "auto") {
+        log(`${pc.green("✓")} This machine is now trusted for ${res.context.slug}.`);
+    }
+    return res;
+}

package/dist/lib/run-env.d.ts

@@ -1,6 +1,5 @@
-/**
- * Pure pieces of `getmyenv run`: validate and merge. Names only in any output.
- */
+/** Names from the server go into an environment or a file. Refuse any that are not variable names. */
+export declare function assertVariableNames(names: Iterable<string>): void;
 export type MissingKey = {
     name: string;
     reason: "missing" | "expired";
@@ -47,4 +46,3 @@ export declare function windowsCommandLine(args: string[]): string;
 export declare function signalExitCode(signal: NodeJS.Signals, numbers: Record<string, number>): number;
 /** `--explain` output. Names and origins only, never values. */
 export declare function explainLines(result: MergeResult, contextSlug: string): string[];
-//# sourceMappingURL=run-env.d.ts.map

package/dist/lib/run-env.js

@@ -1,6 +1,15 @@
 /**
  * Pure pieces of `getmyenv run`: validate and merge. Names only in any output.
  */
+import { isValidVariableName } from "@getmyenv/shared";
+/** Names from the server go into an environment or a file. Refuse any that are not variable names. */
+export function assertVariableNames(names) {
+    for (const name of names) {
+        if (!isValidVariableName(name)) {
+            throw new Error("The server sent a name that is not a valid variable name. Nothing was run or written.");
+        }
+    }
+}
 /** The child never sees the CLI's own settings (token, API URL, config dir). */
 export function withoutOwnEnv(parent) {
     const env = {};
@@ -111,4 +120,3 @@ export function explainLines(result, contextSlug) {
     lines.push(`  ${result.applied.length} from getmyenv, ${result.overridden.length} replaced, ${result.kept.length} kept, ${result.filledByParent.length} from parent env, ${result.unresolved.length} not set`);
     return lines;
 }
-//# sourceMappingURL=run-env.js.map

package/dist/lib/update-check.d.ts

@@ -11,4 +11,3 @@ export declare function updateLine(current: string, latest: string | null): stri
  * cached npm version, refreshed in the background once a day. Skipped in CI.
  */
 export declare function maybeSuggestUpdate(): Promise<void>;
-//# sourceMappingURL=update-check.d.ts.map

package/dist/lib/update-check.js

@@ -90,7 +90,10 @@ async function fetchAndCache(file, timeoutMs) {
     const ctrl = new AbortController();
     setTimeout(() => ctrl.abort(), timeoutMs).unref();
     try {
-        const res = await fetch("https://registry.npmjs.org/getmyenv/latest", { signal: ctrl.signal });
+        const res = await fetch("https://registry.npmjs.org/getmyenv/latest", {
+            signal: ctrl.signal,
+            redirect: "error",
+        });
         if (!res.ok)
             return;
         const data = (await res.json());
@@ -132,4 +135,3 @@ export async function maybeSuggestUpdate() {
     if (line)
         console.error(pc.yellow(line));
 }
-//# sourceMappingURL=update-check.js.map

package/dist/lib/upload.d.ts

@@ -12,10 +12,8 @@ export declare function uploadValues(input: {
     pairs: Record<string, string>;
     prune?: boolean;
     expiresAt?: string | null;
-    vaultPasswordStdin?: boolean;
 }): Promise<{
     set: string[];
     pruned: string[];
     declared: string[];
 }>;
-//# sourceMappingURL=upload.d.ts.map

