@astrale-os/cli 1.0.0-beta.1 → 1.0.0-beta.2

package/studio/server/cli.test.ts

@@ -0,0 +1,88 @@
+import { afterEach, expect, test } from 'bun:test'
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+import {
+  decodeJsonObject,
+  runStudioCliJson,
+  STUDIO_CLI_DESCRIPTOR_ENV,
+  studioCliCommand,
+} from './cli'
+
+const priorDescriptor = process.env[STUDIO_CLI_DESCRIPTOR_ENV]
+const roots: string[] = []
+
+afterEach(() => {
+  if (priorDescriptor === undefined) delete process.env[STUDIO_CLI_DESCRIPTOR_ENV]
+  else process.env[STUDIO_CLI_DESCRIPTOR_ENV] = priorDescriptor
+  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true })
+})
+
+test('exact command rejects missing and incompatible descriptors instead of using PATH', () => {
+  delete process.env[STUDIO_CLI_DESCRIPTOR_ENV]
+  expect(() => studioCliCommand(['instance', 'active'])).toThrow(
+    'launch Studio through this Astrale CLI',
+  )
+  expect(() =>
+    studioCliCommand(
+      ['instance', 'active'],
+      JSON.stringify({ version: 2, executable: '/usr/bin/astrale', args: [] }),
+    ),
+  ).toThrow('launch Studio through this Astrale CLI')
+})
+
+test('machine runner uses the exact descriptor, appends json mode, and versions decoded output', async () => {
+  const root = mkdtempSync(join(tmpdir(), 'studio-cli-runner-'))
+  roots.push(root)
+  mkdirSync(root, { recursive: true })
+  const entry = join(root, 'fake-cli.ts')
+  writeFileSync(entry, `process.stdout.write(JSON.stringify({ command: process.argv.slice(2) }))\n`)
+  process.env[STUDIO_CLI_DESCRIPTOR_ENV] = JSON.stringify({
+    version: 1,
+    executable: process.execPath,
+    args: [realpathSync(entry)],
+  })
+
+  const result = await runStudioCliJson(
+    ['query', '--definition', '/:example.dev:class.Issue'],
+    decodeJsonObject,
+  )
+
+  expect(result).toMatchObject({
+    version: 1,
+    ok: true,
+    exitCode: 0,
+    timedOut: false,
+    data: {
+      command: ['query', '--definition', '/:example.dev:class.Issue', '--json'],
+    },
+  })
+})
+
+test('machine runner decodes structured CLI errors without treating them as success', async () => {
+  const root = mkdtempSync(join(tmpdir(), 'studio-cli-error-'))
+  roots.push(root)
+  const entry = join(root, 'fake-cli.ts')
+  writeFileSync(
+    entry,
+    `process.stderr.write(JSON.stringify({ error: 'NOT_FOUND', message: 'Missing instance.' }))
+process.exit(7)
+`,
+  )
+  process.env[STUDIO_CLI_DESCRIPTOR_ENV] = JSON.stringify({
+    version: 1,
+    executable: process.execPath,
+    args: [realpathSync(entry)],
+  })
+
+  const result = await runStudioCliJson(['instance', 'active'], decodeJsonObject)
+
+  expect(result).toMatchObject({
+    version: 1,
+    ok: false,
+    exitCode: 7,
+    detail: 'Missing instance.',
+    data: { error: 'NOT_FOUND', message: 'Missing instance.' },
+  })
+})

