@kaynooo/env-tools 0.6.0 → 0.7.0

package/dist/redact.js

@@ -276,12 +276,27 @@ function le(i = {}) {
 var t = le();
 
 // ../kit/src/style.ts
+var MARKS = {
+  ok: { symbol: "\u2713", word: "ok:", paint: (colors) => colors.green },
+  warn: { symbol: "!", word: "warning:", paint: (colors) => colors.yellow },
+  problem: { symbol: "\u2717", word: "error:", paint: (colors) => colors.red },
+  note: { symbol: "\xB7", word: "note:", paint: (colors) => colors.dim }
+};
 function takesControlCodes(stream, env = process2.env) {
   return stream.isTTY === true && env.NO_COLOR === undefined && env.NODE_DISABLE_COLORS === undefined && env.TERM !== "dumb";
 }
 function paint(stream, env = process2.env) {
   return le({ stream: { isTTY: takesControlCodes(stream, env) }, env });
 }
+function marked(mark, text, stream, detail, env = process2.env) {
+  const colors = paint(stream, env);
+  const { symbol, word, paint: tint } = MARKS[mark];
+  const head = takesControlCodes(stream, env) ? tint(colors)(symbol) : word;
+  return `${head} ${text}${detail === undefined ? "" : ` ${colors.dim(detail)}`}`;
+}
+function ok(text, detail) {
+  console.log(marked("ok", text, process2.stdout, detail));
+}
 var STATUSES = {
   passed: { symbol: "\u2713", words: ["passed", "success", "succeeded", "ok"], paint: (colors) => colors.green },
   failed: { symbol: "\u2717", words: ["failed", "failure", "error", "errored"], paint: (colors) => colors.red },
@@ -549,6 +564,11 @@ async function readInput(path, { noStdin = "nothing is piped on stdin" } = {}) {
     fail(`no file ${path}`);
   return file.text();
 }
+// ../kit/src/progress.ts
+var ESC = String.fromCharCode(27);
+var ESCAPE_CODE = new RegExp(`${ESC}(?:\\[[\\x30-\\x3F]*[\\x20-\\x2F]*[\\x40-\\x7E]|\\][^\\u0007${ESC}]*(?:\\u0007|${ESC}\\\\))`, "y");
+var RESET_STYLE = `${ESC}[0m`;
+var CLOSE_LINK = `${ESC}]8;;${ESC}\\`;
 // ../kit/src/cli.ts
 import process5 from "process";
 var LEVEL_OPTIONS = {
@@ -755,11 +775,20 @@ async function runMain({ name, version, run, redact }, argv = process5.argv.slic
     return reportThrown(name, error, redact, wantsJson(argv));
   }
 }
+// ../kit/src/logs.ts
+var DAY_MS = 24 * 60 * 60 * 1000;
+// ../kit/src/secrets.ts
+var SECRET_PART = /token|secret|passw|credential|private|dsn|apikey|accesskey|key$/i;
+var SECRET_WORDS = new Set(["key", "pass", "pwd", "auth", "salt", "cookie", "session", "jwt", "ssn", "iban", "card", "cvv", "otp"]);
+var WORD_BREAKS = /[^a-zA-Z\d]+|(?<=[a-z\d])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/;
+function isSecretName(name) {
+  return SECRET_PART.test(name) || name.split(WORD_BREAKS).some((word) => SECRET_WORDS.has(word.toLowerCase()));
+}
 // package.json
-var version = "0.6.0";
+var version = "0.7.0";
 
 // src/files.ts
-import { chmod, readdir, realpath, rename, rm, stat, writeFile } from "fs/promises";
+import { chmod, chown, readdir, realpath, rename, rm, stat, writeFile } from "fs/promises";
 import { basename, dirname, join } from "path";
 
