@rmartz/envctl 3.1.1

package/README.md

@@ -0,0 +1,79 @@
+# envctl
+
+A personal, `gh`-style command-line tool for managing deployment configuration and atomically rotating provider secrets across projects and their environments. The hosting/secret providers (Vercel, Firebase, …) sit behind the tool as pluggable backends.
+
+See the [Vision](https://github.com/rmartz/envctl/issues/1) for the design and desired functionality.
+
+## Install
+
+envctl is published to GitHub Packages as `@rmartz/envctl` and installed as a personal global CLI — never a per-project dependency.
+
+**One-time setup.** GitHub Packages requires authentication (even for public packages), so add to your `~/.npmrc`:
+
+```
+@rmartz:registry=https://npm.pkg.github.com
+//npm.pkg.github.com/:_authToken=<a GitHub token with the read:packages scope>
+```
+
+**Install and update:**
+
+```bash
+pnpm add -g @rmartz/envctl         # install
+pnpm add -g @rmartz/envctl@latest  # update to the newest release
+```
+
+Then, from any project directory:
+
+```bash
+envctl --version
+envctl config push --dry-run   # preview the public-var sync for the current project
+envctl config pull             # write .env.local from the development environment
+envctl secrets rotate          # atomically rotate Firebase/Sentry secrets and redeploy
+envctl secrets init firebase   # bootstrap secrets for a fresh project (auto-detects if omitted)
+```
+
+`secrets rotate` mints each new credential, redeploys, then invalidates the old
+one, so the project is never left without a working credential. It relies on the
+same auth as the rest of the CLI — `VERCEL_TOKEN` or `vercel login`,
+`SENTRY_AUTH_TOKEN`, and an authenticated `gcloud` for Firebase key minting (run
+`envctl auth status` to check). Pass `--no-invalidate` to keep the old keys or
+`--refresh-previews` to redeploy active PR previews afterward.
+
+New to a project, or unsure which command to reach for? Start with the
+**[Vercel deploy runbook](docs/runbook-vercel-deploy.md)** — a scenario-driven
+playbook (cold-start, mint, rotate, add a provider, public-var change, local
+pull) with copy-pasteable sequences and a "how you know it worked" check for
+each. For mechanism detail, see the
+[secrets rotation engine](docs/secrets-rotation.md) for the full mint → deploy →
+verify → invalidate flow, and the [docs index](docs/index.md) for the
+[config-push](docs/config-push.md) and [environments](docs/env.md) subsystems.
+
+## Bootstrap a blank environment
+
+Bring a linked but otherwise empty Vercel project fully online in one step:
+
+```bash
+envctl bootstrap
+```
+
+**Prerequisites:**
+
+1. A linked Vercel project (`.vercel/project.json`, created by `vercel link`)
+2. An authenticated `gcloud` with a **pre-existing** Firebase project and service account — if the project uses Firebase (envctl mints keys for existing resources; creating the service account from scratch is tracked in [#70](https://github.com/rmartz/envctl/issues/70))
+3. A Sentry token (`SENTRY_AUTH_TOKEN` or `sentry-cli login`) and a **pre-existing** Sentry project — if the project uses Sentry
+
+`bootstrap` runs four phases in order: push public variables (`config push`), initialize any missing provider secrets (`secrets init`), pull a local dotenv file (`config pull`), and trigger redeployments so running environments pick up the pushed vars (`triggerAndWaitRedeployments` — skipped with a log message on a zero-deployment project). It is idempotent — safe to re-run after a partial failure, and existing secrets are never rotated. Pass `--dry-run` to preview every phase without making changes.
+
+See the [Bootstrap subsystem docs](docs/bootstrap.md) for the full option reference.
+
+## Development
+
+```bash
+pnpm install
+pnpm build         # tsc → dist/
+pnpm run test:ts   # vitest
+```
+
+## Releases
+
+Releases are automated with [semantic-release](https://semantic-release.gitbook.io/): a merge to `main` computes the next version from the Conventional Commit history, tags it, creates a GitHub release, and publishes `@rmartz/envctl` to GitHub Packages.

