convex 1.47.0 → 1.48.0-alpha.0

package/dist/cjs/cli/lib/profiles.js

@@ -0,0 +1,333 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var profiles_exports = {};
+__export(profiles_exports, {
+  findProfileDirectory: () => findProfileDirectory,
+  getProfileSelection: () => getProfileSelection,
+  initializeDefaultProfile: () => initializeDefaultProfile,
+  legacyAuthForFirstProfile: () => legacyAuthForFirstProfile,
+  profileConfigPath: () => profileConfigPath,
+  readProfileAuth: () => readProfileAuth,
+  readProfileCredentials: () => readProfileCredentials,
+  readProfileSettings: () => readProfileSettings,
+  readProfileToken: () => readProfileToken,
+  savedProfileNames: () => savedProfileNames,
+  updateProfileSettings: () => updateProfileSettings,
+  validateProfileName: () => validateProfileName,
+  writeProfileCredentials: () => writeProfileCredentials,
+  writeProfileDirectory: () => writeProfileDirectory
+});
+module.exports = __toCommonJS(profiles_exports);
+var import_path = __toESM(require("path"), 1);
+var import_util = require("util");
+var import_crypto = require("crypto");
+var dotenv = __toESM(require("dotenv"), 1);
+var import_zod = require("zod");
+var import_log = require("../../bundler/log.js");
+var import_globalConfig = require("./utils/globalConfig.js");
+var import_utils = require("./utils/utils.js");
+var import_envvars = require("./envvars.js");
+const settingsSchema = import_zod.z.object({
+  defaultProfile: import_zod.z.string().optional(),
+  directories: import_zod.z.record(import_zod.z.string()).optional(),
+  revokeReplacedTokens: import_zod.z.boolean().optional()
+}).passthrough();
+const credentialsSchema = import_zod.z.object({
+  accessToken: import_zod.z.string().min(1),
+  memberId: import_zod.z.string().optional(),
+  email: import_zod.z.string().optional()
+}).passthrough();
+async function readProfileSettings(ctx) {
+  if (!ctx.fs.exists((0, import_globalConfig.globalConfigPath)())) return {};
+  try {
+    return settingsSchema.parse(
+      JSON.parse(ctx.fs.readUtf8File((0, import_globalConfig.globalConfigPath)()))
+    );
+  } catch {
+    return await ctx.crash({
+      exitCode: 1,
+      errorType: "invalid filesystem data",
+      printedMessage: `Unable to read account settings from ${(0, import_globalConfig.globalConfigPath)()}. Check defaultProfile, directories, and revokeReplacedTokens.`
+    });
+  }
+}
+function writeProfileSettings(ctx, settings) {
+  if (Object.keys(settings).length === 0) {
+    if (ctx.fs.exists((0, import_globalConfig.globalConfigPath)())) ctx.fs.unlink((0, import_globalConfig.globalConfigPath)());
+    return;
+  }
+  const temporary = `${(0, import_globalConfig.globalConfigPath)()}.${(0, import_crypto.randomUUID)()}.tmp`;
+  try {
+    ctx.fs.writeUtf8File(temporary, JSON.stringify(settings, null, 2), 384);
+    ctx.fs.swapTmpFile(temporary, (0, import_globalConfig.globalConfigPath)());
+  } finally {
+    if (ctx.fs.exists(temporary)) ctx.fs.unlink(temporary);
+  }
+}
+async function updateProfileSettings(ctx, update, afterWrite) {
+  const lockPath = `${(0, import_globalConfig.globalConfigPath)()}.lock`;
+  ctx.fs.mkdir((0, import_utils.rootDirectory)(), { allowExisting: true });
+  const deadline = Date.now() + 5e3;
+  for (; ; ) {
+    try {
+      ctx.fs.mkdir(lockPath);
+      break;
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      if (Date.now() >= deadline) {
+        return await ctx.crash({
+          exitCode: 1,
+          errorType: "fatal",
+          printedMessage: `Another command is updating Convex accounts. Retry after it finishes. If it was interrupted, remove ${lockPath}.`
+        });
+      }
+      await new Promise((resolve) => setTimeout(resolve, 25));
+    }
+  }
+  let released = false;
+  const release = () => {
+    if (released) return;
+    ctx.fs.rmdir(lockPath);
+    released = true;
+  };
+  const cleanup = ctx.registerCleanup(async () => release());
+  try {
+    const settings = await readProfileSettings(ctx);
+    const result = await update(settings);
+    writeProfileSettings(ctx, settings);
+    afterWrite?.();
+    return result;
+  } finally {
+    ctx.removeCleanup(cleanup);
+    release();
+  }
+}
+function profileConfigPath(name) {
+  return import_path.default.join(
+    (0, import_utils.rootDirectory)(),
+    "profiles",
+    `${encodeURIComponent(name)}.json`
+  );
+}
+async function validateProfileName(ctx, name) {
+  if (!/^[a-z0-9][a-z0-9_-]*$/.test(name)) {
+    await ctx.crash({
+      exitCode: 1,
+      errorType: "invalid filesystem or env vars",
+      printedMessage: "Account names must start with a lowercase letter or number and contain only lowercase letters, numbers, hyphens, and underscores."
