@devdogsuga/devtools 0.1.50 → 0.1.51-next.527

package/dist/load-Cp8AMERM.js

@@ -0,0 +1,640 @@
+//#region ../sdk/dist/env/targets.js
+/**
+* The env TARGETS: one row per thing a command can be pointed at.
+*
+*   | `--target`    | File              | Bitwarden project | `DEPLOY_ENV`? |
+*   |---------------|-------------------|-------------------|---------------|
+*   | `development` | `.env`            | none              | yes           |
+*   | `preflight`   | `.env.preflight`  | `preflight`       | **no**        |
+*   | `staging`     | `.env.staging`    | `staging`         | yes           |
+*   | `production`  | `.env.production` | `production`      | yes           |
+*
+* ⚠️ ONE TABLE, ON PURPOSE. This used to be two enums that overlapped in the
+* middle and diverged at both ends: a `DeployEnvironment`
+* (`development | staging | production`, deciding WHICH FILE) in this package,
+* and a `BwsEnvironment` (`preflight | staging | production`, deciding WHICH
+* VAULT PROJECT) in devtools, behind a single `--env` flag that meant whichever
+* of the two the subcommand happened to import. That was not a type error
+* anywhere, because the words `staging` and `production` are in both:
+*
+*   * `init --env staging` created `.env.staging`, mapping target → file;
+*   * `push --env staging` read the root `.env`, because its path helper
+*     defaulted there and only honoured an explicit `--file`.
+*
+* So generating `.env.staging`, filling it in, and pushing it uploaded the
+* DEVELOPMENT file to the staging vault project and reported success. In the
+* other direction `MissingEnvFileError` told people to run a pull that wrote
+* staging values into the development `.env` and never created the file the
+* error was about, so the error repeated.
+*
+* Neither subcommand was wrong about its own enum, so the fix is a smaller
+* vocabulary rather than a better check: one row per target, every per-target
+* fact read from that row, and the two old enums derived as SUBSETS of it
+* (`DeployEnvironment`, `VaultTarget`) rather than maintained beside it. A
+* future subcommand can pick a wrong target; it can no longer pick the wrong
+* vocabulary.
+*
+* Two rows are asymmetric, and both asymmetries are deliberate:
+*
+*   * **`development` has no vault project.** `.env` is one contributor's own
+*     file, and there is no shared "development" set of credentials to sync it
+*     against. `pull`/`push`/`audit` refuse it by name rather than falling
+*     through to some default project.
+*   * **`preflight` is not a deploy environment.** `.env.preflight` is a
+*     staging area for pushing credentials into the preflight vault project;
+*     nothing ever boots from it. See `resolveEnvironment()` below.
+*
+* `.env` IS development rather than a base the others extend, and that is the
+* whole design. A base file plus overlays sounds tidier and fails in one
+* specific way: a variable present in `.env` and forgotten in
+* `.env.production` silently falls through to the development value while
+* `DEPLOY_ENV` says production. Standalone files make that a validation error
+* instead of a wrong answer.
+*
+* There is no `local` alongside `development`. To most people they are
+* synonyms, and a distinction nobody can state is a distinction people get
+* wrong.
+*/
+/**
+* Ordered least- to most-dangerous, and the order is load-bearing: it is what
+* the interactive picker lists, so a reflexive Enter never lands on production.
+*/
+const TARGETS = {
+	development: {
+		file: ".env",
+		project: null,
+		deployEnv: true,
+		guarded: false
+	},
+	preflight: {
+		file: ".env.preflight",
+		project: "preflight",
+		deployEnv: false,
+		guarded: false
+	},
+	staging: {
+		file: ".env.staging",
+		project: "staging",
+		deployEnv: true,
+		guarded: false
+	},
+	production: {
+		file: ".env.production",
+		project: "production",
+		deployEnv: true,
+		guarded: true
+	}
+};
+const ENV_TARGETS = Object.keys(TARGETS);
+ENV_TARGETS.filter((target) => TARGETS[target].project !== null);
+/**
+* A non-empty tuple type because `z.enum()` requires one, and derived rather
+* than written out because a hand-kept copy is a copy that can disagree with
+* the table. `preflight` is absent here and that is the point, see
+* `resolveEnvironment()`.
