@rmartz/envctl 3.1.1

package/dist/lib/check.js

@@ -0,0 +1,165 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mkWarning = exports.mkError = void 0;
+exports.checkStatic = checkStatic;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const deployment_config_1 = require("./commands/deployment-config");
+const manifest_1 = require("./manifest");
+const registry_1 = require("./providers/registry");
+const service_1 = require("./providers/service");
+const targets_1 = require("./targets");
+const mkError = (message) => ({
+    severity: "error",
+    message,
+});
+exports.mkError = mkError;
+const mkWarning = (message) => ({
+    severity: "warning",
+    message,
+});
+exports.mkWarning = mkWarning;
+// Static (offline) validation of a project's deployment config: it reads only
+// the in-repo config, never the network. `--live` reconciliation against the
+// provider lives in check-live.ts.
+function checkStatic(workingDir) {
+    const configDir = (0, deployment_config_1.deploymentDir)(workingDir);
+    if (!fs.existsSync((0, manifest_1.manifestFilePath)(configDir)) &&
+        !fs.existsSync((0, deployment_config_1.environmentsFile)(workingDir)))
+        return [
+            (0, exports.mkError)(`No deployment config found in ${configDir} — run 'envctl init' to scaffold it.`),
+        ];
+    let manifest;
+    try {
+        manifest = (0, manifest_1.parseManifest)(configDir);
+    }
+    catch (e) {
+        return [
+            (0, exports.mkError)(`deployment/manifest.yml failed to parse: ${e instanceof Error ? e.message : String(e)}`),
+        ];
+    }
+    const declared = new Set(manifest.environments);
+    const validTargets = new Set(deployment_config_1.VALID_TARGETS);
+    const isVercel = (manifest.deployments[0]?.provider ?? "vercel") === "vercel";
+    return [
+        ...checkEnvResolution(manifest, configDir, isVercel, validTargets),
+        ...checkDeploymentTargets(manifest, declared, validTargets),
+        ...checkOrphanOverlays(configDir, declared),
+        ...checkProvidersRegistered(manifest),
+        ...checkScopes(manifest, declared),
+        ...checkIdentity(workingDir, isVercel),
+    ];
+}
+// Every declared environment must resolve to a target valid for the provider.
+// Only meaningful for Vercel (the sole registered provider); an unregistered
+// provider is flagged by checkProvidersRegistered instead.
+function checkEnvResolution(manifest, configDir, isVercel, validTargets) {
+    if (!isVercel)
+        return [];
+    const resolve = (0, targets_1.envTargetResolver)(configDir);
+    return manifest.environments
+        .filter((env) => !validTargets.has(resolve(env)))
+        .map((env) => (0, exports.mkError)(`environment '${env}' resolves to invalid target '${resolve(env)}' — add a deployments[].targets entry mapping it to one of: ${[...validTargets].join(", ")}.`));
+}
+// Each deployments[].targets key must be a declared environment, and (for
+// Vercel) each value must be a valid target.
+function checkDeploymentTargets(manifest, declared, validTargets) {
+    const findings = [];
+    for (const dep of manifest.deployments) {
+        for (const [env, target] of Object.entries(dep.targets)) {
+            if (!declared.has(env))
+                findings.push((0, exports.mkError)(`deployment '${dep.provider}' maps undeclared environment '${env}' — declare it under environments or remove the mapping.`));
