@kaynooo/env-tools 0.5.0 → 0.7.0

package/dist/redact.js

@@ -276,12 +276,27 @@ function le(i = {}) {
 var t = le();
 
 // ../kit/src/style.ts
+var MARKS = {
+  ok: { symbol: "\u2713", word: "ok:", paint: (colors) => colors.green },
+  warn: { symbol: "!", word: "warning:", paint: (colors) => colors.yellow },
+  problem: { symbol: "\u2717", word: "error:", paint: (colors) => colors.red },
+  note: { symbol: "\xB7", word: "note:", paint: (colors) => colors.dim }
+};
 function takesControlCodes(stream, env = process2.env) {
   return stream.isTTY === true && env.NO_COLOR === undefined && env.NODE_DISABLE_COLORS === undefined && env.TERM !== "dumb";
 }
 function paint(stream, env = process2.env) {
   return le({ stream: { isTTY: takesControlCodes(stream, env) }, env });
 }
+function marked(mark, text, stream, detail, env = process2.env) {
+  const colors = paint(stream, env);
+  const { symbol, word, paint: tint } = MARKS[mark];
+  const head = takesControlCodes(stream, env) ? tint(colors)(symbol) : word;
+  return `${head} ${text}${detail === undefined ? "" : ` ${colors.dim(detail)}`}`;
+}
+function ok(text, detail) {
+  console.log(marked("ok", text, process2.stdout, detail));
+}
 var STATUSES = {
   passed: { symbol: "\u2713", words: ["passed", "success", "succeeded", "ok"], paint: (colors) => colors.green },
   failed: { symbol: "\u2717", words: ["failed", "failure", "error", "errored"], paint: (colors) => colors.red },
@@ -343,6 +358,26 @@ function printJson(value) {
   console.log(JSON.stringify(value, undefined, 2));
 }
 
+// ../kit/src/text.ts
+var ANSI = new RegExp(`${String.fromCharCode(27)}\\[[\\d;?]*[a-z]`, "gi");
+function distance(a, b) {
+  let previous = Array.from({ length: b.length + 1 }, (_, index) => index);
+  for (const [i, left] of [...a].entries()) {
+    const current = [i + 1];
+    for (const [j, right] of [...b].entries())
+      current.push(Math.min((previous[j + 1] ?? 0) + 1, (current[j] ?? 0) + 1, (previous[j] ?? 0) + (left === right ? 0 : 1)));
+    previous = current;
+  }
+  return previous[b.length] ?? 0;
+}
+function closest(name, names) {
+  const started = names.find((known) => known.startsWith(name));
+  if (started !== undefined)
+    return started;
+  const [best] = names.map((known) => ({ known, far: distance(name, known) })).sort((a, b) => a.far - b.far);
+  return best !== undefined && best.far <= (name.length < 4 ? 1 : 2) ? best.known : undefined;
+}
+
 // ../kit/src/args.ts
 function jsonOption(holds) {
   return { type: "boolean", description: holds === undefined ? "print JSON" : `print JSON: ${holds}` };
@@ -362,8 +397,8 @@ function fail(message, code = 2, hint) {
 }
 
 class UsageError extends Exit {
-  constructor(message) {
-    super(message, 2);
+  constructor(message, hint) {
+    super(message, 2, hint);
   }
 }
 function badUsage(message) {
@@ -386,6 +421,7 @@ var completion = { active: false };
 var OPTIONAL = /\[[^\]]+\]/g;
 var USAGE_PREFIX = /^usage:\s*/i;
 var FULL_STOP = /\.$/;
+var DASHES = /^-+/;
 function usageLine(usage, colors = paint(process4.stdout)) {
   return `${colors.bold("Usage:")} ${usage.replace(USAGE_PREFIX, "").replaceAll(OPTIONAL, (part) => colors.dim(part))}`;
 }
@@ -422,10 +458,10 @@ function optionRows(options, colors = paint(process4.stdout)) {
   const rows = Object.entries(options).map(([name, option]) => {
     const short = option.short === undefined ? "    " : `${colors.cyan(`-${option.short}`)}, `;
     const value = option.type === "string" ? ` ${colors.dim("<value>")}` : "";
-    return { flag: `${short}${colors.cyan(`--${name}`)}${value}`, width: `-x, --${name}`.length + (option.type === "string" ? " <value>".length : 0), description: option.description };
+    return { flag: `${short}${colors.cyan(`--${name}`)}${value}`, width: `-x, --${name}`.length + (option.type === "string" ? " <value>".length : 0), description: option.description ?? "" };
   });
   const width = Math.max(0, ...rows.map((row) => row.width));
-  return rows.map((row) => `  ${row.flag}${" ".repeat(width - row.width)}  ${colors.dim(row.description)}`);
+  return rows.map((row) => row.description === "" ? `  ${row.flag}` : `  ${row.flag}${" ".repeat(width - row.width)}  ${colors.dim(row.description)}`);
 }
 var OUTPUT_OPTIONS = {
   color: { type: "string", description: "auto (on a terminal alone), always or never" },
@@ -457,7 +493,8 @@ function parse(args, usage, options, settings = {}) {
   try {
     parsed = parseArgs({ args: joinDashValues(own, all), options: all, allowPositionals: true, allowNegative: settings.allowNegative === true, strict: true });
