@stacksjs/env 0.74.32 → 0.74.34
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.d.ts +27 -0
- package/dist/cli.js +28 -24
- package/dist/index.js +30 -26
- package/package.json +3 -3
package/dist/cli.d.ts
CHANGED
|
@@ -54,6 +54,33 @@ export declare function envKeyNames(file?: string): { publicKeyName: string, pri
|
|
|
54
54
|
* With no ciphertext there is nothing to stay consistent with, so a fresh
|
|
55
55
|
* keypair is both safe and correct.
|
|
56
56
|
*/
|
|
57
|
+
/**
|
|
58
|
+
* Every public-key name a file may legitimately declare, in preference order.
|
|
59
|
+
*
|
|
60
|
+
* `dotenvx` accepts both the suffixed `DOTENV_PUBLIC_KEY_<ENV>` and the plain
|
|
61
|
+
* `DOTENV_PUBLIC_KEY`, and real projects use the plain form. Looking only for
|
|
62
|
+
* the suffixed name meant a file declaring the plain one appeared to have no
|
|
63
|
+
* key at all, so a fresh keypair was generated, a SECOND declaration was
|
|
64
|
+
* prepended, and every value already encrypted under the original key was
|
|
65
|
+
* stranded (stacksjs/stacks#2489).
|
|
66
|
+
*/
|
|
67
|
+
export declare function envPublicKeyNames(file?: string): string[];
|
|
68
|
+
/** Likewise for the private half. */
|
|
69
|
+
export declare function envPrivateKeyNames(file?: string): string[];
|
|
70
|
+
/**
|
|
71
|
+
* Does this file already hold ciphertext, under any key name?
|
|
72
|
+
*
|
|
73
|
+
* The witness that makes rotation unsafe. If ANY value is encrypted, some key
|
|
74
|
+
* out there decrypts it, and generating a new one strands those values whether
|
|
75
|
+
* or not we recognise the name their public key was declared under. Deliberately
|
|
76
|
+
* name-agnostic: the name is exactly what the previous guards got wrong.
|
|
77
|
+
*/
|
|
78
|
+
export declare function envHasCiphertext(envContent: string): boolean;
|
|
79
|
+
/**
|
|
80
|
+
* The public key an env file declares, whichever accepted name it uses, plus
|
|
81
|
+
* that name so callers write back to the same line instead of adding a second.
|
|
82
|
+
*/
|
|
83
|
+
export declare function declaredEnvPublicKey(envContent: string, file?: string): { name: string, key: string } | undefined;
|
|
57
84
|
export declare function reusableEnvPublicKey(envContent: string, publicKeyName: string): string | undefined;
|
|
58
85
|
/**
|
|
59
86
|
* Encrypt .env file
|
package/dist/cli.js
CHANGED
|
@@ -1,28 +1,32 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{existsSync as
|
|
3
|
-
`);for(let
|
|
4
|
-
`)}if(
|
|
5
|
-
`)){let r=s.trim();if(!r||r.startsWith("#"))continue;if(r.startsWith("DOTENV_PUBLIC_KEY"))continue;let i=r.match(/^([^=]+)=(.*)$/);if(!i||i[1]===void 0)continue;let
|
|
6
|
-
`)){let a=
|
|
7
|
-
`)}function
|
|
8
|
-
`)){let
|
|
2
|
+
import{existsSync as K,readFileSync as k,renameSync as ne,rmSync as re,writeFileSync as b}from"fs";import{basename as se,dirname as j,resolve as E}from"path";import{createCipheriv as X,createDecipheriv as H,createHash as I,createPrivateKey as fe,createPublicKey as G,diffieHellman as J,generateKeyPairSync as M,hkdfSync as z,randomBytes as S}from"crypto";var Y="x25519-public:",A="x25519-private:",C="encrypted:v2:",U="encrypted:",q=Buffer.from("stacks-env:v2","utf8"),Z="Environment decryption failed: authentication or format error";function Q(t){if(t.length===32)return t;return I("sha256").update(t).digest()}function Be(t,n){let e=S(16),s=X("aes-256-gcm",Q(n),e);return{ciphertext:Buffer.concat([s.update(t,"utf8"),s.final()]).toString("hex"),iv:e.toString("hex"),authTag:s.getAuthTag().toString("hex")}}function le(t,n,e,s){try{let r=H("aes-256-gcm",Q(n),Buffer.from(e,"hex"));return r.setAuthTag(Buffer.from(s,"hex")),Buffer.concat([r.update(Buffer.from(t,"hex")),r.final()]).toString("utf8")}catch{throw Error("Decryption failed: authentication or format error")}}function x(t){return t.toString("base64url")}function V(t,n,e){if(typeof t!=="string"||t.length>0&&!/^[A-Za-z0-9_-]+$/.test(t))throw Error(`${n} is not canonical base64url`);let s=Buffer.from(t,"base64url");if(x(s)!==t)throw Error(`${n} is not canonical base64url`);if(e!==void 0&&s.length!==e)throw Error(`${n} has an invalid length`);return s}function pe(t){if(!t.startsWith(Y))throw Error("Legacy or invalid public key. Run buddy env:rotate before creating new ciphertext.");let n=G({key:V(t.slice(Y.length),"public key"),format:"der",type:"spki"});if(n.asymmetricKeyType!=="x25519")throw Error("Public key is not X25519");return n}function de(t){if(!t.startsWith(A))throw Error("Private key is not a version 2 X25519 key");let n=fe({key:V(t.slice(A.length),"private key"),format:"der",type:"pkcs8"});if(n.asymmetricKeyType!