+*
+* The emptiness check is real rather than an assertion: an empty list would
+* make `z.enum()` a type error at every app manifest, but only after somebody
+* had already emptied the table, and "no environment is valid" is worth
+* failing on at import.
+*/
+function deployEnvironments() {
+	const [first, ...rest] = ENV_TARGETS.filter((target) => TARGETS[target].deployEnv);
+	if (first === void 0) throw new Error("The target table declares no deploy environments.");
+	return [first, ...rest];
+}
+const DEPLOY_ENVIRONMENTS = deployEnvironments();
+function isDeployEnvironment(value) {
+	return DEPLOY_ENVIRONMENTS.includes(value);
+}
+/** The file a target reads and writes. The ONLY place that mapping is made. */
+function fileFor(target) {
+	return TARGETS[target].file;
+}
+var UnknownEnvironmentError = class extends Error {
+	value;
+	constructor(value) {
+		super(`DEPLOY_ENV="${value}" is not one of ${DEPLOY_ENVIRONMENTS.join(", ")}.`);
+		this.value = value;
+		this.name = "UnknownEnvironmentError";
+	}
+};
+/**
+* Resolves `DEPLOY_ENV` to an environment, refusing anything unrecognised.
+*
+* ⚠️ AN ALLOWLIST, NOT A PARSE, and the difference is not pedantry. Treating
+* the value as a filename suffix means `DEPLOY_ENV=example` loads
+* `.env.example`, a real committed file whose placeholder values pass most of
+* the schema. The app boots, looks configured, and is pointed at nothing.
+*
+* The failure mode of an unrecognised value is worse than "not found" in the
+* other direction too: the old `switchEnvironment()` treated anything that was
+* not `"development"` as deployed, so a stray `DEPLOY_ENV=production-build`
+* applied the strict schemas while every `=== "production"` gate stayed shut.
+* Configured and wrong, in both directions at once.
+*
+* ⚠️ `DEPLOY_ENV=preflight` IS REFUSED, and that is not an oversight left over
+* from the two-enum era. Do not "fix" the inconsistency by adding it. A
+* `preflight` row exists in the table because `.env.preflight` is a staging
+* area for pushing credentials into the preflight vault project: someone runs
+* `env init --target preflight`, fills the file in, and pushes it. Nothing
+* boots from it. The preflight credentials are read-only by construction (a
+* Postgres role that sees only the migrations table), so an app started
+* against them would fail in a scattered, feature-by-feature way rather than
+* at startup. Refusing here is what keeps that failure at the door.
+*/
+function resolveEnvironment(value = process.env.DEPLOY_ENV) {
+	if (value === void 0 || value === "") return "development";
+	if (!isDeployEnvironment(value)) throw new UnknownEnvironmentError(value);
+	return value;
+}
+//#endregion
+//#region ../sdk/dist/env/derivation.js
+/**
+* `$NAME` and `${NAME}`, dotenvx's expansion syntax, restricted to the
+* SHOUTING_CASE shape every declared key has.
+*
+* Anchored on that shape deliberately: a bare `$` in a password or a price is
+* not a reference, and treating one as such would classify a placeholder as a
+* derivation, the exact mistake this module exists to prevent.
+*/
+const REFERENCE = /\$\{([A-Z][A-Z0-9_]*)\}|\$([A-Z][A-Z0-9_]*)/g;
+/** The variable names a value expands from, in order, duplicates included. */
+function envReferences(value) {
+	return [...value.matchAll(REFERENCE)].map((match) => match[1] ?? match[2]);
+}
+/**
+* Expands `$NAME` / `${NAME}` references in `value`, order-independently.
+*
+* A name is resolved first against `raw` — a COMPLETE map of other
+* not-yet-expanded values, typically every key an env file itself declares —
+* recursing into it when the name is there, and only falling back to
+* `resolved` (already-known, fully-expanded values — the rest of the loaded
+* environment) when it is not. Because `raw` is a full map rather than a
+* running accumulator, a name defined LATER in a file than the value
+* referencing it still resolves: this is the fix for dotenvx's own
+* expansion, which is a single left-to-right pass over the file and silently
+* expands a forward reference to `""`, exactly as an undefined one would.
