@devdogsuga/devtools 0.1.25 → 0.1.27

package/dist/env/audit.js

@@ -1,436 +0,0 @@
-/**
- * Four-way drift detection: local `.env`, Bitwarden, GitHub, Cloudflare.
- *
- * Each store answers a different question, and only one of them answers it
- * completely:
- *
- *   | Store              | Exposes           | So it can be checked for |
- *   |--------------------|-------------------|--------------------------|
- *   | local .env         | names AND values  | value drift              |
- *   | Bitwarden          | names AND values  | value drift (the truth)  |
- *   | GitHub *secrets*   | names + updatedAt | presence, staleness      |
- *   | GitHub *variables* | names AND values  | value drift              |
- *   | Cloudflare         | names only        | presence, orphans        |
- *
- * That asymmetry is the whole design. A GitHub *secret* is write-only, so a
- * clean audit of one does not mean "the values match". It means "nothing
- * detectable is wrong", and the report says which is which rather than implying
- * the stronger claim.
- *
- * Timestamps are what rescue that row from being presence-only. Bitwarden
- * reports a `revisionDate` per secret and `gh secret list` reports `updatedAt`,
- * so "was GitHub updated after Bitwarden last changed?" IS answerable. That is
- * the failure this design actually has: a credential rotated in Bitwarden and
- * never propagated, which a name-only check calls healthy right up until the old
- * one is revoked.
- *
- * ⚠️ GitHub *variables* are the one downstream store that needs none of that
- * reasoning: `gh variable list` returns the value, so the public per-environment
- * keys are compared exactly the way the local file is. Staleness is deliberately
- * NOT applied to them: a timestamp is a proxy for a comparison that could not
- * be made, and using the proxy where the real answer is available would report a
- * variable re-pushed with an identical value as drift. The security plan's §3.6
- * limitation ("names only… a changed value is undetectable") now holds for the
- * secret row alone.
- *
- * ⚠️ One scope sits outside that table altogether: the repository's OWN
- * variables. Push writes environment-scoped values only, and an environment
- * variable SHADOWS a repository one of the same name, so a repository-level
- * copy of a managed key is read by nothing, drifts forever, and becomes the
- * live value on the day somebody deletes the environment copy. It is checked
- * here for the same reason §3.6's orphans are: nothing manages it, so nothing
- * else in this system would ever mention it.
- */
-export function audit(input) {
-    const ignore = input.ignore ?? new Set();
-    const neverStore = input.neverStore ?? new Set();
-    const minted = input.minted ?? new Set();
-    const commented = input.localCommented ?? new Set();
-    const variables = input.variables ?? new Set();
-    const githubVariables = input.githubVariables ?? [];
-    const findings = [];
-    const relevant = (key) => !ignore.has(key) && !neverStore.has(key) && !minted.has(key);
-    // ── must not be stored anywhere remote ─────────────────────────────────────
-    // Checked first and reported as errors. `BWS_ACCESS_TOKEN` in a Bitwarden
-    // project is a key locked inside the box it opens; in GitHub it would give CI
-    // the ability to read every secret we have.
-    for (const key of neverStore) {
-        if (input.bws.has(key)) {
-            findings.push({
-                key,
-                severity: "error",
-                store: "local",
-                summary: "must NEVER be stored in Bitwarden — delete it from the project; " +
-                    "it belongs in the Password Manager vault, exported per shell",
-            });
-        }
-        for (const copy of input.github.filter((g) => g.name === key)) {
-            findings.push({
-                key,
-                severity: "error",
-                store: "github",
-                summary: `must NEVER be a GitHub secret — delete it from \`${copy.environment}\`; ` +
-                    "nothing machine-shaped may authenticate to Secrets Manager",
-            });
-        }
-        for (const [worker, names] of input.cloudflare ?? []) {
-            if (!names.has(key))
-                continue;
-            findings.push({
-                key,
-                severity: "error",
-                store: "cloudflare",
-                summary: `must NEVER be a Worker secret — delete it from ${worker}`,
-            });
-        }
-    }
-    // ── minted at deploy time ──────────────────────────────────────────────────
-    // Cloudflare is deliberately NOT checked: that is where these belong, and
-    // saying so is the entire point of the category. What IS checked is the two
-    // stores a minted credential must never reach, because a copy in either is a
-    // long-lived token nobody rotates sitting beside one that rotates every
-    // deploy, and the stale copy is the one an operator will reach for when
-    // something breaks.
