[NinjaLikesCheez]

Closes #116.

Why

Most of #116 already landed in #113, #115 and #118: just pull / just push, secrets-pull / secrets-push and the secrets manifest. What remained was that every tool still kept its own copy of where each environment lives and how to guard it: REMOTES in ha-devices-lib.ts, VAULTS in secrets-sync-lib.ts, a hard-coded subscription in restart and deploy-dev, the discord-env bash helper, and a prod check that differed from recipe to recipe.

What

• scripts/envs.ts is the one definition of dev and prod: subscription, resource group, Container App, Key Vault, storage account and share, env file, plus the shared guards (PIXEL_ENV match, subscription, PIXEL_APPLY_PROD=1 for prod applies, no laptop prod deploys). It's pure and tested.
• scripts/target.ts loads a Discord tool's env file in TypeScript, replacing the discord-env bash. As before, it drops every key any env file sets before applying the chosen one, so .env (which just loads into every recipe) can't leak into another bot. register-ci opts out with PIXEL_ENV_SOURCE=process, and only does so in GitHub Actions.
• scripts/env.ts is what recipes call: show, shell (assignments to eval), check-az, apply, deploy.
• scripts/share.ts holds the file-share remote and the az storage file arguments. They moved out of ha-devices-lib.ts.
• ha-devices, secrets-sync, register, command-access, restart, deploy and tf-apply/tf-plan all use these. register-env.ts is gone; its tests moved to envs.test.ts.
• justfile:
  • New just env dev|prod.
  • just deploy <env> replaces deploy-dev, which stays as an alias for a release. just deploy prod refuses, because prod ships from the Release workflow.
  • just --list is grouped (develop, environments, config, terraform, release, docs) with readable summaries.
• Tests:
  • The names in ENVS match infra/envs/*/terraform.example.tfvars.
  • The justfile spells no subscription, vault, storage account or resource group.
• Docs:
  • Live docs (runbook, AGENTS.md, README, infra docs) say just deploy dev. ADRs, workflow comments and Terraform variable descriptions are left as they were, since deploy-dev still works.
  • AGENTS.md has a rule pointing tools at scripts/envs.ts.
  • Changelog entry under Changed.

Not done (on purpose)

• No generic push for share files (members.yaml etc.). ADR 0016's addendum keeps those read-only mirrors that Pixel and just ha-devices write.
• No changes to .github/workflows/, so the pipeline diagrams are unchanged. register-ci only gains an env var inside the recipe.

Review notes

• Overlap with open PRs Never print secrets in just push / just pull tfvars diffs #119 and Make just secrets-push the only writer of app secrets (ADR 0017) #120: both edit scripts/secrets-sync.ts / secrets-sync-lib.ts. My changes there are imports plus VAULTS / storage-account lookups, so expect small conflicts at most.
• No AGENTS.md rule-14 paths touched. No Terraform changes.
• Checked locally:
  • just check (1980 tests, coverage thresholds) and just tf-validate pass.
  • The refusals for just tf-apply prod, just deploy prod, a missing .env.prod and a .env.dev with PIXEL_ENV=prod.
  • That a PIXEL_ENV=prod in .env doesn't leak into dev.
• Not run for real: just deploy dev, just restart, just ha-devices, just pull / just push. They touch Azure. Worth one just deploy dev and one just pull dev before merging.

🤖 Generated with Claude Code