+    });
+  }
+}
+async function getProfileSelection(ctx, options = {}) {
+  let name = options.name;
+  let source = "--account";
+  if (name === void 0 && process.env[import_envvars.CONVEX_ACCOUNT_ENV_VAR] !== void 0) {
+    name = process.env[import_envvars.CONVEX_ACCOUNT_ENV_VAR];
+    source = `${import_envvars.CONVEX_ACCOUNT_ENV_VAR} environment variable`;
+  }
+  if (name === void 0) {
+    const files = options.envFile ? [options.envFile] : [import_utils.ENV_VAR_FILE_PATH, ".env"];
+    for (const file of files) {
+      if (!ctx.fs.exists(file)) continue;
+      name = dotenv.parse(ctx.fs.readUtf8File(file))[import_envvars.CONVEX_ACCOUNT_ENV_VAR];
+      if (name !== void 0) {
+        source = `${import_envvars.CONVEX_ACCOUNT_ENV_VAR} in ${file}`;
+        break;
+      }
+    }
+  }
+  if (name === void 0) {
+    const config = await readProfileSettings(ctx);
+    const binding = findProfileDirectory(
+      config.directories ?? {},
+      process.cwd()
+    );
+    name = binding?.name ?? config.defaultProfile;
+    source = binding ? `directory selection for ${binding.directory}` : `default account in ${(0, import_globalConfig.globalConfigPath)()}`;
+  }
+  if (name === void 0) return null;
+  await validateProfileName(ctx, name);
+  return { name, source };
+}
+async function readProfileAuth(ctx, profile, allowMissing = false) {
+  const credentials = await readProfileCredentials(ctx, profile, allowMissing);
+  return credentials === null ? null : {
+    kind: "accessToken",
+    accessToken: credentials.accessToken,
+    header: `Bearer ${credentials.accessToken}`,
+    profile
+  };
+}
+async function readProfileCredentials(ctx, profile, allowMissing = false) {
+  await validateProfileName(ctx, profile.name);
+  const configPath = profileConfigPath(profile.name);
+  if (!ctx.fs.exists(configPath)) {
+    if (allowMissing) return null;
+    return await ctx.crash({
+      exitCode: 1,
+      errorType: "invalid filesystem data",
+      printedMessage: `Account "${profile.name}" selected by ${profile.source} is not logged in. Run \`npx convex login --account ${profile.name}\`.`
+    });
+  }
+  try {
+    return credentialsSchema.parse(JSON.parse(ctx.fs.readUtf8File(configPath)));
+  } catch {
+    return await ctx.crash({
+      exitCode: 1,
+      errorType: "invalid filesystem data",
+      printedMessage: `Unable to read credentials for account "${profile.name}" from ${configPath}.`
+    });
+  }
+}
+function readProfileToken(ctx, name) {
+  try {
+    const token = JSON.parse(
+      ctx.fs.readUtf8File(profileConfigPath(name))
+    ).accessToken;
+    return typeof token === "string" && token.length > 0 ? token : null;
+  } catch {
+    return null;
+  }
+}
+async function writeCredentialsFile(ctx, name, credentials) {
+  const configPath = profileConfigPath(name);
+  const directory = import_path.default.dirname(configPath);
+  ctx.fs.mkdir(directory, { allowExisting: true });
+  for (const dir of [(0, import_utils.rootDirectory)(), directory]) {
+    if (!ctx.fs.lstat(dir).isDirectory()) {
+      return await ctx.crash({
+        exitCode: 1,
+        errorType: "invalid filesystem data",
+        printedMessage: `Cannot save account credentials through a symlink or non-directory: ${dir}.`
+      });
+    }
+  }
+  const temporary = `${configPath}.${(0, import_crypto.randomUUID)()}.tmp`;
+  try {
+    ctx.fs.writeUtf8File(
+      temporary,
+      JSON.stringify(credentials, null, 2),
+      384
+    );
+    ctx.fs.swapTmpFile(temporary, configPath);
+  } finally {
+    if (ctx.fs.exists(temporary)) ctx.fs.unlink(temporary);
+  }
+}
+async function writeProfileCredentials(ctx, name, accessToken, metadata = {}, expected) {
+  await validateProfileName(ctx, name);
+  await updateProfileSettings(ctx, async (settings) => {
+    if (expected !== void 0) {
+      const current = await readProfileCredentials(
+        ctx,
+        { name, source: "login" },
+        true
+      );
+      if (!(0, import_util.isDeepStrictEqual)(current, expected)) {
+        return await ctx.crash({
+          exitCode: 1,
+          errorType: "fatal",
+          printedMessage: `Account "${name}" changed during login. Retry the login.`
+        });
+      }
+    }
+    await writeCredentialsFile(ctx, name, { ...metadata, accessToken });
+    if (settings.defaultProfile === name) settings.accessToken = accessToken;
+  });
+}
+async function legacyAuthForFirstProfile(ctx, profile) {
