@expo/env 2.3.1-canary-20260624-9d83b81 → 2.4.0

package/build/constants.js

@@ -1,262 +1,274 @@
 "use strict";
+
 Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-0 && (module.exports = {
-    isIgnoredEnvKey: null,
-    isLocalEnvKey: null,
-    isUnsafeAllowedEnvKey: null
-});
-function _export(target, all) {
-    for(var name in all)Object.defineProperty(target, name, {
-        enumerable: true,
-        get: Object.getOwnPropertyDescriptor(all, name).get
-    });
-}
-_export(exports, {
-    get isIgnoredEnvKey () {
-        return isIgnoredEnvKey;
-    },
-    get isLocalEnvKey () {
-        return isLocalEnvKey;
-    },
-    get isUnsafeAllowedEnvKey () {
-        return isUnsafeAllowedEnvKey;
-    }
+  value: true
 });
-function _nodeos() {
-    const data = /*#__PURE__*/ _interop_require_default(require("node:os"));
-    _nodeos = function() {
-        return data;
-    };
+exports.isIgnoredEnvKey = isIgnoredEnvKey;
+exports.isLocalEnvKey = isLocalEnvKey;
+exports.isUnsafeAllowedEnvKey = isUnsafeAllowedEnvKey;
+function _nodeOs() {
+  const data = _interopRequireDefault(require("node:os"));
+  _nodeOs = function () {
     return data;
+  };
+  return data;
 }
-function _interop_require_default(obj) {
-    return obj && obj.__esModule ? obj : {
-        default: obj
-    };
-}
-const platform = _nodeos().default.platform();
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const platform = _nodeOs().default.platform();
+
 // WARN(@kitten): We don't read this dynamically to ignore later modifications to this env var
-const safeKeys = new Set(process.env.EXPO_UNSAFE_DOTENV_KEYS?.split(',').filter((x)=>!!x));
+const safeKeys = new Set(process.env.EXPO_UNSAFE_DOTENV_KEYS?.split(',').filter(x => !!x));
 function isUnsafeAllowedEnvKey(name) {
-    return safeKeys.has(name);
+  return safeKeys.has(name);
 }
 function isIgnoredEnvKey(name) {
-    if (platform === 'darwin' && name.startsWith('DYLD_')) {
-        return true;
-    } else if (platform === 'linux' && name.startsWith('LD_')) {
-        return true;
-    } else if (safeKeys.has(name)) {
-        return false;
-    }
-    // NOTE(@kitten): Per-developer tool roots (ANDROID_HOME, JDK_HOME, DEVELOPER_DIR,
-    // npm/pnpm/yarn/bun paths, etc) are not blocked here — see `isLocalEnvKey`, which
-    // restricts them to `.local` env files (gitignored by convention) so committed
-    // `.env*` files cannot redirect them.
-    switch(name){
-        // NOTE: Expo internal env vars
-        case '__EXPO_ENV_LOADED':
-        case 'EXPO_NO_DOTENV':
-        case 'EXPO_UNSAFE_DOTENV_KEYS':
-            return true;
-        // Linux dynamic-loader, can cause inconsistent calls
-        case 'LD_PRELOAD':
-        case 'LD_LIBRARY_PATH':
-        case 'LD_AUDIT':
-            return true;
-        // macOS dynamic-loader, can cause inconsistent calls
-        case 'DYLD_INSERT_LIBRARIES':
-        case 'DYLD_LIBRARY_PATH':
-        case 'DYLD_FRAMEWORK_PATH':
-        case 'DYLD_FALLBACK_LIBRARY_PATH':
-        case 'DYLD_FALLBACK_FRAMEWORK_PATH':
-            return true;
-        // OpenSSL
-        case 'SSLKEYLOGFILE':
-            return true;
-        // Changes Node behaviour and shouldn't be set in dotenv
-        case 'NODE_PATH':
-        case 'NODE_OPTIONS':
-        case 'NODE_EXTRA_CA_CERTS':
-        case 'NODE_TLS_REJECT_UNAUTHORIZED':
-        case 'NODE_COMPILE_CACHE':
-        case 'NPM_CONFIG_NODE_OPTIONS':
-        case 'NODE_REPL_EXTERNAL_MODULE':
-            return true;
-        // Changes Bun behaviour and shouldn't be set in dotenv
-        case 'BUN_RUNTIME_TRANSPILER_CACHE_PATH':
-            return true;
-        // Shell startup hooks
-        case 'BASH_ENV':
-        case 'ENV':
