@codemarc/blt 1.6.2 → 1.6.4

package/README.md

@@ -17,6 +17,7 @@
 - **Bucket**: Supabase storage — list buckets, list/upload/download files, get URLs
 - **Workflow**: List, show, delete, reload, and deploy GitHub Actions workflows (requires `gh`)
 - **Show**: Schema info, row counts, env vars, DB version, repo list
+- **Env**: Decrypt trailz `.trailz/env/.env.<name>.bin` to `.env` via smash (`blt env get`; requires `SMASH_KEY`)
 - **Cleanup**: Remove generated SQL/instance files, clean infrequently used YAML tags
 
 ## Installation
@@ -74,6 +75,7 @@ blt deploy schema
 | `blt workflow`| list, show, delete, reload, deploy   |
 | `blt bucket`  | names, list, upload, download, url, clear |
 | `blt show`    | schema, counts, env, db, repo       |
+| `blt env`     | get (decrypt trailz env to `.env`)   |
 | `blt cleanup` | generated, tags                      |
 
 Run `blt <command>` with no subcommand for help (e.g. `blt image`, `blt pdf`).
@@ -733,6 +735,20 @@ blt show repo --ssh
 
 ---
 
+## Env Commands
+
+### `blt env get <name>`
+
+Decrypt using `smash -n`. Ciphertext must be at `.trailz/env/.env.<name>.bin`; the CLI invokes smash with **`.env.<name>` (no `.bin`)** — that matches `@codemarc/smashdata`, which reads `${path}.bin` for decrypt. Set **`SMASH_KEY`** in your environment (same as when you encrypted). Writes plaintext to `.env` in the current directory.
+
+```bash
+blt env get laf
+```
+
+Equivalent to `smash -n .trailz/env/.env.laf >.env` from the project root when `.trailz/env/.env.laf.bin` exists.
+
+---
+
 ## Cleanup Commands
 
 ### `blt cleanup generated`
@@ -768,7 +784,7 @@ blt cleanup tags joanne --min-count 2 --dry-run
 
 ## Environment Variables
 
-Bucket and database operations typically use Supabase configuration (e.g. from `.env`). The `blt show env` command displays BLT core environment variables.
+Bucket and database operations typically use Supabase configuration (e.g. from `.env`). The `blt show env` command displays BLT core environment variables. To materialize `.env` from a committed encrypted file under `.trailz/env/`, use `blt env get <name>`.
 
 ---
 

package/dist/blt

@@ -12,6 +12,7 @@ import cleanupCommand from "./commands/cleanup";
 import workflowCommand from "./commands/workflow";
 import waiCommand from "./commands/wai";
 import templateCommand from "./commands/template";
+import envCommand from "./commands/env";
 import { join, dirname } from "node:path";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -37,6 +38,7 @@ cleanupCommand(program);
 workflowCommand(program);
 waiCommand(program);
 templateCommand(program);
+envCommand(program);
 // If no command is provided, show help
 const args = process.argv.slice(2);
 if (args.length === 0) {

package/dist/blt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blt.d.ts","sourceRoot":"","sources":["../src/blt.ts"],"names":[],"mappings":";AAuBA,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C"}
+{"version":3,"file":"blt.d.ts","sourceRoot":"","sources":["../src/blt.ts"],"names":[],"mappings":";AAwBA,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C"}