+  const settings = await readProfileSettings(ctx);
+  const profilesDir = import_path.default.dirname(profileConfigPath(profile.name));
+  if (settings.defaultProfile !== void 0 || ctx.fs.exists(profilesDir) && ctx.fs.listDir(profilesDir).some((entry) => entry.name.endsWith(".json"))) {
+    return null;
+  }
+  const config = (0, import_globalConfig.readGlobalConfig)(ctx);
+  return config === null ? null : {
+    kind: "accessToken",
+    accessToken: config.accessToken,
+    header: `Bearer ${config.accessToken}`,
+    profile
+  };
+}
+async function initializeDefaultProfile(ctx, profile, namingLegacyAccount, select = true) {
+  const defaultProfile = await updateProfileSettings(ctx, async (settings) => {
+    if (settings.defaultProfile !== void 0) return void 0;
+    const credentials = await readProfileCredentials(ctx, profile);
+    const accessToken = credentials.accessToken;
+    const legacyToken = settings.accessToken;
+    if (!select && (savedProfileNames(ctx).some((name) => name !== profile.name) || !namingLegacyAccount && typeof legacyToken === "string" && legacyToken.length > 0 && legacyToken !== accessToken))
+      return void 0;
+    if (!namingLegacyAccount && typeof legacyToken === "string" && legacyToken.length > 0 && legacyToken !== accessToken) {
+      let legacyName = "default";
+      for (let suffix = 2; ctx.fs.exists(profileConfigPath(legacyName)); suffix++) {
+        legacyName = `default-${suffix}`;
+      }
+      await writeCredentialsFile(ctx, legacyName, { accessToken: legacyToken });
+      settings.defaultProfile = legacyName;
+    } else {
+      settings.defaultProfile = profile.name;
+      settings.accessToken = accessToken;
+    }
+    return settings.defaultProfile;
+  });
+  if (defaultProfile !== void 0)
+    (0, import_log.logFinishedStep)(`Default account: ${defaultProfile}`);
+}
+function findProfileDirectory(directories, cwd) {
+  let directory = import_path.default.resolve(cwd);
+  for (; ; ) {
+    if (Object.hasOwn(directories, directory)) {
+      return { directory, name: directories[directory] };
+    }
+    const parent = import_path.default.dirname(directory);
+    if (parent === directory) return null;
+    directory = parent;
+  }
+}
+function savedProfileNames(ctx) {
+  const directory = import_path.default.join((0, import_utils.rootDirectory)(), "profiles");
+  if (!ctx.fs.exists(directory)) return [];
+  return ctx.fs.listDir(directory).filter((entry) => entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -5)).sort();
+}
+async function writeProfileDirectory(ctx, name) {
+  await validateProfileName(ctx, name);
+  await updateProfileSettings(ctx, (settings) => {
+    settings.directories = { ...settings.directories, [process.cwd()]: name };
+  });
+  (0, import_log.logFinishedStep)(
+    `Saved directory selection: ${name} (applies to this directory and its subdirectories).`
+  );
+  const selected = await getProfileSelection(ctx);
+  if (selected !== null && selected.name !== name) {
+    (0, import_log.logWarning)(
+      `Account "${selected.name}" selected by ${selected.source} overrides this directory selection. Remove that override to use account "${name}".`
+    );
+  }
+}
+//# sourceMappingURL=profiles.js.map

package/dist/cjs/cli/lib/profiles.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/cli/lib/profiles.ts"],
+  "sourcesContent": ["import path from \"path\";\nimport { isDeepStrictEqual } from \"util\";\nimport { randomUUID } from \"crypto\";\nimport { TempPath } from \"../../bundler/fs.js\";\nimport * as dotenv from \"dotenv\";\nimport { z } from \"zod\";\nimport { BigBrainAuth, Context } from \"../../bundler/context.js\";\nimport { logFinishedStep, logWarning } from \"../../bundler/log.js\";\nimport { globalConfigPath, readGlobalConfig } from \"./utils/globalConfig.js\";\nimport { ENV_VAR_FILE_PATH, rootDirectory } from \"./utils/utils.js\";\n\nimport { CONVEX_ACCOUNT_ENV_VAR } from \"./envvars.js\";\n\nexport type ProfileSelection = {\n  name: string;\n  source: string;\n};\n\nconst settingsSchema = z\n  .object({\n    defaultProfile: z.string().optional(),\n    directories: z.record(z.string()).optional(),\n    revokeReplacedTokens: z.boolean().optional(),\n  })\n  .passthrough();\n\nconst credentialsSchema = z\n  .object({\n    accessToken: z.string().min(1),\n    memberId: z.string().optional(),\n    email: z.string().optional(),\n  })\n  .passthrough();\n\nexport type ProfileCredentials = z.infer<typeof credentialsSchema>;\n\nexport async function readProfileSettings(\n  ctx: Context,\n): Promise<z.infer<typeof settingsSchema>> {\n  if (!ctx.fs.exists(globalConfigPath())) return {};\n  try {\n    return settingsSchema.parse(\n      JSON.parse(ctx.fs.readUtf8File(globalConfigPath())),\n    );\n  } catch {\n    return await ctx.crash({\n      exitCode: 1,\n      errorType: \"invalid filesystem data\",\n      printedMessage: `Unable to read account settings from ${globalConfigPath()}. Check defaultProfile, directories, and revokeReplacedTokens.