   } catch (error) {
-    badUsage(parseError(error));
+    const message = parseError(error);
+    throw new UsageError(message, nearestOption(message, all, settings.allowNegative === true));
   }
   const values = parsed.values;
   applyOutput("color" in output ? values.color : undefined, "plain" in output ? values.plain : undefined);
@@ -500,6 +537,22 @@ function parseError(error) {
   const message = upTo(error instanceof Error ? error.message : String(error), ". ");
   return `${message.charAt(0).toLowerCase()}${message.slice(1)}`;
 }
+var UNKNOWN_OPTION = /^unknown option '(-[^']+)'/;
+function nearestOption(message, options, allowNegative) {
+  const typed = UNKNOWN_OPTION.exec(message)?.[1];
+  if (typed === undefined)
+    return;
+  const word = typed.replace(DASHES, "");
+  if (word.length < 2 && !typed.startsWith("--"))
+    return;
+  const known = Object.entries(options).flatMap(([name, option]) => [
+    ...option.short === undefined ? [] : [`-${option.short}`],
+    `--${name}`,
+    ...allowNegative && option.type === "boolean" ? [`--no-${name}`] : []
+  ]);
+  const meant = closest(word, known.map((flag) => flag.replace(DASHES, "")));
+  return meant === undefined ? undefined : `did you mean ${known.find((flag) => flag.replace(DASHES, "") === meant)}?`;
+}
 async function readInput(path, { noStdin = "nothing is piped on stdin" } = {}) {
   if (path === "-") {
     if (process4.stdin.isTTY)
@@ -511,35 +564,26 @@ async function readInput(path, { noStdin = "nothing is piped on stdin" } = {}) {
     fail(`no file ${path}`);
   return file.text();
 }
+// ../kit/src/progress.ts
+var ESC = String.fromCharCode(27);
+var ESCAPE_CODE = new RegExp(`${ESC}(?:\\[[\\x30-\\x3F]*[\\x20-\\x2F]*[\\x40-\\x7E]|\\][^\\u0007${ESC}]*(?:\\u0007|${ESC}\\\\))`, "y");
+var RESET_STYLE = `${ESC}[0m`;
+var CLOSE_LINK = `${ESC}]8;;${ESC}\\`;
 // ../kit/src/cli.ts
 import process5 from "process";
-
-// ../kit/src/text.ts
-var ANSI = new RegExp(`${String.fromCharCode(27)}\\[[\\d;?]*[a-z]`, "gi");
-function distance(a, b) {
-  let previous = Array.from({ length: b.length + 1 }, (_, index) => index);
-  for (const [i, left] of [...a].entries()) {
-    const current = [i + 1];
-    for (const [j, right] of [...b].entries())
-      current.push(Math.min((previous[j + 1] ?? 0) + 1, (current[j] ?? 0) + 1, (previous[j] ?? 0) + (left === right ? 0 : 1)));
-    previous = current;
-  }
-  return previous[b.length] ?? 0;
-}
-
-// ../kit/src/cli.ts
 var LEVEL_OPTIONS = {
   ...OUTPUT_OPTIONS,
   help: { type: "boolean", short: "h", description: "show this help" }
 };
 var TOP_OPTIONS = { ...LEVEL_OPTIONS, version: { type: "boolean", short: "v", description: "print the version" } };
-function commandRows(commands, colors) {
+async function commandRows(commands, colors) {
   const width = Math.max(...Object.keys(commands).map((name) => name.length));
   const groups = new Map([["Commands:", []]]);
-  for (const [name, { summary, group }] of Object.entries(commands)) {
+  const summaries = await Promise.all(Object.values(commands).map(async ({ summary }) => resolveSummary(summary)));
+  for (const [index, [name, { group }]] of Object.entries(commands).entries()) {
     const heading = group === undefined ? "Commands:" : `${group}:`;
     const rows = groups.get(heading) ?? [];
-    rows.push(`  ${colors.cyan(name.padEnd(width))}  ${colors.dim(summary)}`);
+    rows.push(`  ${colors.cyan(name.padEnd(width))}  ${colors.dim(summaries[index])}`);
     groups.set(heading, rows);
   }
   return [...groups].filter(([, rows]) => rows.length > 0).flatMap(([heading, rows], index) => [...index === 0 ? [] : [""], colors.bold(heading), ...rows]);
@@ -559,28 +603,38 @@ function takeOutputFlags(argv) {
   }
   return argv.slice(index);
 }
-function closest(name, names) {
-  const started = names.find((known) => known.startsWith(name));
-  if (started !== undefined)
-    return started;
-  const [best] = names.map((known) => ({ known, far: distance(name, known) })).sort((a, b) => a.far - b.far);
-  return best !== undefined && best.far <= (name.length < 4 ? 1 : 2) ? best.known : undefined;
+async function resolveSummary(summary) {
+  return typeof summary === "string" ? summary : summary();
 }
-async function help({ path, header, summary, commands, defaultCommand, examples, replaces }, stream) {
+function scopeOf(commands, extra, aliases) {
+  return { commands: typeof commands === "function" ? {} : commands, lazy: [...typeof commands === "function" ? [commands] : [], ...extra === undefined ? [] : [extra]], aliases };
