@willbooster/wb 15.2.1 → 15.3.0

package/bin/dotenv.js

@@ -83,17 +83,30 @@ function validateStandardWbEnv(value, fixTarget) {
 
 // Mirrors src/commands/dotenv.ts (readAndApplyEnvironmentVariables) for this startup fast path.
 function readAndApplyEnvironmentVariables(cwd) {
+  // The mode is FORCED only when WB_ENV is explicitly exported; it drives the forced-mode override
+  // below and the validation at the end.
   const mode = process.env.WB_ENV;
-  // Mode-specific sources drive the forced-mode override below.
+  // Two selectors, both defaulting to development like wb's main loader (`WB_ENV || NODE_ENV ||
+  // 'development'`) so a repo keeping dev-only secrets in `[profiles.development.secrets]` loads them
+  // when WB_ENV is unset instead of only the base table:
+  //   - envCascade picks the `.env.<envCascade>` files. It must NOT consult FNOX_PROFILE — that is a
+  //     fnox-only selector, and letting it redirect a legacy `.env`-only project's cascade would load
+  //     the wrong files.
+  //   - fnoxCascade picks the fnox `--profile` and gates the WB_ENV check below. It additionally honors
+  //     an explicit FNOX_PROFILE, because fnox honors it and `wb dotenv` without WB_ENV is documented
+  //     to as well.
+  const envCascade = mode || process.env.NODE_ENV || 'development';
+  const fnoxCascade = mode || process.env.FNOX_PROFILE || process.env.NODE_ENV || 'development';
+  // Mode-specific sources drive the forced-mode override below (only meaningful when the mode is forced).
   const modeVars = mode
     ? { ...readEnvFile(path.join(cwd, `.env.${mode}`)), ...readEnvFile(path.join(cwd, `.env.${mode}.local`)) }
     : {};
-  // Mirror the shared cascade's precedence: .env.<mode>.local > .env.local > .env.<mode> > .env.
+  // Mirror the shared cascade's precedence: .env.<c>.local > .env.local > .env.<c> > .env (c = envCascade).
   const dotenvVars = {
     ...readEnvFile(path.join(cwd, '.env')),
-    ...(mode ? readEnvFile(path.join(cwd, `.env.${mode}`)) : {}),
+    ...readEnvFile(path.join(cwd, `.env.${envCascade}`)),
     ...readEnvFile(path.join(cwd, '.env.local')),
-    ...(mode ? readEnvFile(path.join(cwd, `.env.${mode}.local`)) : {}),
+    ...readEnvFile(path.join(cwd, `.env.${envCascade}.local`)),
   };
   // WB_ENV in process.env means the mode is explicitly forced, so values from the mode's own
   // sources (.env.<mode>[.local] and the fnox profile) win over variables inherited from the
@@ -101,7 +114,7 @@ function readAndApplyEnvironmentVariables(cwd) {
   // (see https://github.com/WillBooster/shared/issues/930).
   const modeFileOverridesProcessEnv = !!mode && !isCI(process.env.CI);
   // fnox.toml is the committed, encrypted equivalent of .env files; local .env files still win over it.
-  const fnoxVars = readFnoxEnvironmentVariables(cwd, mode, dotenvVars, modeFileOverridesProcessEnv);
+  const fnoxVars = readFnoxEnvironmentVariables(cwd, fnoxCascade, dotenvVars, modeFileOverridesProcessEnv);
   const parsed = { ...fnoxVars, ...dotenvVars };
   // Expand ${...} references against exported variables whose FILE value loses to the shell
   // (mirroring readEnvironmentVariables' effective-value semantics): a reference must resolve to
@@ -139,18 +152,26 @@ function readAndApplyEnvironmentVariables(cwd) {
   // child will see.
   validateStandardWbEnv(mode, 'the exported variable');
   validateStandardWbEnv(process.env.WB_ENV, 'the env source or the exported variable');
-  // The exported mode selected the cascade, so a mode file silently replacing it with a DIFFERENT
-  // valid mode (e.g. `.env.production` containing `WB_ENV=development`) must be rejected as well.
+  // The selected environment is what an env source silently resolving WB_ENV to a DIFFERENT value must
+  // agree with, else the child runs labeled one environment while carrying another's secrets. The
+  // expectation is `fnoxCascade` only when a fnox config participates (its profile provides WB_ENV in a
+  // compliant repo); in a legacy `.env`-only project FNOX_PROFILE is irrelevant, so the expectation is
+  // `envCascade`. This covers both a forced `.env.production` containing `WB_ENV=development` and the
+  // default-development path (`.env.development`, read even when WB_ENV is unset, containing
+  // `WB_ENV=production`), comparing against the selected cascade rather than just the forced `mode`.
+  // Only a STANDARD cascade is enforced (mirroring Project.completeAndValidateWbEnv): a custom suffix
+  // such as `NODE_ENV=qa` legitimately selects `.env.qa` while WB_ENV stays a standard mode.
+  const expectedCascade = hasProjectFnoxConfig(cwd) ? fnoxCascade : envCascade;
   if (
-    mode &&
     process.env.WB_ENV &&
-    process.env.WB_ENV !== mode &&
+    ['development', 'test', 'staging', 'production'].includes(expectedCascade) &&
+    process.env.WB_ENV !== expectedCascade &&
     process.env.WB_SKIP_ENV_CHECK !== '1' &&
     process.env.WB_SKIP_ENV_CHECK !== 'true'
   ) {
     console.error(
-      `WB_ENV resolves to "${process.env.WB_ENV}" although the "${mode}" environment was selected. ` +
-        `Fix the WB_ENV defined in the mode's env sources, or set WB_SKIP_ENV_CHECK=1 to skip this check.`
+      `WB_ENV resolves to "${process.env.WB_ENV}" although the "${expectedCascade}" environment was selected. ` +
+        `Fix the WB_ENV defined in the env sources, or set WB_SKIP_ENV_CHECK=1 to skip this check.`
     );
     process.exit(1);
   }
@@ -197,8 +218,8 @@ function runFnoxExport(cwd, cascade, options) {
   if (options.ignoreProfileEnvVar) {
     // Without `--profile`, fnox falls back to FNOX_PROFILE; the base-adjudication export must
     // read the BASE secrets, so the inherited profile selection is cleared for it — and only for
-    // it: a profile-less PRIMARY export (e.g. `wb dotenv` without WB_ENV) keeps honoring
-    // FNOX_PROFILE.
+    // it. A PRIMARY export still honors FNOX_PROFILE: it either stays profile-less (fnox reads the
+    // variable) or folds it into the `--profile` it passes (see wb dotenv's cascade).
     delete env.FNOX_PROFILE;
   }
   const result = childProcess.spawnSync('fnox', args, {