getmyenv 0.8.0 → 0.9.0

package/README.md

@@ -65,7 +65,7 @@ Server tokens are read-only. `set` needs the folder token from browser sign-in,
 ## Open and Read-only
 
 - Open contexts: the CLI can read and write. Browser sign-in gives the folder a token in `.getmyenv/token.json`.
-- Read-only contexts: the CLI can only read. Set values in the dashboard. Use a server token from the CLI page (one context, IP allowlist) with `GETMYENV_TOKEN`. Each server token has a new machines rule: ask you on Requests (default), trust machines from its allowed IPs on first read (each entry /24 or narrower, IPv6 /64), or block them. Trusted machines read without asking. `status` shows the rule.
+- Read-only contexts: the CLI can read and export, never write. Set values in the dashboard. Use a server token from Project settings, Tokens (one context, IP allowlist) with `GETMYENV_TOKEN`. Each server token has a new machines rule: ask you on Requests (default), trust machines from its allowed IPs on first read (each entry /24 or narrower, IPv6 /64), or block them. Trusted machines read without asking. `status` shows the rule.
 
 ## Chaining
 

package/dist/commands/export.d.ts

@@ -5,5 +5,9 @@ export type ExportOpts = {
     stdout?: boolean;
     yes?: boolean;
 };
-/** `export`: write one open context to a plaintext file, for tools that need one. */
+/**
+ * `export`: write one context to a plaintext file, for tools that need one.
+ * Read-only contexts go through the same checks as `run`: server token,
+ * allowed IP, and a trusted or approved machine.
+ */
 export declare function exportCommand(opts: ExportOpts): Promise<void>;

package/dist/commands/export.js

@@ -6,18 +6,22 @@ import { ensureGitignoreHas, ensureGitignoreHasEnv, parseEnvFile, writePrivateFi
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { resolveContext } from "../lib/context.js";
 import { confirmDiff } from "../lib/confirm.js";
+import { resolveValues } from "../lib/resolve.js";
 import { contextKey } from "../lib/vault.js";
 import { assertVariableNames } from "../lib/run-env.js";
-/** `export`: write one open context to a plaintext file, for tools that need one. */
+/**
+ * `export`: write one context to a plaintext file, for tools that need one.
+ * Read-only contexts go through the same checks as `run`: server token,
+ * allowed IP, and a trusted or approved machine.
+ */
 export async function exportCommand(opts) {
     const log = opts.stdout ? (l = "") => console.error(l) : (l = "") => console.log(l);
     const linked = await ensureTokenAndLink({ apiUrl: opts.apiUrl, quiet: opts.stdout });
     const ctx = resolveContext(linked.who, linked.meta, opts.context);
-    if (ctx.protection === "locked") {
-        throw new Error(`${ctx.slug} is read-only. Export it in the dashboard.`);
-    }
     log(pc.yellow(EXPORT_WARNING));
-    const data = await linked.client.request("GET", `/api/cli/values?context=${encodeURIComponent(ctx.slug)}`);
+    const data = ctx.protection === "locked"
+        ? await resolveValues(linked.client, linked.who.project.id, ctx.slug, "export")
+        : await linked.client.request("GET", `/api/cli/values?context=${encodeURIComponent(ctx.slug)}`);
     assertVariableNames([...data.values.map((v) => v.name), ...data.missing.map((m) => m.name)]);
     const remote = {};
     if (data.values.length > 0) {

