@dotenvx/next-env 2.0.3 → 2.1.0

package/dist/index.cjs

@@ -5889,6 +5889,9 @@ var require_dist = __commonJS({
       "src/encrypted.js"(exports22, module22) {
         var PREFIX = "encrypted:";
         function encrypted2(value) {
+          if (!value) {
+            return false;
+          }
           return value.startsWith(PREFIX);
         }
         module22.exports = encrypted2;
@@ -5958,9 +5961,9 @@ var require_dist = __commonJS({
         function chomp(value) {
           return value.replace(/[\r\n]+$/, "");
         }
-        function evaluate2(value, opts) {
-          const processEnv2 = opts.processEnv || process.env;
-          const runningParsed = opts.runningParsed || {};
+        function evaluate2(value, options) {
+          const processEnv2 = options.processEnv || process.env;
+          const runningParsed = options.runningParsed || {};
           const matches = value.match(/\$\(([^)]+(?:\)[^(]*)*)\)/g) || [];
           return matches.reduce((newValue, match) => {
             const command = match.slice(2, -1);
@@ -5979,11 +5982,11 @@ var require_dist = __commonJS({
     });
     var require_expand = __commonJS2({
       "src/expand.js"(exports22, module22) {
-        function expand2(value, opts) {
-          const overload = opts.overload;
-          const processEnv2 = opts.processEnv || process.env;
-          const runningParsed = opts.runningParsed || {};
-          const literals = opts.literals || {};
+        function expand2(value, options) {
+          const overload = options.overload;
+          const processEnv2 = options.processEnv || process.env;
+          const runningParsed = options.runningParsed || {};
+          const literals = options.literals || {};
           let env = { ...runningParsed, ...processEnv2 };
           if (overload) {
             env = { ...processEnv2, ...runningParsed };
@@ -6026,6 +6029,19 @@ var require_dist = __commonJS({
         module22.exports = expand2;
       }
     });
+    var require_keypair = __commonJS2({
+      "src/keypair.js"(exports22, module22) {
+        var { PrivateKey } = require_dist2();
+        function keypair2() {
+          const kp = new PrivateKey();
+          return {
+            publicKey: kp.publicKey.toHex(),
+            privateKey: Buffer.from(kp.secret).toString("hex")
+          };
+        }
+        module22.exports = keypair2;
+      }
+    });
     var require_scan = __commonJS2({
       "src/scan.js"(exports22, module22) {
         function trimmer(value) {
@@ -6054,26 +6070,33 @@ var require_dist = __commonJS({
           }
           return q;
         }
-        function clean(value, quote) {
+        function clean(value, quote, options) {
           let v = trimmer(value);
           v = v.replace(/^(['"`])([\s\S]*)\1$/mg, "$2");
-          if (quote === '"') {
+          if (quote === '"' && options.expandDoubleQuotedNewlines !== false) {
             v = v.replace(/\\n/g, "\n");
             v = v.replace(/\\r/g, "\r");
             v = v.replace(/\\t/g, "	");
           }
           return v;
         }
-        function scan2(src, transform) {
+        function scan2(src, options = {}, transform) {
+          if (typeof options === "function") {
+            transform = options;
+            options = {};
+          }
           const LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg;
           const parsed = {};
-          const lines = (src || "").toString().replace(/\r\n?/mg, "\n");
+          let lines = (src || "").toString();
+          if (options.convertWindowsNewlines !== false) {
+            lines = lines.replace(/\r\n?/mg, "\n");
+          }
           let match;
           while ((match = LINE.exec(lines)) !== null) {
             const name = match[1];
             const raw = match[2];
             const quote = getQuote(raw);
-            const value = clean(raw, quote);
+            const value = clean(raw, quote, options);
             let parsedValue = value;
             if (typeof transform === "function") {
               parsedValue = transform({
