@aarunyaapps/env-redact 1.0.0

package/dist/index.d.mts

@@ -0,0 +1,39 @@
+type EnvLine = {
+    kind: "blank";
+    raw: string;
+} | {
+    kind: "comment";
+    raw: string;
+} | {
+    kind: "entry";
+    raw: string;
+    key: string;
+    value: string;
+    sensitive: boolean;
+    sep: "=" | ": ";
+    commentPrefix?: string;
+} | {
+    kind: "invalid";
+    raw: string;
+};
+type DiffLine = {
+    changed: false;
+    content: string;
+} | {
+    changed: true;
+    before: string;
+    after: string;
+};
+interface RedactOptions {
+    placeholder?: string;
+}
+declare function parseEnv(content: string): EnvLine[];
+declare function buildSanitized(lines: EnvLine[], opts?: RedactOptions): string;
+declare function buildExample(lines: EnvLine[]): string;
+declare function buildDiff(lines: EnvLine[]): DiffLine[];
+declare function countSensitive(lines: EnvLine[]): number;
+declare function countTotal(lines: EnvLine[]): number;
+declare function isSensitiveKey(key: string): boolean;
+declare function isSensitiveValue(value: string): boolean;
+
+export { type DiffLine, type EnvLine, type RedactOptions, buildDiff, buildExample, buildSanitized, countSensitive, countTotal, isSensitiveKey, isSensitiveValue, parseEnv };

package/dist/index.d.ts

@@ -0,0 +1,39 @@
+type EnvLine = {
+    kind: "blank";
+    raw: string;
+} | {
+    kind: "comment";
+    raw: string;
+} | {
+    kind: "entry";
+    raw: string;
+    key: string;
+    value: string;
+    sensitive: boolean;
+    sep: "=" | ": ";
+    commentPrefix?: string;
+} | {
+    kind: "invalid";
+    raw: string;
+};
+type DiffLine = {
+    changed: false;
+    content: string;
+} | {
+    changed: true;
+    before: string;
+    after: string;
+};
+interface RedactOptions {
+    placeholder?: string;
+}
+declare function parseEnv(content: string): EnvLine[];
+declare function buildSanitized(lines: EnvLine[], opts?: RedactOptions): string;
+declare function buildExample(lines: EnvLine[]): string;
+declare function buildDiff(lines: EnvLine[]): DiffLine[];
+declare function countSensitive(lines: EnvLine[]): number;
+declare function countTotal(lines: EnvLine[]): number;
+declare function isSensitiveKey(key: string): boolean;
+declare function isSensitiveValue(value: string): boolean;
+
+export { type DiffLine, type EnvLine, type RedactOptions, buildDiff, buildExample, buildSanitized, countSensitive, countTotal, isSensitiveKey, isSensitiveValue, parseEnv };

