@rmartz/envctl 3.1.1

package/dist/lib/commands/bootstrap-args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-args.d.ts","sourceRoot":"","sources":["../../../src/lib/commands/bootstrap-args.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,gBAAgB;IAG/B,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,EAAE,MAAM,CAAC;IAEnB,aAAa,EAAE,MAAM,CAAC;IAEtB,MAAM,EAAE,OAAO,CAAC;IAEhB,IAAI,EAAE,OAAO,CAAC;IAEd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,eAAO,MAAM,eAAe,0uCAqBc,CAAC;AAI3C,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EAAE,EACd,UAAU,EAAE,MAAM,GACjB,gBAAgB,CAuClB"}

package/dist/lib/commands/bootstrap-args.js

@@ -0,0 +1,111 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BOOTSTRAP_USAGE = void 0;
+exports.parseBootstrapArgs = parseBootstrapArgs;
+const path = __importStar(require("path"));
+const logger_1 = require("../logger");
+exports.BOOTSTRAP_USAGE = `Usage: envctl bootstrap [OPTIONS]
+
+Configure a project end to end in one pass: push public environment variables,
+initialize any provider secrets that are not yet present, then materialize a
+local dotenv file for development. Idempotent — safe to re-run: public vars are
+upserted, and a secret that already exists is left in place (use
+'envctl secrets rotate' to rotate it) rather than re-initialized.
+
+Preconditions: a linked Vercel project (.vercel/project.json, from
+'vercel link'), the Vercel CLI on PATH, an authenticated gcloud for Firebase,
+and a Sentry token for Sentry. Run 'envctl auth status' to check.
+
+OPTIONS:
+  --env <name|all>         Environment(s) for the public-config and secrets
+                           phases (default: all)
+  --deployment-dir <path>  Path to the deployment config directory, resolved
+                           against the project root (default: deployment)
+  --out <path>             Dotenv file the pull phase writes, resolved against
+                           the project root (default: .env.local)
+  --no-pull                Skip the local dotenv pull phase
+  --dry-run                Print the plan for every phase without making changes
+  -h, --help               Show this help`;
+// Parses `bootstrap` args (the global -C/--working-dir flag is already stripped
+// by the router). Prints usage and exits 0 on -h/--help.
+function parseBootstrapArgs(args, workingDir) {
+    let targetEnv = "all";
+    let deploymentDir = "deployment";
+    let dryRun = false;
+    let pull = true;
+    let out = ".env.local";
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === "--env") {
+            targetEnv =
+                args[++i] ?? (0, logger_1.err)('--env requires an environment name or "all"');
+            if (!targetEnv)
+                (0, logger_1.err)('--env requires an environment name or "all"');
+        }
+        else if (arg === "--deployment-dir") {
+            deploymentDir = args[++i] ?? (0, logger_1.err)("--deployment-dir requires a path");
+            if (!deploymentDir)
+                (0, logger_1.err)("--deployment-dir requires a path");
+        }
+        else if (arg === "--out") {
+            out = args[++i] ?? (0, logger_1.err)("--out requires a path");
+            if (!out)
+                (0, logger_1.err)("--out requires a path");
+        }
+        else if (arg === "--no-pull") {
+            pull = false;
+        }
+        else if (arg === "--dry-run") {
+            dryRun = true;
+        }
+        else if (arg === "-h" || arg === "--help") {
+            console.log(exports.BOOTSTRAP_USAGE);
+            process.exit(0);
+        }
+        else {
+            (0, logger_1.err)(`Unknown option: ${arg}. Run 'envctl bootstrap --help' for usage.`);
+        }
+    }
+    return {
+        targetEnv,
+        workingDir,
+        deploymentDir: path.resolve(workingDir, deploymentDir),
+        dryRun,
+        pull,
+        out: path.resolve(workingDir, out),
+    };
+}
+//# sourceMappingURL=bootstrap-args.js.map

package/dist/lib/commands/bootstrap-args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-args.js","sourceRoot":"","sources":["../../../src/lib/commands/bootstrap-args.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,gDA0CC;AA1FD,2CAA6B;AAE7B,sCAAgC;AAqBnB,QAAA,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;0CAqBW,CAAC;AAE3C,gFAAgF;AAChF,yDAAyD;AACzD,SAAgB,kBAAkB,CAChC,IAAc,EACd,UAAkB;IAElB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,aAAa,GAAG,YAAY,CAAC;IACjC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,IAAI,GAAG,GAAG,YAAY,CAAC;IAEvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,SAAS;gBACP,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAA,YAAG,EAAC,6CAA6C,CAAC,CAAC;YAClE,IAAI,CAAC,SAAS;gBAAE,IAAA,YAAG,EAAC,6CAA6C,CAAC,CAAC;QACrE,CAAC;aAAM,IAAI,GAAG,KAAK,kBAAkB,EAAE,CAAC;YACtC,aAAa,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAA,YAAG,EAAC,kCAAkC,CAAC,CAAC;YACrE,IAAI,CAAC,aAAa;gBAAE,IAAA,YAAG,EAAC,kCAAkC,CAAC,CAAC;QAC9D,CAAC;aAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YAC3B,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAA,YAAG,EAAC,uBAAuB,CAAC,CAAC;YAChD,IAAI,CAAC,GAAG;gBAAE,IAAA,YAAG,EAAC,uBAAuB,CAAC,CAAC;QACzC,CAAC;aAAM,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;aAAM,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;aAAM,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,uBAAe,CAAC,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,IAAA,YAAG,EAAC,mBAAmB,GAAG,4CAA4C,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS;QACT,UAAU;QACV,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC;QACtD,MAAM;QACN,IAAI;QACJ,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;KACnC,CAAC;AACJ,CAAC"}