=="x25519")throw Error("Private key is not X25519");return n}function ee(t){return Buffer.from(`stacks-env:v2;${t.epk};${t.salt};${t.nonce}`,"utf8")}function F(){let{publicKey:t,privateKey:n}=M("x25519"),e=t.export({format:"der",type:"spki"}),s=n.export({format:"der",type:"pkcs8"});return{publicKey:`${Y}${x(e)}`,privateKey:`${A}${x(s)}`}}function W(t,n){let e=pe(n),s=M("x25519"),r=x(s.publicKey.export({format:"der",type:"spki"})),i=S(16),o=S(12),a=J({privateKey:s.privateKey,publicKey:e}),u=Buffer.from(z("sha256",a,i,q,32)),f={epk:r,salt:x(i),nonce:x(o)};try{let c=X("aes-256-gcm",u,o);c.setAAD(ee(f));let l=Buffer.concat([c.update(t,"utf8"),c.final()]),p={v:2,...f,ciphertext:x(l),tag:x(c.getAuthTag())};return`${C}${x(Buffer.from(JSON.stringify(p),"utf8"))}`}finally{a.fill(0),u.fill(0)}}function ye(t){let n=V(t.slice(C.length),"envelope").toString("utf8"),e=JSON.parse(n);if(!e||typeof e!=="object"||Array.isArray(e))throw Error("envelope is not an object");let s=Object.keys(e).sort(),r=["ciphertext","epk","nonce","salt","tag","v"];if(s.length!==r.length||s.some((i,o)=>i!==r[o]))throw Error("envelope fields are invalid");if(e.v!==2)throw Error("envelope version is unsupported");for(let i of["epk","salt","nonce","ciphertext","tag"])if(typeof e[i]!=="string")throw Error(`${i} is invalid`);return e}function ge(t,n){try{let e=ye(t),s=de(n),r=G({key:V(e.epk,"ephemeral public key"),format:"der",type:"spki"});if(r.asymmetricKeyType!=="x25519")throw Error("ephemeral key is not X25519");let i=V(e.salt,"salt",16),o=V(e.nonce,"nonce",12),a=V(e.ciphertext,"ciphertext"),u=V(e.tag,"tag",16),f=J({privateKey:s,publicKey:r}),c=Buffer.from(z("sha256",f,i,q,32));try{let l=H("aes-256-gcm",c,o);return l.setAAD(ee(e)),l.setAuthTag(u),Buffer.concat([l.update(a),l.final()]).toString("utf8")}finally{f.fill(0),c.fill(0)}}catch{throw Error(Z)}}function he(t,n){try{if(!/^[0-9a-f]{64}$/.test(n))throw Error("invalid legacy private key");let e=Buffer.from(t.slice(U.length),"base64");if(e.length<32)throw Error("invalid legacy payload");let s=I("sha256").update(Buffer.from(n,"hex")).digest(),r=I("sha256").update(s).digest();return le(e.subarray(32).toString("hex"),r,e.subarray(0,16).toString("hex"),e.subarray(16,32).toString("hex"))}catch{throw Error(Z)}}function Ie(t){return t.startsWith(U)&&!t.startsWith(C)}function R(t,n){if(!t.startsWith(U))return t;return t.startsWith(C)?ge(t,n):he(t,n)}function Se(t,n,e){return W(R(t,n),e)}function Ye(t){let n=t.match(/^DOTENV_PRIVATE_KEY_(.+)$/);return n&&n[1]?n[1].toLowerCase():""}function Ae(t=""){return t?process.env[`DOTENV_PRIVATE_KEY_${t.toUpperCase()}`]:process.env.DOTENV_PRIVATE_KEY}import{spawnSync as me}from"child_process";import{readFileSync as ve}from"fs";import{arch as Ee,hostname as $e,platform as te,release as ke,userInfo as Ke}from"os";import{basename as we,dirname as be,resolve as Ne}from"path";function T(t,n={}){let e={},s=[],r=[],i=t.split(`
|
|
3
|
+
`);for(let o of i){let a=o.trim();if(!a||a.startsWith("#"))continue;if(a.startsWith("DOTENV_PUBLIC_KEY=")){let l=a.match(/^DOTENV_PUBLIC_KEY=["']?([^"'\n]+)["']?/);if(l&&l[1]!==void 0)e.DOTENV_PUBLIC_KEY=l[1];continue}let u=a.match(/^([^=]+)=(.*)$/);if(!u||u[1]===void 0||u[2]===void 0)continue;let f=u[1].trim(),c=u[2].trim();if(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'")){if(c=c.slice(1,-1),c.includes("\\n"))c=c.replace(/\\n/g,`
|
|
4
|
+
`)}if(c.startsWith("encrypted:")||c.startsWith("enc:")){if(!n.privateKey){r.push(f);continue}try{let l=c.startsWith("enc:")?`encrypted:${c.slice(4)}`:c;c=R(l,n.privateKey)}catch(l){s.push(`Failed to decrypt ${f}: ${l instanceof Error?l.message:"Unknown error"}`)}}c=_e(c,{...n.processEnv||process.env,...e}),c=Te(c),e[f]=c}return{parsed:e,errors:s,skippedEncrypted:r}}function _e(t,n){return t.replace(/\$\{([^}]+)\}/g,(e,s)=>{let r=s.match(/^([^:\-+]+)(:-|-)(.+)$/);if(r){let[,o,a,u]=r,f=n[o];if(a===":-")return f||u;else return f!==void 0?f:u}let i=s.match(/^([^:\-+]+)(:?\+)(.+)$/);if(i){let[,o,a,u]=i,f=n[o];if(a===":+")return f?u:"";else return f!==void 0?u:""}return n[s]||""})}var xe=new Set(["date","hostname","whoami","uname","pwd","echo","printf","cat","basename","dirname"]);function Pe(t){let n=[],e="",s=null,r=!1;for(let i of t.trim()){if(r){e+=i,r=!1;continue}if(i==="\\"&&s!=="'"){r=!0;continue}if(s){if(i===s)s=null;else e+=i;continue}if(i==='"'||i==="'"){s=i;continue}if(/\s/.test(i)){if(e)n.push(e),e="";continue}e+=i}if(r||s)throw Error("Command substitution contains an unterminated escape or quote");if(e)n.push(e);return n}function Ve(t){let[n,...e]=t,s=e.some((r)=>r.startsWith("-"));if(n==="echo"&&!s)return e.join(" ");if(n==="printf"&&e.length===1&&!e[0]?.includes("%"))return e[0];if(n==="hostname"&&e.length===0)return $e();if(n==="whoami"&&e.length===0)return Ke().username;if(n==="pwd"&&e.length===0)return process.cwd();if(n==="basename"&&e.length===1)return we(e[0]??"");if(n==="dirname"&&e.length===1)return be(e[0]??"");if(n==="cat"&&e.length>0&&!s)return e.map((r)=>ve(Ne(process.cwd(),r),"utf8")).join("");if(n==="uname"){let r=e[0]??"