+*
+* A name found in NEITHER map falls back to `""`, matching dotenvx's own
+* behaviour for a genuinely unresolved reference. That is deliberately left
+* alone rather than "fixed": a key declared ahead of its own deployment
+* (`STUDY_GROUP_FINDER_URL` and its `_CALLBACK`, see `write-env.ts`) depends
+* on an unresolved reference staying silent, not becoming a thrown error.
+*
+* Throws when a chain of `raw` references loops back on itself, naming the
+* whole chain — expanding a value that never terminates is a fault in the
+* source file, not something to paper over with another guess. Mirrors
+* `packages/devtools/src/deploy/write-env.ts`'s `expand()`, which resolves
+* the identical formula syntax against a differently-sourced map (GitHub
+* secrets/variables instead of a loaded file) for the same reason: CI
+* composes the file order-independently already, and a local `with-env` load
+* must not depend on which line happened to come first.
+*/
+function expandReferences(key, value, raw, resolved, seen = []) {
+	return value.replace(REFERENCE, (_match, braced, bare) => {
+		const name = braced ?? bare;
+		if (seen.includes(name)) throw new Error(`${key} derives from ${name}, which derives back from it (chain: ${[...seen, name].join(" -> ")}).`);
+		const rawValue = raw.get(name);
+		if (rawValue !== void 0) return expandReferences(name, rawValue, raw, resolved, [...seen, name]);
+		return resolved[name] ?? "";
+	});
+}
+//#endregion
+//#region ../cli-core/src/env-runtime/load.ts
+/**
+* Which env files `with-env` loads. The decision, separated from the doing.
+*
+* `selectEnvFiles()` is pure: environment, file existence and probe result in,
+* ordered file list and warnings out. The CLI wires in the real `existsSync`
+* and the real TCP probe; the tests inject stubs and never open a socket. Keep
+* it that way. The four-row probe table below is the kind of logic that rots
+* when it can only be exercised by spawning processes.
+*
+* ⚠️ This module lives in cli-core, outside `@devdogsuga/sdk/env`, on purpose.
+* The root `"."` export is imported by `apps/platform`, which deploys to
+* Cloudflare Workers; nothing here may ever be re-exported from `index.ts`, or
+* an `import { selectEnvFiles } from "@devdogsuga/sdk/env"` in server code fails at
+* the edge instead of at build. The same is true of `loadEnvironment` below:
+* it dynamically imports `node:fs`/`node:path`/`node:url` and
+* `@dotenvx/dotenvx`, none of which exist at the edge.
+*/
+/**
+* The local Supabase API port. Hardcoded to match `supabase/config.toml`,
+* which itself hardcodes 54321 deliberately: `supabase seed` rejects `env()`
+* interpolation in numeric fields, so the port cannot come from the
+* environment on either side. The file is committed; the number is stable.
+*/
+const LOCAL_STACK_PORT = 54321;
+/** The local-stack connection overlay, written by `start-local-stack`. */
+const GENERATED_FILE = ".env.generated";
+function isDevDatabase(value) {
+	return value === "local" || value === "remote";
+}
+/**
+* The environment variable that carries a session's `DevDatabase` answer to
+* child processes, the same way `DEPLOY_ENV` carries the tier: the devtools
+* launcher asks (or is told) once, exports it, and every nested `with-env`
+* under that session honours the SAME answer instead of re-running the probe
+* — without this, a session that chose `remote` would spawn children that
+* silently re-choose `local` whenever the Docker stack happens to be up.
+*/
+const DEV_DB_ENV = "DEV_DB";
+/**
+* The environment variable that carries the FULL list of key NAMES (comma-
+* separated, values never included) the devtools launcher's own process
+* inherited from the calling shell BEFORE it entered any tier at all — the
+* ONE signal `loadEnvironment`'s default `applyEnvFiles` (below) uses to
+* tell "the user genuinely exported this in their shell" apart from "this
+* looks set only because an EARLIER `enterEnvironment` call in the same
+* session already copied a file value — possibly a stale one, loaded before
+* the local stack was up, or before a failed `db start` finished writing
+* `.env.generated` — onto `process.env`, and every process since has just
+* been inheriting that copy". Only the former is meant to outrank a freshly
+* loaded file, mirroring `with-env`'s classic "a shell var beats the file";
+* the latter is exactly the staleness bug this marker exists to close (see
+* `packages/devtools/src/launch.ts`'s header for the full mechanism).
