@dotenvx/next-env 2.0.2 → 2.1.0

package/dist/index.cjs

@@ -5350,7 +5350,7 @@ var require_dist = __commonJS({
           const isAEAD = algorithm === "aes-256-gcm" || algorithm === "chacha20-poly1305";
           const authTagLength = isAEAD ? AEAD_TAG_LENGTH : 0;
           const options = isAEAD ? { authTagLength } : void 0;
-          const encrypt = (plainText) => {
+          const encrypt2 = (plainText) => {
             const cipher = (0, node_crypto_1.createCipheriv)(algorithm, key, nonce, options);
             if (isAEAD && AAD !== void 0) {
               cipher.setAAD(AAD);
@@ -5375,7 +5375,7 @@ var require_dist = __commonJS({
             return (0, utils_1.concatBytes)(updated, finalized);
           };
           return {
-            encrypt,
+            encrypt: encrypt2,
             decrypt: decrypt2
           };
         };
@@ -5768,13 +5768,13 @@ var require_dist = __commonJS({
         "use strict";
         Object.defineProperty(exports22, "__esModule", { value: true });
         exports22.PublicKey = exports22.PrivateKey = exports22.ECIES_CONFIG = void 0;
-        exports22.encrypt = encrypt;
+        exports22.encrypt = encrypt2;
         exports22.decrypt = decrypt2;
         var utils_1 = require_utils();
         var config_js_1 = require_config();
         var index_js_1 = require_keys();
         var index_js_2 = require_utils4();
-        function encrypt(receiverRawPK, data, config = config_js_1.ECIES_CONFIG) {
+        function encrypt2(receiverRawPK, data, config = config_js_1.ECIES_CONFIG) {
           const curve = config.ellipticCurve;
           const ephemeralSK = new index_js_1.PrivateKey(void 0, curve);
           const receiverPK = receiverRawPK instanceof Uint8Array ? new index_js_1.PublicKey(receiverRawPK, curve) : index_js_1.PublicKey.fromHex(receiverRawPK, curve);
@@ -5889,6 +5889,9 @@ var require_dist = __commonJS({
       "src/encrypted.js"(exports22, module22) {
         var PREFIX = "encrypted:";
         function encrypted2(value) {
+          if (!value) {
+            return false;
+          }
           return value.startsWith(PREFIX);
         }
         module22.exports = encrypted2;
@@ -5900,8 +5903,9 @@ var require_dist = __commonJS({
         var { decrypt: eciesDecrypt } = require_dist2();
         var Errors = require_errors();
         var encrypted2 = require_encrypted();
-        function decrypt2(privateKeyHex, encryptedValue) {
-          if (!encrypted2(encryptedValue)) {
+        function decrypt2(privateKeyHex, encryptedValue, options = {}) {
+          const value = options.prefix === false ? `${encrypted2.PREFIX}${encryptedValue}` : encryptedValue;
+          if (!encrypted2(value)) {
             return encryptedValue;
           }
           if (!privateKeyHex || privateKeyHex.length < 1) {
@@ -5909,7 +5913,7 @@ var require_dist = __commonJS({
           }
           try {
             const privateKey = Buffer.from(privateKeyHex, "hex");
-            const ciphertext = Buffer.from(encryptedValue.substring(encrypted2.PREFIX.length), "base64");
+            const ciphertext = Buffer.from(value.substring(encrypted2.PREFIX.length), "base64");
             return Buffer.from(eciesDecrypt(privateKey, ciphertext)).toString("utf8");
           } catch (e) {
             if (e.message === "Invalid private key") {
@@ -5935,6 +5939,21 @@ var require_dist = __commonJS({
         module22.exports = derive2;
       }
     });
+    var require_encrypt = __commonJS2({
+      "src/encrypt.js"(exports22, module22) {
+        var { encrypt: eciesEncrypt } = require_dist2();
+        var { PREFIX } = require_encrypted();
+        function encrypt2(publicKeyHex, value, options = {}) {
+          const ciphertext = eciesEncrypt(publicKeyHex, Buffer.from(value));
+          const encoded = Buffer.from(ciphertext, "hex").toString("base64");
+          if (options.prefix === false) {
+            return encoded;
+          }
+          return `${PREFIX}${encoded}`;
+        }
+        module22.exports = encrypt2;
