akm-cli 0.9.14 → 0.9.15-beta.1

package/dist/commands/config-cli.js

@@ -12,10 +12,12 @@
  * settings use their canonical engine/strategy paths; retired aliases are not
  * rewritten at this boundary.
  */
+import { isDeepStrictEqual } from "node:util";
 import { defineGroupCommand, defineJsonCommand, output } from "../cli/shared.js";
-import { resolveStashDir } from "../core/common.js";
-import { DEFAULT_CONFIG, loadConfig, mutateConfig } from "../core/config/config.js";
+import { isRecord, resolveStashDir } from "../core/common.js";
+import { DEFAULT_CONFIG, getConfigValueSource, loadConfig, mutateConfig, parseAndValidateConfigText, resolveConfigRefSource, } from "../core/config/config.js";
 import { configGet, configSet, configUnset, unknownKeyHint } from "../core/config/config-walker.js";
+import { UsageError } from "../core/errors.js";
 import { getCacheDir, getConfigPath, getDbPath, getDefaultStashDir } from "../core/paths.js";
 import { formatRegistryUrl } from "../core/registry-url.js";
 // ── Public API ──────────────────────────────────────────────────────────────
@@ -53,6 +55,55 @@ function isRegistryUrlPath(path) {
     return path[0] === "registries" && path.at(-1) === "url";
 }
 export { unknownKeyHint };
+/**
+ * Flatten a (redacted) config object down to `{dottedPath: leafValue}`
+ * entries. A plain object descends; an array or scalar is a leaf — matching
+ * `deepMergeConfig`'s own "objects merge, arrays replace wholesale" rule, so
+ * an array difference reports as one row rather than per-index noise.
+ */
+function flattenConfigLeaves(value, prefix, out) {
+    if (isRecord(value) && Object.keys(value).length > 0) {
+        for (const [key, child] of Object.entries(value))
+            flattenConfigLeaves(child, [...prefix, key], out);
+        return;
+    }
+    out.set(prefix.join("."), value);
+}
+/**
+ * Diff two (already redacted) effective config objects into sorted
+ * `{path, local, other}` rows for every leaf that differs — including a leaf
+ * present on only one side (the other's value reads `undefined`).
+ */
+function diffConfigs(local, other) {
+    const localLeaves = new Map();
+    const otherLeaves = new Map();
+    flattenConfigLeaves(local, [], localLeaves);
+    flattenConfigLeaves(other, [], otherLeaves);
+    const paths = new Set([...localLeaves.keys(), ...otherLeaves.keys()]);
+    const rows = [];
+    for (const path of paths) {
+        const localValue = localLeaves.get(path);
+        const otherValue = otherLeaves.get(path);
+        if (!isDeepStrictEqual(localValue, otherValue))
+            rows.push({ path, local: localValue, other: otherValue });
+    }
+    rows.sort((a, b) => a.path.localeCompare(b.path));
+    return rows;
+}
+/**
+ * `akm config diff <path|bundle//path>`: the current effective config
+ * (this instance's `extends` already applied) against another config file or
+ * bundle-relative file (loaded through the same loader, its own `extends`
+ * honoured), secrets redacted on both sides before comparison so a differing
+ * secret never round-trips into the diff.
+ */
+export function akmConfigDiff(ref) {
+    const current = loadConfig();
+    const { text, resolvedPath } = resolveConfigRefSource(ref, current, getConfigPath());
+    const other = parseAndValidateConfigText(text, resolvedPath);
+    const rows = diffConfigs(redactConfigValue(current), redactConfigValue(other));
+    return { rows };
+}
 // ── `akm config` command surface ────────────────────────────────────────────
 // Extracted verbatim from src/cli.ts (WS6). The `main.subCommands.config` key
 // and every config subcommand's args/output shape are byte-identical. Leaf
@@ -105,9 +156,16 @@ export const configCommand = defineGroupCommand({
             meta: { name: "get", description: "Get a configuration value by key" },
             args: {
                 key: { type: "positional", required: true, description: "Config key (for example: embedding, defaultBundle)" },
+                "show-source": {
+                    type: "boolean",
+                    description: 'Wrap the value as { value, source }, where source is "local", "extends:<ref>" (the nearest ' +
+                        'extends chain member that sets it), or "default".',
+                    default: false,
+                },
             },
             run({ args }) {
-                output("config", getConfigValue(loadConfig(), args.key));
+                const value = getConfigValue(loadConfig(), args.key);
+                output("config", args["show-source"] ? { value, source: getConfigValueSource(args.key) } : value);
             },
         }),
         set: defineJsonCommand({
@@ -152,6 +210,14 @@ export const configCommand = defineGroupCommand({
                 },
             },
             run({ args }) {
+                // A key only an `extends` base supplies has nothing local to remove:
+                // `unsetConfigValue` would silently no-op and the value comes right
+                // back on the next load. Refuse before mutating rather than pretend
+                // it worked.
+                const source = getConfigValueSource(args.key);
+                if (source.startsWith("extends:")) {
+                    throw new UsageError(`Config key "${args.key}" is inherited from ${source} and cannot be unset here.`, "TARGET_NOT_UPDATABLE", `Override it locally with "akm config set ${args.key} <value>", or edit the base file directly.`);
+                }
                 const result = mutateConfig((current) => unsetConfigValue(current, args.key), { absentNoop: true });
                 const updated = result.config;
                 if (!args.silent) {
@@ -159,6 +225,22 @@ export const configCommand = defineGroupCommand({
                 }
             },
         }),
+        diff: defineJsonCommand({
+            meta: {
+                name: "diff",
+                description: "Show effective-config differences against another config file or bundle-relative file, secrets redacted",
+            },
+            args: {
+                ref: {
+                    type: "positional",
+                    required: true,
+                    description: "Other config: a file path or bundle//path (relative to the bundle's content root)",
+                },
+            },
+            run({ args }) {
+                output("config-diff", akmConfigDiff(args.ref));
+            },
+        }),
     },
     // The bare `akm config` invocation (and `akm config --list`) dumps the
     // current config. defineGroupCommand short-circuits this body when a

