@devdogsuga/devtools 0.1.50 → 0.1.51-next.527

package/dist/local-env-BuHU5Ckd.js

@@ -1,357 +0,0 @@
-import { i as ownPackageDir } from "./root-CjPWNkBu.js";
-import { a as repoPeerUrl, n as loadEnv, o as resolveRepoPeerUrl, p as resolveLayout, t as getEnvSync } from "./peers-DvUH5VxX.js";
-import { register } from "node:module";
-import { existsSync, readdirSync, realpathSync } from "node:fs";
-import { join } from "node:path";
-import { pathToFileURL } from "node:url";
-//#region ../cli-core/src/repo/peer-redirect.ts
-/**
-* Points one module's bare import of a peer at the copy the target repo
-* resolved (`repo/peers.ts`).
-*
-* devtools' own `env.ts` manifest imports `@devdogsuga/env` by bare
-* specifier, and from an installed copy that specifier resolves relative to
-* the manifest's own location: inside the pnpm store, next to devtools,
-* where an optional peer is never installed under `pnpm dlx`. The import
-* failed with ERR_MODULE_NOT_FOUND, and every `env` command with it. Even
-* where the specifier does resolve (devtools installed as a devDependency),
-* the only copy that keeps the registry's module identity is the one the
-* repo's manifests use, so the redirect is applied whenever that copy is
-* known rather than only as a fallback.
-*
-* Node resolve hooks (`module.register`) rather than rewriting the file: the
-* manifest also imports `zod`, which has to keep resolving from devtools'
-* own location, and a copy written anywhere else would lose that.
-*/
-/** `redirectPeer` for several at once: the hooks keep one table per
-*  registration, so everything that needs redirecting goes in one call. */
-function redirectPeers(redirects) {
-	register("./peer-redirect-hooks.js", import.meta.url, { data: redirects });
-}
-//#endregion
-//#region ../cli-core/src/repo/tsx-loader.ts
-/**
-* Loads the repo's own TypeScript at runtime: env manifests
-* (each app's `src/env.ts` and friends), cron contracts
-* (each app's `cloudflare/scheduled.ts`), and — via `source.ts` — the
-* `devdogs-source` condition packages (`open-graph`, `email`, `docs`).
-*
-* Uses `tsx`'s programmatic API (`register()` from `tsx/esm/api`), NOT the
-* `--conditions=devdogs-source` CLI flag the old in-repo devtools used —
-* this package ships built JS and runs from `dist/`, so there is no `tsx`
-* process wrapping it anymore (see the package README / CUTOVER note on
-* "built JS, tsx only for repo TS").
-*
-* Gotcha (FINDINGS.md experiments 3 and 4, gotcha C): do NOT pass a
-* `namespace` to `register()`. It silently breaks tsx's own relative
-* `./foo.js` → `./foo.ts` extension-fallback resolution for files loaded
-* under that registration — exactly the convention `open-graph`, `email`,
-* and any future `devdogs-source` package use for their internal relative
-* imports. `register({})` (no options) is the only form validated.
-*/
-let registered = false;
-/** Idempotent: registers tsx's ESM loader hooks once per process. */
-async function ensureRegistered() {
-	if (registered) return;
-	const { register } = await import("tsx/esm/api");
-	register();
-	registered = true;
-}
-/**
-* Imports a repo TypeScript file at an absolute path, loaded through tsx.
-* Returns the module namespace, typed as `T` by the caller (there is no way
-* to know the shape of an arbitrary repo file's exports statically here).
-*/
-async function importRepoTs(absolutePath) {
-	await ensureRegistered();
-	return import(pathToFileURL(absolutePath).href);
-}
-//#endregion
-//#region ../cli-core/src/env/discovery.ts
-/**
-* Fills the `@devdogsuga/env` registry by importing every manifest.
-*
-* The registry populates as a SIDE EFFECT of importing each manifest module.
-* `declare()` runs at import time, so a process that never imports them sees an
-* empty registry and every derived selector returns nothing. That is the
-* fail-open shape this module closes: anything that routes secrets calls
-* `loadRegistry()` first, and `assertRegistryLoaded()` is the guard the
-* selectors' consumers use to refuse an empty answer.
-*
-* Discovery is by filename, per the model doc: `src/env.ts`, then `env.ts`, per
-* workspace package. Both present is a hard error, because two manifests in one
-* package means two places for the next declaration to land and no rule saying
-* which. No `package.json` pointer: every other tool in this repo is found by
-* filename (`tsconfig.json`, `wrangler.jsonc`, `supadart.yaml`), and a pointer
-* would be the only one of its kind.
