@pgpmjs/env - npm Package Compare versions

Comparing version 2.27.0 to 2.28.0

assert.d.ts

+import { PgpmOptions } from '@pgpmjs/types';
+/**
+ * Return a human-readable description of every sensitive option that is still
+ * the built-in development default. Never includes the value itself (secrets
+ * must not be logged) — only the option path and the env var to set.
+ */
+export declare const findUnsafeProductionDefaults: (opts: PgpmOptions) => string[];
+/**
+ * Assert that the merged PGPM options are safe for production. No-op outside
+ * production (per `12factor-env`'s house `NODE_ENV` semantics, so tests and CI
+ * are unaffected). In production, warns or throws per `STRICT_ENV`.
+ */
+export declare const assertProductionEnvOptions: (opts: PgpmOptions, env?: NodeJS.ProcessEnv) => void;

assert.js

+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertProductionEnvOptions = exports.findUnsafeProductionDefaults = void 0;
+const types_1 = require("@pgpmjs/types");
+const _12factor_env_1 = require("12factor-env");
+const SENSITIVE_FIELDS = [
+    { path: 'pg.password', severity: 'secret', envHint: 'PGPASSWORD' },
+    { path: 'db.connections.app.password', severity: 'secret', envHint: 'DB_CONNECTIONS_APP_PASSWORD' },
+    { path: 'db.connections.admin.password', severity: 'secret', envHint: 'DB_CONNECTIONS_ADMIN_PASSWORD' },
+    { path: 'cdn.awsAccessKey', severity: 'secret', envHint: 'AWS_ACCESS_KEY' },
+    { path: 'cdn.awsSecretKey', severity: 'secret', envHint: 'AWS_SECRET_KEY' },
+    { path: 'pg.host', severity: 'host', envHint: 'PGHOST' },
+    { path: 'pg.database', severity: 'host', envHint: 'PGDATABASE' },
+    { path: 'db.rootDb', severity: 'host', envHint: 'PGROOTDATABASE' },
+    { path: 'server.host', severity: 'host', envHint: 'SERVER_HOST' },
+    { path: 'cdn.endpoint', severity: 'host', envHint: 'CDN_ENDPOINT' },
+    { path: 'cdn.publicUrlPrefix', severity: 'host', envHint: 'CDN_PUBLIC_URL_PREFIX' },
+    { path: 'cdn.bucketName', severity: 'host', envHint: 'BUCKET_NAME' }
+];
+const getPath = (obj, path) => path.split('.').reduce((acc, key) => acc && typeof acc === 'object' ? acc[key] : undefined, obj);
+/**
+ * Return a human-readable description of every sensitive option that is still
+ * the built-in development default. Never includes the value itself (secrets
+ * must not be logged) — only the option path and the env var to set.
+ */
+const findUnsafeProductionDefaults = (opts) => {
+    const issues = [];
+    for (const field of SENSITIVE_FIELDS) {
+        const value = getPath(opts, field.path);
+        const builtInDefault = getPath(types_1.pgpmDefaults, field.path);
+        if (value !== undefined && value === builtInDefault) {
+            const note = field.severity === 'secret'
+                ? ' (a secret; must be provided in production)'
+                : '';
+            issues.push(`${field.path} is still the built-in dev default${note} — set ${field.envHint}`);
+        }
+    }
+    return issues;
+};
+exports.findUnsafeProductionDefaults = findUnsafeProductionDefaults;
+const warnedMessages = new Set();
+/**
+ * Assert that the merged PGPM options are safe for production. No-op outside
+ * production (per `12factor-env`'s house `NODE_ENV` semantics, so tests and CI
+ * are unaffected). In production, warns or throws per `STRICT_ENV`.
+ */
+const assertProductionEnvOptions = (opts, env = process.env) => {
+    if (!(0, _12factor_env_1.isProduction)(env))
+        return;
+    const issues = (0, exports.findUnsafeProductionDefaults)(opts);
+    if (issues.length === 0)
+        return;
+    const message = 'Unsafe production environment — the following values are still the built-in ' +
+        `development defaults:\n  ${issues.join('\n  ')}`;
+    if ((0, _12factor_env_1.getStrictEnvMode)(env) === 'throw') {
+        throw new Error(message);
+    }
+    if (warnedMessages.has(message))
+        return;
+    warnedMessages.add(message);
+    // eslint-disable-next-line no-console
+    console.warn(`[pgpm-env] ${message}\n(set STRICT_ENV=throw to make this fatal)`);
+};
+exports.assertProductionEnvOptions = assertProductionEnvOptions;

