@dotenvx/dotenvx 2.10.0 → 2.11.1

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.10.0",
+  "version": "2.11.1",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/run.js

@@ -13,7 +13,7 @@ const resolveEnvKeysFile = require('../../lib/helpers/resolveEnvKeysFile')
 const mask = require('../../lib/helpers/mask')
 const maskEnvSrc = require('../../lib/helpers/maskEnvSrc')
 const maskProcessedEnvs = require('../../lib/helpers/maskProcessedEnvs')
-const decryptedValues = require('../../lib/helpers/decryptedValues')
+const redactedValues = require('../../lib/helpers/redactedValues')
 const { redactOutput } = require('../../lib/helpers/redactOutput')
 
 const { determine } = require('./../../lib/helpers/envResolution')
@@ -127,7 +127,7 @@ async function run () {
     })
 
     if (redactEnabled) {
-      sensitiveValues = decryptedValues(processedEnvs)
+      sensitiveValues = redactedValues(processedEnvs)
     }
 
     if (maskEnabled) {

package/src/cli/actions/update.js

@@ -0,0 +1,15 @@
+const childProcess = require('child_process')
+
+const INSTALL_COMMAND = 'curl -sfS https://dotenvx.sh | sh'
+
+function update () {
+  if (process.pkg) {
+    childProcess.execSync(INSTALL_COMMAND, { stdio: 'inherit' })
+    return
+  }
+
+  console.log('global: npm install -g @dotenvx/dotenvx@latest')
+  console.log('local:  npm install @dotenvx/dotenvx@latest --save')
+}
+
+module.exports = update

package/src/cli/dotenvx.js

@@ -64,13 +64,13 @@ program.command('run')
   .option('-e, --env <strings...>', 'environment variable(s) set as string (example: "HELLO=World")', collectEnvs('env'), [])
   .option('-f, --env-file <path>', 'path(s) to your env file(s)', collectEnvs('envFile'), [])
   .option('-fk, --env-keys-file <path>', 'path(s) to your .env.keys file(s) (default: same path as your env file)', collectEnvKeys)
+  .option('--redact', 'redact injected values except keys ending in _PLAIN', false)
   .option('-o, --overload', 'override existing env variables (by default, existing env vars take precedence over .env files)')
   .option('--strict', 'process.exit(1) on any errors', false)
   .option('--convention <name>', 'load a .env convention (available conventions: [\'nextjs\', \'flow\'])')
   .option('--ignore <errorCodes...>', 'error code(s) to ignore (example: --ignore=MISSING_ENV_FILE)')
   .option('--token <token>', 'set Armor ⛨ token')
   .option('--mask [characters]', 'inject masked values, optionally setting visible characters')
-  .option('--redact', 'redact decrypted values from command output', false)
   .option('--no-armor', 'disable Dotenvx Armor features')
   .option('--no-native', 'disable OS secret store features')
   .action(function (...args) {
@@ -227,6 +227,13 @@ program.command('doctor', { hidden: true })
     return require('./actions/doctor').apply(this, args)
   })
 
+// dotenvx update
+program.command('update')
+  .description('update dotenvx')
+  .action(function (...args) {
+    return require('./actions/update').apply(this, args)
+  })
+
 // dotenvx login (compatibility alias for dotenvx armor login)
 program.command('login', { hidden: true })
   .description('log in to move keys off-device, share with your team, and audit access')

package/src/lib/helpers/colorDepth.js

@@ -1,7 +1,13 @@
 const { WriteStream } = require('tty')
 
-const getColorDepth = () => {
+const getColorDepth = (stream) => {
+  if (stream && !stream.isTTY) return 1
+
   try {
+    if (stream && typeof stream.getColorDepth === 'function') {
+      return stream.getColorDepth()
+    }
+
     return WriteStream.prototype.getColorDepth()
   } catch (error) {
     const term = process.env.TERM

package/src/lib/helpers/executeCommand.js

@@ -4,6 +4,7 @@ const execute = require('./../../lib/helpers/execute')
 const { logger } = require('./../../shared/logger')
 const Errors = require('./errors')
 const { createRedactedStreamWriter, redactOutput } = require('./redactOutput')
+const ptyCommand = require('./ptyCommand')
 
 async function executeCommand (commandArgs, env, sensitiveValues = []) {
   const FORWARD_SIGNAL_GRACE_MS = 1000
@@ -133,8 +134,15 @@ async function executeCommand (commandArgs, env, sensitiveValues = []) {
 
     const redactStdout = sensitiveValues.length > 0
     const redactStderr = sensitiveValues.length > 0
-
-    child = execute.execa(commandArgs[0], commandArgs.slice(1), {
+    const usePty = redactStdout && Boolean(
+      process.stdin && process.stdin.isTTY &&
+      process.stdout && process.stdout.isTTY &&
+      process.stderr && process.stderr.isTTY
+    )
+    const ptyArgs = usePty ? ptyCommand(commandArgs) : null
+    const executedArgs = ptyArgs || commandArgs
+
+    child = execute.execa(executedArgs[0], executedArgs.slice(1), {
       stdio: ['inherit', redactStdout ? 'pipe' : 'inherit', redactStderr ? 'pipe' : 'inherit'],
       buffer: false,
       env: { ...process.env, ...env }

