@envseal/core 0.1.3 → 0.1.5

package/dist/broker.d.ts

@@ -6,6 +6,7 @@ export interface BrokerOptions {
     root: string;
     prompter?: Prompter;
     onConfirm?: ExecOptions['onConfirm'];
+    onRevokeConfirm?: (keys: string[]) => Promise<boolean>;
     onApprovalNeeded?: VerifyOptions['onApprovalNeeded'];
 }
 export declare class Broker {
@@ -14,6 +15,7 @@ export declare class Broker {
     private prompterPromise;
     private readonly ticketStore;
     private readonly onConfirm;
+    private readonly onRevokeConfirm;
     private readonly onApprovalNeeded;
     private readonly salt;
     constructor(opts: BrokerOptions);

package/dist/broker.js

@@ -1,5 +1,6 @@
 import { createHmac } from 'node:crypto';
 import { SepError, isSepError, zero } from '@envseal/protocol';
+import { compileSafePattern } from './pattern.js';
 import { getProvider, findKey } from '@envseal/registry';
 import { selectPrompter } from '@envseal/prompters';
 import { projectPaths, loadOrCreateSalt } from './paths.js';
@@ -39,12 +40,14 @@ export class Broker {
     prompterPromise;
     ticketStore;
     onConfirm;
+    onRevokeConfirm;
     onApprovalNeeded;
     salt;
     constructor(opts) {
         this.paths = projectPaths(opts.root);
         this.ticketStore = new TicketStore();
         this.onConfirm = opts.onConfirm;
+        this.onRevokeConfirm = opts.onRevokeConfirm;
         this.onApprovalNeeded = opts.onApprovalNeeded;
         this.salt = loadOrCreateSalt(this.paths);
         this.prompter = opts.prompter ?? null;
@@ -90,7 +93,7 @@ export class Broker {
                 if (formatValid === null) {
                     const trusted = findKey(entry.key)?.key.format?.pattern;
                     if (trusted !== undefined) {
-                        formatValid = new RegExp(trusted).test(value.toString('utf8'));
+                        formatValid = compileSafePattern(trusted).test(value.toString('utf8'));
                     }
                 }
             }
@@ -269,7 +272,7 @@ export class Broker {
                 }
                 if (result.outcome === 'entered') {
                     if (entry.format?.pattern) {
-                        const pattern = new RegExp(entry.format.pattern);
+                        const pattern = compileSafePattern(entry.format.pattern);
                         const valueStr = result.value.toString('utf8');
                         if (!pattern.test(valueStr)) {
                             this.ticketStore.setOutcome(ticketId, result.key, 'invalid_format');
@@ -385,16 +388,30 @@ export class Broker {
     }
     async use(input) {
         const manifest = loadManifest(this.paths) ?? emptyManifest();
+        const declaredKeys = new Set(manifest.entries.map((e) => e.key));
+        for (const keyName of input.keys) {
+            if (!declaredKeys.has(keyName)) {
+                throw new SepError({ code: 'SEP_NOT_DECLARED' });
+            }
+        }
         const secrets = new Map();
+        const missing = [];
         for (const keyName of input.keys) {
             const entry = manifest.entries.find((e) => e.key === keyName);
-            if (!entry)
-                continue;
             const sink = getSink(entry.sink ?? 'dotenv');
             const value = await sink.read(this.paths, keyName);
             if (value) {
                 secrets.set(keyName, value);
             }
+            else {
+                missing.push(keyName);
+            }
+        }
+        if (missing.length > 0) {
+            throw new SepError({
+                code: 'SEP_KEYS_MISSING',
+                userMessage: `Missing stored values for: ${missing.join(', ')}. Declare and store them before use.`,
+            });
         }
         const result = await runWithSecrets(input.command, secrets, {
             onConfirm: this.onConfirm,
@@ -405,6 +422,13 @@ export class Broker {
         return result;
     }
     async revoke(input) {
+        if (!this.onRevokeConfirm) {
+            throw new SepError({ code: 'SEP_CONFIRMATION_DENIED' });
+        }
+        const confirmed = await this.onRevokeConfirm(input.keys);
+        if (!confirmed) {
+            throw new SepError({ code: 'SEP_CONFIRMATION_DENIED' });
+        }
         const manifest = loadManifest(this.paths) ?? emptyManifest();
         const results = [];
         for (const keyName of input.keys) {