-        case 'ZDOTDIR':
-        case 'IFS':
-        case 'CDPATH':
-        case 'PROMPT_COMMAND':
-        case 'SHELLOPTS':
-        case 'BASHOPTS':
-            return true;
-        // Special git/ssh/gpg args
-        case 'GIT_SSH':
-        case 'GIT_SSH_COMMAND':
-        case 'GPG_TTY':
-        case 'SSH_ASKPASS':
-        case 'GIT_ASKPASS':
-        case 'GIT_EXEC_PATH':
-            return true;
-        // Perl libs
-        case 'PERL5OPT':
-        case 'PERL5LIB':
-        case 'PERLLIB':
-            return true;
-        // Python modules
-        case 'PYTHONSTARTUP':
-        case 'PYTHONPATH':
-        case 'PYTHONHOME':
-        case 'PYTHONINSPECT':
-        case 'PYTHONUSERBASE':
-        case 'PYTHONEXECUTABLE':
-        case 'PYTHONSAFEPATH':
-        case 'PYTJONNOUSERSITE':
-            return true;
-        // Ruby libs
-        case 'RUBYOPT':
-        case 'RUBYLIB':
-        case 'BUNDLE_GEMFILE':
-        case 'RUBYSHELL':
-        case 'RUBYPATH':
-        case 'GEM_HOME':
-        case 'GEM_PATH':
-        case 'BUNDLE_PATH':
-            return true;
-        // Java vars
-        case '_JAVA_OPTIONS':
-        case 'JAVA_TOOL_OPTIONS':
-        case 'JDK_JAVA_OPTIONS':
-        case 'CLASSPATH':
-            return true;
-        // User env vars
-        case 'HOME':
-        case 'USERPROFILE':
-        case 'HOMEDRIVE':
-        case 'HOMEPATH':
-        case 'TMPDIR':
-        case 'TMP':
-        case 'TEMP':
-        case 'USER':
-        case 'SHELL':
-        case 'PATH':
-        case 'PATHEXT':
-        case 'LANG':
-        case 'PWD':
-        case 'OLDPWD':
-        case 'TERMINFO':
-            return true;
-        // Windows-owned
-        case 'SYSTEMROOT':
-        case 'SystemRoot':
-            return true;
-        // User tools
-        case 'EDITOR':
-        case 'VISUAL':
-        case 'PAGER':
-        case 'MANPAGER':
-            return true;
-        // XDG dirs
-        case 'XDG_RUNTIME_DIR':
-        case 'XDG_STATE_HOME':
-        case 'XDG_DATA_HOME':
-        case 'XDG_CONFIG_DIRS':
-        case 'XDG_CACHE_HOME':
-        case 'XDG_CONFIG_HOME':
-        case 'XDG_BIN_HOME':
-            return true;
-        // direnv
-        case 'DIRENV_DIR':
-        case 'DIRENV_FILE':
-        case 'DIRENV_WATCHES':
-        case 'DIRENV_DIFF':
-            return true;
-        // Package-manager registry/install roots. No legitimate per-project `.env`
-        // use case — the established mechanism for each is a dedicated config file
-        // (`.npmrc`, `.yarnrc.yml`, `.bunfig.toml`) — and a malicious value is a
-        // supply-chain RCE the moment the CLI shells out to npm/yarn/pnpm/bun.
-        case 'NPM_CONFIG_REGISTRY':
-        case 'NPM_CONFIG_PREFIX':
-        case 'NPM_CONFIG_USERCONFIG':
-        case 'NPM_CONFIG_GLOBALCONFIG':
-        case 'NPM_CONFIG_CACHE':
-        case 'YARN_REGISTRY':
-        case 'YARN_CACHE_FOLDER':
-        case 'YARN_GLOBAL_FOLDER':
-        case 'PNPM_HOME':
-        case 'BUN_INSTALL':
-        case 'BUN_INSTALL_BIN':
-        case 'COCOAPODS_HOME':
-        case 'CMAKE_HOME':
-            return true;
-        default:
-            return false;
-    }
+  if (platform === 'darwin' && name.startsWith('DYLD_')) {
+    return true;
+  } else if (platform === 'linux' && name.startsWith('LD_')) {
+    return true;
+  } else if (safeKeys.has(name)) {
+    return false;
+  }
+
+  // NOTE(@kitten): Per-developer tool roots (ANDROID_HOME, JDK_HOME, DEVELOPER_DIR,
+  // npm/pnpm/yarn/bun paths, etc) are not blocked here — see `isLocalEnvKey`, which
+  // restricts them to `.local` env files (gitignored by convention) so committed
+  // `.env*` files cannot redirect them.