 // src/dotenv.ts
@@ -768,7 +797,9 @@ var EXPORTED = /^\s*export\s/;
 var INLINE_COMMENT = /\s+#.*$/;
 var CARRIAGE_RETURN = /\r$/;
 var ESCAPES = { n: `
-`, r: "\r", t: "\t", '"': '"', "\\": "\\" };
+`, r: "\r", t: "\t", '"': '"', "\\": "\\", $: "$" };
+var LINE_BREAK = /[\r\n]/;
+var RAW_ONLY = /["\\]/;
 var NEEDS_QUOTES = /[\s#"'\\$`]/;
 function closingQuote(text, quote) {
   for (let index = 0;index < text.length; index++) {
@@ -779,6 +810,9 @@ function closingQuote(text, quote) {
   }
   return -1;
 }
+function unescapeDollar(text) {
+  return text.replaceAll("\\$", "$");
+}
 function unescapeDouble(text) {
   let out = "";
   for (let index = 0;index < text.length; index++) {
@@ -807,7 +841,7 @@ function parseDotenv(text) {
     const start = rest.trimStart();
     const quote = start[0];
     if (quote !== '"' && quote !== "'" && quote !== "`") {
-      lines.push({ raw: line, key, value: start.replace(INLINE_COMMENT, "").trim() });
+      lines.push({ raw: line, key, value: unescapeDollar(start.replace(INLINE_COMMENT, "").trim()) });
       continue;
     }
     let body = start.slice(1);
@@ -822,7 +856,7 @@ ${physical[index] ?? ""}`;
       end = closingQuote(body, quote);
     }
     const inner = end === -1 ? body : body.slice(0, end);
-    lines.push({ raw, key, value: quote === '"' ? unescapeDouble(inner) : inner });
+    lines.push({ raw, key, value: quote === '"' ? unescapeDouble(inner) : unescapeDollar(inner) });
   }
   return { lines };
 }
@@ -841,8 +875,10 @@ function entries(file) {
 function formatAssignment(key, value) {
   if (value === "" || !NEEDS_QUOTES.test(value))
     return `${key}=${value}`;
+  if (RAW_ONLY.test(value) && !value.includes("'") && !LINE_BREAK.test(value))
+    return `${key}='${value.replaceAll("$", "\\$")}'`;
   const escaped = value.replaceAll("\\", "\\\\").replaceAll('"', "\\\"").replaceAll("\r", "\\r").replaceAll(`
-`, "\\n");
+`, "\\n").replaceAll("$", "\\$");
   return `${key}="${escaped}"`;
 }
 function setLine(file, key, value, raw) {
@@ -872,20 +908,38 @@ function lastLine(file, key) {
 }
 