package/src/lib/helpers/kits/sample.js

@@ -1,23 +1,5 @@
 const SAMPLE_ENV_KIT = `
-HELLO="Dotenvx"
-
-# ── Hosting ──────────────────────────────────────
-AWS_ACCESS_KEY_ID="xxxx"
-AWS_SECRET_ACCESS_KEY="xxxx"
-DATABASE_URL="postgresql://postgres:pass@db.ref.supabase.co:5432/postgres"
-VERCEL_TOKEN="vcp_xxxx"
-
-# ── AI ───────────────────────────────────────────
-OPENAI_API_KEY="sk-xxxx"
-ANTHROPIC_API_KEY="sk-ant-xxxx"
-
-# ── Infrastructure ───────────────────────────────
-AUTH0_CLIENT_ID="xxxx"
-AUTH0_CLIENT_SECRET="xxxx"
-RESEND_API_KEY="re_xxxx"
-STRIPE_API_KEY="sk_test_xxxx"
-FLAGSMITH_ENV_ID="xxxx"
-SENTRY_DSN="https://hex@o1234.ingest.us.sentry.io/1234567"
+HELLO="World"
 `.trimStart()
 
 module.exports = SAMPLE_ENV_KIT

package/src/lib/helpers/ptyCommand.js

@@ -0,0 +1,27 @@
+const path = require('path')
+const { which } = require('@dotenvx/tooling')
+
+function shellQuote (value) {
+  const escapedQuote = ['\'', '"', '\'', '"', '\''].join('')
+  return `'${`${value}`.replace(/'/g, escapedQuote)}'`
+}
+
+function ptyCommand (commandArgs, platform = process.platform) {
+  if (!['darwin', 'linux'].includes(platform)) return null
+
+  let script
+  try {
+    script = path.resolve(which.sync('script'))
+  } catch (e) {
+    return null
+  }
+
+  if (platform === 'darwin') {
+    return [script, '-q', '/dev/null', ...commandArgs]
+  }
+
+  // util-linux script only accepts the child command as a shell string.
+  return [script, '-qefc', commandArgs.map(shellQuote).join(' '), '/dev/null']
+}
+
+module.exports = ptyCommand

package/src/lib/helpers/redactedValues.js

@@ -0,0 +1,23 @@
+const isPlainKey = require('./cryptography/isPlainKey')
+
+function redactedValues (processedEnvs) {
+  const result = new Set()
+
+  for (const processedEnv of processedEnvs || []) {
+    const values = {
+      ...(processedEnv.injected || {}),
+      ...(processedEnv.existed || {})
+    }
+
+    for (const [key, value] of Object.entries(values)) {
+      if (isPlainKey(key)) continue
+      if (value === undefined || value === null || value === '') continue
+
+      result.add(`${value}`)
+    }
+  }
+
+  return [...result]
+}
+
+module.exports = redactedValues

package/src/lib/main.d.ts

@@ -173,7 +173,6 @@ export interface DotenvConfigOptions {
     | 'error'
     | 'warn'
     | 'success'
-    | 'successv'
     | 'info'
     | 'help'
     | 'verbose'

package/src/shared/colors.js

@@ -33,8 +33,8 @@ const colorsTrueColor = new Map([
   ['red', [140, 35, 50]] // #8C2332 brighter garnet
 ])
 
-function getColor (color) {
-  const colorDepth = depth.getColorDepth()
+function getColor (color, stream) {
+  const colorDepth = depth.getColorDepth(stream)
   if (!colors256.has(color)) {
     throw new Errors({ color }).invalidColor()
   }
@@ -53,8 +53,8 @@ function getColor (color) {
   return (message) => message
 }
 
-function bold (message) {
-  if (depth.getColorDepth() >= 4) {
+function bold (message, stream) {
+  if (depth.getColorDepth(stream) >= 4) {
     return `\x1b[1m${message}\x1b[22m`
   }
 

package/src/shared/logger.js

@@ -1,4 +1,3 @@
-const packageJson = require('../lib/helpers/packageJson')
 const Errors = require('../lib/helpers/errors')
 const { getColor, bold } = require('./colors')
 
@@ -7,7 +6,6 @@ const levels = {
   infoerror: 0,
   warn: 1,
   success: 2,
-  successv: 2,
   info: 2,
   help: 2,
   verbose: 4,
@@ -15,23 +13,26 @@ const levels = {
   silly: 6
 }
 
