@bremmdev/arca-env 0.0.0-stage → 0.1.2

package/dist/redact-D4Txfinc.mjs

@@ -0,0 +1,151 @@
+import { StringDecoder } from "node:string_decoder";
+/** Builds needles for a value: raw, URL-encoded, JSON-escaped, base64, base64url and URL credentials. */
+function needlesFor(secret) {
+	const { name, value } = secret;
+	const out = [];
+	const add = (text, replacement = `[arca:${name}]`) => {
+		if (text.length >= 6) out.push({
+			text,
+			replacement
+		});
+	};
+	if (value.length < 6) return out;
+	add(value);
+	add(encodeURIComponent(value));
+	add(JSON.stringify(value).slice(1, -1));
+	add(Buffer.from(value, "utf8").toString("base64"));
+	add(Buffer.from(value, "utf8").toString("base64url"));
+	const url = parseCredentialUrl(value);
+	if (url) {
+		add(`${url.rawUser}:${url.rawPassword}`, `[arca:${name}#credentials]`);
+		add(url.rawPassword, `[arca:${name}#password]`);
+		if (url.password !== url.rawPassword) add(url.password, `[arca:${name}#password]`);
+	}
+	return out;
+}
+function parseCredentialUrl(value) {
+	const m = /^[a-z][a-z0-9+.-]*:\/\/([^:@/\s]*):([^@/\s]+)@/i.exec(value);
+	if (!m) return null;
+	const rawPassword = m[2];
+	let password = rawPassword;
+	try {
+		password = decodeURIComponent(rawPassword);
+	} catch {}
+	return {
+		rawUser: m[1],
+		rawPassword,
+		password
+	};
+}
+var Redactor = class {
+	byFirst = /* @__PURE__ */ new Map();
+	held = "";
+	size;
+	constructor(needles) {
+		const unique = /* @__PURE__ */ new Map();
+		for (const n of needles) {
+			const existing = unique.get(n.text);
+			if (!existing || existing.replacement.includes("#") && !n.replacement.includes("#")) unique.set(n.text, n);
+		}
+		const sorted = [...unique.values()].sort((a, b) => b.text.length - a.text.length);
+		for (const n of sorted) {
+			const c = n.text[0];
+			const list = this.byFirst.get(c) ?? [];
+			list.push(n);
+			this.byFirst.set(c, list);
+		}
+		this.size = unique.size;
+	}
+	/** Masks a complete string (no streaming). */
+	redact(text) {
+		return this.scan(text, true).out;
+	}
+	/** Feeds a chunk; returns what can be printed now. */
+	push(chunk) {
+		const { out, hold } = this.scan(this.held + chunk, false);
+		this.held = hold;
+		return out;
+	}
+	/** Returns the held tail, masked as far as possible. */
+	flush() {
+		const { out } = this.scan(this.held, true);
+		this.held = "";
+		return out;
+	}
+	get pending() {
+		return this.held.length > 0;
+	}
+	scan(text, final) {
+		if (this.size === 0) return {
+			out: text,
+			hold: ""
+		};
+		let out = "";
+		let i = 0;
+		let plainStart = 0;
+		while (i < text.length) {
+			const candidates = this.byFirst.get(text[i]);
+			if (candidates) {
+				let match = null;
+				let partial = false;
+				for (const n of candidates) if (i + n.text.length <= text.length) {
+					if (text.startsWith(n.text, i)) {
+						match = n;
+						break;
+					}
+				} else if (!final && n.text.startsWith(text.slice(i))) partial = true;
+				if (partial) {
+					out += text.slice(plainStart, i);
+					return {
+						out,
+						hold: text.slice(i)
+					};
+				}
+				if (match) {
+					out += text.slice(plainStart, i) + match.replacement;
+					i += match.text.length;
+					plainStart = i;
+					continue;
+				}
+			}
+			i++;
+		}
+		out += text.slice(plainStart);
+		return {
+			out,
+			hold: ""
+		};
+	}
+};
+/** Wires a byte stream through a Redactor into `write`, with the 50 ms hold-back flush. */
+function createMaskedWriter(redactor, write, flushMs = 50) {
+	const decoder = new StringDecoder("utf8");
+	let timer = null;
+	const schedule = () => {
+		if (timer) clearTimeout(timer);
+		timer = null;
+		if (redactor.pending) {
+			timer = setTimeout(() => {
+				timer = null;
+				const s = redactor.flush();
+				if (s) write(s);
+			}, flushMs);
+			timer.unref?.();
+		}
+	};
+	return {
+		write(chunk) {
+			const s = redactor.push(typeof chunk === "string" ? chunk : decoder.write(chunk));
+			if (s) write(s);
+			schedule();
+		},
+		end() {
+			if (timer) clearTimeout(timer);
+			timer = null;
+			const s = redactor.push(decoder.end()) + redactor.flush();
+			if (s) write(s);
+		}
+	};
+}
+//#endregion
+export { createMaskedWriter as n, needlesFor as r, Redactor as t };