@@ -6082,7 +6105,8 @@ var require_dist = __commonJS({
                 quote
               });
             }
-            parsed[name] = parsedValue;
+            parsed[name] = parsed[name] || [];
+            parsed[name].push(parsedValue);
           }
           return {
             parsed
@@ -6100,35 +6124,57 @@ var require_dist = __commonJS({
           try {
             const src = fs2.readFileSync(filepath, "utf8");
             const { parsed } = scan2(src);
-            return parsed;
+            const result = [];
+            for (const name in parsed) {
+              if (name.startsWith("DOTENV_PRIVATE_KEY")) {
+                result.push(parsed[name][parsed[name].length - 1]);
+              }
+            }
+            return result;
           } catch (_e) {
-            return {};
+            return [];
           }
         }
-        function keyring2() {
-          const mem = {};
-          const processEnv2 = process.env;
-          const keysFilepath = ".env.keys";
-          const sources = {
-            ...keysFromFile(keysFilepath),
-            ...processEnv2
-            // process.env wins
-          };
-          for (const name in sources) {
+        function keyring2(options = {}) {
+          const ring = options.ring || {};
+          const processEnv2 = options.processEnv || process.env;
+          const keysFilepaths = Array.isArray(options.fk) ? options.fk : [options.fk || ".env.keys"];
+          const privateKeyValues = keysFilepaths.reduce((acc, filepath) => {
+            return acc.concat(keysFromFile(filepath));
+          }, []);
+          for (const name in processEnv2) {
             if (name.startsWith("DOTENV_PRIVATE_KEY")) {
-              try {
-                const privateKeyHex = sources[name];
-                const publicKeyHex = derive2(privateKeyHex);
-                mem[publicKeyHex] = privateKeyHex;
-              } catch (_e) {
-              }
+              privateKeyValues.push(processEnv2[name]);
+            }
+          }
+          for (const privateKeyHex of privateKeyValues) {
+            try {
+              const publicKeyHex = derive2(privateKeyHex);
+              ring[publicKeyHex] = privateKeyHex;
+            } catch (_e) {
             }
           }
-          return mem;
+          return ring;
         }
         module22.exports = keyring2;
       }
     });
+    var require_publickeys = __commonJS2({
+      "src/publickeys.js"(exports22, module22) {
+        var scan2 = require_scan();
+        function publickeys2(src) {
+          const { parsed } = scan2(src);
+          const result = [];
+          for (const name in parsed) {
+            if (name.startsWith("DOTENV_PUBLIC_KEY")) {
+              result.push(parsed[name][parsed[name].length - 1]);
+            }
+          }
+          return result;
+        }
+        module22.exports = publickeys2;
+      }
+    });
     var require_parse = __commonJS2({
       "src/parse.js"(exports22, module22) {
         var decrypt2 = require_decrypt();
@@ -6136,32 +6182,56 @@ var require_dist = __commonJS({
         var encrypted2 = require_encrypted();
         var evaluate2 = require_evaluate();
         var expand2 = require_expand();
+        var publickeys2 = require_publickeys();
         var scan2 = require_scan();
         function resolveEscapeSequences(value) {
           return value.replace(/\\\$/g, "$");
         }
-        function parse22(src, opts = {}) {
-          const overload = opts.overload;
-          const processEnv2 = opts.processEnv || process.env;
-          const ring = keyring2();
+        function decryptWithKeyring(ring, value, publicKeyHexes) {
+          const tried = {};
+          for (const publicKeyHex of publicKeyHexes) {
+            const privateKeyHex = ring[publicKeyHex];
+            if (!privateKeyHex) {
+              continue;
+            }
+            tried[privateKeyHex] = true;
+            try {
+              return decrypt2(privateKeyHex, value);
+            } catch (_e) {
+            }
+          }
+          for (const privateKeyHex of Object.values(ring)) {