package/dist/envctl.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=envctl.d.ts.map

package/dist/envctl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envctl.d.ts","sourceRoot":"","sources":["../src/envctl.ts"],"names":[],"mappings":""}

package/dist/envctl.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const logger_1 = require("./lib/logger");
+const help_1 = require("./lib/cli/help");
+const registry_1 = require("./lib/cli/registry");
+const router_1 = require("./lib/cli/router");
+const version_1 = require("./lib/cli/version");
+async function main() {
+    const registry = (0, registry_1.buildRegistry)();
+    const { workingDir, rest } = (0, router_1.extractGlobalArgs)(process.argv.slice(2), process.cwd());
+    const result = (0, router_1.route)(rest, registry);
+    switch (result.kind) {
+        case "version":
+            console.log((0, version_1.readPackageVersion)(__dirname));
+            return;
+        case "help":
+            console.log(result.group ? (0, help_1.renderGroupHelp)(result.group) : (0, help_1.renderTopHelp)(registry));
+            return;
+        case "error":
+            console.error(result.message);
+            process.exitCode = 1;
+            return;
+        case "run":
+            await result.command.run({ workingDir }, result.args);
+            return;
+    }
+}
+main().catch((error) => {
+    if (error instanceof logger_1.FatalError) {
+        console.error(error.message);
+        process.exit(1);
+    }
+    throw error;
+});
+//# sourceMappingURL=envctl.js.map

package/dist/envctl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envctl.js","sourceRoot":"","sources":["../src/envctl.ts"],"names":[],"mappings":";;;AACA,yCAA0C;AAC1C,yCAAgE;AAChE,iDAAmD;AACnD,6CAA4D;AAC5D,+CAAuD;AAEvD,KAAK,UAAU,IAAI;IACjB,MAAM,QAAQ,GAAG,IAAA,wBAAa,GAAE,CAAC;IACjC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,IAAA,0BAAiB,EAC5C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EACrB,OAAO,CAAC,GAAG,EAAE,CACd,CAAC;IACF,MAAM,MAAM,GAAG,IAAA,cAAK,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAErC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,SAAS;YACZ,OAAO,CAAC,GAAG,CAAC,IAAA,4BAAkB,EAAC,SAAS,CAAC,CAAC,CAAC;YAC3C,OAAO;QACT,KAAK,MAAM;YACT,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAA,sBAAe,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAA,oBAAa,EAAC,QAAQ,CAAC,CACvE,CAAC;YACF,OAAO;QACT,KAAK,OAAO;YACV,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,KAAK,KAAK;YACR,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACtD,OAAO;IACX,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,IAAI,KAAK,YAAY,mBAAU,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,CAAC;AACd,CAAC,CAAC,CAAC"}

package/dist/lib/auth.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Returns the Vercel API token to use, preferring VERCEL_TOKEN env var and
+ * falling back to the token stored by the Vercel CLI (vercel login).
+ *
+ * Returns undefined if no token is available.
+ */
+export declare function resolveVercelToken(): string | undefined;
+/**
+ * Returns the Sentry auth token, preferring SENTRY_AUTH_TOKEN and falling back
+ * to the token stored by sentry-cli (`sentry-cli login` → ~/.sentryclirc).
+ * Returns undefined if none is available.
+ */
+export declare function resolveSentryToken(): string | undefined;
+export interface AuthState {
+    authenticated: boolean;
+    source?: string;
+}
+export declare function vercelAuthState(): AuthState;
+export declare function sentryAuthState(): AuthState;
+export declare function gcpAuthState(): AuthState;
+//# sourceMappingURL=auth.d.ts.map

package/dist/lib/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AA+DA;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAEvD;AAqBD;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAGvD;AAKD,MAAM,WAAW,SAAS;IACxB,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,eAAe,IAAI,SAAS,CAK3C;AAED,wBAAgB,eAAe,IAAI,SAAS,CAM3C;AAID,wBAAgB,YAAY,IAAI,SAAS,CAcxC"}