`,\n    });\n  }\n}\n\nfunction writeProfileSettings(ctx: Context, settings: Record<string, unknown>) {\n  if (Object.keys(settings).length === 0) {\n    if (ctx.fs.exists(globalConfigPath())) ctx.fs.unlink(globalConfigPath());\n    return;\n  }\n  const temporary = `${globalConfigPath()}.${randomUUID()}.tmp` as TempPath;\n  try {\n    ctx.fs.writeUtf8File(temporary, JSON.stringify(settings, null, 2), 0o600);\n    ctx.fs.swapTmpFile(temporary, globalConfigPath());\n  } finally {\n    if (ctx.fs.exists(temporary)) ctx.fs.unlink(temporary);\n  }\n}\n\nexport async function updateProfileSettings<T>(\n  ctx: Context,\n  update: (settings: z.infer<typeof settingsSchema>) => T | Promise<T>,\n  afterWrite?: () => void,\n): Promise<T> {\n  const lockPath = `${globalConfigPath()}.lock`;\n  ctx.fs.mkdir(rootDirectory(), { allowExisting: true });\n  const deadline = Date.now() + 5000;\n  for (;;) {\n    try {\n      ctx.fs.mkdir(lockPath);\n      break;\n    } catch (err: any) {\n      // Only the process that creates the directory owns the update lock.\n      // eslint-disable-next-line no-restricted-syntax\n      if (err.code !== \"EEXIST\") throw err;\n      if (Date.now() >= deadline) {\n        return await ctx.crash({\n          exitCode: 1,\n          errorType: \"fatal\",\n          printedMessage: `Another command is updating Convex accounts. Retry after it finishes. If it was interrupted, remove ${lockPath}.`,\n        });\n      }\n      await new Promise((resolve) => setTimeout(resolve, 25));\n    }\n  }\n  let released = false;\n  const release = () => {\n    if (released) return;\n    ctx.fs.rmdir(lockPath);\n    released = true;\n  };\n  const cleanup = ctx.registerCleanup(async () => release());\n  try {\n    const settings = await readProfileSettings(ctx);\n    const result = await update(settings);\n    writeProfileSettings(ctx, settings);\n    // Credential deletion follows persistence while sharing the lock with renewals.\n    afterWrite?.();\n    return result;\n  } finally {\n    ctx.removeCleanup(cleanup);\n    release();\n  }\n}\n\nexport function profileConfigPath(name: string): string {\n  return path.join(\n    rootDirectory(),\n    \"profiles\",\n    `${encodeURIComponent(name)}.json`,\n  );\n}\n\nexport async function validateProfileName(\n  ctx: Context,\n  name: string,\n): Promise<void> {\n  if (!/^[a-z0-9][a-z0-9_-]*$/.test(name)) {\n    await ctx.crash({\n      exitCode: 1,\n      errorType: \"invalid filesystem or env vars\",\n      printedMessage:\n        \"Account names must start with a lowercase letter or number and contain only lowercase letters, numbers, hyphens, and underscores.\",\n    });\n  }\n}\n\nexport async function getProfileSelection(\n  ctx: Context,\n  options: { name?: string | undefined; envFile?: string | undefined } = {},\n): Promise<ProfileSelection | null> {\n  let name = options.name;\n  let source = \"--account\";\n  if (name === undefined && process.env[CONVEX_ACCOUNT_ENV_VAR] !== undefined) {\n    name = process.env[CONVEX_ACCOUNT_ENV_VAR];\n    source = `${CONVEX_ACCOUNT_ENV_VAR} environment variable`;\n  }\n  if (name === undefined) {\n    const files = options.envFile\n      ? [options.envFile]\n      : [ENV_VAR_FILE_PATH, \".env\"];\n    for (const file of files) {\n      if (!ctx.fs.exists(file)) continue;\n      name = dotenv.parse(ctx.fs.readUtf8File(file))[CONVEX_ACCOUNT_ENV_VAR];\n      if (name !