package/dist/lib/commands/bootstrap.d.ts

@@ -0,0 +1,5 @@
+import type { CommandContext } from "../cli/registry";
+import type { BootstrapOptions } from "./bootstrap-args";
+export declare function runBootstrap(opts: BootstrapOptions): Promise<void>;
+export declare function runBootstrapCommand(ctx: CommandContext, args: string[]): Promise<void>;
+//# sourceMappingURL=bootstrap.d.ts.map

package/dist/lib/commands/bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../../src/lib/commands/bootstrap.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AActD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAiKzD,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmDxE;AAID,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/lib/commands/bootstrap.js

@@ -0,0 +1,166 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runBootstrap = runBootstrap;
+exports.runBootstrapCommand = runBootstrapCommand;
+const auth_1 = require("../auth");
+const deployments_1 = require("../deployments");
+const environments_1 = require("../environments");
+const targets_1 = require("../targets");
+const firebase_credential_1 = require("../firebase-credential");
+const logger_1 = require("../logger");
+const manifest_1 = require("../manifest");
+const project_1 = require("../project");
+const subprocess_1 = require("../subprocess");
+const vercel_api_1 = require("../vercel-api");
+const bootstrap_args_1 = require("./bootstrap-args");
+const config_pull_1 = require("./config-pull");
+const config_push_1 = require("./config-push");
+const env_plan_1 = require("./env-plan");
+const secrets_1 = require("./secrets");
+const secrets_plan_1 = require("./secrets-plan");
+// Fails fast, before any change, on the prerequisites the three phases need:
+// a resolvable Vercel project, the Vercel CLI (for the pull), gcloud (for
+// Firebase), and a Sentry token (for Sentry). Tool-existence checks are skipped
+// on --dry-run because those tools are never invoked on that path.
+function bootstrapPreflight(opts, configured) {
+    (0, project_1.detectProject)(opts.workingDir); // throws early if the project can't be resolved
+    if (opts.dryRun)
+        return;
+    if (opts.pull && !(0, subprocess_1.commandExists)("vercel"))
+        (0, logger_1.err)("The Vercel CLI is required for the local pull phase. Install it (e.g. `npm i -g vercel`) or pass --no-pull.");
+    if (configured.firebase && !(0, subprocess_1.commandExists)("gcloud"))
+        (0, logger_1.err)("gcloud is required to initialize Firebase secrets. Authenticate gcloud, or remove Firebase config to skip it.");
+    if (configured.sentry && !(0, auth_1.resolveSentryToken)())
+        (0, logger_1.err)("A Sentry token is required to initialize Sentry secrets. Set SENTRY_AUTH_TOKEN or run `sentry-cli login`.");
+}
+// The three fixed Vercel deployment targets. Used to check full presence for
+// "--env all": a secret is "already present" only if it covers all targets.
+const ALL_VERCEL_TARGETS = ["production", "preview", "development"];
+// Reports which providers already have their secret present in the Vercel
+// project, scoped to the requested target(s) so a partial prior run (e.g. key
+// exists for production only) does not incorrectly skip other environments.
+// Uses the manifest's resolved Firebase credential names so a project with
+// custom var names (e.g. `privateKey: FB_PK`) is correctly detected.
+async function detectExistingSecrets(client, targetEnv, deploymentDir) {
+    const { envs } = await client.listEnvVars();
+    const isPresent = (key) => {
+        if (targetEnv === "all") {
+            return ALL_VERCEL_TARGETS.every((t) => envs.some((e) => e.key === key && e.target.includes(t)));
+        }
+        return envs.some((e) => e.key === key && e.target.includes(targetEnv));
+    };
+    const firebaseService = (0, manifest_1.parseManifest)(deploymentDir).services.find((s) => s.provider === "firebase");
+    const firebaseSpec = (0, firebase_credential_1.resolveFirebaseCredential)(firebaseService);
+    return {
+        firebase: (0, firebase_credential_1.firebasePresenceKeys)(firebaseSpec).some(isPresent),
+        sentry: ["SENTRY_DSN", "NEXT_PUBLIC_SENTRY_DSN"].some(isPresent),
+    };
+}
+// Phase 2: initialize each configured secret that is not already present.
+// Idempotent — an existing secret is left in place (rotate it explicitly).
+async function bootstrapSecrets(opts, token, configured, resolvedTarget) {
+    const services = ["firebase", "sentry"].filter((s) => configured[s]);
+    if (services.length === 0) {
+        (0, logger_1.log)("  No secret providers configured — skipping.");
+        return;
+    }
+    if (opts.dryRun) {
+        for (const s of services)
