@jskit-ai/jskit-cli 0.2.145 → 0.2.146

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/jskit-cli",
-  "version": "0.2.145",
+  "version": "0.2.146",
   "description": "Bundle and package orchestration CLI for JSKIT apps.",
   "type": "module",
   "files": [
@@ -21,9 +21,9 @@
     "test": "node --test"
   },
   "dependencies": {
-    "@jskit-ai/jskit-catalog": "0.1.139",
-    "@jskit-ai/kernel": "0.1.125",
-    "@jskit-ai/shell-web": "0.1.126",
+    "@jskit-ai/jskit-catalog": "0.1.140",
+    "@jskit-ai/kernel": "0.1.126",
+    "@jskit-ai/shell-web": "0.1.127",
     "@vue/compiler-sfc": "^3.5.29",
     "ts-morph": "^28.0.0",
     "yaml": "^2.8.3"

package/src/server/cliRuntime/sensitiveLockState.js

@@ -1,4 +1,5 @@
 import path from "node:path";
+import process from "node:process";
 import {
   ensureArray,
   ensureObject
@@ -154,13 +155,15 @@ async function resolveSensitiveOptionEnvFallbacks({
   packageEntry = {},
   appRoot = "",
   optionInput = {},
-  readFileBufferIfExists
+  readFileBufferIfExists,
+  environment = process.env
 } = {}) {
   if (!appRoot || typeof readFileBufferIfExists !== "function") {
     return {};
   }
 
   const fallbacks = {};
+  const runtimeEnvironment = ensureObject(environment);
   const runtimeOptions = ensureObject(optionInput);
   const optionSchemas = ensureObject(packageEntry?.descriptor?.options);
   const textMutations = ensureArray(ensureObject(packageEntry?.descriptor?.mutations).text);
@@ -204,13 +207,21 @@ async function resolveSensitiveOptionEnvFallbacks({
       continue;
     }
 
+    const optionSchema = ensureObject(optionSchemas[optionName]);
+    const environmentValue = Object.prototype.hasOwnProperty.call(runtimeEnvironment, resolvedKey)
+      ? String(runtimeEnvironment[resolvedKey] ?? "")
+      : null;
+    if (environmentValue !== null && (environmentValue || optionSchema.allowEmpty === true)) {
+      fallbacks[optionName] = environmentValue;
+      continue;
+    }
+
     const existing = await readFileBufferIfExists(path.join(appRoot, relativeFile));
     if (!existing.exists) {
       continue;
     }
 
     const envValue = readEnvValue(existing.buffer.toString("utf8"), resolvedKey);
-    const optionSchema = ensureObject(optionSchemas[optionName]);
     if (envValue !== null && (envValue || optionSchema.allowEmpty === true)) {
       fallbacks[optionName] = envValue;
     }

package/src/server/core/commandCatalog.js

@@ -538,7 +538,7 @@ const COMMAND_DESCRIPTORS = Object.freeze({
     defaults: Object.freeze([
       "No npm install runs unless --run-npm-install is passed.",
       "Existing non-secret lock options are reused unless overridden inline.",
-      "Secret options are read from current .env values or explicit inline options; they are not stored in the lock.",
+      "Secret options are read from the process environment, current .env values, or explicit inline options; they are not stored in the lock.",
       "update reuses add package flow with forced reapply."
     ]),
     fullUse: "jskit update package <packageId> [--<option> <value>...] [--dry-run] [--run-npm-install] [--json]",