esm/assert.js

+import { pgpmDefaults } from '@pgpmjs/types';
+import { getStrictEnvMode, isProduction } from '12factor-env';
+const SENSITIVE_FIELDS = [
+    { path: 'pg.password', severity: 'secret', envHint: 'PGPASSWORD' },
+    { path: 'db.connections.app.password', severity: 'secret', envHint: 'DB_CONNECTIONS_APP_PASSWORD' },
+    { path: 'db.connections.admin.password', severity: 'secret', envHint: 'DB_CONNECTIONS_ADMIN_PASSWORD' },
+    { path: 'cdn.awsAccessKey', severity: 'secret', envHint: 'AWS_ACCESS_KEY' },
+    { path: 'cdn.awsSecretKey', severity: 'secret', envHint: 'AWS_SECRET_KEY' },
+    { path: 'pg.host', severity: 'host', envHint: 'PGHOST' },
+    { path: 'pg.database', severity: 'host', envHint: 'PGDATABASE' },
+    { path: 'db.rootDb', severity: 'host', envHint: 'PGROOTDATABASE' },
+    { path: 'server.host', severity: 'host', envHint: 'SERVER_HOST' },
+    { path: 'cdn.endpoint', severity: 'host', envHint: 'CDN_ENDPOINT' },
+    { path: 'cdn.publicUrlPrefix', severity: 'host', envHint: 'CDN_PUBLIC_URL_PREFIX' },
+    { path: 'cdn.bucketName', severity: 'host', envHint: 'BUCKET_NAME' }
+];
+const getPath = (obj, path) => path.split('.').reduce((acc, key) => acc && typeof acc === 'object' ? acc[key] : undefined, obj);
+/**
+ * Return a human-readable description of every sensitive option that is still
+ * the built-in development default. Never includes the value itself (secrets
+ * must not be logged) — only the option path and the env var to set.
+ */
+export const findUnsafeProductionDefaults = (opts) => {
+    const issues = [];
+    for (const field of SENSITIVE_FIELDS) {
+        const value = getPath(opts, field.path);
+        const builtInDefault = getPath(pgpmDefaults, field.path);
+        if (value !== undefined && value === builtInDefault) {
+            const note = field.severity === 'secret'
+                ? ' (a secret; must be provided in production)'
+                : '';
+            issues.push(`${field.path} is still the built-in dev default${note} — set ${field.envHint}`);
+        }
+    }
+    return issues;
+};
+const warnedMessages = new Set();
+/**
+ * Assert that the merged PGPM options are safe for production. No-op outside
+ * production (per `12factor-env`'s house `NODE_ENV` semantics, so tests and CI
+ * are unaffected). In production, warns or throws per `STRICT_ENV`.
+ */
+export const assertProductionEnvOptions = (opts, env = process.env) => {
+    if (!isProduction(env))
+        return;
+    const issues = findUnsafeProductionDefaults(opts);
+    if (issues.length === 0)
+        return;
+    const message = 'Unsafe production environment — the following values are still the built-in ' +
+        `development defaults:\n  ${issues.join('\n  ')}`;
+    if (getStrictEnvMode(env) === 'throw') {
+        throw new Error(message);
+    }
+    if (warnedMessages.has(message))
+        return;
+    warnedMessages.add(message);
+    // eslint-disable-next-line no-console
+    console.warn(`[pgpm-env] ${message}\n(set STRICT_ENV=throw to make this fatal)`);
+};

env.d.ts

@@ -0,4 +1,4 @@
+import { parseEnvBoolean, parseEnvNumber } from '12factor-env';
 import { PgpmOptions } from '@pgpmjs/types';
-export declare const parseEnvNumber: (val?: string) => number | undefined;
-export declare const parseEnvBoolean: (val?: string) => boolean | undefined;
+export { parseEnvBoolean, parseEnvNumber };
 /**
@@ -13,2 +13,1 @@ * Parse core PGPM environment variables.
 export declare const getNodeEnv: () => NodeEnv;
-export {};

