@devdogsuga/devtools 0.1.26 → 0.1.27

package/dist/local-env-D8HC2JK_.js

@@ -0,0 +1,351 @@
+import { i as ownPackageDir, r as findRepoRoot } from "./root-C2OmZDwD.js";
+import { a as repoPeerUrl, n as loadEnv, t as getEnvSync } from "./peers-RBplwovA.js";
+import { register } from "node:module";
+import { existsSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { pathToFileURL } from "node:url";
+//#region ../cli-core/src/repo/peer-redirect.ts
+/**
+* Points one module's bare import of a peer at the copy the target repo
+* resolved (`repo/peers.ts`).
+*
+* devtools' own `env.ts` manifest imports `@devdogsuga/env` by bare
+* specifier, and from an installed copy that specifier resolves relative to
+* the manifest's own location: inside the pnpm store, next to devtools,
+* where an optional peer is never installed under `pnpm dlx`. The import
+* failed with ERR_MODULE_NOT_FOUND, and every `env` command with it. Even
+* where the specifier does resolve (devtools installed as a devDependency),
+* the only copy that keeps the registry's module identity is the one the
+* repo's manifests use, so the redirect is applied whenever that copy is
+* known rather than only as a fallback.
+*
+* Node resolve hooks (`module.register`) rather than rewriting the file: the
+* manifest also imports `zod`, which has to keep resolving from devtools'
+* own location, and a copy written anywhere else would lose that.
+*/
+/** Registers `redirect`. Hooks cannot be unregistered, so each call adds a
+*  loader for the rest of the process; call it once per redirect. */
+function redirectPeer(redirect) {
+	register("./peer-redirect-hooks.js", import.meta.url, { data: [redirect] });
+}
+//#endregion
+//#region ../cli-core/src/repo/tsx-loader.ts
+/**
+* Loads the repo's own TypeScript at runtime: env manifests
+* (each app's `src/env.ts` and friends), cron contracts
+* (each app's `cloudflare/scheduled.ts`), and — via `source.ts` — the
+* `devdogs-source` condition packages (`open-graph`, `email`, `docs`).
+*
+* Uses `tsx`'s programmatic API (`register()` from `tsx/esm/api`), NOT the
+* `--conditions=devdogs-source` CLI flag the old in-repo devtools used —
+* this package ships built JS and runs from `dist/`, so there is no `tsx`
+* process wrapping it anymore (see the package README / CUTOVER note on
+* "built JS, tsx only for repo TS").
+*
+* Gotcha (FINDINGS.md experiments 3 and 4, gotcha C): do NOT pass a
+* `namespace` to `register()`. It silently breaks tsx's own relative
+* `./foo.js` → `./foo.ts` extension-fallback resolution for files loaded
+* under that registration — exactly the convention `open-graph`, `email`,
+* and any future `devdogs-source` package use for their internal relative
+* imports. `register({})` (no options) is the only form validated.
+*/
+let registered = false;
+/** Idempotent: registers tsx's ESM loader hooks once per process. */
+async function ensureRegistered() {
+	if (registered) return;
+	const { register } = await import("tsx/esm/api");
+	register();
+	registered = true;
+}
+/**
+* Imports a repo TypeScript file at an absolute path, loaded through tsx.
+* Returns the module namespace, typed as `T` by the caller (there is no way
+* to know the shape of an arbitrary repo file's exports statically here).
+*/
+async function importRepoTs(absolutePath) {
+	await ensureRegistered();
+	return import(pathToFileURL(absolutePath).href);
+}
+//#endregion
+//#region ../cli-core/src/env/discovery.ts
+/**
+* Fills the `@devdogsuga/env` registry by importing every manifest.
+*
+* The registry populates as a SIDE EFFECT of importing each manifest module.
+* `declare()` runs at import time, so a process that never imports them sees an
+* empty registry and every derived selector returns nothing. That is the
+* fail-open shape this module closes: anything that routes secrets calls
+* `loadRegistry()` first, and `assertRegistryLoaded()` is the guard the
+* selectors' consumers use to refuse an empty answer.
+*
+* Discovery is by filename, per the model doc: `src/env.ts`, then `env.ts`, per
+* workspace package. Both present is a hard error, because two manifests in one
+* package means two places for the next declaration to land and no rule saying
+* which. No `package.json` pointer: every other tool in this repo is found by
+* filename (`tsconfig.json`, `wrangler.jsonc`, `supadart.yaml`), and a pointer
+* would be the only one of its kind.