+      }
+    });
     var require_evaluate = __commonJS2({
       "src/evaluate.js"(exports22, module22) {
         var { execSync } = require("child_process");
@@ -5942,9 +5961,9 @@ var require_dist = __commonJS({
         function chomp(value) {
           return value.replace(/[\r\n]+$/, "");
         }
-        function evaluate2(value, opts) {
-          const processEnv2 = opts.processEnv || process.env;
-          const runningParsed = opts.runningParsed || {};
+        function evaluate2(value, options) {
+          const processEnv2 = options.processEnv || process.env;
+          const runningParsed = options.runningParsed || {};
           const matches = value.match(/\$\(([^)]+(?:\)[^(]*)*)\)/g) || [];
           return matches.reduce((newValue, match) => {
             const command = match.slice(2, -1);
@@ -5963,11 +5982,11 @@ var require_dist = __commonJS({
     });
     var require_expand = __commonJS2({
       "src/expand.js"(exports22, module22) {
-        function expand2(value, opts) {
-          const overload = opts.overload;
-          const processEnv2 = opts.processEnv || process.env;
-          const runningParsed = opts.runningParsed || {};
-          const literals = opts.literals || {};
+        function expand2(value, options) {
+          const overload = options.overload;
+          const processEnv2 = options.processEnv || process.env;
+          const runningParsed = options.runningParsed || {};
+          const literals = options.literals || {};
           let env = { ...runningParsed, ...processEnv2 };
           if (overload) {
             env = { ...processEnv2, ...runningParsed };
@@ -6010,6 +6029,19 @@ var require_dist = __commonJS({
         module22.exports = expand2;
       }
     });
+    var require_keypair = __commonJS2({
+      "src/keypair.js"(exports22, module22) {
+        var { PrivateKey } = require_dist2();
+        function keypair2() {
+          const kp = new PrivateKey();
+          return {
+            publicKey: kp.publicKey.toHex(),
+            privateKey: Buffer.from(kp.secret).toString("hex")
+          };
+        }
+        module22.exports = keypair2;
+      }
+    });
     var require_scan = __commonJS2({
       "src/scan.js"(exports22, module22) {
         function trimmer(value) {
@@ -6038,26 +6070,33 @@ var require_dist = __commonJS({
           }
           return q;
         }
-        function clean(value, quote) {
+        function clean(value, quote, options) {
           let v = trimmer(value);
           v = v.replace(/^(['"`])([\s\S]*)\1$/mg, "$2");
-          if (quote === '"') {
+          if (quote === '"' && options.expandDoubleQuotedNewlines !== false) {
             v = v.replace(/\\n/g, "\n");
             v = v.replace(/\\r/g, "\r");
             v = v.replace(/\\t/g, "	");
           }
           return v;
         }
-        function scan2(src, transform) {
+        function scan2(src, options = {}, transform) {
+          if (typeof options === "function") {
+            transform = options;
+            options = {};
+          }
           const LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg;
           const parsed = {};
-          const lines = (src || "").toString().replace(/\r\n?/mg, "\n");
+          let lines = (src || "").toString();
+          if (options.convertWindowsNewlines !== false) {
+            lines = lines.replace(/\r\n?/mg, "\n");
+          }
           let match;
           while ((match = LINE.exec(lines)) !== null) {
             const name = match[1];
             const raw = match[2];
             const quote = getQuote(raw);
-            const value = clean(raw, quote);
+            const value = clean(raw, quote, options);
             let parsedValue = value;
             if (typeof transform === "function") {
               parsedValue = transform({
@@ -6066,7 +6105,8 @@ var require_dist = __commonJS({
                 quote
               });
             }
-            parsed[name] = parsedValue;