env.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getNodeEnv = exports.getEnvVars = exports.parseEnvBoolean = exports.parseEnvNumber = void 0;
-const parseEnvNumber = (val) => {
-    const num = Number(val);
-    return !isNaN(num) ? num : undefined;
-};
-exports.parseEnvNumber = parseEnvNumber;
-const parseEnvBoolean = (val) => {
-    if (val === undefined)
-        return undefined;
-    return ['true', '1', 'yes'].includes(val.toLowerCase());
-};
-exports.parseEnvBoolean = parseEnvBoolean;
+exports.getNodeEnv = exports.getEnvVars = exports.parseEnvNumber = exports.parseEnvBoolean = void 0;
+const _12factor_env_1 = require("12factor-env");
+Object.defineProperty(exports, "parseEnvBoolean", { enumerable: true, get: function () { return _12factor_env_1.parseEnvBoolean; } });
+Object.defineProperty(exports, "parseEnvNumber", { enumerable: true, get: function () { return _12factor_env_1.parseEnvNumber; } });
 const parseEnvStringArray = (val) => {
@@ -71,11 +63,11 @@ if (!val)
         server: {
-            ...(PORT && { port: (0, exports.parseEnvNumber)(PORT) }),
+            ...(PORT && { port: (0, _12factor_env_1.parseEnvNumber)(PORT) }),
             ...(SERVER_HOST && { host: SERVER_HOST }),
-            ...(SERVER_TRUST_PROXY && { trustProxy: (0, exports.parseEnvBoolean)(SERVER_TRUST_PROXY) }),
+            ...(SERVER_TRUST_PROXY && { trustProxy: (0, _12factor_env_1.parseEnvBoolean)(SERVER_TRUST_PROXY) }),
             ...(SERVER_ORIGIN && { origin: SERVER_ORIGIN }),
-            ...(SERVER_STRICT_AUTH && { strictAuth: (0, exports.parseEnvBoolean)(SERVER_STRICT_AUTH) }),
+            ...(SERVER_STRICT_AUTH && { strictAuth: (0, _12factor_env_1.parseEnvBoolean)(SERVER_STRICT_AUTH) }),
         },
         pg: {
             ...(PGHOST && { host: PGHOST }),
-            ...(PGPORT && { port: (0, exports.parseEnvNumber)(PGPORT) }),
+            ...(PGPORT && { port: (0, _12factor_env_1.parseEnvNumber)(PGPORT) }),
             ...(PGUSER && { user: PGUSER }),
@@ -95,6 +87,6 @@ ...(PGPASSWORD && { password: PGPASSWORD }),
         deployment: {
-            ...(DEPLOYMENT_USE_TX && { useTx: (0, exports.parseEnvBoolean)(DEPLOYMENT_USE_TX) }),
-            ...(DEPLOYMENT_FAST && { fast: (0, exports.parseEnvBoolean)(DEPLOYMENT_FAST) }),
-            ...(DEPLOYMENT_USE_PLAN && { usePlan: (0, exports.parseEnvBoolean)(DEPLOYMENT_USE_PLAN) }),
-            ...(DEPLOYMENT_CACHE && { cache: (0, exports.parseEnvBoolean)(DEPLOYMENT_CACHE) }),
+            ...(DEPLOYMENT_USE_TX && { useTx: (0, _12factor_env_1.parseEnvBoolean)(DEPLOYMENT_USE_TX) }),
+            ...(DEPLOYMENT_FAST && { fast: (0, _12factor_env_1.parseEnvBoolean)(DEPLOYMENT_FAST) }),
+            ...(DEPLOYMENT_USE_PLAN && { usePlan: (0, _12factor_env_1.parseEnvBoolean)(DEPLOYMENT_USE_PLAN) }),
+            ...(DEPLOYMENT_CACHE && { cache: (0, _12factor_env_1.parseEnvBoolean)(DEPLOYMENT_CACHE) }),
             ...(DEPLOYMENT_TO_CHANGE && { toChange: DEPLOYMENT_TO_CHANGE }),
@@ -105,3 +97,3 @@ },
                 codegen: {
-                    useTx: (0, exports.parseEnvBoolean)(MIGRATIONS_CODEGEN_USE_TX)
+                    useTx: (0, _12factor_env_1.parseEnvBoolean)(MIGRATIONS_CODEGEN_USE_TX)
                 }
@@ -119,3 +111,3 @@ }),
                     ...(JOBS_SUPPORT_ANY && {
-                        supportAny: (0, exports.parseEnvBoolean)(JOBS_SUPPORT_ANY)
+                        supportAny: (0, _12factor_env_1.parseEnvBoolean)(JOBS_SUPPORT_ANY)
                     }),
@@ -128,3 +120,3 @@ ...(JOBS_SUPPORTED && {