+*
+* Set exactly once, by the devtools launcher, at the very top of the FIRST
+* process in a session — before it calls `enterEnvironment` at all — from a
+* snapshot of `process.env`'s keys at that moment. Every child (an
+* `enterEnvironment`-entered `next dev`, a nested `pnpm devtools` spawning
+* another launcher, …) re-exports the SAME list unchanged rather than
+* recomputing it: by the time a nested launcher runs, `process.env` no
+* longer reflects "what the shell had", it already holds this session's
+* entered values, and recomputing from it would misclassify every one of
+* them as a genuine shell export.
+*
+* Absence means "outside a devtools session" — a bare `with-env` run with no
+* launcher in front of it, or any caller that never went through
+* `launch.ts` — and `applyEnvFiles` falls back to its long-standing,
+* unqualified "anything already set in the base snapshot wins" rule. Only
+* `override: false` callers ever consult it; an explicit `override: true`
+* (a re-entrant load of a DIFFERENT tier than the process runs under, see
+* `LoadEnvironmentOptions.override`) already overrides everything and has no
+* use for a narrower exemption list.
+*/
+const SHELL_KEYS_ENV = "DEVTOOLS_SHELL_KEYS";
+/**
+* An explicitly `local` development session, but the local Supabase stack is
+* not actually reachable. Thrown instead of falling back to `.env` alone,
+* because that fallback is how a hosted `DB_URL` ends up behind a command
+* that asked for the Docker stack. The message carries its own
+* troubleshooting; callers print it and stop (the devtools launcher exempts
+* `db`/the menu so `db start` can fix the very state being reported).
+*/
+var LocalStackOfflineError = class extends Error {
+	constructor(detail, advice = "Run `pnpm devtools db start` to bring the stack up (and confirm with `supabase status`), or choose the remote development database with `--tier development:remote`.") {
+		super(`the session asked for the local development database, but ${detail} ${advice}`);
+		this.name = "LocalStackOfflineError";
+	}
+};
+/**
+* Wrangler's local Hyperdrive emulator does not read an application's DB_URL.
+* It requires this binding-specific process variable instead. Keep DB_URL as
+* the repository's one source of database credentials and derive Wrangler's
+* alias only in the child-process environment.
+*/
+const HYPERDRIVE_LOCAL_CONNECTION_ENV = "CLOUDFLARE_HYPERDRIVE_LOCAL_CONNECTION_STRING_HYPERDRIVE";
+function applyWranglerLocalDatabaseAlias(environment) {
+	if (environment["CLOUDFLARE_HYPERDRIVE_LOCAL_CONNECTION_STRING_HYPERDRIVE"] === void 0 && environment.DB_URL !== void 0) environment[HYPERDRIVE_LOCAL_CONNECTION_ENV] = environment.DB_URL;
+}
+/**
+* The variables a deployed build reads to learn its tier, all of which say the
+* same thing `DEPLOY_ENV` already does: `CLOUDFLARE_ENV` picks the wrangler
+* environment, `NEXT_PUBLIC_DEPLOY_ENV` is inlined into the client bundle.
+* Naming the tier once, as `DEPLOY_ENV` (or `--tier`), is enough; the build
+* scripts no longer restate it three times.
+*
+* An explicit, non-empty value always wins, so a build can still target a
+* different wrangler environment than the tier it loaded. Development derives
+* nothing: it has no wrangler environment, and the client bundle already
+* defaults to it.
+*
+* Deliberately NOT part of `loadEnvironment`: that also runs in-process inside
+* a devtools session, where a derived value written onto `process.env` would
+* read as "explicitly set" the next time the tier changed. Only the `with-env`
+* child, whose environment is built fresh per run, derives them.
