getmyenv 0.9.5 → 0.9.7

package/README.md

@@ -22,7 +22,7 @@ npx getmyenv run staging -- npm start # or pick one
 - `import [file] [--prune] [--dry-run] [--yes]`: `.env.<slug>` goes to that context.
 - `export [-o file | --stdout] [--yes]`: for tools that need a file. The file is added to `.gitignore` and gets owner-only permissions on macOS and Linux.
 - `guest [--name <name>]`: a project without an account. It works for 30 days. Claim it within 60.
-- `claim`: claim a guest project. Reads `.getmyenv/claim.json`, or asks for the claim code and guest passphrase that `guest` printed once.
+- `claim`: claim a guest project. Reads `.getmyenv/claim.json`, or asks for the claim code and guest passphrase that `guest` printed once at a terminal.
 - `backup [-o file]`: encrypted backup of open contexts (default `<project>.getmyenv-backup`). It opens with the Vault password in effect when it was made.
 - `restore <file> [--dry-run] [--yes]`: restore a backup into this folder's project. Values go into open contexts with the same slug and replace values with the same name. Read-only and missing contexts are skipped.
 - `start`: same as bare `getmyenv`. `start --template <id or link>` adds a template's variable names and asks for each value.
@@ -35,7 +35,7 @@ Prompts and status lines go to stderr, so `export --stdout > .env` stays clean.
 Commit `.getmyenv/project.json`. `token.json` and `claim.json` stay local and are gitignored.
 