== undefined) {\n        source = `${CONVEX_ACCOUNT_ENV_VAR} in ${file}`;\n        break;\n      }\n    }\n  }\n  if (name === undefined) {\n    const config = await readProfileSettings(ctx);\n    const binding = findProfileDirectory(\n      config.directories ?? {},\n      process.cwd(),\n    );\n    name = binding?.name ?? config.defaultProfile;\n    source = binding\n      ? `directory selection for ${binding.directory}`\n      : `default account in ${globalConfigPath()}`;\n  }\n  if (name === undefined) return null;\n  await validateProfileName(ctx, name);\n  return { name, source };\n}\n\nexport async function readProfileAuth(\n  ctx: Context,\n  profile: ProfileSelection,\n  allowMissing = false,\n): Promise<Extract<BigBrainAuth, { kind: \"accessToken\" }> | null> {\n  const credentials = await readProfileCredentials(ctx, profile, allowMissing);\n  return credentials === null\n    ? null\n    : {\n        kind: \"accessToken\",\n        accessToken: credentials.accessToken,\n        header: `Bearer ${credentials.accessToken}`,\n        profile,\n      };\n}\n\nexport async function readProfileCredentials(\n  ctx: Context,\n  profile: ProfileSelection,\n  allowMissing = false,\n): Promise<ProfileCredentials | null> {\n  await validateProfileName(ctx, profile.name);\n  const configPath = profileConfigPath(profile.name);\n  if (!ctx.fs.exists(configPath)) {\n    if (allowMissing) return null;\n    return await ctx.crash({\n      exitCode: 1,\n      errorType: \"invalid filesystem data\",\n      printedMessage: `Account \"${profile.name}\" selected by ${profile.source} is not logged in. Run \\`npx convex login --account ${profile.name}\\`.`,\n    });\n  }\n  try {\n    return credentialsSchema.parse(JSON.parse(ctx.fs.readUtf8File(configPath)));\n  } catch {\n    return await ctx.crash({\n      exitCode: 1,\n      errorType: \"invalid filesystem data\",\n      printedMessage: `Unable to read credentials for account \"${profile.name}\" from ${configPath}.`,\n    });\n  }\n}\n\nexport function readProfileToken(ctx: Context, name: string): string | null {\n  try {\n    const token = JSON.parse(\n      ctx.fs.readUtf8File(profileConfigPath(name)),\n    ).accessToken;\n    return typeof token === \"string\" && token.length > 0 ? token : null;\n  } catch {\n    return null;\n  }\n}\n\nasync function writeCredentialsFile(\n  ctx: Context,\n  name: string,\n  credentials: ProfileCredentials,\n) {\n  const configPath = profileConfigPath(name);\n  const directory = path.dirname(configPath);\n  ctx.fs.mkdir(directory, { allowExisting: true });\n  for (const dir of [rootDirectory(), directory]) {\n    if (!ctx.fs.lstat(dir).isDirectory()) {\n      return await ctx.crash({\n        exitCode: 1,\n        errorType: \"invalid filesystem data\",\n        printedMessage: `Cannot save account credentials through a symlink or non-directory: ${dir}.`,\n      });\n    }\n  }\n  const temporary = `${configPath}.${randomUUID()}.tmp` as TempPath;\n  try {\n    ctx.fs.writeUtf8File(\n      temporary,\n      JSON.stringify(credentials, null, 2),\n      0o600,\n    );\n    ctx.fs.swapTmpFile(temporary, configPath);\n  } finally {\n    if (ctx.fs.exists(temporary)) ctx.fs.unlink(temporary);\n  }\n}\n\nexport async function writeProfileCredentials(\n  ctx: Context,\n  name: string,\n  accessToken: string,\n  metadata: Omit<ProfileCredentials, \"accessToken\"> = {},\n  expected?: ProfileCredentials | null,\n): Promise<void> {\n  await validateProfileName(ctx, name);\n  await updateProfileSettings(ctx, async (settings) => {\n    if (expected !== undefined) {\n      const current = await readProfileCredentials(\n        ctx,\n        { name, source: \"login\" },\n        true,\n      );\n      if (!isDeepStrictEqual(current, expected)) {\n        return await ctx.crash({\n          exitCode: 1,\n          errorType: \"fatal\",\n          printedMessage: `Account \"${name}\" changed during login. Retry the login.`,\n        });\n      }\n    }\n    await writeCredentialsFile(ctx, name, { ...metadata, accessToken });\n    if (settings.defaultProfile === name) settings.accessToken = accessToken;\n  });\n}\n\nexport async function legacyAuthForFirstProfile(\n  ctx: Context,\n  profile: ProfileSelection,\n): Promise<Extract<BigBrainAuth, { kind: \"accessToken\" }> | null> {\n  const settings = await readProfileSettings(ctx);\n  const profilesDir = path.dirname(profileConfigPath(profile.name));\n  if (\n    settings.defaultProfile !== undefined ||\n    (ctx.fs.exists(profilesDir) &&\n      ctx.fs.listDir(profilesDir).some((entry) => entry.name.endsWith(\".json\")))\n  ) {\n    return null;\n  }\n  const config = readGlobalConfig(ctx);\n  return config === null\n    ? null\n    : {\n        kind: \"accessToken\",\n        accessToken: config.accessToken,\n        header: `Bearer ${config.accessToken}`,\n        profile,\n      };\n}\n\nexport async function initializeDefaultProfile(\n  ctx: Context,\n  profile: ProfileSelection,\n  namingLegacyAccount: boolean,\n  select = true,\n) {\n  const defaultProfile = await updateProfileSettings(ctx, async (settings) => {\n    if (settings.defaultProfile !