+            if (dep.provider === "vercel" && !validTargets.has(target))
+                findings.push((0, exports.mkError)(`deployment '${dep.provider}' maps '${env}' to invalid target '${target}' — valid targets: ${[...validTargets].join(", ")}.`));
+        }
+    }
+    return findings;
+}
+// A per-environment overlay file (deployment/<env>.yml) whose name is not a
+// declared environment is an orphan: it will never be pushed and usually means
+// a typo or a stale file.
+function checkOrphanOverlays(configDir, declared) {
+    if (!fs.existsSync(configDir))
+        return [];
+    const reserved = new Set(["manifest.yml", "environments.yml"]);
+    return fs
+        .readdirSync(configDir)
+        .filter((f) => f.endsWith(".yml") && !reserved.has(f))
+        .filter((f) => !declared.has(f.slice(0, -".yml".length)))
+        .map((f) => (0, exports.mkError)(`overlay file '${f}' has no matching environment — declare '${f.slice(0, -".yml".length)}' or remove deployment/${f}.`));
+}
+// Every deployment and service `provider:` must be registered.
+function checkProvidersRegistered(manifest) {
+    const findings = [];
+    const knownDeployments = new Set(registry_1.KNOWN_DEPLOYMENT_PROVIDERS);
+    for (const dep of manifest.deployments)
+        if (!knownDeployments.has(dep.provider))
+            findings.push((0, exports.mkError)(`unknown deployment provider '${dep.provider}' — envctl supports: ${[...knownDeployments].join(", ")}.`));
+    const knownServices = new Set((0, service_1.serviceProviders)().map((p) => p.provider));
+    for (const svc of manifest.services)
+        if (!knownServices.has(svc.provider))
+            findings.push((0, exports.mkError)(`unknown service provider '${svc.provider}' — envctl supports: ${[...knownServices].join(", ")}.`));
+    return findings;
+}
+// Service and variable-group `environments:` may only reference declared
+// environments.
+function checkScopes(manifest, declared) {
+    const findings = [];
+    for (const svc of manifest.services)
+        for (const env of svc.environments ?? [])
+            if (!declared.has(env))
+                findings.push((0, exports.mkError)(`service '${svc.provider}' is scoped to undeclared environment '${env}'.`));
+    for (const group of manifest.variableGroups)
+        for (const env of group.environments ?? [])
+            if (!declared.has(env))
+                findings.push((0, exports.mkError)(`variable group '${group.name}' is scoped to undeclared environment '${env}'.`));
+    return findings;
+}
+// The Vercel deployment provider's identity should resolve. Missing identity is
+// a warning, not an error: the manifest is still valid — identity is only
+// needed once you push or rotate.
+function checkIdentity(workingDir, isVercel) {
+    if (!isVercel)
+        return [];
+    const linked = fs.existsSync(path.join(workingDir, ".vercel", "project.json")) ||
+        Boolean(process.env.VERCEL_PROJECT_ID);
+    return linked
+        ? []
+        : [
+            (0, exports.mkWarning)("Vercel project identity not resolved — .vercel/project.json is missing and VERCEL_PROJECT_ID is unset. Required for 'config push' and 'secrets', not for validation."),
+        ];
+}
+//# sourceMappingURL=check.js.map

