@seekrit/cli 0.28.0 → 0.30.0

package/dist/index.js

@@ -208,6 +208,130 @@ function parseBranchTtl(input) {
 	return value * multiplier;
 }
 //#endregion
+//#region ../../packages/core/src/dotenv.ts
+/**
+* `.env` parsing and serialization — the canonical definition of what a `.env`
+* file means to seekrit. `apps/run/src/dotenv.rs` is a faithful port of the
+* parser; the two must be changed together.
+*
+* Supported: `KEY=VALUE`, `#` comments, an optional `export` prefix, and
+* single/double-quoted values. A quoted value may span lines — it runs to its
+* closing quote, wherever that lands — which is what makes a pretty-printed
+* JSON credential (a Google service-account key, say) storable in a `.env`
+* file. Single quotes are literal; double quotes honor `\n \r \t \" \\`.
+* Unquoted values are single-line and drop a trailing ` # comment`.
+*
+* {@link parseDotenv} and {@link dotenvQuote} are inverses: anything the
+* serializer emits parses back to the identical string, including values that
+* contain literal backslash escapes (`"private_key": "…\n…"` in a JSON blob).
+*/
+/** Values that can go on the line bare — no quoting needed to survive a parse. */
+function needsQuoting(value) {
+	return /[\s"'`$\\#]/.test(value) || value === "";
+}
+/**
+* Quote one value for a `.env` line so it parses back byte-for-byte.
+*
+* Single quotes are preferred whenever they are safe, because they are literal:
+* a JSON credential full of `\"` and `\n` escapes stays readable and survives
+* the round-trip untouched. Values containing a single quote (or a real
+* newline, which many other `.env` readers can't span) fall back to double
+* quotes with every escape written out.
+*/
+function dotenvQuote(value) {
+	if (!needsQuoting(value)) return value;
+	if (!value.includes("'") && !/[\n\r]/.test(value)) return `'${value}'`;
+	return `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"").replaceAll("\n", "\\n").replaceAll("\r", "\\r")}"`;
+}
+/**
+* Apply double-quote escapes in a single left-to-right pass.
+*
+* A pass per escape (`\n` → newline, then `\\` → `\`, …) is wrong: in `\\n` the
+* first pass matches the trailing `\n` and yields a real newline, corrupting
+* every literal backslash-n a JSON credential is made of. Scanning once means a
+* backslash consumes the character after it and can never be re-read.
+*/
+function unescapeDoubleQuoted(text) {
+	let out = "";
+	for (let i = 0; i < text.length; i++) {
+		if (text[i] !== "\\" || i === text.length - 1) {
+			out += text[i];
+			continue;
+		}
+		const next = text[++i];
+		if (next === "n") out += "\n";
+		else if (next === "r") out += "\r";
+		else if (next === "t") out += "	";
+		else if (next === "\"" || next === "\\") out += next;
+		else out += `\\${next}`;
+	}
+	return out;
+}
+/**
+* Find the index of the quote that closes a value opened at `start`.
+*
+* Inside double quotes a `\"` is an escaped quote, not the terminator (and a
+* `\\` immediately before the quote *is* a terminator, since the backslash is
+* itself escaped) — so the scan tracks escapes rather than searching for the
+* next bare quote. Single quotes have no escapes: the next one closes. Returns
+* -1 when the value is never closed.
+*/
+function findClosingQuote(content, start, quote) {
+	for (let i = start; i < content.length; i++) {
+		if (quote === "\"" && content[i] === "\\") {
+			i++;
+			continue;
+		}
+		if (content[i] === quote) return i;
+	}
+	return -1;
+}
+/**
+* Parse `.env` text into variables. Later assignments win, matching the
+* object-assignment semantics every `.env` reader has.