+            parsed[name] = parsed[name] || [];
+            parsed[name].push(parsedValue);
           }
           return {
             parsed
@@ -6084,35 +6124,57 @@ var require_dist = __commonJS({
           try {
             const src = fs2.readFileSync(filepath, "utf8");
             const { parsed } = scan2(src);
-            return parsed;
+            const result = [];
+            for (const name in parsed) {
+              if (name.startsWith("DOTENV_PRIVATE_KEY")) {
+                result.push(parsed[name][parsed[name].length - 1]);
+              }
+            }
+            return result;
           } catch (_e) {
-            return {};
+            return [];
           }
         }
-        function keyring2() {
-          const mem = {};
-          const processEnv2 = process.env;
-          const keysFilepath = ".env.keys";
-          const sources = {
-            ...keysFromFile(keysFilepath),
-            ...processEnv2
-            // process.env wins
-          };
-          for (const name in sources) {
+        function keyring2(options = {}) {
+          const ring = options.ring || {};
+          const processEnv2 = options.processEnv || process.env;
+          const keysFilepaths = Array.isArray(options.fk) ? options.fk : [options.fk || ".env.keys"];
+          const privateKeyValues = keysFilepaths.reduce((acc, filepath) => {
+            return acc.concat(keysFromFile(filepath));
+          }, []);
+          for (const name in processEnv2) {
             if (name.startsWith("DOTENV_PRIVATE_KEY")) {
-              try {
-                const privateKeyHex = sources[name];
-                const publicKeyHex = derive2(privateKeyHex);
-                mem[publicKeyHex] = privateKeyHex;
-              } catch (_e) {
-              }
+              privateKeyValues.push(processEnv2[name]);
+            }
+          }
+          for (const privateKeyHex of privateKeyValues) {
+            try {
+              const publicKeyHex = derive2(privateKeyHex);
+              ring[publicKeyHex] = privateKeyHex;
+            } catch (_e) {
             }
           }
-          return mem;
+          return ring;
         }
         module22.exports = keyring2;
       }
     });
+    var require_publickeys = __commonJS2({
+      "src/publickeys.js"(exports22, module22) {
+        var scan2 = require_scan();
+        function publickeys2(src) {
+          const { parsed } = scan2(src);
+          const result = [];
+          for (const name in parsed) {
+            if (name.startsWith("DOTENV_PUBLIC_KEY")) {
+              result.push(parsed[name][parsed[name].length - 1]);
+            }
+          }
+          return result;
+        }
+        module22.exports = publickeys2;
+      }
+    });
     var require_parse = __commonJS2({
       "src/parse.js"(exports22, module22) {
         var decrypt2 = require_decrypt();
@@ -6120,32 +6182,56 @@ var require_dist = __commonJS({
         var encrypted2 = require_encrypted();
         var evaluate2 = require_evaluate();
         var expand2 = require_expand();
+        var publickeys2 = require_publickeys();
         var scan2 = require_scan();
         function resolveEscapeSequences(value) {
           return value.replace(/\\\$/g, "$");
         }
-        function parse22(src, opts = {}) {
-          const overload = opts.overload;
-          const processEnv2 = opts.processEnv || process.env;
-          const ring = keyring2();
+        function decryptWithKeyring(ring, value, publicKeyHexes) {
+          const tried = {};
+          for (const publicKeyHex of publicKeyHexes) {
+            const privateKeyHex = ring[publicKeyHex];
+            if (!privateKeyHex) {
+              continue;
+            }
+            tried[privateKeyHex] = true;
+            try {
+              return decrypt2(privateKeyHex, value);
+            } catch (_e) {
+            }
+          }
+          for (const privateKeyHex of Object.values(ring)) {
+            if (!privateKeyHex || tried[privateKeyHex]) {