                     ...(JOBS_SUPPORT_ANY && {
-                        supportAny: (0, exports.parseEnvBoolean)(JOBS_SUPPORT_ANY)
+                        supportAny: (0, _12factor_env_1.parseEnvBoolean)(JOBS_SUPPORT_ANY)
                     }),
@@ -147,3 +139,3 @@ ...(JOBS_SUPPORTED && {
                     ...(INTERNAL_JOBS_CALLBACK_PORT && {
-                        callbackPort: (0, exports.parseEnvNumber)(INTERNAL_JOBS_CALLBACK_PORT)
+                        callbackPort: (0, _12factor_env_1.parseEnvNumber)(INTERNAL_JOBS_CALLBACK_PORT)
                     })
@@ -154,10 +146,10 @@ }
         errorOutput: {
-            ...(PGPM_ERROR_QUERY_HISTORY_LIMIT && { queryHistoryLimit: (0, exports.parseEnvNumber)(PGPM_ERROR_QUERY_HISTORY_LIMIT) }),
-            ...(PGPM_ERROR_MAX_LENGTH && { maxLength: (0, exports.parseEnvNumber)(PGPM_ERROR_MAX_LENGTH) }),
-            ...(PGPM_ERROR_VERBOSE && { verbose: (0, exports.parseEnvBoolean)(PGPM_ERROR_VERBOSE) }),
+            ...(PGPM_ERROR_QUERY_HISTORY_LIMIT && { queryHistoryLimit: (0, _12factor_env_1.parseEnvNumber)(PGPM_ERROR_QUERY_HISTORY_LIMIT) }),
+            ...(PGPM_ERROR_MAX_LENGTH && { maxLength: (0, _12factor_env_1.parseEnvNumber)(PGPM_ERROR_MAX_LENGTH) }),
+            ...(PGPM_ERROR_VERBOSE && { verbose: (0, _12factor_env_1.parseEnvBoolean)(PGPM_ERROR_VERBOSE) }),
         },
         smtp: {
             ...(SMTP_HOST && { host: SMTP_HOST }),
-            ...(SMTP_PORT && { port: (0, exports.parseEnvNumber)(SMTP_PORT) }),
-            ...(SMTP_SECURE && { secure: (0, exports.parseEnvBoolean)(SMTP_SECURE) }),
+            ...(SMTP_PORT && { port: (0, _12factor_env_1.parseEnvNumber)(SMTP_PORT) }),
+            ...(SMTP_SECURE && { secure: (0, _12factor_env_1.parseEnvBoolean)(SMTP_SECURE) }),
             ...(SMTP_USER && { user: SMTP_USER }),
@@ -167,10 +159,10 @@ ...(SMTP_PASS && { pass: SMTP_PASS }),
             ...(SMTP_REPLY_TO && { replyTo: SMTP_REPLY_TO }),
-            ...(SMTP_REQUIRE_TLS && { requireTLS: (0, exports.parseEnvBoolean)(SMTP_REQUIRE_TLS) }),
-            ...(SMTP_TLS_REJECT_UNAUTHORIZED && { tlsRejectUnauthorized: (0, exports.parseEnvBoolean)(SMTP_TLS_REJECT_UNAUTHORIZED) }),
-            ...(SMTP_POOL && { pool: (0, exports.parseEnvBoolean)(SMTP_POOL) }),
-            ...(SMTP_MAX_CONNECTIONS && { maxConnections: (0, exports.parseEnvNumber)(SMTP_MAX_CONNECTIONS) }),
-            ...(SMTP_MAX_MESSAGES && { maxMessages: (0, exports.parseEnvNumber)(SMTP_MAX_MESSAGES) }),
+            ...(SMTP_REQUIRE_TLS && { requireTLS: (0, _12factor_env_1.parseEnvBoolean)(SMTP_REQUIRE_TLS) }),
+            ...(SMTP_TLS_REJECT_UNAUTHORIZED && { tlsRejectUnauthorized: (0, _12factor_env_1.parseEnvBoolean)(SMTP_TLS_REJECT_UNAUTHORIZED) }),
+            ...(SMTP_POOL && { pool: (0, _12factor_env_1.parseEnvBoolean)(SMTP_POOL) }),
+            ...(SMTP_MAX_CONNECTIONS && { maxConnections: (0, _12factor_env_1.parseEnvNumber)(SMTP_MAX_CONNECTIONS) }),
+            ...(SMTP_MAX_MESSAGES && { maxMessages: (0, _12factor_env_1.parseEnvNumber)(SMTP_MAX_MESSAGES) }),
             ...(SMTP_NAME && { name: SMTP_NAME }),
-            ...(SMTP_LOGGER && { logger: (0, exports.parseEnvBoolean)(SMTP_LOGGER) }),
-            ...(SMTP_DEBUG && { debug: (0, exports.parseEnvBoolean)(SMTP_DEBUG) }),
+            ...(SMTP_LOGGER && { logger: (0, _12factor_env_1.parseEnvBoolean)(SMTP_LOGGER) }),
+            ...(SMTP_DEBUG && { debug: (0, _12factor_env_1.parseEnvBoolean)(SMTP_DEBUG) }),
         }
@@ -177,0 +169,0 @@ };