package/dist/lib/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/lib/check.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,kCAmCC;AAzED,uCAAyB;AACzB,2CAA6B;AAE7B,oEAIsC;AACtC,yCAIoB;AACpB,mDAAkE;AAClE,iDAAuD;AACvD,uCAA8C;AAWvC,MAAM,OAAO,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,CAAC;IACpD,QAAQ,EAAE,OAAO;IACjB,OAAO;CACR,CAAC,CAAC;AAHU,QAAA,OAAO,WAGjB;AACI,MAAM,SAAS,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,CAAC;IACtD,QAAQ,EAAE,SAAS;IACnB,OAAO;CACR,CAAC,CAAC;AAHU,QAAA,SAAS,aAGnB;AAEH,8EAA8E;AAC9E,6EAA6E;AAC7E,mCAAmC;AACnC,SAAgB,WAAW,CAAC,UAAkB;IAC5C,MAAM,SAAS,GAAG,IAAA,iCAAa,EAAC,UAAU,CAAC,CAAC;IAC5C,IACE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAA,2BAAgB,EAAC,SAAS,CAAC,CAAC;QAC3C,CAAC,EAAE,CAAC,UAAU,CAAC,IAAA,oCAAgB,EAAC,UAAU,CAAC,CAAC;QAE5C,OAAO;YACL,IAAA,eAAO,EACL,iCAAiC,SAAS,sCAAsC,CACjF;SACF,CAAC;IAEJ,IAAI,QAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,QAAQ,GAAG,IAAA,wBAAa,EAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,IAAA,eAAO,EACL,4CAA4C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACzF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,iCAAa,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,QAAQ,CAAC,KAAK,QAAQ,CAAC;IAE9E,OAAO;QACL,GAAG,kBAAkB,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC;QAClE,GAAG,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC;QAC3D,GAAG,mBAAmB,CAAC,SAAS,EAAE,QAAQ,CAAC;QAC3C,GAAG,wBAAwB,CAAC,QAAQ,CAAC;QACrC,GAAG,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAClC,GAAG,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,2DAA2D;AAC3D,SAAS,kBAAkB,CACzB,QAA0B,EAC1B,SAAiB,EACjB,QAAiB,EACjB,YAAyB;IAEzB,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,IAAA,2BAAiB,EAAC,SAAS,CAAC,CAAC;IAC7C,OAAO,QAAQ,CAAC,YAAY;SACzB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;SAChD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACX,IAAA,eAAO,EACL,gBAAgB,GAAG,iCAAiC,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC/J,CACF,CAAC;AACN,CAAC;AAED,0EAA0E;AAC1E,6CAA6C;AAC7C,SAAS,sBAAsB,CAC7B,QAA0B,EAC1B,QAAqB,EACrB,YAAyB;IAEzB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBACpB,QAAQ,CAAC,IAAI,CACX,IAAA,eAAO,EACL,eAAe,GAAG,CAAC,QAAQ,kCAAkC,GAAG,0DAA0D,CAC3H,CACF,CAAC;YACJ,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;gBACxD,QAAQ,CAAC,IAAI,CACX,IAAA,eAAO,EACL,eAAe,GAAG,CAAC,QAAQ,WAAW,GAAG,wBAAwB,MAAM,sBAAsB,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7H,CACF,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4EAA4E;AAC5E,+EAA+E;AAC/E,0BAA0B;AAC1B,SAAS,mBAAmB,CAC1B,SAAiB,EACjB,QAAqB;IAErB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC/D,OAAO,EAAE;SACN,WAAW,CAAC,SAAS,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACrD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,IAAA,eAAO,EACL,iBAAiB,CAAC,4CAA4C,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,GAAG,CACvH,CACF,CAAC;AACN,CAAC;AAED,+DAA+D;AAC/D,SAAS,wBAAwB,CAAC,QAA0B;IAC1D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,qCAA0B,CAAC,CAAC;IAC7D,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,WAAW;QACpC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;YACrC,QAAQ,CAAC,IAAI,CACX,IAAA,eAAO,EACL,gCAAgC,GAAG,CAAC,QAAQ,wBAAwB,CAAC,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACxG,CACF,CAAC;IAEN,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,IAAA,0BAAgB,GAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ;QACjC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClC,QAAQ,CAAC,IAAI,CACX,IAAA,eAAO,EACL,6BAA6B,GAAG,CAAC,QAAQ,wBAAwB,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAClG,CACF,CAAC;IACN,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,yEAAyE;AACzE,gBAAgB;AAChB,SAAS,WAAW,CAClB,QAA0B,EAC1B,QAAqB;IAErB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ;QACjC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,IAAI,EAAE;YACtC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBACpB,QAAQ,CAAC,IAAI,CACX,IAAA,eAAO,EACL,YAAY,GAAG,CAAC,QAAQ,0CAA0C,GAAG,IAAI,CAC1E,CACF,CAAC;IACR,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,cAAc;QACzC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,YAAY,IAAI,EAAE;YACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBACpB,QAAQ,CAAC,IAAI,CACX,IAAA,eAAO,EACL,mBAAmB,KAAK,CAAC,IAAI,0CAA0C,GAAG,IAAI,CAC/E,CACF,CAAC;IACR,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,0EAA0E;AAC1E,kCAAkC;AAClC,SAAS,aAAa,CAAC,UAAkB,EAAE,QAAiB;IAC1D,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,MAAM,GACV,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QAC/D,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACzC,OAAO,MAAM;QACX,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE,IAAA,iBAAS,EACP,sKAAsK,CACvK;SACF,CAAC;AACR,CAAC"}

