@kirschbaum-development/sst-laravel 0.2.15 → 0.2.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kirschbaum-development/sst-laravel",
-  "version": "0.2.15",
+  "version": "0.2.16",
   "type": "module",
   "description": "An unofficial extension of SST to deploy containerized Laravel applications to AWS Fargate.",
   "main": "laravel-sst.ts",
@@ -28,6 +28,7 @@
   ],
   "scripts": {
     "build": "tsc",
+    "test": "vitest run",
     "release": "./scripts/publish.sh"
   },
   "repository": {
@@ -65,7 +66,8 @@
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
-    "typescript": "^5.0.0"
+    "typescript": "^5.0.0",
+    "vitest": "4.1.5"
   },
   "publishConfig": {
     "access": "public",

package/src/remote-env-file.ts

@@ -213,19 +213,38 @@ function buildEnvFileContent(
   ].filter(Boolean).join('\n\n');
 }
 
-function toEnvFileContent(vars: Record<string, string>): string {
+export function toEnvFileContent(vars: Record<string, string>): string {
   const sortedKeys = Object.keys(vars).sort();
 
   return sortedKeys
     .map((key) => {
       const value = vars[key];
+      const needsQuoting =
+        value.includes(' ') ||
+        value.includes('"') ||
+        value.includes("'") ||
+        value.includes('\n') ||
+        value.includes('$') ||
+        value.includes('\\') ||
+        value.includes('#');
+
+      if (!needsQuoting) {
+        return `${key}=${value}`;
+      }
 
-      if (value.includes(' ') || value.includes('"') || value.includes("'") || value.includes('\n')) {
-        const escaped = value.replace(/"/g, '\\"');
-        return `${key}="${escaped}"`;
+      // Single quotes are phpdotenv "raw literal" mode — no $ expansion, no escapes.
+      // Use them whenever possible so randomly-generated secrets round-trip safely.
+      if (!value.includes("'") && !value.includes('\n')) {
+        return `${key}='${value}'`;
       }
 
-      return `${key}=${value}`;
+      // Fall back to double quotes when the value itself contains a single quote
+      // or newline. Escape \, $, and " so phpdotenv reads the literal value.
+      const escaped = value
+        .replace(/\\/g, '\\\\')
+        .replace(/\$/g, '\\$')
+        .replace(/"/g, '\\"');
+      return `${key}="${escaped}"`;
     })
     .join('\n');
 }