-const error = (m) => bold(getColor('red')(`☠ ${m}`))
-const infoerror = getColor('gray') // actually an error
-const warn = (m) => getColor('orangered')(`⚠ ${m}`)
-const success = getColor('amber')
-const successv = (m) => getColor('amber')(`⟐ ${m}`)
-const info = getColor('gray')
-const help = getColor('dodgerblue')
-const verbose = (m) => getColor('plum')(`┆ ${m}`)
-const debug = (m) => getColor('plum')(`┆ ${m}`)
+const error = (m, stream) => bold(getColor('red', stream)(`☠ ${m}`), stream)
+const infoerror = (m, stream) => getColor('gray', stream)(m) // actually an error
+const warn = (m, stream) => getColor('orangered', stream)(`⚠ ${m}`)
+const success = (m, stream) => getColor('amber', stream)(m)
+const info = (m, stream) => getColor('gray', stream)(m)
+const help = (m, stream) => getColor('dodgerblue', stream)(m)
+const verbose = (m, stream) => getColor('plum', stream)(`┆ ${m}`)
+const debug = (m, stream) => getColor('plum', stream)(`┆ ${m}`)
 
 let currentLevel = levels.info // default log level
-let currentName = 'dotenvx' // default logger name
-let currentVersion = packageJson.version // default logger version
 
 function stderr (level, message) {
-  const formattedMessage = formatMessage(level, message)
-  console.error(formattedMessage)
+  if (levels[level] === undefined) {
+    throw new Errors({ level }).missingLogLevel()
+  }
+
+  if (levels[level] <= currentLevel) {
+    const formattedMessage = formatMessage(level, message, process.stderr)
+    console.error(formattedMessage)
+  }
 }
 
 function stdout (level, message) {
@@ -40,40 +41,38 @@ function stdout (level, message) {
   }
 
   if (levels[level] <= currentLevel) {
-    const formattedMessage = formatMessage(level, message)
+    const formattedMessage = formatMessage(level, message, process.stdout)
     console.log(formattedMessage)
   }
 }
 
-function formatMessage (level, message) {
+function formatMessage (level, message, stream) {
   const formattedMessage = typeof message === 'object' ? JSON.stringify(message) : message
 
   switch (level.toLowerCase()) {
     // errors
     case 'error':
-      return error(formattedMessage)
+      return error(formattedMessage, stream)
     case 'infoerror':
-      return infoerror(formattedMessage)
+      return infoerror(formattedMessage, stream)
     // warns
     case 'warn':
-      return warn(formattedMessage)
+      return warn(formattedMessage, stream)
     // successes
     case 'success':
-      return success(formattedMessage)
-    case 'successv': // success with 'version'
-      return successv(`${formattedMessage} · ${currentName}@${currentVersion}`)
+      return success(formattedMessage, stream)
     // info
     case 'info':
-      return info(formattedMessage)
+      return info(formattedMessage, stream)
     // help
     case 'help':
-      return help(formattedMessage)
+      return help(formattedMessage, stream)
     // verbose
     case 'verbose':
-      return verbose(formattedMessage)
+      return verbose(formattedMessage, stream)
     // debug
     case 'debug':
-      return debug(formattedMessage)
+      return debug(formattedMessage, stream)
   }
 }
 
@@ -85,18 +84,17 @@ const logger = {
   error: (msg) => stderr('error', msg),
   infoerror: (msg) => stderr('infoerror', msg),
   // warns
-  warn: (msg) => stdout('warn', msg),
+  warn: (msg) => stderr('warn', msg),
   // success
-  success: (msg) => stdout('success', msg),
-  successv: (msg) => stdout('successv', msg),
+  success: (msg) => stderr('success', msg),
   // info
   info: (msg) => stdout('info', msg),
   // help
-  help: (msg) => stdout('help', msg),
+  help: (msg) => stderr('help', msg),
   // verbose
-  verbose: (msg) => stdout('verbose', msg),
+  verbose: (msg) => stderr('verbose', msg),
   // debug
-  debug: (msg) => stdout('debug', msg),
+  debug: (msg) => stderr('debug', msg),
   setLevel: (level) => {
     if (levels[level] !== undefined) {
       currentLevel = levels[level]
@@ -104,11 +102,9 @@ const logger = {
     }
   },
   setName: (name) => {
-    currentName = name
     logger.name = name
   },
   setVersion: (version) => {
-    currentVersion = version
     logger.version = version
   }
 }

package/src/lib/helpers/decryptedValues.js

@@ -1,32 +0,0 @@
-const { encrypted, scan } = require('@dotenvx/primitives')
-
-function decryptedValues (processedEnvs) {
-  const result = new Set()
-
-  for (const processedEnv of processedEnvs || []) {
-    const src = processedEnv.src || processedEnv.string
-    if (!src) continue
-
-    let rawParsed
-    try {
-      rawParsed = scan(src).parsed
-    } catch (error) {
-      continue
-    }
-
-    for (const [key, rawValues] of Object.entries(rawParsed || {})) {
-      const rawValue = rawValues[rawValues.length - 1]
-      const injectedValue = (processedEnv.injected || {})[key]
-
-      if (!encrypted(rawValue)) continue
-      if (injectedValue === undefined || injectedValue === null || injectedValue === '') continue
-      if (encrypted(injectedValue)) continue
-
-      result.add(`${injectedValue}`)
-    }
-  }
-
-  return [...result]
-}
-
-module.exports = decryptedValues