@stacksjs/env 0.70.355 → 0.70.357
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.d.ts +14 -0
- package/dist/cli.js +22 -22
- package/dist/index.js +24 -24
- package/package.json +3 -3
package/dist/cli.d.ts
CHANGED
|
@@ -14,6 +14,20 @@
|
|
|
14
14
|
* empty string so callers fall through to their own defaults unchanged.
|
|
15
15
|
*/
|
|
16
16
|
export declare function resolveEnvFile(file?: string, environment?: string): string;
|
|
17
|
+
/**
|
|
18
|
+
* The key names an env file's keypair is stored under: `.env.production` →
|
|
19
|
+
* `DOTENV_{PUBLIC,PRIVATE}_KEY_PRODUCTION`, plain `.env` → the unsuffixed pair.
|
|
20
|
+
*
|
|
21
|
+
* One helper because it was two, and they disagreed. The keys file was written
|
|
22
|
+
* from the basename (`.env` → no suffix, `secrets/.env.production` →
|
|
23
|
+
* `_PRODUCTION`), while the header written INTO the encrypted file was derived
|
|
24
|
+
* from the raw option (`.env` → `_.ENV`, a path → `_SECRETS/.ENV.PRODUCTION`).
|
|
25
|
+
* A file encrypted that way names a public key that does not exist in
|
|
26
|
+
* `.env.keys`, so nothing can find the private half and every value in it is
|
|
27
|
+
* lost — and only for callers who passed `--file` explicitly, which is why it
|
|
28
|
+
* survived: the default path agreed with itself.
|
|
29
|
+
*/
|
|
30
|
+
export declare function envKeyNames(file?: string): { publicKeyName: string, privateKeyName: string };
|
|
17
31
|
/**
|
|
18
32
|
* Encrypt .env file
|
|
19
33
|
*/
|
package/dist/cli.js
CHANGED
|
@@ -1,24 +1,24 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{createCipheriv as
|
|
3
|
-
`);for(let D of w){let I=D.trim();if(!I||I.startsWith("#"))continue;if(I.startsWith("DOTENV_PUBLIC_KEY=")){let X=I.match(/^DOTENV_PUBLIC_KEY=["']?([^"'\n]+)["']?/);if(X&&X[1]!==void 0)g.DOTENV_PUBLIC_KEY=X[1];continue}let
|
|
4
|
-
`)}if(
|
|
5
|
-
`)){let D
|
|
6
|
-
`)}function
|
|
7
|
-
${
|
|
8
|
-
${
|
|
9
|
-
`;
|
|
10
|
-
${
|
|
11
|
-
${
|
|
12
|
-
`;
|
|
13
|
-
\u2714 key added to ${f.keysFile||".env.keys"}`}}catch(B){return{success:!1,error:`Failed to encrypt: ${B instanceof Error?B.message:"Unknown error"}`}}}function
|
|
14
|
-
`),
|
|
15
|
-
`);if(f.stdout)return{success:!0,output:
|
|
16
|
-
`),
|
|
17
|
-
${
|
|
18
|
-
${
|
|
19
|
-
`,
|
|
20
|
-
`);return
|
|
21
|
-
`);break;case"json":default:
|
|
22
|
-
`),
|
|
2
|
+
import{createCipheriv as k,createDecipheriv as u,createHash as F,createPrivateKey as gf,createPublicKey as m,diffieHellman as n,generateKeyPairSync as v,hkdfSync as o,randomBytes as S}from"crypto";var b="x25519-public:",P="x25519-private:",C="encrypted:v2:",N="encrypted:",i=Buffer.from("stacks-env:v2","utf8"),s="Environment decryption failed: authentication or format error";function y(f){if(f.length===32)return f;return F("sha256").update(f).digest()}function Zf(f,E){let g=S(16),$=k("aes-256-gcm",y(E),g);return{ciphertext:Buffer.concat([$.update(f,"utf8"),$.final()]).toString("hex"),iv:g.toString("hex"),authTag:$.getAuthTag().toString("hex")}}function Ef(f,E,g,$){try{let B=u("aes-256-gcm",y(E),Buffer.from(g,"hex"));return B.setAuthTag(Buffer.from($,"hex")),Buffer.concat([B.update(Buffer.from(f,"hex")),B.final()]).toString("utf8")}catch{throw Error("Decryption failed: authentication or format error")}}function Q(f){return f.toString("base64url")}function V(f,E,g){if(typeof f!=="string"||f.length>0&&!/^[A-Za-z0-9_-]+$/.test(f))throw Error(`${E} is not canonical base64url`);let $=Buffer.from(f,"base64url");if(Q($)!==f)throw Error(`${E} is not canonical base64url`);if(g!==void 0&&$.length!==g)throw Error(`${E} has an invalid length`);return $}function Bf(f){if(!f.startsWith(b))throw Error("Legacy or invalid public key. Run buddy env:rotate before creating new ciphertext.");let E=m({key:V(f.slice(b.length),"public key"),format:"der",type:"spki"});if(E.asymmetricKeyType!=="x25519")throw Error("Public key is not X25519");return E}function $f(f){if(!f.startsWith(P))throw Error("Private key is not a version 2 X25519 key");let E=gf({key:V(f.slice(P.length),"private key"),format:"der",type:"pkcs8"});if(E.asymmetricKeyType!=="x25519")throw Error("Private key is not X25519");return E}function p(f){return Buffer.from(`stacks-env:v2;${f.epk};${f.salt};${f.nonce}`,"utf8")}function q(){let{publicKey:f,privateKey:E}=v("x25519"),g=f.export({format:"der",type:"spki"}),$=E.export({format:"der",type:"pkcs8"});return{publicKey:`${b}${Q(g)}`,privateKey:`${P}${Q($)}`}}function r(f,E){let g=Bf(E),$=v("x25519"),B=Q($.publicKey.export({format:"der",type:"spki"})),w=S(16),D=S(12),I=n({privateKey:$.privateKey,publicKey:g}),_=Buffer.from(o("sha256",I,w,i,32)),T={epk:B,salt:Q(w),nonce:Q(D)};try{let A=k("aes-256-gcm",_,D);A.setAAD(p(T));let X=Buffer.concat([A.update(f,"utf8"),A.final()]),R={v:2,...T,ciphertext:Q(X),tag:Q(A.getAuthTag())};return`${C}${Q(Buffer.from(JSON.stringify(R),"utf8"))}`}finally{I.fill(0),_.fill(0)}}function wf(f){let E=V(f.slice(C.length),"envelope").toString("utf8"),g=JSON.parse(E);if(!g||typeof g!=="object"||Array.isArray(g))throw Error("envelope is not an object");let $=Object.keys(g).sort(),B=["ciphertext","epk","nonce","salt","tag","v"];if($.length!==B.length||$.some((w,D)=>w!==B[D]))throw Error("envelope fields are invalid");if(g.v!==2)throw Error("envelope version is unsupported");for(let w of["epk","salt","nonce","ciphertext","tag"])if(typeof g[w]!=="string")throw Error(`${w} is invalid`);return g}function Af(f,E){try{let g=wf(f),$=$f(E),B=m({key:V(g.epk,"ephemeral public key"),format:"der",type:"spki"});if(B.asymmetricKeyType!