getmyenv 0.9.4 → 0.9.6

package/README.md

@@ -22,7 +22,7 @@ npx getmyenv run staging -- npm start # or pick one
 - `import [file] [--prune] [--dry-run] [--yes]`: `.env.<slug>` goes to that context.
 - `export [-o file | --stdout] [--yes]`: for tools that need a file. The file is added to `.gitignore` and gets owner-only permissions on macOS and Linux.
 - `guest [--name <name>]`: a project without an account. It works for 30 days. Claim it within 60.
-- `claim`: claim a guest project. Reads `.getmyenv/claim.json`, or asks for the claim code and guest passphrase that `guest` printed once.
+- `claim`: claim a guest project. Reads `.getmyenv/claim.json`, or asks for the claim code and guest passphrase that `guest` printed once at a terminal.
 - `backup [-o file]`: encrypted backup of open contexts (default `<project>.getmyenv-backup`). It opens with the Vault password in effect when it was made.
 - `restore <file> [--dry-run] [--yes]`: restore a backup into this folder's project. Values go into open contexts with the same slug and replace values with the same name. Read-only and missing contexts are skipped.
 - `start`: same as bare `getmyenv`. `start --template <id or link>` adds a template's variable names and asks for each value.
@@ -35,7 +35,7 @@ Prompts and status lines go to stderr, so `export --stdout > .env` stays clean.
 Commit `.getmyenv/project.json`. `token.json` and `claim.json` stay local and are gitignored.
 