package/dist/index.js

@@ -0,0 +1,221 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  buildDiff: () => buildDiff,
+  buildExample: () => buildExample,
+  buildSanitized: () => buildSanitized,
+  countSensitive: () => countSensitive,
+  countTotal: () => countTotal,
+  isSensitiveKey: () => isSensitiveKey,
+  isSensitiveValue: () => isSensitiveValue,
+  parseEnv: () => parseEnv
+});
+module.exports = __toCommonJS(index_exports);
+var SENSITIVE_KEY_PATTERNS = [
+  /SECRET/i,
+  /PASSWORD/i,
+  /PASSWD/i,
+  /PASS$/i,
+  /_KEY$/i,
+  /^API_KEY/i,
+  /TOKEN/i,
+  /AUTH/i,
+  /CREDENTIAL/i,
+  /PRIVATE/i,
+  /SIGNING/i,
+  /ENCRYPTION/i,
+  /DATABASE_URL/i,
+  /DB_URL/i,
+  /_DSN$/i,
+  /CONNECTION_STRING/i,
+  /MONGODB_URI/i,
+  /REDIS_URL/i,
+  /STRIPE_/i,
+  /OPENAI_/i,
+  /ANTHROPIC_/i,
+  /GEMINI_/i,
+  /GITHUB_TOKEN/i,
+  /GH_TOKEN/i,
+  /AWS_SECRET/i,
+  /AWS_ACCESS_KEY/i,
+  /AZURE_/i,
+  /GCP_/i,
+  /GOOGLE_/i,
+  /TWILIO_/i,
+  /SENDGRID_/i,
+  /MAILGUN_/i,
+  /DISCORD_TOKEN/i,
+  /SLACK_TOKEN/i,
+  /WEBHOOK_SECRET/i,
+  /HMAC/i,
+  /SALT$/i,
+  /CERTIFICATE/i,
+  /CERT$/i,
+  /PEM$/i,
+  /SSH_/i
+];
+var SENSITIVE_VALUE_PATTERNS = [
+  /^[A-Za-z0-9+/]{32,}={0,2}$/,
+  /^[0-9a-f]{32,}$/i,
+  /^sk_/,
+  /^pk_live/,
+  /^rk_/,
+  /^eyJ/,
+  /^ghp_/,
+  /^github_pat_/,
+  /^gho_/,
+  /^ghu_/,
+  /^[A-Z0-9]{20,}$/,
+  /-----BEGIN/,
+  /^[A-Za-z0-9_-]{40,}$/
+];
+function cleanValue(raw) {
+  return raw.trim().replace(/,$/, "").replace(/^(['"])(.*)\1$/, "$2");
+}
+function isValueSensitive(key, rawValue) {
+  const val = cleanValue(rawValue);
+  if (!val) return false;
+  for (const p of SENSITIVE_KEY_PATTERNS) if (p.test(key)) return true;
+  if (val.length >= 32) {
+    for (const p of SENSITIVE_VALUE_PATTERNS) if (p.test(val)) return true;
+  }
+  return false;
+}
+function detectSeparator(lines) {
+  let colonCount = 0, equalsCount = 0;
+  for (const line of lines.slice(0, 30)) {
+    const t = line.trim().replace(/^\/\/\s*/, "");
+    if (!t || t.startsWith("#")) continue;
+    if (/^[A-Z_][A-Z0-9_]*\s*=/.test(t)) equalsCount++;
+    else if (/^[A-Z_][A-Z0-9_]*\s*:/.test(t)) colonCount++;
+  }
+  return colonCount > equalsCount ? "colon" : "=";
+}
+function tryParseKeyValue(inner) {
+  const colonM = inner.match(/^([A-Z_][A-Z0-9_]*)\s*:\s*(.*)$/i);
+  if (colonM) return { key: colonM[1], value: colonM[2].trim(), sep: ": " };
+  const eqIdx = inner.indexOf("=");
+  if (eqIdx !== -1) {
+    const key = inner.slice(0, eqIdx).trim();
+    if (/^[A-Z_][A-Z0-9_]*$/i.test(key)) return { key, value: inner.slice(eqIdx + 1), sep: "=" };
+  }
+  return null;
+}
+function parseEnv(content) {
+  const rawLines = content.split("\n");
+  const sep = detectSeparator(rawLines);
+  const normalised = [];
+  if (sep === "colon") {
+    let i = 0;
+    while (i < rawLines.length) {
+      const line = rawLines[i];
+      if (/^[A-Z_][A-Z0-9_]*\s*:\s*$/.test(line.trim()) && i + 1 < rawLines.length) {
+        normalised.push({ raw: line + "\n" + rawLines[i + 1], joined: line.trim() + " " + rawLines[i + 1].trim() });