package/dist/display.d.ts

@@ -28,4 +28,9 @@ export declare function useConfirmationBody(info: {
     networkEgress: boolean;
     target?: import('./exec.js').TargetInfo;
 }, projectRoot: string): string;
+/**
+ * The full `env_revoke` approval dialog: project and key names only — never
+ * values. Every binding renders exactly this.
+ */
+export declare function revokeConfirmationBody(keys: string[], projectRoot: string): string;
 //# sourceMappingURL=display.d.ts.map

package/dist/display.js

@@ -95,4 +95,19 @@ export function useConfirmationBody(info, projectRoot) {
     lines.push('', 'Type yes to approve, or submit an empty box to deny. Nothing runs unless you approve.');
     return lines.join('\\n');
 }
+/**
+ * The full `env_revoke` approval dialog: project and key names only — never
+ * values. Every binding renders exactly this.
+ */
+export function revokeConfirmationBody(keys, projectRoot) {
+    const lines = [
+        'EnvSeal is about to remove these stored credentials.',
+        '',
+        `  project: ${escapeForDisplay(projectRoot)}`,
+        `  keys:    ${keys.length > 0 ? keys.map(escapeForDisplay).join(', ') : '(none)'}`,
+        '',
+        'Type yes to approve, or submit an empty box to deny. Nothing is removed unless you approve.',
+    ];
+    return lines.join('\\n');
+}
 //# sourceMappingURL=display.js.map

package/dist/guard.d.ts

@@ -61,6 +61,7 @@ export declare function scanText(path: string, text: string, tier: GuardTier): S
  * not scanned.
  */
 export declare function scanManifestEntry(entry: ManifestEntry, basePath: string): SecretFinding | null;
+export declare function secretInManifestFileError(finding: SecretFinding): SepError;
 export declare function secretInDeclarationError(finding: SecretFinding): SepError;
 export declare function secretInRequestError(finding: SecretFinding): SepError;
 //# sourceMappingURL=guard.d.ts.map

package/dist/guard.js

@@ -133,6 +133,14 @@ export function scanManifestEntry(entry, basePath) {
     }
     return findings.find((finding) => finding !== null) ?? null;
 }
+export function secretInManifestFileError(finding) {
+    return new SepError({
+        code: 'SEP_VALUE_IN_REQUEST',
+        userMessage: `Refusing to load manifest: ${finding.path} contains secret-shaped text (${finding.label}). ` +
+            'Remove any credential from comments or other non-schema text before continuing.',
+        details: { field: finding.path, detected: finding.label, confidence: finding.confidence },
+    });
+}
 export function secretInDeclarationError(finding) {
     return new SepError({
         code: 'SEP_VALUE_IN_REQUEST',

package/dist/index.d.ts

@@ -6,8 +6,10 @@ export * from './redact.js';
 export * from './tickets.js';
 export * from './audit.js';
 export * from './sinks/types.js';
-export { parseDotenv, serializeDotenv, readDotenv, setDotenvValue, removeDotenvKey, DotenvSink, } from './sinks/dotenv.js';
-export type { DotenvLine, ParsedDotenv, WriteDotenvOptions } from './sinks/dotenv.js';
+export { parseDotenv, serializeDotenv, readDotenv, setDotenvValue, removeDotenvKey, DotenvSink, inspectDotenvGitSafety, } from './sinks/dotenv.js';
+export type { DotenvLine, ParsedDotenv, WriteDotenvOptions, DotenvGitSafety } from './sinks/dotenv.js';
+export { compileSafePattern } from './pattern.js';
+export { buildDarwinWriteArgs } from './sinks/keychain.js';
 export * from './approvals.js';
 export * from './verify.js';
 export * from './exec.js';

package/dist/index.js

@@ -6,7 +6,9 @@ export * from './redact.js';
 export * from './tickets.js';
 export * from './audit.js';
 export * from './sinks/types.js';
-export { parseDotenv, serializeDotenv, readDotenv, setDotenvValue, removeDotenvKey, DotenvSink, } from './sinks/dotenv.js';
+export { parseDotenv, serializeDotenv, readDotenv, setDotenvValue, removeDotenvKey, DotenvSink, inspectDotenvGitSafety, } from './sinks/dotenv.js';
+export { compileSafePattern } from './pattern.js';
+export { buildDarwinWriteArgs } from './sinks/keychain.js';
 export * from './approvals.js';
 export * from './verify.js';
 export * from './exec.js';