=="x25519")throw Error("ephemeral key is not X25519");let w=V(g.salt,"salt",16),D=V(g.nonce,"nonce",12),I=V(g.ciphertext,"ciphertext"),_=V(g.tag,"tag",16),T=n({privateKey:$,publicKey:B}),A=Buffer.from(o("sha256",T,w,i,32));try{let X=u("aes-256-gcm",A,D);return X.setAAD(p(g)),X.setAuthTag(_),Buffer.concat([X.update(I),X.final()]).toString("utf8")}finally{T.fill(0),A.fill(0)}}catch{throw Error(s)}}function _f(f,E){try{if(!/^[0-9a-f]{64}$/.test(E))throw Error("invalid legacy private key");let g=Buffer.from(f.slice(N.length),"base64");if(g.length<32)throw Error("invalid legacy payload");let $=F("sha256").update(Buffer.from(E,"hex")).digest(),B=F("sha256").update($).digest();return Ef(g.subarray(32).toString("hex"),B,g.subarray(0,16).toString("hex"),g.subarray(16,32).toString("hex"))}catch{throw Error(s)}}function Qf(f){return f.startsWith(N)&&!f.startsWith(C)}function M(f,E){if(!f.startsWith(N))return f;return f.startsWith(C)?Af(f,E):_f(f,E)}function Vf(f,E,g){return r(M(f,E),g)}function Lf(f){let E=f.match(/^DOTENV_PRIVATE_KEY_(.+)$/);return E&&E[1]?E[1].toLowerCase():""}function qf(f=""){return f?process.env[`DOTENV_PRIVATE_KEY_${f.toUpperCase()}`]:process.env.DOTENV_PRIVATE_KEY}import{spawnSync as Tf}from"child_process";import{readFileSync as If}from"fs";import{arch as Df,hostname as Xf,platform as l,release as Of,userInfo as Rf}from"os";import{basename as Yf,dirname as Hf,resolve as Wf}from"path";function L(f,E={}){let g={},$=[],B=[],w=f.split(`
|
|
3
|
+
`);for(let D of w){let I=D.trim();if(!I||I.startsWith("#"))continue;if(I.startsWith("DOTENV_PUBLIC_KEY=")){let X=I.match(/^DOTENV_PUBLIC_KEY=["']?([^"'\n]+)["']?/);if(X&&X[1]!==void 0)g.DOTENV_PUBLIC_KEY=X[1];continue}let _=I.match(/^([^=]+)=(.*)$/);if(!_||_[1]===void 0||_[2]===void 0)continue;let T=_[1].trim(),A=_[2].trim();if(A.startsWith('"')&&A.endsWith('"')||A.startsWith("'")&&A.endsWith("'")){if(A=A.slice(1,-1),A.includes("\\n"))A=A.replace(/\\n/g,`
|
|
4
|
+
`)}if(A.startsWith("encrypted:")||A.startsWith("enc:")){if(!E.privateKey){B.push(T);continue}try{let X=A.startsWith("enc:")?`encrypted:${A.slice(4)}`:A;A=M(X,E.privateKey)}catch(X){$.push(`Failed to decrypt ${T}: ${X instanceof Error?X.message:"Unknown error"}`)}}A=hf(A,{...E.processEnv||process.env,...g}),A=Jf(A),g[T]=A}return{parsed:g,errors:$,skippedEncrypted:B}}function hf(f,E){return f.replace(/\$\{([^}]+)\}/g,(g,$)=>{let B=$.match(/^([^:\-+]+)(:-|-)(.+)$/);if(B){let[,D,I,_]=B,T=E[D];if(I===":-")return T||_;else return T!==void 0?T:_}let w=$.match(/^([^:\-+]+)(:?\+)(.+)$/);if(w){let[,D,I,_]=w,T=E[D];if(I===":+")return T?_:"";else return T!==void 0?_:""}return E[$]||""})}var jf=new Set(["date","hostname","whoami","uname","pwd","echo","printf","cat","basename","dirname"]);function xf(f){let E=[],g="",$=null,B=!1;for(let w of f.trim()){if(B){g+=w,B=!1;continue}if(w==="\\"&&$!=="'"){B=!0;continue}if($){if(w===$)$=null;else g+=w;continue}if(w==='"'||w==="'"){$=w;continue}if(/\s/.test(w)){if(g)E.push(g),g="";continue}g+=w}if(B||$)throw Error("Command substitution contains an unterminated escape or quote");if(g)E.push(g);return E}function Gf(f){let[E,...g]=f,$=g.some((B)=>B.startsWith("-"));if(E==="echo"&&!$)return g.join(" ");if(E==="printf"&&g.length===1&&!g[0]?.includes("%"))return g[0];if(E==="hostname"&&g.length===0)return Xf();if(E==="whoami"&&g.length===0)return Rf().username;if(E==="pwd"&&g.length===0)return process.cwd();if(E==="basename"&&g.length===1)return Yf(g[0]??"");if(E==="dirname"&&g.length===1)return Hf(g[0]??"");if(E==="cat"&&g.length>0&&!$)return g.map((B)=>If(Wf(process.cwd(),B),"utf8")).join("");if(E==="uname"){let B=g[0]??"-s";if(g.length<=1&&B==="-m")return Df();if(g.length<=1&&B==="-r")return Of();if(g.length<=1&&B==="-s")return{aix:"AIX",android:"Android",cygwin:"CYGWIN",darwin:"Darwin",freebsd:"FreeBSD",haiku:"Haiku",linux:"Linux",netbsd:"NetBSD",openbsd:"OpenBSD",sunos:"SunOS",win32:"Windows_NT"}[l()]??l()}return}function Jf(f){return f.replace(/\$\(([^)]+)\)/g,(E,g)=>{try{let $=xf(g),B=$[0];if(!B||!jf.has(B))return console.warn(`[env] Blocked command substitution for disallowed command: ${B}`),"";let w=Gf($);if(w!==void 0)return w.trim();let D=Tf(B,$.slice(1),{encoding:"utf8",env:process.env});if(D.status===0)return D.stdout.trim();let I=D.stderr.trim();console.warn(`[env] Command substitution failed (exit code ${D.status??"unknown"}): ${B}${I?`: ${I}`:""}`)}catch($){console.warn(`[env] Command substitution error: ${$ instanceof Error?$.message:String($)}`)}return""})}async function bf(f,E={}){let g={},$=[],B=[];for(let w of f)try{let D=Bun.file(w);if(!D.size)continue;let I=await D.text(),{parsed:_,errors:T,skippedEncrypted:A}=L(I,E);$.push(...T),B.push(...A);for(let[X,R]of Object.entries(_)){if(!E.overload&&g[X]!==void 0)continue;g[X]=R}}catch(D){if(D?.code==="ENOENT")continue;$.push(`Failed to read ${w}: ${D instanceof Error?D.message:String(D)}`)}return{parsed:g,errors:$,skippedEncrypted:B}}import{existsSync as U,readFileSync as J,renameSync as K,rmSync as a,writeFileSync as z}from"fs";import{basename as t,dirname as e,resolve as G}from"path";function kf(f,E){if(f)return f;let g=String(E??"").trim();if(!g||g==="development"||g==="dev"||g==="local")return"";if(!/^[\w.-]+$/.test(g))return"";return`.env.${g}`}function ff(f,E,g,$){let B=["#/-------------------[DOTENV_PUBLIC_KEY]--------------------/","#/ versioned X25519 encryption for .env files /","#/ [how it works](https://stacksjs.com/encryption) /","#/----------------------------------------------------------/",`${g}="${E}"`,""],w=!1;for(let D of f.split(`
|
|
5
|
+