-s";if(e.length<=1&&r==="-m")return Ee();if(e.length<=1&&r==="-r")return ke();if(e.length<=1&&r==="-s")return{aix:"AIX",android:"Android",cygwin:"CYGWIN",darwin:"Darwin",freebsd:"FreeBSD",haiku:"Haiku",linux:"Linux",netbsd:"NetBSD",openbsd:"OpenBSD",sunos:"SunOS",win32:"Windows_NT"}[te()]??te()}return}function Te(t){return t.replace(/\$\(([^)]+)\)/g,(n,e)=>{try{let s=Pe(e),r=s[0];if(!r||!xe.has(r))return console.warn(`[env] Blocked command substitution for disallowed command: ${r}`),"";let i=Ve(s);if(i!==void 0)return i.trim();let o=me(r,s.slice(1),{encoding:"utf8",env:process.env});if(o.status===0)return o.stdout.trim();let a=o.stderr.trim();console.warn(`[env] Command substitution failed (exit code ${o.status??"unknown"}): ${r}${a?`: ${a}`:""}`)}catch(s){console.warn(`[env] Command substitution error: ${s instanceof Error?s.message:String(s)}`)}return""})}async function Je(t,n={}){let e={},s=[],r=[];for(let i of t)try{let o=Bun.file(i);if(!o.size)continue;let a=await o.text(),{parsed:u,errors:f,skippedEncrypted:c}=T(a,n);s.push(...f),r.push(...c);for(let[l,p]of Object.entries(u)){if(!n.overload&&e[l]!==void 0)continue;e[l]=p}}catch(o){if(o?.code==="ENOENT")continue;s.push(`Failed to read ${i}: ${o instanceof Error?o.message:String(o)}`)}return{parsed:e,errors:s,skippedEncrypted:r}}function et(t,n){if(t)return t;let e=String(n??"").trim();if(!e||e==="development"||e==="dev"||e==="local")return"";if(!/^[\w.-]+$/.test(e))return"";return`.env.${e}`}function oe(t,n){return(!n.key||t.includes(n.key))&&(!n.excludeKey||!t.includes(n.excludeKey))}function Oe(t,n){let e=[];for(let s of t.split(`
|
|
5
|
+
`)){let r=s.trim();if(!r||r.startsWith("#"))continue;if(r.startsWith("DOTENV_PUBLIC_KEY"))continue;let i=r.match(/^([^=]+)=(.*)$/);if(!i||i[1]===void 0)continue;let o=i[1].trim();if(oe(o,n))e.push(o)}return e}function ce(t,n,e,s){let r=["#/-------------------[DOTENV_PUBLIC_KEY]--------------------/","#/ versioned X25519 encryption for .env files /","#/ [how it works](https://stacksjs.com/encryption) /","#/----------------------------------------------------------/",`${e}="${n}"`,""],i=!1;for(let o of t.split(`
|
|
6
|
+
`)){let a=o.trim();if(a.startsWith("#/"))continue;if(a.startsWith("DOTENV_PUBLIC_KEY"))continue;if(!a&&!i)continue;if(!a||a.startsWith("#")){i=!0,r.push(o);continue}i=!0;let u=a.match(/^([^=]+)=(.*)$/);if(!u||u[1]===void 0||u[2]===void 0){r.push(o);continue}let f=u[1].trim(),c=u[2].trim();if(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))c=c.slice(1,-1);if(oe(f,s)&&!c.startsWith("encrypted:"))c=W(c,n);r.push(`${f}="${c}"`)}return r.join(`
|
|
7
|
+
`)}function D(t){let e=((t||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase();return{publicKeyName:e?`DOTENV_PUBLIC_KEY_${e}`:"DOTENV_PUBLIC_KEY",privateKeyName:e?`DOTENV_PRIVATE_KEY_${e}`:"DOTENV_PRIVATE_KEY"}}function ae(t){let{publicKeyName:n}=D(t);return n==="DOTENV_PUBLIC_KEY"?[n]:[n,"DOTENV_PUBLIC_KEY"]}function L(t){let{privateKeyName:n}=D(t);return n==="DOTENV_PRIVATE_KEY"?[n]:[n,"DOTENV_PRIVATE_KEY"]}function ie(t){for(let n of t.split(`
|
|
8
|
+
`)){let e=n.trim();if(!e||e.startsWith("#"))continue;let s=e.match(/^([^=]+)=(.*)$/);if(!s?.[1]||s[2]===void 0)continue;let r=s[2].trim().replace(/^["']|["']$/g,"");if(r.startsWith("encrypted:")||r.startsWith("enc:"))return!0}return!1}function De(t,n){let e=ae(n);for(let s of t.split(`
|
|
9
|
+
`)){let r=s.trim();if(!r||r.startsWith("#"))continue;let i=r.match(/^([^=]+)=["']?([^"'\n]+)["']?/);if(!i?.[1]||!i[2])continue;let o=i[1].trim();if(e.includes(o))return{name:o,key:i[2]}}return}function Fe(t,n){let e,s=!1;for(let r of t.split(`
|
|
10
|
+
`)){let i=r.trim();if(!i||i.startsWith("#"))continue;let o=i.match(/^([^=]+)=(.*)$/);if(!o?.[1]||o[2]===void 0)continue;let a=o[1].trim(),u=o[2].trim().replace(/^["']|["']$/g,"");if(a===n)e=u;else if(u.startsWith("encrypted:")||u.startsWith("enc:"))s=!0}return e&&s?e:void 0}function tt(t={}){let n=t.cwd||process.cwd(),e=E(n,t.file||".env"),s=E(n,t.keysFile||".env.keys");if(!K(e))return{success:!1,error:`File not found: ${e}`};try{let r,i,o=Fe(k(e,"utf-8"),D(t.file).publicKeyName);if(o)r=o;else if(K(s)){let f=k(s,"utf-8"),{parsed:c}=T(f),{publicKeyName:l,privateKeyName:p}=D(t.file);if(r=c[l]||"",i=c[p]||"",!r||!i){let g=F();r=g.publicKey,i=g.privateKey;let d=`
|
|
9
11
|
${l}="${r}"
|
|
10
|
-
${
|
|
11
|
-
`;b(s,f+
|
|
12
|
-