-    for (const key of minted) {
-        if (input.bws.has(key)) {
-            findings.push({
-                key,
-                severity: "error",
-                store: "local",
-                summary: "is minted at deploy time and must not be stored in Bitwarden — " +
-                    "delete it from the project; the deploy signs a fresh one and " +
-                    "writes it straight to the Worker",
-            });
-        }
-        for (const copy of input.github.filter((g) => g.name === key)) {
-            findings.push({
-                key,
-                severity: "error",
-                store: "github",
-                summary: `is minted at deploy time and must not be a GitHub secret — delete ` +
-                    `it from \`${copy.environment}\`; what CI needs is the signing key, ` +
-                    "not a token somebody minted once",
-            });
-        }
-    }
-    // ── in the wrong GitHub store ──────────────────────────────────────────────
-    // Errors, and reported before the drift passes, because both directions are
-    // silent misconfigurations that a presence check calls healthy: the NAME is
-    // in GitHub either way.
-    for (const copy of input.github) {
-        if (!relevant(copy.name) || !variables.has(copy.name))
-            continue;
-        findings.push({
-            key: copy.name,
-            severity: "error",
-            store: "github",
-            summary: `is public and is a SECRET on \`${copy.environment}\` — delete it and ` +
-                "let push set it as a variable; GitHub masks a secret's value in logs " +
-                "by substring, which redacts the very links and hostnames it appears in",
-        });
-    }
-    for (const copy of githubVariables) {
-        if (!relevant(copy.name) || variables.has(copy.name))
-            continue;
-        // Only for a key the registry calls a secret. An unrecognised name in the
-        // variable store is an orphan from a rename, reported as one below.
-        // Calling it a leaked secret would be a guess, and a loud wrong one. With
-        // no declared set there is no way to tell the two apart, so neither fires.
-        if (!input.declared?.has(copy.name))
-            continue;
-        findings.push({
-            key: copy.name,
-            severity: "error",
-            store: "github",
-            summary: `is a secret and is a VARIABLE on \`${copy.environment}\` — its value ` +
-                "is readable by anyone who can see the repository's Actions config, " +
-                "and it is not masked in logs. Delete it there and rotate it",
-        });
-    }
-    // ── repository-level variables ─────────────────────────────────────────────
-    // The scope push never writes to, and the one a presence check cannot see
-    // from inside an environment.
-    //
-    // ⚠️ An ENVIRONMENT variable SHADOWS a repository variable of the same name.
-    // So a repository-level `AIRTABLE_BASE_ID`, which people were told to set by
-    // hand before push started routing that key, is not merely redundant: it is
-    // unreadable from every job, holds whatever it held the day it was set, and
-    // becomes live the moment somebody deletes the environment copy. Nothing
-    // manages it and nothing else here would ever mention it, which makes it the
-    // same failure as the §3.6 orphan audit rather than a new one.
-    const repository = input.repositoryVariables;
-    if (repository !== undefined && !repository.readable) {
-        // A finding, in the same list as the rest, rather than a line printed
-        // underneath it: the whole hazard of this check is that its absence looks
-        // like health, and a clean report with a quiet caveat below it reads as
-        // clean. The key is parenthesised so it cannot be mistaken for one.
-        findings.push({
-            key: "(repository variables)",
-            severity: "warning",
-            store: "github",
-            summary: "could not check — listing the repository's own variables failed " +
-                `(${repository.reason}). This run rules out NOTHING at that scope; a ` +
-                "repository variable shadowed by an environment copy would look " +
-                "exactly like this report. Run `gh variable list` by hand",
-        });
-    }
-    const repositoryNames = repository?.readable ? repository.names : [];
-    for (const name of repositoryNames) {
-        // Membership in `variables` IS the declaration test for this branch, since
-        // the set comes from the registry, which is why it does not also consult
-        // `declared`. A caller that passed one and forgot the other would
-        // otherwise get silence from the check it asked for.
