@dotenvx/next-env 2.0.3 → 2.1.1

package/dist/index.cjs

@@ -5889,6 +5889,9 @@ var require_dist = __commonJS({
       "src/encrypted.js"(exports22, module22) {
         var PREFIX = "encrypted:";
         function encrypted2(value) {
+          if (!value) {
+            return false;
+          }
           return value.startsWith(PREFIX);
         }
         module22.exports = encrypted2;
@@ -5958,9 +5961,9 @@ var require_dist = __commonJS({
         function chomp(value) {
           return value.replace(/[\r\n]+$/, "");
         }
-        function evaluate2(value, opts) {
-          const processEnv2 = opts.processEnv || process.env;
-          const runningParsed = opts.runningParsed || {};
+        function evaluate2(value, options) {
+          const processEnv2 = options.processEnv || process.env;
+          const runningParsed = options.runningParsed || {};
           const matches = value.match(/\$\(([^)]+(?:\)[^(]*)*)\)/g) || [];
           return matches.reduce((newValue, match) => {
             const command = match.slice(2, -1);
@@ -5979,11 +5982,11 @@ var require_dist = __commonJS({
     });
     var require_expand = __commonJS2({
       "src/expand.js"(exports22, module22) {
-        function expand2(value, opts) {
-          const overload = opts.overload;
-          const processEnv2 = opts.processEnv || process.env;
-          const runningParsed = opts.runningParsed || {};
-          const literals = opts.literals || {};
+        function expand2(value, options) {
+          const overload = options.overload;
+          const processEnv2 = options.processEnv || process.env;
+          const runningParsed = options.runningParsed || {};
+          const literals = options.literals || {};
           let env = { ...runningParsed, ...processEnv2 };
           if (overload) {
             env = { ...processEnv2, ...runningParsed };
@@ -6026,6 +6029,19 @@ var require_dist = __commonJS({
         module22.exports = expand2;
       }
     });
+    var require_keypair = __commonJS2({
+      "src/keypair.js"(exports22, module22) {
+        var { PrivateKey } = require_dist2();
+        function keypair2() {
+          const kp = new PrivateKey();
+          return {
+            publicKey: kp.publicKey.toHex(),
+            privateKey: Buffer.from(kp.secret).toString("hex")
+          };
+        }
+        module22.exports = keypair2;
+      }
+    });
     var require_scan = __commonJS2({
       "src/scan.js"(exports22, module22) {
         function trimmer(value) {
@@ -6054,26 +6070,33 @@ var require_dist = __commonJS({
           }
           return q;
         }
-        function clean(value, quote) {
+        function clean(value, quote, options) {
           let v = trimmer(value);
           v = v.replace(/^(['"`])([\s\S]*)\1$/mg, "$2");
-          if (quote === '"') {
+          if (quote === '"' && options.expandDoubleQuotedNewlines !== false) {
             v = v.replace(/\\n/g, "\n");
             v = v.replace(/\\r/g, "\r");
             v = v.replace(/\\t/g, "	");
           }
           return v;
         }
-        function scan2(src, transform) {
+        function scan2(src, options = {}, transform) {
+          if (typeof options === "function") {
+            transform = options;
+            options = {};
+          }
           const LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg;
           const parsed = {};
-          const lines = (src || "").toString().replace(/\r\n?/mg, "\n");
+          let lines = (src || "").toString();
+          if (options.convertWindowsNewlines !== false) {
+            lines = lines.replace(/\r\n?/mg, "\n");
+          }
           let match;
           while ((match = LINE.exec(lines)) !== null) {
             const name = match[1];
             const raw = match[2];
             const quote = getQuote(raw);
-            const value = clean(raw, quote);
+            const value = clean(raw, quote, options);
             let parsedValue = value;
             if (typeof transform === "function") {
               parsedValue = transform({
@@ -6082,7 +6105,8 @@ var require_dist = __commonJS({
                 quote
               });
             }
-            parsed[name] = parsedValue;
+            parsed[name] = parsed[name] || [];
+            parsed[name].push(parsedValue);