+}
+async function expand(scope, words) {
+  if (scope.lazy.length === 0)
+    return scope;
+  const commands = { ...scope.commands };
+  for (const added of await Promise.all(scope.lazy.map(async (lazy) => lazy(words)))) {
+    for (const [name, command] of Object.entries(added))
+      commands[name] ??= command;
+  }
+  return { ...scope, commands, lazy: [] };
+}
+async function help({ path, header, summary: lazySummary, commands, defaultCommand, examples, replaces }, stream) {
   const colors = paint(stream);
   const prefix = path.join(" ");
+  const summary = await resolveSummary(lazySummary);
   if (wantsHelpJson())
     return JSON.stringify(description(`${prefix} <command> [options]: ${summary}`, { examples, replaces }));
   const fallback = defaultCommand === undefined ? undefined : commands[defaultCommand];
   const options = fallback !== undefined && "run" in fallback ? await optionsOf(fallback.run) : undefined;
   const own = Object.entries(options ?? {}).filter(([name]) => !(name in TOP_OPTIONS));
   return [
-    header(colors),
+    header(colors, summary),
     "",
     usageLine(`${prefix} ${defaultCommand === undefined ? colors.cyan("<command>") : `[${colors.cyan("<command>")}]`} [options]`, colors),
     ...replacesRows(replaces, colors),
     "",
-    ...commandRows(commands, colors),
+    ...await commandRows(commands, colors),
     ...own.length === 0 ? [] : ["", `${colors.bold(`Options of ${defaultCommand}:`)} ${colors.dim("the command run when none is named")}`, ...optionRows(Object.fromEntries(own), colors)],
     "",
     colors.bold("Options:"),
@@ -626,11 +680,11 @@ async function dispatch(level, typed, { version, redact }) {
   }
   const [name, ...args] = argv;
   if (name === undefined && level.path.length > 1) {
-    console.error(await help(level, process5.stderr));
+    console.error(await help(await expand(level, [...level.path.slice(1), ...argv]), process5.stderr));
     return 2;
   }
   if (name === undefined || name === "help" || name === "--help" || name === "-h") {
-    console.log(await help(level, process5.stdout));
+    console.log(await help(await expand(level, [...level.path.slice(1), ...argv]), process5.stdout));
     return 0;
   }
   if (level.path.length === 1 && (name === "--version" || name === "-v")) {
@@ -639,6 +693,10 @@ async function dispatch(level, typed, { version, redact }) {
   }
   let command = level.commands[level.aliases?.[name] ?? name];
   let rest = args;
+  if (command === undefined && level.lazy.length > 0) {
+    level = await expand(level, [...level.path.slice(1), ...argv]);
+    command = level.commands[level.aliases?.[name] ?? name];
+  }
   if (command === undefined && level.defaultCommand !== undefined) {
     command = level.commands[level.defaultCommand];
     rest = argv;
@@ -650,7 +708,7 @@ async function dispatch(level, typed, { version, redact }) {
   }
   if ("commands" in command) {
     const { summary } = command;
-    return dispatch({ path: [...level.path, name], header: (colors) => `${colors.bold(`${prefix} ${name}`)}  ${summary}`, summary, commands: command.commands, aliases: command.aliases, defaultCommand: undefined, examples: command.examples, replaces: undefined }, rest, { version, redact });
+    return dispatch({ path: [...level.path, name], header: (colors, text) => `${colors.bold(`${prefix} ${name}`)}  ${text}`, summary, ...scopeOf(command.commands, command.extraCommands, command.aliases), defaultCommand: undefined, examples: command.examples, replaces: undefined }, rest, { version, redact });
   }
   try {
     return await command.run(rest);
@@ -675,18 +733,24 @@ async function optionsOf(run) {
 async function leafCandidates(run, words) {
   if (!(words.at(-1) ?? "").startsWith("-"))
     return [FILES];
-  return Object.entries(await optionsOf(run)).map(([name, option]) => `--${name}	${option.description}`);
+  return Object.entries(await optionsOf(run)).map(([name, option]) => option.description === undefined ? `--${name}` : `--${name}	${option.description}`);
 }
-async function candidates(commands, aliases, defaultCommand, words) {
+async function candidates(scope, defaultCommand, words, before = []) {
   const [word = "", ...rest] = words;
-  const command = commands[aliases?.[word] ?? word];
-  if (rest.length === 0 && !word.startsWith("-"))
-    return Object.entries(commands).map(([name, { summary }]) => `${name}	${summary}`);
+  const listing = rest.length === 0 && !word.startsWith("-");
+  let { commands, aliases } = scope;
+  let command = commands[aliases?.[word] ?? word];