== undefined) return undefined;\n    const credentials = await readProfileCredentials(ctx, profile);\n    const accessToken = credentials!.accessToken;\n    const legacyToken = settings.accessToken;\n    if (\n      !select &&\n      (savedProfileNames(ctx).some((name) => name !== profile.name) ||\n        (!namingLegacyAccount &&\n          typeof legacyToken === \"string\" &&\n          legacyToken.length > 0 &&\n          legacyToken !== accessToken))\n    )\n      return undefined;\n    if (\n      !namingLegacyAccount &&\n      typeof legacyToken === \"string\" &&\n      legacyToken.length > 0 &&\n      legacyToken !== accessToken\n    ) {\n      // An explicitly new login keeps the previous account as the default for\n      // directories that haven't selected an account.\n      let legacyName = \"default\";\n      for (\n        let suffix = 2;\n        ctx.fs.exists(profileConfigPath(legacyName));\n        suffix++\n      ) {\n        legacyName = `default-${suffix}`;\n      }\n      await writeCredentialsFile(ctx, legacyName, { accessToken: legacyToken });\n      settings.defaultProfile = legacyName;\n    } else {\n      settings.defaultProfile = profile.name;\n      settings.accessToken = accessToken;\n    }\n\n    return settings.defaultProfile;\n  });\n  if (defaultProfile !== undefined)\n    logFinishedStep(`Default account: ${defaultProfile}`);\n}\n\nexport function findProfileDirectory(\n  directories: Record<string, string>,\n  cwd: string,\n): { directory: string; name: string } | null {\n  let directory = path.resolve(cwd);\n  for (;;) {\n    if (Object.hasOwn(directories, directory)) {\n      return { directory, name: directories[directory] };\n    }\n    const parent = path.dirname(directory);\n    if (parent === directory) return null;\n    directory = parent;\n  }\n}\n\nexport function savedProfileNames(ctx: Context): string[] {\n  const directory = path.join(rootDirectory(), \"profiles\");\n  if (!ctx.fs.exists(directory)) return [];\n  return ctx.fs\n    .listDir(directory)\n    .filter((entry) => entry.name.endsWith(\".json\"))\n    .map((entry) => entry.name.slice(0, -5))\n    .sort();\n}\n\nexport async function writeProfileDirectory(ctx: Context, name: string) {\n  await validateProfileName(ctx, name);\n  await updateProfileSettings(ctx, (settings) => {\n    settings.directories = { ...settings.directories, [process.cwd()]: name };\n  });\n  logFinishedStep(\n    `Saved directory selection: ${name} (applies to this directory and its subdirectories).`,\n  );\n  const selected = await getProfileSelection(ctx);\n  if (selected !== null && selected.name !== name) {\n    logWarning(\n      `Account \"${selected.name}\" selected by ${selected.source} overrides this directory selection. Remove that override to use account \"${name}\".`,\n    );\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAAiB;AACjB,kBAAkC;AAClC,oBAA2B;AAE3B,aAAwB;AACxB,iBAAkB;AAElB,iBAA4C;AAC5C,0BAAmD;AACnD,mBAAiD;AAEjD,qBAAuC;AAOvC,MAAM,iBAAiB,aACpB,OAAO;AAAA,EACN,gBAAgB,aAAE,OAAO,EAAE,SAAS;AAAA,EACpC,aAAa,aAAE,OAAO,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC3C,sBAAsB,aAAE,QAAQ,EAAE,SAAS;AAC7C,CAAC,EACA,YAAY;AAEf,MAAM,oBAAoB,aACvB,OAAO;AAAA,EACN,aAAa,aAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,UAAU,aAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,OAAO,aAAE,OAAO,EAAE,SAAS;AAC7B,CAAC,EACA,YAAY;AAIf,eAAsB,oBACpB,KACyC;AACzC,MAAI,CAAC,IAAI,GAAG,WAAO,sCAAiB,CAAC,EAAG,QAAO,CAAC;AAChD,MAAI;AACF,WAAO,eAAe;AAAA,MACpB,KAAK,MAAM,IAAI,GAAG,iBAAa,sCAAiB,CAAC,CAAC;AAAA,IACpD;AAAA,EACF,QAAQ;AACN,WAAO,MAAM,IAAI,MAAM;AAAA,MACrB,UAAU;AAAA,MACV,WAAW;AAAA,MACX,gBAAgB,4CAAwC,sCAAiB,CAAC;AAAA,IAC5E,CAAC;AAAA,EACH;AACF;AAEA,SAAS,qBAAqB,KAAc,UAAmC;AAC7E,MAAI,OAAO,KAAK,QAAQ,EAAE,WAAW,GAAG;AACtC,QAAI,IAAI,GAAG,WAAO,sCAAiB,CAAC,EAAG,KAAI,GAAG,WAAO,sCAAiB,CAAC;AACvE;AAAA,EACF;AACA,QAAM,YAAY,OAAG,sCAAiB,CAAC,QAAI,0BAAW,CAAC;AACvD,MAAI;AACF,QAAI,GAAG,cAAc,WAAW,KAAK,UAAU,UAAU,MAAM,CAAC,GAAG,GAAK;AACxE,QAAI,GAAG,YAAY,eAAW,sCAAiB,CAAC;AAAA,EAClD,UAAE;AACA,QAAI,IAAI,GAAG,OAAO,SAAS,EAAG,KAAI,GAAG,OAAO,SAAS;AAAA,EACvD;AACF;AAEA,eAAsB,sBACpB,KACA,QACA,YACY;AACZ,QAAM,WAAW,OAAG,sCAAiB,CAAC;AACtC,MAAI,GAAG,UAAM,4BAAc,GAAG,EAAE,eAAe,KAAK,CAAC;AACrD,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,aAAS;AACP,QAAI;AACF,UAAI,GAAG,MAAM,QAAQ;AACrB