           }
           return {
             parsed
@@ -6096,72 +6120,201 @@ var require_dist = __commonJS({
         var fs2 = require("fs");
         var derive2 = require_derive();
         var scan2 = require_scan();
-        function keysFromFile(filepath = ".env.keys") {
+        async function keysFromFile(filepath = ".env.keys") {
+          try {
+            const src = await fs2.promises.readFile(filepath, "utf8");
+            const { parsed } = scan2(src);
+            const result = [];
+            for (const name in parsed) {
+              if (name.startsWith("DOTENV_PRIVATE_KEY")) {
+                result.push(parsed[name][parsed[name].length - 1]);
+              }
+            }
+            return result;
+          } catch (_e) {
+            return [];
+          }
+        }
+        function keysFromFileSync(filepath = ".env.keys") {
           try {
             const src = fs2.readFileSync(filepath, "utf8");
             const { parsed } = scan2(src);
-            return parsed;
+            const result = [];
+            for (const name in parsed) {
+              if (name.startsWith("DOTENV_PRIVATE_KEY")) {
+                result.push(parsed[name][parsed[name].length - 1]);
+              }
+            }
+            return result;
           } catch (_e) {
-            return {};
+            return [];
           }
         }
-        function keyring2() {
-          const mem = {};
-          const processEnv2 = process.env;
-          const keysFilepath = ".env.keys";
-          const sources = {
-            ...keysFromFile(keysFilepath),
-            ...processEnv2
-            // process.env wins
-          };
-          for (const name in sources) {
+        async function keyring2(options = {}) {
+          const ring = options.ring || {};
+          const provider = options.provider;
+          const processEnv2 = options.processEnv || process.env;
+          const keysFilepaths = Array.isArray(options.fk) ? options.fk : [options.fk || ".env.keys"];
+          const privateKeyValues = [];
+          for (const filepath of keysFilepaths) {
+            privateKeyValues.push(...await keysFromFile(filepath));
+          }
+          for (const name in processEnv2) {
             if (name.startsWith("DOTENV_PRIVATE_KEY")) {
-              try {
-                const privateKeyHex = sources[name];
-                const publicKeyHex = derive2(privateKeyHex);
-                mem[publicKeyHex] = privateKeyHex;
-              } catch (_e) {
+              privateKeyValues.push(processEnv2[name]);
+            }
+          }
+          for (const privateKeyHex of privateKeyValues) {
+            try {
+              const publicKeyHex = derive2(privateKeyHex);
+              ring[publicKeyHex] = privateKeyHex;
+            } catch (_e) {
+            }
+          }
+          if (typeof provider === "function") {
+            for (const publicKeyHex in ring) {
+              if (ring[publicKeyHex]) {
+                continue;
+              }
+              const privateKeyHex = await provider(publicKeyHex);
+              if (privateKeyHex) {
+                ring[publicKeyHex] = privateKeyHex;
+              }
+            }
+          }
+          return ring;
+        }
+        function keyringSync2(options = {}) {
+          const ring = options.ring || {};
+          const provider = options.provider;
+          const processEnv2 = options.processEnv || process.env;
+          const keysFilepaths = Array.isArray(options.fk) ? options.fk : [options.fk || ".env.keys"];
+          const privateKeyValues = keysFilepaths.reduce((acc, filepath) => {
+            return acc.concat(keysFromFileSync(filepath));
+          }, []);
+          for (const name in processEnv2) {
+            if (name.startsWith("DOTENV_PRIVATE_KEY")) {
+              privateKeyValues.push(processEnv2[name]);
+            }
+          }
+          for (const privateKeyHex of privateKeyValues) {
+            try {
+              const publicKeyHex = derive2(privateKeyHex);
+              ring[publicKeyHex] = privateKeyHex;
+            } catch (_e) {
+            }
+          }
+          if (typeof provider === "function") {
+            for (const publicKeyHex in ring) {
+              if (ring[publicKeyHex]) {
+                continue;