-*
-* From a Backstage checkout the scan covers BOTH repos (`repo/layout.ts`):
-* Backstage's `apps/*` and `packages/*`, then DevDogsUGA's through
-* `devdogsuga/`, de-duplicated by directory name with Backstage first.
-*
-* One special case: `supabase/env.ts` sits at DevDogsUGA's root, OUTSIDE the
-* workspace globs. Its variables belong to `config.toml` and the Supabase
-* CLI, not to any package, so it lives next to the config that reads them.
-*
-* `@devdogsuga/env` itself (the package that exports `define()`/`declare()`)
-* no longer needs a special-case exclusion here: since the Backstage
-* cutover it is an installed npm dependency, not a workspace package under
-* `packages/`, so this scan never sees it at all.
-*
-* devtools' OWN operator manifest (this package's root `env.ts` — the keys
-* no app reads at all: `BWS_ACCESS_TOKEN`, `CLOUDFLARE_API_TOKEN`, and
-* friends) has the same problem in reverse: since the Backstage cutover
-* devtools is no longer one of the TARGET repo's workspace packages either,
-* so the scan below would never see it. It is loaded unconditionally,
-* always, regardless of which repo devtools is running against — see
-* `ownManifestPath()`'s own comment for how it stays resolvable both from a
-* workspace checkout and from an installed `pnpm dlx`/`node_modules` copy,
-* and for why loading it through the same `importRepoTs()` tsx path as
-* every other manifest (rather than a plain static `import`) is what keeps
-* its `declare()`/`define()` calls landing in the SAME `@devdogsuga/env`
-* registry instance the target repo's manifests populate (module identity —
-* see `repo/peers.ts`'s header and the devtools-dlx prototype's
-* FINDINGS.md experiment 3). Its bare `@devdogsuga/env` import is
-* redirected to the copy `loadEnv()` resolved through the repo, because
-* from a `pnpm dlx` copy the specifier does not resolve at all: devtools
-* ships no copy of its own (`@devdogsuga/env` is only ever an optional
-* peer), and nothing installs one next to it. See `repo/peer-redirect.ts`.
-*
-* Most workspace packages declare nothing, so "no env.ts found" means
-* not-a-manifest rather than an error.
-*
-* ⚠️ A Worker still needs a manifest, even though its bindings arrive as a
-* function argument rather than `process.env`: a manifest is the only thing
-* that routes a credential to a deployed environment and the only thing that
-* tells `env audit` a Worker secret is supposed to be there. Without one, a
-* minted secret (in no Bitwarden project by design) is reported as an orphan,
-* i.e. as safe for the §3.6 prune path to delete.
-*/
-/**
-* The single in-flight (or settled) load.
-*
-* Node's module cache already makes a second `import()` of the same manifest a
-* no-op, but memoizing the whole pass is asserted here rather than inherited: a
-* future bundler or test runner that re-evaluates modules would duplicate every
-* declaration, and duplicated declarations are what the completeness test
-* treats as a bug. A failed load stays failed. Every later call gets the same
-* rejection, because retrying into a half-populated registry would hide the
-* manifest that broke.
-*/
-let loaded;
-/**
-* Imports every manifest so the registry populates. Idempotent; concurrent
-* callers share one pass. Await this before touching any derived selector.
-*/
-function loadRegistry() {
-	loaded ??= importManifests();
-	return loaded;
-}
-/**
-* Refuses to proceed on an empty registry.
-*
-* For SYNC consumers of the derived selectors (`selectForPush`, `routeTo`),
-* which cannot await the load themselves. An empty registry makes every
-* selector return `[]`, and `[]` fails open in the worst direction: nothing is
-* never-store, so `BWS_ACCESS_TOKEN` would upload. Better a crash naming the
-* missing call than a push that quietly stores the unstorable.