+  if (listing || command === undefined) {
+    ({ commands, aliases } = await expand(scope, [...before, ...words]));
+    command = commands[aliases?.[word] ?? word];
+  }
+  if (listing)
+    return Promise.all(Object.entries(commands).map(async ([name, { summary }]) => `${name}	${await resolveSummary(summary)}`));
   if (command === undefined) {
     const fallback = defaultCommand === undefined ? undefined : commands[defaultCommand];
     return fallback !== undefined && "run" in fallback ? leafCandidates(fallback.run, words) : [];
   }
-  return "commands" in command ? candidates(command.commands, command.aliases, undefined, rest) : leafCandidates(command.run, rest);
+  return "commands" in command ? candidates(scopeOf(command.commands, command.extraCommands, command.aliases), undefined, rest, [...before, word]) : leafCandidates(command.run, rest);
 }
 async function printCandidates(found) {
   for (const line of await found)
@@ -695,8 +759,8 @@ async function printCandidates(found) {
 }
 async function runCli(cli, argv = process5.argv.slice(2)) {
   if (argv[0] === COMPLETE)
-    return printCandidates(candidates(cli.commands, cli.aliases, cli.defaultCommand, argv.slice(1)));
-  return dispatch({ path: [cli.name], header: (colors) => `${colors.bold(cli.name)} ${colors.dim(cli.version)}  ${cli.about}`, summary: cli.about, commands: cli.commands, aliases: cli.aliases, defaultCommand: cli.defaultCommand, examples: cli.examples, replaces: cli.replaces }, argv, { version: cli.version, redact: cli.redact });
+    return printCandidates(candidates(scopeOf(cli.commands, cli.extraCommands, cli.aliases), cli.defaultCommand, argv.slice(1)));
+  return dispatch({ path: [cli.name], header: (colors, about) => `${colors.bold(cli.name)} ${colors.dim(cli.version)}  ${about}`, summary: cli.about, ...scopeOf(cli.commands, cli.extraCommands, cli.aliases), defaultCommand: cli.defaultCommand, examples: cli.examples, replaces: cli.replaces }, argv, { version: cli.version, redact: cli.redact });
 }
 async function runMain({ name, version, run, redact }, argv = process5.argv.slice(2)) {
   if (argv[0] === COMPLETE)
@@ -711,11 +775,21 @@ async function runMain({ name, version, run, redact }, argv = process5.argv.slic
     return reportThrown(name, error, redact, wantsJson(argv));
   }
 }
+// ../kit/src/logs.ts
+var DAY_MS = 24 * 60 * 60 * 1000;
+// ../kit/src/secrets.ts
+var SECRET_PART = /token|secret|passw|credential|private|dsn|apikey|accesskey|key$/i;
+var SECRET_WORDS = new Set(["key", "pass", "pwd", "auth", "salt", "cookie", "session", "jwt", "ssn", "iban", "card", "cvv", "otp"]);
+var WORD_BREAKS = /[^a-zA-Z\d]+|(?<=[a-z\d])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/;
+function isSecretName(name) {
+  return SECRET_PART.test(name) || name.split(WORD_BREAKS).some((word) => SECRET_WORDS.has(word.toLowerCase()));
+}
 // package.json
-var version = "0.5.0";
+var version = "0.7.0";
 
 // src/files.ts
-import { readdir } from "fs/promises";
+import { chmod, chown, readdir, realpath, rename, rm, stat, writeFile } from "fs/promises";
+import { basename, dirname, join } from "path";
 
 // src/dotenv.ts
 var ASSIGNMENT = /^\s*(?:export\s+)?([A-Z_][\w.-]*)\s*=(.*)$/i;
@@ -723,7 +797,9 @@ var EXPORTED = /^\s*export\s/;
 var INLINE_COMMENT = /\s+#.*$/;
 var CARRIAGE_RETURN = /\r$/;
 var ESCAPES = { n: `
-`, r: "\r", t: "\t", '"': '"', "\\": "\\" };
+`, r: "\r", t: "\t", '"': '"', "\\": "\\", $: "$" };
+var LINE_BREAK = /[\r\n]/;
+var RAW_ONLY = /["\\]/;
 var NEEDS_QUOTES = /[\s#"'\\$`]/;
 function closingQuote(text, quote) {
   for (let index = 0;index < text.length; index++) {
@@ -734,6 +810,9 @@ function closingQuote(text, quote) {
   }
   return -1;
 }
+function unescapeDollar(text) {
+  return text.replaceAll("\\$", "$");
+}
 function unescapeDouble(text) {
   let out = "";
   for (let index = 0;index < text.length; index++) {
@@ -762,7 +841,7 @@ function parseDotenv(text) {
     const start = rest.trimStart();
     const quote = start[0];
     if (quote !== '"' && quote !== "'" && quote !== "`") {
-      lines.push({ raw: line, key, value: start.replace(INLINE_COMMENT, "").trim() });
+      lines.push({ raw: line, key, value: unescapeDollar(start.replace(INLINE_COMMENT, "").trim()) });
       continue;
     }
     let body = start.slice(1);
@@ -777,7 +856,7 @@ ${physical[index] ?? ""}`;
       end = closingQuote(body, quote);
     }
     const inner = end === -1 ? body : body.slice(0, end);
-    lines.push({ raw, key, value: quote === '"' ? unescapeDouble(inner) : inner });