package/dist/lib/auth.js

@@ -0,0 +1,148 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveVercelToken = resolveVercelToken;
+exports.resolveSentryToken = resolveSentryToken;
+exports.vercelAuthState = vercelAuthState;
+exports.sentryAuthState = sentryAuthState;
+exports.gcpAuthState = gcpAuthState;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const subprocess_1 = require("./subprocess");
+function vercelCliAuthPath() {
+    if (process.env.__VERCEL_CLI_AUTH_PATH)
+        return process.env.__VERCEL_CLI_AUTH_PATH;
+    switch (process.platform) {
+        case "darwin":
+            return path.join(os.homedir(), "Library", "Application Support", "com.vercel.cli", "auth.json");
+        case "win32":
+            return path.join(process.env.APPDATA ?? os.homedir(), "com.vercel.cli", "auth.json");
+        default:
+            return path.join(process.env.XDG_DATA_HOME ?? path.join(os.homedir(), ".local", "share"), "com.vercel.cli", "auth.json");
+    }
+}
+function readCliToken() {
+    const authPath = vercelCliAuthPath();
+    let raw;
+    try {
+        raw = fs.readFileSync(authPath, "utf-8");
+    }
+    catch {
+        return undefined;
+    }
+    let auth;
+    try {
+        auth = JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+    if (!auth.token)
+        return undefined;
+    if (auth.expiresAt !== undefined && Date.now() / 1000 > auth.expiresAt) {
+        return undefined;
+    }
+    return auth.token;
+}
+/**
+ * Returns the Vercel API token to use, preferring VERCEL_TOKEN env var and
+ * falling back to the token stored by the Vercel CLI (vercel login).
+ *
+ * Returns undefined if no token is available.
+ */
+function resolveVercelToken() {
+    return process.env.VERCEL_TOKEN ?? readCliToken() ?? undefined;
+}
+function sentryClircPath() {
+    return (process.env.__SENTRY_CLIRC_PATH ?? path.join(os.homedir(), ".sentryclirc"));
+}
+// Reads the `token = …` value from sentry-cli's ~/.sentryclirc (INI-style).
+// Graceful: a missing or unparseable file yields undefined.
+function readSentryClircToken() {
+    let raw;
+    try {
+        raw = fs.readFileSync(sentryClircPath(), "utf-8");
+    }
+    catch {
+        return undefined;
+    }
+    const match = /^\s*token\s*=\s*(\S+)\s*$/m.exec(raw);
+    return match ? match[1] : undefined;
+}
+/**
+ * Returns the Sentry auth token, preferring SENTRY_AUTH_TOKEN and falling back
+ * to the token stored by sentry-cli (`sentry-cli login` → ~/.sentryclirc).
+ * Returns undefined if none is available.
+ */
+function resolveSentryToken() {
+    // `||` (not `??`) so a blank SENTRY_AUTH_TOKEN falls through to the CLI store.
+    return process.env.SENTRY_AUTH_TOKEN || readSentryClircToken() || undefined;
+}
+function vercelAuthState() {
+    if (process.env.VERCEL_TOKEN)
+        return { authenticated: true, source: "VERCEL_TOKEN env var" };
+    if (readCliToken())
+        return { authenticated: true, source: "vercel login" };
+    return { authenticated: false };
+}
+function sentryAuthState() {
+    if (process.env.SENTRY_AUTH_TOKEN)
+        return { authenticated: true, source: "SENTRY_AUTH_TOKEN env var" };
+    if (readSentryClircToken())
+        return { authenticated: true, source: "sentry-cli login (~/.sentryclirc)" };
+    return { authenticated: false };
+}
+// GCP auth is owned entirely by the gcloud CLI; report the active account via a
+// local, side-effect-free `gcloud auth list` query (no token minting).
+function gcpAuthState() {
+    if (!(0, subprocess_1.commandExists)("gcloud"))
+        return { authenticated: false };
+    try {
+        const account = (0, subprocess_1.run)("gcloud", [
+            "auth",
+            "list",
+            "--filter=status:ACTIVE",
+            "--format=value(account)",
+        ]).trim();
+        if (account)
+            return { authenticated: true, source: `gcloud: ${account}` };
+    }
+    catch {
+        // gcloud present but the query failed — treat as unauthenticated.
+    }
+    return { authenticated: false };
+}
+//# sourceMappingURL=auth.js.map