package/dist/commands/env/env-cli.js

@@ -22,52 +22,11 @@ import path from "node:path";
 import { getParsedInvocation } from "../../cli/invocation.js";
 import { getStringArg } from "../../cli/parse-args.js";
 import { defineGroupCommand, defineJsonCommand, output } from "../../cli/shared.js";
-import { deriveCanonicalAssetName } from "../../core/asset/asset-placement.js";
 import { writeFileAtomic } from "../../core/common.js";
-import { loadConfig } from "../../core/config/config.js";
-import { makeEnvRef, resolveEnvPath, resolveEnvWriteTarget, withEnvSecretWrite } from "../../core/env-secret-ref.js";
+import { listEnvsRecursive, makeEnvRef, resolveEnvPath, resolveEnvWriteTarget, sensitiveMarkerPath, withEnvSecretWrite, } from "../../core/env-secret-ref.js";
 import { ConfigError, NotFoundError, UsageError } from "../../core/errors.js";
-import { resolveSourceEntries } from "../../indexer/search/search-source.js";
 import { readStdin } from "../../runtime.js";
 import { buildChildEnv } from "./child-env.js";
-import { sensitiveMarkerPath } from "./marker-path.js";
-/**
- * Walk each stash's env files and return one entry per `.env` file, using the
- * env asset spec's canonical-name logic (e.g. `env/team/prod.env` →
- * `env/team/prod`, `env/team/.env` → `env/team/default`).
- */
-function listEnvsRecursive(listKeysFn) {
-    const result = [];
-    for (const source of resolveSourceEntries(undefined, loadConfig())) {
-        const root = path.join(source.path, "env");
-        if (!fs.existsSync(root))
-            continue;
-        const walk = (dir) => {
-            for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-                const full = path.join(dir, entry.name);
-                if (entry.isDirectory()) {
-                    walk(full);
-                    continue;
-                }
-                if (!entry.isFile())
-                    continue;
-                if (entry.name !== ".env" && !entry.name.endsWith(".env"))
-                    continue;
-                const canonical = deriveCanonicalAssetName("env", root, full);
-                if (!canonical)
-                    continue;
-                // Skip sensitive envs: a sibling .sensitive marker file suppresses listing.
-                const markerPath = sensitiveMarkerPath(full, "env");
-                if (fs.existsSync(markerPath))
-                    continue;
-                const { keys } = listKeysFn(full);
-                result.push({ ref: makeEnvRef(canonical, source), path: full, keys });
-            }
-        };
-        walk(root);
-    }
-    return result;
-}
 const envListCommand = defineJsonCommand({
     meta: { name: "list", description: "List all env files across all bundles with their key names (no values)" },
     async run() {

package/dist/commands/env/env.js

@@ -49,7 +49,7 @@ import fs from "node:fs";
 import path from "node:path";
 import dotenv from "dotenv";
 import { scanEnvKeyNames, writeFileAtomic } from "../../core/common.js";
-import { sensitiveMarkerPath } from "./marker-path.js";
+import { sensitiveMarkerPath } from "../../core/sensitive-marker-path.js";
 export { scanEnvKeyNames };
 /**
  * Read and return ONLY non-secret metadata: key names.

package/dist/commands/env/secret-cli.js

@@ -35,14 +35,13 @@ import { defineGroupCommand, defineJsonCommand, output } from "../../cli/shared.
 import { decideDangerousEnvInjection } from "../../core/activation-policy.js";
 import { deriveCanonicalAssetName } from "../../core/asset/asset-placement.js";
 import { loadConfig } from "../../core/config/config.js";
-import { makeSecretRef, resolveSecretPath, resolveSecretWriteTarget, withEnvSecretWrite, } from "../../core/env-secret-ref.js";
+import { makeSecretRef, resolveSecretPath, resolveSecretWriteTarget, sensitiveMarkerPath, withEnvSecretWrite, } from "../../core/env-secret-ref.js";
 import { ConfigError, NotFoundError, UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
 import { warn } from "../../core/warn.js";
 import { resolveSourceEntries } from "../../indexer/search/search-source.js";
 import { readStdin } from "../../runtime.js";
 import { buildChildEnv } from "./child-env.js";
-import { sensitiveMarkerPath } from "./marker-path.js";
 function parseKeyListFlag(raw) {
     if (raw === undefined)
         return undefined;