-        if (variables.has(name)) {
-            if (!relevant(name))
-                continue;
-            findings.push({
-                key: name,
-                severity: "warning",
-                store: "github",
-                summary: "is also a REPOSITORY-level GitHub variable, which push does not " +
-                    "manage — the environment copy shadows it, so every job reads the " +
-                    "environment value and this one is invisible, stale, and unnoticed " +
-                    "until somebody deletes that copy, whereupon it silently becomes " +
-                    `the live value. Delete it: \`gh variable delete ${name}\``,
-            });
-            continue;
-        }
-        // A name the registry calls a SECRET, sitting in the readable store one
-        // scope up. The environment-level version of this is an error above, and
-        // this is the same finding with the shadowing sentence removed, because
-        // there is none: secrets and variables are separate namespaces, so nothing
-        // hides this one.
-        //
-        // ⚠️ Filtered on `ignore` alone, deliberately NOT on the whole of
-        // `relevant()`. An ignored key legitimately lives outside these stores.
-        // `GITHUB_ORG` is a committed constant, and a repository variable holding
-        // it is somebody making a reasonable choice. A never-store or minted
-        // credential in the READABLE store is the worst case this file knows
-        // about, not an exempt one, so those two fall through to the error.
-        //
-        // `declared` is required here for the reason it is required above: without
-        // it an unrecognised name is indistinguishable from another team's
-        // variable, and calling that a leaked secret would be a loud guess.
-        if (ignore.has(name))
-            continue;
-        if (!input.declared?.has(name))
-            continue;
-        findings.push({
-            key: name,
-            severity: "error",
-            store: "github",
-            summary: "is a secret and is a REPOSITORY-level GitHub variable — its value " +
-                "is readable by anyone who can see the repository's Actions config, " +
-                "and no environment copy hides it: secrets and variables are separate " +
-                `namespaces. Delete it (\`gh variable delete ${name}\`) and rotate it`,
-        });
-    }
-    // ── undeclared keys ────────────────────────────────────────────────────────
-    // Reported once, here, and then excluded from the drift comparisons below:
-    // an undeclared key is invisible to push routing, so "in your .env, not in
-    // Bitwarden" would be true and useless, since pushing cannot fix it.
-    const undeclared = (key) => input.declared !== undefined && !input.declared.has(key);
-    for (const key of input.local.keys()) {
-        if (!relevant(key) || !undeclared(key))
-            continue;
-        findings.push({
-            key,
-            severity: "warning",
-            store: "local",
-            summary: "in your .env but declared in no env manifest — push skips it. " +
-                "Declare it with define() in the owning package's env.ts, or remove " +
-                "the line",
-        });
-    }
-    // ── local vs Bitwarden ─────────────────────────────────────────────────────
-    // The only VALUE comparison available anywhere in this system.
-    for (const [key, value] of input.local) {
-        if (!relevant(key) || undeclared(key))
-            continue;
-        const truth = input.bws.get(key);
-        if (truth === undefined) {
-            findings.push({
-                key,
-                severity: "warning",
-                store: "local",
-                summary: "in your .env, not in Bitwarden — either a local-only value or one " +
-                    "somebody forgot to push",
-            });
-        }
-        else if (truth.value !== value) {
-            findings.push({
-                key,
-                severity: "error",
-                store: "local",
-                summary: "your .env disagrees with Bitwarden — pull to take theirs, push to " +
-                    "take yours",
-            });
-        }
-    }
-    for (const key of input.bws.keys()) {
-        if (!relevant(key))
-            continue;
-        if (!input.local.has(key)) {
-            findings.push({
-                key,
-                severity: commented.has(key) ? "info" : "warning",
-                store: "local",
-                summary: commented.has(key)
-                    ? "commented out in your .env; Bitwarden has a value"
-                    : "in Bitwarden, missing from your .env",
-            });
-        }
-    }
-    // ── Bitwarden vs GitHub ────────────────────────────────────────────────────
-    // One pass over both stores. Which one a key is compared against is decided
-    // by the registry, not by where the key happened to turn up. Otherwise a
-    // misplaced copy would define its own correctness and never be reported.
-    for (const [key, entry] of input.bws) {
-        if (!relevant(key))
-            continue;
-        const expected = input.route(key);
-        if (expected === null)
-            continue;
-        const accepted = input.accepted ??
-            ((_key, environment) => environment === expected);
-        const isVariable = variables.has(key);
-        const noun = isVariable ? "variable" : "secret";
-        const pool = isVariable
-            ? githubVariables
-            : input.github;
-        const copies = pool.filter((g) => g.name === key);
-        const here = copies.find((g) => g.environment === expected);
-        // A copy somewhere it does not belong. Listed FIRST because for the
-        // apply-only credentials this is the reviewer gate failing open: the token
-        // is sitting in an environment that deploys with nobody in front of it.