+*/
+function applyDeployTierAliases(environment, tier) {
+	if (tier === "development") return;
+	for (const key of ["CLOUDFLARE_ENV", "NEXT_PUBLIC_DEPLOY_ENV"]) if (environment[key] === void 0 || environment[key] === "") environment[key] = tier;
+}
+/**
+* A minimal, single-line-only `.env` assignment reader, used ONLY to recover
+* a key's UNEXPANDED value so a `$NAME` reference inside it can be resolved
+* order-independently — see `expandReferences` in `derivation.ts`, and the
+* `applyEnvFiles` default below, which is the actual bug fix. It is not a
+* general-purpose parser: dotenvx's own parser (used for everything else —
+* quoting edge cases, encryption, multiline private keys) stays the source of
+* truth for every key this cannot confidently read, which it signals by
+* leaving that key out of the returned map entirely rather than guessing.
+*
+* A key is included only when its whole value fits on one physical line with
+* matched quoting:
+*
+*   * `'...'` — single-quoted. dotenvx never expands these (`quote()` in
+*     `packages/devtools/src/deploy/write-env.ts` relies on exactly this), so
+*     `literal: true` tells the caller not to recurse into it looking for a
+*     reference — a literal `$` in a single-quoted password is not one.
+*   * `"..."` — double-quoted, expandable.
+*   * a bare unquoted value, read to the end of the line (minus a trailing
+*     ` #comment`), also expandable.
+*
+* An unterminated quote — the start of a multiline value like the GitHub
+* App private key — is left out entirely, and so is an `encrypted:` blob or
+* anything else that does not match one of the three shapes above.
+*/
+function parseRawAssignments(text) {
+	const out = /* @__PURE__ */ new Map();
+	for (const line of text.split(/\r?\n/)) {
+		const trimmed = line.trim();
+		if (trimmed === "" || trimmed.startsWith("#")) continue;
+		const assignment = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/.exec(trimmed);
+		if (!assignment) continue;
+		const key = assignment[1];
+		const rest = assignment[2];
+		const doubleQuoted = /^"((?:[^"\\]|\\.)*)"\s*(?:#.*)?$/.exec(rest);
+		if (doubleQuoted) {
+			out.set(key, {
+				raw: doubleQuoted[1],
+				literal: false
+			});
+			continue;
+		}
+		const singleQuoted = /^'([^']*)'\s*(?:#.*)?$/.exec(rest);
+		if (singleQuoted) {
+			out.set(key, {
+				raw: singleQuoted[1],
+				literal: true
+			});
+			continue;
+		}
+		if (rest.startsWith("\"") || rest.startsWith("'")) continue;
+		const hash = rest.search(/\s#/);
+		out.set(key, {
+			raw: (hash === -1 ? rest : rest.slice(0, hash)).trim(),
+			literal: false
+		});
+	}
+	return out;
+}
+/**
+* A selected environment's file is missing. The message names the file and the
+* command that materialises it, because "ENOENT: .env.staging" tells a new
+* contributor nothing about `env pull`.
+*
+* ⚠️ The named command has to actually produce the named file. It did not
+* before: this said `secrets pull --env staging`, whose `--env` was the VAULT
+* vocabulary. So it wrote staging's values into the development `.env`, the
+* file that may hold the only copy of somebody's production credentials, and
+* left `.env.staging` still missing, so the error repeated. `--target` now
+* defaults the file from the same table this message reads.
+*/
+var MissingEnvFileError = class extends Error {
+	environment;
+	file;
+	constructor(environment, file) {
+		super(environment === "development" ? `${file} does not exist. Run \`pnpm devtools setup\` to create it.` : `${file} does not exist. Run \`pnpm devtools env pull --target ${environment}\` to fetch it.`);
+		this.environment = environment;
+		this.file = file;
+		this.name = "MissingEnvFileError";
+	}
+};
+/**
+* Resolves `DEPLOY_ENV` and decides which files to load.
+*
+* Throws `UnknownEnvironmentError` for anything outside the allowlist (never
+* fall through to `.env.${DEPLOY_ENV}`: `DEPLOY_ENV=example` would load the
+* committed placeholder file, largely pass validation, and boot an app pointed
+* at nothing) and `MissingEnvFileError` when the selected file is absent.
+*
+* ⚠️ `.env.generated` IS DEVELOPMENT-ONLY, and the design doc's probe table
+* does not say so because it never imagines otherwise. The overlay holds a
+* local Docker container's connection block, and under `DEPLOY_ENV=staging` or
+* `production` a running container must never shadow the deployed connection
+* values: first-file-wins would silently point a staging build at localhost.
