getmyenv 0.9.8 → 0.9.9

package/README.md

@@ -35,7 +35,7 @@ Prompts and status lines go to stderr, so `export --stdout > .env` stays clean.
 Commit `.getmyenv/project.json`. `token.json` and `claim.json` stay local and are gitignored.
 
 <!-- cli:help -->
-Output of `npx getmyenv --help` (0.9.8):
+Output of `npx getmyenv --help` (0.9.9):
 
 ```text
 Usage: getmyenv [options] [command]

package/dist/commands/restore.js

@@ -5,7 +5,7 @@ import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { findContext } from "../lib/context.js";
 import { promptConfirm } from "../lib/fs.js";
 import { resolveVaultPassword } from "../lib/guest-key.js";
-import { contextKey } from "../lib/vault.js";
+import { writeKey } from "../lib/vault.js";
 /**
  * Restore a backup into this folder's project. The backup opens locally with
  * the Vault password it was made with. Values are encrypted again with this
@@ -73,11 +73,13 @@ export async function restoreCommand(file, opts) {
         }
     }
     const values = [];
+    const keyVersions = {};
     for (const v of opened.values) {
         if (!writable(v.context))
             continue;
         const target = targets.get(v.context);
-        const key = await contextKey(linked, target, { create: true });
+        const { key, keyVersion } = await writeKey(linked, target);
+        keyVersions[v.context] = keyVersion;
         values.push({
             key: v.key,
             context: v.context,
@@ -89,6 +91,7 @@ export async function restoreCommand(file, opts) {
         keys: envelope.keys,
         tags: envelope.tags ?? {},
         values,
+        keyVersions,
     });
     const skipped = [...perContext.keys()].filter((slug) => !writable(slug));
     console.log(`${pc.green("✓")} Restored ${res.restored} values into ${res.projectName}`);

package/dist/lib/upload.js

@@ -1,7 +1,7 @@
 import { encryptSecret, serializePayload } from "@getmyenv/crypto";
 import { FACTS } from "@getmyenv/shared";
 import { ApiError } from "./api.js";
-import { contextKey } from "./vault.js";
+import { writeKey } from "./vault.js";
 /** Fail fast before prompting or encrypting. Mirrors the server's `checkWrite`, which still enforces it. */
 export function assertWritable(linked, ctx) {
     if (linked.who.token.kind === "server") {
@@ -23,17 +23,20 @@ export async function uploadValues(input) {
         .filter(([, v]) => v === "")
         .map(([k]) => k);
     let values = [];
+    let keyVersion;
     if (filled.length > 0) {
-        const key = await contextKey(linked, context, { create: true });
+        const write = await writeKey(linked, context);
+        keyVersion = write.keyVersion;
         values = filled.map(([name, value]) => ({
             name,
-            ciphertext: serializePayload(encryptSecret(key, name, value)),
+            ciphertext: serializePayload(encryptSecret(write.key, name, value)),
             ...(input.expiresAt !== undefined ? { expiresAt: input.expiresAt } : {}),
         }));
     }
     const body = {
         context: context.slug,
         values,
+        ...(keyVersion !== undefined ? { keyVersion } : {}),
         ...(input.prune ? { prune: true } : {}),
         ...(declare.length > 0 ? { declare } : {}),
     };

package/dist/lib/vault.d.ts

@@ -18,6 +18,8 @@ export type VaultContext = {
     protection: Protection;
     hasKey: boolean;
     sealedKey: SealedKey | null;
+    /** Version of the key in sealedKey. Sent back with every write. */
+    keyVersion: number;
 };
 export type VaultInfo = {
     holder: "user" | "guest" | "token";
@@ -45,6 +47,15 @@ export type KeyOpts = {
     create?: boolean;
 };
 export declare function fetchVault(linked: Linked): Promise<VaultInfo>;
+/**
+ * The context key and its version, for a write. The server refuses ciphertext
+ * written with a key that was replaced since, so the version comes from the
+ * same vault response as the sealed key.