esm/env.js

@@ -1,10 +0,3 @@
-export const parseEnvNumber = (val) => {
-    const num = Number(val);
-    return !isNaN(num) ? num : undefined;
-};
-export const parseEnvBoolean = (val) => {
-    if (val === undefined)
-        return undefined;
-    return ['true', '1', 'yes'].includes(val.toLowerCase());
-};
+import { parseEnvBoolean, parseEnvNumber } from '12factor-env';
+export { parseEnvBoolean, parseEnvNumber };
 const parseEnvStringArray = (val) => {
@@ -11,0 +4,0 @@ if (!val)

esm/index.js

@@ -1,4 +0,5 @@
-export { getEnvOptions, getConnEnvOptions, getDeploymentEnvOptions } from './merge';
-export { loadConfigSync, loadConfigSyncFromDir, loadConfigFileSync, resolvePgpmPath, resolvePnpmWorkspace, resolveLernaWorkspace, resolveNpmWorkspace, resolveWorkspaceByType } from './config';
+export { assertProductionEnvOptions, findUnsafeProductionDefaults } from './assert';
+export { loadConfigFileSync, loadConfigSync, loadConfigSyncFromDir, resolveLernaWorkspace, resolveNpmWorkspace, resolvePgpmPath, resolvePnpmWorkspace, resolveWorkspaceByType } from './config';
 export { getEnvVars, getNodeEnv, parseEnvBoolean, parseEnvNumber } from './env';
-export { walkUp, replaceArrays } from './utils';
+export { getConnEnvOptions, getDeploymentEnvOptions, getEnvOptions } from './merge';
+export { replaceArrays, walkUp } from './utils';

esm/merge.js

@@ -0,3 +1,4 @@
+import { pgpmDefaults } from '@pgpmjs/types';
 import deepmerge from 'deepmerge';
-import { pgpmDefaults } from '@pgpmjs/types';
+import { assertProductionEnvOptions } from './assert';
 import { loadConfigSync } from './config';
@@ -22,5 +23,9 @@ import { getEnvVars } from './env';
     const envOptions = getEnvVars(env);
-    return deepmerge.all([pgpmDefaults, configOptions, envOptions, overrides], {
+    const merged = deepmerge.all([pgpmDefaults, configOptions, envOptions, overrides], {
         arrayMerge: replaceArrays
     });
+    // In production, surface (warn) or reject (STRICT_ENV=throw) sensitive options
+    // still left at their built-in dev defaults. No-op in dev/test/CI.
+    assertProductionEnvOptions(merged, env);
+    return merged;
 };
@@ -27,0 +32,0 @@ export const getConnEnvOptions = (overrides = {}, cwd = process.cwd()) => {