+            (0, logger_1.log)(`  Would initialize ${s} secrets if not already present.`);
+        return;
+    }
+    const project = (0, project_1.detectProject)(opts.workingDir);
+    const client = new vercel_api_1.VercelClient(token, project.projectId, project.teamId);
+    const present = await detectExistingSecrets(client, resolvedTarget, opts.deploymentDir);
+    for (const service of services) {
+        if (present[service]) {
+            (0, logger_1.log)(`  ${service}: already present — skipping (use 'envctl secrets rotate' to rotate).`);
+            continue;
+        }
+        (0, logger_1.log)(`  ${service}: initializing...`);
+        await (0, secrets_1.runSecrets)({
+            targetEnv: resolvedTarget,
+            workingDir: opts.workingDir,
+            deploymentDir: opts.deploymentDir,
+            invalidateKeys: true,
+            refreshPreviews: false,
+            init: service,
+        });
+    }
+}
+// Phase 4: trigger redeployments so running environments pick up the pushed
+// vars. On a zero-deployment project this logs a skip per env (the
+// "No READY deployment found" message) rather than erroring, satisfying the
+// #71 requirement that bootstrap explicitly reports when verification is skipped.
+async function bootstrapVerify(opts, token, resolvedTarget) {
+    if (opts.dryRun) {
+        (0, logger_1.log)("  Would trigger redeployments to verify pushed configuration.");
+        return;
+    }
+    const project = (0, project_1.detectProject)(opts.workingDir);
+    const client = new vercel_api_1.VercelClient(token, project.projectId, project.teamId);
+    await (0, deployments_1.triggerAndWaitRedeployments)(resolvedTarget, client);
+}
+// Phase 3: materialize the local dotenv file from the development environment.
+function bootstrapPull(opts) {
+    if (!opts.pull) {
+        (0, logger_1.log)("  Skipping local dotenv pull (--no-pull).");
+        return;
+    }
+    if (opts.dryRun) {
+        (0, logger_1.log)(`  Would pull development into ${opts.out}.`);
+        return;
+    }
+    // Bootstrap is idempotent and always refreshes the local dotenv, so it
+    // overwrites any existing file (--force).
+    (0, config_pull_1.runConfigPull)({ workingDir: opts.workingDir }, [
+        "--env",
+        "development",
+        "--out",
+        opts.out,
+        "--force",
+    ]);
+}
+// Orchestrates the end-to-end bootstrap: public config, then any missing
+// secrets, then the local dotenv file. Accepts fully-resolved options so it is
+// directly unit-testable.
+async function runBootstrap(opts) {
+    const token = (0, auth_1.resolveVercelToken)();
+    (0, env_plan_1.assertDeploymentPrereqs)(opts.deploymentDir, token); // narrows token to string
+    const activeEnvs = (0, environments_1.listActiveEnvs)(opts.deploymentDir);
+    if (activeEnvs.length === 0)
+        (0, logger_1.err)(`No active environments found in ${opts.deploymentDir}/environments.yml`);
+    const devSource = (0, env_plan_1.findDevSource)(opts.deploymentDir, activeEnvs);
+    const envList = (0, env_plan_1.resolveEnvList)(activeEnvs, opts.targetEnv, devSource);
+    // Resolve the env name to its Vercel provider target for Vercel API calls.
+    // detectConfiguredServices scans env YAML files and needs the env name, not
+    // the provider target, so it still receives opts.targetEnv.
+    const resolvedTarget = opts.targetEnv === "all"
+        ? "all"
+        : (0, targets_1.resolveEnvTarget)(opts.deploymentDir, opts.targetEnv);
+    const configured = (0, secrets_plan_1.detectConfiguredServices)(opts.deploymentDir, opts.targetEnv, envList, devSource);
+    bootstrapPreflight(opts, configured);
+    (0, logger_1.log)(opts.dryRun
+        ? "Bootstrap dry run — no changes will be made"
+        : "Bootstrapping project...");
+    (0, logger_1.log)("Phase 1/4 — public environment variables");
+    await (0, config_push_1.runPush)({
+        targetEnv: opts.targetEnv,
+        workingDir: opts.workingDir,
+        deploymentDir: opts.deploymentDir,
+        dryRun: opts.dryRun,
+    });
+    (0, logger_1.log)("Phase 2/4 — provider secrets");
+    await bootstrapSecrets(opts, token, configured, resolvedTarget);
+    (0, logger_1.log)("Phase 3/4 — local environment file");
+    bootstrapPull(opts);
+    (0, logger_1.log)("Phase 4/4 — post-push verification");
+    await bootstrapVerify(opts, token, resolvedTarget);
+    (0, logger_1.log)(opts.dryRun ? "Dry run complete." : "Bootstrap complete.");
+}
+// Command adapter: parses args (the global -C is already stripped by the
+// router) and dispatches to the orchestrator.
+async function runBootstrapCommand(ctx, args) {
+    await runBootstrap((0, bootstrap_args_1.parseBootstrapArgs)(args, ctx.workingDir));
+}
+//# sourceMappingURL=bootstrap.js.map