package/studio/server/cli.ts

@@ -0,0 +1,240 @@
+/**
+ * Exact Astrale CLI bridge for Studio.
+ *
+ * The launching `astrale studio` process passes its runtime + entrypoint through a versioned
+ * descriptor. Every Studio CLI delegation uses that exact pair; this module never falls back to
+ * resolving an unrelated `astrale` binary from PATH.
+ */
+import { isAbsolute } from 'node:path'
+
+import { asJsonRecord, asStringArray, parseJson as parseUntrustedJson } from './json'
+
+export const STUDIO_CLI_DESCRIPTOR_ENV = 'DOMAIN_STUDIO_CLI_DESCRIPTOR'
+
+export interface StudioCliDescriptorV1 {
+  version: 1
+  executable: string
+  args: string[]
+}
+
+export type StudioCliDecoder<T> = (value: unknown) => T | null
+
+export interface StudioCliMachineResult<T> {
+  version: 1
+  ok: boolean
+  data: T | null
+  value: unknown | null
+  detail: string
+  exitCode: number
+  stdout: string
+  stderr: string
+  timedOut: boolean
+}
+
+export interface StudioCliTextResult {
+  version: 1
+  ok: boolean
+  detail: string
+  exitCode: number
+  stdout: string
+  stderr: string
+  timedOut: boolean
+}
+
+interface RunOptions {
+  cwd?: string
+  timeoutMs?: number
+  acceptedExitCodes?: readonly number[]
+}
+
+interface CapturedProcess {
+  exitCode: number
+  stdout: string
+  stderr: string
+  timedOut: boolean
+  spawnError?: string
+}
+
+export function decodeStudioCliDescriptor(value: string | undefined): StudioCliDescriptorV1 | null {
+  if (!value) return null
+  const parsed = asJsonRecord(parseUntrustedJson(value))
+  const args = asStringArray(parsed?.args)
+  if (
+    parsed?.version !== 1 ||
+    typeof parsed.executable !== 'string' ||
+    !isAbsolute(parsed.executable) ||
+    !args ||
+    args.length > 1 ||
+    !args.every((arg) => isAbsolute(arg))
+  ) {
+    return null
+  }
+  return { version: 1, executable: parsed.executable, args }
+}
+
+export function studioCliCommand(
+  args: readonly string[],
+  encodedDescriptor = process.env[STUDIO_CLI_DESCRIPTOR_ENV],
+): string[] {
+  const descriptor = decodeStudioCliDescriptor(encodedDescriptor)
+  if (!descriptor) {
+    throw new Error(
+      `${STUDIO_CLI_DESCRIPTOR_ENV} is missing or invalid; launch Studio through this Astrale CLI`,
+    )
+  }
+  return [descriptor.executable, ...descriptor.args, ...args]
+}
+
+export function decodeJsonObject(value: unknown): Record<string, unknown> | null {
+  return asJsonRecord(value) ?? null
+}
+
+export function conciseCliFailure(raw: string): string | undefined {
+  const lines = raw
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean)
+  const error = lines.find((line) => /^[A-Za-z_$][\w$]*(?:Error|Exception):\s+\S/.test(line))
+  if (error) return error.slice(0, 600)
+  const explicit = lines.find((line) => /^(?:error|failed):\s+\S/i.test(line))
+  if (explicit) return explicit.slice(0, 600)
+  const useful = lines.find(
+    (line) =>
+      !/^\d+\s+\|/.test(line) &&
+      line !== '^' &&
+      !/^at\s/.test(line) &&
+      !/^Bun v\d/.test(line) &&
+      !/^details?:\s*[{[]?$/i.test(line),
+  )
+  return useful?.slice(0, 600)
+}
+
+function nonEmptyString(value: unknown): string | undefined {
+  return typeof value === 'string' && value.trim() ? value.trim() : undefined
+}
+
+function resultDetail(value: unknown, stdout: string, stderr: string): string {
+  const object = decodeJsonObject(value)
+  return (
+    nonEmptyString(object?.message) ??
+    nonEmptyString(object?.error) ??
+    conciseCliFailure(stderr) ??
+    conciseCliFailure(stdout) ??
+    ''
+  )
+}
+
+function parseJson(text: string): unknown | null {
+  const normalized = text.replace(/^\uFEFF/, '').trim()
+  if (!normalized) return null
+  try {
+    return JSON.parse(normalized)
+  } catch {
+    return null
+  }
+}
+
+async function captureStudioCli(
+  args: readonly string[],
+  options: RunOptions,
+): Promise<CapturedProcess> {
+  let command: string[]
+  try {
+    command = studioCliCommand(args)
+  } catch (error) {
+    return {
+      exitCode: -1,
+      stdout: '',
+      stderr: '',
+      timedOut: false,
+      spawnError: error instanceof Error ? error.message : String(error),
+    }
+  }
+
+  try {
+    const proc = Bun.spawn(command, {
+      ...(options.cwd ? { cwd: options.cwd } : {}),
+      stdout: 'pipe',
+      stderr: 'pipe',
+    })
+    let timedOut = false
+    const timer = options.timeoutMs
+      ? setTimeout(() => {
+          timedOut = true
+          try {
+            proc.kill()
+          } catch {
+            // Already exited.
+          }
+        }, options.timeoutMs)
+      : undefined
+    try {
+      const [stdout, stderr, exitCode] = await Promise.all([
+        new Response(proc.stdout).text(),
+        new Response(proc.stderr).text(),
+        proc.exited,
+      ])
+      return { exitCode, stdout, stderr, timedOut }
+    } finally {
+      if (timer) clearTimeout(timer)
+    }
+  } catch (error) {
+    return {
+      exitCode: -1,
+      stdout: '',
+      stderr: '',
+      timedOut: false,
+      spawnError: error instanceof Error ? error.message : String(error),
+    }
+  }
+}
+
+export async function runStudioCliJson<T>(
+  args: readonly string[],
+  decoder: StudioCliDecoder<T>,
+  options: RunOptions = {},
+): Promise<StudioCliMachineResult<T>> {
+  const machineArgs = args.includes('--json') ? [...args] : [...args, '--json']
+  const captured = await captureStudioCli(machineArgs, options)
+  const value = parseJson(captured.stdout) ?? parseJson(captured.stderr)
+  const data = value === null ? null : decoder(value)
+  const accepted = options.acceptedExitCodes ?? [0]
+  const detail =
+    captured.spawnError ??
+    (captured.timedOut
+      ? `Astrale CLI timed out after ${options.timeoutMs ?? 0}ms`
+      : resultDetail(value, captured.stdout, captured.stderr))
+  return {
+    version: 1,
+    ok: accepted.includes(captured.exitCode) && data !== null && !captured.timedOut,
+    data,
+    value,
+    detail,
+    exitCode: captured.exitCode,
+    stdout: captured.stdout,
+    stderr: captured.stderr,
+    timedOut: captured.timedOut,
+  }
+}
+
+export async function runStudioCliText(
+  args: readonly string[],
+  options: RunOptions = {},
+): Promise<StudioCliTextResult> {
+  const captured = await captureStudioCli(args, options)
+  const accepted = options.acceptedExitCodes ?? [0]
+  const detail =
+    captured.spawnError ??
+    (captured.timedOut
+      ? `Astrale CLI timed out after ${options.timeoutMs ?? 0}ms`
+      : (conciseCliFailure(captured.stderr) ?? conciseCliFailure(captured.stdout) ?? ''))
+  return {
+    version: 1,
+    ok: accepted.includes(captured.exitCode) && !captured.timedOut,
+    detail,
+    exitCode: captured.exitCode,
+    stdout: captured.stdout,
+    stderr: captured.stderr,
+    timedOut: captured.timedOut,
+  }
+}