+              continue;
+            }
+            try {
+              return decrypt2(privateKeyHex, value);
+            } catch (_e) {
+            }
+          }
+          return value;
+        }
+        function parse22(src, options = {}) {
+          const overload = options.overload;
+          const processEnv2 = options.processEnv || process.env;
+          const publicKeyHexes = publickeys2(src);
+          let ring = {};
+          for (const publicKeyHex of publicKeyHexes) {
+            ring[publicKeyHex] = "";
+          }
+          ring = keyring2({ processEnv: processEnv2, ring });
           function inProcessEnv(name) {
             return Object.prototype.hasOwnProperty.call(processEnv2, name);
           }
-          let publicKeyHex;
-          let runningParsed = {};
-          let literals = {};
-          const { parsed } = scan2(src, ({ name, value, quote }) => {
+          const runningParsed = {};
+          const literals = {};
+          const parsed = {};
+          scan2(src, ({ name, value, quote }) => {
             let parsedValue = value;
-            if (name.startsWith("DOTENV_PUBLIC_KEY")) {
-              publicKeyHex = parsedValue;
-            }
             if (!overload && inProcessEnv(name)) {
               parsedValue = processEnv2[name];
             }
-            try {
-              parsedValue = decrypt2(ring[publicKeyHex], parsedValue);
-            } catch (_e) {
-            }
+            parsedValue = decryptWithKeyring(ring, parsedValue, publicKeyHexes);
             const encryptedPrefixed = encrypted2(parsedValue);
             let evaled = false;
             if (!encryptedPrefixed && quote !== "'" && (!inProcessEnv(name) || processEnv2[name] === parsedValue)) {
@@ -6165,6 +6251,7 @@ var require_dist = __commonJS({
               literals[name] = parsedValue;
             }
             runningParsed[name] = parsedValue;
+            parsed[name] = parsedValue;
             if (Object.prototype.hasOwnProperty.call(processEnv2, name) && !overload) {
             } else {
             }
@@ -6177,23 +6264,52 @@ var require_dist = __commonJS({
         module22.exports = parse22;
       }
     });
+    var require_sealed = __commonJS2({
+      "src/sealed.js"(exports22, module22) {
+        var encrypted2 = require_encrypted();
+        var scan2 = require_scan();
+        function publicKey(name) {
+          return name.startsWith("DOTENV_PUBLIC_KEY");
+        }
+        function sealed2(src) {
+          const { parsed } = scan2(src);
+          for (const [name, values] of Object.entries(parsed)) {
+            for (const value of values) {
+              if (!encrypted2(value) && !publicKey(name)) {
+                return false;
+              }
+            }
+          }
+          return true;
+        }
+        module22.exports = sealed2;
+      }
+    });
     var decrypt = require_decrypt();
     var derive = require_derive();
+    var encrypt = require_encrypt();
     var encrypted = require_encrypted();
     var evaluate = require_evaluate();
     var expand = require_expand();
+    var keypair = require_keypair();
     var keyring = require_keyring();
     var parse2 = require_parse();
+    var publickeys = require_publickeys();
     var scan = require_scan();
+    var sealed = require_sealed();
     module2.exports = {
       decrypt,
       derive,
+      encrypt,
       encrypted,
       evaluate,
       expand,
+      keypair,
       keyring,
       parse: parse2,
-      scan
+      publickeys,
+      scan,
+      sealed
     };
   }
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotenvx/next-env",
-  "version": "2.0.2",
+  "version": "2.1.0",
   "description": "dotenvx drop-in replacement for @next/env",
   "license": "BSD-3-Clause",
   "repository": {
@@ -23,7 +23,7 @@
     "prepublishOnly": "npm pack --dry-run"
   },
   "devDependencies": {
-    "@dotenvx/primitives": "0.4.0",
+    "@dotenvx/primitives": "^0.9.0",
     "esbuild": "^0.28.1"
   }
 }