package/dist/lib/commands/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../../src/lib/commands/bootstrap.ts"],"names":[],"mappings":";;AAgLA,oCAmDC;AAID,kDAKC;AA5OD,kCAAiE;AAEjE,gDAA6D;AAC7D,kDAAiD;AACjD,wCAA8C;AAC9C,gEAGgC;AAChC,sCAAqC;AACrC,0CAA4C;AAC5C,wCAA2C;AAC3C,8CAA8C;AAC9C,8CAA6C;AAC7C,qDAAsD;AAEtD,+CAA8C;AAC9C,+CAAwC;AACxC,yCAIoB;AACpB,uCAAuC;AACvC,iDAA0D;AAI1D,6EAA6E;AAC7E,0EAA0E;AAC1E,gFAAgF;AAChF,mEAAmE;AACnE,SAAS,kBAAkB,CACzB,IAAsB,EACtB,UAAsB;IAEtB,IAAA,uBAAa,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,gDAAgD;IAChF,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO;IACxB,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAA,0BAAa,EAAC,QAAQ,CAAC;QACvC,IAAA,YAAG,EACD,6GAA6G,CAC9G,CAAC;IACJ,IAAI,UAAU,CAAC,QAAQ,IAAI,CAAC,IAAA,0BAAa,EAAC,QAAQ,CAAC;QACjD,IAAA,YAAG,EACD,+GAA+G,CAChH,CAAC;IACJ,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,IAAA,yBAAkB,GAAE;QAC5C,IAAA,YAAG,EACD,2GAA2G,CAC5G,CAAC;AACN,CAAC;AAED,6EAA6E;AAC7E,4EAA4E;AAC5E,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAU,CAAC;AAE7E,0EAA0E;AAC1E,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,qEAAqE;AACrE,KAAK,UAAU,qBAAqB,CAClC,MAAoB,EACpB,SAAiB,EACjB,aAAqB;IAErB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,CAAC,GAAW,EAAW,EAAE;QACzC,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CACpC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CACxD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC;IACF,MAAM,eAAe,GAAG,IAAA,wBAAa,EAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,IAAI,CAChE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CACjC,CAAC;IACF,MAAM,YAAY,GAAG,IAAA,+CAAyB,EAAC,eAAe,CAAC,CAAC;IAChE,OAAO;QACL,QAAQ,EAAE,IAAA,0CAAoB,EAAC,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;QAC5D,MAAM,EAAE,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,KAAK,UAAU,gBAAgB,CAC7B,IAAsB,EACtB,KAAa,EACb,UAAsB,EACtB,cAAsB;IAEtB,MAAM,QAAQ,GAAI,CAAC,UAAU,EAAE,QAAQ,CAAW,CAAC,MAAM,CACvD,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CACrB,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAA,YAAG,EAAC,8CAA8C,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,QAAQ;YACtB,IAAA,YAAG,EAAC,sBAAsB,CAAC,kCAAkC,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,yBAAY,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,MAAM,qBAAqB,CACzC,MAAM,EACN,cAAc,EACd,IAAI,CAAC,aAAa,CACnB,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACrB,IAAA,YAAG,EACD,KAAK,OAAO,uEAAuE,CACpF,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAA,YAAG,EAAC,KAAK,OAAO,mBAAmB,CAAC,CAAC;QACrC,MAAM,IAAA,oBAAU,EAAC;YACf,SAAS,EAAE,cAAc;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,cAAc,EAAE,IAAI;YACpB,eAAe,EAAE,KAAK;YACtB,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,mEAAmE;AACnE,4EAA4E;AAC5E,kFAAkF;AAClF,KAAK,UAAU,eAAe,CAC5B,IAAsB,EACtB,KAAa,EACb,cAAsB;IAEtB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAA,YAAG,EAAC,+DAA+D,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,yBAAY,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,IAAA,yCAA2B,EAAC,cAAc,EAAE,MAAM,CAAC,CAAC;AAC5D,CAAC;AAED,+EAA+E;AAC/E,SAAS,aAAa,CAAC,IAAsB;IAC3C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,IAAA,YAAG,EAAC,2CAA2C,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAA,YAAG,EAAC,iCAAiC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IACD,uEAAuE;IACvE,0CAA0C;IAC1C,IAAA,2BAAa,EAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE;QAC7C,OAAO;QACP,aAAa;QACb,OAAO;QACP,IAAI,CAAC,GAAG;QACR,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,+EAA+E;AAC/E,0BAA0B;AACnB,KAAK,UAAU,YAAY,CAAC,IAAsB;IACvD,MAAM,KAAK,GAAG,IAAA,yBAAkB,GAAE,CAAC;IACnC,IAAA,kCAAuB,EAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,0BAA0B;IAE9E,MAAM,UAAU,GAAG,IAAA,6BAAc,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACtD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QACzB,IAAA,YAAG,EACD,mCAAmC,IAAI,CAAC,aAAa,mBAAmB,CACzE,CAAC;IACJ,MAAM,SAAS,GAAG,IAAA,wBAAa,EAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,IAAA,yBAAc,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACtE,2EAA2E;IAC3E,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,cAAc,GAClB,IAAI,CAAC,SAAS,KAAK,KAAK;QACtB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAA,0BAAgB,EAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,IAAA,uCAAwB,EACzC,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,SAAS,EACd,OAAO,EACP,SAAS,CACV,CAAC;IAEF,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAErC,IAAA,YAAG,EACD,IAAI,CAAC,MAAM;QACT,CAAC,CAAC,6CAA6C;QAC/C,CAAC,CAAC,0BAA0B,CAC/B,CAAC;IAEF,IAAA,YAAG,EAAC,0CAA0C,CAAC,CAAC;IAChD,MAAM,IAAA,qBAAO,EAAC;QACZ,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IAEH,IAAA,YAAG,EAAC,8BAA8B,CAAC,CAAC;IACpC,MAAM,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IAEhE,IAAA,YAAG,EAAC,oCAAoC,CAAC,CAAC;IAC1C,aAAa,CAAC,IAAI,CAAC,CAAC;IAEpB,IAAA,YAAG,EAAC,oCAAoC,CAAC,CAAC;IAC1C,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;IAEnD,IAAA,YAAG,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;AACjE,CAAC;AAED,yEAAyE;AACzE,8CAA8C;AACvC,KAAK,UAAU,mBAAmB,CACvC,GAAmB,EACnB,IAAc;IAEd,MAAM,YAAY,CAAC,IAAA,mCAAkB,EAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/lib/commands/check.d.ts