package/dist/manifest.js

@@ -3,7 +3,7 @@ import { isDeepStrictEqual } from 'node:util';
 import * as jsonc from 'jsonc-parser';
 import { DeclareResult, Manifest, ManifestEntry, SepError } from '@envseal/protocol';
 import { appendAudit } from './audit.js';
-import { scanManifestEntry, secretInDeclarationError } from './guard.js';
+import { scanText, scanManifestEntry, secretInDeclarationError, secretInManifestFileError } from './guard.js';
 export function emptyManifest() {
     return { version: 1, entries: [] };
 }
@@ -39,6 +39,15 @@ export function loadManifest(paths) {
     const text = readFileIfPresent(paths.manifest);
     if (text === null)
         return null;
+    const rawFinding = scanText('manifest', text, 'strict');
+    if (rawFinding !== null) {
+        appendAudit(paths, {
+            type: 'blocked',
+            reason: 'secret_in_declaration',
+            detail: `${rawFinding.path}: ${rawFinding.label}`,
+        });
+        throw secretInManifestFileError(rawFinding);
+    }
     const errors = [];
     const value = jsonc.parse(text, errors, {
         disallowComments: false,

package/dist/pattern.d.ts

@@ -0,0 +1,3 @@
+/** Compile a manifest format.pattern after the protocol's linearish safety check. */
+export declare function compileSafePattern(pattern: string): RegExp;
+//# sourceMappingURL=pattern.d.ts.map

package/dist/pattern.js

@@ -0,0 +1,14 @@
+import { isLinearishRegex, SepError } from '@envseal/protocol';
+/** Compile a manifest format.pattern after the protocol's linearish safety check. */
+export function compileSafePattern(pattern) {
+    if (!isLinearishRegex(pattern)) {
+        throw new SepError({ code: 'SEP_PATTERN_UNSAFE' });
+    }
+    try {
+        return new RegExp(pattern);
+    }
+    catch {
+        throw new SepError({ code: 'SEP_PATTERN_UNSAFE' });
+    }
+}
+//# sourceMappingURL=pattern.js.map

package/dist/sinks/dotenv.d.ts

@@ -36,6 +36,12 @@ export interface ParsedDotenv {
 export declare function unsafeSecretToUtf8(value: SecretValue): string;
 export declare function parseDotenv(text: string): ParsedDotenv;
 export declare function serializeDotenv(parsed: ParsedDotenv): string;
+export interface DotenvGitSafety {
+    insideGit: boolean;
+    tracked: boolean;
+    ignored: boolean;
+}
+export declare function inspectDotenvGitSafety(paths: ProjectPaths): DotenvGitSafety;
 export interface WriteDotenvOptions {
     allowUnsafe?: boolean;
     description?: string;