+* So the whole table below is gated on `development`.
+*
+* An explicit `devDatabase` answer overrides the table before it is consulted:
+*
+*   * `"local"` — the overlay is REQUIRED and required LIVE. A dead port or a
+*     missing file throws `LocalStackOfflineError` rather than falling back
+*     to `.env` alone, because `.env` may carry a hosted `DB_URL` and "I
+*     asked for the Docker stack" must never quietly become "a remote
+*     database answered".
+*   * `"remote"` — the overlay is skipped and the port is not even probed:
+*     the session has said which database it means, so a running container
+*     is a fact worth one warning line, not a vote. (Whether the overlay
+*     file exists is still checked, only to phrase that warning.)
+*
+* With no answer, the probe table (file is a hint; the port is the truth):
+*
+*   | `.env.generated` | port 54321 | behaviour                             |
+*   |------------------|------------|---------------------------------------|
+*   | exists           | listening  | prepend it, a first-file-wins overlay |
+*   | exists           | refused    | ignore it, warn: stale                |
+*   | missing          | listening  | warn: regenerate it                   |
+*   | missing          | refused    | hosted project, silent, also normal   |
+*
+* No file-existence rule can distinguish the middle two rows; that is the
+* entire reason the probe exists.
+*/
+async function selectEnvFiles(ctx) {
+	const environment = resolveEnvironment(ctx.deployEnv);
+	const envFile = fileFor(environment);
+	if (!ctx.exists(envFile)) throw new MissingEnvFileError(environment, envFile);
+	const files = [envFile];
+	const warnings = [];
+	if (environment === "development" && ctx.devDatabase === "remote") {
+		if (ctx.exists(".env.generated")) warnings.push(`ignoring ${GENERATED_FILE} — this session targets the remote development database (DEV_DB=remote), not the local stack.`);
+		return {
+			environment,
+			files,
+			warnings
+		};
+	}
+	if (environment === "development" && ctx.devDatabase === "local") {
+		const generated = ctx.exists(GENERATED_FILE);
+		if (!await ctx.probeLocalStack()) throw new LocalStackOfflineError(`nothing is listening on 127.0.0.1:${LOCAL_STACK_PORT}` + (generated ? ` (${GENERATED_FILE} exists but is stale).` : ` (and ${GENERATED_FILE} is missing).`));
+		if (!generated) throw new LocalStackOfflineError(`the stack is listening on 127.0.0.1:${LOCAL_STACK_PORT} while ${GENERATED_FILE} — its connection block — is missing.`, `Run \`supabase status -o env > ${GENERATED_FILE}\` at the repo root to regenerate it.`);
+		files.unshift(GENERATED_FILE);
+		return {
+			environment,
+			files,
+			warnings
+		};
+	}
+	if (environment === "development") {
+		const generated = ctx.exists(GENERATED_FILE);
+		const listening = await ctx.probeLocalStack();
+		if (generated && listening) files.unshift(GENERATED_FILE);
+		else if (generated) warnings.push(`ignoring stale ${GENERATED_FILE} — nothing is listening on 127.0.0.1:${LOCAL_STACK_PORT}, so the local stack is not running.`);
+		else if (listening) warnings.push(`the local stack is listening on 127.0.0.1:${LOCAL_STACK_PORT} but ${GENERATED_FILE} is missing — run \`supabase status -o env > ${GENERATED_FILE}\` at the repo root to regenerate it.`);
+	}
+	return {
+		environment,
+		files,
+		warnings
+	};
+}
+/**
+* The real probe: one TCP connect to 127.0.0.1:54321.
+*
+* On loopback a refused connection returns ECONNREFUSED immediately, so the
+* hosted-project path costs well under a millisecond. The timeout is for the
+* pathological case, a firewall that drops instead of refusing, and is kept
+* tight so a weird network stack cannot stall every script in the repo by more
+* than a quarter second.
+*
+* Accepted hole (recorded in the design doc): something *else* listening on
+* 54321 fools this. Proving identity would mean an HTTP round-trip on every
+* command, and that failure is loud and immediate rather than silent.