@@ -0,0 +1,3 @@
+import type { CommandContext } from "../cli/registry";
+export declare function runCheck(ctx: CommandContext, args: string[]): Promise<void>;
+//# sourceMappingURL=check.d.ts.map

package/dist/lib/commands/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../src/lib/commands/check.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AA2BtD,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,IAAI,CAAC,CAoBf"}

package/dist/lib/commands/check.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCheck = runCheck;
+const check_1 = require("../check");
+const check_live_1 = require("../check-live");
+const logger_1 = require("../logger");
+const USAGE = `Usage: envctl check [--live]
+
+Validate that the project's deployment config is coherent and deployable,
+without changing anything. Reports every problem it finds and exits non-zero if
+any is an error.
+
+  --live   Also reconcile declared public variables against what is live on the
+           deployment provider (requires network + auth).`;
+function parseCheckArgs(args) {
+    let live = false;
+    for (const arg of args) {
+        if (arg === "--live")
+            live = true;
+        else if (arg === "-h" || arg === "--help") {
+            console.log(USAGE);
+            process.exit(0);
+        }
+        else
+            (0, logger_1.err)(`Unknown option: ${arg}. Run 'envctl check --help' for usage.`);
+    }
+    return { live };
+}
+// `envctl check [--live]` — read-only validation of the project's deployment
+// config. Prints each finding, then exits non-zero (via err) if any error was
+// found.
+async function runCheck(ctx, args) {
+    const { live } = parseCheckArgs(args);
+    const findings = (0, check_1.checkStatic)(ctx.workingDir);
+    if (live)
+        findings.push(...(await (0, check_live_1.checkLive)(ctx.workingDir)));
+    for (const f of findings)
+        console.error(`  ${f.severity === "error" ? "✖" : "⚠"} ${f.message}`);
+    const errorCount = findings.filter((f) => f.severity === "error").length;
+    const warningCount = findings.length - errorCount;
+    if (errorCount > 0)
+        (0, logger_1.err)(`check failed: ${errorCount} error(s)${warningCount ? `, ${warningCount} warning(s)` : ""}.`);
+    (0, logger_1.log)(warningCount > 0
+        ? `OK with ${warningCount} warning(s).`
+        : "OK — deployment config is valid.");
+}
+//# sourceMappingURL=check.js.map