+*
+* One special case: `supabase/env.ts` sits at the repo root, OUTSIDE the
+* workspace globs. Its variables belong to `config.toml` and the Supabase
+* CLI, not to any package, so it lives next to the config that reads them.
+*
+* `@devdogsuga/env` itself (the package that exports `define()`/`declare()`)
+* no longer needs a special-case exclusion here: since the Backstage
+* cutover it is an installed npm dependency, not a workspace package under
+* `packages/`, so this scan never sees it at all.
+*
+* devtools' OWN operator manifest (this package's root `env.ts` — the keys
+* no app reads at all: `BWS_ACCESS_TOKEN`, `CLOUDFLARE_API_TOKEN`, and
+* friends) has the same problem in reverse: since the Backstage cutover
+* devtools is no longer one of the TARGET repo's workspace packages either,
+* so the scan below would never see it. It is loaded unconditionally,
+* always, regardless of which repo devtools is running against — see
+* `ownManifestPath()`'s own comment for how it stays resolvable both from a
+* workspace checkout and from an installed `pnpm dlx`/`node_modules` copy,
+* and for why loading it through the same `importRepoTs()` tsx path as
+* every other manifest (rather than a plain static `import`) is what keeps
+* its `declare()`/`define()` calls landing in the SAME `@devdogsuga/env`
+* registry instance the target repo's manifests populate (module identity —
+* see `repo/peers.ts`'s header and the devtools-dlx prototype's
+* FINDINGS.md experiment 3). Its bare `@devdogsuga/env` import is
+* redirected to the copy `loadEnv()` resolved through the repo, because
+* from a `pnpm dlx` copy the specifier does not resolve at all: devtools
+* ships no copy of its own (`@devdogsuga/env` is only ever an optional
+* peer), and nothing installs one next to it. See `repo/peer-redirect.ts`.
+*
+* Most workspace packages declare nothing, so "no env.ts found" means
+* not-a-manifest rather than an error.
+*
+* ⚠️ `apps/sandbox` was once listed here as having no manifest ON PURPOSE, on
+* the grounds that a Worker reads bindings that arrive as a function argument
+* rather than `process.env`. That premise is still true and the conclusion
+* drawn from it was still wrong: a manifest is also the only thing that routes
+* a credential to a deployed environment and the only thing that tells
+* `env audit` a Worker secret is supposed to be there. Without one,
+* `SANDBOX_PROXY_TOKEN`, minted at deploy time and therefore in no Bitwarden
+* project by design, was reported as an orphan, i.e. as safe for the §3.6 prune
+* path to delete. `apps/sandbox/env.ts` exists now, and states that reasoning
+* at length.
+*/
+/**
+* The single in-flight (or settled) load.
+*
+* Node's module cache already makes a second `import()` of the same manifest a
+* no-op, but memoizing the whole pass is asserted here rather than inherited: a
+* future bundler or test runner that re-evaluates modules would duplicate every
+* declaration, and duplicated declarations are what the completeness test
+* treats as a bug. A failed load stays failed. Every later call gets the same
+* rejection, because retrying into a half-populated registry would hide the
+* manifest that broke.
+*/
+let loaded;
+/**
+* Imports every manifest so the registry populates. Idempotent; concurrent
+* callers share one pass. Await this before touching any derived selector.
+*/
+function loadRegistry() {
+	loaded ??= importManifests();
+	return loaded;
+}
+/**
+* Refuses to proceed on an empty registry.
+*
+* For SYNC consumers of the derived selectors (`selectForPush`, `routeTo`),
+* which cannot await the load themselves. An empty registry makes every
+* selector return `[]`, and `[]` fails open in the worst direction: nothing is
+* never-store, so `BWS_ACCESS_TOKEN` would upload. Better a crash naming the
+* missing call than a push that quietly stores the unstorable.
+*/
+function assertRegistryLoaded() {
+	if (getEnvSync().variables().size === 0) throw new Error("The env registry is empty — no manifest has been imported, so the derived key sets would all be []. Await loadRegistry() (from devtools' env/discovery.ts) before routing or selecting secrets.");
+}
+async function importManifests() {
+	await loadEnv();
+	const envUrl = repoPeerUrl("@devdogsuga/env");
+	if (envUrl) redirectPeer({
+		parentURL: pathToFileURL(ownManifestPath()).href,
+		specifier: "@devdogsuga/env",
+		url: envUrl
+	});
+	const previous = process.env.SKIP_ENV_VALIDATION;
+	process.env.SKIP_ENV_VALIDATION = "1";
+	try {
+		for (const path of manifestPaths()) try {
+			await importRepoTs(path);
+		} catch (cause) {
+			throw new Error(`The env manifest at ${path} failed to import.`, { cause });
+		}
+	} finally {
+		if (previous === void 0) delete process.env.SKIP_ENV_VALIDATION;
+		else process.env.SKIP_ENV_VALIDATION = previous;
+	}
+}
+/**
+* Every manifest file, in a stable order.