+    lines.push({ raw, key, value: quote === '"' ? unescapeDouble(inner) : unescapeDollar(inner) });
   }
   return { lines };
 }
@@ -796,8 +875,10 @@ function entries(file) {
 function formatAssignment(key, value) {
   if (value === "" || !NEEDS_QUOTES.test(value))
     return `${key}=${value}`;
+  if (RAW_ONLY.test(value) && !value.includes("'") && !LINE_BREAK.test(value))
+    return `${key}='${value.replaceAll("$", "\\$")}'`;
   const escaped = value.replaceAll("\\", "\\\\").replaceAll('"', "\\\"").replaceAll("\r", "\\r").replaceAll(`
-`, "\\n");
+`, "\\n").replaceAll("$", "\\$");
   return `${key}="${escaped}"`;
 }
 function setLine(file, key, value, raw) {
@@ -827,51 +908,137 @@ function lastLine(file, key) {
 }
 
 // src/mask.ts
-var MIN_KNOWN_LENGTH = 6;
-var SECRET_KEY = /TOKEN|SECRET|PASSWORD|KEY|PRIVATE|DSN/i;
-var URL_PASSWORD = /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]*:([^\s@/]+)@/dgi;
+var MIN_KNOWN_LENGTH = 4;
+var KEY_MASK = "*** private key redacted ***";
+var PLAIN_VALUE = /^(?:true|false|null|none|nil|yes|no|on|off|undefined)$/i;
+var PLACEHOLDER = /^[$%{<(*/]/;
+var URL_PASSWORD = /(?<![a-z0-9+.-])[a-z][a-z0-9+.-]{0,31}:\/\/[^\s:/@]*:([^\s'"]{1,1024})@/dgi;
+var PORT = /^\d{1,5}$/;
 var ESCAPE2 = /[.*+?^${}()|[\]\\]/g;
+function isPlaceholder(value) {
+  return PLACEHOLDER.test(value) || PLAIN_VALUE.test(value);
+}
 var TOKEN_FORMATS = [
-  ["GitHub token", /\b(?:gh[pousr]_|github_pat_)\w{20,}/g],
-  ["GitLab token", /\bglpat-[\w-]{20,}/g],
-  ["API key", /\bsk-[\w-]{20,}/g],
-  ["Slack token", /\bxox[abprs]-[\w-]{10,}/g],
-  ["JWT", /\beyJ[\w-]+\.[\w-]+\.[\w-]+/g]
+  { kind: "GitHub token", pattern: /\b(?:gh[pousr]_|github_pat_)\w{20,}/dg },
+  { kind: "GitLab token", pattern: /\bglpat-[\w-]{20,}/dg },
+  { kind: "API key", pattern: /\bsk-[\w-]{20,}/dg },
+  { kind: "Slack token", pattern: /\bx(?:ox[abprs]|app)-[\w-]{10,}/dg },
+  { kind: "JWT", pattern: /\beyJ[\w-]+\.[\w-]+\.[\w-]+/dg },
+  { kind: "AWS access key", pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/dg },
+  { kind: "npm token", pattern: /\bnpm_[A-Za-z0-9]{30,}/dg },
+  { kind: "Stripe key", pattern: /\b[sr]k_(?:live|test)_[A-Za-z0-9]{10,}/dg },
+  { kind: "Google API key", pattern: /\bAIza[\w-]{35}/dg },
+  { kind: "SendGrid key", pattern: /\bSG\.[\w-]{16,}\.[\w-]{16,}/dg },
+  { kind: "Authorization header", pattern: /\bAuthorization["']?\s*[:=]\s*["']?(?:Bearer|Basic|Token|Digest)\s+([^\s"',;]{8,})/dgi, skip: isPlaceholder },
+  { kind: "Bearer token", pattern: /\bBearer\s+((?=[\w.~+/=-]*\d)[\w.~+/=-]{20,})/dg },
+  { kind: "password", pattern: /(?<![\w-])(?:[\w-]{0,30}[_-])?(?:password|passwd|secret|api[_-]?key)(?:[_-][\w-]{0,30})?=([^\s"'&;,]{4,})/dgi, skip: isPlaceholder },
+  { kind: "password", pattern: /(?<![\w-])["']?(?:[\w-]{0,30}[_-])?(?:password|passwd|secret|api[_-]?key)(?:[_-][\w-]{0,30})?["']?\s*[:=]\s*(["'])((?:\\.|(?!\1)[^\\\n]){4,})\1/dgi, skip: isPlaceholder }
 ];
-var PEM_BEGIN = /-----BEGIN [A-Z ]*PRIVATE KEY-----/;
-var PEM_END = /-----END [A-Z ]*PRIVATE KEY-----/;
-function isSecretKey(key) {
-  return SECRET_KEY.test(key);
-}
+var PEM_BEGIN = /-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----/;
+var PEM_END = /-----END [A-Z ]*PRIVATE KEY(?: BLOCK)?-----/;
+var PEM_BODY = /(?<=-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----)(?:(?!-----END [A-Z ]*PRIVATE KEY(?: BLOCK)?-----)[\s\S])+/dg;
+var PEM_BEGIN_ALL = /-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----/g;
+var URL_PARTS = /(?<![a-z0-9+.-])[a-z][a-z0-9+.-]{0,31}:\/\/([^\s/?#'"<>`]*)([^\s?#'"<>`]*)(?:\?([^\s#'"<>`]*))?/dgi;
+var PATH_SEGMENT = /[^/]+/g;
+var SECRET_PARAM = /^(?:token|[a-z]+_token|key|api[_-]?key|access[_-]?key|secret|[a-z]+_secret|password|passwd|pwd|sig|signature|auth|authorization)$/i;
+var WEBHOOK_FORMATS = [
+  ["Discord webhook", /(?:^|\.)discord(?:app)?\.com\/api\/(?:v\d+\/)?webhooks\/\d+\/([\w-]+)/di],
+  ["Slack webhook", /^hooks\.slack\.com\/(?:services|workflows)\/(?:[\w-]+\/)*([\w-]+)/di],
+  ["Uptime Kuma push URL", /\/api\/push\/([\w-]+)/di],
+  ["healthchecks.io ping URL", /^hc-ping\.com\/([\w-]+)/di]
+];
+var OPAQUE_SEGMENT = /^(?:(?=[\w-]{20,}$)(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[\w-]+|(?=[A-Za-z\d]{32,}$)(?=.*[A-Za-z])(?=.*\d).+)$/;
 function hint(value) {
   const shown = Math.min(3, Math.floor(value.length / 4));
   return `${value.slice(0, shown)}***(${value.length})`;
 }
+function forms(value) {
+  return [...new Set([value, encodeURIComponent(value), JSON.stringify(value).slice(1, -1)])];
+}
 function knownSecrets(pairs) {
   const keys = new Map;