package/dist/lib/commands/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../../src/lib/commands/check.ts"],"names":[],"mappings":";;AA6BA,4BAuBC;AApDD,oCAAqD;AACrD,8CAA0C;AAE1C,sCAAqC;AAErC,MAAM,KAAK,GAAG;;;;;;;0DAO4C,CAAC;AAE3D,SAAS,cAAc,CAAC,IAAc;IACpC,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,QAAQ;YAAE,IAAI,GAAG,IAAI,CAAC;aAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;;YAAM,IAAA,YAAG,EAAC,mBAAmB,GAAG,wCAAwC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,8EAA8E;AAC9E,SAAS;AACF,KAAK,UAAU,QAAQ,CAC5B,GAAmB,EACnB,IAAc;IAEd,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAEtC,MAAM,QAAQ,GAAc,IAAA,mBAAW,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,IAAI;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAA,sBAAS,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAE9D,KAAK,MAAM,CAAC,IAAI,QAAQ;QACtB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAExE,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACzE,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC;IAClD,IAAI,UAAU,GAAG,CAAC;QAChB,IAAA,YAAG,EACD,iBAAiB,UAAU,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,CAC7F,CAAC;IACJ,IAAA,YAAG,EACD,YAAY,GAAG,CAAC;QACd,CAAC,CAAC,WAAW,YAAY,cAAc;QACvC,CAAC,CAAC,kCAAkC,CACvC,CAAC;AACJ,CAAC"}

package/dist/lib/commands/config-pull.d.ts

@@ -0,0 +1,12 @@
+import type { CommandContext } from "../cli/registry";
+interface PullOptions {
+    env: string;
+    out: string;
+    force: boolean;
+}
+export declare const PULL_USAGE = "Usage: envctl config pull [OPTIONS]\n\nMaterialize a local dotenv file from an environment for local development \u2014 the\ninverse of 'config push'. Delegates to the Vercel CLI (`vercel env pull`),\nwhich handles decryption and dotenv escaping, so the pulled file includes the\nenvironment's secrets. The environment name is mapped to its Vercel target the\nsame way as 'config push' (development -> development, staging -> preview, ...).\n\nThe target holds live secrets: it is written with owner-only (0600) permissions\nand 'config pull' warns if it is not gitignored.\n\nOPTIONS:\n  --env <name>   Environment to pull (default: development)\n  --out <path>   Output file, resolved against the project root\n                 (default: .env.local)\n  --force        Overwrite the target file if it already exists\n  -h, --help     Show this help";
+export declare function parsePullArgs(args: string[], workingDir: string): PullOptions;
+export declare function runConfigPull(ctx: CommandContext, args: string[]): void;
+export declare function runEnvPullDeprecated(ctx: CommandContext, args: string[]): void;
+export {};
+//# sourceMappingURL=config-pull.d.ts.map

package/dist/lib/commands/config-pull.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-pull.d.ts","sourceRoot":"","sources":["../../../src/lib/commands/config-pull.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAMtD,UAAU,WAAW;IAEnB,GAAG,EAAE,MAAM,CAAC;IAEZ,GAAG,EAAE,MAAM,CAAC;IAEZ,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,eAAO,MAAM,UAAU,s1BAgBS,CAAC;AAGjC,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAsB7E;AAuBD,wBAAgB,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CA2DvE;AAID,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,EAAE,GACb,IAAI,CAGN"}