`)){let I=D.trim();if(I.startsWith("#/"))continue;if(I.startsWith("DOTENV_PUBLIC_KEY"))continue;if(!I&&!w)continue;if(!I||I.startsWith("#")){w=!0,B.push(D);continue}w=!0;let _=I.match(/^([^=]+)=(.*)$/);if(!_||_[1]===void 0||_[2]===void 0){B.push(D);continue}let T=_[1].trim(),A=_[2].trim();if(A.startsWith('"')&&A.endsWith('"')||A.startsWith("'")&&A.endsWith("'"))A=A.slice(1,-1);if((!$.key||T.includes($.key))&&(!$.excludeKey||!T.includes($.excludeKey))&&!A.startsWith("encrypted:"))A=r(A,E);B.push(`${T}="${A}"`)}return B.join(`
|
|
6
|
+
`)}function d(f){let g=((f||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase();return{publicKeyName:g?`DOTENV_PUBLIC_KEY_${g}`:"DOTENV_PUBLIC_KEY",privateKeyName:g?`DOTENV_PRIVATE_KEY_${g}`:"DOTENV_PRIVATE_KEY"}}function uf(f={}){let E=f.cwd||process.cwd(),g=G(E,f.file||".env"),$=G(E,f.keysFile||".env.keys");if(!U(g))return{success:!1,error:`File not found: ${g}`};try{let B,w;if(U($)){let _=J($,"utf-8"),{parsed:T}=L(_),{publicKeyName:A,privateKeyName:X}=d(f.file);if(B=T[A]||"",w=T[X]||"",!B||!w){let R=q();B=R.publicKey,w=R.privateKey;let Y=`
|
|
7
|
+
${A}="${B}"
|
|
8
|
+
${X}="${w}"
|
|
9
|
+
`;z($,_+Y,"utf-8")}}else{let _=q();B=_.publicKey,w=_.privateKey;let{publicKeyName:T,privateKeyName:A}=d(f.file),X=`# .env.keys - Keep this file secure and never commit to source control
|
|
10
|
+
${T}="${B}"
|
|
11
|
+
${A}="${w}"
|
|
12
|
+
`;z($,X,"utf-8")}let D=J(g,"utf-8"),I=ff(D,B,d(f.file).publicKeyName,f);if(f.stdout)return{success:!0,output:I};return z(g,I,"utf-8"),{success:!0,output:`\u2714 encrypted (${f.file||".env"})
|
|
13
|
+
\u2714 key added to ${f.keysFile||".env.keys"}`}}catch(B){return{success:!1,error:`Failed to encrypt: ${B instanceof Error?B.message:"Unknown error"}`}}}function Uf(f={}){let E=f.cwd||process.cwd(),g=G(E,f.file||".env"),$=G(E,f.keysFile||".env.keys");if(!U(g))return{success:!1,error:`File not found: ${g}`};if(!U($))return{success:!1,error:`Keys file not found: ${$}`};try{let B=J($,"utf-8"),{parsed:w}=L(B),_=((f.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),T=_?`DOTENV_PRIVATE_KEY_${_}`:"DOTENV_PRIVATE_KEY",A=w[T];if(!A)return{success:!1,error:`Private key not found: ${T}`};let R=J(g,"utf-8").split(`
|
|
14
|
+
`),Y=[];for(let x of R){let Z=x.trim();if(!Z||Z.startsWith("#")){Y.push(x);continue}if(Z.startsWith("DOTENV_PUBLIC_KEY"))continue;let H=Z.match(/^([^=]+)=(.*)$/);if(!H||H[1]===void 0||H[2]===void 0){Y.push(x);continue}let W=H[1].trim(),O=H[2].trim();if(O.startsWith('"')&&O.endsWith('"')||O.startsWith("'")&&O.endsWith("'"))O=O.slice(1,-1);let j=O.startsWith("encrypted:");if(f.key&&!W.includes(f.key))j=!1;if(j)O=M(O,A);Y.push(`${W}="${O}"`)}let h=Y.join(`
|
|
15
|
+
`);if(f.stdout)return{success:!0,output:h};return z(g,h,"utf-8"),{success:!0,output:`\u2714 decrypted (${f.file||".env"})`}}catch(B){return{success:!1,error:`Failed to decrypt: ${B instanceof Error?B.message:"Unknown error"}`}}}function mf(f,E,g={}){let $=g.cwd||process.cwd(),B=G($,g.file||".env"),w=G($,g.keysFile||".env.keys");try{let D="";if(U(B))D=J(B,"utf-8");let I=D.split(`
|
|
16
|
+
`),_=!1,T,R=((g.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),Y=R?`DOTENV_PUBLIC_KEY_${R}`:"DOTENV_PUBLIC_KEY",h=R?`DOTENV_PRIVATE_KEY_${R}`:"DOTENV_PRIVATE_KEY";for(let H of I){let W=H.trim();if(W.startsWith(`${Y}=`)){let O=W.match(/^[^=]+=["']?([^"'\n]+)["']?/);if(O)T=O[1];break}}if(T){let H=!1;if(U(w)){let W=J(w,"utf-8"),{parsed:O}=L(W);H=Boolean(O[h])}if(!H)T=void 0}if(!g.plain&&!T){let H=q();T=H.publicKey;let W="";if(U(w))W=J(w,"utf-8");W+=`
|
|
17
|
+
${Y}="${H.publicKey}"
|
|
18
|
+
${h}="${H.privateKey}"
|
|
19
|
+
`,z(w,W,"utf-8");for(let O=I.length-1;O>=0;O--){let j=I[O];if(j!==void 0&&j.trim().startsWith(`${Y}=`))I.splice(O,1)}I.unshift(`${Y}="${T}"`)}let x=E;if(!g.plain&&T)x=r(E,T);for(let H=0;H<I.length;H++){let W=I[H];if(W===void 0)continue;if(W.trim().startsWith(`${f}=`)){I[H]=`${f}="${x}"`,_=!0;break}}if(!_)I.push(`${f}="${x}"`);let Z=I.join(`
|
|
20
|
+
`);return z(B,Z,"utf-8"),{success:!0,output:`set ${f}${g.plain?"":" with encryption"} (${g.file||".env"})`}}catch(D){return{success:!1,error:`Failed to set: ${D instanceof Error?D.message:"Unknown error"}`}}}function nf(f,E={}){let g=E.cwd||process.cwd(),$=G(g,E.file||".env");if(!U($))return{success:!1,error:`File not found: ${$}`};try{let B,w=G(g,E.keysFile||".env.keys"),_=((E.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),T=_?`DOTENV_PRIVATE_KEY_${_}`:"DOTENV_PRIVATE_KEY";if(U(w)){let h=J(w,"utf-8"),{parsed:x}=L(h);B=x[T]}if(!B)B=process.env[T];let A=J($,"utf-8"),{parsed:X}=L(A,{privateKey:B});if(f&&!E.all){let h=X[f];if(h===void 0)return{success:!1,error:`Key not found: ${f}`};return{success:!0,output:h}}let R=E.all?{...process.env,...X}:X,Y;switch(E.format){case"shell":Y=Object.entries(R).map(([h,x])=>`${h}=${x}`).join(" ");break;case"eval":Y=Object.entries(R).map(([h,x])=>`${h}="${x}"`).join(`
|
|
21
|
+
`);break;case"json":default:Y=E.prettyPrint?JSON.stringify(R,null,2):JSON.stringify(R);break}return{success:!0,output:Y}}catch(B){return{success:!1,error:`Failed to get: ${B instanceof Error?B.message:"Unknown error"}`}}}function vf(f,E={}){let g=E.cwd||process.cwd(),$=G(g,E.keysFile||".env.keys");if(!U($))return{success:!1,error:`Keys file not found: ${$}`};try{let B=J($,"utf-8"),{parsed:w}=L(B),_=((E.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),T=_?`DOTENV_PUBLIC_KEY_${_}`:"DOTENV_PUBLIC_KEY",A=_?`DOTENV_PRIVATE_KEY_${_}`:"DOTENV_PRIVATE_KEY";if(f){let Y=w[f];if(!Y)return{success:!1,error:`Key not found: ${f}`};return{success:!0,output:Y}}let X={[T]:w[T],[A]:w[A]};return{success:!0,output:E.format==="shell"?`${T}=${X[T]} ${A}=${X[A]}`:JSON.stringify(X)}}catch(B){return{success:!1,error:`Failed to get keypair: ${B instanceof Error?B.message:"Unknown error"}`}}}function of(f={}){let E=Uf({file:f.file,keysFile:f.keysFile,stdout:!0,cwd:f.cwd});if(!E.success)return E;let g=f.cwd||process.cwd(),$=G(g,f.file||".env"),B=G(g,f.keysFile||".env.keys");if(E.output===void 0)return{success:!1,error:"Rotation produced no decrypted content"};let w=q(),D=J($),I=J(B),_=I.toString("utf8").split(`