+        i += 2;
+      } else {
+        normalised.push({ raw: line, joined: line });
+        i++;
+      }
+    }
+  } else {
+    rawLines.forEach((r) => normalised.push({ raw: r, joined: r }));
+  }
+  return normalised.map(({ raw, joined }) => {
+    const line = joined.trim();
+    if (line === "") return { kind: "blank", raw };
+    if (line.startsWith("#")) return { kind: "comment", raw };
+    if (line.startsWith("//")) {
+      const m = line.match(/^(\/\/\s*)(.*)$/);
+      if (m) {
+        const kv = tryParseKeyValue(m[2].trim());
+        if (kv && isValueSensitive(kv.key, kv.value)) {
+          return { kind: "entry", raw, key: kv.key, value: kv.value, sep: kv.sep, sensitive: true, commentPrefix: m[1] };
+        }
+      }
+      return { kind: "comment", raw };
+    }
+    let key, value;
+    const entrySep = sep === "colon" ? ": " : "=";
+    if (sep === "colon") {
+      const m = line.match(/^([A-Z_][A-Z0-9_]*)\s*:\s*(.*)$/i);
+      if (!m) return { kind: "invalid", raw };
+      key = m[1].trim();
+      value = m[2].trim();
+    } else {
+      const eqIndex = line.indexOf("=");
+      if (eqIndex === -1) return { kind: "invalid", raw };
+      key = line.slice(0, eqIndex).trim();
+      value = line.slice(eqIndex + 1);
+      if (!/^[A-Z_][A-Z0-9_]*$/i.test(key)) return { kind: "invalid", raw };
+    }
+    return { kind: "entry", raw, key, value, sep: entrySep, sensitive: isValueSensitive(key, value) };
+  });
+}
+function buildSanitized(lines, opts = {}) {
+  const placeholder = opts.placeholder ?? "REDACTED";
+  return lines.map((line) => {
+    if (line.kind === "entry" && line.sensitive) {
+      return `${line.commentPrefix ?? ""}${line.key}${line.sep}${placeholder}`;
+    }
+    return line.raw;
+  }).join("\n");
+}
+function buildExample(lines) {
+  return lines.map((line) => {
+    if (line.kind === "entry") return `${line.commentPrefix ?? ""}${line.key}${line.sep}`;
+    return line.raw;
+  }).join("\n");
+}
+function buildDiff(lines) {
+  return lines.map((line) => {
+    if (line.kind === "entry" && line.sensitive) {
+      const prefix = line.commentPrefix ?? "";
+      return { changed: true, before: `${prefix}${line.key}${line.sep}${line.value}`, after: `${prefix}${line.key}${line.sep}REDACTED` };
+    }
+    return { changed: false, content: line.raw };
+  });
+}
+function countSensitive(lines) {
+  return lines.filter((l) => l.kind === "entry" && l.sensitive).length;
+}
+function countTotal(lines) {
+  return lines.filter((l) => l.kind === "entry").length;
+}
+function isSensitiveKey(key) {
+  return SENSITIVE_KEY_PATTERNS.some((p) => p.test(key));
+}
+function isSensitiveValue(value) {
+  const val = cleanValue(value);
+  if (val.length < 32) return false;
+  return SENSITIVE_VALUE_PATTERNS.some((p) => p.test(val));
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  buildDiff,
+  buildExample,
+  buildSanitized,
+  countSensitive,
+  countTotal,
+  isSensitiveKey,
+  isSensitiveValue,
+  parseEnv
+});