package/dist/lib/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqEA,gDAEC;AA0BD,gDAGC;AAUD,0CAKC;AAED,0CAMC;AAID,oCAcC;AA7ID,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAE7B,6CAA4D;AAO5D,SAAS,iBAAiB;IACxB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB;QACpC,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC5C,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,IAAI,CACd,EAAE,CAAC,OAAO,EAAE,EACZ,SAAS,EACT,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,CACZ,CAAC;QACJ,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,IAAI,CACd,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,EACnC,gBAAgB,EAChB,WAAW,CACZ,CAAC;QACJ;YACE,OAAO,IAAI,CAAC,IAAI,CACd,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,EACvE,gBAAgB,EAChB,WAAW,CACZ,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAElC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB;IAChC,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,YAAY,EAAE,IAAI,SAAS,CAAC;AACjE,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,4DAA4D;AAC5D,SAAS,oBAAoB;IAC3B,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB;IAChC,+EAA+E;IAC/E,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,oBAAoB,EAAE,IAAI,SAAS,CAAC;AAC9E,CAAC;AAUD,SAAgB,eAAe;IAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;QAC1B,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACjE,IAAI,YAAY,EAAE;QAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC3E,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED,SAAgB,eAAe;IAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC/B,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IACtE,IAAI,oBAAoB,EAAE;QACxB,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IAC9E,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED,gFAAgF;AAChF,uEAAuE;AACvE,SAAgB,YAAY;IAC1B,IAAI,CAAC,IAAA,0BAAa,EAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAA,gBAAM,EAAC,QAAQ,EAAE;YAC/B,MAAM;YACN,MAAM;YACN,wBAAwB;YACxB,yBAAyB;SAC1B,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,OAAO;YAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,OAAO,EAAE,EAAE,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC"}

package/dist/lib/check-firebase.d.ts

@@ -0,0 +1,6 @@
+import { type Finding } from "./check";
+import type { DeploymentProvider } from "./providers/deployment";
+import type { VercelEnvVar } from "./vercel-api";
+export declare function checkFirebaseSaDrift(deployment: DeploymentProvider, configDir: string, liveEnvs: VercelEnvVar[]): Promise<Finding[]>;
+export declare function checkFirebaseProjectDrift(deployment: DeploymentProvider, configDir: string, liveEnvs: VercelEnvVar[]): Promise<Finding[]>;
+//# sourceMappingURL=check-firebase.d.ts.map

package/dist/lib/check-firebase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-firebase.d.ts","sourceRoot":"","sources":["../../src/lib/check-firebase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAQ3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAUjD,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,kBAAkB,EAC9B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,YAAY,EAAE,GACvB,OAAO,CAAC,OAAO,EAAE,CAAC,CAqCpB;AAaD,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,kBAAkB,EAC9B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,YAAY,EAAE,GACvB,OAAO,CAAC,OAAO,EAAE,CAAC,CAkCpB"}