package/studio/server/client-package.ts

@@ -2,6 +2,8 @@ import { existsSync, readFileSync, statSync } from 'node:fs'
 import { isAbsolute, join, relative, resolve } from 'node:path'
 import { parse as parseYaml } from 'yaml'
 
+import { asJsonRecord, asStringArray, parseJson } from './json'
+
 export type ClientPackageResolution =
   | {
       status: 'available'
@@ -203,7 +205,29 @@ function packageWorkspacePatterns(pkg?: PackageManifest): string[] {
 }
 
 function readPackage(packageFile: string): PackageManifest {
-  return JSON.parse(readFileSync(packageFile, 'utf8')) as PackageManifest
+  const record = asJsonRecord(parseJson(readFileSync(packageFile, 'utf8')))
+  if (!record) throw new TypeError('package.json must contain an object')
+  const scriptsRecord = asJsonRecord(record.scripts)
+  const scripts = scriptsRecord
+    ? Object.fromEntries(
+        Object.entries(scriptsRecord).filter(
+          (entry): entry is [string, string] => typeof entry[1] === 'string',
+        ),
+      )
+    : undefined
+  let workspaces: PackageManifest['workspaces']
+  const workspaceList = asStringArray(record.workspaces)
+  if (workspaceList) {
+    workspaces = workspaceList
+  } else {
+    const workspaceObject = asJsonRecord(record.workspaces)
+    const packages = asStringArray(workspaceObject?.packages)
+    if (workspaceObject) workspaces = packages ? { packages } : {}
+  }
+  return {
+    ...(scripts === undefined ? {} : { scripts }),
+    ...(workspaces === undefined ? {} : { workspaces }),
+  }
 }
 
 function previewScript(pkg?: PackageManifest): string | undefined {

package/studio/server/domain.test.ts

@@ -20,8 +20,8 @@ afterEach(() => {
   while (roots.length) rmSync(roots.pop()!, { recursive: true, force: true })
 })
 