 // src/mask.ts
-var MIN_KNOWN_LENGTH = 6;
-var SECRET_KEY = /TOKEN|SECRET|PASSWORD|KEY|PRIVATE|DSN/i;
-var URL_PASSWORD = /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]*:([^\s@/]+)@/dgi;
+var MIN_KNOWN_LENGTH = 4;
+var KEY_MASK = "*** private key redacted ***";
+var PLAIN_VALUE = /^(?:true|false|null|none|nil|yes|no|on|off|undefined)$/i;
+var PLACEHOLDER = /^[$%{<(*/]/;
+var URL_PASSWORD = /(?<![a-z0-9+.-])[a-z][a-z0-9+.-]{0,31}:\/\/[^\s:/@]*:([^\s'"]{1,1024})@/dgi;
+var PORT = /^\d{1,5}$/;
 var ESCAPE2 = /[.*+?^${}()|[\]\\]/g;
+function isPlaceholder(value) {
+  return PLACEHOLDER.test(value) || PLAIN_VALUE.test(value);
+}
 var TOKEN_FORMATS = [
-  ["GitHub token", /\b(?:gh[pousr]_|github_pat_)\w{20,}/g],
-  ["GitLab token", /\bglpat-[\w-]{20,}/g],
-  ["API key", /\bsk-[\w-]{20,}/g],
-  ["Slack token", /\bxox[abprs]-[\w-]{10,}/g],
-  ["JWT", /\beyJ[\w-]+\.[\w-]+\.[\w-]+/g]
+  { kind: "GitHub token", pattern: /\b(?:gh[pousr]_|github_pat_)\w{20,}/dg },
+  { kind: "GitLab token", pattern: /\bglpat-[\w-]{20,}/dg },
+  { kind: "API key", pattern: /\bsk-[\w-]{20,}/dg },
+  { kind: "Slack token", pattern: /\bx(?:ox[abprs]|app)-[\w-]{10,}/dg },
+  { kind: "JWT", pattern: /\beyJ[\w-]+\.[\w-]+\.[\w-]+/dg },
+  { kind: "AWS access key", pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/dg },
+  { kind: "npm token", pattern: /\bnpm_[A-Za-z0-9]{30,}/dg },
+  { kind: "Stripe key", pattern: /\b[sr]k_(?:live|test)_[A-Za-z0-9]{10,}/dg },
+  { kind: "Google API key", pattern: /\bAIza[\w-]{35}/dg },
+  { kind: "SendGrid key", pattern: /\bSG\.[\w-]{16,}\.[\w-]{16,}/dg },
+  { kind: "Authorization header", pattern: /\bAuthorization["']?\s*[:=]\s*["']?(?:Bearer|Basic|Token|Digest)\s+([^\s"',;]{8,})/dgi, skip: isPlaceholder },
+  { kind: "Bearer token", pattern: /\bBearer\s+((?=[\w.~+/=-]*\d)[\w.~+/=-]{20,})/dg },
+  { kind: "password", pattern: /(?<![\w-])(?:[\w-]{0,30}[_-])?(?:password|passwd|secret|api[_-]?key)(?:[_-][\w-]{0,30})?=([^\s"'&;,]{4,})/dgi, skip: isPlaceholder },
+  { kind: "password", pattern: /(?<![\w-])["']?(?:[\w-]{0,30}[_-])?(?:password|passwd|secret|api[_-]?key)(?:[_-][\w-]{0,30})?["']?\s*[:=]\s*(["'])((?:\\.|(?!\1)[^\\\n]){4,})\1/dgi, skip: isPlaceholder }
 ];
-var URL_PARTS = /\b[a-z][a-z0-9+.-]*:\/\/([^\s/?#'"<>`]*)([^\s?#'"<>`]*)(?:\?([^\s#'"<>`]*))?/dgi;
+var PEM_BEGIN = /-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----/;
+var PEM_END = /-----END [A-Z ]*PRIVATE KEY(?: BLOCK)?-----/;
+var PEM_BODY = /(?<=-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----)(?:(?!-----END [A-Z ]*PRIVATE KEY(?: BLOCK)?-----)[\s\S])+/dg;
+var PEM_BEGIN_ALL = /-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----/g;
+var URL_PARTS = /(?<![a-z0-9+.-])[a-z][a-z0-9+.-]{0,31}:\/\/([^\s/?#'"<>`]*)([^\s?#'"<>`]*)(?:\?([^\s#'"<>`]*))?/dgi;
 var PATH_SEGMENT = /[^/]+/g;
-var QUERY_PARAM = /([^&=]+)=([^&]*)/g;
 var SECRET_PARAM = /^(?:token|[a-z]+_token|key|api[_-]?key|access[_-]?key|secret|[a-z]+_secret|password|passwd|pwd|sig|signature|auth|authorization)$/i;
 var WEBHOOK_FORMATS = [
   ["Discord webhook", /(?:^|\.)discord(?:app)?\.com\/api\/(?:v\d+\/)?webhooks\/\d+\/([\w-]+)/di],
@@ -894,28 +948,41 @@ var WEBHOOK_FORMATS = [
   ["healthchecks.io ping URL", /^hc-ping\.com\/([\w-]+)/di]
 ];
 var OPAQUE_SEGMENT = /^(?:(?=[\w-]{20,}$)(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[\w-]+|(?=[A-Za-z\d]{32,}$)(?=.*[A-Za-z])(?=.*\d).+)$/;
-var PEM_BEGIN = /-----BEGIN [A-Z ]*PRIVATE KEY-----/;
-var PEM_END = /-----END [A-Z ]*PRIVATE KEY-----/;
-function isSecretKey(key) {
-  return SECRET_KEY.test(key);
-}
 function hint(value) {
   const shown = Math.min(3, Math.floor(value.length / 4));
   return `${value.slice(0, shown)}***(${value.length})`;
 }
+function forms(value) {
+  return [...new Set([value, encodeURIComponent(value), JSON.stringify(value).slice(1, -1)])];
+}
 function knownSecrets(pairs) {
   const keys = new Map;
   for (const [key, value] of pairs) {
-    if (value.length >= MIN_KNOWN_LENGTH && !keys.has(value))