package/dist/lib/commands/config-pull.js

@@ -0,0 +1,161 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PULL_USAGE = void 0;
+exports.parsePullArgs = parsePullArgs;
+exports.runConfigPull = runConfigPull;
+exports.runEnvPullDeprecated = runEnvPullDeprecated;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const logger_1 = require("../logger");
+const subprocess_1 = require("../subprocess");
+const targets_1 = require("../targets");
+const deployment_config_1 = require("./deployment-config");
+exports.PULL_USAGE = `Usage: envctl config pull [OPTIONS]
+
+Materialize a local dotenv file from an environment for local development — the
+inverse of 'config push'. Delegates to the Vercel CLI (\`vercel env pull\`),
+which handles decryption and dotenv escaping, so the pulled file includes the
+environment's secrets. The environment name is mapped to its Vercel target the
+same way as 'config push' (development -> development, staging -> preview, ...).
+
+The target holds live secrets: it is written with owner-only (0600) permissions
+and 'config pull' warns if it is not gitignored.
+
+OPTIONS:
+  --env <name>   Environment to pull (default: development)
+  --out <path>   Output file, resolved against the project root
+                 (default: .env.local)
+  --force        Overwrite the target file if it already exists
+  -h, --help     Show this help`;
+// `args` has already had the global -C/--working-dir flag stripped by the router.
+function parsePullArgs(args, workingDir) {
+    let env = "development";
+    let out = ".env.local";
+    let force = false;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === "--env") {
+            env = args[++i] ?? (0, logger_1.err)("--env requires an environment name");
+        }
+        else if (arg === "--out") {
+            out = args[++i] ?? (0, logger_1.err)("--out requires a path");
+        }
+        else if (arg === "--force") {
+            force = true;
+        }
+        else if (arg === "-h" || arg === "--help") {
+            console.log(exports.PULL_USAGE);
+            process.exit(0);
+        }
+        else {
+            (0, logger_1.err)(`Unknown option: ${arg}. Run 'envctl config pull --help' for usage.`);
+        }
+    }
+    return { env, out: path.resolve(workingDir, out), force };
+}
+// Warns when the pulled file is not gitignored, since it now holds live
+// secrets. Uses `git check-ignore` (the authoritative source: it honors nested
+// .gitignore, negations, and global excludes) rather than reimplementing the
+// match. Silently skips when git is absent or the path is outside a repo — a
+// spurious warning is worse than none for an advisory check.
+function warnIfNotGitIgnored(target, cwd) {
+    if (!(0, subprocess_1.commandExists)("git"))
+        return;
+    const { status } = (0, subprocess_1.runStatus)("git", ["check-ignore", "-q", "--", target], {
+        cwd,
+    });
+    if (status === 1)
+        (0, logger_1.warn)(`${target} is not gitignored — it holds secrets and may be committed. Add it to .gitignore.`);
+}
+// `envctl config pull` — pull an environment's variables into a local dotenv
+// file, the inverse of `config push`. Wraps the Vercel CLI (it owns decryption
+// + escaping); preflights that the CLI is present and the directory is a linked
+// Vercel project, refuses to clobber an existing file without --force, and
+// restricts the written file to the owner because it contains secrets.
+function runConfigPull(ctx, args) {
+    const opts = parsePullArgs(args, ctx.workingDir);
+    if (!(0, subprocess_1.commandExists)("vercel")) {
+        (0, logger_1.err)("The Vercel CLI is required for 'config pull'. Install it (e.g. `npm i -g vercel`) and run `vercel login`.");
+    }
+    if (!fs.existsSync(path.join(ctx.workingDir, ".vercel", "project.json"))) {
+        (0, logger_1.err)("Not a linked Vercel project (no .vercel/project.json). Run `vercel link` first.");
+    }
+    // Use lstatSync (not existsSync) to avoid following symlinks: a dangling
+    // symlink returns false from existsSync but lstatSync detects it.
+    let targetStat;
+    try {
+        targetStat = fs.lstatSync(opts.out);
+    }
+    catch {
+        // Target does not exist — safe to create.
+    }
+    if (targetStat !== undefined) {
+        if (!targetStat.isFile()) {
+            (0, logger_1.err)(`${opts.out} exists but is not a regular file — refusing to write secrets to it.`);
+        }
+        if (!opts.force) {
+            (0, logger_1.err)(`Refusing to overwrite ${opts.out} without --force.`);
+        }
+    }
+    const target = (0, targets_1.resolveEnvTarget)((0, deployment_config_1.deploymentDir)(ctx.workingDir), opts.env);
+    // Pre-create the target at 0600 before the CLI writes secrets into it,
+    // closing the window where the CLI creates the file with a permissive umask.
+    // chmodSync handles existing files, since writeFileSync's mode applies only
+    // on creation.
+    fs.writeFileSync(opts.out, "", { mode: 0o600 });
+    fs.chmodSync(opts.out, 0o600);
+    (0, logger_1.log)(`Pulling '${opts.env}' (${target}) into ${opts.out}...`);
+    try {
+        (0, subprocess_1.run)("vercel", ["env", "pull", opts.out, `--environment=${target}`, "--yes"], {
+            cwd: ctx.workingDir,
+            env: { ...process.env, VERCEL_NON_INTERACTIVE: "1" },
+        });
+    }
+    catch (error) {
+        (0, logger_1.err)(`vercel env pull failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    // Backstop: some CLIs replace the inode (temp-then-rename); re-lock after write.
+    fs.chmodSync(opts.out, 0o600);
+    warnIfNotGitIgnored(opts.out, ctx.workingDir);
+    (0, logger_1.log)(`Wrote ${opts.out}`);
+}
+// Deprecated alias: `envctl env pull` now lives at `config pull` (the inverse of
+// `config push`). Warns, then delegates so existing scripts keep working.
+function runEnvPullDeprecated(ctx, args) {
+    (0, logger_1.warn)("'envctl env pull' is deprecated — use 'envctl config pull' instead.");
+    runConfigPull(ctx, args);
+}
+//# sourceMappingURL=config-pull.js.map

