@dragonmastery/tamer 0.31.0 → 0.31.1

package/dist/tamer.mjs

@@ -7702,40 +7702,42 @@ function parseDotenvContent(content) {
 function readDotenvFile(filePath) {
 	return parseDotenvContent(readFileSync(resolve(process.cwd(), filePath), "utf8"));
 }
+/** Default bulk-load file for a remote env. Plain `.dev.vars` is wrangler dev / local only. */
+function defaultSecretsLoadFile(env) {
+	return `.dev.vars.${env}`;
+}
 /**
-* Merge env vars for bulk load: all keys from `process.env`, then file
-* entries overwrite on duplicate keys (file wins).
+* Reject plain `.dev.vars` — reserved for local `wrangler dev`, not vault seeding.
 */
-function mergeLoadSources(fileEntries) {
-	const merged = {};
-	for (const [key, value] of Object.entries(process.env)) if (value != null && value !== "") merged[key] = value;
-	for (const [key, value] of Object.entries(fileEntries)) merged[key] = value;
-	return merged;
+function assertRemoteSecretsLoadFile(filePath, env) {
+	if ((filePath.replace(/\\/g, "/").split("/").pop() ?? filePath) === ".dev.vars") throw new Error(`\`.dev.vars\` is for local wrangler dev only. Seed the vault with \`.dev.vars.${env}\` or omit --file (default).`);
 }
 
 //#endregion
 //#region src/cli/commands/secrets/load.ts
 async function runSecretsLoad(options) {
-	if (!options.file?.trim()) throw new Error("usage: tamer secrets load --file <path> --env <env>");
+	const env = resolveSecretsEnv(options.env);
+	const file = options.file?.trim() || defaultSecretsLoadFile(env);
+	assertRemoteSecretsLoadFile(file, env);
 	const ctx = await createSecretsContext({
-		env: options.env,
+		env,
 		configPath: options.configPath
 	});
-	const merged = mergeLoadSources(readDotenvFile(options.file));
-	const names = Object.keys(merged).sort();
+	const fileEntries = readDotenvFile(file);
+	const names = Object.keys(fileEntries).sort();
 	if (names.length === 0) {
 		console.log("secrets load: no entries to import");
 		return;
 	}
 	let count = 0;
 	for (const name of names) {
-		const plaintext = merged[name];
+		const plaintext = fileEntries[name];
 		const encrypted = await encryptSecretValue(plaintext, ctx.masterKey);
 		const valueHash = await secretValueFingerprint(plaintext);
 		await ctx.vault.upsert(name, encrypted, valueHash, { updatedBy: cliUpdatedBy() });
 		count += 1;
 	}
-	console.log(`secrets: loaded ${count} secret(s) into ${ctx.env} vault from ${options.file}`);
+	console.log(`secrets: loaded ${count} secret(s) into ${ctx.env} vault from ${file}`);
 }
 
 //#endregion
@@ -8154,7 +8156,7 @@ async function runSecretsPush(options) {
 const SECRETS_USAGE = `usage:
   tamer secrets init --env <env> [--config <path>]
   tamer secrets set <NAME> --env <env> [--config <path>]   # value on stdin (pipe only)
-  tamer secrets load --file <path> --env <env> [--config <path>]
+  tamer secrets load --env <env> [--file <path>] [--config <path>]   # default file: .dev.vars.{env}
   tamer secrets get <NAME> --env <env> [--config <path>]   # confirmation + audit log
   tamer secrets list --env <env> [--config <path>]
   tamer secrets rm <NAME> --env <env> [--config <path>]
@@ -8202,7 +8204,6 @@ async function runSecrets(argv) {
 			});
 			return 0;
 		case "load":
-			if (!parsed.file) throw new Error("secrets load requires --file <path>");
 			await runSecretsLoad({
 				file: parsed.file,
 				env: parsed.env,
@@ -8730,7 +8731,7 @@ Options:
 Secrets (requires TAMER_SECRETS_KEY_{env} master key env var):
   tamer secrets init --env <env>              Generate master key (print once) + provision vault
   tamer secrets set <NAME> --env <env>        Encrypt value from stdin into vault (pipe only)
-  tamer secrets load --file .dev.vars --env <env>  Bulk import; file wins over process.env
+  tamer secrets load --env <env> [--file .dev.vars.<env>]  Bulk import from env file; not plain .dev.vars
   tamer secrets get <NAME> --env <env>        Decrypt + print (confirmation + audit log)
   tamer secrets list --env <env>              Names + fingerprints + last-set (never values)
   tamer secrets rm <NAME> --env <env>         Remove from vault