package/package.json

@@ -1,6 +1,53 @@
 {
   "name": "@bremmdev/arca-env",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.2",
+  "description": "Keep secrets out of .env files and out of reach of AI agents. Encrypted local store, injected at runtime, output always masked.",
+  "type": "module",
+  "license": "MIT",
+  "author": "bremmdev",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/bremmdev/arca-env"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "bin": {
+    "arca": "./dist/cli.mjs"
+  },
+  "exports": {
+    ".": "./dist/index.mjs",
+    "./schema.json": "./schema.json",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "schema.json"
+  ],
+  "keywords": [
+    "env",
+    "dotenv",
+    "secrets",
+    "ai-agents",
+    "keychain",
+    "redaction"
+  ],
+  "scripts": {
+    "build": "tsdown",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "dependencies": {
+    "@clack/prompts": "^1.8.1",
+    "@napi-rs/keyring": "^2.1.2",
+    "cross-spawn": "^7.0.6"
+  },
+  "devDependencies": {
+    "@types/cross-spawn": "^6.0.6",
+    "@types/node": "^26.6.5",
+    "tsdown": "^0.22.2",
+    "typescript": "^6.0.3",
+    "vitest": "^5.0.5"
+  }
+}

package/schema.json

@@ -0,0 +1,63 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://unpkg.com/@bremmdev/arca-env/schema.json",
+  "title": "arca.json",
+  "description": "arca project config. Holds variable names and metadata, never values. Secrets live in arca, non-sensitive config in .env files.",
+  "type": "object",
+  "required": ["id"],
+  "properties": {
+    "$schema": { "type": "string" },
+    "id": {
+      "type": "string",
+      "pattern": "^arc_[a-z2-7]{8,}$",
+      "description": "Stable project ID generated by `arca init`. Clones and git worktrees with the same ID share secrets. Don't edit by hand; use `arca init --new-id`."
+    },
+    "name": { "type": "string", "description": "Display name." },
+    "envFiles": {
+      "type": "array",
+      "items": { "type": "string" },
+      "default": [],
+      "description": "Opt-in: .env files arca loads itself, for tools that don't (plain node, tsx). Injected below secrets and the shell env. Frameworks load their own .env files, so leave this empty for Next.js, Vite, Astro and friends."
+    },
+    "leakGuard": {
+      "type": "object",
+      "properties": {
+        "ignore": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Variable names the leak guard should never flag in .env files."
+        }
+      },
+      "additionalProperties": false
+    },
+    "vars": {
+      "type": "object",
+      "description": "Every variable the project needs. Names only.",
+      "propertyNames": { "pattern": "^[A-Za-z_][A-Za-z0-9_]*$" },
+      "additionalProperties": {
+        "type": "object",
+        "properties": {
+          "description": { "type": "string", "description": "Shown in `arca setup` and `arca list`." },
+          "required": { "type": "boolean", "default": false, "description": "`arca run` and `arca check` fail when it's missing." },
+          "sensitive": {
+            "type": "boolean",
+            "default": true,
+            "description": "true (default): a secret, its value comes from arca and is masked in output. false: config, its value lives in .env."
+          },
+          "example": { "type": "string", "description": "A hint shown during `arca setup`. Never a real value." },
+          "docs": { "type": "string", "description": "Where to get the value, e.g. a dashboard URL." },
+          "generate": {
+            "type": "object",
+            "description": "Lets `arca setup` and `arca set NAME --generate` create a random value.",
+            "properties": {
+              "bytes": { "type": "integer", "minimum": 8, "maximum": 1024, "default": 32 },
+              "encoding": { "enum": ["base64url", "base64", "hex"], "default": "base64url" }
+            },
+            "additionalProperties": false
+          }
+        },
+        "additionalProperties": false
+      }
+    }
+  }
+}