package/dist/lib/commands/config-pull.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-pull.js","sourceRoot":"","sources":["../../../src/lib/commands/config-pull.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,sCAsBC;AAuBD,sCA2DC;AAID,oDAMC;AAvJD,uCAAyB;AACzB,2CAA6B;AAG7B,sCAA2C;AAC3C,8CAA8D;AAC9D,wCAA8C;AAC9C,2DAAoD;AAWvC,QAAA,UAAU,GAAG;;;;;;;;;;;;;;;;gCAgBM,CAAC;AAEjC,kFAAkF;AAClF,SAAgB,aAAa,CAAC,IAAc,EAAE,UAAkB;IAC9D,IAAI,GAAG,GAAG,aAAa,CAAC;IACxB,IAAI,GAAG,GAAG,YAAY,CAAC;IACvB,IAAI,KAAK,GAAG,KAAK,CAAC;IAElB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAA,YAAG,EAAC,oCAAoC,CAAC,CAAC;QAC/D,CAAC;aAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YAC3B,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAA,YAAG,EAAC,uBAAuB,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;aAAM,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,kBAAU,CAAC,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,IAAA,YAAG,EAAC,mBAAmB,GAAG,8CAA8C,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;AAC5D,CAAC;AAED,wEAAwE;AACxE,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,6DAA6D;AAC7D,SAAS,mBAAmB,CAAC,MAAc,EAAE,GAAW;IACtD,IAAI,CAAC,IAAA,0BAAa,EAAC,KAAK,CAAC;QAAE,OAAO;IAClC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,sBAAS,EAAC,KAAK,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE;QACxE,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,CAAC;QACd,IAAA,aAAI,EACF,GAAG,MAAM,mFAAmF,CAC7F,CAAC;AACN,CAAC;AAED,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,2EAA2E;AAC3E,uEAAuE;AACvE,SAAgB,aAAa,CAAC,GAAmB,EAAE,IAAc;IAC/D,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAEjD,IAAI,CAAC,IAAA,0BAAa,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,IAAA,YAAG,EACD,2GAA2G,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QACzE,IAAA,YAAG,EACD,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,kEAAkE;IAClE,IAAI,UAAgC,CAAC;IACrC,IAAI,CAAC;QACH,UAAU,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;IAC5C,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACzB,IAAA,YAAG,EACD,GAAG,IAAI,CAAC,GAAG,sEAAsE,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,IAAA,YAAG,EAAC,yBAAyB,IAAI,CAAC,GAAG,mBAAmB,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAC,IAAA,iCAAa,EAAC,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACzE,uEAAuE;IACvE,6EAA6E;IAC7E,4EAA4E;IAC5E,eAAe;IACf,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,IAAA,YAAG,EAAC,YAAY,IAAI,CAAC,GAAG,MAAM,MAAM,UAAU,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,IAAA,gBAAG,EACD,QAAQ,EACR,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,iBAAiB,MAAM,EAAE,EAAE,OAAO,CAAC,EAC7D;YACE,GAAG,EAAE,GAAG,CAAC,UAAU;YACnB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,sBAAsB,EAAE,GAAG,EAAE;SACrD,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAA,YAAG,EACD,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACpF,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAA,YAAG,EAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,iFAAiF;AACjF,0EAA0E;AAC1E,SAAgB,oBAAoB,CAClC,GAAmB,EACnB,IAAc;IAEd,IAAA,aAAI,EAAC,qEAAqE,CAAC,CAAC;IAC5E,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC"}

package/dist/lib/commands/config-push-args.d.ts

@@ -0,0 +1,9 @@
+export interface PushOptions {
+    targetEnv: string;
+    workingDir: string;
+    deploymentDir: string;
+    dryRun: boolean;
+}
+export declare const PUSH_USAGE = "Usage: envctl config push [OPTIONS]\n\nUpsert public (non-secret) environment variables to a Vercel project from\ndeployment configuration files. Reads the list of active environments from\n<deployment-dir>/environments.yml and per-environment values from\n<deployment-dir>/{env}.yml.\n\nThe development Vercel target is always populated from the same YAML source as\nthe staging/preview environment. It does not appear in environments.yml and has\nno dedicated YAML file. Existing variables are updated in place; missing ones\nare created as plain-type records. Variables not present in the config files are\nleft untouched.\n\nOPTIONS:\n  --env <name>             Target a specific environment by name as listed in\n                           environments.yml, or 'development' for the implicit\n                           development target (default: all active environments\n                           plus development)\n  --deployment-dir <path>  Path to the deployment config directory, resolved\n                           against the project root (default: deployment)\n  --dry-run                Print what would change without making any API calls\n  -h, --help               Show this help\n\nENVIRONMENT MAPPING:\n  production  \u2192 production (Vercel target)\n  staging     \u2192 preview   (Vercel target)\n  preview     \u2192 preview   (Vercel target)\n  development \u2192 development (implicit \u2014 mirrors staging/preview)\n  <other>     \u2192 passed through as-is";
+export declare function parsePushArgs(args: string[], workingDir: string): PushOptions;
+//# sourceMappingURL=config-push-args.d.ts.map

package/dist/lib/commands/config-push-args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-push-args.d.ts","sourceRoot":"","sources":["../../../src/lib/commands/config-push-args.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,WAAW;IAG1B,SAAS,EAAE,MAAM,CAAC;IAGlB,UAAU,EAAE,MAAM,CAAC;IAEnB,aAAa,EAAE,MAAM,CAAC;IAEtB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,eAAO,MAAM,UAAU,q9CA4Bc,CAAC;AAMtC,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CA8B7E"}