|
|
22
|
+
`),T=f.file||".env",A=t(T).replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),X=A?`DOTENV_PUBLIC_KEY_${A}`:"DOTENV_PUBLIC_KEY",R=A?`DOTENV_PRIVATE_KEY_${A}`:"DOTENV_PRIVATE_KEY",Y=!1,h=!1;for(let j=0;j<_.length;j++){let c=_[j];if(c===void 0)continue;if(c.startsWith(`${X}=`))_[j]=`${X}="${w.publicKey}"`,Y=!0;else if(c.startsWith(`${R}=`))_[j]=`${R}="${w.privateKey}"`,h=!0}if(!Y)_.push(`${X}="${w.publicKey}"`);if(!h)_.push(`${R}="${w.privateKey}"`);let x=`${_.join(`
|
|
23
23
|
`).replace(/\n+$/,"")}
|
|
24
|
-
`,
|
|
24
|
+
`,Z=ff(E.output,w.publicKey,X,f),H=`${process.pid}-${Date.now()}`,W=G(e($),`.${t($)}.${H}.rotate`),O=G(e(B),`.${t(B)}.${H}.rotate`);try{if(z(W,Z,{encoding:"utf8",mode:384}),z(O,x,{encoding:"utf8",mode:384}),f.stdout)return K(O,B),{success:!0,output:Z};K(W,$);try{K(O,B)}catch(j){throw z($,D),j}return{success:!0,output:`\u2714 rotated (${f.file||".env"}) to encrypted:v2`}}catch(j){if(!U(B))z(B,I,{mode:384});return{success:!1,error:`Failed to rotate without exposing plaintext: ${j instanceof Error?j.message:"Unknown error"}`}}finally{a(W,{force:!0}),a(O,{force:!0})}}export{mf as setEnv,of as rotateKeypair,kf as resolveEnvFile,vf as getKeypair,nf as getEnv,d as envKeyNames,uf as encryptEnv,Uf as decryptEnv};
|
package/dist/index.js
CHANGED
|
@@ -1,27 +1,27 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{createCipheriv as
|
|
3
|
-
`);for(let H of D){let
|
|
4
|
-
`)}if(
|
|
5
|
-
`)){let H
|
|
6
|
-
`)}function
|
|
7
|
-
${
|
|
8
|
-
${
|
|
9
|
-
`;V(X,
|
|
10
|
-
${
|
|
11
|
-
${
|
|
12
|
-
`;V(X,
|
|
13
|
-
\u2714 key added to ${f.keysFile||".env.keys"}`}}catch($){return{success:!1,error:`Failed to encrypt: ${$ instanceof Error?$.message:"Unknown error"}`}}}function
|
|
14
|
-
`),G=[];for(let
|
|
15
|
-
`);if(f.stdout)return{success:!0,output:
|
|
16
|
-
`),
|
|
2
|
+
import{createCipheriv as B2,createDecipheriv as $2,createHash as t,createPrivateKey as V2,createPublicKey as X2,diffieHellman as D2,generateKeyPairSync as H2,hkdfSync as _2,randomBytes as y}from"crypto";var v="x25519-public:",n="x25519-private:",P="encrypted:v2:",i="encrypted:",A2=Buffer.from("stacks-env:v2","utf8"),W2="Environment decryption failed: authentication or format error";function Y2(f){if(f.length===32)return f;return t("sha256").update(f).digest()}function Jf(f,g){let B=y(16),X=B2("aes-256-gcm",Y2(g),B);return{ciphertext:Buffer.concat([X.update(f,"utf8"),X.final()]).toString("hex"),iv:B.toString("hex"),authTag:X.getAuthTag().toString("hex")}}function E2(f,g,B,X){try{let $=$2("aes-256-gcm",Y2(g),Buffer.from(B,"hex"));return $.setAuthTag(Buffer.from(X,"hex")),Buffer.concat([$.update(Buffer.from(f,"hex")),$.final()]).toString("utf8")}catch{throw Error("Decryption failed: authentication or format error")}}function E(f){return f.toString("base64url")}function x(f,g,B){if(typeof f!=="string"||f.length>0&&!/^[A-Za-z0-9_-]+$/.test(f))throw Error(`${g} is not canonical base64url`);let X=Buffer.from(f,"base64url");if(E(X)!==f)throw Error(`${g} is not canonical base64url`);if(B!==void 0&&X.length!==B)throw Error(`${g} has an invalid length`);return X}function C2(f){if(!f.startsWith(v))throw Error("Legacy or invalid public key. Run buddy env:rotate before creating new ciphertext.");let g=X2({key:x(f.slice(v.length),"public key"),format:"der",type:"spki"});if(g.asymmetricKeyType!=="x25519")throw Error("Public key is not X25519");return g}function x2(f){if(!f.startsWith(n))throw Error("Private key is not a version 2 X25519 key");let g=V2({key:x(f.slice(n.length),"private key"),format:"der",type:"pkcs8"});if(g.asymmetricKeyType!=="x25519")throw Error("Private key is not X25519");return g}function j2(f){return Buffer.from(`stacks-env:v2;${f.epk};${f.salt};${f.nonce}`,"utf8")}function S(){let{publicKey:f,privateKey:g}=H2("x25519"),B=f.export({format:"der",type:"spki"}),X=g.export({format:"der",type:"pkcs8"});return{publicKey:`${v}${E(B)}`,privateKey:`${n}${E(X)}`}}function c(f,g){let B=C2(g),X=H2("x25519"),$=E(X.publicKey.export({format:"der",type:"spki"})),D=y(16),H=y(12),W=D2({privateKey:X.privateKey,publicKey:B}),A=Buffer.from(_2("sha256",W,D,A2,32)),Y={epk:$,salt:E(D),nonce:E(H)};try{let _=B2("aes-256-gcm",A,H);_.setAAD(j2(Y));let j=Buffer.concat([_.update(f,"utf8"),_.final()]),J={v:2,...Y,ciphertext:E(j),tag:E(_.getAuthTag())};return`${P}${E(Buffer.from(JSON.stringify(J),"utf8"))}`}finally{W.fill(0),A.fill(0)}}function F2(f){let g=x(f.slice(P.length),"envelope").toString("utf8"),B=JSON.parse(g);if(!B||typeof B!=="object"||Array.isArray(B))throw Error("envelope is not an object");let X=Object.keys(B).sort(),$=["ciphertext","epk","nonce","salt","tag","v"];if(X.length!==$.length||X.some((D,H)=>D!==$[H]))throw Error("envelope fields are invalid");if(B.v!==2)throw Error("envelope version is unsupported");for(let D of["epk","salt","nonce","ciphertext","tag"])if(typeof B[D]!=="string")throw Error(`${D} is invalid`);return B}function b2(f,g){try{let B=F2(f),X=x2(g),$=X2({key:x(B.epk,"ephemeral public key"),format:"der",type:"spki"});if($.asymmetricKeyType!=="x25519")throw Error("ephemeral key is not X25519");let D=x(B.salt,"salt",16),H=x(B.nonce,"nonce",12),W=x(B.ciphertext,"ciphertext"),A=x(B.tag,"tag",16),Y=D2({privateKey:X,publicKey:$}),_=Buffer.from(_2("sha256",Y,D,A2,32));try{let j=$2("aes-256-gcm",_,H);return j.setAAD(j2(B)),j.setAuthTag(A),Buffer.concat([j.update(W),j.final()]).toString("utf8")}finally{Y.fill(0),_.fill(0)}}catch{throw Error(W2)}}function S2(f,g){try{if(!