package/dist/lib/cli/help.d.ts

@@ -0,0 +1,4 @@
+import type { CommandGroup, Registry } from "./registry";
+export declare function renderTopHelp(registry: Registry): string;
+export declare function renderGroupHelp(group: CommandGroup): string;
+//# sourceMappingURL=help.d.ts.map

package/dist/lib/cli/help.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../../../src/lib/cli/help.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAKzD,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAyBxD;AAGD,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAqB3D"}

package/dist/lib/cli/help.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderTopHelp = renderTopHelp;
+exports.renderGroupHelp = renderGroupHelp;
+// Renders the top-level help: usage plus the list of command groups. With an
+// empty registry the groups section is omitted, so the output stays coherent
+// until command groups land.
+function renderTopHelp(registry) {
+    const lines = [
+        "envctl — manage deploy configuration and provider secrets across projects",
+        "",
+        "Usage:",
+        "  envctl [-C <dir>] <group> <command> [args]",
+        "  envctl --version",
+        "  envctl --help",
+        "",
+        "Global flags:",
+        "  -C, --working-dir <dir>   Project root to operate on (default: current directory)",
+        "  -h, --help                Show help",
+        "      --version             Print the envctl version",
+    ];
+    if (registry.length > 0) {
+        lines.push("", "Command groups:");
+        const width = Math.max(...registry.map((g) => g.name.length));
+        for (const group of registry) {
+            lines.push(`  ${group.name.padEnd(width)}   ${group.summary}`);
+        }
+        lines.push("", "Run 'envctl <group> --help' for a group's commands.");
+    }
+    return lines.join("\n");
+}
+// Renders help for a single group: its commands and their summaries.
+function renderGroupHelp(group) {
+    const usage = group.commands.length === 0 && group.run
+        ? `  envctl ${group.name}`
+        : `  envctl ${group.name} <command> [args]`;
+    const lines = [
+        `envctl ${group.name} — ${group.summary}`,
+        "",
+        "Usage:",
+        usage,
+    ];
+    if (group.commands.length > 0) {
+        lines.push("", "Commands:");
+        const width = Math.max(...group.commands.map((c) => c.name.length));
+        for (const command of group.commands) {
+            lines.push(`  ${command.name.padEnd(width)}   ${command.summary}`);
+        }
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=help.js.map

package/dist/lib/cli/help.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../../../src/lib/cli/help.ts"],"names":[],"mappings":";;AAKA,sCAyBC;AAGD,0CAqBC;AApDD,6EAA6E;AAC7E,6EAA6E;AAC7E,6BAA6B;AAC7B,SAAgB,aAAa,CAAC,QAAkB;IAC9C,MAAM,KAAK,GAAG;QACZ,2EAA2E;QAC3E,EAAE;QACF,QAAQ;QACR,8CAA8C;QAC9C,oBAAoB;QACpB,iBAAiB;QACjB,EAAE;QACF,eAAe;QACf,qFAAqF;QACrF,uCAAuC;QACvC,sDAAsD;KACvD,CAAC;IAEF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9D,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,qDAAqD,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,qEAAqE;AACrE,SAAgB,eAAe,CAAC,KAAmB;IACjD,MAAM,KAAK,GACT,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG;QACtC,CAAC,CAAC,YAAY,KAAK,CAAC,IAAI,EAAE;QAC1B,CAAC,CAAC,YAAY,KAAK,CAAC,IAAI,mBAAmB,CAAC;IAChD,MAAM,KAAK,GAAG;QACZ,UAAU,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,OAAO,EAAE;QACzC,EAAE;QACF,QAAQ;QACR,KAAK;KACN,CAAC;IAEF,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACpE,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/lib/cli/registry.d.ts

@@ -0,0 +1,19 @@
+export interface CommandContext {
+    workingDir: string;
+}
+export interface Command {
+    name: string;
+    summary: string;
+    run(ctx: CommandContext, args: string[]): void | Promise<void>;
+}
+export interface CommandGroup {
+    name: string;
+    summary: string;
+    commands: Command[];
+    run?: Command["run"];
+}
+export type Registry = CommandGroup[];
+export declare function buildRegistry(): Registry;
+export declare function findGroup(registry: Registry, name: string): CommandGroup | undefined;
+export declare function findCommand(group: CommandGroup, name: string): Command | undefined;
+//# sourceMappingURL=registry.d.ts.map