-      keys.set(value, key);
+    if (value.length < MIN_KNOWN_LENGTH || PLAIN_VALUE.test(value))
+      continue;
+    for (const form of forms(value)) {
+      if (!keys.has(form))
+        keys.set(form, key);
+    }
   }
   if (keys.size === 0)
     return { pattern: undefined, keys };
   const alternatives = [...keys.keys()].sort((a, b) => b.length - a.length).map((value) => value.replace(ESCAPE2, "\\$&"));
   return { pattern: new RegExp(`(?<!\\w)(?:${alternatives.join("|")})(?!\\w)`, "g"), keys };
 }
+function passwordSpans(text) {
+  const spans = [];
+  for (const url of text.matchAll(URL_PASSWORD)) {
+    const [start, end] = url.indices?.[1] ?? [];
+    const password = url[1] ?? "";
+    const slash = password.indexOf("/");
+    if (start !== undefined && end !== undefined && !(slash !== -1 && PORT.test(password.slice(0, slash))))
+      spans.push([start, end]);
+  }
+  return spans;
+}
 function urlPasswords(text) {
-  return [...text.matchAll(URL_PASSWORD)].flatMap((url) => url[1] ?? []);
+  return passwordSpans(text).map(([start, end]) => text.slice(start, end));
 }
 function urlTokens(line) {
   const found = [];
@@ -942,24 +1009,34 @@ function urlTokens(line) {
     }
     if (query === undefined || queryStart === undefined)
       continue;
-    for (const param of query.matchAll(QUERY_PARAM)) {
-      const [name, value] = [param[1] ?? "", param[2] ?? ""];
-      if (value !== "" && SECRET_PARAM.test(name))
-        add("URL token", queryStart + param.index + name.length + 1, value);
+    let offset = 0;
+    for (const param of query.split("&")) {
+      const equals = param.indexOf("=");
+      if (equals > 0 && equals < param.length - 1 && SECRET_PARAM.test(param.slice(0, equals)))
+        add("URL token", queryStart + offset + equals + 1, param.slice(equals + 1));
+      offset += param.length + 1;
     }
   }
   return found.filter((match) => match.end > match.start);
 }
 function findSecrets(line, known) {
   const found = [];
-  for (const url of line.matchAll(URL_PASSWORD)) {
-    const [start, end] = url.indices?.[1] ?? [];
+  for (const [start, end] of passwordSpans(line))
+    found.push({ start, end, kind: "URL password", mask: "***" });
+  for (const body of line.matchAll(PEM_BODY)) {
+    const [start, end] = body.indices?.[0] ?? [];
     if (start !== undefined && end !== undefined)
-      found.push({ start, end, kind: "URL password", mask: "***" });
+      found.push({ start, end, kind: "private key", mask: KEY_MASK });
   }
-  for (const [kind, pattern] of TOKEN_FORMATS) {
-    for (const token of line.matchAll(pattern))
-      found.push({ start: token.index, end: token.index + token[0].length, kind, mask: hint(token[0]) });
+  for (const { kind, pattern, skip } of TOKEN_FORMATS) {
+    for (const token of line.matchAll(pattern)) {
+      const [start, end] = token.indices?.at(-1) ?? [];
+      if (start === undefined || end === undefined)
+        continue;
+      const value = line.slice(start, end);
+      if (!skip?.(value))
+        found.push({ start, end, kind, mask: hint(value) });
+    }
   }
   found.push(...urlTokens(line));
   if (known?.pattern !== undefined) {
@@ -974,6 +1051,13 @@ function findSecrets(line, known) {
   }
   return kept;
 }
+function openKeyBody(line) {
+  const last = [...line.matchAll(PEM_BEGIN_ALL)].at(-1);
+  if (last === undefined)
+    return;
+  const after = line.slice(last.index + last[0].length);
+  return PEM_END.test(after) ? undefined : after.trim();
+}
 function maskLine(line, known) {
   let out = "";
   let at = 0;
@@ -983,18 +1067,38 @@ function maskLine(line, known) {
   }
   return out + line.slice(at);
 }
-function maskValue(key, value) {
+function maskValue(key, value, known) {
   if (value === "")
     return value;
-  return isSecretKey(key) || PEM_BEGIN.test(value) ? hint(value) : maskLine(value);
+  return isSecretName(key) || PEM_BEGIN.test(value) ? hint(value) : maskLine(value, known);
 }
 