/^[0-9a-f]{64}$/.test(g))throw Error("invalid legacy private key");let B=Buffer.from(f.slice(i.length),"base64");if(B.length<32)throw Error("invalid legacy payload");let X=t("sha256").update(Buffer.from(g,"hex")).digest(),$=t("sha256").update(X).digest();return E2(B.subarray(32).toString("hex"),$,B.subarray(0,16).toString("hex"),B.subarray(16,32).toString("hex"))}catch{throw Error(W2)}}function Of(f){return f.startsWith(i)&&!f.startsWith(P)}function b(f,g){if(!f.startsWith(i))return f;return f.startsWith(P)?b2(f,g):S2(f,g)}function Zf(f,g,B){return c(b(f,g),B)}function Qf(f){let g=f.match(/^DOTENV_PRIVATE_KEY_(.+)$/);return g&&g[1]?g[1].toLowerCase():""}function o(f=""){return f?process.env[`DOTENV_PRIVATE_KEY_${f.toUpperCase()}`]:process.env.DOTENV_PRIVATE_KEY}import{spawnSync as h2}from"child_process";import{readFileSync as K2}from"fs";import{arch as N2,hostname as P2,platform as G2,release as c2,userInfo as k2}from"os";import{basename as m2,dirname as d2,resolve as u2}from"path";function M(f,g={}){let B={},X=[],$=[],D=f.split(`
|
|
3
|
+
`);for(let H of D){let W=H.trim();if(!W||W.startsWith("#"))continue;if(W.startsWith("DOTENV_PUBLIC_KEY=")){let j=W.match(/^DOTENV_PUBLIC_KEY=["']?([^"'\n]+)["']?/);if(j&&j[1]!==void 0)B.DOTENV_PUBLIC_KEY=j[1];continue}let A=W.match(/^([^=]+)=(.*)$/);if(!A||A[1]===void 0||A[2]===void 0)continue;let Y=A[1].trim(),_=A[2].trim();if(_.startsWith('"')&&_.endsWith('"')||_.startsWith("'")&&_.endsWith("'")){if(_=_.slice(1,-1),_.includes("\\n"))_=_.replace(/\\n/g,`
|
|
4
|
+
`)}if(_.startsWith("encrypted:")||_.startsWith("enc:")){if(!g.privateKey){$.push(Y);continue}try{let j=_.startsWith("enc:")?`encrypted:${_.slice(4)}`:_;_=b(j,g.privateKey)}catch(j){X.push(`Failed to decrypt ${Y}: ${j instanceof Error?j.message:"Unknown error"}`)}}_=r2(_,{...g.processEnv||process.env,...B}),_=n2(_),B[Y]=_}return{parsed:B,errors:X,skippedEncrypted:$}}function r2(f,g){return f.replace(/\$\{([^}]+)\}/g,(B,X)=>{let $=X.match(/^([^:\-+]+)(:-|-)(.+)$/);if($){let[,H,W,A]=$,Y=g[H];if(W===":-")return Y||A;else return Y!==void 0?Y:A}let D=X.match(/^([^:\-+]+)(:?\+)(.+)$/);if(D){let[,H,W,A]=D,Y=g[H];if(W===":+")return Y?A:"";else return Y!==void 0?A:""}return g[X]||""})}var t2=new Set(["date","hostname","whoami","uname","pwd","echo","printf","cat","basename","dirname"]);function y2(f){let g=[],B="",X=null,$=!1;for(let D of f.trim()){if($){B+=D,$=!1;continue}if(D==="\\"&&X!=="'"){$=!0;continue}if(X){if(D===X)X=null;else B+=D;continue}if(D==='"'||D==="'"){X=D;continue}if(/\s/.test(D)){if(B)g.push(B),B="";continue}B+=D}if($||X)throw Error("Command substitution contains an unterminated escape or quote");if(B)g.push(B);return g}function v2(f){let[g,...B]=f,X=B.some(($)=>$.startsWith("-"));if(g==="echo"&&!X)return B.join(" ");if(g==="printf"&&B.length===1&&!B[0]?.includes("%"))return B[0];if(g==="hostname"&&B.length===0)return P2();if(g==="whoami"&&B.length===0)return k2().username;if(g==="pwd"&&B.length===0)return process.cwd();if(g==="basename"&&B.length===1)return m2(B[0]??"");if(g==="dirname"&&B.length===1)return d2(B[0]??"");if(g==="cat"&&B.length>0&&!X)return B.map(($)=>K2(u2(process.cwd(),$),"utf8")).join("");if(g==="uname"){let $=B[0]??"-s";if(B.length<=1&&$==="-m")return N2();if(B.length<=1&&$==="-r")return c2();if(B.length<=1&&$==="-s")return{aix:"AIX",android:"Android",cygwin:"CYGWIN",darwin:"Darwin",freebsd:"FreeBSD",haiku:"Haiku",linux:"Linux",netbsd:"NetBSD",openbsd:"OpenBSD",sunos:"SunOS",win32:"Windows_NT"}[G2()]??G2()}return}function n2(f){return f.replace(/\$\(([^)]+)\)/g,(g,B)=>{try{let X=y2(B),$=X[0];if(!$||!t2.has($))return console.warn(`[env] Blocked command substitution for disallowed command: ${$}`),"";let D=v2(X);if(D!==void 0)return D.trim();let H=h2($,X.slice(1),{encoding:"utf8",env:process.env});if(H.status===0)return H.stdout.trim();let W=H.stderr.trim();console.warn(`[env] Command substitution failed (exit code ${H.status??"unknown"}): ${$}${W?`: ${W}`:""}`)}catch(X){console.warn(`[env] Command substitution error: ${X instanceof Error?X.message:String(X)}`)}return""})}async function Mf(f,g={}){let B={},X=[],$=[];for(let D of f)try{let H=Bun.file(D);if(!H.size)continue;let W=await H.text(),{parsed:A,errors:Y,skippedEncrypted:_}=M(W,g);X.push(...Y),$.push(..._);for(let[j,J]of Object.entries(A)){if(!g.overload&&B[j]!==void 0)continue;B[j]=J}}catch(H){if(H?.code==="ENOENT")continue;X.push(`Failed to read ${D}: ${H instanceof Error?H.message:String(H)}`)}return{parsed:B,errors:X,skippedEncrypted:$}}import{existsSync as k}from"fs";import{readFileSync as p}from"fs";import{resolve as m}from"path";function h(f){return typeof f==="string"&&(f.startsWith("encrypted:")||f.startsWith("enc:"))}function F(f){if(!f||h(f))return;let g=f.trim().toLowerCase();if(!/^[a-z0-9_-]+$/.test(g))return;if(g==="prod")return"production";if(g==="stage")return"staging";if(g==="dev")return"development";return g}var d=null,u,r;function i2(f,g,B=".env.keys"){let X=m(g,B);if(!k(X))return;try{let{parsed:$}=M(p(X,"utf-8"));if(f){let D=$[`DOTENV_PRIVATE_KEY_${f.toUpperCase()}`];if(D)return D}return $.DOTENV_PRIVATE_KEY}catch{return}}function l(f={}){return F(f.env)||r||F("development")||F(process.env.DOTENV_ENV)||F(process.env.APP_ENV)||"development"}function o2(f={}){let g=l(f),B=f.cwd||process.cwd();if(d===g)return u;let X=o(g);if(!X)X=process.env.DOTENV_PRIVATE_KEY;if(!X)X=i2(g,B);return d=g,u=X,X}function bf(){d=null,u=void 0,r=void 0}function J2(f,g={}){if(!h(f))return f;let B=o2(g);if(!B)return;try{let X=f.startsWith("enc:")?`encrypted:${f.slice(4)}`:f;return b(X,B)}catch{return}}function O2(f={}){let{path:g=[".env"],overload:B=!1,env:X,privateKey:$,keysFile:D=".env.keys",quiet:H=!1,cwd:W=process.cwd()}=f,A=Array.isArray(g)?g:[g],Y=[],_=0,j=new Set(Object.entries(process.env).filter(([,G])=>G!