   for (const [key, value] of pairs) {
-    if (value.length >= MIN_KNOWN_LENGTH && !keys.has(value))
-      keys.set(value, key);
+    if (value.length < MIN_KNOWN_LENGTH || PLAIN_VALUE.test(value))
+      continue;
+    for (const form of forms(value)) {
+      if (!keys.has(form))
+        keys.set(form, key);
+    }
   }
   if (keys.size === 0)
     return { pattern: undefined, keys };
   const alternatives = [...keys.keys()].sort((a, b) => b.length - a.length).map((value) => value.replace(ESCAPE2, "\\$&"));
   return { pattern: new RegExp(`(?<!\\w)(?:${alternatives.join("|")})(?!\\w)`, "g"), keys };
 }
+function passwordSpans(text) {
+  const spans = [];
+  for (const url of text.matchAll(URL_PASSWORD)) {
+    const [start, end] = url.indices?.[1] ?? [];
+    const password = url[1] ?? "";
+    const slash = password.indexOf("/");
+    if (start !== undefined && end !== undefined && !(slash !== -1 && PORT.test(password.slice(0, slash))))
+      spans.push([start, end]);
+  }
+  return spans;
+}
 function urlPasswords(text) {
-  return [...text.matchAll(URL_PASSWORD)].flatMap((url) => url[1] ?? []);
+  return passwordSpans(text).map(([start, end]) => text.slice(start, end));
+}
+function urlTokens(line) {
+  const found = [];
+  const add = (kind, start, value) => {
+    found.push({ start, end: start + value.length, kind, mask: hint(value) });
+  };
+  for (const url of line.matchAll(URL_PARTS)) {
+    const [authority, path = "", query] = [url[1] ?? "", url[2] ?? "", url[3]];
+    const authorityStart = url.indices?.[1]?.[0];
+    const pathStart = url.indices?.[2]?.[0];
+    const queryStart = url.indices?.[3]?.[0];
+    if (authorityStart === undefined || pathStart === undefined)
+      continue;
+    const hostAt = authority.lastIndexOf("@") + 1;
+    const target = authority.slice(hostAt) + path;
+    for (const [kind, pattern] of WEBHOOK_FORMATS) {
+      const [start, end] = pattern.exec(target)?.indices?.[1] ?? [];
+      if (start !== undefined && end !== undefined)
+        add(kind, authorityStart + hostAt + start, target.slice(start, end));
+    }
+    for (const segment of path.matchAll(PATH_SEGMENT)) {
+      if (OPAQUE_SEGMENT.test(segment[0]))
+        add("URL token", pathStart + segment.index, segment[0]);
+    }
+    if (query === undefined || queryStart === undefined)
+      continue;
+    let offset = 0;
+    for (const param of query.split("&")) {
+      const equals = param.indexOf("=");
+      if (equals > 0 && equals < param.length - 1 && SECRET_PARAM.test(param.slice(0, equals)))
+        add("URL token", queryStart + offset + equals + 1, param.slice(equals + 1));
+      offset += param.length + 1;
+    }
+  }
+  return found.filter((match) => match.end > match.start);
 }
 function findSecrets(line, known) {
   const found = [];
-  for (const url of line.matchAll(URL_PASSWORD)) {
-    const [start, end] = url.indices?.[1] ?? [];
+  for (const [start, end] of passwordSpans(line))
+    found.push({ start, end, kind: "URL password", mask: "***" });
+  for (const body of line.matchAll(PEM_BODY)) {
+    const [start, end] = body.indices?.[0] ?? [];
     if (start !== undefined && end !== undefined)
-      found.push({ start, end, kind: "URL password", mask: "***" });
+      found.push({ start, end, kind: "private key", mask: KEY_MASK });
   }
-  for (const [kind, pattern] of TOKEN_FORMATS) {
-    for (const token of line.matchAll(pattern))
-      found.push({ start: token.index, end: token.index + token[0].length, kind, mask: hint(token[0]) });
+  for (const { kind, pattern, skip } of TOKEN_FORMATS) {
+    for (const token of line.matchAll(pattern)) {
+      const [start, end] = token.indices?.at(-1) ?? [];
+      if (start === undefined || end === undefined)
+        continue;
+      const value = line.slice(start, end);
+      if (!skip?.(value))
+        found.push({ start, end, kind, mask: hint(value) });
+    }
   }
+  found.push(...urlTokens(line));
   if (known?.pattern !== undefined) {
     for (const value of line.matchAll(known.pattern))
       found.push({ start: value.index, end: value.index + value[0].length, kind: `value of ${known.keys.get(value[0])}`, mask: hint(value[0]) });
@@ -884,6 +1051,13 @@ function findSecrets(line, known) {
   }
   return kept;
 }
+function openKeyBody(line) {
+  const last = [...line.matchAll(PEM_BEGIN_ALL)].at(-1);
+  if (last === undefined)
+    return;
+  const after = line.slice(last.index + last[0].length);
+  return PEM_END.test(after) ? undefined : after.trim();
+}
 function maskLine(line, known) {
   let out = "";
   let at = 0;