package/dist/lib/check-firebase.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkFirebaseSaDrift = checkFirebaseSaDrift;
+exports.checkFirebaseProjectDrift = checkFirebaseProjectDrift;
+const check_1 = require("./check");
+const environments_1 = require("./environments");
+const firebase_credential_1 = require("./firebase-credential");
+const firebase_vars_1 = require("./firebase-vars");
+const manifest_1 = require("./manifest");
+const targets_1 = require("./targets");
+// #103: `FIREBASE_SA_EMAIL` is a deprecated committed var that duplicates the
+// service-account identity the app already reads from the credential's
+// `clientEmail`. This flags a project that still declares it against the live
+// credential — an **error** when the two name different service accounts (the
+// drift class #97/#98 were created to kill: envctl would mint keys for one SA
+// while the app authenticates as another), a deprecation **warning** when it
+// merely duplicates the credential. Part of `envctl check --live`, since the
+// credential's value lives in the provider, not in git.
+async function checkFirebaseSaDrift(deployment, configDir, liveEnvs) {
+    const manifest = (0, manifest_1.parseManifest)(configDir);
+    const spec = (0, firebase_credential_1.resolveFirebaseCredential)(manifest.services.find((s) => s.provider === "firebase"));
+    const resolveTarget = (0, targets_1.envTargetResolver)(configDir);
+    const findings = [];
+    const seen = new Set();
+    for (const env of manifest.environments) {
+        const declared = (0, environments_1.parseDeploymentEnv)(configDir, env).FIREBASE_SA_EMAIL;
+        if (!declared)
+            continue;
+        const target = resolveTarget(env);
+        const seenKey = `${target}|${declared}`;
+        if (seen.has(seenKey))
+            continue;
+        seen.add(seenKey);
+        if (!(0, firebase_vars_1.hasFirebaseCredentialForEnv)(liveEnvs, spec.names, target))
+            continue;
+        const sa = await (0, firebase_vars_1.getFirebaseSaForEnv)(target, liveEnvs, spec.names, deployment);
+        if (!sa?.email)
+            continue;
+        findings.push(sa.email === declared
+            ? (0, check_1.mkWarning)(`FIREBASE_SA_EMAIL for '${env}' duplicates the credential's ${spec.names.clientEmail} — it is deprecated; remove it and let envctl derive the service account from the credential.`)
+            : (0, check_1.mkError)(`FIREBASE_SA_EMAIL for '${env}' (${declared}) disagrees with the credential's ${spec.names.clientEmail} (${sa.email}) on the '${target}' target — they name different service accounts. Remove the deprecated FIREBASE_SA_EMAIL and let envctl derive the identity from the credential.`));
+    }
+    return findings;
+}
+// #121: the committed `FIREBASE_PROJECT_ID` (a public var in `deployment/{env}.yml`)
+// is the target's own GCP project — the project envctl mints keys in at init, and
+// the same project the app's credential authenticates against (the credential's
+// `projectId` var). If the two disagree, envctl would mint keys in one GCP
+// project while the app runs against another — the projectId analog of the
+// SA-email drift #103 addressed. Unlike `FIREBASE_SA_EMAIL`, `FIREBASE_PROJECT_ID`
+// is **not** deprecated: #127 established that init must resolve the project
+// strictly from the target's own declared value, so a matching committed value is
+// correct and required — only a mismatch (drift) is flagged, as an error. Part of
+// `envctl check --live` (the credential's value lives in the provider, not git);
+// deferred to this follow-up by #127.
+async function checkFirebaseProjectDrift(deployment, configDir, liveEnvs) {
+    const manifest = (0, manifest_1.parseManifest)(configDir);
+    const spec = (0, firebase_credential_1.resolveFirebaseCredential)(manifest.services.find((s) => s.provider === "firebase"));
+    const resolveTarget = (0, targets_1.envTargetResolver)(configDir);
+    const findings = [];
+    const seen = new Set();
+    for (const env of manifest.environments) {
+        const declared = (0, environments_1.parseDeploymentEnv)(configDir, env).FIREBASE_PROJECT_ID;
+        if (!declared)
+            continue;
+        const target = resolveTarget(env);
+        const seenKey = `${target}|${declared}`;
+        if (seen.has(seenKey))
+            continue;
+        seen.add(seenKey);
+        if (!(0, firebase_vars_1.hasFirebaseCredentialForEnv)(liveEnvs, spec.names, target))
+            continue;
+        const sa = await (0, firebase_vars_1.getFirebaseSaForEnv)(target, liveEnvs, spec.names, deployment);
+        if (!sa?.gcpProject)
+            continue;
+        if (sa.gcpProject !== declared)
+            findings.push((0, check_1.mkError)(`FIREBASE_PROJECT_ID for '${env}' (${declared}) disagrees with the credential's ${spec.names.projectId} (${sa.gcpProject}) on the '${target}' target — envctl would mint keys in one GCP project while the app authenticates against another. Reconcile the committed FIREBASE_PROJECT_ID with the live credential.`));
+    }
+    return findings;
+}
+//# sourceMappingURL=check-firebase.js.map