package/dist/index.mjs

@@ -0,0 +1,189 @@
+// src/index.ts
+var SENSITIVE_KEY_PATTERNS = [
+  /SECRET/i,
+  /PASSWORD/i,
+  /PASSWD/i,
+  /PASS$/i,
+  /_KEY$/i,
+  /^API_KEY/i,
+  /TOKEN/i,
+  /AUTH/i,
+  /CREDENTIAL/i,
+  /PRIVATE/i,
+  /SIGNING/i,
+  /ENCRYPTION/i,
+  /DATABASE_URL/i,
+  /DB_URL/i,
+  /_DSN$/i,
+  /CONNECTION_STRING/i,
+  /MONGODB_URI/i,
+  /REDIS_URL/i,
+  /STRIPE_/i,
+  /OPENAI_/i,
+  /ANTHROPIC_/i,
+  /GEMINI_/i,
+  /GITHUB_TOKEN/i,
+  /GH_TOKEN/i,
+  /AWS_SECRET/i,
+  /AWS_ACCESS_KEY/i,
+  /AZURE_/i,
+  /GCP_/i,
+  /GOOGLE_/i,
+  /TWILIO_/i,
+  /SENDGRID_/i,
+  /MAILGUN_/i,
+  /DISCORD_TOKEN/i,
+  /SLACK_TOKEN/i,
+  /WEBHOOK_SECRET/i,
+  /HMAC/i,
+  /SALT$/i,
+  /CERTIFICATE/i,
+  /CERT$/i,
+  /PEM$/i,
+  /SSH_/i
+];
+var SENSITIVE_VALUE_PATTERNS = [
+  /^[A-Za-z0-9+/]{32,}={0,2}$/,
+  /^[0-9a-f]{32,}$/i,
+  /^sk_/,
+  /^pk_live/,
+  /^rk_/,
+  /^eyJ/,
+  /^ghp_/,
+  /^github_pat_/,
+  /^gho_/,
+  /^ghu_/,
+  /^[A-Z0-9]{20,}$/,
+  /-----BEGIN/,
+  /^[A-Za-z0-9_-]{40,}$/
+];
+function cleanValue(raw) {
+  return raw.trim().replace(/,$/, "").replace(/^(['"])(.*)\1$/, "$2");
+}
+function isValueSensitive(key, rawValue) {
+  const val = cleanValue(rawValue);
+  if (!val) return false;
+  for (const p of SENSITIVE_KEY_PATTERNS) if (p.test(key)) return true;
+  if (val.length >= 32) {
+    for (const p of SENSITIVE_VALUE_PATTERNS) if (p.test(val)) return true;
+  }
+  return false;
+}
+function detectSeparator(lines) {
+  let colonCount = 0, equalsCount = 0;
+  for (const line of lines.slice(0, 30)) {
+    const t = line.trim().replace(/^\/\/\s*/, "");
+    if (!t || t.startsWith("#")) continue;
+    if (/^[A-Z_][A-Z0-9_]*\s*=/.test(t)) equalsCount++;
+    else if (/^[A-Z_][A-Z0-9_]*\s*:/.test(t)) colonCount++;
+  }
+  return colonCount > equalsCount ? "colon" : "=";
+}
+function tryParseKeyValue(inner) {
+  const colonM = inner.match(/^([A-Z_][A-Z0-9_]*)\s*:\s*(.*)$/i);
+  if (colonM) return { key: colonM[1], value: colonM[2].trim(), sep: ": " };
+  const eqIdx = inner.indexOf("=");
+  if (eqIdx !== -1) {
+    const key = inner.slice(0, eqIdx).trim();
+    if (/^[A-Z_][A-Z0-9_]*$/i.test(key)) return { key, value: inner.slice(eqIdx + 1), sep: "=" };
+  }
+  return null;
+}
+function parseEnv(content) {
+  const rawLines = content.split("\n");
+  const sep = detectSeparator(rawLines);
+  const normalised = [];
+  if (sep === "colon") {
+    let i = 0;
+    while (i < rawLines.length) {
+      const line = rawLines[i];
+      if (/^[A-Z_][A-Z0-9_]*\s*:\s*$/.test(line.trim()) && i + 1 < rawLines.length) {
+        normalised.push({ raw: line + "\n" + rawLines[i + 1], joined: line.trim() + " " + rawLines[i + 1].trim() });
+        i += 2;
+      } else {
+        normalised.push({ raw: line, joined: line });
+        i++;
+      }
+    }
+  } else {
+    rawLines.forEach((r) => normalised.push({ raw: r, joined: r }));
+  }
+  return normalised.map(({ raw, joined }) => {
+    const line = joined.trim();
+    if (line === "") return { kind: "blank", raw };
+    if (line.startsWith("#")) return { kind: "comment", raw };
+    if (line.startsWith("//")) {
+      const m = line.match(/^(\/\/\s*)(.*)$/);
+      if (m) {
+        const kv = tryParseKeyValue(m[2].trim());