-function fixture(entry: 'implementation.ts' | 'domain.ts'): string {
-  const root = mkdtempSync(join(tmpdir(), 'studio-domain-layout-'))
+function fixture(entry: 'implementation.ts' | 'domain.ts', parent = tmpdir()): string {
+  const root = mkdtempSync(join(parent, 'studio-domain-layout-'))
   roots.push(root)
   mkdirSync(join(root, 'schema'), { recursive: true })
   writeFileSync(join(root, 'astrale.config.ts'), 'export default {}\n')
@@ -65,3 +65,31 @@ test('prefers implementation.ts when both composition entries exist', () => {
 
   expect(basename(resolveDomainEntry(root)!)).toBe('implementation.ts')
 })
+
+test('recognizes only an SDK that resolves from the Domain through an autonomous hoist', () => {
+  const isolatedWorkspace = mkdtempSync(join(tmpdir(), 'studio-domain-no-hoist-'))
+  roots.push(isolatedWorkspace)
+  mkdirSync(join(isolatedWorkspace, 'packages'))
+  const isolatedRoot = fixture('implementation.ts', join(isolatedWorkspace, 'packages'))
+  expect(depsInstalled(isolatedRoot)).toBe(false)
+
+  const hoistedWorkspace = mkdtempSync(join(tmpdir(), 'studio-domain-hoist-'))
+  roots.push(hoistedWorkspace)
+  mkdirSync(join(hoistedWorkspace, 'packages'))
+  mkdirSync(join(hoistedWorkspace, 'node_modules', '@astrale-os', 'sdk'), { recursive: true })
+  writeFileSync(
+    join(hoistedWorkspace, 'node_modules', '@astrale-os', 'sdk', 'package.json'),
+    JSON.stringify({
+      name: '@astrale-os/sdk',
+      type: 'module',
+      exports: { './schema': './schema.js' },
+    }),
+  )
+  writeFileSync(
+    join(hoistedWorkspace, 'node_modules', '@astrale-os', 'sdk', 'schema.js'),
+    'export const schema = {}\n',
+  )
+  const hoistedRoot = fixture('implementation.ts', join(hoistedWorkspace, 'packages'))
+
+  expect(depsInstalled(hoistedRoot)).toBe(true)
+})

package/studio/server/domain.ts

@@ -83,11 +83,23 @@ export function allDomains(): DomainHandle[] {
 
 /** Does the domain have the dependency cohort required by its project layout installed? */
 export function depsInstalled(root: string): boolean {
-  const sdk = existsSync(join(root, 'node_modules', '@astrale-os', 'sdk'))
+  const installed = (packageDir: string, specifier: string): boolean => {
+    if (existsSync(join(root, 'node_modules', '@astrale-os', packageDir))) return true
+    try {
+      Bun.resolveSync(specifier, root)
+      return true
+    } catch {
+      return false
+    }
+  }
+
+  // A workspace may hoist the package above the Domain root. Check both the
+  // conventional local link and Bun's real resolver from the Domain boundary.
+  const sdk = installed('sdk', '@astrale-os/sdk/schema')
   const entry = resolveDomainEntry(root)
 
   // implementation.ts is an SDK boundary by contract. Legacy domain.ts
   // projects may predate the SDK facade and depend on kernel-core directly.
   if (entry?.endsWith('implementation.ts')) return sdk
-  return sdk || existsSync(join(root, 'node_modules', '@astrale-os', 'kernel-core'))
+  return sdk || installed('kernel-core', '@astrale-os/kernel-core')
 }