+  switch (name) {
+    // NOTE: Expo internal env vars
+    case '__EXPO_ENV_LOADED':
+    case 'EXPO_NO_DOTENV':
+    case 'EXPO_UNSAFE_DOTENV_KEYS':
+      return true;
+
+    // Linux dynamic-loader, can cause inconsistent calls
+    case 'LD_PRELOAD':
+    case 'LD_LIBRARY_PATH':
+    case 'LD_AUDIT':
+      return true;
+
+    // macOS dynamic-loader, can cause inconsistent calls
+    case 'DYLD_INSERT_LIBRARIES':
+    case 'DYLD_LIBRARY_PATH':
+    case 'DYLD_FRAMEWORK_PATH':
+    case 'DYLD_FALLBACK_LIBRARY_PATH':
+    case 'DYLD_FALLBACK_FRAMEWORK_PATH':
+      return true;
+
+    // OpenSSL
+    case 'SSLKEYLOGFILE':
+      return true;
+
+    // Changes Node behaviour and shouldn't be set in dotenv
+    case 'NODE_PATH':
+    case 'NODE_OPTIONS':
+    case 'NODE_EXTRA_CA_CERTS':
+    case 'NODE_TLS_REJECT_UNAUTHORIZED':
+    case 'NODE_COMPILE_CACHE':
+    case 'NPM_CONFIG_NODE_OPTIONS':
+    case 'NODE_REPL_EXTERNAL_MODULE':
+      return true;
+
+    // Changes Bun behaviour and shouldn't be set in dotenv
+    case 'BUN_RUNTIME_TRANSPILER_CACHE_PATH':
+      return true;
+
+    // Shell startup hooks
+    case 'BASH_ENV':
+    case 'ENV':
+    case 'ZDOTDIR':
+    case 'IFS':
+    case 'CDPATH':
+    case 'PROMPT_COMMAND':
+    case 'SHELLOPTS':
+    case 'BASHOPTS':
+      return true;
+
+    // Special git/ssh/gpg args
+    case 'GIT_SSH':
+    case 'GIT_SSH_COMMAND':
+    case 'GPG_TTY':
+    case 'SSH_ASKPASS':
+    case 'GIT_ASKPASS':
+    case 'GIT_EXEC_PATH':
+      return true;
+
+    // Perl libs
+    case 'PERL5OPT':
+    case 'PERL5LIB':
+    case 'PERLLIB':
+      return true;
+
+    // Python modules
+    case 'PYTHONSTARTUP':
+    case 'PYTHONPATH':
+    case 'PYTHONHOME':
+    case 'PYTHONINSPECT':
+    case 'PYTHONUSERBASE':
+    case 'PYTHONEXECUTABLE':
+    case 'PYTHONSAFEPATH':
+    case 'PYTJONNOUSERSITE':
+      return true;
+
+    // Ruby libs
+    case 'RUBYOPT':
+    case 'RUBYLIB':
+    case 'BUNDLE_GEMFILE':
+    case 'RUBYSHELL':
+    case 'RUBYPATH':
+    case 'GEM_HOME':
+    case 'GEM_PATH':
+    case 'BUNDLE_PATH':
+      return true;
+
+    // Java vars
+    case '_JAVA_OPTIONS':
+    case 'JAVA_TOOL_OPTIONS':
+    case 'JDK_JAVA_OPTIONS':
+    case 'CLASSPATH':
+      return true;
+
+    // User env vars
+    case 'HOME':
+    case 'USERPROFILE':
+    case 'HOMEDRIVE':
+    case 'HOMEPATH':
+    case 'TMPDIR':
+    case 'TMP':
+    case 'TEMP':
+    case 'USER':
+    case 'SHELL':
+    case 'PATH':
+    case 'PATHEXT':
+    case 'LANG':
+    case 'PWD':
+    case 'OLDPWD':
+    case 'TERMINFO':
+      return true;
+
+    // Windows-owned
+    case 'SYSTEMROOT':
+    case 'SystemRoot':
+      return true;
+
+    // User tools
+    case 'EDITOR':
+    case 'VISUAL':
+    case 'PAGER':
+    case 'MANPAGER':
+      return true;
+
+    // XDG dirs
+    case 'XDG_RUNTIME_DIR':
+    case 'XDG_STATE_HOME':
+    case 'XDG_DATA_HOME':
+    case 'XDG_CONFIG_DIRS':
+    case 'XDG_CACHE_HOME':
+    case 'XDG_CONFIG_HOME':
+    case 'XDG_BIN_HOME':
+      return true;
+
+    // direnv
+    case 'DIRENV_DIR':
+    case 'DIRENV_FILE':
+    case 'DIRENV_WATCHES':
+    case 'DIRENV_DIFF':
+      return true;
+
+    // Package-manager registry/install roots. No legitimate per-project `.env`
+    // use case — the established mechanism for each is a dedicated config file
+    // (`.npmrc`, `.yarnrc.yml`, `.bunfig.toml`) — and a malicious value is a
+    // supply-chain RCE the moment the CLI shells out to npm/yarn/pnpm/bun.
+    case 'NPM_CONFIG_REGISTRY':
+    case 'NPM_CONFIG_PREFIX':
+    case 'NPM_CONFIG_USERCONFIG':
+    case 'NPM_CONFIG_GLOBALCONFIG':
+    case 'NPM_CONFIG_CACHE':
+    case 'YARN_REGISTRY':
+    case 'YARN_CACHE_FOLDER':
+    case 'YARN_GLOBAL_FOLDER':
+    case 'PNPM_HOME':
+    case 'BUN_INSTALL':
+    case 'BUN_INSTALL_BIN':
+    case 'COCOAPODS_HOME':
+    case 'CMAKE_HOME':
+      return true;
+    default:
+      return false;
+  }
 }
+
+/**
+ * Whether a dotenv key represents per-developer/per-machine configuration that
+ * should only be loaded from `.local` env files (e.g. `.env.local`,
+ * `.env.development.local`). Committed `.env*` files cannot set these — that
+ * prevents a malicious project from redirecting developer-tool roots (e.g.
+ * `ANDROID_HOME`) via a supply-chain attack, while still letting developers
+ * pin them in their gitignored `.local` overrides.
+ *
+ * Honors `EXPO_UNSAFE_DOTENV_KEYS`: opt-in keys are allowed in any env file.