+*
+* The workspace members are enumerated by scanning `apps/*` and `packages/*`
+* plus the literal `docs`, a deliberately boring mirror of the three globs in
+* `pnpm-workspace.yaml` rather than a YAML parse: the globs have not changed
+* since the workspace existed, devtools carries no YAML dependency, and a new
+* top-level glob would already mean editing more interesting files than this
+* one.
+*/
+function manifestPaths() {
+	const paths = [];
+	for (const dir of workspaceDirs()) {
+		const manifest = manifestIn(dir);
+		if (manifest) paths.push(manifest);
+	}
+	const supabase = manifestIn(join(findRepoRoot(), "supabase"));
+	if (supabase) paths.push(supabase);
+	paths.push(ownManifestPath());
+	return paths;
+}
+/**
+* The absolute path to devtools' own `env.ts`, resolved relative to THIS
+* module's own file rather than the target repo — it ships alongside
+* `dist/` (see `package.json`'s `files`), not inside the target repo's
+* workspace, so `findRepoRoot()`/`workspaceDirs()` can never find it.
+*
+* The package root is `ownPackageDir()`: `env.ts` sits there, deliberately
+* outside `src/` (see that file's own header, and `tsconfig.typecheck.json`,
+* which includes it as a sibling of `src` for exactly that reason). Same file,
+* same relative shape, in both a workspace checkout
+* (`packages/devtools/env.ts`) and an installed copy
+* (`node_modules/@devdogsuga/devtools/env.ts`).
+*/
+function ownManifestPath() {
+	return join(ownPackageDir(), "env.ts");
+}
+function workspaceDirs() {
+	const dirs = [];
+	const repoRoot = findRepoRoot();
+	for (const parent of ["apps", "packages"]) {
+		const names = [];
+		for (const entry of readdirSync(join(repoRoot, parent), { withFileTypes: true })) {
+			if (!entry.isDirectory()) continue;
+			if (entry.name === "node_modules" || entry.name.startsWith(".")) continue;
+			names.push(entry.name);
+		}
+		names.sort();
+		for (const name of names) dirs.push(join(repoRoot, parent, name));
+	}
+	dirs.push(join(repoRoot, "docs"));
+	return dirs;
+}
+/** `src/env.ts`, then `env.ts`; both present in one package is a hard error. */
+function manifestIn(dir) {
+	const inSrc = join(dir, "src", "env.ts");
+	const atRoot = join(dir, "env.ts");
+	const hasSrc = existsSync(inSrc);
+	const hasRoot = existsSync(atRoot);
+	if (hasSrc && hasRoot) throw new Error(`${dir} has BOTH src/env.ts and env.ts. One package gets one manifest — two of them means two places for the next declaration to land, and no rule saying which. Merge them.`);
+	return hasSrc ? inSrc : hasRoot ? atRoot : null;
+}
+//#endregion
+//#region src/cf/local-env.ts
+function renderWranglerEnvFile(keys, environment) {
+	return keys.flatMap((key) => {
+		const value = environment[key];
+		return value === void 0 ? [] : [`${key}='${value}'`];
+	}).join("\n") + "\n";
+}
+/** The app's declared keys, deduped and sorted, from the given entries or the
+* loaded registry.
+*
+* `DEPLOY_ENV` and `NODE_ENV` are excluded BY NAME, not by any registry-meta
+* heuristic. Their committed source is wrangler.jsonc's per-env `vars` blocks
+* (and the framework), never an env file — see each key's `define()` doc.
+* Materializing them into the temp `.dev.vars` this file feeds to `wrangler
+* dev` lets a stray or empty `.env` value OVERRIDE the tier's wrangler var,
+* which surfaced as a Workflow isolate reading a blank `DEPLOY_ENV` and
+* throwing "has no HYPERDRIVE binding".