index.d.ts

@@ -1,6 +0,7 @@
-export { getEnvOptions, getConnEnvOptions, getDeploymentEnvOptions } from './merge';
-export { loadConfigSync, loadConfigSyncFromDir, loadConfigFileSync, resolvePgpmPath, resolvePnpmWorkspace, resolveLernaWorkspace, resolveNpmWorkspace, resolveWorkspaceByType } from './config';
+export { assertProductionEnvOptions, findUnsafeProductionDefaults } from './assert';
 export type { WorkspaceType } from './config';
+export { loadConfigFileSync, loadConfigSync, loadConfigSyncFromDir, resolveLernaWorkspace, resolveNpmWorkspace, resolvePgpmPath, resolvePnpmWorkspace, resolveWorkspaceByType } from './config';
 export { getEnvVars, getNodeEnv, parseEnvBoolean, parseEnvNumber } from './env';
-export { walkUp, replaceArrays } from './utils';
-export type { PgpmOptions, PgTestConnectionOptions, DeploymentOptions } from '@pgpmjs/types';
+export { getConnEnvOptions, getDeploymentEnvOptions, getEnvOptions } from './merge';
+export { replaceArrays, walkUp } from './utils';
+export type { DeploymentOptions, PgpmOptions, PgTestConnectionOptions } from '@pgpmjs/types';

index.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.replaceArrays = exports.walkUp = exports.parseEnvNumber = exports.parseEnvBoolean = exports.getNodeEnv = exports.getEnvVars = exports.resolveWorkspaceByType = exports.resolveNpmWorkspace = exports.resolveLernaWorkspace = exports.resolvePnpmWorkspace = exports.resolvePgpmPath = exports.loadConfigFileSync = exports.loadConfigSyncFromDir = exports.loadConfigSync = exports.getDeploymentEnvOptions = exports.getConnEnvOptions = exports.getEnvOptions = void 0;
-var merge_1 = require("./merge");
-Object.defineProperty(exports, "getEnvOptions", { enumerable: true, get: function () { return merge_1.getEnvOptions; } });
-Object.defineProperty(exports, "getConnEnvOptions", { enumerable: true, get: function () { return merge_1.getConnEnvOptions; } });
-Object.defineProperty(exports, "getDeploymentEnvOptions", { enumerable: true, get: function () { return merge_1.getDeploymentEnvOptions; } });
+exports.walkUp = exports.replaceArrays = exports.getEnvOptions = exports.getDeploymentEnvOptions = exports.getConnEnvOptions = exports.parseEnvNumber = exports.parseEnvBoolean = exports.getNodeEnv = exports.getEnvVars = exports.resolveWorkspaceByType = exports.resolvePnpmWorkspace = exports.resolvePgpmPath = exports.resolveNpmWorkspace = exports.resolveLernaWorkspace = exports.loadConfigSyncFromDir = exports.loadConfigSync = exports.loadConfigFileSync = exports.findUnsafeProductionDefaults = exports.assertProductionEnvOptions = void 0;
+var assert_1 = require("./assert");
+Object.defineProperty(exports, "assertProductionEnvOptions", { enumerable: true, get: function () { return assert_1.assertProductionEnvOptions; } });
+Object.defineProperty(exports, "findUnsafeProductionDefaults", { enumerable: true, get: function () { return assert_1.findUnsafeProductionDefaults; } });
 var config_1 = require("./config");
+Object.defineProperty(exports, "loadConfigFileSync", { enumerable: true, get: function () { return config_1.loadConfigFileSync; } });
 Object.defineProperty(exports, "loadConfigSync", { enumerable: true, get: function () { return config_1.loadConfigSync; } });
 Object.defineProperty(exports, "loadConfigSyncFromDir", { enumerable: true, get: function () { return config_1.loadConfigSyncFromDir; } });
-Object.defineProperty(exports, "loadConfigFileSync", { enumerable: true, get: function () { return config_1.loadConfigFileSync; } });
+Object.defineProperty(exports, "resolveLernaWorkspace", { enumerable: true, get: function () { return config_1.resolveLernaWorkspace; } });
+Object.defineProperty(exports, "resolveNpmWorkspace", { enumerable: true, get: function () { return config_1.resolveNpmWorkspace; } });
 Object.defineProperty(exports, "resolvePgpmPath", { enumerable: true, get: function () { return config_1.resolvePgpmPath; } });
 Object.defineProperty(exports, "resolvePnpmWorkspace", { enumerable: true, get: function () { return config_1.resolvePnpmWorkspace; } });
-Object.defineProperty(exports, "resolveLernaWorkspace", { enumerable: true, get: function () { return config_1.resolveLernaWorkspace; } });
-Object.defineProperty(exports, "resolveNpmWorkspace", { enumerable: true, get: function () { return config_1.resolveNpmWorkspace; } });
 Object.defineProperty(exports, "resolveWorkspaceByType", { enumerable: true, get: function () { return config_1.resolveWorkspaceByType; } });
@@ -22,4 +21,8 @@ var env_1 = require("./env");
 Object.defineProperty(exports, "parseEnvNumber", { enumerable: true, get: function () { return env_1.parseEnvNumber; } });
+var merge_1 = require("./merge");
+Object.defineProperty(exports, "getConnEnvOptions", { enumerable: true, get: function () { return merge_1.getConnEnvOptions; } });
+Object.defineProperty(exports, "getDeploymentEnvOptions", { enumerable: true, get: function () { return merge_1.getDeploymentEnvOptions; } });
+Object.defineProperty(exports, "getEnvOptions", { enumerable: true, get: function () { return merge_1.getEnvOptions; } });
 var utils_1 = require("./utils");
+Object.defineProperty(exports, "replaceArrays", { enumerable: true, get: function () { return utils_1.replaceArrays; } });
 Object.defineProperty(exports, "walkUp", { enumerable: true, get: function () { return utils_1.walkUp; } });
-Object.defineProperty(exports, "replaceArrays", { enumerable: true, get: function () { return utils_1.replaceArrays; } });