+*/
+async function probeLocalStack(port = LOCAL_STACK_PORT, timeoutMs = 250) {
+	const { connect } = await import("node:net");
+	return new Promise((resolve) => {
+		const socket = connect({
+			host: "127.0.0.1",
+			port
+		});
+		const settle = (up) => {
+			socket.destroy();
+			resolve(up);
+		};
+		socket.setTimeout(timeoutMs, () => settle(false));
+		socket.once("connect", () => settle(true));
+		socket.once("error", () => settle(false));
+	});
+}
+/**
+* Walks up from THIS module's directory for the workspace marker, mirroring
+* `cli.ts`'s own `findRoot`. The duplication is deliberate rather than a
+* shared export: `cli.ts` still needs its own root synchronously, before it
+* can decide the Windows dotenvx-CLI `-f` paths below, and passing that same
+* root through as `context.root` (as `with-env` now does) is what lets a
+* caller skip this walk entirely rather than paying for it twice.
+*
+* Throws instead of `console.error` + `process.exit`, unlike `cli.ts`'s
+* version: this is a library function other commands call in-process, and
+* exiting the whole process out from under an unrelated caller would be a far
+* worse failure than a rejected promise.
+*/
+async function findRepoRoot() {
+	const { existsSync } = await import("node:fs");
+	const { dirname, join, resolve } = await import("node:path");
+	const { fileURLToPath } = await import("node:url");
+	let dir = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+	for (;;) {
+		if (existsSync(join(dir, "pnpm-workspace.yaml"))) return dir;
+		const parent = dirname(dir);
+		if (parent === dir) throw new Error("loadEnvironment: could not locate the monorepo root (no pnpm-workspace.yaml found above this package).");
+		dir = parent;
+	}
+}
+/**
+* Loads a deploy tier's env files into a FRESH map, in-process — the same
+* selection-then-load `with-env` does at startup (`selectEnvFiles` here plus
+* dotenvx's Node API), pulled out so any command can load a tier's
+* environment WITHOUT re-execing itself through the `with-env` bin.
+*
+* ⚠️ NODE-ONLY / EDGE-UNSAFE, same as the rest of this module: never
+* re-export this from `index.ts`. It dynamically imports
+* `node:fs`/`node:path`/`node:url` (only when `context.root` or
+* `context.exists` is not supplied) and `@dotenvx/dotenvx` (only when files
+* are actually applied), none of which resolve at the Cloudflare Workers edge
+* `apps/platform` deploys to.
+*
+* `process.env` (or `context.baseEnv`) is read, never written: `env` on the
+* result is a new object built from a snapshot of it, so loading one tier
+* in-process can never leak into, or be clobbered by, a caller's own
+* `process.env`.
+*
+* `MissingEnvFileError` and `UnknownEnvironmentError` from `selectEnvFiles`
+* are NOT caught here — they propagate. Only `with-env` knows how to survive
+* a missing file (report it, continue with none loaded); a library function
+* deciding that on every caller's behalf would take away the choice.
+*
+* See `LoadEnvironmentOptions.override` for the precedence subtlety: the
+* default (false) matches `with-env`'s "a shell var beats the file", which is
+* only correct when the caller is loading the SAME tier the process already
+* runs under. A caller loading a DIFFERENT tier — one that did not shape
+* `process.env` — must pass `override: true`, or that tier's file loses to
+* values that were never meant to apply to it.