 // src/files.ts
-var ENV_FILE = /^\.env(?:\..+)?$/;
+var ENV_FILE = /^(?:\.env(?:\..+)?|.+\.env|\.envrc)$/;
 var TEMPLATE = /\.(?:example|sample|template|dist|defaults)$/;
+var KNOWN_DEPTH = 3;
+var SKIPPED = new Set(["node_modules", ".git", "vendor"]);
+var LOCK_WAIT_MS = 5000;
+var LOCK_STALE_MS = 30000;
+async function isFileEntry(entry, path) {
+  if (entry.isFile())
+    return true;
+  if (!entry.isSymbolicLink())
+    return false;
+  try {
+    return (await stat(path)).isFile();
+  } catch {
+    return false;
+  }
+}
 async function envFiles(folder = process.cwd()) {
   const found = await readdir(folder, { withFileTypes: true });
-  return found.filter((entry) => entry.isFile() && ENV_FILE.test(entry.name)).map((entry) => entry.name).sort();
+  const names = [];
+  for (const entry of found) {
+    if (ENV_FILE.test(entry.name) && await isFileEntry(entry, join(folder, entry.name)))
+      names.push(entry.name);
+  }
+  return names.sort();
 }
 async function readEnv(path) {
   const file = Bun.file(path);
@@ -1002,31 +1106,109 @@ async function readEnv(path) {
     fail(`${path} does not exist`);
   return parseDotenv(await file.text());
 }
-async function writeEnv(path, file) {
+async function writeAtomic(path, text) {
   let target = path;
   let mode = 384;
+  let owner;
   try {
     target = await realpath(path);
-    mode = (await stat(target)).mode & 511;
-  } catch {}
+    const current = await stat(target);
+    mode = current.mode & 511;
+    owner = current;
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      throw error;
+  }
   const temp = join(dirname(target), `.${basename(target)}.${process.pid}.${crypto.randomUUID()}.tmp`);
   try {
-    await writeFile(temp, serializeDotenv(file), { mode: 384, flag: "wx" });
+    await writeFile(temp, text, { mode: 384, flag: "wx" });
+    if (owner !== undefined)
+      await keepOwner(temp, owner);
     await chmod(temp, mode);
     await rename(temp, target);
   } finally {
     await rm(temp, { force: true });
   }
 }
-async function loadKnown(folder = process.cwd()) {
-  const pairs = [];
-  for (const name of await envFiles(folder)) {
-    for (const [key, value] of entries(parseDotenv(await Bun.file(`${folder}/${name}`).text()))) {
-      if (isSecretKey(key))
-        pairs.push([key, value]);
-      else
-        pairs.push(...urlPasswords(value).map((password) => [key, password]));
+async function keepOwner(path, owner) {
+  try {
+    await chown(path, owner.uid, owner.gid);
+  } catch (error) {
+    if (error.code !== "EPERM")
+      throw error;
+  }
+}
+async function writeEnv(path, file) {
+  await writeAtomic(path, serializeDotenv(file));
+}
+async function withLocks(paths, fn) {
+  const held = [];
+  try {
+    for (const path of [...new Set(paths)].sort())
+      held.push(await acquire(path));
+    return await fn();
+  } finally {
+    for (const lock of held)
+      await rm(lock, { force: true });
+  }
+}
+async function acquire(path) {
+  let real = path;
+  try {
+    real = await realpath(path);
+  } catch {}
+  const lock = join(dirname(real), `.${basename(real)}.lock`);
+  const deadline = Date.now() + LOCK_WAIT_MS;
+  while (true) {
+    try {
+      await writeFile(lock, String(process.pid), { flag: "wx", mode: 384 });
+      return lock;
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
     }
+    try {
+      if (Date.now() - (await stat(lock)).mtimeMs > LOCK_STALE_MS)
+        await rm(lock, { force: true });
+    } catch {}
+    if (Date.now() > deadline)
+      fail(`${path} is locked by another ev run (${lock})`, 1);
+    await Bun.sleep(25);
+  }
+}
+function secretPairs(file) {
+  const pairs = [];
+  for (const [key, value] of entries(file)) {
+    if (isSecretName(key))
+      pairs.push([key, value]);
+    else
+      pairs.push(...urlPasswords(value).map((password) => [key, password]));
+  }
+  return pairs;
+}
+async function envFilesBelow(folder, depth = 0) {
+  const found = [];
+  let children;
+  try {
+    children = await readdir(folder, { withFileTypes: true });
+  } catch {
+    return found;
+  }
+  for (const entry of children) {
+    const path = join(folder, entry.name);
+    if (entry.isDirectory() && depth < KNOWN_DEPTH && !SKIPPED.has(entry.name))
+      found.push(...await envFilesBelow(path, depth + 1));
+    else if (ENV_FILE.test(entry.name) && await isFileEntry(entry, path))
+      found.push(path);
+  }
+  return found;
+}
+async function loadKnown(folder = process.cwd(), extra = []) {
+  const pairs = extra.flatMap(secretPairs);
+  for (const path of await envFilesBelow(folder)) {
+    try {
+      pairs.push(...secretPairs(parseDotenv(await Bun.file(path).text())));
+    } catch {}
   }
   return knownSecrets(pairs);
 }
@@ -1035,6 +1217,8 @@ async function loadKnown(folder = process.cwd()) {
 var DIFF_START = /^(?:diff --git |@@ )/;
 var NEW_FILE = /^\+\+\+ (?:b\/)?(.+)$/;
 var HUNK = /^@@ -\d+(?:,\d+)? \+(\d+)/;
+var MAX_PENDING = 1 << 18;
+var OVERLAP = 1 << 13;
 