package/studio/server/environment/dotenv-preview.test.ts

@@ -0,0 +1,39 @@
+import { expect, test } from 'bun:test'
+
+import { parseDotenvPreview } from './dotenv-preview'
+
+test('environment preview mirrors the SDK declared-secrets subset without mutating process.env', () => {
+  const keys = ['BASE', 'EXPANDED', 'LITERAL', 'EMPTY'] as const
+  const before = Object.fromEntries(keys.map((key) => [key, process.env[key]]))
+  const seeded = {
+    BASE: 'process-base',
+    EXPANDED: 'process-expanded',
+    LITERAL: 'process-literal',
+    EMPTY: 'process-empty',
+  } as const
+  Object.assign(process.env, seeded)
+
+  try {
+    const values = parseDotenvPreview(`
+BASE=alpha
+EXPANDED="${'${BASE}'}/beta"
+LITERAL='${'${BASE}'}/beta'
+export EMPTY=
+# IGNORED=value
+`)
+
+    expect(values).toEqual({
+      BASE: 'alpha',
+      EXPANDED: 'alpha/beta',
+      LITERAL: '${BASE}/beta',
+      EMPTY: '',
+    })
+    expect(Object.fromEntries(keys.map((key) => [key, process.env[key]]))).toEqual(seeded)
+  } finally {
+    for (const key of keys) {
+      const value = before[key]
+      if (value === undefined) delete process.env[key]
+      else process.env[key] = value
+    }
+  }
+})

package/studio/server/environment/dotenv-preview.ts

@@ -0,0 +1,27 @@
+/**
+ * Isolated preview of an adapter secrets file for Studio's editor.
+ *
+ * The SDK adapter remains authoritative when deploying. It is not a runtime
+ * dependency of the raw Studio server shipped inside the CLI package, so this
+ * isolated parser intentionally mirrors only the SDK's documented dotenv
+ * subset and never mutates process.env.
+ */
+export function parseDotenvPreview(contents: string): Record<string, string> {
+  const values: Record<string, string> = {}
+  for (const raw of contents.split('\n')) {
+    const line = raw.trim()
+    if (!line || line.startsWith('#')) continue
+    const match = /^(?:export\s+)?([A-Za-z_]\w*)\s*=\s*(.*)$/.exec(line)
+    if (!match) continue
+    const key = match[1]!
+    let value = match[2]!.trim()
+    const singleQuoted = value.length >= 2 && value.startsWith("'") && value.endsWith("'")
+    if (singleQuoted || (value.length >= 2 && value.startsWith('"') && value.endsWith('"'))) {
+      value = value.slice(1, -1)
+    }
+    values[key] = singleQuoted
+      ? value
+      : value.replace(/\$\{(\w+)\}/g, (_, name: string) => values[name] ?? '')
+  }
+  return values
+}

package/studio/server/environment/files.test.ts

@@ -0,0 +1,53 @@
+import { afterEach, expect, test } from 'bun:test'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+import { readEnvModel } from './files'
+
+const roots: string[] = []
+
+afterEach(() => {
+  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true })
+})
+
+test('env editor composes typed fields with isolated config and dotenv previews', () => {
+  const root = mkdtempSync(join(tmpdir(), 'studio-env-preview-'))
+  roots.push(root)
+  writeFileSync(
+    join(root, 'env.ts'),
+    `export interface Env {
+  /** API credential. */
+  API_TOKEN: string
+  OPTIONAL_NOTE?: string
+  WORKER_URL: string
+}`,
+  )
+  writeFileSync(
+    join(root, 'astrale.config.ts'),
+    `// astrale({ dev: { secrets: '.env.fake' } })
+export default cloudflare({ dev: { secrets: '.env.dev' } })`,
+  )
+  writeFileSync(join(root, '.env.dev'), `BASE=token\nAPI_TOKEN="${'${BASE}'}-value"\nORPHAN=kept\n`)
+
+  expect(readEnvModel(root, 'dev')).toEqual({
+    env: 'dev',
+    file: '.env.dev',
+    configured: true,
+    exists: true,
+    adapter: 'cloudflare',
+    requiredMissing: 0,
+    rows: [
+      {
+        name: 'API_TOKEN',
+        value: 'token-value',
+        declared: true,
+        optional: false,
+        doc: 'API credential.',
+      },
+      { name: 'OPTIONAL_NOTE', value: '', declared: true, optional: true },
+      { name: 'BASE', value: 'token', declared: false, optional: true },
+      { name: 'ORPHAN', value: 'kept', declared: false, optional: true },
+    ],
+  })
+})