+              }
+              const privateKeyHex = provider(publicKeyHex);
+              if (privateKeyHex) {
+                ring[publicKeyHex] = privateKeyHex;
               }
             }
           }
-          return mem;
+          return ring;
         }
         module22.exports = keyring2;
+        module22.exports.sync = keyringSync2;
+      }
+    });
+    var require_publickeys = __commonJS2({
+      "src/publickeys.js"(exports22, module22) {
+        var scan2 = require_scan();
+        function publickeys2(src) {
+          const { parsed } = scan2(src);
+          const result = [];
+          for (const name in parsed) {
+            if (name.startsWith("DOTENV_PUBLIC_KEY")) {
+              result.push(parsed[name][parsed[name].length - 1]);
+            }
+          }
+          return result;
+        }
+        module22.exports = publickeys2;
       }
     });
     var require_parse = __commonJS2({
       "src/parse.js"(exports22, module22) {
         var decrypt2 = require_decrypt();
         var keyring2 = require_keyring();
+        var keyringSync2 = require_keyring().sync;
         var encrypted2 = require_encrypted();
         var evaluate2 = require_evaluate();
         var expand2 = require_expand();
+        var publickeys2 = require_publickeys();
         var scan2 = require_scan();
         function resolveEscapeSequences(value) {
           return value.replace(/\\\$/g, "$");
         }
-        function parse22(src, opts = {}) {
-          const overload = opts.overload;
-          const processEnv2 = opts.processEnv || process.env;
-          const ring = keyring2();
+        function decryptWithKeyring(ring, value, publicKeyHexes) {
+          const tried = {};
+          for (const publicKeyHex of publicKeyHexes) {
+            const privateKeyHex = ring[publicKeyHex];
+            if (!privateKeyHex) {
+              continue;
+            }
+            tried[privateKeyHex] = true;
+            try {
+              return decrypt2(privateKeyHex, value);
+            } catch (_e) {
+            }
+          }
+          for (const privateKeyHex of Object.values(ring)) {
+            if (!privateKeyHex || tried[privateKeyHex]) {
+              continue;
+            }
+            try {
+              return decrypt2(privateKeyHex, value);
+            } catch (_e) {
+            }
+          }
+          return value;
+        }
+        async function parse2(src, options = {}) {
+          const { overload, processEnv: processEnv2, fk, provider, publicKeyHexes, ring: initialRing } = keyringOptions(src, options);
+          const ring = await keyring2({ processEnv: processEnv2, ring: initialRing, fk, provider });
+          return parseWithRing(src, { overload, processEnv: processEnv2, ring, publicKeyHexes });
+        }
+        function parseSync22(src, options = {}) {
+          const { overload, processEnv: processEnv2, fk, provider, publicKeyHexes, ring: initialRing } = keyringOptions(src, options);
+          const ring = keyringSync2({ processEnv: processEnv2, ring: initialRing, fk, provider });
+          return parseWithRing(src, { overload, processEnv: processEnv2, ring, publicKeyHexes });
+        }
+        function keyringOptions(src, options = {}) {
+          const overload = options.overload;
+          const processEnv2 = options.processEnv || process.env;
+          const fk = options.fk;
+          const provider = options.provider;
+          const publicKeyHexes = publickeys2(src);
+          const ring = {};
+          for (const publicKeyHex of publicKeyHexes) {
+            ring[publicKeyHex] = "";
+          }
+          return { overload, processEnv: processEnv2, fk, provider, publicKeyHexes, ring };
+        }
+        function parseWithRing(src, options = {}) {
+          const overload = options.overload;
+          const processEnv2 = options.processEnv || process.env;
+          const ring = options.ring || {};
+          const publicKeyHexes = options.publicKeyHexes || [];
           function inProcessEnv(name) {
             return Object.prototype.hasOwnProperty.call(processEnv2, name);
           }
-          let publicKeyHex;
-          let runningParsed = {};
-          let literals = {};
-          const { parsed } = scan2(src, ({ name, value, quote }) => {
+          const runningParsed = {};