${
|
|
12
|
+
${p}="${i}"
|
|
13
|
+
`;b(s,f+d,"utf-8")}}else{let f=F();r=f.publicKey,i=f.privateKey;let{publicKeyName:c,privateKeyName:l}=D(t.file),p=`# .env.keys - Keep this file secure and never commit to source control
|
|
14
|
+
${c}="${r}"
|
|
13
15
|
${l}="${i}"
|
|
14
|
-
`;b(s,
|
|
15
|
-
\u2714 key added to ${t.keysFile||".env.keys"}`}}catch(r){return{success:!1,error:`Failed to encrypt: ${r instanceof Error?r.message:"Unknown error"}`}}}function
|
|
16
|
-
`),
|
|
17
|
-
`);if(t.stdout)return{success:!0,output:m};return b(e,m,"utf-8"),{success:!0,output:`\u2714 decrypted (${t.file||".env"})`}}catch(r){return{success:!1,error:`Failed to decrypt: ${r instanceof Error?r.message:"Unknown error"}`}}}function
|
|
18
|
-
`),u=!1,f,
|
|
19
|
-
|
|
20
|
-
${
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
`),
|
|
16
|
+
`;b(s,p,"utf-8")}let a=k(e,"utf-8"),u=ce(a,r,D(t.file).publicKeyName,t);if(t.stdout)return{success:!0,output:u};return b(e,u,"utf-8"),{success:!0,output:`\u2714 encrypted (${t.file||".env"})
|
|
17
|
+
\u2714 key added to ${t.keysFile||".env.keys"}`}}catch(r){return{success:!1,error:`Failed to encrypt: ${r instanceof Error?r.message:"Unknown error"}`}}}function Re(t={}){let n=t.cwd||process.cwd(),e=E(n,t.file||".env"),s=E(n,t.keysFile||".env.keys");if(!K(e))return{success:!1,error:`File not found: ${e}`};if(!K(s))return{success:!1,error:`Keys file not found: ${s}`};try{let r=k(s,"utf-8"),{parsed:i}=T(r),u=((t.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),f=u?`DOTENV_PRIVATE_KEY_${u}`:"DOTENV_PRIVATE_KEY",c=i[f];if(!c)return{success:!1,error:`Private key not found: ${f}`};let l=[c];if(f!=="DOTENV_PRIVATE_KEY"&&i.DOTENV_PRIVATE_KEY&&i.DOTENV_PRIVATE_KEY!==c)l.push(i.DOTENV_PRIVATE_KEY);let g=k(e,"utf-8").split(`
|
|
18
|
+
`),d=[];for(let N of g){let h=N.trim();if(!h||h.startsWith("#")){d.push(N);continue}if(h.startsWith("DOTENV_PUBLIC_KEY"))continue;let O=h.match(/^([^=]+)=(.*)$/);if(!O||O[1]===void 0||O[2]===void 0){d.push(N);continue}let v=O[1].trim(),y=O[2].trim();if(y.startsWith('"')&&y.endsWith('"')||y.startsWith("'")&&y.endsWith("'"))y=y.slice(1,-1);let _=y.startsWith("encrypted:");if(t.key&&!v.includes(t.key))_=!1;if(_){let w,P;for(let B of l)try{w=R(y,B);break}catch(ue){P=ue}if(w===void 0)throw P instanceof Error?P:Error(`Unable to decrypt ${v}`);y=w}d.push(`${v}="${y}"`)}let m=d.join(`
|
|
19
|
+
`);if(t.stdout)return{success:!0,output:m};return b(e,m,"utf-8"),{success:!0,output:`\u2714 decrypted (${t.file||".env"})`}}catch(r){return{success:!1,error:`Failed to decrypt: ${r instanceof Error?r.message:"Unknown error"}`}}}function nt(t,n,e={}){let s=e.cwd||process.cwd(),r=E(s,e.file||".env"),i=e.keysFile?E(s,e.keysFile):E(j(r),".env.keys");try{let o="";if(K(r))o=k(r,"utf-8");let a=o.split(`
|
|
20
|
+
`),u=!1,f,p=((e.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),g=p?`DOTENV_PUBLIC_KEY_${p}`:"DOTENV_PUBLIC_KEY",d=p?`DOTENV_PRIVATE_KEY_${p}`:"DOTENV_PRIVATE_KEY",m=De(o,e.file),N=m?.name??g;if(f=m?.key,f){let v=!1;if(K(i)){let _=k(i,"utf-8"),{parsed:w}=T(_);v=L(e.file).some((P)=>Boolean(w[P]))}let y=L(e.file).some((_)=>Boolean(process.env[_]));if(!v&&!y&&!ie(o))f=void 0}if(!e.plain&&!f&&ie(o))return{success:!1,error:`${e.file||".env"} already contains encrypted values, but no key that can be used to add another was found.
|
|
21
|
+
Generating one would leave every existing encrypted value unreadable.
|
|
22
|
+
Provide the private key as ${L(e.file)[0]} in the environment, restore ${i}, or use --plain to write this value unencrypted.`};if(!e.plain&&!f){let v=F();f=v.publicKey;let y="";if(K(i))y=k(i,"utf-8");y+=`
|
|
23
|
+
${g}="${v.publicKey}"
|
|
24
|
+
${d}="${v.privateKey}"
|
|
25
|
+
`,b(i,y,"utf-8");let _=ae(e.file);for(let w=a.length-1;w>=0;w--){let P=a[w];if(P!==void 0&&_.some((B)=>P.trim().startsWith(`${B}=`)))a.splice(w,1)}a.unshift(`${N}="${f}"`)}let h=n;if(!e.plain&&f)h=W(n,f);for(let v=0;v<a.length;v++){let y=a[v];if(y===void 0)continue;if(y.trim().startsWith(`${t}=`)){a[v]=`${t}="${h}"`,u=!0;break}}if(!u)a.push(`${t}="${h}"`);let O=a.join(`
|
|
26
|
+
`);return b(r,O,"utf-8"),{success:!0,output:`set ${t}${e.plain?"":" with encryption"} (${e.file||".env"})`}}catch(o){return{success:!1,error:`Failed to set: ${o instanceof Error?o.message:"Unknown error"}`}}}function rt(t,n={}){let e=n.cwd||process.cwd(),s=E(e,n.file||".env");if(!K(s))return{success:!1,error:`File not found: ${s}`};try{let r,i=E(e,n.keysFile||".env.keys"),u=((n.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),f=u?`DOTENV_PRIVATE_KEY_${u}`:"DOTENV_PRIVATE_KEY";if(K(i)){let d=k(i,"utf-8"),{parsed:m}=T(d);r=m[f]}if(!r)r=process.env[f];let c=k(s,"utf-8"),{parsed:l}=T(c,{privateKey:r});if(t&&!n.all){let d=l[t];if(d===void 0)return{success:!1,error:`Key not found: ${t}`};return{success:!0,output:d}}let p=n.all?{...process.env,...l}:l,g;switch(n.format){case"shell":g=Object.entries(p).map(([d,m])=>`${d}=${m}`).join(" ");break;case"eval":g=Object.entries(p).map(([d,m])=>`${d}="${m}"`).join(`