+            if (!privateKeyHex || tried[privateKeyHex]) {
+              continue;
+            }
+            try {
+              return decrypt2(privateKeyHex, value);
+            } catch (_e) {
+            }
+          }
+          return value;
+        }
+        function parse22(src, options = {}) {
+          const overload = options.overload;
+          const processEnv2 = options.processEnv || process.env;
+          const publicKeyHexes = publickeys2(src);
+          let ring = {};
+          for (const publicKeyHex of publicKeyHexes) {
+            ring[publicKeyHex] = "";
+          }
+          ring = keyring2({ processEnv: processEnv2, ring });
           function inProcessEnv(name) {
             return Object.prototype.hasOwnProperty.call(processEnv2, name);
           }
-          let publicKeyHex;
-          let runningParsed = {};
-          let literals = {};
-          const { parsed } = scan2(src, ({ name, value, quote }) => {
+          const runningParsed = {};
+          const literals = {};
+          const parsed = {};
+          scan2(src, ({ name, value, quote }) => {
             let parsedValue = value;
-            if (name.startsWith("DOTENV_PUBLIC_KEY")) {
-              publicKeyHex = parsedValue;
-            }
             if (!overload && inProcessEnv(name)) {
               parsedValue = processEnv2[name];
             }
-            try {
-              parsedValue = decrypt2(ring[publicKeyHex], parsedValue);
-            } catch (_e) {
-            }
+            parsedValue = decryptWithKeyring(ring, parsedValue, publicKeyHexes);
             const encryptedPrefixed = encrypted2(parsedValue);
             let evaled = false;
             if (!encryptedPrefixed && quote !== "'" && (!inProcessEnv(name) || processEnv2[name] === parsedValue)) {
@@ -6181,6 +6251,7 @@ var require_dist = __commonJS({
               literals[name] = parsedValue;
             }
             runningParsed[name] = parsedValue;
+            parsed[name] = parsedValue;
             if (Object.prototype.hasOwnProperty.call(processEnv2, name) && !overload) {
             } else {
             }
@@ -6193,15 +6264,39 @@ var require_dist = __commonJS({
         module22.exports = parse22;
       }
     });
+    var require_sealed = __commonJS2({
+      "src/sealed.js"(exports22, module22) {
+        var encrypted2 = require_encrypted();
+        var scan2 = require_scan();
+        function publicKey(name) {
+          return name.startsWith("DOTENV_PUBLIC_KEY");
+        }
+        function sealed2(src) {
+          const { parsed } = scan2(src);
+          for (const [name, values] of Object.entries(parsed)) {
+            for (const value of values) {
+              if (!encrypted2(value) && !publicKey(name)) {
+                return false;
+              }
+            }
+          }
+          return true;
+        }
+        module22.exports = sealed2;
+      }
+    });
     var decrypt = require_decrypt();
     var derive = require_derive();
     var encrypt = require_encrypt();
     var encrypted = require_encrypted();
     var evaluate = require_evaluate();
     var expand = require_expand();
+    var keypair = require_keypair();
     var keyring = require_keyring();
     var parse2 = require_parse();
+    var publickeys = require_publickeys();
     var scan = require_scan();
+    var sealed = require_sealed();
     module2.exports = {
       decrypt,
       derive,
@@ -6209,9 +6304,12 @@ var require_dist = __commonJS({
       encrypted,
       evaluate,
       expand,
+      keypair,
       keyring,
       parse: parse2,
-      scan
+      publickeys,
+      scan,
+      sealed
     };
   }
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotenvx/next-env",
-  "version": "2.0.3",
+  "version": "2.1.0",
   "description": "dotenvx drop-in replacement for @next/env",
   "license": "BSD-3-Clause",
   "repository": {
@@ -23,7 +23,7 @@
     "prepublishOnly": "npm pack --dry-run"
   },
   "devDependencies": {
-    "@dotenvx/primitives": "^0.6.0",
+    "@dotenvx/primitives": "^0.9.0",
     "esbuild": "^0.28.1"
   }
 }