package/dist/lib/check-firebase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-firebase.js","sourceRoot":"","sources":["../../src/lib/check-firebase.ts"],"names":[],"mappings":";;AAoBA,oDAyCC;AAaD,8DAsCC;AAhHD,mCAA2D;AAC3D,iDAAoD;AACpD,+DAAkE;AAClE,mDAGyB;AACzB,yCAA2C;AAE3C,uCAA8C;AAG9C,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,wDAAwD;AACjD,KAAK,UAAU,oBAAoB,CACxC,UAA8B,EAC9B,SAAiB,EACjB,QAAwB;IAExB,MAAM,QAAQ,GAAG,IAAA,wBAAa,EAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAA,+CAAyB,EACpC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CACzD,CAAC;IACF,MAAM,aAAa,GAAG,IAAA,2BAAiB,EAAC,SAAS,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAA,iCAAkB,EAAC,SAAS,EAAE,GAAG,CAAC,CAAC,iBAAiB,CAAC;QACtE,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAChC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAElB,IAAI,CAAC,IAAA,2CAA2B,EAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,SAAS;QACzE,MAAM,EAAE,GAAG,MAAM,IAAA,mCAAmB,EAClC,MAAM,EACN,QAAQ,EACR,IAAI,CAAC,KAAK,EACV,UAAU,CACX,CAAC;QACF,IAAI,CAAC,EAAE,EAAE,KAAK;YAAE,SAAS;QAEzB,QAAQ,CAAC,IAAI,CACX,EAAE,CAAC,KAAK,KAAK,QAAQ;YACnB,CAAC,CAAC,IAAA,iBAAS,EACP,0BAA0B,GAAG,iCAAiC,IAAI,CAAC,KAAK,CAAC,WAAW,+FAA+F,CACpL;YACH,CAAC,CAAC,IAAA,eAAO,EACL,0BAA0B,GAAG,MAAM,QAAQ,qCAAqC,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,EAAE,CAAC,KAAK,aAAa,MAAM,kJAAkJ,CACzR,CACN,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,qFAAqF;AACrF,kFAAkF;AAClF,gFAAgF;AAChF,2EAA2E;AAC3E,2EAA2E;AAC3E,mFAAmF;AACnF,6EAA6E;AAC7E,kFAAkF;AAClF,kFAAkF;AAClF,iFAAiF;AACjF,sCAAsC;AAC/B,KAAK,UAAU,yBAAyB,CAC7C,UAA8B,EAC9B,SAAiB,EACjB,QAAwB;IAExB,MAAM,QAAQ,GAAG,IAAA,wBAAa,EAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAA,+CAAyB,EACpC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CACzD,CAAC;IACF,MAAM,aAAa,GAAG,IAAA,2BAAiB,EAAC,SAAS,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAA,iCAAkB,EAAC,SAAS,EAAE,GAAG,CAAC,CAAC,mBAAmB,CAAC;QACxE,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAChC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAElB,IAAI,CAAC,IAAA,2CAA2B,EAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,SAAS;QACzE,MAAM,EAAE,GAAG,MAAM,IAAA,mCAAmB,EAClC,MAAM,EACN,QAAQ,EACR,IAAI,CAAC,KAAK,EACV,UAAU,CACX,CAAC;QACF,IAAI,CAAC,EAAE,EAAE,UAAU;YAAE,SAAS;QAE9B,IAAI,EAAE,CAAC,UAAU,KAAK,QAAQ;YAC5B,QAAQ,CAAC,IAAI,CACX,IAAA,eAAO,EACL,4BAA4B,GAAG,MAAM,QAAQ,qCAAqC,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,EAAE,CAAC,UAAU,aAAa,MAAM,yKAAyK,CACrT,CACF,CAAC;IACN,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/lib/check-live.d.ts

@@ -0,0 +1,3 @@
+import { type Finding } from "./check";
+export declare function checkLive(workingDir: string): Promise<Finding[]>;
+//# sourceMappingURL=check-live.d.ts.map

package/dist/lib/check-live.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-live.d.ts","sourceRoot":"","sources":["../../src/lib/check-live.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAmB3D,wBAAsB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CA4CtE"}