+          const literals = {};
+          const parsed = {};
+          const injected = {};
+          const existed = {};
+          scan2(src, ({ name, value, quote }) => {
             let parsedValue = value;
-            if (name.startsWith("DOTENV_PUBLIC_KEY")) {
-              publicKeyHex = parsedValue;
-            }
             if (!overload && inProcessEnv(name)) {
               parsedValue = processEnv2[name];
             }
-            try {
-              parsedValue = decrypt2(ring[publicKeyHex], parsedValue);
-            } catch (_e) {
-            }
+            parsedValue = decryptWithKeyring(ring, parsedValue, publicKeyHexes);
             const encryptedPrefixed = encrypted2(parsedValue);
             let evaled = false;
             if (!encryptedPrefixed && quote !== "'" && (!inProcessEnv(name) || processEnv2[name] === parsedValue)) {
@@ -6181,16 +6334,43 @@ var require_dist = __commonJS({
               literals[name] = parsedValue;
             }
             runningParsed[name] = parsedValue;
+            parsed[name] = parsedValue;
             if (Object.prototype.hasOwnProperty.call(processEnv2, name) && !overload) {
+              existed[name] = processEnv2[name];
             } else {
+              injected[name] = parsed[name];
             }
             return parsedValue;
           });
           return {
-            parsed
+            parsed,
+            injected,
+            existed
           };
         }
-        module22.exports = parse22;
+        module22.exports = parse2;
+        module22.exports.sync = parseSync22;
+      }
+    });
+    var require_sealed = __commonJS2({
+      "src/sealed.js"(exports22, module22) {
+        var encrypted2 = require_encrypted();
+        var scan2 = require_scan();
+        function publicKey(name) {
+          return name.startsWith("DOTENV_PUBLIC_KEY");
+        }
+        function sealed2(src) {
+          const { parsed } = scan2(src);
+          for (const [name, values] of Object.entries(parsed)) {
+            for (const value of values) {
+              if (!encrypted2(value) && !publicKey(name)) {
+                return false;
+              }
+            }
+          }
+          return true;
+        }
+        module22.exports = sealed2;
       }
     });
     var decrypt = require_decrypt();
@@ -6199,9 +6379,14 @@ var require_dist = __commonJS({
     var encrypted = require_encrypted();
     var evaluate = require_evaluate();
     var expand = require_expand();
+    var keypair = require_keypair();
     var keyring = require_keyring();
-    var parse2 = require_parse();
+    var keyringSync = require_keyring().sync;
+    var parse = require_parse();
+    var parseSync2 = require_parse().sync;
+    var publickeys = require_publickeys();
     var scan = require_scan();
+    var sealed = require_sealed();
     module2.exports = {
       decrypt,
       derive,
@@ -6209,9 +6394,14 @@ var require_dist = __commonJS({
       encrypted,
       evaluate,
       expand,
+      keypair,
       keyring,
-      parse: parse2,
-      scan
+      keyringSync,
+      parse,
+      parseSync: parseSync2,
+      publickeys,
+      scan,
+      sealed
     };
   }
 });
@@ -6219,7 +6409,7 @@ var require_dist = __commonJS({
 // index.cjs
 var fs = require("fs");
 var path = require("path");
-var { parse } = require_dist();
+var { parseSync } = require_dist();
 var initialEnv;
 var combinedEnv;
 var parsedEnv;
@@ -6261,7 +6451,7 @@ function processEnv(loadedEnvFiles, dir, log = console, forceReload = false, onR
   const parsed = {};
   for (const envFile of loadedEnvFiles) {
     try {
-      const result = parse(envFile.contents);
+      const result = parseSync(envFile.contents);
       if (result.parsed && !previousLoadedEnvFiles.some(
         (item) => item.contents === envFile.contents && item.path === envFile.path
       )) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotenvx/next-env",
-  "version": "2.0.3",
+  "version": "2.1.1",
   "description": "dotenvx drop-in replacement for @next/env",
   "license": "BSD-3-Clause",
   "repository": {
@@ -23,7 +23,7 @@
     "prepublishOnly": "npm pack --dry-run"
   },
   "devDependencies": {
-    "@dotenvx/primitives": "^0.6.0",
+    "@dotenvx/primitives": "^1.0.0",
     "esbuild": "^0.28.1"
   }
 }