|
|
27
|
+
`);break;case"json":default:g=n.prettyPrint?JSON.stringify(p,null,2):JSON.stringify(p);break}return{success:!0,output:g}}catch(r){return{success:!1,error:`Failed to get: ${r instanceof Error?r.message:"Unknown error"}`}}}function st(t,n={}){let e=n.cwd||process.cwd(),s=E(e,n.keysFile||".env.keys");if(!K(s))return{success:!1,error:`Keys file not found: ${s}`};try{let r=k(s,"utf-8"),{parsed:i}=T(r),u=((n.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),f=u?`DOTENV_PUBLIC_KEY_${u}`:"DOTENV_PUBLIC_KEY",c=u?`DOTENV_PRIVATE_KEY_${u}`:"DOTENV_PRIVATE_KEY";if(t){let g=i[t];if(!g)return{success:!1,error:`Key not found: ${t}`};return{success:!0,output:g}}let l={[f]:i[f],[c]:i[c]};return{success:!0,output:n.format==="shell"?`${f}=${l[f]} ${c}=${l[c]}`:JSON.stringify(l)}}catch(r){return{success:!1,error:`Failed to get keypair: ${r instanceof Error?r.message:"Unknown error"}`}}}function Ce(t,n,e,s){let r=t.split(`
|
|
28
|
+
`),i=!1,o=!1;for(let a=0;a<r.length;a++){let u=r[a];if(u===void 0)continue;if(u.startsWith(`${e}=`))r[a]=`${e}="${n.publicKey}"`,i=!0;else if(u.startsWith(`${s}=`))r[a]=`${s}="${n.privateKey}"`,o=!0}if(!i)r.push(`${e}="${n.publicKey}"`);if(!o)r.push(`${s}="${n.privateKey}"`);return`${r.join(`
|
|
25
29
|
`).replace(/\n+$/,"")}
|
|
26
|
-
`}function
|
|
27
|
-
`)}}let f=
|
|
28
|
-
`)};let l=
|
|
30
|
+
`}function it(t={}){let n=Re({file:t.file,keysFile:t.keysFile,stdout:!0,cwd:t.cwd});if(!n.success)return n;if(n.output===void 0)return{success:!1,error:"Rotation produced no decrypted content"};let e=t.cwd||process.cwd(),s=t.file||".env",r=t.keysFile||".env.keys",i=E(e,s),o=E(e,r),{publicKeyName:a,privateKeyName:u}=D(t.file);if(t.dryRun){let h=Oe(n.output,t);return{success:!0,output:["Dry run: nothing was written.",`${s}: ${h.length} value${h.length===1?"":"s"} would be re-encrypted under a new ${a}.`,`${r}: ${a} and ${u} would be replaced.`,`The current ${u} decrypts nothing once that happens, so keep a copy until the rotation is verified.`].join(`
|
|
31
|
+
`)}}let f=F(),c=ce(n.output,f.publicKey,a,t);if(t.stdout)return{success:!0,output:c,notice:[`Nothing was written. To adopt the output above, put this keypair in ${r}:`,"",`${a}="${f.publicKey}"`,`${u}="${f.privateKey}"`,"","Without it that output cannot be decrypted. Run without --stdout to have both applied together."].join(`
|
|
32
|
+
`)};let l=k(i),p=k(o),g=Ce(p.toString("utf8"),f,a,u),d=`${process.pid}-${Date.now()}`,m=E(j(i),`.${se(i)}.${d}.rotate`),N=E(j(o),`.${se(o)}.${d}.rotate`);try{b(m,c,{encoding:"utf8",mode:384}),b(N,g,{encoding:"utf8",mode:384}),ne(m,i);try{ne(N,o)}catch(h){throw b(i,l),h}return{success:!0,output:`\u2714 rotated (${s}) to encrypted:v2`}}catch(h){if(!K(o))b(o,p,{mode:384});return{success:!1,error:`Failed to rotate without exposing plaintext: ${h instanceof Error?h.message:"Unknown error"}`}}finally{re(m,{force:!0}),re(N,{force:!0})}}export{De as declaredEnvPublicKey,Re as decryptEnv,tt as encryptEnv,ie as envHasCiphertext,D as envKeyNames,L as envPrivateKeyNames,ae as envPublicKeyNames,rt as getEnv,st as getKeypair,et as resolveEnvFile,Fe as reusableEnvPublicKey,it as rotateKeypair,nt as setEnv};
|
package/dist/index.js
CHANGED
|
@@ -1,31 +1,35 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import
|
|
3
|
-
`);for(let o of s){let d=o.trim();if(!d||d.startsWith("#"))continue;if(d.startsWith("DOTENV_PUBLIC_KEY=")){let f=d.match(/^DOTENV_PUBLIC_KEY=["']?([^"'\n]+)["']?/);if(f&&f[1]!==void 0)t.DOTENV_PUBLIC_KEY=f[1];continue}let c=d.match(/^([^=]+)=(.*)$/);if(!c||c[1]===void 0||c[2]===void 0)continue;let
|
|
4
|
-
`)}if(
|
|
5
|
-
`)){let i=r.trim();if(!i||i.startsWith("#"))continue;if(i.startsWith("DOTENV_PUBLIC_KEY"))continue;let s=i.match(/^([^=]+)=(.*)$/);if(!s||s[1]===void 0)continue;let o=s[1].trim();if(
|
|
6
|
-
`)){let d=o.trim();if(d.startsWith("#/"))continue;if(d.startsWith("DOTENV_PUBLIC_KEY"))continue;if(!d&&!s)continue;if(!d||d.startsWith("#")){s=!0,i.push(o);continue}s=!0;let c=d.match(/^([^=]+)=(.*)$/);if(!c||c[1]===void 0||c[2]===void 0){i.push(o);continue}let
|
|
7
|
-
`)}function
|
|
8
|
-
`)){let
|
|
2
|
+