@@ -893,18 +1067,38 @@ function maskLine(line, known) {
   }
   return out + line.slice(at);
 }
-function maskValue(key, value) {
+function maskValue(key, value, known) {
   if (value === "")
     return value;
-  return isSecretKey(key) || PEM_BEGIN.test(value) ? hint(value) : maskLine(value);
+  return isSecretName(key) || PEM_BEGIN.test(value) ? hint(value) : maskLine(value, known);
 }
 
 // src/files.ts
-var ENV_FILE = /^\.env(?:\..+)?$/;
+var ENV_FILE = /^(?:\.env(?:\..+)?|.+\.env|\.envrc)$/;
 var TEMPLATE = /\.(?:example|sample|template|dist|defaults)$/;
+var KNOWN_DEPTH = 3;
+var SKIPPED = new Set(["node_modules", ".git", "vendor"]);
+var LOCK_WAIT_MS = 5000;
+var LOCK_STALE_MS = 30000;
+async function isFileEntry(entry, path) {
+  if (entry.isFile())
+    return true;
+  if (!entry.isSymbolicLink())
+    return false;
+  try {
+    return (await stat(path)).isFile();
+  } catch {
+    return false;
+  }
+}
 async function envFiles(folder = process.cwd()) {
   const found = await readdir(folder, { withFileTypes: true });
-  return found.filter((entry) => entry.isFile() && ENV_FILE.test(entry.name)).map((entry) => entry.name).sort();
+  const names = [];
+  for (const entry of found) {
+    if (ENV_FILE.test(entry.name) && await isFileEntry(entry, join(folder, entry.name)))
+      names.push(entry.name);
+  }
+  return names.sort();
 }
 async function readEnv(path) {
   const file = Bun.file(path);
@@ -912,18 +1106,109 @@ async function readEnv(path) {
     fail(`${path} does not exist`);
   return parseDotenv(await file.text());
 }
+async function writeAtomic(path, text) {
+  let target = path;
+  let mode = 384;
+  let owner;
+  try {
+    target = await realpath(path);
+    const current = await stat(target);
+    mode = current.mode & 511;
+    owner = current;
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      throw error;
+  }
+  const temp = join(dirname(target), `.${basename(target)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+  try {
+    await writeFile(temp, text, { mode: 384, flag: "wx" });
+    if (owner !== undefined)
+      await keepOwner(temp, owner);
+    await chmod(temp, mode);
+    await rename(temp, target);
+  } finally {
+    await rm(temp, { force: true });
+  }
+}
+async function keepOwner(path, owner) {
+  try {
+    await chown(path, owner.uid, owner.gid);
+  } catch (error) {
+    if (error.code !== "EPERM")
+      throw error;
+  }
+}
 async function writeEnv(path, file) {
-  await Bun.write(path, serializeDotenv(file));
+  await writeAtomic(path, serializeDotenv(file));
 }
-async function loadKnown(folder = process.cwd()) {
-  const pairs = [];
-  for (const name of await envFiles(folder)) {
-    for (const [key, value] of entries(parseDotenv(await Bun.file(`${folder}/${name}`).text()))) {
-      if (isSecretKey(key))
-        pairs.push([key, value]);
-      else
-        pairs.push(...urlPasswords(value).map((password) => [key, password]));
+async function withLocks(paths, fn) {
+  const held = [];
+  try {
+    for (const path of [...new Set(paths)].sort())
+      held.push(await acquire(path));
+    return await fn();
+  } finally {
+    for (const lock of held)
+      await rm(lock, { force: true });
+  }
+}
+async function acquire(path) {
+  let real = path;
+  try {
+    real = await realpath(path);
+  } catch {}
+  const lock = join(dirname(real), `.${basename(real)}.lock`);
+  const deadline = Date.now() + LOCK_WAIT_MS;
+  while (true) {
+    try {
+      await writeFile(lock, String(process.pid), { flag: "wx", mode: 384 });
+      return lock;
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
     }
+    try {
+      if (Date.now() - (await stat(lock)).mtimeMs > LOCK_STALE_MS)
+        await rm(lock, { force: true });
+    } catch {}
+    if (Date.now() > deadline)
+      fail(`${path} is locked by another ev run (${lock})`, 1);
+    await Bun.sleep(25);
+  }
+}
+function secretPairs(file) {
+  const pairs = [];
+  for (const [key, value] of entries(file)) {
+    if (isSecretName(key))
+      pairs.push([key, value]);
+    else
+      pairs.push(...urlPasswords(value).map((password) => [key, password]));
+  }
+  return pairs;
+}
+async function envFilesBelow(folder, depth = 0) {
+  const found = [];
+  let children;
+  try {
+    children = await readdir(folder, { withFileTypes: true });
+  } catch {
+    return found;
+  }
+  for (const entry of children) {
+    const path = join(folder, entry.name);
+    if (entry.isDirectory() && depth < KNOWN_DEPTH && !SKIPPED.has(entry.name))
+      found.push(...await envFilesBelow(path, depth + 1));
+    else if (ENV_FILE.test(entry.name) && await isFileEntry(entry, path))
+      found.push(path);
+  }
+  return found;
+}
+async function loadKnown(folder = process.cwd(), extra = []) {
+  const pairs = extra.flatMap(secretPairs);
+  for (const path of await envFilesBelow(folder)) {
+    try {
+      pairs.push(...secretPairs(parseDotenv(await Bun.file(path).text())));
+    } catch {}
   }
   return knownSecrets(pairs);
 }
@@ -932,6 +1217,8 @@ async function loadKnown(folder = process.cwd()) {
 var DIFF_START = /^(?:diff --git |@@ )/;
 var NEW_FILE = /^\+\+\+ (?:b\/)?(.+)$/;
 var HUNK = /^@@ -\d+(?:,\d+)? \+(\d+)/;
+var MAX_PENDING = 1 << 18;
+var OVERLAP = 1 << 13;
 
 class Redactor {
   known;
@@ -942,17 +1229,26 @@ class Redactor {
     this.known = known;
   }
   push(chunk) {
-    this.pending += chunk;
-    const end = this.pending.lastIndexOf(`
+    const end = chunk.lastIndexOf(`
 `);
+    this.pending += chunk;
     if (end === -1)
-      return "";
-    const complete = this.pending.slice(0, end + 1);
-    this.pending = this.pending.slice(end + 1);
+      return this.pending.length > MAX_PENDING ? this.cut() : "";
+    const split = this.pending.length - chunk.length + end + 1;
+    const complete = this.pending.slice(0, split);
+    this.pending = this.pending.slice(split);
     return complete.split(`
 `).slice(0, -1).map((line) => this.line(line)).filter((line) => line !== undefined).map((line) => `${line}
 `).join("");
   }
+  cut() {
+    const limit = this.pending.length - OVERLAP;
+    const space = this.pending.lastIndexOf(" ", limit);
+    const at = space > 0 ? space + 1 : limit;
+    const head = this.pending.slice(0, at);
+    this.pending = this.pending.slice(at);
+    return this.line(head) ?? "";
+  }
   end() {
     const rest = this.pending;
     this.pending = "";
@@ -960,19 +1256,20 @@ class Redactor {
   }
   line(line) {
     if (this.inKey) {
-      if (PEM_END.test(line)) {
-        this.inKey = false;
-        return line;
+      const end = PEM_END.exec(line);
+      if (end === null) {
+        if (this.hidden)
+          return;
+        this.hidden = true;
+        return KEY_MASK;
       }
-      if (this.hidden)
-        return;
-      this.hidden = true;
-      return "*** private key redacted ***";
+      this.inKey = false;
+      return (end.index > 0 && !this.hidden ? KEY_MASK : "") + this.line(line.slice(end.index));
     }
-    if (PEM_BEGIN.test(line)) {
-      this.inKey = !PEM_END.test(line);
-      this.hidden = false;
-      return line;
+    const body = openKeyBody(line);
+    if (body !== undefined) {
+      this.inKey = true;
+      this.hidden = body !== "";
     }
     return maskLine(line, this.known);
   }
@@ -1012,15 +1309,21 @@ function check(text, known) {
       number = index + 1;
     }
     if (inKey) {
-      inKey = !PEM_END.test(line);
-      continue;
+      const end = PEM_END.exec(line);
+      inKey = end === null;
+      if (end === null)
+        continue;
+      line = line.slice(end.index);
     }
-    if (PEM_BEGIN.test(line)) {
-      inKey = !PEM_END.test(line);
-      findings.push({ file, line: number, kind: "private key" });
+    const found = findSecrets(line, known).map((match) => match.kind);
+    const body = openKeyBody(line);
+    if (body !== undefined) {
+      inKey = true;
+      if (body === "")
+        found.push("private key");
     }
-    for (const match of findSecrets(line, known))
-      findings.push({ file, line: number, kind: match.kind });
+    for (const kind of found)
+      findings.push({ file, line: number, kind });
   }
   return findings;
 }
@@ -1028,7 +1331,7 @@ function check(text, known) {
 // src/redact.ts
 var usage = `redact [--check]
 
-Copies stdin to stdout line by line with secrets masked: known token formats (ghp_, github_pat_, glpat-, sk-, xox?-, JWTs), private key blocks, the password of any URL and the values of secret-looking keys in this folder's .env* files.
+Copies stdin to stdout line by line with secrets masked: known token formats (GitHub, GitLab, Slack, AWS, npm, Stripe, Google and SendGrid keys, sk-, JWTs, Authorization headers, password= and secret= pairs), private key blocks, the password and the tokens of any URL and the values of secret-looking keys in this folder's .env* files.
 --check prints nothing of the input and lists the file and line of each secret found, exiting 1 when there is any: \`git diff --cached | redact --check\`.
 
 Exits 0 when it copied the input or found no secret, 1 when --check finds one, 2 on a usage error.`;