package/dist/lib/cli/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/lib/cli/registry.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,cAAc;IAE7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;IAIpB,GAAG,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;CACtB;AAED,MAAM,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;AAItC,wBAAgB,aAAa,IAAI,QAAQ,CAsFxC;AAED,wBAAgB,SAAS,CACvB,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,GACX,YAAY,GAAG,SAAS,CAE1B;AAED,wBAAgB,WAAW,CACzB,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,GAAG,SAAS,CAErB"}

package/dist/lib/cli/registry.js

@@ -0,0 +1,111 @@
+"use strict";
+// The command registry — the single extension point for the CLI surface.
+// Later milestones add their groups here (config, env, secrets, auth) without
+// touching the router or entrypoint.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildRegistry = buildRegistry;
+exports.findGroup = findGroup;
+exports.findCommand = findCommand;
+const auth_1 = require("../commands/auth");
+const bootstrap_1 = require("../commands/bootstrap");
+const check_1 = require("../commands/check");
+const config_pull_1 = require("../commands/config-pull");
+const config_push_1 = require("../commands/config-push");
+const env_1 = require("../commands/env");
+const init_1 = require("../commands/init");
+const secrets_1 = require("../commands/secrets");
+// The live registry. The router and help output are driven entirely by whatever
+// is listed here; later milestones add their groups (env, secrets, auth).
+function buildRegistry() {
+    return [
+        {
+            name: "config",
+            summary: "Manage environment variables",
+            commands: [
+                {
+                    name: "push",
+                    summary: "Push public (non-secret) env vars to the provider",
+                    run: config_push_1.configPushCommand,
+                },
+                {
+                    name: "pull",
+                    summary: "Materialize an environment into a local dotenv file",
+                    run: config_pull_1.runConfigPull,
+                },
+            ],
+        },
+        {
+            name: "env",
+            summary: "Define project environments and their target mappings",
+            commands: [
+                {
+                    name: "add",
+                    summary: "Add an environment and its target mapping",
+                    run: env_1.runEnvAdd,
+                },
+                {
+                    name: "list",
+                    summary: "List defined environments and their provider targets",
+                    run: env_1.runEnvList,
+                },
+                {
+                    name: "pull",
+                    summary: "Deprecated: use 'config pull'",
+                    run: config_pull_1.runEnvPullDeprecated,
+                },
+            ],
+        },
+        {
+            name: "init",
+            summary: "Scaffold the deployment/ config in this project",
+            commands: [],
+            run: init_1.runInit,
+        },
+        {
+            name: "bootstrap",
+            summary: "Configure a project end to end: push config, init secrets, pull local env",
+            commands: [],
+            run: bootstrap_1.runBootstrapCommand,
+        },
+        {
+            name: "check",
+            summary: "Validate the project's deployment config (read-only)",
+            commands: [],
+            run: check_1.runCheck,
+        },
+        {
+            name: "secrets",
+            summary: "Atomically rotate and bootstrap provider secrets",
+            commands: [
+                {
+                    name: "rotate",
+                    summary: "Rotate Firebase/Sentry secrets, redeploy, then invalidate",
+                    run: secrets_1.runSecretsRotate,
+                },
+                {
+                    name: "init",
+                    summary: "Bootstrap provider secrets for a fresh project",
+                    run: secrets_1.runSecretsInit,
+                },
+            ],
+        },
+        {
+            name: "auth",
+            summary: "Inspect provider credentials",
+            commands: [
+                {
+                    name: "status",
+                    summary: "Show which providers are authenticated and how",
+                    run: auth_1.runAuthStatus,
+                },
+            ],
+        },
+    ];
+}
+function findGroup(registry, name) {
+    return registry.find((g) => g.name === name);
+}
+function findCommand(group, name) {
+    return group.commands.find((c) => c.name === name);
+}
+//# sourceMappingURL=registry.js.map