import mn from"process";import{projectPath as Rn}from"@stacksjs/path";import De from"fs";import{existsSync as V}from"fs";import{readFileSync as J}from"fs";import{resolve as M}from"path";import{createCipheriv as ie,createDecipheriv as se,createHash as H,createPrivateKey as Le,createPublicKey as oe,diffieHellman as de,generateKeyPairSync as ce,hkdfSync as ae,randomBytes as j}from"crypto";var X="x25519-public:",Q="x25519-private:",w="encrypted:v2:",q="encrypted:",ue=Buffer.from("stacks-env:v2","utf8"),fe="Environment decryption failed: authentication or format error";function Ee(e){if(e.length===32)return e;return H("sha256").update(e).digest()}function In(e,n){let t=j(16),r=ie("aes-256-gcm",Ee(n),t);return{ciphertext:Buffer.concat([r.update(e,"utf8"),r.final()]).toString("hex"),iv:t.toString("hex"),authTag:r.getAuthTag().toString("hex")}}function ke(e,n,t,r){try{let i=se("aes-256-gcm",Ee(n),Buffer.from(t,"hex"));return i.setAuthTag(Buffer.from(r,"hex")),Buffer.concat([i.update(Buffer.from(e,"hex")),i.final()]).toString("utf8")}catch{throw Error("Decryption failed: authentication or format error")}}function C(e){return e.toString("base64url")}function b(e,n,t){if(typeof e!=="string"||e.length>0&&!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${n} is not canonical base64url`);let r=Buffer.from(e,"base64url");if(C(r)!==e)throw Error(`${n} is not canonical base64url`);if(t!==void 0&&r.length!==t)throw Error(`${n} has an invalid length`);return r}function Ue(e){if(!e.startsWith(X))throw Error("Legacy or invalid public key. Run buddy env:rotate before creating new ciphertext.");let n=oe({key:b(e.slice(X.length),"public key"),format:"der",type:"spki"});if(n.asymmetricKeyType!=="x25519")throw Error("Public key is not X25519");return n}function $e(e){if(!e.startsWith(Q))throw Error("Private key is not a version 2 X25519 key");let n=Le({key:b(e.slice(Q.length),"private key"),format:"der",type:"pkcs8"});if(n.asymmetricKeyType!=="x25519")throw Error("Private key is not X25519");return n}function le(e){return Buffer.from(`stacks-env:v2;${e.epk};${e.salt};${e.nonce}`,"utf8")}function U(){let{publicKey:e,privateKey:n}=ce("x25519"),t=e.export({format:"der",type:"spki"}),r=n.export({format:"der",type:"pkcs8"});return{publicKey:`${X}${C(t)}`,privateKey:`${Q}${C(r)}`}}function B(e,n){let t=Ue(n),r=ce("x25519"),i=C(r.publicKey.export({format:"der",type:"spki"})),s=j(16),o=j(12),d=de({privateKey:r.privateKey,publicKey:t}),c=Buffer.from(ae("sha256",d,s,ue,32)),a={epk:i,salt:C(s),nonce:C(o)};try{let u=ie("aes-256-gcm",c,o);u.setAAD(le(a));let f=Buffer.concat([u.update(e,"utf8"),u.final()]),E={v:2,...a,ciphertext:C(f),tag:C(u.getAuthTag())};return`${w}${C(Buffer.from(JSON.stringify(E),"utf8"))}`}finally{d.fill(0),c.fill(0)}}function xe(e){let n=b(e.slice(w.length),"envelope").toString("utf8"),t=JSON.parse(n);if(!t||typeof t!=="object"||Array.isArray(t))throw Error("envelope is not an object");let r=Object.keys(t).sort(),i=["ciphertext","epk","nonce","salt","tag","v"];if(r.length!==i.length||r.some((s,o)=>s!==i[o]))throw Error("envelope fields are invalid");if(t.v!==2)throw Error("envelope version is unsupported");for(let s of["epk","salt","nonce","ciphertext","tag"])if(typeof t[s]!=="string")throw Error(`${s} is invalid`);return t}function we(e,n){try{let t=xe(e),r=$e(n),i=oe({key:b(t.epk,"ephemeral public key"),format:"der",type:"spki"});if(i.asymmetricKeyType!=="x25519")throw Error("ephemeral key is not X25519");let s=b(t.salt,"salt",16),o=b(t.nonce,"nonce",12),d=b(t.ciphertext,"ciphertext"),c=b(t.tag,"tag",16),a=de({privateKey:r,publicKey:i}),u=Buffer.from(ae("sha256",a,s,ue,32));try{let f=se("aes-256-gcm",u,o);return f.setAAD(le(t)),f.setAuthTag(c),Buffer.concat([f.update(d),f.final()]).toString("utf8")}finally{a.fill(0),u.fill(0)}}catch{throw Error(fe)}}function Be(e,n){try{if(!/^[0-9a-f]{64}$/.test(n))throw Error("invalid legacy private key");let t=Buffer.from(e.slice(q.length),"base64");if(t.length<32)throw Error("invalid legacy payload");let r=H("sha256").update(Buffer.from(n,"hex")).digest(),i=H("sha256").update(r).digest();return ke(t.subarray(32).toString("hex"),i,t.subarray(0,16).toString("hex"),t.subarray(16,32).toString("hex"))}catch{throw Error(fe)}}function Nn(e){return e.startsWith(q)&&!e.startsWith(w)}function L(e,n){if(!e.startsWith(q))return e;return e.startsWith(w)?we(e,n):Be(e,n)}function hn(e,n,t){return B(L(e,n),t)}function Pn(e){let n=e.match(/^DOTENV_PRIVATE_KEY_(.+)$/);return n&&n[1]?n[1].toLowerCase():""}function z(e=""){return e?process.env[`DOTENV_PRIVATE_KEY_${e.toUpperCase()}`]:process.env.DOTENV_PRIVATE_KEY}import{spawnSync as Ve}from"child_process";import{readFileSync as Me}from"fs";import{arch as Fe,hostname as Ye,platform as pe,release as We,userInfo as Ge}from"os";import{basename as He,dirname as je,resolve as Xe}from"path";function h(e,n={}){let t={},r=[],i=[],s=e.split(`
|
|
3
|
+