;AAAA,IACF,SAAS,KAAU;AAGjB,UAAI,IAAI,SAAS,SAAU,OAAM;AACjC,UAAI,KAAK,IAAI,KAAK,UAAU;AAC1B,eAAO,MAAM,IAAI,MAAM;AAAA,UACrB,UAAU;AAAA,UACV,WAAW;AAAA,UACX,gBAAgB,uGAAuG,QAAQ;AAAA,QACjI,CAAC;AAAA,MACH;AACA,YAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAAA,IACxD;AAAA,EACF;AACA,MAAI,WAAW;AACf,QAAM,UAAU,MAAM;AACpB,QAAI,SAAU;AACd,QAAI,GAAG,MAAM,QAAQ;AACrB,eAAW;AAAA,EACb;AACA,QAAM,UAAU,IAAI,gBAAgB,YAAY,QAAQ,CAAC;AACzD,MAAI;AACF,UAAM,WAAW,MAAM,oBAAoB,GAAG;AAC9C,UAAM,SAAS,MAAM,OAAO,QAAQ;AACpC,yBAAqB,KAAK,QAAQ;AAElC,iBAAa;AACb,WAAO;AAAA,EACT,UAAE;AACA,QAAI,cAAc,OAAO;AACzB,YAAQ;AAAA,EACV;AACF;AAEO,SAAS,kBAAkB,MAAsB;AACtD,SAAO,YAAAA,QAAK;AAAA,QACV,4BAAc;AAAA,IACd;AAAA,IACA,GAAG,mBAAmB,IAAI,CAAC;AAAA,EAC7B;AACF;AAEA,eAAsB,oBACpB,KACA,MACe;AACf,MAAI,CAAC,wBAAwB,KAAK,IAAI,GAAG;AACvC,UAAM,IAAI,MAAM;AAAA,MACd,UAAU;AAAA,MACV,WAAW;AAAA,MACX,gBACE;AAAA,IACJ,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,oBACpB,KACA,UAAuE,CAAC,GACtC;AAClC,MAAI,OAAO,QAAQ;AACnB,MAAI,SAAS;AACb,MAAI,SAAS,UAAa,QAAQ,IAAI,qCAAsB,MAAM,QAAW;AAC3E,WAAO,QAAQ,IAAI,qCAAsB;AACzC,aAAS,GAAG,qCAAsB;AAAA,EACpC;AACA,MAAI,SAAS,QAAW;AACtB,UAAM,QAAQ,QAAQ,UAClB,CAAC,QAAQ,OAAO,IAChB,CAAC,gCAAmB,MAAM;AAC9B,eAAW,QAAQ,OAAO;AACxB,UAAI,CAAC,IAAI,GAAG,OAAO,IAAI,EAAG;AAC1B,aAAO,OAAO,MAAM,IAAI,GAAG,aAAa,IAAI,CAAC,EAAE,qCAAsB;AACrE,UAAI,SAAS,QAAW;AACtB,iBAAS,GAAG,qCAAsB,OAAO,IAAI;AAC7C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,QAAW;AACtB,UAAM,SAAS,MAAM,oBAAoB,GAAG;AAC5C,UAAM,UAAU;AAAA,MACd,OAAO,eAAe,CAAC;AAAA,MACvB,QAAQ,IAAI;AAAA,IACd;AACA,WAAO,SAAS,QAAQ,OAAO;AAC/B,aAAS,UACL,2BAA2B,QAAQ,SAAS,KAC5C,0BAAsB,sCAAiB,CAAC;AAAA,EAC9C;AACA,MAAI,SAAS,OAAW,QAAO;AAC/B,QAAM,oBAAoB,KAAK,IAAI;AACnC,SAAO,EAAE,MAAM,OAAO;AACxB;AAEA,eAAsB,gBACpB,KACA,SACA,eAAe,OACiD;AAChE,QAAM,cAAc,MAAM,uBAAuB,KAAK,SAAS,YAAY;AAC3E,SAAO,gBAAgB,OACnB,OACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa,YAAY;AAAA,IACzB,QAAQ,UAAU,YAAY,WAAW;AAAA,IACzC;AAAA,EACF;AACN;AAEA,eAAsB,uBACpB,KACA,SACA,eAAe,OACqB;AACpC,QAAM,oBAAoB,KAAK,QAAQ,IAAI;AAC3C,QAAM,aAAa,kBAAkB,QAAQ,IAAI;AACjD,MAAI,CAAC,IAAI,GAAG,OAAO,UAAU,GAAG;AAC9B,QAAI,aAAc,QAAO;AACzB,WAAO,MAAM,IAAI,MAAM;AAAA,MACrB,UAAU;AAAA,MACV,WAAW;AAAA,MACX,gBAAgB,YAAY,QAAQ,IAAI,iBAAiB,QAAQ,MAAM,uDAAuD,QAAQ,IAAI;AAAA,IAC5I,CAAC;AAAA,EACH;AACA,MAAI;AACF,WAAO,kBAAkB,MAAM,KAAK,MAAM,IAAI,GAAG,aAAa,UAAU,CAAC,CAAC;AAAA,EAC5E,QAAQ;AACN,WAAO,MAAM,IAAI,MAAM;AAAA,MACrB,UAAU;AAAA,MACV,WAAW;AAAA,MACX,gBAAgB,2CAA2C,QAAQ,IAAI,UAAU,UAAU;AAAA,IAC7F,CAAC;AAAA,EACH;AACF;AAEO,SAAS,iBAAiB,KAAc,MAA6B;AAC1E,MAAI;AACF,UAAM,QAAQ,KAAK;AAAA,MACjB,IAAI,GAAG,aAAa,kBAAkB,IAAI,CAAC;AAAA,IAC7C,EAAE;AACF,WAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AAAA,EACjE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,qBACb,KACA,MACA,aACA;AACA,QAAM,aAAa,kBAAkB,IAAI;AACzC,QAAM,YAAY,YAAAA,QAAK,QAAQ,UAAU;AACzC,MAAI,GAAG,MAAM,WAAW,EAAE,eAAe,KAAK,CAAC;AAC/C,aAAW,OAAO,KAAC,4BAAc,GAAG,SAAS,GAAG;AAC9C,QAAI,CAAC,IAAI,GAAG,MAAM,GAAG,EAAE,YAAY,GAAG;AACpC,aAAO,MAAM,IAAI,MAAM;AAAA,QACrB,UAAU;AAAA,QACV,WAAW;AAAA,QACX,gBAAgB,uEAAuE,GAAG;AAAA,MAC5F,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,YAAY,GAAG,UAAU,QAAI,0BAAW,CAAC;AAC/C,MAAI;AACF,QAAI,GAAG;AAAA,MACL;AAAA,MACA,KAAK,UAAU,aAAa,MAAM,CAAC;AAAA,MACnC;AAAA,IACF;AACA,QAAI,GAAG,YAAY,WAAW,UAAU;AAAA,EAC1C,UAAE;AACA,QAAI,IAAI,GAAG,OAAO,SAAS,EAAG,KAAI,GAAG,OAAO,SAAS;AAAA,EACvD;AACF;AAEA,eAAsB,wBACpB,KACA,MACA,aACA,WAAoD,CAAC,GACrD,UACe;AACf,QAAM,oBAAoB,KAAK,IAAI;AACnC,QAAM,sBAAsB,KAAK,OAAO,aAAa;AACnD,QAAI,aAAa,QAAW;AAC1B,YAAM,UAAU,MAAM;AAAA,QACpB;AAAA,QACA,EAAE,MAAM,QAAQ,QAAQ;AAAA,QACxB;AAAA,MACF;AACA,UAAI,KAAC,+BAAkB,SAAS,QAAQ,GAAG;AACzC,eAAO,MAAM,IAAI,MAAM;AAAA,UACrB,UAAU;AAAA,UACV,WAAW;AAAA,UACX,gBAAgB,YAAY,IAAI;AAAA,QAClC,CAAC;AAAA,MACH;AAAA,IACF;AACA,UAAM,qBAAqB,KAAK,MAAM,EAAE,GAAG,UAAU,YAAY,CAAC;AAClE,QAAI,SAAS,mBAAmB,KAAM,UAAS,cAAc;AAAA,EAC/D,CAAC;AACH;AAEA,eAAsB,0BACpB,KACA,SACgE;AAChE,QAAM,WAAW,MAAM,oBAAoB,GAAG;AAC9C,QAAM,cAAc,YAAAA,QAAK,QAAQ,kBAAkB,QAAQ,IAAI,CAAC;AAChE,MACE,SAAS,mBAAmB,UAC3B,IAAI,GAAG,OAAO,WAAW,KACxB,IAAI,GAAG,QAAQ,WAAW,EAAE,KAAK,CAAC,UAAU,MAAM,KAAK,SAAS,OAAO,CAAC,GAC1E;AACA,WAAO;AAAA,EACT;AACA,QAAM,aAAS,sCAAiB,GAAG;AACnC,SAAO,WAAW,OACd,OACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa,OAAO;AAAA,IACpB,QAAQ,UAAU,OAAO,WAAW;AAAA,IACpC;AAAA,EACF;AACN;AAEA,eAAsB,yBACpB,KACA,SACA,qBACA,SAAS,MACT;AACA,QAAM,iBAAiB,MAAM,sBAAsB,KAAK,OAAO,aAAa;AAC1E,QAAI,SAAS,mBAAmB,OAAW,QAAO;AAClD,UAAM,cAAc,MAAM,uBAAuB,KAAK,OAAO;AAC7D,UAAM,cAAc,YAAa;AACjC,UAAM,cAAc,SAAS;AAC7B,QACE,CAAC,WACA,kBAAkB,GAAG,EAAE,KAAK,CAAC,