-        //
-        // `accepted`, not `!== expected`: `production-apply` legitimately holds a
-        // second copy of most production keys. An apply-tier key in `production`
-        // still lands here, which is the case this finding exists for.
-        for (const stray of copies.filter((g) => !accepted(key, g.environment))) {
-            findings.push({
-                key,
-                severity: "error",
-                store: "github",
-                summary: `also set as a ${noun} on \`${stray.environment}\`, which is not ` +
-                    `where it belongs (\`${expected}\`) — delete it there`,
-            });
-        }
-        if (!here) {
-            findings.push({
-                key,
-                severity: "error",
-                store: "github",
-                summary: `in Bitwarden, NOT a ${noun} on the \`${expected}\` GitHub ` +
-                    "environment — the deploy cannot see it",
-            });
-            continue;
-        }
-        // The comparison a secret cannot have. Kept distinct from the missing case
-        // above on purpose: "absent" is fixed by a push, "drifted" means somebody
-        // edited the value in the GitHub UI and the two stores now disagree about
-        // which is real, and the fix has to start by deciding that.
-        if (isVariable) {
-            const mine = githubVariables.find((g) => g.name === key && g.environment === expected);
-            if (mine !== undefined && mine.value !== entry.value) {
-                findings.push({
-                    key,
-                    severity: "error",
-                    store: "github",
-                    summary: `the \`${expected}\` GitHub variable's VALUE disagrees with ` +
-                        "Bitwarden — push to overwrite GitHub, or fix Bitwarden if the " +
-                        "edit there was the deliberate one",
-                });
-            }
-            continue;
-        }
-        if (isStale(entry.revisionDate, here.updatedAt)) {
-            findings.push({
-                key,
-                severity: "error",
-                store: "github",
-                summary: "rotated in Bitwarden after GitHub was last updated — the deploy is " +
-                    "still using the previous value",
-            });
-        }
-    }
-    for (const copy of input.github) {
-        if (!relevant(copy.name))
-            continue;
-        if (!input.bws.has(copy.name)) {
-            findings.push({
-                key: copy.name,
-                severity: "warning",
-                store: "github",
-                summary: `in the \`${copy.environment}\` GitHub environment, not in ` +
-                    "Bitwarden — an orphan from a rename or a removal",
-            });
-        }
-    }
-    for (const copy of githubVariables) {
-        if (!relevant(copy.name))
-            continue;
-        if (!input.bws.has(copy.name)) {
-            findings.push({
-                key: copy.name,
-                severity: "warning",
-                store: "github",
-                summary: `a variable on the \`${copy.environment}\` GitHub environment, not ` +
-                    "in Bitwarden — an orphan from a rename or a removal",
-            });
-        }
-    }
-    // ── Bitwarden vs Cloudflare ────────────────────────────────────────────────
-    // Presence only, and asymmetric on purpose: a Worker holding a secret nobody
-    // stores is an orphan worth reporting, but a secret NOT on a given Worker is
-    // usually correct -- DISCORD_TOKEN belongs to platform and nothing else.
-    // `--secrets-file` preserves what it omits, so orphans persist indefinitely.
-    for (const [worker, names] of input.cloudflare ?? []) {
-        for (const name of names) {
-            if (!relevant(name))
-                continue;
-            if (!input.bws.has(name)) {
-                findings.push({
-                    key: name,
-                    severity: "warning",
-                    store: "cloudflare",
-                    summary: `on ${worker}, not in Bitwarden — a renamed or dropped variable leaves its secret behind`,
-                });
-            }
-        }
-    }
-    return findings.sort((a, b) => rank(a.severity) - rank(b.severity) || a.key.localeCompare(b.key));
-}
-/**
- * True when GitHub's copy predates the Bitwarden revision.
- *
- * A missing or unparseable date on either side returns false. A comparison
- * against `NaN` is false anyway, so this only makes that explicit. The reason
- * to be explicit is that the alternative reading, "unknown means stale",
- * turns one malformed timestamp into a report that says everything is behind,
- * after which nobody reads it, including on the run where something really is.