+*
+* A `scope: "default"` + `commented: true` filter was tried first and is
+* WRONG: that shape also matches `GITHUB_COMPETITION_REPO`, an opt-in
+* override a contributor sets deliberately in their `.env` (its wrangler
+* config defines no such var), and the heuristic silently stripped it from
+* `wrangler dev`'s environment. Wrangler-ownership is a fact about
+* wrangler.jsonc, not about registry metadata, so the two keys it is true
+* for are named outright. */
+const WRANGLER_OWNED_KEYS = /* @__PURE__ */ new Set(["DEPLOY_ENV", "NODE_ENV"]);
+async function scopedKeys(app, entries) {
+	if (!entries) {
+		await loadRegistry();
+		entries = (await loadEnv()).declarations();
+	}
+	return [...new Set(entries.filter((entry) => entry.source === app).filter((entry) => !WRANGLER_OWNED_KEYS.has(entry.key)).map((entry) => entry.key))].sort();
+}
+/**
+* The process env for a `vinext dev` child, scoped the way the temp
+* `.dev.vars` is for `wrangler dev`.
+*
+* `@cloudflare/vite-plugin` has no `--env-file`: it reads the app dir's own
+* `.dev.vars`/`.env`, or — with `CLOUDFLARE_INCLUDE_PROCESS_ENV` — its whole
+* `process.env`, as Worker vars that override wrangler.jsonc's `vars`. So the
+* scoping happens on the child's env instead: every key some OTHER app
+* declares (and this app doesn't) is dropped, `NODE_ENV` is left to Vite, and
+* `DEPLOY_ENV` is pinned to the tier rather than dropped, because the Vite
+* process's own `next.config.ts` reads it too. Undeclared keys (PATH, HOME,
+* pnpm's own) stay; the child needs them and they carry no app secrets.
+*/
+async function scopedProcessEnv(app, environment, tier, entries) {
+	if (!entries) {
+		await loadRegistry();
+		entries = (await loadEnv()).declarations();
+	}
+	const own = new Set(await scopedKeys(app, entries));
+	const scoped = { ...environment };
+	for (const entry of entries) if (entry.source !== app && !own.has(entry.key)) delete scoped[entry.key];
+	delete scoped.NODE_ENV;
+	scoped.DEPLOY_ENV = tier;
+	scoped.CLOUDFLARE_INCLUDE_PROCESS_ENV = "true";
+	return scoped;
+}
+/** Writes the mode-0600 `.dev.vars` into a fresh private temp directory. */
+function materializeEnvFile(keys, environment) {
+	const directory = mkdtempSync(join(tmpdir(), "devtools-wrangler-env-"));
+	const path = join(directory, ".dev.vars");
+	writeFileSync(path, renderWranglerEnvFile(keys, environment), {
+		encoding: "utf8",
+		mode: 384
+	});
+	return {
+		directory,
+		path
+	};
+}
+/**
+* Create an app-scoped, mode-0600 env file for a local Worker runtime whose
+* lifetime a single bracket callback cannot express.
+*
+* ⚠️ KEPT DELIBERATELY, not an oversight: `workflows/commands.ts` holds this
+* file open across a long-lived `wrangler dev` child process, and in the
+* `workflows run` temporary-session path that span crosses a `finally` that
+* is unrelated to starting Wrangler at all — it also triggers a Workflow and
+* polls for its completion before the session stops. Squeezing that into a
+* single `withWranglerEnv` callback would mean merging two previously
+* independent concerns (spinning up a dev session; triggering-and-waiting)
+* into one control path, which is a real redesign of a 700-line orchestrator,
+* not a mechanical bracket swap — and duplicating this function's
+* retry/readiness loop across a bracket-shaped variant just to convert the
+* `workflows serve` half would fragment one shared, tested implementation
+* into two for no behavioural gain.
+*
+* `env` mirrors `withWranglerEnv`'s `options.env`: pass a tier's loaded map to
+* materialize a scoped file from THAT tier rather than the inherited process
+* environment; omit it to keep today's behavior.
+*/
+async function createTemporaryWranglerEnv(app, env) {
+	const { directory, path } = materializeEnvFile(await scopedKeys(app), env ?? process.env);
+	return {
+		path,
+		remove: () => rmSync(directory, {
+			recursive: true,
+			force: true
+		})
+	};
+}
+//#endregion
+export { loadRegistry as a, assertRegistryLoaded as i, renderWranglerEnvFile as n, scopedProcessEnv as r, createTemporaryWranglerEnv as t };

package/dist/local-env-DrBCXqD8.js

@@ -0,0 +1,2 @@
+import { r as scopedProcessEnv } from "./local-env-D8HC2JK_.js";
+export { scopedProcessEnv };