`);for(let o of s){let d=o.trim();if(!d||d.startsWith("#"))continue;if(d.startsWith("DOTENV_PUBLIC_KEY=")){let f=d.match(/^DOTENV_PUBLIC_KEY=["']?([^"'\n]+)["']?/);if(f&&f[1]!==void 0)t.DOTENV_PUBLIC_KEY=f[1];continue}let c=d.match(/^([^=]+)=(.*)$/);if(!c||c[1]===void 0||c[2]===void 0)continue;let a=c[1].trim(),u=c[2].trim();if(u.startsWith('"')&&u.endsWith('"')||u.startsWith("'")&&u.endsWith("'")){if(u=u.slice(1,-1),u.includes("\\n"))u=u.replace(/\\n/g,`
|
|
4
|
+
`)}if(u.startsWith("encrypted:")||u.startsWith("enc:")){if(!n.privateKey){i.push(a);continue}try{let f=u.startsWith("enc:")?`encrypted:${u.slice(4)}`:u;u=L(f,n.privateKey)}catch(f){r.push(`Failed to decrypt ${a}: ${f instanceof Error?f.message:"Unknown error"}`)}}u=Qe(u,{...n.processEnv||process.env,...t}),u=Ze(u),t[a]=u}return{parsed:t,errors:r,skippedEncrypted:i}}function Qe(e,n){return e.replace(/\$\{([^}]+)\}/g,(t,r)=>{let i=r.match(/^([^:\-+]+)(:-|-)(.+)$/);if(i){let[,o,d,c]=i,a=n[o];if(d===":-")return a||c;else return a!==void 0?a:c}let s=r.match(/^([^:\-+]+)(:?\+)(.+)$/);if(s){let[,o,d,c]=s,a=n[o];if(d===":+")return a?c:"";else return a!==void 0?c:""}return n[r]||""})}var qe=new Set(["date","hostname","whoami","uname","pwd","echo","printf","cat","basename","dirname"]);function ze(e){let n=[],t="",r=null,i=!1;for(let s of e.trim()){if(i){t+=s,i=!1;continue}if(s==="\\"&&r!=="'"){i=!0;continue}if(r){if(s===r)r=null;else t+=s;continue}if(s==='"'||s==="'"){r=s;continue}if(/\s/.test(s)){if(t)n.push(t),t="";continue}t+=s}if(i||r)throw Error("Command substitution contains an unterminated escape or quote");if(t)n.push(t);return n}function Je(e){let[n,...t]=e,r=t.some((i)=>i.startsWith("-"));if(n==="echo"&&!r)return t.join(" ");if(n==="printf"&&t.length===1&&!t[0]?.includes("%"))return t[0];if(n==="hostname"&&t.length===0)return Ye();if(n==="whoami"&&t.length===0)return Ge().username;if(n==="pwd"&&t.length===0)return process.cwd();if(n==="basename"&&t.length===1)return He(t[0]??"");if(n==="dirname"&&t.length===1)return je(t[0]??"");if(n==="cat"&&t.length>0&&!r)return t.map((i)=>Me(Xe(process.cwd(),i),"utf8")).join("");if(n==="uname"){let i=t[0]??"-s";if(t.length<=1&&i==="-m")return Fe();if(t.length<=1&&i==="-r")return We();if(t.length<=1&&i==="-s")return{aix:"AIX",android:"Android",cygwin:"CYGWIN",darwin:"Darwin",freebsd:"FreeBSD",haiku:"Haiku",linux:"Linux",netbsd:"NetBSD",openbsd:"OpenBSD",sunos:"SunOS",win32:"Windows_NT"}[pe()]??pe()}return}function Ze(e){return e.replace(/\$\(([^)]+)\)/g,(n,t)=>{try{let r=ze(t),i=r[0];if(!i||!qe.has(i))return console.warn(`[env] Blocked command substitution for disallowed command: ${i}`),"";let s=Je(r);if(s!==void 0)return s.trim();let o=Ve(i,r.slice(1),{encoding:"utf8",env:process.env});if(o.status===0)return o.stdout.trim();let d=o.stderr.trim();console.warn(`[env] Command substitution failed (exit code ${o.status??"unknown"}): ${i}${d?`: ${d}`:""}`)}catch(r){console.warn(`[env] Command substitution error: ${r instanceof Error?r.message:String(r)}`)}return""})}async function Un(e,n={}){let t={},r=[],i=[];for(let s of e)try{let o=Bun.file(s);if(!o.size)continue;let d=await o.text(),{parsed:c,errors:a,skippedEncrypted:u}=h(d,n);r.push(...a),i.push(...u);for(let[f,E]of Object.entries(c)){if(!n.overload&&t[f]!==void 0)continue;t[f]=E}}catch(o){if(o?.code==="ENOENT")continue;r.push(`Failed to read ${s}: ${o instanceof Error?o.message:String(o)}`)}return{parsed:t,errors:r,skippedEncrypted:i}}function x(e){return typeof e==="string"&&(e.startsWith("encrypted:")||e.startsWith("enc:"))}function K(e){if(!e||x(e))return;let n=e.trim().toLowerCase();if(!/^[a-z0-9_-]+$/.test(n))return;if(n==="prod")return"production";if(n==="stage")return"staging";if(n==="dev")return"development";return n}var F=null,Y,W;function en(e,n,t=".env.keys"){let r=M(n,t);if(!V(r))return;try{let{parsed:i}=h(J(r,"utf-8"));if(e){let s=i[`DOTENV_PRIVATE_KEY_${e.toUpperCase()}`];if(s)return s}return i.DOTENV_PRIVATE_KEY}catch{return}}function Z(e={}){return K(e.env)||W||K("development")||K(process.env.DOTENV_ENV)||K(process.env.APP_ENV)||"development"}function nn(e={}){let n=Z(e),t=e.cwd||process.cwd();if(F===n)return Y;let r=z(n);if(!r)r=process.env.DOTENV_PRIVATE_KEY;if(!r)r=en(n,t);return F=n,Y=r,r}function Fn(){F=null,Y=void 0,W=void 0}function ge(e,n={}){if(!x(e))return e;let t=nn(n);if(!t)return;try{let r=e.startsWith("enc:")?`encrypted:${e.slice(4)}`:e;return L(r,t)}catch{return}}function _e(e={}){let{path:n=[".env"],overload:t=!1,env:r,privateKey:i,keysFile:s=".env.keys",quiet:o=!1,cwd:d=process.cwd()}=e,c=Array.isArray(n)?n:[n],a=[],u=0,f=new Set(Object.entries(process.env).filter(([,g])=>g!