merge.d.ts

@@ -1,2 +0,2 @@
-import { PgpmOptions, PgTestConnectionOptions, DeploymentOptions } from '@pgpmjs/types';
+import { DeploymentOptions, PgpmOptions, PgTestConnectionOptions } from '@pgpmjs/types';
 /**
@@ -3,0 +3,0 @@ * Get core PGPM environment options by merging:

merge.js

@@ -7,4 +7,5 @@ "use strict";
 exports.getDeploymentEnvOptions = exports.getConnEnvOptions = exports.getEnvOptions = void 0;
+const types_1 = require("@pgpmjs/types");
 const deepmerge_1 = __importDefault(require("deepmerge"));
-const types_1 = require("@pgpmjs/types");
+const assert_1 = require("./assert");
 const config_1 = require("./config");
@@ -29,5 +30,9 @@ const env_1 = require("./env");
     const envOptions = (0, env_1.getEnvVars)(env);
-    return deepmerge_1.default.all([types_1.pgpmDefaults, configOptions, envOptions, overrides], {
+    const merged = deepmerge_1.default.all([types_1.pgpmDefaults, configOptions, envOptions, overrides], {
         arrayMerge: utils_1.replaceArrays
     });
+    // In production, surface (warn) or reject (STRICT_ENV=throw) sensitive options
+    // still left at their built-in dev defaults. No-op in dev/test/CI.
+    (0, assert_1.assertProductionEnvOptions)(merged, env);
+    return merged;
 };
@@ -34,0 +39,0 @@ exports.getEnvOptions = getEnvOptions;

package.json

 {
   "name": "@pgpmjs/env",
-  "version": "2.27.0",
+  "version": "2.28.0",
   "author": "Dan Lynch <Dan Lynch>",
@@ -32,2 +32,3 @@ "description": "PGPM environment management",
   "dependencies": {
+    "12factor-env": "^1.17.0",
     "@pgpmjs/types": "^2.34.0",
@@ -47,3 +48,3 @@ "deepmerge": "^4.3.1"
   },
-  "gitHead": "7eb34a3baa10ba3476575967b87ff51b606e042a"
+  "gitHead": "ff6c442b789cbe8803f33036110f6e09124e65df"
 }

New alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Improved metrics

Total package byte prevSize

59421

15.9%

Number of package files

21

16.67%

Lines of code

1093

14.09%

Worsened metrics

Dependency count

3

50%

Number of low supply chain risk alerts

16

23.08%

Dependency changes

• + Added

  12factor-env@^1.17.0