-*/
-function assertRegistryLoaded() {
-	if (getEnvSync().variables().size === 0) throw new Error("The env registry is empty — no manifest has been imported, so the derived key sets would all be []. Await loadRegistry() (from devtools' env/discovery.ts) before routing or selecting secrets.");
-}
-async function importManifests() {
-	await loadEnv();
-	const redirects = [];
-	const envUrl = repoPeerUrl("@devdogsuga/env");
-	if (envUrl) {
-		redirects.push({
-			parentURL: pathToFileURL(ownManifestPath()).href,
-			specifier: "@devdogsuga/env",
-			url: envUrl
-		});
-		redirects.push(...siblingRedirects(envUrl));
-	}
-	if (redirects.length > 0) redirectPeers(redirects);
-	const previous = process.env.SKIP_ENV_VALIDATION;
-	process.env.SKIP_ENV_VALIDATION = "1";
-	try {
-		for (const path of manifestPaths()) try {
-			await importRepoTs(path);
-		} catch (cause) {
-			throw new Error(`The env manifest at ${path} failed to import.`, { cause });
-		}
-	} finally {
-		if (previous === void 0) delete process.env.SKIP_ENV_VALIDATION;
-		else process.env.SKIP_ENV_VALIDATION = previous;
-	}
-}
-/**
-* From a Backstage checkout, the manifests under `devdogsuga/` import
-* `@devdogsuga/env` through THAT checkout's `node_modules` (or not at all, when
-* it has none): a second copy of the package, and so a second registry that
-* every `declare()` there would populate instead of the one this process
-* reads. Point their imports at the copy `loadEnv()` resolved. Resolved
-* through `realpath`, because the loader sees the module's real location, not
-* the `devdogsuga` symlink.
-*/
-function siblingRedirects(envUrl) {
-	const layout = resolveLayout();
-	if (layout.kind !== "backstage" || !layout.hasDevdogsuga) return [];
-	const nextjs = resolveRepoPeerUrl("@devdogsuga/env/nextjs");
-	const redirects = [];
-	for (const path of manifestPaths()) {
-		if (!path.startsWith(layout.devdogsugaRoot)) continue;
-		const parentURL = pathToFileURL(realpathSync(path)).href;
-		redirects.push({
-			parentURL,
-			specifier: "@devdogsuga/env",
-			url: envUrl
-		});
-		if (nextjs) redirects.push({
-			parentURL,
-			specifier: "@devdogsuga/env/nextjs",
-			url: nextjs
-		});
-	}
-	return redirects;
-}
-/**
-* Every manifest file, in a stable order.
-*
-* The workspace members are enumerated by scanning `apps/*` and `packages/*`
-* plus the literal `docs`, a deliberately boring mirror of the three globs in
-* `pnpm-workspace.yaml` rather than a YAML parse: the globs have not changed
-* since the workspace existed, devtools carries no YAML dependency, and a new
-* top-level glob would already mean editing more interesting files than this
-* one.
-*/
-function manifestPaths() {
-	const paths = [];
-	for (const dir of workspaceDirs()) {
-		const manifest = manifestIn(dir);
-		if (manifest) paths.push(manifest);
-	}
-	const layout = resolveLayout();
-	const supabase = layout.hasDevdogsuga ? manifestIn(join(layout.devdogsugaRoot, "supabase")) : null;
-	if (supabase) paths.push(supabase);
-	paths.push(ownManifestPath());
-	return paths;
-}
-/**
-* The absolute path to devtools' own `env.ts`, resolved relative to THIS
-* module's own file rather than the target repo — it ships alongside
-* `dist/` (see `package.json`'s `files`), not inside the target repo's
-* workspace, so `findRepoRoot()`/`workspaceDirs()` can never find it.
-*
-* The package root is `ownPackageDir()`: `env.ts` sits there, deliberately
-* outside `src/` (see that file's own header, and `tsconfig.typecheck.json`,
-* which includes it as a sibling of `src` for exactly that reason). Same file,
-* same relative shape, in both a workspace checkout
-* (`packages/devtools/env.ts`) and an installed copy
-* (`node_modules/@devdogsuga/devtools/env.ts`).
-*/
-function ownManifestPath() {
-	return join(ownPackageDir(), "env.ts");
-}
-/**
-* The CLIs' own packages: each loads its own operator manifest through
-* `ownManifestPath()`, so scanning them from a Backstage checkout would
-* declare the same keys twice.
-*/
-const CLI_PACKAGES = /* @__PURE__ */ new Set(["devtools", "backstage"]);
-/**
-* `apps/*` and `packages/*` of every repo in the layout (the repo you are in
-* first, so it wins a name clash: before the cutover both repos carry
-* `apps/platform` and `packages/email`), then DevDogsUGA's `docs`.