+ */
 function isLocalEnvKey(name) {
-    if (safeKeys.has(name)) return false;
-    switch(name){
-        // Android tooling
-        case 'ANDROID_HOME':
-        case 'ANDROID_SDK_ROOT':
-        case 'ANDROID_NDK_HOME':
-        case 'ANDROID_NDK_ROOT':
-        case 'ANDROID_AVD_HOME':
-        case 'ANDROID_EMULATOR_HOME':
-        case 'GRADLE_HOME':
-        case 'GRADLE_USER_HOME':
-        case 'KOTLIN_HOME':
-            return true;
-        // JVM tooling
-        case 'JAVA_HOME':
-        case 'JDK_HOME':
-        case 'JRE_HOME':
-            return true;
-        // Apple tooling
-        case 'DEVELOPER_DIR':
-        case 'XCODE_DEVELOPER_DIR_PATH':
-            return true;
-        // CocoaPods / Fastlane (secrets and non-exec config)
-        case 'COCOAPODS_DISABLE_STATS':
-        case 'FASTLANE_USER':
-        case 'FASTLANE_PASSWORD':
-        case 'FASTLANE_SESSION':
-        case 'FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD':
-            return true;
-        // Android NDK (per-project NDK version pinning is common)
-        case 'NDK_HOME':
-        case 'NDK_ROOT':
-            return true;
-        // Per-developer preferences and per-machine setup
-        case 'BROWSER':
-        case 'BROWSER_ARGS':
-        case 'HTTP_PROXY':
-        case 'http_proxy':
-        case 'HTTPS_PROXY':
-        case 'https_proxy':
-        case 'ALL_PROXY':
-        case 'all_proxy':
-        case 'NO_PROXY':
-        case 'no_proxy':
-        case 'FTP_PROXY':
-        case 'ftp_proxy':
-        case 'SSL_CRT_FILE':
-        case 'SSL_KEY_FILE':
-        case 'REACT_NATIVE_PACKAGER_HOSTNAME':
-            return true;
-        // NOTE(@kitten): Used to override where hermesc is found, not safe to read from .env
-        case 'REACT_NATIVE_OVERRIDE_HERMES_DIR':
-            return true;
-        default:
-            return false;
-    }
-}
+  if (safeKeys.has(name)) return false;
+  switch (name) {
+    // Android tooling
+    case 'ANDROID_HOME':
+    case 'ANDROID_SDK_ROOT':
+    case 'ANDROID_NDK_HOME':
+    case 'ANDROID_NDK_ROOT':
+    case 'ANDROID_AVD_HOME':
+    case 'ANDROID_EMULATOR_HOME':
+    case 'GRADLE_HOME':
+    case 'GRADLE_USER_HOME':
+    case 'KOTLIN_HOME':
+      return true;
+
+    // JVM tooling
+    case 'JAVA_HOME':
+    case 'JDK_HOME':
+    case 'JRE_HOME':
+      return true;
+
+    // Apple tooling
+    case 'DEVELOPER_DIR':
+    case 'XCODE_DEVELOPER_DIR_PATH':
+      return true;
 
-//# sourceMappingURL=constants.js.map
+    // CocoaPods / Fastlane (secrets and non-exec config)
+    case 'COCOAPODS_DISABLE_STATS':
+    case 'FASTLANE_USER':
+    case 'FASTLANE_PASSWORD':
+    case 'FASTLANE_SESSION':
+    case 'FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD':
+      return true;
+
+    // Android NDK (per-project NDK version pinning is common)
+    case 'NDK_HOME':
+    case 'NDK_ROOT':
+      return true;
+
+    // Per-developer preferences and per-machine setup
+    case 'BROWSER':
+    case 'BROWSER_ARGS':
+    case 'HTTP_PROXY':
+    case 'http_proxy':
+    case 'HTTPS_PROXY':
+    case 'https_proxy':
+    case 'ALL_PROXY':
+    case 'all_proxy':
+    case 'NO_PROXY':
+    case 'no_proxy':
+    case 'FTP_PROXY':
+    case 'ftp_proxy':
+    case 'SSL_CRT_FILE':
+    case 'SSL_KEY_FILE':
+    case 'REACT_NATIVE_PACKAGER_HOSTNAME':
+      return true;
+    // NOTE(@kitten): Used to override where hermesc is found, not safe to read from .env
+    case 'REACT_NATIVE_OVERRIDE_HERMES_DIR':