package/dist/lib/check-live.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkLive = checkLive;
+const check_1 = require("./check");
+const check_firebase_1 = require("./check-firebase");
+const deployment_config_1 = require("./commands/deployment-config");
+const environments_1 = require("./environments");
+const manifest_1 = require("./manifest");
+const registry_1 = require("./providers/registry");
+const targets_1 = require("./targets");
+// Live reconciliation (`envctl check --live`): compares the public config vars
+// the project declares against what is actually present on the deployment
+// provider, surfacing drift. Requires network + auth, which is why it is behind
+// a flag. Secrets (Firebase/Sentry credentials, generated values) are owned by
+// the rotation engine and deliberately out of scope here — this checks the
+// public variables `config push` manages, so declared-vs-live stays apples to
+// apples.
+async function checkLive(workingDir) {
+    const configDir = (0, deployment_config_1.deploymentDir)(workingDir);
+    let deployment;
+    try {
+        deployment = (0, registry_1.resolveProjectDeployment)(configDir, workingDir);
+    }
+    catch (e) {
+        return [
+            (0, check_1.mkError)(`--live check skipped: ${e instanceof Error ? e.message : String(e)}`),
+        ];
+    }
+    const manifest = (0, manifest_1.parseManifest)(configDir);
+    const resolveTarget = (0, targets_1.envTargetResolver)(configDir);
+    const live = (await deployment.listEnvVars()).envs;
+    const findings = [];
+    for (const env of manifest.environments) {
+        const target = resolveTarget(env);
+        const declared = (0, environments_1.parseDeploymentEnv)(configDir, env);
+        for (const key of Object.keys(declared)) {
+            const present = live.some((e) => e.key === key && e.target.includes(target));
+            if (!present)
+                findings.push((0, check_1.mkWarning)(`declared variable '${key}' for '${env}' is not present on the '${target}' target (drift).`));
+        }
+    }
+    // The deprecated FIREBASE_SA_EMAIL must agree with the credential's live
+    // clientEmail (#103).
+    findings.push(...(await (0, check_firebase_1.checkFirebaseSaDrift)(deployment, configDir, live)));
+    // The committed FIREBASE_PROJECT_ID must agree with the credential's live
+    // projectId (#121).
+    findings.push(...(await (0, check_firebase_1.checkFirebaseProjectDrift)(deployment, configDir, live)));
+    return findings;
+}
+//# sourceMappingURL=check-live.js.map

package/dist/lib/check-live.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-live.js","sourceRoot":"","sources":["../../src/lib/check-live.ts"],"names":[],"mappings":";;AAmBA,8BA4CC;AA/DD,mCAA2D;AAC3D,qDAG0B;AAC1B,oEAA6D;AAC7D,iDAAoD;AACpD,yCAA2C;AAE3C,mDAAgE;AAChE,uCAA8C;AAE9C,+EAA+E;AAC/E,0EAA0E;AAC1E,gFAAgF;AAChF,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,UAAU;AACH,KAAK,UAAU,SAAS,CAAC,UAAkB;IAChD,MAAM,SAAS,GAAG,IAAA,iCAAa,EAAC,UAAU,CAAC,CAAC;IAE5C,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QACH,UAAU,GAAG,IAAA,mCAAwB,EAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,IAAA,eAAO,EACL,yBAAyB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACtE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,wBAAa,EAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,IAAA,2BAAiB,EAAC,SAAS,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,CAAC,MAAM,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC;IAEnD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAA,iCAAkB,EAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACpD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAClD,CAAC;YACF,IAAI,CAAC,OAAO;gBACV,QAAQ,CAAC,IAAI,CACX,IAAA,iBAAS,EACP,sBAAsB,GAAG,UAAU,GAAG,4BAA4B,MAAM,mBAAmB,CAC5F,CACF,CAAC;QACN,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,sBAAsB;IACtB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAA,qCAAoB,EAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5E,0EAA0E;IAC1E,oBAAoB;IACpB,QAAQ,CAAC,IAAI,CACX,GAAG,CAAC,MAAM,IAAA,0CAAyB,EAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAClE,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/lib/check.d.ts

@@ -0,0 +1,9 @@
+export type Severity = "error" | "warning";
+export interface Finding {
+    readonly severity: Severity;
+    readonly message: string;
+}
+export declare const mkError: (message: string) => Finding;
+export declare const mkWarning: (message: string) => Finding;
+export declare function checkStatic(workingDir: string): Finding[];
+//# sourceMappingURL=check.d.ts.map

package/dist/lib/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/lib/check.ts"],"names":[],"mappings":"AAoBA,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAC3C,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,OAAO,GAAI,SAAS,MAAM,KAAG,OAGxC,CAAC;AACH,eAAO,MAAM,SAAS,GAAI,SAAS,MAAM,KAAG,OAG1C,CAAC;AAKH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,EAAE,CAmCzD"}