package/dist/lib/upload.js

@@ -1,5 +1,5 @@
 import { encryptSecret, serializePayload } from "@getmyenv/crypto";
-import { unlockProjectKey } from "./unlock.js";
+import { contextKey } from "./vault.js";
 /** Fail fast before prompting or encrypting. Mirrors the server's `checkWrite`, which still enforces it. */
 export function assertWritable(linked, ctx) {
     if (linked.who.token.kind === "server") {
@@ -21,33 +21,24 @@ export async function uploadValues(input) {
         .filter(([, v]) => v === "")
         .map(([k]) => k);
     let values = [];
-    let wrappedProjectKey;
     if (filled.length > 0) {
-        const { wrappedProjectKey: serverWrapped } = await linked.client.request("GET", "/api/cli/vault");
-        const { pek, wrappedRaw, created } = await unlockProjectKey({
-            isGuest: linked.who.isGuest,
-            projectId: linked.who.project.id,
-            wrapped: serverWrapped,
-            cache: true,
-            allowCreate: true,
-            vaultPasswordStdin: input.vaultPasswordStdin,
-            apiUrl: linked.apiUrl,
-        });
-        if (serverWrapped == null || created) {
-            wrappedProjectKey = JSON.parse(wrappedRaw);
-        }
+        const key = await contextKey(linked, context, { create: true });
         values = filled.map(([name, value]) => ({
             name,
-            ciphertext: serializePayload(encryptSecret(pek, value)),
+            ciphertext: serializePayload(encryptSecret(key, name, value)),
             ...(input.expiresAt !== undefined ? { expiresAt: input.expiresAt } : {}),
         }));
     }
-    return linked.client.request("POST", "/api/cli/values", {
+    const body = {
         context: context.slug,
-        ...(wrappedProjectKey ? { wrappedProjectKey } : {}),
         values,
         ...(input.prune ? { prune: true } : {}),
         ...(declare.length > 0 ? { declare } : {}),
-    });
+    };
+    if (Buffer.byteLength(JSON.stringify(body)) > UPLOAD_MAX_BYTES) {
+        throw new Error("Too much to upload at once (max 1 MB encrypted). Split the file and import each part.");
+    }
+    return linked.client.request("POST", "/api/cli/values", body);
 }
-//# sourceMappingURL=upload.js.map
+/** Matches the server limit on `/api/cli/values`. */
+const UPLOAD_MAX_BYTES = 1024 * 1024;

package/dist/lib/vault.d.ts

@@ -0,0 +1,54 @@
+import { type SealedKey, type WrappedPrivateKey } from "@getmyenv/crypto";
+import { type Protection } from "./api.js";
+import type { Linked } from "./bootstrap.js";
+/**
+ * Context keys for the CLI.
+ *
+ * Folder and guest tokens: the account (or guest) private key is wrapped with
+ * the Vault password (or the guest passphrase in claim.json). It is unwrapped
+ * here, opens the sealed context keys, and is wiped. Open context keys may
+ * stay in the OS keychain for 8 hours. The private key is never stored.
+ *
+ * Server tokens: GETMYENV_TOKEN holds the token's own private key. It opens
+ * the one context key sealed to that token. No Vault password.
+ */
+export type VaultContext = {
+    id: number;
+    slug: string;
+    protection: Protection;
+    hasKey: boolean;
+    sealedKey: SealedKey | null;
+};
+export type VaultInfo = {
+    holder: "user" | "guest" | "token";
+    publicKey: string | null;
+    wrappedPrivateKey: WrappedPrivateKey | null;
+    contexts: VaultContext[];
+    claim: {
+        publicKey: string;
+        wrappedPrivateKey: WrappedPrivateKey;
+        shares: Array<{
+            contextId: number;
+            sealedKey: SealedKey;
+        }>;
+    } | null;
+};
+export type KeyTarget = {
+    id: number;
+    slug: string;
+    protection: Protection;
+    /** Sealed key already sent by the server, so no extra request is needed. */
+    sealedKey?: SealedKey | null;
+};
+export type KeyOpts = {
+    /** Make the Vault password and the context key when they do not exist yet. */
+    create?: boolean;
+};
+export declare function fetchVault(linked: Linked): Promise<VaultInfo>;
+/** The context key, unlocking with the Vault password when needed. */
+export declare function contextKey(linked: Linked, target: KeyTarget, opts?: KeyOpts): Promise<Uint8Array>;
+/** Unlock with the Vault password and return the private key. Caller wipes it. */
+export declare function unlockPrivateKey(linked: Linked, opts?: KeyOpts): Promise<{
+    vault: VaultInfo;
+    privateKey: Uint8Array;
+}>;