+*/
+function parseDotenv(content) {
+	const out = {};
+	let cursor = 0;
+	while (cursor < content.length) {
+		const newline = content.indexOf("\n", cursor);
+		const lineEnd = newline === -1 ? content.length : newline;
+		const lineStart = cursor;
+		const trimmedEnd = lineEnd > lineStart && content[lineEnd - 1] === "\r" ? lineEnd - 1 : lineEnd;
+		cursor = lineEnd + 1;
+		let i = skipSpace(content, lineStart, trimmedEnd);
+		if (i === trimmedEnd || content[i] === "#") continue;
+		if (content.startsWith("export ", i)) i = skipSpace(content, i + 7, trimmedEnd);
+		const eq = content.indexOf("=", i);
+		if (eq === -1 || eq >= trimmedEnd) continue;
+		const key = content.slice(i, eq).trim();
+		if (!key) continue;
+		const valueStart = skipSpace(content, eq + 1, trimmedEnd);
+		const quote = content[valueStart];
+		if (valueStart === trimmedEnd || quote !== "\"" && quote !== "'") {
+			const rest = content.slice(valueStart, trimmedEnd).trimEnd();
+			const comment = rest.indexOf(" #");
+			out[key] = comment === -1 ? rest : rest.slice(0, comment).trimEnd();
+			continue;
+		}
+		const close = findClosingQuote(content, valueStart + 1, quote);
+		const valueEnd = close === -1 ? content.length : close;
+		const value = content.slice(valueStart + 1, valueEnd);
+		out[key] = quote === "\"" ? unescapeDoubleQuoted(value) : value;
+		if (valueEnd >= cursor) {
+			const after = content.indexOf("\n", valueEnd);
+			cursor = after === -1 ? content.length : after + 1;
+		}
+	}
+	return out;
+}
+/** First index at or after `from` (and before `end`) that isn't a space or tab. */
+function skipSpace(content, from, end) {
+	let i = from;
+	while (i < end && (content[i] === " " || content[i] === "	")) i++;
+	return i;
+}
+//#endregion
 //#region ../../packages/core/src/ids.ts
 const ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 /**
@@ -371,6 +495,104 @@ function interpolateSecrets(values) {
 		unresolved: [...unresolved].sort()
 	};
 }
+//#endregion
+//#region ../../packages/core/src/json-value.ts
+/**
+* Whether a value is worth *offering* a JSON view for: an object or array.
+*
+* Deliberately narrow. A bare `123`, `true`, or `"quoted string"` is legal JSON
+* but is far more likely to be an ordinary secret that happens to look like a
+* literal, and badging those as JSON would be noise on almost every row.
+*/
+function looksLikeJson(value) {
+	const trimmed = value.trim();
+	return trimmed.startsWith("{") && trimmed.endsWith("}") || trimmed.startsWith("[") && trimmed.endsWith("]");
+}
+/** Strip one layer of matching surrounding quotes, if the value has them. */
+function unquote(value) {
+	const trimmed = value.trim();
+	const quote = trimmed[0];
+	if (trimmed.length < 2) return null;
+	if (quote !== "'" && quote !== "\"" || trimmed.at(-1) !== quote) return null;
+	return trimmed.slice(1, -1);
+}
+function isParseable(value) {
+	try {
+		JSON.parse(value);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* The two ways a copied credential usually arrives broken.
+*
+* Both come from a shell habit rather than a typo: the quotes that made the
+* value survive `.env` or a command line get pasted along with it, or a value
+* that was escaped for a double-quoted context is pasted still escaped.
+*/
+function findRepair(value) {
+	const inner = unquote(value);
+	if (inner !== null && looksLikeJson(inner) && isParseable(inner)) return {
+		label: "remove the quotes",
+		reason: "the surrounding quotes were pasted along with the value",
+		value: inner
+	};
+	if (value.includes("\\\"")) {
+		const unescaped = value.replaceAll("\\\"", "\"").replaceAll("\\\\", "\\");
+		const candidate = unquote(unescaped) ?? unescaped;
+		if (looksLikeJson(candidate) && isParseable(candidate)) return {
+			label: "unescape the quotes",
+			reason: "the value is still escaped for a shell or a double-quoted string",
+			value: candidate
+		};
+	}
+	return null;
+}
+/**
+* Classify a decrypted value as JSON, nearly-JSON, or ordinary text.
+*
+* Only object- and array-shaped values are considered (see
+* {@link looksLikeJson}), so an ordinary secret is never reported as malformed
+* JSON just because it starts with a brace-free string.
+*/
+function inspectJsonValue(value) {
+	if (!looksLikeJson(value)) {
+		const repair = findRepair(value);
+		return repair ? {
+			kind: "malformed",
+			error: repair.reason,
+			repair
+		} : { kind: "text" };
+	}
+	let data;
+	try {
+		data = JSON.parse(value);
+	} catch (err) {
+		return {
+			kind: "malformed",
+			error: err instanceof Error ? err.message : "not valid JSON",
+			repair: findRepair(value)
+		};
+	}
+	const pretty = JSON.stringify(data, null, 2);
+	return {
+		kind: "json",
+		pretty,
+		minified: JSON.stringify(data),
+		isPretty: value.trim() === pretty,
+		size: Array.isArray(data) ? data.length : Object.keys(data).length,
+		shape: Array.isArray(data) ? "array" : "object"
+	};
+}
+/**
+* Pretty-print a value if it is JSON, otherwise hand it back unchanged — for
+* output paths that want to be helpful without ever altering a non-JSON secret.