package/dist/blt.js.map

@@ -1 +1 @@
-{"version":3,"file":"blt.js","sourceRoot":"","sources":["../src/blt.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,aAAa,MAAM,mBAAmB,CAAC;AAC9C,OAAO,YAAY,MAAM,kBAAkB,CAAC;AAC5C,OAAO,aAAa,MAAM,mBAAmB,CAAC;AAC9C,OAAO,YAAY,MAAM,kBAAkB,CAAC;AAC5C,OAAO,WAAW,MAAM,iBAAiB,CAAC;AAC1C,OAAO,UAAU,MAAM,gBAAgB,CAAC;AACxC,OAAO,cAAc,MAAM,oBAAoB,CAAC;AAChD,OAAO,WAAW,MAAM,iBAAiB,CAAC;AAC1C,OAAO,cAAc,MAAM,oBAAoB,CAAC;AAChD,OAAO,eAAe,MAAM,qBAAqB,CAAC;AAClD,OAAO,UAAU,MAAM,gBAAgB,CAAC;AACxC,OAAO,eAAe,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AACtC,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,EAAG,IAAI,EAAE,cAAc,CAAC,CAAC;AAE/D,MAAM,UAAU,iBAAiB;IAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACtE,OAAO,WAAW,CAAC,OAAO,CAAC;AAC7B,CAAC;AAED,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;KACjB,OAAO,CAAC,iBAAiB,EAAE,CAAC;KAC5B,WAAW,CAAC,cAAc,CAAC,CAAC;AAE5B,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,eAAe,CAAC,OAAO,CAAC,CAAC;AAE3B,uCAAuC;AACvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;IACtB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AACD,OAAO,CAAC,GAAG,EAAE,CAAC"}
+{"version":3,"file":"blt.js","sourceRoot":"","sources":["../src/blt.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,aAAa,MAAM,mBAAmB,CAAC;AAC9C,OAAO,YAAY,MAAM,kBAAkB,CAAC;AAC5C,OAAO,aAAa,MAAM,mBAAmB,CAAC;AAC9C,OAAO,YAAY,MAAM,kBAAkB,CAAC;AAC5C,OAAO,WAAW,MAAM,iBAAiB,CAAC;AAC1C,OAAO,UAAU,MAAM,gBAAgB,CAAC;AACxC,OAAO,cAAc,MAAM,oBAAoB,CAAC;AAChD,OAAO,WAAW,MAAM,iBAAiB,CAAC;AAC1C,OAAO,cAAc,MAAM,oBAAoB,CAAC;AAChD,OAAO,eAAe,MAAM,qBAAqB,CAAC;AAClD,OAAO,UAAU,MAAM,gBAAgB,CAAC;AACxC,OAAO,eAAe,MAAM,qBAAqB,CAAC;AAClD,OAAO,UAAU,MAAM,gBAAgB,CAAC;AAExC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AACtC,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,EAAG,IAAI,EAAE,cAAc,CAAC,CAAC;AAE/D,MAAM,UAAU,iBAAiB;IAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACtE,OAAO,WAAW,CAAC,OAAO,CAAC;AAC7B,CAAC;AAED,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;KACjB,OAAO,CAAC,iBAAiB,EAAE,CAAC;KAC5B,WAAW,CAAC,cAAc,CAAC,CAAC;AAE5B,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,UAAU,CAAC,OAAO,CAAC,CAAC;AAEtB,uCAAuC;AACvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;IACtB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AACD,OAAO,CAAC,GAAG,EAAE,CAAC"}

package/dist/commands/env/get.d.ts

@@ -0,0 +1,7 @@
+import type { Logger } from "@caporal/core";
+/**
+ * Decrypt `.trailz/env/.env.<name>.bin` with smash (`-n`) and write plaintext to `.env`.
+ * Invokes smash with path `.trailz/env/.env.<name>` (no `.bin`) so smash reads `${path}.bin`.
+ */
+export declare function envGet(name: string, logger: Logger): Promise<void>;
+//# sourceMappingURL=get.d.ts.map

package/dist/commands/env/get.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../src/commands/env/get.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAwB5C;;;GAGG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCxE"}

package/dist/commands/env/get.js

@@ -0,0 +1,55 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+/** Single path segment for `.env.<name>` under `.trailz/env/`. */
+const NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+/**
+ * `@codemarc/smashdata` `smash` expects the **plaintext path** `tf` (e.g. `.env.laf`).
+ * Ciphertext must live at `${tf}.bin`. If you pass `tf` = `.env.laf.bin`, that file
+ * exists as `tf`, so smash treats it as plaintext and **re-encrypts** — output is garbage.
+ */
+function resolveSmashCommand(cwd) {
+    const binSmash = join(cwd, "node_modules", ".bin", "smash");
+    const script = join(cwd, "node_modules", "@codemarc", "smashdata", "smash");
+    if (existsSync(binSmash)) {
+        return [binSmash];
+    }
+    if (existsSync(script)) {
+        return ["node", script];
+    }
+    return ["bunx", "@codemarc/smashdata"];
+}
+/**
+ * Decrypt `.trailz/env/.env.<name>.bin` with smash (`-n`) and write plaintext to `.env`.
+ * Invokes smash with path `.trailz/env/.env.<name>` (no `.bin`) so smash reads `${path}.bin`.
+ */
+export async function envGet(name, logger) {
+    if (!NAME_RE.test(name)) {
+        logger.error("Invalid environment name: use one segment (letters, numbers, . _ -).");
+        process.exit(1);
+    }
+    const cwd = process.cwd();
+    const dir = join(cwd, ".trailz", "env");
+    /** Plaintext path smash expects; ciphertext is `${basePath}.bin`. */
+    const basePath = join(dir, `.env.${name}`);
+    const binPath = `${basePath}.bin`;
+    if (!existsSync(binPath)) {
+        logger.error(`Encrypted env not found (need ciphertext at):\n  ${binPath}\n` +
+            `Smash stores secrets in .env.<name>.bin; the argument to smash is .env.<name> without .bin.`);
+        process.exit(1);
+    }
+    const smashCmd = resolveSmashCommand(cwd);
+    const proc = Bun.spawnSync({
+        cmd: [...smashCmd, "-n", basePath],
+        cwd,
+        env: process.env,
+        stdout: "pipe",
+        stderr: "inherit",
+    });
+    if (proc.exitCode !== 0) {
+        process.exit(proc.exitCode ?? 1);
+    }
+    const outPath = join(cwd, ".env");
+    await Bun.write(outPath, proc.stdout);
+    logger.info(`Wrote ${outPath}`);
+}
+//# sourceMappingURL=get.js.map