+        if (kv && isValueSensitive(kv.key, kv.value)) {
+          return { kind: "entry", raw, key: kv.key, value: kv.value, sep: kv.sep, sensitive: true, commentPrefix: m[1] };
+        }
+      }
+      return { kind: "comment", raw };
+    }
+    let key, value;
+    const entrySep = sep === "colon" ? ": " : "=";
+    if (sep === "colon") {
+      const m = line.match(/^([A-Z_][A-Z0-9_]*)\s*:\s*(.*)$/i);
+      if (!m) return { kind: "invalid", raw };
+      key = m[1].trim();
+      value = m[2].trim();
+    } else {
+      const eqIndex = line.indexOf("=");
+      if (eqIndex === -1) return { kind: "invalid", raw };
+      key = line.slice(0, eqIndex).trim();
+      value = line.slice(eqIndex + 1);
+      if (!/^[A-Z_][A-Z0-9_]*$/i.test(key)) return { kind: "invalid", raw };
+    }
+    return { kind: "entry", raw, key, value, sep: entrySep, sensitive: isValueSensitive(key, value) };
+  });
+}
+function buildSanitized(lines, opts = {}) {
+  const placeholder = opts.placeholder ?? "REDACTED";
+  return lines.map((line) => {
+    if (line.kind === "entry" && line.sensitive) {
+      return `${line.commentPrefix ?? ""}${line.key}${line.sep}${placeholder}`;
+    }
+    return line.raw;
+  }).join("\n");
+}
+function buildExample(lines) {
+  return lines.map((line) => {
+    if (line.kind === "entry") return `${line.commentPrefix ?? ""}${line.key}${line.sep}`;
+    return line.raw;
+  }).join("\n");
+}
+function buildDiff(lines) {
+  return lines.map((line) => {
+    if (line.kind === "entry" && line.sensitive) {
+      const prefix = line.commentPrefix ?? "";
+      return { changed: true, before: `${prefix}${line.key}${line.sep}${line.value}`, after: `${prefix}${line.key}${line.sep}REDACTED` };
+    }
+    return { changed: false, content: line.raw };
+  });
+}
+function countSensitive(lines) {
+  return lines.filter((l) => l.kind === "entry" && l.sensitive).length;
+}
+function countTotal(lines) {
+  return lines.filter((l) => l.kind === "entry").length;
+}
+function isSensitiveKey(key) {
+  return SENSITIVE_KEY_PATTERNS.some((p) => p.test(key));
+}
+function isSensitiveValue(value) {
+  const val = cleanValue(value);
+  if (val.length < 32) return false;
+  return SENSITIVE_VALUE_PATTERNS.some((p) => p.test(val));
+}
+export {
+  buildDiff,
+  buildExample,
+  buildSanitized,
+  countSensitive,
+  countTotal,
+  isSensitiveKey,
+  isSensitiveValue,
+  parseEnv
+};

package/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "@aarunyaapps/env-redact",
+  "version": "1.0.0",
+  "description": "Parse .env files and detect/redact sensitive values. Zero dependencies. Browser + Node.js compatible.",
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+    }
+  },
+  "files": ["dist", "README.md"],
+  "scripts": {
+    "build": "tsup src/index.ts --format cjs,esm --dts --clean",
+    "dev": "tsup src/index.ts --format cjs,esm --dts --watch",
+    "type-check": "tsc --noEmit"
+  },
+  "keywords": ["dotenv", "env", "secrets", "redact", "sanitize", "security", "privacy"],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/aarunyaapps/env-redact"
+  },
+  "devDependencies": {
+    "tsup": "^8.0.0",
+    "typescript": "^5.8.3"
+  }
+}