package/dist/commands/run.js

@@ -2,40 +2,13 @@ import { spawn } from "node:child_process";
 import os from "node:os";
 import pc from "picocolors";
 import { decryptSecret, parsePayload } from "@getmyenv/crypto";
-import { ApiError } from "../lib/api.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { resolveContext } from "../lib/context.js";
-import { signMachineProof } from "../lib/identity.js";
+import { resolveValues } from "../lib/resolve.js";
 import { contextKey } from "../lib/vault.js";
-import { sleep } from "../lib/authorize.js";
 import { assertVariableNames, explainLines, mergeEnv, signalExitCode, validationError, windowsCommandLine, } from "../lib/run-env.js";
-const GRANT_HEADER = "X-Getmyenv-Grant";
 /** Status lines go to stderr so the child's stdout stays clean for pipes. */
 const log = (line = "") => console.error(line);
-async function resolveOnce(client, projectId, slug, grant) {
-    return client.request("POST", "/api/cli/resolve", { context: slug, machine: signMachineProof(projectId, slug) }, grant ? { [GRANT_HEADER]: grant } : undefined);
-}
-async function waitForGrant(client, pending) {
-    log(`Waiting for approval in the dashboard: ${pending.reviewUrl}`);
-    log(pc.dim("Trust this machine there to skip approval next time.\n"));
-    const deadline = new Date(pending.expiresAt).getTime();
-    while (Date.now() < deadline) {
-        await sleep(1500);
-        const s = await client.request("GET", `/api/cli/requests/${pending.requestId}`);
-        if (s.status === "approved" && s.grantToken) {
-            log(`${pc.green("✓")} Approved\n`);
-            return s.grantToken;
-        }
-        if (s.status === "approved") {
-            throw new Error("This approval was already used. Run the command again.");
-        }
-        if (s.status === "denied")
-            throw new Error("Access denied in the dashboard.");
-        if (s.status === "expired")
-            break;
-    }
-    throw new Error("Approval request expired. Run the command again.");
-}
 /** Resolve, validate, merge, spawn. */
 export async function runCommand(opts, childArgs) {
     if (childArgs.length === 0 && !opts.explain) {
@@ -44,24 +17,7 @@ export async function runCommand(opts, childArgs) {
     const linked = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
     const { who, client, meta } = linked;
     const ctx = resolveContext(who, meta, opts.context);
-    let res = await resolveOnce(client, who.project.id, ctx.slug);
-    if (res.status === "pending") {
-        const grant = await waitForGrant(client, res);
-        try {
-            res = await resolveOnce(client, who.project.id, ctx.slug, grant);
-        }
-        catch (err) {
-            if (err instanceof ApiError && err.status === 401) {
-                throw new Error(`${err.message}. Run the command again.`);
-            }
-            throw err;
-        }
-        if (res.status !== "ok")
-            throw new Error("Approval did not complete. Run the command again.");
-    }
-    if (res.via === "auto") {
-        log(`${pc.green("✓")} This machine is now trusted for ${res.context.slug}.`);
-    }
+    const res = await resolveValues(client, who.project.id, ctx.slug, "run");
     assertVariableNames([...res.values.map((v) => v.name), ...res.missing.map((m) => m.name)]);
     const values = {};
     if (res.values.length > 0) {

package/dist/commands/unlink.js

@@ -37,7 +37,7 @@ export async function unlinkCommand(opts) {
             // 401/404: the token is already gone on the server. Anything else keeps
             // token.json, so a still-valid token is never left without a local copy.
             if (!(err instanceof ApiError && (err.status === 401 || err.status === 404))) {
-                throw new Error("Could not revoke the token on the server. Nothing was removed. Try again, or revoke it on the CLI page first.");
+                throw new Error("Could not revoke the token on the server. Nothing was removed. Try again, or revoke it in Project settings, Tokens first.");
             }
             console.log(pc.dim("Token was already revoked."));
         }

package/dist/lib/authorize.js

@@ -60,8 +60,8 @@ async function saveVerifiedToken(token, apiUrl) {
     return who;
 }
 async function authorizeViaPaste(apiUrl) {
-    const cliPage = `${apiUrl.replace(/\/$/, "")}/cli`;
-    console.error(pc.dim(`Create or copy a folder token: ${cliPage}\n`));
+    const projectsPage = `${apiUrl.replace(/\/$/, "")}/projects`;
+    console.error(pc.dim(`Create a folder token in Project settings, Tokens: ${projectsPage}\n`));
     const token = (await readLine("Paste the folder token: ")).trim();
     if (!token) {
         throw new Error("No token entered.");

package/dist/lib/bootstrap.js

@@ -34,7 +34,7 @@ export async function fetchWhoami(client) {
         }
         if (err instanceof ApiError && err.status === 401) {
             throw new Error(process.env.GETMYENV_TOKEN?.trim()
-                ? `${err.message}\nGETMYENV_TOKEN no longer works. Create a new token on the CLI page.`
+                ? `${err.message}\nGETMYENV_TOKEN no longer works. Create a new token in Project settings, Tokens.`
                 : `${err.message}\nThis folder's token no longer works. Run: npx getmyenv unlink, then npx getmyenv`);
         }
         throw err;

package/dist/lib/credentials.js

@@ -23,7 +23,7 @@ export function assertTokenNotCommitted(cwd = process.cwd()) {
     if (fs.existsSync(file) && isTrackedByGit(file, cwd)) {
         throw new Error([
             ".getmyenv/token.json is committed to git. Anyone with the repo can use it.",
-            "Revoke it on the CLI page, then: git rm --cached .getmyenv/token.json",
+            "Revoke it in Project settings, Tokens, then: git rm --cached .getmyenv/token.json",
             "Then run: npx getmyenv unlink, and npx getmyenv",
         ].join("\n"));
     }

package/dist/lib/resolve.d.ts

@@ -0,0 +1,25 @@
+import type { SealedKey } from "@getmyenv/crypto";
+import { ApiClient, type Protection } from "./api.js";
+import type { MissingKey } from "./run-env.js";
+export type ResolveOk = {
+    status: "ok";
+    /** How the read was allowed. */
+    via: "open" | "trusted" | "auto" | "grant";
+    context: {
+        id: number;
+        slug: string;
+        name: string;
+        protection: Protection;
+    };
+    sealedKey: SealedKey | null;
+    values: Array<{
+        name: string;
+        ciphertext: string;
+    }>;
+    missing: MissingKey[];
+};
+/**
+ * Ciphertext for one context. Read-only contexts need a server token, an
+ * allowed IP, and a trusted machine or an approval in the dashboard.
+ */
+export declare function resolveValues(client: ApiClient, projectId: string, slug: string, purpose: "run" | "export"): Promise<ResolveOk>;