 class Redactor {
   known;
@@ -1045,17 +1229,26 @@ class Redactor {
     this.known = known;
   }
   push(chunk) {
-    this.pending += chunk;
-    const end = this.pending.lastIndexOf(`
+    const end = chunk.lastIndexOf(`
 `);
+    this.pending += chunk;
     if (end === -1)
-      return "";
-    const complete = this.pending.slice(0, end + 1);
-    this.pending = this.pending.slice(end + 1);
+      return this.pending.length > MAX_PENDING ? this.cut() : "";
+    const split = this.pending.length - chunk.length + end + 1;
+    const complete = this.pending.slice(0, split);
+    this.pending = this.pending.slice(split);
     return complete.split(`
 `).slice(0, -1).map((line) => this.line(line)).filter((line) => line !== undefined).map((line) => `${line}
 `).join("");
   }
+  cut() {
+    const limit = this.pending.length - OVERLAP;
+    const space = this.pending.lastIndexOf(" ", limit);
+    const at = space > 0 ? space + 1 : limit;
+    const head = this.pending.slice(0, at);
+    this.pending = this.pending.slice(at);
+    return this.line(head) ?? "";
+  }
   end() {
     const rest = this.pending;
     this.pending = "";
@@ -1063,19 +1256,20 @@ class Redactor {
   }
   line(line) {
     if (this.inKey) {
-      if (PEM_END.test(line)) {
-        this.inKey = false;
-        return line;
+      const end = PEM_END.exec(line);
+      if (end === null) {
+        if (this.hidden)
+          return;
+        this.hidden = true;
+        return KEY_MASK;
       }
-      if (this.hidden)
-        return;
-      this.hidden = true;
-      return "*** private key redacted ***";
+      this.inKey = false;
+      return (end.index > 0 && !this.hidden ? KEY_MASK : "") + this.line(line.slice(end.index));
     }
-    if (PEM_BEGIN.test(line)) {
-      this.inKey = !PEM_END.test(line);
-      this.hidden = false;
-      return line;
+    const body = openKeyBody(line);
+    if (body !== undefined) {
+      this.inKey = true;
+      this.hidden = body !== "";
     }
     return maskLine(line, this.known);
   }
@@ -1115,15 +1309,21 @@ function check(text, known) {
       number = index + 1;
     }
     if (inKey) {
-      inKey = !PEM_END.test(line);
-      continue;
+      const end = PEM_END.exec(line);
+      inKey = end === null;
+      if (end === null)
+        continue;
+      line = line.slice(end.index);
     }
-    if (PEM_BEGIN.test(line)) {
-      inKey = !PEM_END.test(line);
-      findings.push({ file, line: number, kind: "private key" });
+    const found = findSecrets(line, known).map((match) => match.kind);
+    const body = openKeyBody(line);
+    if (body !== undefined) {
+      inKey = true;
+      if (body === "")
+        found.push("private key");
     }
-    for (const match of findSecrets(line, known))
-      findings.push({ file, line: number, kind: match.kind });
+    for (const kind of found)
+      findings.push({ file, line: number, kind });
   }
   return findings;
 }
@@ -1131,7 +1331,7 @@ function check(text, known) {
 // src/redact.ts
 var usage = `redact [--check]
 