package/dist/lib/cli/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/lib/cli/registry.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,8EAA8E;AAC9E,qCAAqC;;AAoCrC,sCAsFC;AAED,8BAKC;AAED,kCAKC;AAtID,2CAAiD;AACjD,qDAA4D;AAC5D,6CAA6C;AAC7C,yDAA8E;AAC9E,yDAA4D;AAC5D,yCAAwD;AACxD,2CAA2C;AAC3C,iDAAuE;AAyBvE,gFAAgF;AAChF,0EAA0E;AAC1E,SAAgB,aAAa;IAC3B,OAAO;QACL;YACE,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,8BAA8B;YACvC,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,mDAAmD;oBAC5D,GAAG,EAAE,+BAAiB;iBACvB;gBACD;oBACE,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,qDAAqD;oBAC9D,GAAG,EAAE,2BAAa;iBACnB;aACF;SACF;QACD;YACE,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,uDAAuD;YAChE,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,KAAK;oBACX,OAAO,EAAE,2CAA2C;oBACpD,GAAG,EAAE,eAAS;iBACf;gBACD;oBACE,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,sDAAsD;oBAC/D,GAAG,EAAE,gBAAU;iBAChB;gBACD;oBACE,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,+BAA+B;oBACxC,GAAG,EAAE,kCAAoB;iBAC1B;aACF;SACF;QACD;YACE,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,iDAAiD;YAC1D,QAAQ,EAAE,EAAE;YACZ,GAAG,EAAE,cAAO;SACb;QACD;YACE,IAAI,EAAE,WAAW;YACjB,OAAO,EACL,2EAA2E;YAC7E,QAAQ,EAAE,EAAE;YACZ,GAAG,EAAE,+BAAmB;SACzB;QACD;YACE,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,sDAAsD;YAC/D,QAAQ,EAAE,EAAE;YACZ,GAAG,EAAE,gBAAQ;SACd;QACD;YACE,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,kDAAkD;YAC3D,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,2DAA2D;oBACpE,GAAG,EAAE,0BAAgB;iBACtB;gBACD;oBACE,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,gDAAgD;oBACzD,GAAG,EAAE,wBAAc;iBACpB;aACF;SACF;QACD;YACE,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,8BAA8B;YACvC,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,gDAAgD;oBACzD,GAAG,EAAE,oBAAa;iBACnB;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,SAAS,CACvB,QAAkB,EAClB,IAAY;IAEZ,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,SAAgB,WAAW,CACzB,KAAmB,EACnB,IAAY;IAEZ,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACrD,CAAC"}

package/dist/lib/cli/router.d.ts

@@ -0,0 +1,22 @@
+import type { Command, CommandGroup, Registry } from "./registry";
+export interface GlobalArgs {
+    workingDir: string;
+    rest: string[];
+}
+export declare function extractGlobalArgs(argv: string[], cwd: string): GlobalArgs;
+export type RouteResult = {
+    kind: "version";
+} | {
+    kind: "help";
+    group?: CommandGroup;
+} | {
+    kind: "run";
+    group: CommandGroup;
+    command: Command;
+    args: string[];
+} | {
+    kind: "error";
+    message: string;
+};
+export declare function route(tokens: string[], registry: Registry): RouteResult;
+//# sourceMappingURL=router.d.ts.map

package/dist/lib/cli/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../src/lib/cli/router.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAKlE,MAAM,WAAW,UAAU;IAEzB,UAAU,EAAE,MAAM,CAAC;IAEnB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAKD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CAmBzE;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,YAAY,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAIvC,wBAAgB,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,GAAG,WAAW,CAsCvE"}

