#!/usr/bin/env bash
# Reads a single KEY=value out of a .env-style file without sourcing it —
# sourcing an arbitrary env file would `eval` its contents, which is both
# a needless injection risk and (via `source <(...)`) unreliable on older
# bash (confirmed broken on bash 3.2, still macOS's default: the
# assignment silently doesn't take effect in the calling shell). Only the
# last matching line is used, matching how a real KEY=value file would be
# interpreted if it were sourced.
#
# Usage: env_var <file> <KEY>
env_var() {
  local file="$1" name="$2"
  grep -E "^${name}=" "$file" | tail -n1 | cut -d= -f2-
}