-Copies stdin to stdout line by line with secrets masked: known token formats (ghp_, github_pat_, glpat-, sk-, xox?-, JWTs), private key blocks, the password and the tokens of any URL and the values of secret-looking keys in this folder's .env* files.
+Copies stdin to stdout line by line with secrets masked: known token formats (GitHub, GitLab, Slack, AWS, npm, Stripe, Google and SendGrid keys, sk-, JWTs, Authorization headers, password= and secret= pairs), private key blocks, the password and the tokens of any URL and the values of secret-looking keys in this folder's .env* files.
 --check prints nothing of the input and lists the file and line of each secret found, exiting 1 when there is any: \`git diff --cached | redact --check\`.
 
 Exits 0 when it copied the input or found no secret, 1 when --check finds one, 2 on a usage error.`;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kaynooo/env-tools",
   "type": "module",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "ev lists and edits .env files with secrets masked, redact masks secrets in any piped output.",
   "author": "Kaynooo <contact@kaynooo.fr>",
   "license": "MIT",

package/src/dotenv.ts

@@ -13,7 +13,10 @@ const ASSIGNMENT = /^\s*(?:export\s+)?([A-Z_][\w.-]*)\s*=(.*)$/i
 const EXPORTED = /^\s*export\s/
 const INLINE_COMMENT = /\s+#.*$/
 const CARRIAGE_RETURN = /\r$/
-const ESCAPES: Record<string, string> = { 'n': '\n', 'r': '\r', 't': '\t', '"': '"', '\\': '\\' }
+const ESCAPES: Record<string, string> = { 'n': '\n', 'r': '\r', 't': '\t', '"': '"', '\\': '\\', '$': '$' }
+const LINE_BREAK = /[\r\n]/
+// Bun does not unescape these inside double quotes, so a value holding one is written in single quotes.
+const RAW_ONLY = /["\\]/
 const NEEDS_QUOTES = /[\s#"'\\$`]/
 
 // Finds the closing quote, skipping backslash escapes inside double quotes. Returns -1 when the value continues on the next line.
@@ -28,6 +31,11 @@ function closingQuote(text: string, quote: string): number {
   return -1
 }
 
+// Bun reads `\$` as a literal dollar sign in every quoting, and expands a bare `$` even inside single quotes.
+function unescapeDollar(text: string): string {
+  return text.replaceAll('\\$', '$')
+}
+
 function unescapeDouble(text: string): string {
   let out = ''
 
@@ -65,7 +73,7 @@ export function parseDotenv(text: string): Dotenv {
     const quote = start[0]
 
     if (quote !== '"' && quote !== '\'' && quote !== '`') {
-      lines.push({ raw: line, key, value: start.replace(INLINE_COMMENT, '').trim() })
+      lines.push({ raw: line, key, value: unescapeDollar(start.replace(INLINE_COMMENT, '').trim()) })
 
       continue
     }
@@ -83,7 +91,7 @@ export function parseDotenv(text: string): Dotenv {
 
     const inner = end === -1 ? body : body.slice(0, end)
 
-    lines.push({ raw, key, value: quote === '"' ? unescapeDouble(inner) : inner })
+    lines.push({ raw, key, value: quote === '"' ? unescapeDouble(inner) : unescapeDollar(inner) })
   }
 
   return { lines }
@@ -109,7 +117,11 @@ export function formatAssignment(key: string, value: string): string {
   if (value === '' || !NEEDS_QUOTES.test(value))
     return `${key}=${value}`
 
-  const escaped = value.replaceAll('\\', '\\\\').replaceAll('"', '\\"').replaceAll('\r', '\\r').replaceAll('\n', '\\n')
+  // Bun expands a bare `$` in every quoting, so each one is written as `\$`.
+  if (RAW_ONLY.test(value) && !value.includes('\'') && !LINE_BREAK.test(value))
+    return `${key}='${value.replaceAll('$', '\\$')}'`
+
+  const escaped = value.replaceAll('\\', '\\\\').replaceAll('"', '\\"').replaceAll('\r', '\\r').replaceAll('\n', '\\n').replaceAll('$', '\\$')
 
   return `${key}="${escaped}"`
 }