package/studio/server/{state/env.ts → environment/files.ts}

@@ -1,5 +1,5 @@
 /**
- * env.ts — the env-vars editor backend. Reconciles a domain's `.env.<env>` file
+ * Environment file editor. Reconciles a domain's `.env.<env>` file
  * (the actual secrets/vars, dotenv format) against the `Env` interface in
  * `env.ts` (the typed contract, parsed by buildEnvFields), and is the ONE place
  * the otherwise read-only studio writes a domain file — the explicit exception
@@ -16,6 +16,8 @@ import { join, resolve } from 'node:path'
 import type { EnvFileModel, EnvName, EnvVarRow } from '../../shared/types'
 
 import { buildEnvFields } from '../introspect/anatomy-extras'
+import { readConfigPreview } from '../introspect/config-preview'
+import { parseDotenvPreview } from './dotenv-preview'
 
 const ENV_NAMES: EnvName[] = ['dev', 'prod']
 export const isEnvName = (v: unknown): v is EnvName =>
@@ -25,55 +27,12 @@ export const isEnvName = (v: unknown): v is EnvName =>
  *  and every domain uses. The filename is fixed, so no path-traversal is possible. */
 const envFileName = (env: EnvName) => `.env.${env}`
 
-/** Mirror of the SDK's minimal dotenv parser (`@astrale-os/sdk` cli/dotenv) so the
- *  studio reads values exactly as the deploy path will: `#` comments, `export`,
- *  quotes (single = literal), `${VAR}` interpolation against earlier keys. */
-function parseDotenv(contents: string): Record<string, string> {
-  const out: Record<string, string> = {}
-  for (const raw of contents.split('\n')) {
-    const line = raw.trim()
-    if (!line || line.startsWith('#')) continue
-    const m = /^(?:export\s+)?([A-Za-z_]\w*)\s*=\s*(.*)$/.exec(line)
-    if (!m) continue
-    let value = m[2].trim()
-    const single = value.length >= 2 && value.startsWith("'") && value.endsWith("'")
-    if (single || (value.length >= 2 && value.startsWith('"') && value.endsWith('"')))
-      value = value.slice(1, -1)
-    out[m[1]] = single ? value : value.replace(/\$\{(\w+)\}/g, (_, n: string) => out[n] ?? '')
-  }
-  return out
-}
-
-/** astrale.config.ts with comments stripped — so a COMMENTED-OUT adapter block
- *  (e.g. the scaffold's "swap to cloudflare" example) never reads as active config.
- *  The `[^:]` guard keeps `https://` in URLs from being mistaken for a line comment. */
-function configText(root: string): string {
-  let s: string
-  try {
-    s = readFileSync(join(root, 'astrale.config.ts'), 'utf8')
-  } catch {
-    return ''
-  }
-  return s.replace(/\/\*[\s\S]*?\*\//g, '').replace(/(^|[^:])\/\/.*$/gm, '$1')
-}
-
-/** Is this `.env.<env>` wired into astrale.config's ACTIVE `secrets:`? (vs convention only) */
-function isConfigured(config: string, env: EnvName): boolean {
-  return new RegExp(`secrets\\s*:\\s*['"]\\.env\\.${env}['"]`).test(config)
-}
-
-function adapterOf(config: string): EnvFileModel['adapter'] {
-  if (/\bastrale\s*\(/.test(config)) return 'astrale'
-  if (/\bcloudflare\s*\(/.test(config)) return 'cloudflare'
-  return 'unknown'
-}
-
 /** Build the merged model for one env: env.ts fillable fields ⨯ the `.env.<env>` values. */
 export function readEnvModel(root: string, env: EnvName): EnvFileModel {
   const file = envFileName(env)
   const abs = join(root, file)
   const exists = existsSync(abs)
-  const values = exists ? parseDotenv(readFileSync(abs, 'utf8')) : {}
+  const values = exists ? parseDotenvPreview(readFileSync(abs, 'utf8')) : {}
 
   // env.ts contract — only fillable (non-binding) fields; bindings are adapter-injected.
   const declared = buildEnvFields(root).filter((f) => f.secret)
@@ -92,13 +51,13 @@ export function readEnvModel(root: string, env: EnvName): EnvFileModel {
   }
 
   const requiredMissing = rows.filter((r) => r.declared && !r.optional && r.value === '').length
-  const config = configText(root)
+  const config = readConfigPreview(root)
   return {
     env,
     file,
-    configured: isConfigured(config, env),
+    configured: config.configuredSecretFiles.includes(file),
     exists,
-    adapter: adapterOf(config),
+    adapter: config.adapter,
     rows,
     requiredMissing,
   }