SAAS,SAAS,QAAQ,IAAI,KACzD,CAAC,uBACA,OAAO,gBAAgB,YACvB,YAAY,SAAS,KACrB,gBAAgB;AAEpB,aAAO;AACT,QACE,CAAC,uBACD,OAAO,gBAAgB,YACvB,YAAY,SAAS,KACrB,gBAAgB,aAChB;AAGA,UAAI,aAAa;AACjB,eACM,SAAS,GACb,IAAI,GAAG,OAAO,kBAAkB,UAAU,CAAC,GAC3C,UACA;AACA,qBAAa,WAAW,MAAM;AAAA,MAChC;AACA,YAAM,qBAAqB,KAAK,YAAY,EAAE,aAAa,YAAY,CAAC;AACxE,eAAS,iBAAiB;AAAA,IAC5B,OAAO;AACL,eAAS,iBAAiB,QAAQ;AAClC,eAAS,cAAc;AAAA,IACzB;AAEA,WAAO,SAAS;AAAA,EAClB,CAAC;AACD,MAAI,mBAAmB;AACrB,oCAAgB,oBAAoB,cAAc,EAAE;AACxD;AAEO,SAAS,qBACd,aACA,KAC4C;AAC5C,MAAI,YAAY,YAAAA,QAAK,QAAQ,GAAG;AAChC,aAAS;AACP,QAAI,OAAO,OAAO,aAAa,SAAS,GAAG;AACzC,aAAO,EAAE,WAAW,MAAM,YAAY,SAAS,EAAE;AAAA,IACnD;AACA,UAAM,SAAS,YAAAA,QAAK,QAAQ,SAAS;AACrC,QAAI,WAAW,UAAW,QAAO;AACjC,gBAAY;AAAA,EACd;AACF;AAEO,SAAS,kBAAkB,KAAwB;AACxD,QAAM,YAAY,YAAAA,QAAK,SAAK,4BAAc,GAAG,UAAU;AACvD,MAAI,CAAC,IAAI,GAAG,OAAO,SAAS,EAAG,QAAO,CAAC;AACvC,SAAO,IAAI,GACR,QAAQ,SAAS,EACjB,OAAO,CAAC,UAAU,MAAM,KAAK,SAAS,OAAO,CAAC,EAC9C,IAAI,CAAC,UAAU,MAAM,KAAK,MAAM,GAAG,EAAE,CAAC,EACtC,KAAK;AACV;AAEA,eAAsB,sBAAsB,KAAc,MAAc;AACtE,QAAM,oBAAoB,KAAK,IAAI;AACnC,QAAM,sBAAsB,KAAK,CAAC,aAAa;AAC7C,aAAS,cAAc,EAAE,GAAG,SAAS,aAAa,CAAC,QAAQ,IAAI,CAAC,GAAG,KAAK;AAAA,EAC1E,CAAC;AACD;AAAA,IACE,8BAA8B,IAAI;AAAA,EACpC;AACA,QAAM,WAAW,MAAM,oBAAoB,GAAG;AAC9C,MAAI,aAAa,QAAQ,SAAS,SAAS,MAAM;AAC/C;AAAA,MACE,YAAY,SAAS,IAAI,iBAAiB,SAAS,MAAM,6EAA6E,IAAI;AAAA,IAC5I;AAAA,EACF;AACF;",
+  "names": ["path"]
+}

package/dist/cjs/cli/lib/utils/utils.js

@@ -37,6 +37,7 @@ __export(utils_exports, {
   CONVEX_SELF_HOSTED_ADMIN_KEY_VAR_NAME: () => CONVEX_SELF_HOSTED_ADMIN_KEY_VAR_NAME,
   CONVEX_SELF_HOSTED_URL_VAR_NAME: () => CONVEX_SELF_HOSTED_URL_VAR_NAME,
   ENV_VAR_FILE_PATH: () => ENV_VAR_FILE_PATH,
+  IGNORED_DEPLOY_KEY: () => IGNORED_DEPLOY_KEY,
   ThrowingFetchError: () => ThrowingFetchError,
   bareDeploymentFetch: () => bareDeploymentFetch,
   bigBrainAPI: () => bigBrainAPI,
@@ -68,6 +69,7 @@ __export(utils_exports, {
   processDeployKeyValue: () => processDeployKeyValue,
   productionProvisionHost: () => productionProvisionHost,
   provisionHost: () => provisionHost,
+  readDeployKeyEnvVar: () => readDeployKeyEnvVar,
   readDeployKeyFromEnv: () => readDeployKeyFromEnv,
   retryDelay: () => retryDelay,
   rootDirectory: () => rootDirectory,
@@ -108,13 +110,14 @@ const CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME = "CONVEX_DEPLOYMENT_TOKEN";
 const CONVEX_DEPLOYMENT_ENV_VAR_NAME = "CONVEX_DEPLOYMENT";
 const CONVEX_SELF_HOSTED_URL_VAR_NAME = "CONVEX_SELF_HOSTED_URL";
 const CONVEX_SELF_HOSTED_ADMIN_KEY_VAR_NAME = "CONVEX_SELF_HOSTED_ADMIN_KEY";
+const IGNORED_DEPLOY_KEY = "<ignore_deploy_key>";
 const MAX_RETRIES = 6;
 const RETRY_LOG_THRESHOLD = 3;
 async function processDeployKeyValue(ctx, deployKey) {
   if (deployKey === void 0) {
     return void 0;
   }
-  if (deployKey === "<ignore_deploy_key>") {
+  if (deployKey === IGNORED_DEPLOY_KEY) {
     return void 0;
   }
   const missingKeyPattern = /^<missing_deploy_key:(.+)>$/;
@@ -130,17 +133,23 @@ async function processDeployKeyValue(ctx, deployKey) {
   return deployKey;
 }
 function readDeployKeyFromEnv(getEnv) {
-  const fromDeployKey = getEnv(CONVEX_DEPLOY_KEY_ENV_VAR_NAME);
-  const fromToken = getEnv(CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME);
-  return fromDeployKey || fromToken || void 0;
+  return readDeployKeyEnvVar(getEnv)?.value;
+}
+function readDeployKeyEnvVar(getEnv) {
+  for (const name of [
+    CONVEX_DEPLOY_KEY_ENV_VAR_NAME,
+    CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME
+  ]) {
+    const value = getEnv(name);
+    if (value) return { name, value };
+  }
+  return void 0;
 }
 const PERMISSION_DENIED_MESSAGE_PREFIX = "You do not have permission to perform this operation";
 function deployKeyPermissionAdvice() {
-  const envVarName = process.env[CONVEX_DEPLOY_KEY_ENV_VAR_NAME] ? CONVEX_DEPLOY_KEY_ENV_VAR_NAME : process.env[CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME] ? CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME : null;
-  if (envVarName === null) {
-    return null;
-  }
-  return `This is determined by the permissions granted to ${envVarName}.`;
+  const envVar = readDeployKeyEnvVar((name) => process.env[name]);
+  if (envVar === void 0 || envVar.value === IGNORED_DEPLOY_KEY) return null;
+  return `This is determined by the permissions granted to ${envVar.name}.`;
 }
 function permissionDeniedErrorMessage(errorMessage) {
   const index = errorMessage.indexOf(PERMISSION_DENIED_MESSAGE_PREFIX);