package/dist/commands/env/get.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../src/commands/env/get.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,kEAAkE;AAClE,MAAM,OAAO,GAAG,8BAA8B,CAAC;AAE/C;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5E,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,MAAc;IACxD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,CACX,sEAAsE,CACtE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACxC,qEAAqE;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,GAAG,QAAQ,MAAM,CAAC;IAElC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,KAAK,CACX,oDAAoD,OAAO,IAAI;YAC9D,6FAA6F,CAC9F,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC;QAC1B,GAAG,EAAE,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC;QAClC,GAAG;QACH,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,SAAS;KACjB,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,CAAC,IAAI,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;AACjC,CAAC"}

package/dist/commands/env.d.ts

@@ -0,0 +1,3 @@
+import type { Program } from "@caporal/core";
+export default function envCommand(program: Program): void;
+//# sourceMappingURL=env.d.ts.map

package/dist/commands/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/commands/env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiC,OAAO,EAAE,MAAM,eAAe,CAAC;AAG5E,MAAM,CAAC,OAAO,UAAU,UAAU,CAAC,OAAO,EAAE,OAAO,QA2ClD"}

package/dist/commands/env.js

@@ -0,0 +1,37 @@
+import { envGet } from "./env/get";
+export default function envCommand(program) {
+    const envHelpText = `
+env utilities (trailz / smash)
+
+Usage:
+  blt env <operation>
+
+Available operations:
+  get <name>   Decrypt .trailz/env/.env.<name>.bin with smash and write .env (invokes smash with .env.<name> path; see @codemarc/smashdata)
+
+Requires: SMASH_KEY, ciphertext at .trailz/env/.env.<name>.bin, and smash (@codemarc/smashdata) via node_modules or bunx.
+
+Run 'blt env get --help' for more information.
+`;
+    program
+        .command("env", "decrypt trailz env to .env")
+        .help(envHelpText)
+        .action(() => {
+        console.log(envHelpText);
+    });
+    program
+        .command("env get", "Decrypt named trailz env to .env")
+        .hide()
+        .argument("<name>", "Environment name (ciphertext: .trailz/env/.env.<name>.bin)")
+        .action(async ({ args, logger, }) => {
+        try {
+            await envGet(args.name, logger);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            logger.error(message);
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=env.js.map

package/dist/commands/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/commands/env.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC,MAAM,CAAC,OAAO,UAAU,UAAU,CAAC,OAAgB;IAClD,MAAM,WAAW,GAAG;;;;;;;;;;;;CAYpB,CAAC;IAED,OAAO;SACL,OAAO,CAAC,KAAK,EAAE,4BAA4B,CAAC;SAC5C,IAAI,CAAC,WAAW,CAAC;SACjB,MAAM,CAAC,GAAG,EAAE;QACZ,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEJ,OAAO;SACL,OAAO,CAAC,SAAS,EAAE,kCAAkC,CAAC;SACtD,IAAI,EAAE;SACN,QAAQ,CAAC,QAAQ,EAAE,4DAA4D,CAAC;SAChF,MAAM,CACN,KAAK,EAAE,EACN,IAAI,EACJ,MAAM,GAIN,EAAE,EAAE;QACJ,IAAI,CAAC;YACJ,MAAM,MAAM,CAAC,IAAI,CAAC,IAAc,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;IACF,CAAC,CACD,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codemarc/blt",
-  "version": "1.6.2",
+  "version": "1.6.4",
   "description": "blt cli",
   "type": "module",
   "main": "dist/blt",