==void 0&&!h(G)).map(([G])=>G)),J=$;if(!J&&D){let G=m(W,D);if(k(G))try{let Q=p(G,"utf-8"),{parsed:w}=M(Q);if(X){let T=`DOTENV_PRIVATE_KEY_${X.toUpperCase()}`;J=w[T]}else J=w.DOTENV_PRIVATE_KEY}catch(Q){Y.push(`Failed to load keys file: ${Q instanceof Error?Q.message:"Unknown error"}`)}}if(!J)J=o(X||"");for(let G of A){let Q=m(W,G);if(!k(Q)){if(!H)Y.push(`File not found: ${Q}`);continue}try{let w=p(Q,"utf-8"),{parsed:T,errors:I,skippedEncrypted:R}=M(w,{privateKey:J,processEnv:process.env});if(Y.push(...I),R.length>0){for(let N of R)if(h(process.env[N]))delete process.env[N];let U=X?`DOTENV_PRIVATE_KEY_${X.toUpperCase()}`:"DOTENV_PRIVATE_KEY",C=R.slice(0,5).join(", "),K=R.length>5?`, \u2026 +${R.length-5} more`:"";console.warn(`[env] warning: skipped ${R.length} encrypted value(s) in ${G} (${U} not set; defaults apply): ${C}${K}`)}let Z=0;for(let[U,C]of Object.entries(T)){if(U==="DOTENV_PUBLIC_KEY")continue;let K=process.env[U],N=h(K)&&C!==K;if(B||!j.has(U)||N)process.env[U]=C,_++,Z++}if(!H&&!process.env.__ENV_LOADED__)console.error(`[env] loaded ${Z}/${Object.keys(T).length} variables from ${G}`),process.env.__ENV_LOADED__="1"}catch(w){Y.push(`Failed to load ${Q}: ${w instanceof Error?w.message:"Unknown error"}`)}}return{loaded:_,errors:Y}}function p2(f={}){return{name:"env-plugin",setup(g){O2(f)}}}function Sf(f={}){let g=F(f.env)||F("development")||F(process.env.DOTENV_ENV)||F(process.env.APP_ENV)||"development",B=f.cwd||process.cwd();if(r!==g)r=g,d=null,u=void 0;let X=[],$=(W)=>{if(!X.includes(W)&&k(m(B,W)))X.push(W)};$(".env"),$(".env.local");let D=`.env.${g}`,H=`.env.${g}.local`;return $(D),$(H),O2({...f,path:X,env:g})}var Kf=p2;import{existsSync as z,readFileSync as q,renameSync as s,rmSync as Z2,writeFileSync as V}from"fs";import{basename as a,dirname as Q2,resolve as L}from"path";function mf(f,g){if(f)return f;let B=String(g??"").trim();if(!B||B==="development"||B==="dev"||B==="local")return"";if(!/^[\w.-]+$/.test(B))return"";return`.env.${B}`}function R2(f,g,B,X){let $=["#/-------------------[DOTENV_PUBLIC_KEY]--------------------/","#/ versioned X25519 encryption for .env files /","#/ [how it works](https://stacksjs.com/encryption) /","#/----------------------------------------------------------/",`${B}="${g}"`,""],D=!1;for(let H of f.split(`
|
|
5
|
+
`)){let W=H.trim();if(W.startsWith("#/"))continue;if(W.startsWith("DOTENV_PUBLIC_KEY"))continue;if(!W&&!D)continue;if(!W||W.startsWith("#")){D=!0,$.push(H);continue}D=!0;let A=W.match(/^([^=]+)=(.*)$/);if(!A||A[1]===void 0||A[2]===void 0){$.push(H);continue}let Y=A[1].trim(),_=A[2].trim();if(_.startsWith('"')&&_.endsWith('"')||_.startsWith("'")&&_.endsWith("'"))_=_.slice(1,-1);if((!X.key||Y.includes(X.key))&&(!X.excludeKey||!Y.includes(X.excludeKey))&&!_.startsWith("encrypted:"))_=c(_,g);$.push(`${Y}="${_}"`)}return $.join(`
|
|
6
|
+
`)}function e(f){let B=((f||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase();return{publicKeyName:B?`DOTENV_PUBLIC_KEY_${B}`:"DOTENV_PUBLIC_KEY",privateKeyName:B?`DOTENV_PRIVATE_KEY_${B}`:"DOTENV_PRIVATE_KEY"}}function df(f={}){let g=f.cwd||process.cwd(),B=L(g,f.file||".env"),X=L(g,f.keysFile||".env.keys");if(!z(B))return{success:!1,error:`File not found: ${B}`};try{let $,D;if(z(X)){let A=q(X,"utf-8"),{parsed:Y}=M(A),{publicKeyName:_,privateKeyName:j}=e(f.file);if($=Y[_]||"",D=Y[j]||"",!$||!D){let J=S();$=J.publicKey,D=J.privateKey;let G=`
|
|
7
|
+
${_}="${$}"
|
|
8
|
+
${j}="${D}"
|
|
9
|
+
`;V(X,A+G,"utf-8")}}else{let A=S();$=A.publicKey,D=A.privateKey;let{publicKeyName:Y,privateKeyName:_}=e(f.file),j=`# .env.keys - Keep this file secure and never commit to source control
|
|
10
|
+
${Y}="${$}"
|
|
11
|
+
${_}="${D}"
|
|
12
|
+
`;V(X,j,"utf-8")}let H=q(B,"utf-8"),W=R2(H,$,e(f.file).publicKeyName,f);if(f.stdout)return{success:!0,output:W};return V(B,W,"utf-8"),{success:!0,output:`\u2714 encrypted (${f.file||".env"})
|
|
13
|
+
\u2714 key added to ${f.keysFile||".env.keys"}`}}catch($){return{success:!1,error:`Failed to encrypt: ${$ instanceof Error?$.message:"Unknown error"}`}}}function l2(f={}){let g=f.cwd||process.cwd(),B=L(g,f.file||".env"),X=L(g,f.keysFile||".env.keys");if(!z(B))return{success:!1,error:`File not found: ${B}`};if(!z(X))return{success:!1,error:`Keys file not found: ${X}`};try{let $=q(X,"utf-8"),{parsed:D}=M($),A=((f.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),Y=A?`DOTENV_PRIVATE_KEY_${A}`:"DOTENV_PRIVATE_KEY",_=D[Y];if(!_)return{success:!1,error:`Private key not found: ${Y}`};let J=q(B,"utf-8").split(`
|
|
14
|
+
`),G=[];for(let w of J){let T=w.trim();if(!T||T.startsWith("#")){G.push(w);continue}if(T.startsWith("DOTENV_PUBLIC_KEY"))continue;let I=T.match(/^([^=]+)=(.*)$/);if(!I||I[1]===void 0||I[2]===void 0){G.push(w);continue}let R=I[1].trim(),Z=I[2].trim();if(Z.startsWith('"')&&Z.endsWith('"')||Z.startsWith("'")&&Z.endsWith("'"))Z=Z.slice(1,-1);let U=Z.startsWith("encrypted:");if(f.key&&!R.includes(f.key))U=!1;if(U)Z=b(Z,_);G.push(`${R}="${Z}"`)}let Q=G.join(`
|
|
15
|
+
`);if(f.stdout)return{success:!0,output:Q};return V(B,Q,"utf-8"),{success:!0,output:`\u2714 decrypted (${f.file||".env"})`}}catch($){return{success:!1,error:`Failed to decrypt: ${$ instanceof Error?$.message:"Unknown error"}`}}}function uf(f,g,B={}){let X=B.cwd||process.cwd(),$=L(X,B.file||".env"),D=L(X,B.keysFile||".env.keys");try{let H="";if(z($))H=q($,"utf-8");let W=H.split(`
|
|
16
|
+