package/dist/sinks/dotenv.js

@@ -239,6 +239,9 @@ function atomicWrite(paths, target, content) {
 function renameOverwrite(tmp, target) {
     try {
         withTransientRetry(() => renameSync(tmp, target));
+        if (isPosix) {
+            chmodSync(target, 0o600);
+        }
     }
     catch (error) {
         try {
@@ -279,18 +282,60 @@ function runGit(cwd, args) {
         return typeof status === 'number' ? status : 1;
     }
 }
+function readGitignoreLines(root) {
+    try {
+        return readFileSync(join(root, '.gitignore'), 'utf8').split(/\r\n|\n|\r/);
+    }
+    catch {
+        return [];
+    }
+}
+/** Whether a single .gitignore line would ignore the project `.env` file. */
+function gitignoreLineCoversDotenv(line) {
+    let trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith('!')) {
+        return false;
+    }
+    trimmed = trimmed.replace(/\/+$/, '');
+    if (trimmed === '.env' || trimmed === '.env*' || trimmed.startsWith('.env*')) {
+        return true;
+    }
+    if (trimmed === '**/.env' || trimmed.endsWith('/.env')) {
+        return true;
+    }
+    if (trimmed === '**/.env*' || trimmed.endsWith('/.env*')) {
+        return true;
+    }
+    return /(^|\/)\.env(\*|$)/.test(trimmed);
+}
+function dotenvCoveredByGitignore(root) {
+    return readGitignoreLines(root).some(gitignoreLineCoversDotenv);
+}
+export function inspectDotenvGitSafety(paths) {
+    const insideGit = runGit(paths.root, ['rev-parse', '--is-inside-work-tree']) === 0;
+    if (!insideGit) {
+        return {
+            insideGit: false,
+            tracked: false,
+            ignored: dotenvCoveredByGitignore(paths.root),
+        };
+    }
+    const relPath = relative(paths.root, paths.dotenv);
+    const tracked = runGit(paths.root, ['ls-files', '--error-unmatch', '--', relPath]) === 0;
+    const ignored = runGit(paths.root, ['check-ignore', '-q', relPath]) === 0;
+    return { insideGit, tracked, ignored };
+}
 function assertGitSafe(paths, allowUnsafe) {
     if (allowUnsafe)
         return;
-    if (runGit(paths.root, ['rev-parse', '--is-inside-work-tree']) !== 0)
+    const status = inspectDotenvGitSafety(paths);
+    if (status.insideGit) {
+        if (status.tracked || !status.ignored) {
+            throw new SepError({ code: 'SEP_GITIGNORE_UNSAFE' });
+        }
         return;
-    const relPath = relative(paths.root, paths.dotenv);
-    const tracked = runGit(paths.root, ['ls-files', '--error-unmatch', '--', relPath]) === 0;
-    if (tracked) {
-        throw new SepError({ code: 'SEP_GITIGNORE_UNSAFE' });
     }
-    const ignored = runGit(paths.root, ['check-ignore', '-q', relPath]) === 0;
-    if (!ignored) {
+    if (!status.ignored) {
         throw new SepError({ code: 'SEP_GITIGNORE_UNSAFE' });
     }
 }

package/dist/sinks/keychain.d.ts

@@ -1,6 +1,13 @@
 import type { SecretValue } from '@envseal/protocol';
 import type { ProjectPaths } from '../paths.js';
 import type { Sink } from './types.js';
+/**
+ * Args for `security add-generic-password`. `security(1)` has no documented
+ * non-interactive stdin password path: omitting `-w` stores an empty secret
+ * (verified on macos-latest). The password therefore appears on argv for the
+ * lifetime of the spawn — residual-risks.md §2.
+ */
+export declare function buildDarwinWriteArgs(account: string, secret: string): string[];
 declare class KeychainSink implements Sink {
     readonly id = "keychain";
     available(): Promise<boolean>;

package/dist/sinks/keychain.js

@@ -44,6 +44,15 @@ function execCommand(file, args, input, env) {
         }
     });
 }
+/**
+ * Args for `security add-generic-password`. `security(1)` has no documented
+ * non-interactive stdin password path: omitting `-w` stores an empty secret
+ * (verified on macos-latest). The password therefore appears on argv for the
+ * lifetime of the spawn — residual-risks.md §2.
+ */
+export function buildDarwinWriteArgs(account, secret) {
+    return ['add-generic-password', '-U', '-s', 'envseal', '-a', account, '-w', secret];
+}
 function exitCodeOf(error) {
     return error?.exitCode;
 }
@@ -241,16 +250,7 @@ class KeychainSink {
         const account = accountFor(_paths, key);
         const valueStr = unsafeSecretToUtf8(value);
         if (process.platform === 'darwin') {
-            await execCommand('security', [
-                'add-generic-password',
-                '-U',
-                '-s',
-                'envseal',
-                '-a',
-                account,
-                '-w',
-                valueStr,
-            ]);
+            await execCommand('security', buildDarwinWriteArgs(account, valueStr));
         }
         else if (process.platform === 'win32') {
             const dir = windowsCredsDir();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envseal/core",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "type": "module",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
@@ -22,10 +22,10 @@
   "dependencies": {
     "jsonc-parser": "^3.3.1",
     "ulid": "^2.3.0",
-    "@envseal/protocol": "0.1.3",
-    "@envseal/registry": "0.1.3",
-    "@envseal/detector": "0.1.3",
-    "@envseal/prompters": "0.1.3"
+    "@envseal/protocol": "0.1.5",
+    "@envseal/detector": "0.1.5",
+    "@envseal/registry": "0.1.5",
+    "@envseal/prompters": "0.1.5"
   },
   "devDependencies": {
     "fast-check": "^3.23.1"