+*/
+async function loadEnvironment(deployEnv, options, context) {
+	const override = options?.override ?? false;
+	const root = context?.root ?? await findRepoRoot();
+	let exists = context?.exists;
+	if (!exists) {
+		const { existsSync } = await import("node:fs");
+		const { join } = await import("node:path");
+		exists = (file) => existsSync(join(root, file));
+	}
+	const base = context?.baseEnv ?? process.env;
+	let devDatabase = options?.devDatabase;
+	if (devDatabase === void 0) {
+		const inherited = base[DEV_DB_ENV];
+		if (inherited !== void 0 && inherited !== "") {
+			if (!isDevDatabase(inherited)) throw new Error(`${DEV_DB_ENV}="${inherited}" is not one of: local, remote.`);
+			devDatabase = inherited;
+		}
+	}
+	const selection = await selectEnvFiles({
+		deployEnv,
+		exists,
+		probeLocalStack: context?.probeLocalStack ?? (() => probeLocalStack()),
+		devDatabase
+	});
+	const env = {};
+	for (const [key, value] of Object.entries(base)) if (value !== void 0) env[key] = value;
+	if (selection.files.length > 0) {
+		const { join } = await import("node:path");
+		await (context?.applyEnvFiles ?? (async (paths, target, overrideExisting) => {
+			const { default: dx } = await import("@dotenvx/dotenvx");
+			const { readFileSync } = await import("node:fs");
+			const raw = /* @__PURE__ */ new Map();
+			for (const path of paths) {
+				let text;
+				try {
+					text = readFileSync(path, "utf8");
+				} catch {
+					continue;
+				}
+				for (const [key, entry] of parseRawAssignments(text)) if (!raw.has(key) && !entry.literal) raw.set(key, entry.raw);
+			}
+			const shellKeysMarker = target["DEVTOOLS_SHELL_KEYS"];
+			const shellKeys = !overrideExisting && shellKeysMarker !== void 0 ? new Set(shellKeysMarker.split(",").filter((k) => k !== "")) : void 0;
+			const shellWins = /* @__PURE__ */ new Set();
+			if (shellKeys) {
+				for (const key of raw.keys()) if (shellKeys.has(key) && target[key] !== void 0) shellWins.add(key);
+			} else if (!overrideExisting) {
+				for (const key of raw.keys()) if (target[key] !== void 0) shellWins.add(key);
+			}
+			const sessionOverride = shellKeys !== void 0;
+			const preserved = /* @__PURE__ */ new Map();
+			if (sessionOverride) for (const key of shellWins) preserved.set(key, target[key]);
+			dx.config({
+				path: overrideExisting || sessionOverride ? [...paths].reverse() : paths,
+				processEnv: target,
+				quiet: true,
+				overload: overrideExisting || sessionOverride
+			});
+			for (const [key, value] of preserved) target[key] = value;
+			for (const [key, value] of raw) {
+				if (shellWins.has(key)) continue;
+				if (envReferences(value).length === 0) continue;
+				target[key] = expandReferences(key, value, raw, target);
+			}
+		}))(selection.files.map((file) => join(root, file)), env, override);
+	}
+	applyWranglerLocalDatabaseAlias(env);
+	return {
+		environment: selection.environment,
+		files: selection.files,
+		env,
+		warnings: selection.warnings
+	};
+}
+//#endregion
+export { fileFor as _, LocalStackOfflineError as a, applyDeployTierAliases as c, loadEnvironment as d, parseRawAssignments as f, UnknownEnvironmentError as g, DEPLOY_ENVIRONMENTS as h, LOCAL_STACK_PORT as i, applyWranglerLocalDatabaseAlias as l, selectEnvFiles as m, GENERATED_FILE as n, MissingEnvFileError as o, probeLocalStack as p, HYPERDRIVE_LOCAL_CONNECTION_ENV as r, SHELL_KEYS_ENV as s, DEV_DB_ENV as t, isDevDatabase as u, isDeployEnvironment as v };

package/dist/load-Czhayrsk.js

@@ -0,0 +1,2 @@
+import { a as LocalStackOfflineError, c as applyDeployTierAliases, d as loadEnvironment, f as parseRawAssignments, i as LOCAL_STACK_PORT, l as applyWranglerLocalDatabaseAlias, m as selectEnvFiles, n as GENERATED_FILE, o as MissingEnvFileError, p as probeLocalStack, r as HYPERDRIVE_LOCAL_CONNECTION_ENV, s as SHELL_KEYS_ENV, t as DEV_DB_ENV, u as isDevDatabase } from "./load-Cp8AMERM.js";
+export { DEV_DB_ENV, GENERATED_FILE, HYPERDRIVE_LOCAL_CONNECTION_ENV, LOCAL_STACK_PORT, LocalStackOfflineError, MissingEnvFileError, SHELL_KEYS_ENV, applyDeployTierAliases, applyWranglerLocalDatabaseAlias, isDevDatabase, loadEnvironment, parseRawAssignments, probeLocalStack, selectEnvFiles };