package/dist/lib/cli/router.js

@@ -0,0 +1,98 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractGlobalArgs = extractGlobalArgs;
+exports.route = route;
+const path = __importStar(require("path"));
+const logger_1 = require("../logger");
+const registry_1 = require("./registry");
+const HELP_FLAGS = new Set(["-h", "--help"]);
+// Pulls the global -C/--working-dir flag out of argv wherever it appears,
+// resolving its value against `cwd`. Defaults to `cwd` when absent. Throws a
+// FatalError (via err) when the flag is given without a directory value.
+function extractGlobalArgs(argv, cwd) {
+    let workingDir = cwd;
+    const rest = [];
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === "-C" || arg === "--working-dir") {
+            const value = argv[i + 1];
+            if (value === undefined) {
+                (0, logger_1.err)(`${arg} requires a directory argument`);
+            }
+            workingDir = path.resolve(cwd, value);
+            i++; // consume the value
+            continue;
+        }
+        rest.push(arg);
+    }
+    return { workingDir, rest };
+}
+// Pure routing over the non-global tokens. Returns a description of what the
+// entrypoint should do; performs no IO so it is fully unit-testable.
+function route(tokens, registry) {
+    const [first, second, ...rest] = tokens;
+    if (first === undefined || HELP_FLAGS.has(first)) {
+        return { kind: "help" };
+    }
+    if (first === "--version") {
+        return { kind: "version" };
+    }
+    const group = (0, registry_1.findGroup)(registry, first);
+    if (!group) {
+        return { kind: "error", message: `unknown command: ${first}` };
+    }
+    // A runnable leaf group (e.g. `init`) with no subcommand runs directly.
+    if (second === undefined && group.run) {
+        return {
+            kind: "run",
+            group,
+            command: { name: group.name, summary: group.summary, run: group.run },
+            args: [],
+        };
+    }
+    if (second === undefined || HELP_FLAGS.has(second)) {
+        return { kind: "help", group };
+    }
+    const command = (0, registry_1.findCommand)(group, second);
+    if (!command) {
+        return {
+            kind: "error",
+            message: `unknown command: ${group.name} ${second}`,
+        };
+    }
+    return { kind: "run", group, command, args: rest };
+}
+//# sourceMappingURL=router.js.map

package/dist/lib/cli/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../../src/lib/cli/router.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,8CAmBC;AAUD,sBAsCC;AArFD,2CAA6B;AAE7B,sCAAgC;AAEhC,yCAAoD;AAEpD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;AAS7C,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,SAAgB,iBAAiB,CAAC,IAAc,EAAE,GAAW;IAC3D,IAAI,UAAU,GAAG,GAAG,CAAC;IACrB,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAA,YAAG,EAAC,GAAG,GAAG,gCAAgC,CAAC,CAAC;YAC9C,CAAC;YACD,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACtC,CAAC,EAAE,CAAC,CAAC,oBAAoB;YACzB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAC9B,CAAC;AAQD,6EAA6E;AAC7E,qEAAqE;AACrE,SAAgB,KAAK,CAAC,MAAgB,EAAE,QAAkB;IACxD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;IAExC,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,KAAK,GAAG,IAAA,oBAAS,EAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,KAAK,EAAE,EAAE,CAAC;IACjE,CAAC;IAED,wEAAwE;IACxE,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACtC,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK;YACL,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE;YACrE,IAAI,EAAE,EAAE;SACT,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,sBAAW,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,oBAAoB,KAAK,CAAC,IAAI,IAAI,MAAM,EAAE;SACpD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC"}

package/dist/lib/cli/version.d.ts

@@ -0,0 +1,2 @@
+export declare function readPackageVersion(fromDir: string): string;
+//# sourceMappingURL=version.d.ts.map

package/dist/lib/cli/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../../../src/lib/cli/version.ts"],"names":[],"mappings":"AAOA,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAgB1D"}

package/dist/lib/cli/version.js

@@ -0,0 +1,58 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readPackageVersion = readPackageVersion;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+// Walks up from `fromDir` to the nearest package.json and returns its version.
+// Works both when running compiled (dist/envctl.js → repo root) and under
+// Vitest (src/lib/cli → repo root), since neither layout has an intervening
+// package.json. Throws a plain Error if none is found.
+function readPackageVersion(fromDir) {
+    let dir = fromDir;
+    for (;;) {
+        const pkgPath = path.join(dir, "package.json");
+        if (fs.existsSync(pkgPath)) {
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+            return pkg.version ?? "0.0.0";
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir) {
+            throw new Error(`package.json not found above ${fromDir}`);
+        }
+        dir = parent;
+    }
+}
+//# sourceMappingURL=version.js.map

package/dist/lib/cli/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../../src/lib/cli/version.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA,gDAgBC;AAvBD,uCAAyB;AACzB,2CAA6B;AAE7B,+EAA+E;AAC/E,0EAA0E;AAC1E,4EAA4E;AAC5E,uDAAuD;AACvD,SAAgB,kBAAkB,CAAC,OAAe;IAChD,IAAI,GAAG,GAAG,OAAO,CAAC;IAClB,SAAS,CAAC;QACR,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAEvD,CAAC;YACF,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;QAChC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/lib/commands/auth.d.ts