+      return true;
+    default:
+      return false;
+  }
+}
+//# sourceMappingURL=constants.js.map

package/build/constants.js.map

@@ -1 +1 @@
-{"version":3,"sources":["constants.ts"],"sourcesContent":[null],"names":["isIgnoredEnvKey","isLocalEnvKey","isUnsafeAllowedEnvKey","platform","os","safeKeys","Set","process","env","EXPO_UNSAFE_DOTENV_KEYS","split","filter","x","name","has","startsWith"],"mappings":";;;;;;;;;;;;;;;;QAWgBA;eAAAA;;QA4LAC;eAAAA;;QAhMAC;eAAAA;;;;gEAPD;;;;;;;;;;;AAEf,MAAMC,WAAWC,iBAAE,CAACD,QAAQ;AAE5B,8FAA8F;AAC9F,MAAME,WAAW,IAAIC,IAAIC,QAAQC,GAAG,CAACC,uBAAuB,EAAEC,MAAM,KAAKC,OAAO,CAACC,IAAM,CAAC,CAACA;AAElF,SAASV,sBAAsBW,IAAY;IAChD,OAAOR,SAASS,GAAG,CAACD;AACtB;AAEO,SAASb,gBAAgBa,IAAY;IAC1C,IAAIV,aAAa,YAAYU,KAAKE,UAAU,CAAC,UAAU;QACrD,OAAO;IACT,OAAO,IAAIZ,aAAa,WAAWU,KAAKE,UAAU,CAAC,QAAQ;QACzD,OAAO;IACT,OAAO,IAAIV,SAASS,GAAG,CAACD,OAAO;QAC7B,OAAO;IACT;IAEA,kFAAkF;IAClF,kFAAkF;IAClF,+EAA+E;IAC/E,sCAAsC;IACtC,OAAQA;QACN,+BAA+B;QAC/B,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QAET,qDAAqD;QACrD,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QAET,qDAAqD;QACrD,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QAET,UAAU;QACV,KAAK;YACH,OAAO;QAET,wDAAwD;QACxD,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QAET,uDAAuD;QACvD,KAAK;YACH,OAAO;QAET,sBAAsB;QACtB,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QAET,2BAA2B;QAC3B,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QAET,YAAY;QACZ,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QAET,iBAAiB;QACjB,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QAET,YAAY;QACZ,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QAET,YAAY;QACZ,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QAET,gBAAgB;QAChB,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QAET,gBAAgB;QAChB,KAAK;QACL,KAAK;YACH,OAAO;QAET,aAAa;QACb,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QAET,WAAW;QACX,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QAET,SAAS;QACT,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QAET,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,uEAAuE;QACvE,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QAET;YACE,OAAO;IACX;AACF;AAYO,SAASZ,cAAcY,IAAY;IACxC,IAAIR,SAASS,GAAG,CAACD,OAAO,OAAO;IAC/B,OAAQA;QACN,kBAAkB;QAClB,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QAET,cAAc;QACd,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QAET,gBAAgB;QAChB,KAAK;QACL,KAAK;YACH,OAAO;QAET,qDAAqD;QACrD,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QAET,0DAA0D;QAC1D,KAAK;QACL,KAAK;YACH,OAAO;QAET,kDAAkD;QAClD,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;YACH,OAAO;QACT,qFAAqF;QACrF,KAAK;YACH,OAAO;QAET;YACE,OAAO;IACX;AACF"}
+{"version":3,"file":"constants.js","names":["_nodeOs","data","_interopRequireDefault","require","e","__esModule","default","platform","os","safeKeys","Set","process","env","EXPO_UNSAFE_DOTENV_KEYS","split","filter","x","isUnsafeAllowedEnvKey","name","has","isIgnoredEnvKey","startsWith","isLocalEnvKey"],"sources":["../src/constants.ts"],"sourcesContent":["import os from 'node:os';\n\nconst platform = os.platform();\n\n// WARN(@kitten): We don't read this dynamically to ignore later modifications to this env var\nconst safeKeys = new Set(process.env.EXPO_UNSAFE_DOTENV_KEYS?.split(',').filter((x) => !!x));\n\nexport function isUnsafeAllowedEnvKey(name: string): boolean {\n  return safeKeys.has(name);\n}\n\nexport function isIgnoredEnvKey(name: string) {\n  if (platform === 'darwin' && name.startsWith('DYLD_')) {\n    return true;\n  } else if (platform === 'linux' && name.startsWith('LD_')) {\n    return true;\n  } else if (safeKeys.has(name)) {\n    return false;\n  }\n\n  // NOTE(@kitten): Per-developer tool roots (ANDROID_HOME, JDK_HOME, DEVELOPER_DIR,\n  // npm/pnpm/yarn/bun paths, etc) are not blocked here — see `isLocalEnvKey`, which\n  // restricts them to `.local` env files (gitignored by convention) so committed\n  // `.env*` files cannot redirect them.