+*/
+function prettyJsonOrRaw(value) {
+	const inspection = inspectJsonValue(value);
+	return inspection.kind === "json" ? inspection.pretty : value;
+}
 z.enum([
 	"postgres",
 	"mysql",
@@ -2497,7 +2719,7 @@ function isCliSessionToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.28.0";
+var version = "0.30.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -4591,45 +4813,7 @@ function registerBranchCommands(program) {
 	});
 }
 //#endregion
-//#region src/dotenv.ts
-/**
-* Minimal `.env` parser: `KEY=VALUE`, `#` comments, an optional `export`
-* prefix, and single/double-quoted values (double quotes honor `\n \t \r \" \\`
-* escapes; unquoted values drop trailing ` # comments`). Multiline values are
-* not supported — keep those in seekrit itself.
-*/
-function parseDotenv(content) {
-	const out = {};
-	for (const raw of content.split(/\r?\n/)) {
-		let line = raw.trim();
-		if (!line || line.startsWith("#")) continue;
-		if (line.startsWith("export ")) line = line.slice(7).trimStart();
-		const eq = line.indexOf("=");
-		if (eq === -1) continue;
-		const key = line.slice(0, eq).trim();
-		if (!key) continue;
-		let value = line.slice(eq + 1).trim();
-		const quote = value[0];
-		if (value.length >= 2 && (quote === "\"" || quote === "'") && value.at(-1) === quote) {
-			value = value.slice(1, -1);
-			if (quote === "\"") value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, "\"").replace(/\\\\/g, "\\");
-		} else {
-			const comment = value.indexOf(" #");
-			if (comment !== -1) value = value.slice(0, comment).trim();
-		}
-		out[key] = value;
-	}
-	return out;
-}
-//#endregion
 //#region src/format.ts
-function needsQuoting(value) {
-	return /[\s"'`$\\#]/.test(value) || value === "";
-}
-function dotenvQuote(value) {
-	if (!needsQuoting(value)) return value;
-	return `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"").replaceAll("\n", "\\n")}"`;
-}
 function shellQuote(value) {
 	return `'${value.replaceAll("'", `'\\''`)}'`;
 }
@@ -6582,20 +6766,27 @@ withTarget(secrets.command("list").alias("ls").description("list secret names (n
 		col("updated", (s) => s.updatedAt)
 	], `no secrets in ${label}`));
 });
-withTarget(secrets.command("get <name>").description("decrypt and print one secret value").option("--raw", "print the stored value without expanding ${OTHER_SECRET} references").option("--version <n>", "print an earlier version instead of the current one")).action(async (name, options) => {
+withTarget(secrets.command("get <name>").description("decrypt and print one secret value").option("--raw", "print the stored value without expanding ${OTHER_SECRET} references").option("--version <n>", "print an earlier version instead of the current one").option("--pretty", "re-indent the value if it is JSON (left alone if it is not)")).action(async (name, options) => {
 	const ctx = buildContext();
 	const { orgId, envId } = await resolveEnvTarget(ctx, options);
 	let value;
 	if (options.version === void 0) value = (await fetchDecryptedSecrets(ctx, orgId, envId, { raw: options.raw }))[name];
 	else value = await fetchDecryptedVersion(ctx, orgId, envId, name, parseVersion(options.version));
 	if (value === void 0) fail(`no secret named ${name}`);
-	process.stdout.write(value);
+	process.stdout.write(options.pretty ? prettyJsonOrRaw(value) : value);
 	if (process.stdout.isTTY) process.stdout.write("\n");
 });
-withTarget(secrets.command("set <name> [value]").description("encrypt and store a secret (reads stdin when value is omitted or '-')")).action(async (name, value, options) => {
+withTarget(secrets.command("set <name> [value]").description("encrypt and store a secret (reads stdin when value is omitted or '-')").option("--file <path>", "read the value from a file — the way to store a JSON credential or a PEM key without fighting shell quoting")).action(async (name, value, options) => {
+	if (options.file !== void 0 && value !== void 0) fail("pass a value or --file, not both");
 	const ctx = buildContext();
 	const { orgId, envId } = await resolveEnvTarget(ctx, options);
-	await encryptAndSetSecret(ctx, orgId, envId, name, value === void 0 || value === "-" ? (await readStdin()).replace(/\n$/, "") : value);
+	let plaintext;
+	if (options.file !== void 0) {
+		if (!existsSync(options.file)) fail(`no such file: ${options.file}`);
+		plaintext = readFileSync(options.file, "utf8").replace(/\n$/, "");
+	} else if (value === void 0 || value === "-") plaintext = (await readStdin()).replace(/\n$/, "");
+	else plaintext = value;
+	await encryptAndSetSecret(ctx, orgId, envId, name, plaintext);
 	console.error(`${name} saved`);
 });
 withTarget(secrets.command("import [file]").description("bulk-import secrets from a .env file (default .env; '-' reads stdin)").option("--dry-run", "list the variable names that would be imported, without writing")).action(async (file, options) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.28.0",
+  "version": "0.30.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {