@kaynooo/env-tools 0.6.0 → 0.7.0

package/README.md

@@ -20,10 +20,11 @@ bun install -g @kaynooo/env-tools
 | `ev mv KEY --from <file> --to <file>` | moves a key's line as written, `--force` to replace one the target has |
 | `ev diff <a> <b>` | names the keys set in one file and not the other, exit 1 when they differ |
 | `ev missing [file]` | names the keys of `.env.example` (`--against`) that the file lacks, exit 1 when some are |
+| `ev pins [dir]` | checks an app's tests pin the env that reaches outside: lists the optional URL, key, token, secret, password and host variables of its `defineEnv` schema that no `.env.test` entry, test `overrideEnv` or local bunfig preload dropping what `.env` sets pins, and each test file calling `testSite` or `proxyKeyTests` without pinning them (`// ev pins: none reached, <why>` exempts one), names only, exit 1 when something is unpinned |
 | `ev audit [dir...]` | lists the `.env` files any account can read or git tracks, and the compose files any account can read that write a secret or URL password out, with the fix for each, exit 1 when it finds one |
 | `ev audit --fix [dir...]` | moves each secret a listed compose file writes out into the `.env` beside it as `${KEY}` (a key the `.env` sets to another value stays put), puts it back when `docker compose config` resolves differently, and shuts other accounts out of both files and of every listed `.env`; exit 1 when something is left |
 
-A value is masked when its key looks like `TOKEN|SECRET|PASSWORD|KEY|PRIVATE|DSN`, when it is a private key, or in the password part of any URL (`postgres://user:***@host/db`) and any known token format. A URL is also masked where it carries a token, whatever its key is named: the last segment of a Discord, Slack, Uptime Kuma push or healthchecks.io ping URL, any path segment of 20 or more characters of `A-Za-z0-9_-` mixing lowercase, uppercase and digits, any path segment of 32 or more letters and digits of any case (hex, base32, dashless UUIDs), and the value of a query parameter named `token`, `key`, `apikey`, `secret`, `password`, `sig`, `signature`, `auth` or ending in `_token` or `_secret`; the host and the rest of the URL stay readable. A masked value keeps a few leading characters and its length (`ghp***(40)`) so two values can be told apart. There is no flag that prints a secret unmasked.
+A value is masked when its key is named like a secret (`TOKEN`, `SECRET`, `PASSWORD`, `PASS`, `PWD`, `KEY`, `PRIVATE`, `DSN`, `AUTH`, `SALT`, `COOKIE`, `CREDENTIALS`, the definition `isSecretName` of `@kaynooo/cli-kit` that `db` shares), when it equals a secret value of the folder's `.env*` files whatever its own key, when it is a private key (PEM or PGP, also escaped on one line), or in the password part of any URL (`postgres://user:***@host/db`) and any known token format (GitHub, GitLab, Slack, AWS, npm, Stripe, Google, SendGrid, `sk-`, JWTs, `Authorization` credentials and `password=`/`secret=` pairs). A URL is also masked where it carries a token, whatever its key is named: the last segment of a Discord, Slack, Uptime Kuma push or healthchecks.io ping URL, any path segment of 20 or more characters of `A-Za-z0-9_-` mixing lowercase, uppercase and digits, any path segment of 32 or more letters and digits of any case (hex, base32, dashless UUIDs), and the value of a query parameter named `token`, `key`, `apikey`, `secret`, `password`, `sig`, `signature`, `auth` or ending in `_token` or `_secret`; the host and the rest of the URL stay readable. A masked value keeps a few leading characters and its length (`ghp***(40)`) so two values can be told apart. There is no flag that prints a secret unmasked.
 
 Files are parsed and written back preserving comments, order, `export KEY=` prefixes, quoting and multiline values; only the lines a command touches change.
 
@@ -38,7 +39,7 @@ git diff --cached | redact --check
 
 - known token formats: `ghp_`, `github_pat_`, `glpat-`, `sk-`, `xox?-`, JWTs and the body of PEM private key blocks
 - the password and the tokens of any URL (webhook and push URLs, opaque path segments, token query parameters)
-- the values of secret-looking keys in the `.env*` files of the current folder (whole words only, from 6 characters), `--no-env` skips them
+- the values of secret-looking keys in the `.env*` files of the current folder and the folders below it (whole words only, from 4 characters, also in their percent-encoded and JSON-escaped forms), `--no-env` skips them
 
 `redact --check` prints nothing of the input: it lists `<file>:<line>: <kind>` for each secret found and exits 1. On a diff it reads the added lines only and names the new file's line numbers.