\n  switch (name) {\n    // NOTE: Expo internal env vars\n    case '__EXPO_ENV_LOADED':\n    case 'EXPO_NO_DOTENV':\n    case 'EXPO_UNSAFE_DOTENV_KEYS':\n      return true;\n\n    // Linux dynamic-loader, can cause inconsistent calls\n    case 'LD_PRELOAD':\n    case 'LD_LIBRARY_PATH':\n    case 'LD_AUDIT':\n      return true;\n\n    // macOS dynamic-loader, can cause inconsistent calls\n    case 'DYLD_INSERT_LIBRARIES':\n    case 'DYLD_LIBRARY_PATH':\n    case 'DYLD_FRAMEWORK_PATH':\n    case 'DYLD_FALLBACK_LIBRARY_PATH':\n    case 'DYLD_FALLBACK_FRAMEWORK_PATH':\n      return true;\n\n    // OpenSSL\n    case 'SSLKEYLOGFILE':\n      return true;\n\n    // Changes Node behaviour and shouldn't be set in dotenv\n    case 'NODE_PATH':\n    case 'NODE_OPTIONS':\n    case 'NODE_EXTRA_CA_CERTS':\n    case 'NODE_TLS_REJECT_UNAUTHORIZED':\n    case 'NODE_COMPILE_CACHE':\n    case 'NPM_CONFIG_NODE_OPTIONS':\n    case 'NODE_REPL_EXTERNAL_MODULE':\n      return true;\n\n    // Changes Bun behaviour and shouldn't be set in dotenv\n    case 'BUN_RUNTIME_TRANSPILER_CACHE_PATH':\n      return true;\n\n    // Shell startup hooks\n    case 'BASH_ENV':\n    case 'ENV':\n    case 'ZDOTDIR':\n    case 'IFS':\n    case 'CDPATH':\n    case 'PROMPT_COMMAND':\n    case 'SHELLOPTS':\n    case 'BASHOPTS':\n      return true;\n\n    // Special git/ssh/gpg args\n    case 'GIT_SSH':\n    case 'GIT_SSH_COMMAND':\n    case 'GPG_TTY':\n    case 'SSH_ASKPASS':\n    case 'GIT_ASKPASS':\n    case 'GIT_EXEC_PATH':\n      return true;\n\n    // Perl libs\n    case 'PERL5OPT':\n    case 'PERL5LIB':\n    case 'PERLLIB':\n      return true;\n\n    // Python modules\n    case 'PYTHONSTARTUP':\n    case 'PYTHONPATH':\n    case 'PYTHONHOME':\n    case 'PYTHONINSPECT':\n    case 'PYTHONUSERBASE':\n    case 'PYTHONEXECUTABLE':\n    case 'PYTHONSAFEPATH':\n    case 'PYTJONNOUSERSITE':\n      return true;\n\n    // Ruby libs\n    case 'RUBYOPT':\n    case 'RUBYLIB':\n    case 'BUNDLE_GEMFILE':\n    case 'RUBYSHELL':\n    case 'RUBYPATH':\n    case 'GEM_HOME':\n    case 'GEM_PATH':\n    case 'BUNDLE_PATH':\n      return true;\n\n    // Java vars\n    case '_JAVA_OPTIONS':\n    case 'JAVA_TOOL_OPTIONS':\n    case 'JDK_JAVA_OPTIONS':\n    case 'CLASSPATH':\n      return true;\n\n    // User env vars\n    case 'HOME':\n    case 'USERPROFILE':\n    case 'HOMEDRIVE':\n    case 'HOMEPATH':\n    case 'TMPDIR':\n    case 'TMP':\n    case 'TEMP':\n    case 'USER':\n    case 'SHELL':\n    case 'PATH':\n    case 'PATHEXT':\n    case 'LANG':\n    case 'PWD':\n    case 'OLDPWD':\n    case 'TERMINFO':\n      return true;\n\n    // Windows-owned\n    case 'SYSTEMROOT':\n    case 'SystemRoot':\n      return true;\n\n    // User tools\n    case 'EDITOR':\n    case 'VISUAL':\n    case 'PAGER':\n    case 'MANPAGER':\n      return true;\n\n    // XDG dirs\n    case 'XDG_RUNTIME_DIR':\n    case 'XDG_STATE_HOME':\n    case 'XDG_DATA_HOME':\n    case 'XDG_CONFIG_DIRS':\n    case 'XDG_CACHE_HOME':\n    case 'XDG_CONFIG_HOME':\n    case 'XDG_BIN_HOME':\n      return true;\n\n    // direnv\n    case 'DIRENV_DIR':\n    case 'DIRENV_FILE':\n    case 'DIRENV_WATCHES':\n    case 'DIRENV_DIFF':\n      return true;\n\n    // Package-manager registry/install roots. No legitimate per-project `.env`\n    // use case — the established mechanism for each is a dedicated config file\n    // (`.npmrc`, `.yarnrc.yml`, `.bunfig.toml`) — and a malicious value is a\n    // supply-chain RCE the moment the CLI shells out to npm/yarn/pnpm/bun.