- */
-function isStale(revisionDate, updatedAt) {
-    if (!revisionDate || !updatedAt)
-        return false;
-    const revised = Date.parse(revisionDate);
-    const updated = Date.parse(updatedAt);
-    if (Number.isNaN(revised) || Number.isNaN(updated))
-        return false;
-    return updated < revised;
-}
-function rank(s) {
-    return s === "error" ? 0 : s === "warning" ? 1 : 2;
-}
-export function hasErrors(findings) {
-    return findings.some((f) => f.severity === "error");
-}
-export function renderFindings(findings) {
-    if (findings.length === 0) {
-        return "No detectable drift.";
-    }
-    const mark = { error: "✗", warning: "!", info: "·" };
-    return findings
-        .map((f) => `${mark[f.severity]} ${f.key}  ${f.summary}`)
-        .join("\n");
-}

package/dist/env/cloudflare.d.ts

@@ -1,21 +0,0 @@
-import { workerApps } from "../workers.js";
-/** Re-exported so existing importers of this module (e.g. `deploy/orphans.ts`,
- * this file's own tests) do not need to know the list moved to `workers.ts`.
- * A function, not a top-level constant — see `workers.ts`'s header on why
- * eagerly reading `workers.json` at import time broke `--help`/`setup`
- * outside a repo. */
-export { workerApps };
-export declare class CloudflareError extends Error {
-}
-/**
- * Secret names per Worker for one target.
- *
- * A Worker that fails to read comes back as an empty set rather than a throw,
- * and the caller is told which ones could not be read. A Worker that has never
- * been deployed is the common case during setup, and it must not stop the audit
- * from reporting everything it CAN see.
- */
-export declare function listWorkerSecrets(target: string): Promise<{
-    secrets: Map<string, Set<string>>;
-    unreadable: string[];
-}>;

package/dist/env/cloudflare.js

@@ -1,61 +0,0 @@
-/**
- * Reading the secret NAMES set on each Worker.
- *
- * Cloudflare never returns a secret's value, so this contributes presence only.
- * That is still worth having: `wrangler deploy --secrets-file` **preserves what
- * it omits**, so a renamed or dropped variable leaves its secret on the Worker
- * indefinitely, and nothing else in the system can see it.
- */
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-import { join } from "node:path";
-import { findRepoRoot } from "../repo/root.js";
-import { workerApps } from "../workers.js";
-const run = promisify(execFile);
-/** Re-exported so existing importers of this module (e.g. `deploy/orphans.ts`,
- * this file's own tests) do not need to know the list moved to `workers.ts`.
- * A function, not a top-level constant — see `workers.ts`'s header on why
- * eagerly reading `workers.json` at import time broke `--help`/`setup`
- * outside a repo. */
-export { workerApps };
-export class CloudflareError extends Error {
-}
-/**
- * Secret names per Worker for one target.
- *
- * A Worker that fails to read comes back as an empty set rather than a throw,
- * and the caller is told which ones could not be read. A Worker that has never
- * been deployed is the common case during setup, and it must not stop the audit
- * from reporting everything it CAN see.
- */
-export async function listWorkerSecrets(target) {
-    const secrets = new Map();
-    const unreadable = [];
-    for (const app of workerApps()) {
-        const worker = `${target}-${app}`;
-        try {
-            const { stdout } = await run("pnpm", [
-                "exec",
-                "wrangler",
-                "secret",
-                "list",
-                // ⚠️ WRANGLER's `--env`, not ours. Our flag is `--target`; this one
-                // names a wrangler.jsonc environment block and must keep its spelling.
-                "--env",
-                target,
-                "--format",
-                "json",
-            ], { cwd: join(findRepoRoot(), "apps", app), shell: false });
-            // wrangler prints its banner on stdout too, so take the JSON array only.
-            const start = stdout.indexOf("[");
-            const parsed = start === -1
-                ? []
-                : JSON.parse(stdout.slice(start));
-            secrets.set(worker, new Set(parsed.map((s) => s.name)));
-        }
-        catch {
-            unreadable.push(worker);
-        }
-    }
-    return { secrets, unreadable };
-}

package/dist/env/commands.d.ts

@@ -1,99 +0,0 @@
-import type { EnvTarget } from "@devdogsuga/env";
-import { type VaultTarget } from "../bws/environments.js";
-import { EnvDocument } from "./document.js";
-export interface EnvOptions {
-    /**
-     * Typed as any `EnvTarget` rather than a `VaultTarget`, on purpose.