+ */
+export declare function writeKey(linked: Linked, target: KeyTarget): Promise<{
+    key: Uint8Array;
+    keyVersion: number;
+}>;
 /** The context key, unlocking with the Vault password when needed. */
 export declare function contextKey(linked: Linked, target: KeyTarget, opts?: KeyOpts): Promise<Uint8Array>;
 /** Unlock with the Vault password and return the private key. Caller wipes it. */

package/dist/lib/vault.js

@@ -6,9 +6,25 @@ import { resolveVaultPassword } from "./guest-key.js";
 import { keychainAccount, keychainEnabled, readCachedContextKey, storeCachedContextKeys, } from "./keychain.js";
 /** One unlock per process: several contexts in one command prompt once. */
 const memo = new Map();
+/** Key version of each memo entry opened from the vault response. Keys from the keychain have none. */
+const versions = new Map();
 export function fetchVault(linked) {
     return linked.client.request("GET", "/api/cli/vault");
 }
+/**
+ * The context key and its version, for a write. The server refuses ciphertext
+ * written with a key that was replaced since, so the version comes from the
+ * same vault response as the sealed key.
+ */
+export async function writeKey(linked, target) {
+    if (!versions.has(target.id))
+        memo.delete(target.id);
+    const key = await contextKey(linked, { ...target, sealedKey: undefined }, { create: true });
+    const keyVersion = versions.get(target.id);
+    if (keyVersion === undefined)
+        throw new Error(`No key version for ${target.slug}. Run the command again.`);
+    return { key, keyVersion };
+}
 /** The context key, unlocking with the Vault password when needed. */
 export async function contextKey(linked, target, opts = {}) {
     const cached = memo.get(target.id);
@@ -45,10 +61,14 @@ export async function contextKey(linked, target, opts = {}) {
         if (!key) {
             throw new Error(member
                 ? `Waiting for the owner to send the key for ${target.slug}. It arrives the next time they unlock the vault in the dashboard.`
-                : `No key for ${target.slug} on this account. Open the project in the dashboard once.`);
+                : `This account has no key for ${target.slug}. If you reset your vault, reset ${target.slug} in the dashboard to set new values.`);
         }
         for (const [id, k] of opened)
             memo.set(id, k);
+        for (const c of vault.contexts) {
+            if (opened.has(c.id))
+                versions.set(c.id, c.keyVersion);
+        }
         if (account)
             await remember(account, vault, opened);
         return key;
@@ -109,6 +129,7 @@ async function initContextKey(linked, vault, ctx) {
     const key = generateContextKey();
     try {
         await linked.client.request("POST", "/api/cli/vault", {
+            publicKey: vault.publicKey,
             shares: [{ contextId: ctx.id, sealedKey: sealContextKey(key, vault.publicKey, ctx.id) }],
         });
     }
@@ -164,7 +185,7 @@ async function holderPrivateKey(linked, vault, opts) {
                 console.error(pc.red("Wrong Vault password. Try again.\n"));
                 continue;
             }
-            throw new Error("Could not unlock. Check your Vault password.");
+            throw new Error("Could not unlock. Check your Vault password. Forgot it? Reset the vault in the dashboard, Settings.");
         }
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "getmyenv",
-  "version": "0.9.8",
+  "version": "0.9.9",
   "description": "CLI for getmyenv, an encrypted store for environment variables and secrets. We store ciphertext only.",
   "type": "module",
   "bin": {
@@ -34,7 +34,7 @@
   },
   "dependencies": {
     "@getmyenv/crypto": "0.4.1",
-    "@getmyenv/shared": "0.8.4",
+    "@getmyenv/shared": "0.8.5",
     "@napi-rs/keyring": "^2.1.0",
     "commander": "^15.0.0",
     "dotenv": "^16.4.7",