\n    case 'NPM_CONFIG_REGISTRY':\n    case 'NPM_CONFIG_PREFIX':\n    case 'NPM_CONFIG_USERCONFIG':\n    case 'NPM_CONFIG_GLOBALCONFIG':\n    case 'NPM_CONFIG_CACHE':\n    case 'YARN_REGISTRY':\n    case 'YARN_CACHE_FOLDER':\n    case 'YARN_GLOBAL_FOLDER':\n    case 'PNPM_HOME':\n    case 'BUN_INSTALL':\n    case 'BUN_INSTALL_BIN':\n    case 'COCOAPODS_HOME':\n    case 'CMAKE_HOME':\n      return true;\n\n    default:\n      return false;\n  }\n}\n\n/**\n * Whether a dotenv key represents per-developer/per-machine configuration that\n * should only be loaded from `.local` env files (e.g. `.env.local`,\n * `.env.development.local`). Committed `.env*` files cannot set these — that\n * prevents a malicious project from redirecting developer-tool roots (e.g.\n * `ANDROID_HOME`) via a supply-chain attack, while still letting developers\n * pin them in their gitignored `.local` overrides.\n *\n * Honors `EXPO_UNSAFE_DOTENV_KEYS`: opt-in keys are allowed in any env file.\n */\nexport function isLocalEnvKey(name: string): boolean {\n  if (safeKeys.has(name)) return false;\n  switch (name) {\n    // Android tooling\n    case 'ANDROID_HOME':\n    case 'ANDROID_SDK_ROOT':\n    case 'ANDROID_NDK_HOME':\n    case 'ANDROID_NDK_ROOT':\n    case 'ANDROID_AVD_HOME':\n    case 'ANDROID_EMULATOR_HOME':\n    case 'GRADLE_HOME':\n    case 'GRADLE_USER_HOME':\n    case 'KOTLIN_HOME':\n      return true;\n\n    // JVM tooling\n    case 'JAVA_HOME':\n    case 'JDK_HOME':\n    case 'JRE_HOME':\n      return true;\n\n    // Apple tooling\n    case 'DEVELOPER_DIR':\n    case 'XCODE_DEVELOPER_DIR_PATH':\n      return true;\n\n    // CocoaPods / Fastlane (secrets and non-exec config)\n    case 'COCOAPODS_DISABLE_STATS':\n    case 'FASTLANE_USER':\n    case 'FASTLANE_PASSWORD':\n    case 'FASTLANE_SESSION':\n    case 'FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD':\n      return true;\n\n    // Android NDK (per-project NDK version pinning is common)\n    case 'NDK_HOME':\n    case 'NDK_ROOT':\n      return true;\n\n    // Per-developer preferences and per-machine setup\n    case 'BROWSER':\n    case 'BROWSER_ARGS':\n    case 'HTTP_PROXY':\n    case 'http_proxy':\n    case 'HTTPS_PROXY':\n    case 'https_proxy':\n    case 'ALL_PROXY':\n    case 'all_proxy':\n    case 'NO_PROXY':\n    case 'no_proxy':\n    case 'FTP_PROXY':\n    case 'ftp_proxy':\n    case 'SSL_CRT_FILE':\n    case 'SSL_KEY_FILE':\n    case 'REACT_NATIVE_PACKAGER_HOSTNAME':\n      return true;\n    // NOTE(@kitten): Used to override where hermesc is found, not safe to read from .env\n    case 'REACT_NATIVE_OVERRIDE_HERMES_DIR':\n      return true;\n\n    default:\n      return false;\n  }\n}\n"],"mappings":";;;;;;;;AAAA,SAAAA,QAAA;EAAA,MAAAC,IAAA,GAAAC,sBAAA,CAAAC,OAAA;EAAAH,OAAA,YAAAA,CAAA;IAAA,OAAAC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAAyB,SAAAC,uBAAAE,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAEzB,MAAMG,QAAQ,GAAGC,iBAAE,CAACD,QAAQ,CAAC,CAAC;;AAE9B;AACA,MAAME,QAAQ,GAAG,IAAIC,GAAG,CAACC,OAAO,CAACC,GAAG,CAACC,uBAAuB,EAAEC,KAAK,CAAC,GAAG,CAAC,CAACC,MAAM,CAAEC,CAAC,IAAK,CAAC,CAACA,CAAC,CAAC,CAAC;AAErF,SAASC,qBAAqBA,CAACC,IAAY,EAAW;EAC3D,OAAOT,QAAQ,CAACU,GAAG,CAACD,IAAI,CAAC;AAC3B;AAEO,SAASE,eAAeA,CAACF,IAAY,EAAE;EAC5C,IAAIX,QAAQ,KAAK,QAAQ,IAAIW,IAAI,CAACG,UAAU,CAAC,OAAO,CAAC,EAAE;IACrD,OAAO,IAAI;EACb,CAAC,MAAM,IAAId,QAAQ,KAAK,OAAO,IAAIW,IAAI,CAACG,UAAU,CAAC,KAAK,CAAC,EAAE;IACzD,OAAO,IAAI;EACb,CAAC,MAAM,IAAIZ,QAAQ,CAACU,GAAG,CAACD,IAAI,CAAC,EAAE;IAC7B,OAAO,KAAK;EACd;;EAEA;EACA;EACA;EACA;EACA,QAAQA,IAAI;IACV;IACA,KAAK,mBAAmB;IACxB,KAAK,gBAAgB;IACrB,KAAK,yBAAyB;MAC5B,OAAO,IAAI;;IAEb;IACA,KAAK,YAAY;IACjB,KAAK,iBAAiB;IACtB,KAAK,UAAU;MACb,OAAO,IAAI;;IAEb;IACA,KAAK,uBAAuB;IAC5B,KAAK,mBAAmB;IACxB,KAAK,qBAAqB;IAC1B,KAAK,4BAA4B;IACjC,KAAK,8BAA8B;MACjC,OAAO,IAAI;;IAEb;IACA,KAAK,eAAe;MAClB,OAAO,IAAI;;IAEb;IACA,KAAK,WAAW;IAChB,KAAK,cAAc;IACnB,KAAK,qBAAqB;IAC1B,KAAK,8BAA8B;IACnC,KAAK,oBAAoB;IACzB,KAAK,yBAAyB;IAC9B,KAAK,2BAA2B;MAC9B,OAAO,IAAI;;IAEb;IACA,KAAK,mCAAmC;MACtC,OAAO,IAAI;;IAEb;IACA,KAAK,UAAU;IACf,KAAK,KAAK;IACV,KAAK,SAAS;IACd,KAAK,KAAK;IACV,KAAK,QAAQ;IACb,KAAK,gBAAgB;IACrB,KAAK,WAAW;IAChB,KAAK,UAAU;MACb,OAAO,IAAI;;IAEb;IACA,KAAK,SAAS;IACd,KAAK,iBAAiB;IACtB,KAAK,SAAS;IACd,KAAK,aAAa;IAClB,KAAK,aAAa;IAClB,KAAK,eAAe;MAClB,OAAO,IAAI;;IAEb;IACA,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,SAAS;MACZ,OAAO,IAAI;;IAEb;IACA,KAAK,eAAe;IACpB,KAAK,YAAY;IACjB,KAAK,YAAY;IACjB,KAAK,eAAe;IACpB,KAAK,gBAAgB;IACrB,KAAK,kBAAkB;IACvB,KAAK,gBAAgB;IACrB,KAAK,kBAAkB;MACrB,OAAO,IAAI;;IAEb;IACA,KAAK,SAAS;IACd,KAAK,SAAS;IACd,KAAK,gBAAgB;IACrB,KAAK,WAAW;IAChB,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,aAAa;MAChB,OAAO,IAAI;;IAEb;IACA,KAAK,eAAe;IACpB,KAAK,mBAAmB;IACxB,KAAK,kBAAkB;IACvB,KAAK,WAAW;MACd,OAAO,IAAI;;IAEb;IACA,KAAK,MAAM;IACX,KAAK,aAAa;IAClB,KAAK,WAAW;IAChB,KAAK,UAAU;IACf,KAAK,QAAQ;IACb,KAAK,KAAK;IACV,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,OAAO;IACZ,KAAK,MAAM;IACX,KAAK,SAAS;IACd,KAAK,MAAM;IACX,KAAK,KAAK;IACV,KAAK,QAAQ;IACb,KAAK,UAAU;MACb,OAAO,IAAI;;IAEb;IACA,KAAK,YAAY;IACjB,KAAK,YAAY;MACf,OAAO,IAAI;;IAEb;IACA,KAAK,QAAQ;IACb,KAAK,QAAQ;IACb,KAAK,OAAO;IACZ,KAAK,UAAU;MACb,OAAO,IAAI;;IAEb;IACA,KAAK,iBAAiB;IACtB,KAAK,gBAAgB;IACrB,KAAK,eAAe;IACpB,KAAK,iBAAiB;IACtB,KAAK,gBAAgB;IACrB,KAAK,iBAAiB;IACtB,KAAK,cAAc;MACjB,OAAO,IAAI;;IAEb;IACA,KAAK,YAAY;IACjB,KAAK,aAAa;IAClB,KAAK,gBAAgB;IACrB,KAAK,aAAa;MAChB,OAAO,IAAI;;IAEb;IACA;IACA;IACA;IACA,KAAK,qBAAqB;IAC1B,KAAK,mBAAmB;IACxB,KAAK,uBAAuB;IAC5B,KAAK,yBAAyB;IAC9B,KAAK,kBAAkB;IACvB,KAAK,eAAe;IACpB,KAAK,mBAAmB;IACxB,KAAK,oBAAoB;IACzB,KAAK,WAAW;IAChB,KAAK,aAAa;IAClB,KAAK,iBAAiB;IACtB,KAAK,gBAAgB;IACrB,KAAK,YAAY;MACf,OAAO,IAAI;IAEb;MACE,OAAO,KAAK;EAChB;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASI,aAAaA,CAACJ,IAAY,EAAW;EACnD,IAAIT,QAAQ,CAACU,GAAG,CAACD,IAAI,CAAC,EAAE,OAAO,KAAK;EACpC,QAAQA,IAAI;IACV;IACA,KAAK,cAAc;IACnB,KAAK,kBAAkB;IACvB,KAAK,kBAAkB;IACvB,KAAK,kBAAkB;IACvB,KAAK,kBAAkB;IACvB,KAAK,uBAAuB;IAC5B,KAAK,aAAa;IAClB,KAAK,kBAAkB;IACvB,KAAK,aAAa;MAChB,OAAO,IAAI;;IAEb;IACA,KAAK,WAAW;IAChB,KAAK,UAAU;IACf,KAAK,UAAU;MACb,OAAO,IAAI;;IAEb;IACA,KAAK,eAAe;IACpB,KAAK,0BAA0B;MAC7B,OAAO,IAAI;;IAEb;IACA,KAAK,yBAAyB;IAC9B,KAAK,eAAe;IACpB,KAAK,mBAAmB;IACxB,KAAK,kBAAkB;IACvB,KAAK,8CAA8C;MACjD,OAAO,IAAI;;IAEb;IACA,KAAK,UAAU;IACf,KAAK,UAAU;MACb,OAAO,IAAI;;IAEb;IACA,KAAK,SAAS;IACd,KAAK,cAAc;IACnB,KAAK,YAAY;IACjB,KAAK,YAAY;IACjB,KAAK,aAAa;IAClB,KAAK,aAAa;IAClB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,cAAc;IACnB,KAAK,cAAc;IACnB,KAAK,gCAAgC;MACnC,OAAO,IAAI;IACb;IACA,KAAK,kCAAkC;MACrC,OAAO,IAAI;IAEb;MACE,OAAO,KAAK;EAChB;AACF","ignoreList":[]}