@karmaniverous/get-dotenv 6.2.4 → 6.4.0

package/dist/chunks/{index-Bc3h0a95.mjs → index-r0Me7-sT.mjs}

@@ -1,20 +1,126 @@
-import { l as redactTriple, m as maybeWarnEntropy, r as readMergedOptions, c as getDotenvCliOptions2Options, d as definePlugin } from './readMergedOptions-Nt0TR7dX.mjs';
+import { r as readMergedOptions, g as getDotenvCliOptions2Options, d as definePlugin } from './readMergedOptions-B7VdLROn.mjs';
 import 'execa';
 import 'fs-extra';
+import 'node:path';
 import 'crypto';
 import 'path';
 import 'url';
 import '@commander-js/extra-typings';
 import 'nanoid';
 import 'dotenv';
-import './loader-DnhPeGfq.mjs';
+import './loader-CePOf74i.mjs';
 import 'package-directory';
 import 'yaml';
 import { z } from 'zod';
-import { c as resolveCommand, d as resolveShell, t as tokenize, s as shouldCapture, r as runCommand, b as buildSpawnEnv } from './spawnEnv-CN8a7cNR.mjs';
+import { b as resolveCommand, c as resolveShell, t as tokenize, s as shouldCapture, r as runCommand, d as buildSpawnEnv } from './spawnEnv-CQwFu7ZJ.mjs';
 import { m as maybePreserveNodeEvalArgv, c as composeNestedEnv, s as stripOne } from './invoke-DuRPU1oC.mjs';
-import { b as dotenvExpandFromProcessEnv } from './overlayEnv-Bs2kVayG.mjs';
-import { r as resolveCliOptions, b as baseGetDotenvCliOptions } from './resolveCliOptions-TFRzhB2c.mjs';
+import { h as dotenvExpandFromProcessEnv } from './readDotenvCascade-DfFkWMjs.mjs';
+import { r as resolveCliOptions, b as baseGetDotenvCliOptions } from './resolveCliOptions-pgUXHJtj.mjs';
+
+/** src/diagnostics/entropy.ts
+ * Entropy diagnostics (presentation-only).
+ * - Gated by min length and printable ASCII.
+ * - Warn once per key per run when bits/char \>= threshold.
+ * - Supports whitelist patterns to suppress known-noise keys.
+ */
+const warned = new Set();
+const isPrintableAscii = (s) => /^[\x20-\x7E]+$/.test(s);
+const compile$1 = (patterns) => (patterns ?? []).map((p) => (typeof p === 'string' ? new RegExp(p, 'i') : p));
+const whitelisted = (key, regs) => regs.some((re) => re.test(key));
+const shannonBitsPerChar = (s) => {
+    const freq = new Map();
+    for (const ch of s)
+        freq.set(ch, (freq.get(ch) ?? 0) + 1);
+    const n = s.length;
+    let h = 0;
+    for (const c of freq.values()) {
+        const p = c / n;
+        h -= p * Math.log2(p);
+    }
+    return h;
+};
+/**
+ * Maybe emit a one-line entropy warning for a key.
+ * Caller supplies an `emit(line)` function; the helper ensures once-per-key.
+ */
+const maybeWarnEntropy = (key, value, origin, opts, emit) => {
+    if (!opts || opts.warnEntropy === false)
+        return;
+    if (warned.has(key))
+        return;
+    const v = value ?? '';
+    const minLen = Math.max(0, opts.entropyMinLength ?? 16);
+    const threshold = opts.entropyThreshold ?? 3.8;
+    if (v.length < minLen)
+        return;
+    if (!isPrintableAscii(v))
+        return;
+    const wl = compile$1(opts.entropyWhitelist);
+    if (whitelisted(key, wl))
+        return;
+    const bpc = shannonBitsPerChar(v);
+    if (bpc >= threshold) {
+        warned.add(key);
+        emit(`[entropy] key=${key} score=${bpc.toFixed(2)} len=${String(v.length)} origin=${origin}`);
+    }
+};
+
+const DEFAULT_PATTERNS = [
+    '\\bsecret\\b',
+    '\\btoken\\b',
+    '\\bpass(word)?\\b',
+    '\\bapi[_-]?key\\b',
+    '\\bkey\\b',
+];
+const compile = (patterns) => (patterns && patterns.length > 0 ? patterns : DEFAULT_PATTERNS).map((p) => typeof p === 'string' ? new RegExp(p, 'i') : p);
+const shouldRedactKey = (key, regs) => regs.some((re) => re.test(key));
+const MASK = '[redacted]';
+/**
+ * Redact a single displayed value according to key/patterns.
+ * Returns the original value when redaction is disabled or key is not matched.
+ */
+const redactDisplay = (key, value, opts) => {
+    if (!value)
+        return value;
+    if (!opts?.redact)
+        return value;
+    const regs = compile(opts.redactPatterns);
+    return shouldRedactKey(key, regs) ? MASK : value;
+};
+/**
+ * Produce a shallow redacted copy of an env-like object for display.
+ */
+const redactObject = (obj, opts) => {
+    if (!opts?.redact)
+        return { ...obj };
+    const regs = compile(opts.redactPatterns);
+    const out = {};
+    for (const [k, v] of Object.entries(obj)) {
+        out[k] = v && shouldRedactKey(k, regs) ? MASK : v;
+    }
+    return out;
+};
+/**
+ * Utility to redact three related displayed values (parent/dotenv/final)
+ * consistently for trace lines.
+ */
+const redactTriple = (key, triple, opts) => {
+    if (!opts?.redact)
+        return triple;
+    const regs = compile(opts.redactPatterns);
+    const maskIf = (v) => (v && shouldRedactKey(key, regs) ? MASK : v);
+    const out = {};
+    const p = maskIf(triple.parent);
+    const d = maskIf(triple.dotenv);
+    const f = maskIf(triple.final);
+    if (p !== undefined)
+        out.parent = p;
+    if (d !== undefined)
+        out.dotenv = d;
+    if (f !== undefined)
+        out.final = f;
+    return out;
+};
 
