@hobenakicoffee/libraries 1.20.0 → 1.21.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hobenakicoffee/libraries",
-  "version": "1.20.0",
+  "version": "1.21.1",
   "type": "module",
   "types": "src/index.ts",
   "exports": {
@@ -48,7 +48,8 @@
     "./moderation": "./src/moderation/index.ts",
     "./providers/theme-provider": "./src/providers/theme-provider.tsx",
     "./types": "./src/types/index.ts",
-    "./utils": "./src/utils/index.ts"
+    "./utils": "./src/utils/index.ts",
+    "./scripts": "./src/scripts/index.ts"
   },
   "files": [
     "src",
@@ -70,6 +71,7 @@
     "prepublishOnly": "bun run test",
     "check": "ultracite check",
     "fix": "ultracite fix",
+    "check:env": "bun run src/scripts/check-env-encryption.ts",
     "prepare": "lefthook install"
   },
   "devDependencies": {

package/src/scripts/check-env-encryption.ts

@@ -0,0 +1,51 @@
+import { existsSync, readFileSync } from "node:fs";
+
+export function checkEnvEncryption(
+  envFiles: string[] = [".env", ".env.production"]
+) {
+  const ALLOWED = new Set([
+    "DOTENV_PUBLIC_KEY",
+    "DOTENV_PUBLIC_KEY_PRODUCTION",
+  ]);
+  let hasError = false;
+
+  for (const file of envFiles) {
+    if (!existsSync(file)) {
+      console.warn(`⚠️ Skipping missing file: ${file}`);
+      continue;
+    }
+
+    const text = readFileSync(file, "utf-8");
+    const lines = text.split("\n");
+
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const [key, ...rest] = trimmed.split("=");
+      if (!key || rest.length === 0) continue;
+      let value = rest.join("=").trim();
+      value = value.replace(/^['"]|['"]$/g, "");
+      if (ALLOWED.has(key)) continue;
+      if (!value.startsWith("encrypted:")) {
+        console.error(`❌ ${file} -> ${key} is not encrypted`);
+        hasError = true;
+      }
+    }
+  }
+
+  if (hasError) {
+    console.error("\n🚨 Env encryption validation failed");
+    process.exit(1);
+  }
+  console.log("✅ All env variables are encrypted");
+}
+
+// CLI support — works in both Bun and Node
+const isMain =
+  process.argv[1] === import.meta.url.replace("file://", "") ||
+  // biome-ignore lint/correctness/noUndeclaredVariables: <optional check>
+  (typeof Bun !== "undefined" && import.meta.main);
+
+if (isMain) {
+  checkEnvEncryption();
+}

package/src/scripts/index.ts

@@ -0,0 +1 @@
+export * from "./check-env-encryption";