`),A=!1,Y,J=((B.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),G=J?`DOTENV_PUBLIC_KEY_${J}`:"DOTENV_PUBLIC_KEY",Q=J?`DOTENV_PRIVATE_KEY_${J}`:"DOTENV_PRIVATE_KEY";for(let I of W){let R=I.trim();if(R.startsWith(`${G}=`)){let Z=R.match(/^[^=]+=["']?([^"'\n]+)["']?/);if(Z)Y=Z[1];break}}if(Y){let I=!1;if(z(D)){let R=q(D,"utf-8"),{parsed:Z}=M(R);I=Boolean(Z[Q])}if(!I)Y=void 0}if(!B.plain&&!Y){let I=S();Y=I.publicKey;let R="";if(z(D))R=q(D,"utf-8");R+=`
|
|
17
17
|
${G}="${I.publicKey}"
|
|
18
|
-
${
|
|
19
|
-
`,V(D,
|
|
20
|
-
`);return V($,T,"utf-8"),{success:!0,output:`set ${f}${B.plain?"":" with encryption"} (${B.file||".env"})`}}catch(H){return{success:!1,error:`Failed to set: ${H instanceof Error?H.message:"Unknown error"}`}}}function
|
|
21
|
-
`);break;case"json":default:G=g.prettyPrint?JSON.stringify(
|
|
22
|
-
`),
|
|
18
|
+
${Q}="${I.privateKey}"
|
|
19
|
+
`,V(D,R,"utf-8");for(let Z=W.length-1;Z>=0;Z--){let U=W[Z];if(U!==void 0&&U.trim().startsWith(`${G}=`))W.splice(Z,1)}W.unshift(`${G}="${Y}"`)}let w=g;if(!B.plain&&Y)w=c(g,Y);for(let I=0;I<W.length;I++){let R=W[I];if(R===void 0)continue;if(R.trim().startsWith(`${f}=`)){W[I]=`${f}="${w}"`,A=!0;break}}if(!A)W.push(`${f}="${w}"`);let T=W.join(`
|
|
20
|
+
`);return V($,T,"utf-8"),{success:!0,output:`set ${f}${B.plain?"":" with encryption"} (${B.file||".env"})`}}catch(H){return{success:!1,error:`Failed to set: ${H instanceof Error?H.message:"Unknown error"}`}}}function rf(f,g={}){let B=g.cwd||process.cwd(),X=L(B,g.file||".env");if(!z(X))return{success:!1,error:`File not found: ${X}`};try{let $,D=L(B,g.keysFile||".env.keys"),A=((g.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),Y=A?`DOTENV_PRIVATE_KEY_${A}`:"DOTENV_PRIVATE_KEY";if(z(D)){let Q=q(D,"utf-8"),{parsed:w}=M(Q);$=w[Y]}if(!$)$=process.env[Y];let _=q(X,"utf-8"),{parsed:j}=M(_,{privateKey:$});if(f&&!g.all){let Q=j[f];if(Q===void 0)return{success:!1,error:`Key not found: ${f}`};return{success:!0,output:Q}}let J=g.all?{...process.env,...j}:j,G;switch(g.format){case"shell":G=Object.entries(J).map(([Q,w])=>`${Q}=${w}`).join(" ");break;case"eval":G=Object.entries(J).map(([Q,w])=>`${Q}="${w}"`).join(`
|
|
21
|
+
`);break;case"json":default:G=g.prettyPrint?JSON.stringify(J,null,2):JSON.stringify(J);break}return{success:!0,output:G}}catch($){return{success:!1,error:`Failed to get: ${$ instanceof Error?$.message:"Unknown error"}`}}}function tf(f,g={}){let B=g.cwd||process.cwd(),X=L(B,g.keysFile||".env.keys");if(!z(X))return{success:!1,error:`Keys file not found: ${X}`};try{let $=q(X,"utf-8"),{parsed:D}=M($),A=((g.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),Y=A?`DOTENV_PUBLIC_KEY_${A}`:"DOTENV_PUBLIC_KEY",_=A?`DOTENV_PRIVATE_KEY_${A}`:"DOTENV_PRIVATE_KEY";if(f){let G=D[f];if(!G)return{success:!1,error:`Key not found: ${f}`};return{success:!0,output:G}}let j={[Y]:D[Y],[_]:D[_]};return{success:!0,output:g.format==="shell"?`${Y}=${j[Y]} ${_}=${j[_]}`:JSON.stringify(j)}}catch($){return{success:!1,error:`Failed to get keypair: ${$ instanceof Error?$.message:"Unknown error"}`}}}function yf(f={}){let g=l2({file:f.file,keysFile:f.keysFile,stdout:!0,cwd:f.cwd});if(!g.success)return g;let B=f.cwd||process.cwd(),X=L(B,f.file||".env"),$=L(B,f.keysFile||".env.keys");if(g.output===void 0)return{success:!1,error:"Rotation produced no decrypted content"};let D=S(),H=q(X),W=q($),A=W.toString("utf8").split(`
|
|
22
|
+
`),Y=f.file||".env",_=a(Y).replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),j=_?`DOTENV_PUBLIC_KEY_${_}`:"DOTENV_PUBLIC_KEY",J=_?`DOTENV_PRIVATE_KEY_${_}`:"DOTENV_PRIVATE_KEY",G=!1,Q=!1;for(let U=0;U<A.length;U++){let C=A[U];if(C===void 0)continue;if(C.startsWith(`${j}=`))A[U]=`${j}="${D.publicKey}"`,G=!0;else if(C.startsWith(`${J}=`))A[U]=`${J}="${D.privateKey}"`,Q=!0}if(!G)A.push(`${j}="${D.publicKey}"`);if(!Q)A.push(`${J}="${D.privateKey}"`);let w=`${A.join(`
|
|
23
23
|
`).replace(/\n+$/,"")}
|
|
24
|
-
`,T=
|
|
25
|
-
`).map((g)=>g.trim()).filter(Boolean).filter((g)=>g!==".env.example").filter((g)=>/(?:^|\/)\.env(?:\.|$)/.test(g)).filter((g)=>!g.endsWith(".env.keys"))}function
|
|
26
|
-
`),H=D.findIndex((
|
|
27
|
-
`))}function
|
|
24
|
+
`,T=R2(g.output,D.publicKey,j,f),I=`${process.pid}-${Date.now()}`,R=L(Q2(X),`.${a(X)}.${I}.rotate`),Z=L(Q2($),`.${a($)}.${I}.rotate`);try{if(V(R,T,{encoding:"utf8",mode:384}),V(Z,w,{encoding:"utf8",mode:384}),f.stdout)return s(Z,$),{success:!0,output:T};s(R,X);try{s(Z,$)}catch(U){throw V(X,H),U}return{success:!0,output:`\u2714 rotated (${f.file||".env"}) to encrypted:v2`}}catch(U){if(!z($))V($,W,{mode:384});return{success:!1,error:`Failed to rotate without exposing plaintext: ${U instanceof Error?U.message:"Unknown error"}`}}finally{Z2(R,{force:!0}),Z2(Z,{force:!0})}}import O from"process";import{platform as s2}from"os";var I2=typeof Bun<"u",w2=typeof O<"u"&&O.versions?.node!==void 0,a2=I2?"bun":w2?"node":"unknown",pf={name:a2,version:I2?Bun.version:w2?O.version:void 0},g2=s2(),lf=g2==="win32",sf=g2==="darwin",af=g2==="linux",U2=Boolean(O.stdout?.isTTY),ef=typeof globalThis.window<"u",e2=Boolean(O.env.CI||O.env.CONTINUOUS_INTEGRATION||O.env.BUILD_NUMBER||O.env.RUN_ID),f5=Boolean(O.env.DEBUG||O.env.VERBOSE||O.argv.includes("--debug")||O.argv.includes("--verbose")),ff=e2||!U2,g5=Boolean(!ff&&(U2||O.env.COLORTERM||O.env.FORCE_COLOR||O.env.TERM&&O.env.TERM!=="dumb")),f2={github:{name:"GitHub Actions",detected:Boolean(O.env.GITHUB_ACTIONS)},gitlab:{name:"GitLab CI",detected:Boolean(O.env.GITLAB_CI)},circle:{name:"CircleCI",detected:Boolean(O.env.CIRCLECI)},travis:{name:"Travis CI",detected:Boolean(O.env.TRAVIS)},jenkins:{name:"Jenkins",detected:Boolean(O.env.JENKINS_URL)},vercel:{name:"Vercel",detected:Boolean(O.env.VERCEL)},netlify:{name:"Netlify",detected:Boolean(O.env.NETLIFY)},heroku:{name:"Heroku",detected:Boolean(O.env.DYNO)},aws:{name:"AWS",detected:Boolean(O.env.AWS_REGION||O.env.AWS_LAMBDA_FUNCTION_NAME)},azure:{name:"Azure",detected:Boolean(O.env.AZURE_HTTP_USER_AGENT)},cloudflare:{name:"Cloudflare",detected:Boolean(O.env.CF_PAGES)},railway:{name:"Railway",detected:Boolean(O.env.RAILWAY_ENVIRONMENT)},render:{name:"Render",detected:Boolean(O.env.RENDER)}},gf=Object.keys(f2).find((f)=>{let g=f2[f];return g!