 /**
  * Trace child env composition with redaction and entropy warnings.
@@ -371,4 +477,4 @@ const cmdPlugin = (options = {}) => {
     return plugin;
 };
 
-export { cmdPlugin as c, traceChildEnv as t };
+export { redactDisplay as a, cmdPlugin as c, maybeWarnEntropy as m, redactObject as r, traceChildEnv as t };

package/dist/chunks/{loadSso-w1eTVg0O.mjs → loadSso-CLR1fKci.mjs}

@@ -1,17 +1,18 @@
-import { w as resolveAwsSdkSigV4Config, x as normalizeProvider, y as getSmithyContext, z as EndpointCache, A as resolveEndpoint, B as awsEndpointFunctions, D as customEndpointFunctions, t as toUtf8, i as fromUtf8, F as parseUrl, G as NoOpLogger, I as AwsSdkSigV4Signer, J as NoAuthSigner, n as toBase64, m as fromBase64, K as emitWarningIfUnsupportedVersion, L as resolveDefaultsModeConfig, M as emitWarningIfUnsupportedVersion$1, O as loadConfig, r as streamCollector, P as Hash, N as NodeHttpHandler, Q as createDefaultUserAgentProvider, R as calculateBodyLength, S as NODE_APP_ID_CONFIG_OPTIONS, T as NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, U as NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, V as NODE_RETRY_MODE_CONFIG_OPTIONS, W as DEFAULT_RETRY_MODE, X as NODE_REGION_CONFIG_FILE_OPTIONS, Y as NODE_REGION_CONFIG_OPTIONS, Z as NODE_MAX_ATTEMPT_CONFIG_OPTIONS, _ as NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, $ as loadConfigsForDefaultMode, a0 as getAwsRegionExtensionConfiguration, a1 as getDefaultExtensionConfiguration, a2 as getHttpHandlerExtensionConfiguration, a3 as resolveAwsRegionExtensionConfiguration, a4 as resolveDefaultRuntimeConfig, a5 as resolveHttpHandlerRuntimeConfig, a6 as Client, a7 as resolveUserAgentConfig, a8 as resolveRetryConfig, a9 as resolveRegionConfig, aa as resolveEndpointConfig, ab as resolveHostHeaderConfig, ac as getSchemaSerdePlugin, ad as getUserAgentPlugin, ae as getRetryPlugin, af as getContentLengthPlugin, ag as getHostHeaderPlugin, ah as getLoggerPlugin, ai as getRecursionDetectionPlugin, aj as getHttpAuthSchemeEndpointRuleSetPlugin, ak as DefaultIdentityProviderConfig, al as getHttpSigningPlugin, am as ServiceException, an as TypeRegistry, ao as Command, ap as getEndpointPlugin } from './index-CeCufHlm.mjs';
-import { A as AwsRestJsonProtocol } from './AwsRestJsonProtocol-Bq1HE-Ln.mjs';
-import './readMergedOptions-Nt0TR7dX.mjs';
+import { w as resolveAwsSdkSigV4Config, x as normalizeProvider, y as getSmithyContext, z as EndpointCache, A as resolveEndpoint, B as awsEndpointFunctions, D as customEndpointFunctions, t as toUtf8, i as fromUtf8, F as parseUrl, G as NoOpLogger, I as AwsSdkSigV4Signer, J as NoAuthSigner, n as toBase64, m as fromBase64, K as emitWarningIfUnsupportedVersion, L as resolveDefaultsModeConfig, M as emitWarningIfUnsupportedVersion$1, O as loadConfig, r as streamCollector, P as