-     * `development` has to REACH these commands so each can refuse it by name.
-     * Narrowing here would move the refusal back into the argument parser, which
-     * is where it was missing.
-     */
-    target: EnvTarget;
-    /** Overrides the file the target implies. */
-    file?: string;
-    yes?: boolean;
-}
-/**
- * Writes the document, tidying first.
- *
- * `group()` runs on every write rather than as its own command: files drift a
- * line at a time, and a tidy pass nobody remembers to run is a tidy pass that
- * never happens.
- *
- * Env files contain credentials and must not be world-readable. The mode
- * parameter only applies on creation, so existing world-readable files are
- * tightened with chmod after each write.
- */
-export declare function save(path: string, doc: EnvDocument): Promise<boolean>;
-/**
- * Brings Bitwarden's values into the target's env file, in place.
- *
- * ⚠️ With `--file .env` (or `--target development`, which is refused) this is
- * the file `pnpm dev` reads. Pulling `production` into it points local
- * development at production, which is why that target warns and defaults its
- * confirmation to no.
- */
-export declare function runEnvPull(options: EnvOptions): Promise<void>;
-/**
- * Sends the target's env file to Bitwarden and then on to GitHub.
- *
- * Both, always. Bitwarden alone is the failure this design has: the source of
- * truth moves, the deploy does not, and everything looks healthy until the old
- * credential is revoked.
- *
- * ⚠️ The file comes from the TARGET. `--target staging` reads `.env.staging`,
- * not the root `.env`. That defaulting mistake meant this command uploaded a
- * developer's own values to a shared project and said "3 created, 12 updated"
- * about it.
- *
- * ⚠️ Two GitHub stores on the far side, and only one Bitwarden project. The
- * public per-environment values become GitHub *variables* rather than secrets
- * (see `gh/client.ts` for why the store matters), but they are stored in
- * Bitwarden alongside the secrets, because "Bitwarden is the source of truth"
- * has to be true of a WHOLE target for `pull` to rebuild a working env file.
- * Splitting them would make GitHub the only home for 27 keys and the second
- * source of truth for their values, which is the arrangement this tool exists
- * to remove.
- */
-export declare function runEnvPush(options: EnvOptions): Promise<void>;
-/**
- * The second half of every push.
- *
- * One Bitwarden project can feed more than one GitHub environment: `production`
- * feeds both `production` and `production-apply`, and which key goes where IS
- * the reviewer gate. So this loops over the routed targets rather than assuming
- * one, and confirms each separately. Agreeing to update production's ordinary
- * secrets is not agreeing to touch the two write-capable credentials sitting
- * behind the reviewers.
- *
- * The two maps stay two maps all the way down to the two `gh` calls. Merging
- * them and branching at the bottom would put "which store does this go to?" one
- * boolean away from being wrong, and getting it wrong in the variable direction
- * publishes a credential's plaintext to everyone who can read the repository's
- * Actions config.
- *
- * Exported ONLY so dispatch can be tested against a mocked `gh` client. The two
- * `setSecret`/`setVariable` lines below are the one place where a swap is
- * silent, irreversible, and invisible to `selection.ts`'s tests.
- */
-export declare function pushToGithub(target: VaultTarget, secrets: Map<string, string>, publicValues: Map<string, string>, yes?: boolean): Promise<void>;
-/** Read-only, and safe to run against anything. */
-export declare function runEnvAudit(options: EnvOptions): Promise<void>;
-/**
- * Empties every value in a local env file, losing none of them.
- *
- * The use is handing a filled-in file back to its blank state: after pulling
- * production onto a laptop, before passing a machine on, or when a set of keys
- * has to be re-entered from scratch. Deleting the values would do that too, and
- * would also delete the only copy of anything that was never pushed. So each
- * becomes a commented line holding what it was, plus an empty active line
- * beneath. The file still declares every key it needs, which makes it a
- * checklist rather than a blank page.
- *
- * Purely local. It touches no remote store, so it takes no `--target`: asking
- * which target to clear a file against would imply it reaches one. It works on
- * `.env` unless `--file` says otherwise, and that default is written out here
- * rather than inherited, so the shared `pathFor` has no "no target" case for a
- * remote command to fall into.
- */
-export declare function runEnvReset(options: Pick<EnvOptions, "file" | "yes">): Promise<void>;