 <!-- cli:help -->
-Output of `npx getmyenv --help` (0.9.4):
+Output of `npx getmyenv --help` (0.9.6):
 
 ```text
 Usage: getmyenv [options] [command]

package/dist/commands/backup.js

@@ -9,7 +9,7 @@ export async function backupCommand(opts) {
     const { client } = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
     const data = await client.request("GET", "/api/cli/backup");
     if (!data.publicKey || !data.wrappedPrivateKey) {
-        throw new Error("No Vault password yet, so there is nothing to back up. Set a value first: npx getmyenv set KEY");
+        throw new Error("No Vault password yet, so there is nothing to back up. Set it in the dashboard, or set a value: npx getmyenv set KEY");
     }
     const envelope = createBackupEnvelope({
         projectName: data.projectName,

package/dist/commands/guest.js

@@ -50,9 +50,14 @@ export async function createGuestProject(opts = {}) {
     const daysLeft = Math.max(0, Math.ceil((new Date(created.guestExpiresAt).getTime() - Date.now()) / 86_400_000));
     console.error(`${pc.green("✓")} Guest project ${pc.bold(created.projectName)}. Context: development.`);
     console.error(pc.dim(`Expires in ${daysLeft} days unless claimed. Commit .getmyenv/project.json. token.json and claim.json stay local.`));
-    console.error(pc.dim("claim.json holds the claim code and guest passphrase. Shown once, save them to claim later:"));
-    console.error(`  ${pc.dim("Claim code:")}       ${created.claimCode}`);
-    console.error(`  ${pc.dim("Guest passphrase:")} ${passphrase}\n`);
+    if (process.stdin.isTTY) {
+        console.error(pc.dim("claim.json holds the claim code and guest passphrase. Shown once, save them to claim later:"));
+        console.error(`  ${pc.dim("Claim code:")}       ${created.claimCode}`);
+        console.error(`  ${pc.dim("Guest passphrase:")} ${passphrase}\n`);
+    }
+    else {
+        console.error(pc.dim("claim.json holds the claim code and guest passphrase. It is the only copy. Keep it private.\n"));
+    }
     return created;
 }
 export async function guestCommand(opts = {}) {

package/dist/commands/unlink.js

@@ -22,7 +22,10 @@ export async function unlinkCommand(opts) {
     }
     if (!opts.yes) {
         const label = meta?.projectName ?? meta?.projectId ?? "this folder";
-        const ok = await promptConfirm(`Unlink ${label}? Revokes this folder's token and removes .getmyenv files. The project and its values stay.`, { defaultYes: false });
+        const tokenLine = readClaimFile()
+            ? "Removes .getmyenv files except claim.json. The guest token stays, so claim still works."
+            : "Revokes this folder's token and removes .getmyenv files.";
+        const ok = await promptConfirm(`Unlink ${label}? ${tokenLine} The project and its values stay.`, { defaultYes: false });
         if (!ok) {
             console.log(pc.dim("Kept."));
             return;
@@ -30,8 +33,13 @@ export async function unlinkCommand(opts) {
     }
     if (folder) {
         try {
-            await new ApiClient(resolveApiUrl(opts.apiUrl), folder.token).request("DELETE", "/api/cli/token");
-            console.log(`${pc.green("✓")} Token revoked`);
+            const res = await new ApiClient(resolveApiUrl(opts.apiUrl), folder.token).request("DELETE", "/api/cli/token");
+            if (res?.revoked === false) {
+                console.log(pc.dim("Guest token kept on the server, so claim still works with claim.json."));
+            }
+            else {
+                console.log(`${pc.green("✓")} Token revoked`);
+            }
         }
         catch (err) {
             // 401/404: the token is already gone on the server. Anything else keeps

package/dist/lib/api.js

@@ -55,15 +55,17 @@ export class ApiClient {
             throw new ApiError(`Could not reach ${this.baseUrl}`, 0);
         }
         if (!res.ok) {
-            let message = `HTTP ${res.status}`;
+            let serverMessage;
             try {
                 const data = (await res.json());
-                if (data.error)
-                    message = data.error;
+                serverMessage = data.error;
             }
             catch {
                 /* ignore */
             }
+            const message = res.status >= 500
+                ? `The getmyenv server had an error (HTTP ${res.status}). Try again in a moment.`
+                : (serverMessage ?? `HTTP ${res.status}`);
             throw new ApiError(message, res.status);
         }
         if (res.status === 204)

package/dist/lib/fs.js

@@ -142,7 +142,7 @@ export function readLine(question) {
 export async function promptHidden(question) {
     const stdin = process.stdin;
     if (!stdin.isTTY) {
-        throw new Error(`No terminal to ask for the Vault password. Unlock once in a terminal: open contexts stay unlocked for ${VAULT_UNLOCK_DURATION}. On servers and in CI, use a server token.`);
+        throw new Error(`No terminal to ask for the Vault password. Run this same command once in a terminal to unlock. Open contexts then stay unlocked for ${VAULT_UNLOCK_DURATION}. On servers and in CI, use a server token.`);
     }
     // Prompts go to stderr so stdout stays clean for `export --stdout > .env` and pipes.
     const out = process.stderr;

package/dist/lib/upload.d.ts

@@ -1,4 +1,4 @@
-import type { ContextInfo } from "./api.js";
+import { type ContextInfo } from "./api.js";
 import type { Linked } from "./bootstrap.js";
 /** Fail fast before prompting or encrypting. Mirrors the server's `checkWrite`, which still enforces it. */
 export declare function assertWritable(linked: Linked, ctx: ContextInfo): void;

package/dist/lib/upload.js

@@ -1,5 +1,6 @@
 import { encryptSecret, serializePayload } from "@getmyenv/crypto";
 import { FACTS } from "@getmyenv/shared";
+import { ApiError } from "./api.js";
 import { contextKey } from "./vault.js";
 /** Fail fast before prompting or encrypting. Mirrors the server's `checkWrite`, which still enforces it. */
 export function assertWritable(linked, ctx) {
@@ -39,7 +40,15 @@ export async function uploadValues(input) {
     if (Buffer.byteLength(JSON.stringify(body)) > UPLOAD_MAX_BYTES) {
         throw new Error("Too much to upload at once (max 1 MB encrypted). Split the file and import each part.");
     }
-    return linked.client.request("POST", "/api/cli/values", body);
+    try {
+        return await linked.client.request("POST", "/api/cli/values", body);
+    }
+    catch (err) {
+        if (err instanceof ApiError && err.status >= 500) {
+            throw new ApiError(`${err.message} Some values may already be saved. npx getmyenv ls shows what is set in ${context.slug}.`, err.status);
+        }
+        throw err;
+    }
 }
 /** Matches the server limit on `/api/cli/values`. */
 const UPLOAD_MAX_BYTES = 1024 * 1024;

package/dist/lib/vault.js

@@ -129,7 +129,7 @@ async function holderPrivateKey(linked, vault, opts) {
     const isGuest = vault.holder === "guest";
     if (!vault.publicKey || !vault.wrappedPrivateKey) {
         if (!opts.create) {
-            throw new Error("No Vault password yet. Set a value first: npx getmyenv set KEY");
+            throw new Error("No Vault password yet. Set it in the dashboard, or set a value: npx getmyenv set KEY");
         }
         if (!isGuest) {
             console.error(pc.dim("Choose a Vault password. It stays on this machine. We store an encrypted key blob only.\n"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "getmyenv",
-  "version": "0.9.4",
+  "version": "0.9.6",
   "description": "CLI for getmyenv, an encrypted store for environment variables and secrets. We store ciphertext only.",
   "type": "module",
   "bin": {
@@ -34,7 +34,7 @@
   },
   "dependencies": {
     "@getmyenv/crypto": "0.4.1",
-    "@getmyenv/shared": "0.8.0",
+    "@getmyenv/shared": "0.8.2",
     "@napi-rs/keyring": "^2.1.0",
     "commander": "^15.0.0",
     "dotenv": "^16.4.7",