 <!-- cli:help -->
-Output of `npx getmyenv --help` (0.9.5):
+Output of `npx getmyenv --help` (0.9.7):
 
 ```text
 Usage: getmyenv [options] [command]

package/dist/commands/guest.js

@@ -2,6 +2,7 @@ import { randomBytes } from "node:crypto";
 import path from "node:path";
 import pc from "picocolors";
 import { createUserKeys, wipe } from "@getmyenv/crypto";
+import { FACTS } from "@getmyenv/shared";
 import { ensureGitignoreHasEnv, readProjectMeta, writeClaimFile, writeProjectMeta, } from "../lib/fs.js";
 import { readFolderToken, writeFolderToken } from "../lib/credentials.js";
 import { ApiClient, resolveApiUrl } from "../lib/api.js";
@@ -50,9 +51,14 @@ export async function createGuestProject(opts = {}) {
     const daysLeft = Math.max(0, Math.ceil((new Date(created.guestExpiresAt).getTime() - Date.now()) / 86_400_000));
     console.error(`${pc.green("✓")} Guest project ${pc.bold(created.projectName)}. Context: development.`);
     console.error(pc.dim(`Expires in ${daysLeft} days unless claimed. Commit .getmyenv/project.json. token.json and claim.json stay local.`));
-    console.error(pc.dim("claim.json holds the claim code and guest passphrase. Shown once, save them to claim later:"));
-    console.error(`  ${pc.dim("Claim code:")}       ${created.claimCode}`);
-    console.error(`  ${pc.dim("Guest passphrase:")} ${passphrase}\n`);
+    if (process.stdin.isTTY) {
+        console.error(pc.dim("claim.json holds the claim code and guest passphrase. Shown once, save them to claim later:"));
+        console.error(`  ${pc.dim("Claim code:")}       ${created.claimCode}`);
+        console.error(`  ${pc.dim("Guest passphrase:")} ${passphrase}\n`);
+    }
+    else {
+        console.error(pc.dim(`claim.json holds the claim code and guest passphrase. It is the only copy. Keep it private. ${FACTS.claimLoss}\n`));
+    }
     return created;
 }
 export async function guestCommand(opts = {}) {

package/dist/lib/api.d.ts

@@ -5,6 +5,7 @@ import type { NewMachinePolicy } from "@getmyenv/shared";
 /** From package.json, which ships with the package: src/lib and dist/lib are both two levels down. */
 export declare const CLI_VERSION: string;
 export { isDefaultApiUrl, parseSafeUrl } from "./api-url.js";
+export declare const API_TIMEOUT_MS = 30000;
 export type Protection = "open" | "locked";
 export type ValueStatus = "set" | "expiring_soon" | "expired" | "missing";
 export type ContextInfo = {

package/dist/lib/api.js

@@ -7,6 +7,7 @@ import { pickApiUrl } from "./api-url.js";
 /** From package.json, which ships with the package: src/lib and dist/lib are both two levels down. */
 export const CLI_VERSION = createRequire(import.meta.url)("../../package.json").version;
 export { isDefaultApiUrl, parseSafeUrl } from "./api-url.js";
+export const API_TIMEOUT_MS = 30_000;
 export class ApiError extends Error {
     status;
     constructor(message, status) {
@@ -49,27 +50,41 @@ export class ApiClient {
                 body: body === undefined ? undefined : JSON.stringify(body),
                 // The token must never follow a redirect to another host.
                 redirect: "error",
+                signal: AbortSignal.timeout(API_TIMEOUT_MS),
             });
         }
-        catch {
-            throw new ApiError(`Could not reach ${this.baseUrl}`, 0);
+        catch (err) {
+            throw networkError(err, `Could not reach ${this.baseUrl}`);
         }
         if (!res.ok) {
-            let message = `HTTP ${res.status}`;
+            let serverMessage;
             try {
                 const data = (await res.json());
-                if (data.error)
-                    message = data.error;
+                serverMessage = data.error;
             }
             catch {
                 /* ignore */
             }
+            const message = res.status >= 500
+                ? `The getmyenv server had an error (HTTP ${res.status}). Try again in a moment.`
+                : (serverMessage ?? `HTTP ${res.status}`);
             throw new ApiError(message, res.status);
         }
         if (res.status === 204)
             return undefined;
-        return (await res.json());
+        try {
+            return (await res.json());
+        }
+        catch (err) {
+            throw networkError(err, `The connection to ${this.baseUrl} closed before the answer arrived. Try again in a moment.`);
+        }
+    }
+}
+function networkError(err, fallback) {
+    if (err instanceof Error && err.name === "TimeoutError") {
+        return new ApiError(`The getmyenv server did not answer within ${API_TIMEOUT_MS / 1000} seconds. Try again in a moment.`, 0);
     }
+    return new ApiError(fallback, 0);
 }
 /**
  * Env / folder token only, no prompt. A server token is `auth.privateKey`:

package/dist/lib/bootstrap.js

@@ -35,8 +35,8 @@ export async function fetchWhoami(client) {
         }
         if (err instanceof ApiError && err.status === 401) {
             throw new Error(process.env.GETMYENV_TOKEN?.trim()
-                ? `${err.message}\nGETMYENV_TOKEN no longer works. Create a new token in Project settings, Tokens.`
-                : `${err.message}\nThis folder's token no longer works. Run: npx getmyenv unlink, then npx getmyenv`);
+                ? "GETMYENV_TOKEN no longer works. It was revoked or expired. Create a new token in Project settings, Tokens."
+                : "This folder's token no longer works. It was revoked or expired. Run: npx getmyenv unlink, then npx getmyenv");
         }
         throw err;
     }

package/dist/lib/fs.js

@@ -142,7 +142,7 @@ export function readLine(question) {
 export async function promptHidden(question) {
     const stdin = process.stdin;
     if (!stdin.isTTY) {
-        throw new Error(`No terminal to ask for the Vault password. Unlock once in a terminal: open contexts stay unlocked for ${VAULT_UNLOCK_DURATION}. On servers and in CI, use a server token.`);
+        throw new Error(`No terminal to ask for the Vault password. Run this same command once in a terminal to unlock. Open contexts then stay unlocked for ${VAULT_UNLOCK_DURATION}. On servers and in CI, use a server token.`);
     }
     // Prompts go to stderr so stdout stays clean for `export --stdout > .env` and pipes.
     const out = process.stderr;

package/dist/lib/upload.d.ts

@@ -1,4 +1,4 @@
-import type { ContextInfo } from "./api.js";
+import { type ContextInfo } from "./api.js";
 import type { Linked } from "./bootstrap.js";
 /** Fail fast before prompting or encrypting. Mirrors the server's `checkWrite`, which still enforces it. */
 export declare function assertWritable(linked: Linked, ctx: ContextInfo): void;

package/dist/lib/upload.js

@@ -1,5 +1,6 @@
 import { encryptSecret, serializePayload } from "@getmyenv/crypto";
 import { FACTS } from "@getmyenv/shared";
+import { ApiError } from "./api.js";
 import { contextKey } from "./vault.js";
 /** Fail fast before prompting or encrypting. Mirrors the server's `checkWrite`, which still enforces it. */
 export function assertWritable(linked, ctx) {
@@ -39,7 +40,15 @@ export async function uploadValues(input) {
     if (Buffer.byteLength(JSON.stringify(body)) > UPLOAD_MAX_BYTES) {
         throw new Error("Too much to upload at once (max 1 MB encrypted). Split the file and import each part.");
     }
-    return linked.client.request("POST", "/api/cli/values", body);
+    try {
+        return await linked.client.request("POST", "/api/cli/values", body);
+    }
+    catch (err) {
+        if (err instanceof ApiError && err.status >= 500) {
+            throw new ApiError(`${err.message} Some values may already be saved. npx getmyenv ls shows what is set in ${context.slug}.`, err.status);
+        }
+        throw err;
+    }
 }
 /** Matches the server limit on `/api/cli/values`. */
 const UPLOAD_MAX_BYTES = 1024 * 1024;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "getmyenv",
-  "version": "0.9.5",
+  "version": "0.9.7",
   "description": "CLI for getmyenv, an encrypted store for environment variables and secrets. We store ciphertext only.",
   "type": "module",
   "bin": {
@@ -34,7 +34,7 @@
   },
   "dependencies": {
     "@getmyenv/crypto": "0.4.1",
-    "@getmyenv/shared": "0.8.1",
+    "@getmyenv/shared": "0.8.3",
     "@napi-rs/keyring": "^2.1.0",
     "commander": "^15.0.0",
     "dotenv": "^16.4.7",