==void 0&&g.detected})||"unknown",B5=f2[gf]||{name:"Unknown",detected:!1};import _f from"process";import{projectPath as Af}from"@stacksjs/path";import M2 from"fs";var T2={APP_ENV:["local","dev","development","staging","prod","production"],DB_CONNECTION:["mysql","sqlite","postgres","singlestore","vitess","dynamodb"],DB_MIGRATE_FRESH:["allow","confirm","disabled"],MAIL_MAILER:["smtp","mailgun","ses","log","sendgrid","mailtrap","capture"],SEARCH_ENGINE_DRIVER:["opensearch","meilisearch","algolia","typesense"],FRONTEND_APP_ENV:["development","staging","production"]};function Bf(f){return typeof f==="string"&&(f.startsWith("encrypted:")||f.startsWith("enc:"))}var $f=/(?:^|_)(?:PASSWORD|PASSWD|SECRET|TOKEN|APIKEY|API_KEY|CREDENTIAL|CREDENTIALS|PRIVATE|SALT|DSN|CERT|CIPHER|SIGNATURE|WEBHOOK)(?:_|$)|(?:^|_)(?:ACCESS|SECRET)_KEY(?:_|$)|_KEY$/,Xf=/^DOTENV_(?:PUBLIC|PRIVATE)_KEY/,Df=/^\$\{[^}]+\}$/;function D5(f,g={}){let{placeholders:B={},strict:X=!1}=g,$=[];for(let[D,H]of Object.entries(f)){if(!H||H.trim()==="")continue;if(Bf(H))continue;if(Xf.test(D))continue;if(Df.test(H.trim()))continue;let W=$f.test(D),A=Object.prototype.hasOwnProperty.call(B,D)&&B[D]===H;if(W&&!A){$.push({key:D,reason:"plaintext-secret"});continue}if(X)$.push({key:D,reason:"plaintext-value"})}return $}function H5(f){return f.split(`
|
|
25
|
+
`).map((g)=>g.trim()).filter(Boolean).filter((g)=>g!==".env.example").filter((g)=>/(?:^|\/)\.env(?:\.|$)/.test(g)).filter((g)=>!g.endsWith(".env.keys"))}function L2(f){return`${f.replace(/[^a-z0-9]/gi,"").toUpperCase()}_`}function Hf(f,g={}){let B=g.self?L2(g.self):void 0,X=(g.tenants??[]).filter((H)=>typeof H==="string"&&H.trim().length>0).map((H)=>({slug:H,prefix:L2(H)})).filter(({prefix:H})=>H!==B).sort((H,W)=>W.prefix.length-H.prefix.length),$={},D={};for(let[H,W]of Object.entries(f)){let A=X.find(({prefix:Y})=>H.startsWith(Y));if(A){(D[A.slug]??={})[H]=W;continue}$[H]=W}return{own:$,foreign:D}}function A5(f,g={}){return Hf(f,g).own}function W5(f){return Object.entries(f.foreign).map(([g,B])=>({tenant:g,keys:Object.keys(B).sort()})).sort((g,B)=>g.tenant.localeCompare(B.tenant))}var q2=new Set;function Wf(f){if(q2.has(f))return;q2.add(f);let g=l();console.warn(`[env] warning: "${f}" is encrypted but no usable private key was found for the "${g}" environment; falling back to its default. Set DOTENV_PRIVATE_KEY_${g.toUpperCase()} or ship .env.keys.`)}var Yf={get:(f,g)=>{let B=f[g];if(typeof B==="string"&&(B.startsWith("encrypted:")||B.startsWith("enc:"))){let $=J2(B);if($===void 0){Wf(g),delete f[g];return}f[g]=$,B=$}let X=["_PORT","_TIMEOUT","_TTL","_SIZE","_LIMIT","_MAX","_MIN","_INTERVAL","_RETRIES","_CONCURRENCY","_WORKERS","_CONNECTIONS"];if(typeof B==="string"&&/^\d+$/.test(B)&&!B.startsWith("0")&&X.some(($)=>g.endsWith($)))return Number(B);if(typeof B==="string"){let $=B.toLowerCase();if($==="true")return!0;if($==="false")return!1}return B}};function jf(){return typeof Bun<"u"?Bun.env:_f.env}var z2=new Proxy(jf(),Yf);function Q5(f,g,B){let X=B?.path||Af(".env"),D=M2.readFileSync(X,"utf-8").split(`
|
|
26
|
+
`),H=D.findIndex((Y)=>Y.startsWith(`${f}=`)),A=/[\s"'#$\\]/.test(g)?`"${g.replace(/"/g,"\\\"")}"`:g;if(H!==-1)D[H]=`${f}=${A}`;else D.push(`${f}=${A}`);M2.writeFileSync(X,D.join(`
|
|
27
|
+
`))}function R5(f=z2){let g=[];for(let[B,X]of Object.entries(T2)){let $=f[B];if($!==void 0&&$!==""&&!X.includes(String($)))g.push(`${B}="${$}" is not valid. Allowed values: ${X.join(", ")}`)}return g}function I5(f,g=z2){let B=[];for(let X of f){let $=g[X];if($===void 0||$===""||$===null)B.push(X)}if(B.length>0)throw Error(`[env] Missing required environment variable(s): ${B.join(", ")}. Set them in .env or your process environment before booting.`);return g}export{Q5 as writeEnv,R5 as validateEnv,H5 as trackedEnvFiles,L2 as tenantEnvPrefix,A5 as stripForeignTenantEnv,uf as setEnv,pf as runtimeInfo,a2 as runtime,yf as rotateKeypair,o2 as resolvePrivateKey,mf as resolveEnvFile,bf as resetPrivateKeyCache,I5 as requireEnv,B5 as providerInfo,gf as provider,jf as process,g2 as platform,D5 as plaintextSecrets,Hf as partitionTenantEnv,Qf as parseEnvFromKey,M as parse,Zf as migrateEncryptedValue,Mf as loadEnvFiles,O2 as loadEnv,lf as isWindows,w2 as isNode,ff as isMinimal,sf as isMacOS,af as isLinux,Of as isLegacyEncryptedValue,Bf as isEncryptedValue,f5 as isDebug,g5 as isColorSupported,e2 as isCI,I2 as isBun,ef as hasWindow,U2 as hasTTY,o as getPrivateKey,tf as getKeypair,rf as getEnv,S as generateKeypair,W5 as foreignTenantKeys,p2 as envPlugin,e as envKeyNames,T2 as envEnum,z2 as env,c as encryptValue,df as encryptEnv,b as decryptValue,J2 as decryptEnvValue,l2 as decryptEnv,Sf as autoLoadEnv,Jf as aesEncrypt,E2 as aesDecrypt,l as activeEnvName,$f as SECRET_NAME_PATTERN};
|
package/package.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"name": "@stacksjs/env",
|
|
3
3
|
"type": "module",
|
|
4
4
|
"sideEffects": false,
|
|
5
|
-
"version": "0.70.
|
|
5
|
+
"version": "0.70.357",
|
|
6
6
|
"description": "Stacks env helper methods.",
|
|
7
7
|
"author": "Chris Breuer",
|
|
8
8
|
"contributors": [
|
|
@@ -56,7 +56,7 @@
|
|
|
56
56
|
},
|
|
57
57
|
"devDependencies": {
|
|
58
58
|
"better-dx": "^0.2.17",
|
|
59
|
-
"@stacksjs/path": "0.70.
|
|
60
|
-
"@stacksjs/validation": "0.70.
|
|
59
|
+
"@stacksjs/path": "0.70.357",
|
|
60
|
+
"@stacksjs/validation": "0.70.357"
|
|
61
61
|
}
|
|
62
62
|
}
|