package/dist/lib/resolve.js

@@ -0,0 +1,56 @@
+import pc from "picocolors";
+import { ApiError } from "./api.js";
+import { sleep } from "./authorize.js";
+import { signMachineProof } from "./identity.js";
+const GRANT_HEADER = "X-Getmyenv-Grant";
+/** Status lines go to stderr so stdout stays clean for pipes. */
+const log = (line = "") => console.error(line);
+async function resolveOnce(client, projectId, slug, purpose, grant) {
+    return client.request("POST", "/api/cli/resolve", { context: slug, machine: signMachineProof(projectId, slug), purpose }, grant ? { [GRANT_HEADER]: grant } : undefined);
+}
+async function waitForGrant(client, pending) {
+    log(`Waiting for approval in the dashboard: ${pending.reviewUrl}`);
+    log(pc.dim("Trust this machine there to skip approval next time.\n"));
+    const deadline = new Date(pending.expiresAt).getTime();
+    while (Date.now() < deadline) {
+        await sleep(1500);
+        const s = await client.request("GET", `/api/cli/requests/${pending.requestId}`);
+        if (s.status === "approved" && s.grantToken) {
+            log(`${pc.green("✓")} Approved\n`);
+            return s.grantToken;
+        }
+        if (s.status === "approved") {
+            throw new Error("This approval was already used. Run the command again.");
+        }
+        if (s.status === "denied")
+            throw new Error("Access denied in the dashboard.");
+        if (s.status === "expired")
+            break;
+    }
+    throw new Error("Approval request expired. Run the command again.");
+}
+/**
+ * Ciphertext for one context. Read-only contexts need a server token, an
+ * allowed IP, and a trusted machine or an approval in the dashboard.
+ */
+export async function resolveValues(client, projectId, slug, purpose) {
+    let res = await resolveOnce(client, projectId, slug, purpose);
+    if (res.status === "pending") {
+        const grant = await waitForGrant(client, res);
+        try {
+            res = await resolveOnce(client, projectId, slug, purpose, grant);
+        }
+        catch (err) {
+            if (err instanceof ApiError && err.status === 401) {
+                throw new Error(`${err.message}. Run the command again.`);
+            }
+            throw err;
+        }
+        if (res.status !== "ok")
+            throw new Error("Approval did not complete. Run the command again.");
+    }
+    if (res.via === "auto") {
+        log(`${pc.green("✓")} This machine is now trusted for ${res.context.slug}.`);
+    }
+    return res;
+}

package/dist/lib/vault.js

@@ -43,7 +43,7 @@ export async function contextKey(linked, target, opts = {}) {
         const key = opened.get(target.id);
         if (!key) {
             throw new Error(member
-                ? `The owner has not sent you the key for ${target.slug} yet. Ask them to open Members in the dashboard.`
+                ? `The owner has not sent you the key for ${target.slug} yet. Ask them to open Project settings, Members in the dashboard.`
                 : `No key for ${target.slug} on this account. Open the project in the dashboard once.`);
         }
         for (const [id, k] of opened)
@@ -59,7 +59,7 @@ export async function contextKey(linked, target, opts = {}) {
 async function serverContextKey(linked, target) {
     const { privateKey } = splitServerToken(process.env.GETMYENV_TOKEN?.trim() ?? "");
     if (!privateKey) {
-        throw new Error("This server token has no key. Create a new server token on the CLI page.");
+        throw new Error("This server token has no key. Create a new server token in Project settings, Tokens.");
     }
     try {
         let sealed = target.sealedKey;
@@ -67,7 +67,7 @@ async function serverContextKey(linked, target) {
             sealed = (await fetchVault(linked)).contexts.find((c) => c.id === target.id)?.sealedKey ?? null;
         }
         if (!sealed) {
-            throw new Error(`This server token has no key for ${target.slug}. Create a new server token on the CLI page.`);
+            throw new Error(`This server token has no key for ${target.slug}. Create a new server token in Project settings, Tokens.`);
         }
         const key = openSealedKey(sealed, privateKey, target.id);
         memo.set(target.id, key);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "getmyenv",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "CLI for getmyenv, an encrypted store for environment variables and secrets. We store ciphertext only.",
   "type": "module",
   "bin": {
@@ -34,15 +34,15 @@
   },
   "dependencies": {
     "@getmyenv/crypto": "0.4.0",
-    "@getmyenv/shared": "0.5.0",
+    "@getmyenv/shared": "0.6.0",
     "@napi-rs/keyring": "^2.1.0",
-    "commander": "^13.1.0",
+    "commander": "^15.0.0",
     "dotenv": "^16.4.7",
     "picocolors": "^1.1.1"
   },
   "devDependencies": {
     "@types/node": "^22.13.10",
-    "typescript": "^5.8.2",
+    "typescript": "^7.0.2",
     "vitest": "^4.1.11"
   },
   "engines": {