Hash, N as NodeHttpHandler, Q as createDefaultUserAgentProvider, R as calculateBodyLength, S as NODE_APP_ID_CONFIG_OPTIONS, T as NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, U as NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, V as NODE_RETRY_MODE_CONFIG_OPTIONS, W as DEFAULT_RETRY_MODE, X as NODE_REGION_CONFIG_FILE_OPTIONS, Y as NODE_REGION_CONFIG_OPTIONS, Z as NODE_MAX_ATTEMPT_CONFIG_OPTIONS, _ as NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, $ as loadConfigsForDefaultMode, a0 as getAwsRegionExtensionConfiguration, a1 as getDefaultExtensionConfiguration, a2 as getHttpHandlerExtensionConfiguration, a3 as resolveAwsRegionExtensionConfiguration, a4 as resolveDefaultRuntimeConfig, a5 as resolveHttpHandlerRuntimeConfig, a6 as Client, a7 as resolveUserAgentConfig, a8 as resolveRetryConfig, a9 as resolveRegionConfig, aa as resolveEndpointConfig, ab as resolveHostHeaderConfig, ac as getSchemaSerdePlugin, ad as getUserAgentPlugin, ae as getRetryPlugin, af as getContentLengthPlugin, ag as getHostHeaderPlugin, ah as getLoggerPlugin, ai as getRecursionDetectionPlugin, aj as getHttpAuthSchemeEndpointRuleSetPlugin, ak as DefaultIdentityProviderConfig, al as getHttpSigningPlugin, am as ServiceException, an as TypeRegistry, ao as Command, ap as getEndpointPlugin } from './index-70Dm0f1N.mjs';
+import { A as AwsRestJsonProtocol } from './AwsRestJsonProtocol-fYZqn-kW.mjs';
+import './readMergedOptions-B7VdLROn.mjs';
 import 'zod';
 import '@commander-js/extra-typings';
-import './overlayEnv-Bs2kVayG.mjs';
+import './readDotenvCascade-DfFkWMjs.mjs';
 import 'fs-extra';
+import 'node:path';
 import './loadModuleDefault-Dj8B3Stt.mjs';
 import 'crypto';
 import 'path';
 import 'url';
-import 'nanoid';
 import 'dotenv';
-import './loader-DnhPeGfq.mjs';
+import 'nanoid';
+import './loader-CePOf74i.mjs';
 import 'package-directory';
 import 'yaml';
 import 'execa';
@@ -23,7 +24,7 @@ import 'https';
 import 'stream';
 import 'process';
 import 'node:fs';
-import './sdk-stream-mixin-BZoJ5jy9.mjs';
+import './sdk-stream-mixin-ecbbBR0l.mjs';
 
 const defaultSSOHttpAuthSchemeParametersProvider = async (config, context, input) => {
     return {

package/dist/chunks/{loader-DnhPeGfq.mjs → loader-CePOf74i.mjs}

@@ -4,6 +4,7 @@ import path, { join, extname } from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
 import YAML from 'yaml';
 import { z } from 'zod';
+import 'node:path';
 import { l as loadModuleDefault } from './loadModuleDefault-Dj8B3Stt.mjs';
 
 /**

package/dist/chunks/{parseKnownFiles-B9cDK21V.mjs → parseKnownFiles-BQvmJ0HK.mjs}

@@ -1,4 +1,4 @@
-import { l as loadSharedConfigFiles } from './index-CeCufHlm.mjs';
+import { l as loadSharedConfigFiles } from './index-70Dm0f1N.mjs';
 
 const mergeConfigFiles = (...files) => {
     const merged = {};