-*/
-function workspaceDirs() {
-	const layout = resolveLayout();
-	const roots = [layout.root];
-	if (layout.kind === "backstage" && layout.hasDevdogsuga) roots.push(layout.devdogsugaRoot);
-	const dirs = [];
-	for (const parent of ["apps", "packages"]) {
-		const found = /* @__PURE__ */ new Map();
-		for (const root of roots) {
-			let entries;
-			try {
-				entries = readdirSync(join(root, parent), { withFileTypes: true });
-			} catch {
-				continue;
-			}
-			for (const entry of entries) {
-				if (!entry.isDirectory()) continue;
-				if (entry.name === "node_modules" || entry.name.startsWith(".")) continue;
-				if (layout.kind === "backstage" && parent === "packages" && CLI_PACKAGES.has(entry.name)) continue;
-				if (!found.has(entry.name)) found.set(entry.name, join(root, parent, entry.name));
-			}
-		}
-		for (const name of [...found.keys()].sort()) dirs.push(found.get(name));
-	}
-	if (layout.hasDevdogsuga) dirs.push(join(layout.devdogsugaRoot, "docs"));
-	return dirs;
-}
-/** `src/env.ts`, then `env.ts`; both present in one package is a hard error. */
-function manifestIn(dir) {
-	const inSrc = join(dir, "src", "env.ts");
-	const atRoot = join(dir, "env.ts");
-	const hasSrc = existsSync(inSrc);
-	const hasRoot = existsSync(atRoot);
-	if (hasSrc && hasRoot) throw new Error(`${dir} has BOTH src/env.ts and env.ts. One package gets one manifest — two of them means two places for the next declaration to land, and no rule saying which. Merge them.`);
-	return hasSrc ? inSrc : hasRoot ? atRoot : null;
-}
-//#endregion
-//#region src/cf/local-env.ts
-/** The app's declared keys, deduped and sorted, from the given entries or the
-* loaded registry.
-*
-* `DEPLOY_ENV` and `NODE_ENV` are excluded BY NAME, not by any registry-meta
-* heuristic. Their committed source is wrangler.jsonc's per-env `vars` blocks
-* (and the framework), never an env file — see each key's `define()` doc.
-* Materializing them into the temp `.dev.vars` this file feeds to `wrangler
-* dev` lets a stray or empty `.env` value OVERRIDE the tier's wrangler var,
-* which surfaced as a Workflow isolate reading a blank `DEPLOY_ENV` and
-* throwing "has no HYPERDRIVE binding".
-*
-* A `scope: "default"` + `commented: true` filter was tried first and is
-* WRONG: that shape also matches `GITHUB_COMPETITION_REPO`, an opt-in
-* override a contributor sets deliberately in their `.env` (its wrangler
-* config defines no such var), and the heuristic silently stripped it from
-* `wrangler dev`'s environment. Wrangler-ownership is a fact about
-* wrangler.jsonc, not about registry metadata, so the two keys it is true
-* for are named outright. */
-const WRANGLER_OWNED_KEYS = /* @__PURE__ */ new Set(["DEPLOY_ENV", "NODE_ENV"]);
-async function scopedKeys(app, entries) {
-	if (!entries) {
-		await loadRegistry();
-		entries = (await loadEnv()).declarations();
-	}
-	return [...new Set(entries.filter((entry) => entry.source === app).filter((entry) => !WRANGLER_OWNED_KEYS.has(entry.key)).map((entry) => entry.key))].sort();
-}
-/**
-* The process env for a `vinext dev` child, scoped the way the temp
-* `.dev.vars` is for `wrangler dev`.
-*
-* `@cloudflare/vite-plugin` has no `--env-file`: it reads the app dir's own
-* `.dev.vars`/`.env`, or — with `CLOUDFLARE_INCLUDE_PROCESS_ENV` — its whole
-* `process.env`, as Worker vars that override wrangler.jsonc's `vars`. So the
-* scoping happens on the child's env instead: every key some OTHER app
-* declares (and this app doesn't) is dropped, `NODE_ENV` is left to Vite, and
-* `DEPLOY_ENV` is pinned to the tier rather than dropped, because the Vite
-* process's own `next.config.ts` reads it too. Undeclared keys (PATH, HOME,
-* pnpm's own) stay; the child needs them and they carry no app secrets.
-*/
-async function scopedProcessEnv(app, environment, tier, entries) {
-	if (!entries) {
-		await loadRegistry();
-		entries = (await loadEnv()).declarations();
-	}
-	const own = new Set(await scopedKeys(app, entries));
-	const scoped = { ...environment };
-	for (const entry of entries) if (entry.source !== app && !own.has(entry.key)) delete scoped[entry.key];
-	delete scoped.NODE_ENV;
-	scoped.DEPLOY_ENV = tier;
-	scoped.CLOUDFLARE_INCLUDE_PROCESS_ENV = "true";
-	return scoped;
-}
-//#endregion
-export { assertRegistryLoaded as n, loadRegistry as r, scopedProcessEnv as t };

package/dist/local-env-MqH18s-N.js

@@ -1,2 +0,0 @@
-import { t as scopedProcessEnv } from "./local-env-BuHU5Ckd.js";
-export { scopedProcessEnv };