@@ -0,0 +1,2 @@
+export declare function runAuthStatus(): void;
+//# sourceMappingURL=auth.d.ts.map

package/dist/lib/commands/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/lib/commands/auth.ts"],"names":[],"mappings":"AAiBA,wBAAgB,aAAa,IAAI,IAAI,CA0BpC"}

package/dist/lib/commands/auth.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runAuthStatus = runAuthStatus;
+const auth_1 = require("../auth");
+const logger_1 = require("../logger");
+// `envctl auth status` — read-only report of each provider's credential state
+// and source. envctl stores nothing itself; writing credentials is delegated to
+// the providers' own CLIs (vercel login / gcloud auth login / sentry-cli login).
+function runAuthStatus() {
+    const reports = [
+        {
+            name: "vercel",
+            state: (0, auth_1.vercelAuthState)(),
+            hint: "set VERCEL_TOKEN or run `vercel login`",
+        },
+        {
+            name: "gcp",
+            state: (0, auth_1.gcpAuthState)(),
+            hint: "install the gcloud CLI and run `gcloud auth login`",
+        },
+        {
+            name: "sentry",
+            state: (0, auth_1.sentryAuthState)(),
+            hint: "set SENTRY_AUTH_TOKEN or run `sentry-cli login`",
+        },
+    ];
+    for (const { name, state, hint } of reports) {
+        (0, logger_1.log)(state.authenticated
+            ? `${name.padEnd(7)} authenticated (${state.source})`
+            : `${name.padEnd(7)} not authenticated — ${hint}`);
+    }
+}
+//# sourceMappingURL=auth.js.map

package/dist/lib/commands/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/lib/commands/auth.ts"],"names":[],"mappings":";;AAiBA,sCA0BC;AA3CD,kCAKiB;AACjB,sCAAgC;AAQhC,8EAA8E;AAC9E,gFAAgF;AAChF,iFAAiF;AACjF,SAAgB,aAAa;IAC3B,MAAM,OAAO,GAAqB;QAChC;YACE,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,IAAA,sBAAe,GAAE;YACxB,IAAI,EAAE,wCAAwC;SAC/C;QACD;YACE,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,IAAA,mBAAY,GAAE;YACrB,IAAI,EAAE,oDAAoD;SAC3D;QACD;YACE,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,IAAA,sBAAe,GAAE;YACxB,IAAI,EAAE,iDAAiD;SACxD;KACF,CAAC;IAEF,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;QAC5C,IAAA,YAAG,EACD,KAAK,CAAC,aAAa;YACjB,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,KAAK,CAAC,MAAM,GAAG;YACrD,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,wBAAwB,IAAI,EAAE,CACpD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/lib/commands/bootstrap-args.d.ts

@@ -0,0 +1,11 @@
+export interface BootstrapOptions {
+    targetEnv: string;
+    workingDir: string;
+    deploymentDir: string;
+    dryRun: boolean;
+    pull: boolean;
+    out: string;
+}
+export declare const BOOTSTRAP_USAGE = "Usage: envctl bootstrap [OPTIONS]\n\nConfigure a project end to end in one pass: push public environment variables,\ninitialize any provider secrets that are not yet present, then materialize a\nlocal dotenv file for development. Idempotent \u2014 safe to re-run: public vars are\nupserted, and a secret that already exists is left in place (use\n'envctl secrets rotate' to rotate it) rather than re-initialized.\n\nPreconditions: a linked Vercel project (.vercel/project.json, from\n'vercel link'), the Vercel CLI on PATH, an authenticated gcloud for Firebase,\nand a Sentry token for Sentry. Run 'envctl auth status' to check.\n\nOPTIONS:\n  --env <name|all>         Environment(s) for the public-config and secrets\n                           phases (default: all)\n  --deployment-dir <path>  Path to the deployment config directory, resolved\n                           against the project root (default: deployment)\n  --out <path>             Dotenv file the pull phase writes, resolved against\n                           the project root (default: .env.local)\n  --no-pull                Skip the local dotenv pull phase\n  --dry-run                Print the plan for every phase without making changes\n  -h, --help               Show this help";
+export declare function parseBootstrapArgs(args: string[], workingDir: string): BootstrapOptions;
+//# sourceMappingURL=bootstrap-args.d.ts.map