==void 0&&!x(g)).map(([g])=>g)),E=i;if(!E&&s){let g=M(d,s);if(V(g))try{let l=J(g,"utf-8"),{parsed:y}=h(l);if(r){let v=`DOTENV_PRIVATE_KEY_${r.toUpperCase()}`;E=y[v]}else E=y.DOTENV_PRIVATE_KEY}catch(l){a.push(`Failed to load keys file: ${l instanceof Error?l.message:"Unknown error"}`)}}if(!E)E=z(r||"");for(let g of c){let l=M(d,g);if(!V(l)){if(!o)a.push(`File not found: ${l}`);continue}try{let y=J(l,"utf-8"),{parsed:v,errors:T,skippedEncrypted:O}=h(y,{privateKey:E,processEnv:process.env});if(a.push(...T),O.length>0){for(let I of O)if(x(process.env[I]))delete process.env[I];let _=r?`DOTENV_PRIVATE_KEY_${r.toUpperCase()}`:"DOTENV_PRIVATE_KEY",A=O.slice(0,5).join(", "),R=O.length>5?`, \u2026 +${O.length-5} more`:"";console.warn(`[env] warning: skipped ${O.length} encrypted value(s) in ${g} (${_} not set; defaults apply): ${A}${R}`)}let m=0;for(let[_,A]of Object.entries(v)){if(_==="DOTENV_PUBLIC_KEY")continue;let R=process.env[_],I=x(R)&&A!==R;if(t||!f.has(_)||I)process.env[_]=A,u++,m++}if(!o&&!process.env.__ENV_LOADED__)console.error(`[env] loaded ${m}/${Object.keys(v).length} variables from ${g}`),process.env.__ENV_LOADED__="1"}catch(y){a.push(`Failed to load ${l}: ${y instanceof Error?y.message:"Unknown error"}`)}}return{loaded:u,errors:a}}function tn(e={}){return{name:"env-plugin",setup(n){_e(e)}}}function Yn(e={}){let n=K(e.env)||K("development")||K(process.env.DOTENV_ENV)||K(process.env.APP_ENV)||"development",t=e.cwd||process.cwd();if(W!==n)W=n,F=null,Y=void 0;let r=[],i=(d)=>{if(!r.includes(d)&&V(M(t,d)))r.push(d)};i(".env"),i(".env.local");let s=`.env.${n}`,o=`.env.${n}.local`;return i(s),i(o),_e({...e,path:r,env:n})}var Gn=tn;var ye={APP_ENV:["local","dev","development","staging","prod","production"],DB_CONNECTION:["mysql","sqlite","postgres","singlestore","vitess","dynamodb"],DB_MIGRATE_FRESH:["allow","confirm","disabled"],MAIL_MAILER:["smtp","mailgun","ses","log","sendgrid","mailtrap","capture"],SEARCH_ENGINE_DRIVER:["opensearch","meilisearch","algolia","typesense"],FRONTEND_APP_ENV:["development","staging","production"]};function Hn(e){return e}import{existsSync as P,readFileSync as N,renameSync as Te,rmSync as me,writeFileSync as D}from"fs";import{basename as Re,dirname as ne,resolve as S}from"path";function Jn(e,n){if(e)return e;let t=String(n??"").trim();if(!t||t==="development"||t==="dev"||t==="local")return"";if(!/^[\w.-]+$/.test(t))return"";return`.env.${t}`}function Oe(e,n){return(!n.key||e.includes(n.key))&&(!n.excludeKey||!e.includes(n.excludeKey))}function rn(e,n){let t=[];for(let r of e.split(`
|
|
5
|
+
`)){let i=r.trim();if(!i||i.startsWith("#"))continue;if(i.startsWith("DOTENV_PUBLIC_KEY"))continue;let s=i.match(/^([^=]+)=(.*)$/);if(!s||s[1]===void 0)continue;let o=s[1].trim();if(Oe(o,n))t.push(o)}return t}function Ae(e,n,t,r){let i=["#/-------------------[DOTENV_PUBLIC_KEY]--------------------/","#/ versioned X25519 encryption for .env files /","#/ [how it works](https://stacksjs.com/encryption) /","#/----------------------------------------------------------/",`${t}="${n}"`,""],s=!1;for(let o of e.split(`
|
|
6
|
+
`)){let d=o.trim();if(d.startsWith("#/"))continue;if(d.startsWith("DOTENV_PUBLIC_KEY"))continue;if(!d&&!s)continue;if(!d||d.startsWith("#")){s=!0,i.push(o);continue}s=!0;let c=d.match(/^([^=]+)=(.*)$/);if(!c||c[1]===void 0||c[2]===void 0){i.push(o);continue}let a=c[1].trim(),u=c[2].trim();if(u.startsWith('"')&&u.endsWith('"')||u.startsWith("'")&&u.endsWith("'"))u=u.slice(1,-1);if(Oe(a,r)&&!u.startsWith("encrypted:"))u=B(u,n);i.push(`${a}="${u}"`)}return i.join(`
|
|
7
|
+
`)}function k(e){let t=((e||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase();return{publicKeyName:t?`DOTENV_PUBLIC_KEY_${t}`:"DOTENV_PUBLIC_KEY",privateKeyName:t?`DOTENV_PRIVATE_KEY_${t}`:"DOTENV_PRIVATE_KEY"}}function Se(e){let{publicKeyName:n}=k(e);return n==="DOTENV_PUBLIC_KEY"?[n]:[n,"DOTENV_PUBLIC_KEY"]}function ee(e){let{privateKeyName:n}=k(e);return n==="DOTENV_PRIVATE_KEY"?[n]:[n,"DOTENV_PRIVATE_KEY"]}function ve(e){for(let n of e.split(`
|
|
8
|
+
`)){let t=n.trim();if(!t||t.startsWith("#"))continue;let r=t.match(/^([^=]+)=(.*)$/);if(!r?.[1]||r[2]===void 0)continue;let i=r[2].trim().replace(/^["']|["']$/g,"");if(i.startsWith("encrypted:")||i.startsWith("enc:"))return!0}return!1}function sn(e,n){let t=Se(n);for(let r of e.split(`
|
|
9
|
+
`)){let i=r.trim();if(!i||i.startsWith("#"))continue;let s=i.match(/^([^=]+)=["']?([^"'\n]+)["']?/);if(!s?.[1]||!s[2])continue;let o=s[1].trim();if(t.includes(o))return{name:o,key:s[2]}}return}function on(e,n){let t,r=!1;for(let i of e.split(`
|
|
10
|
+
`)){let s=i.trim();if(!s||s.startsWith("#"))continue;let o=s.match(/^([^=]+)=(.*)$/);if(!o?.[1]||o[2]===void 0)continue;let d=o[1].trim(),c=o[2].trim().replace(/^["']|["']$/g,"");if(d===n)t=c;else if(c.startsWith("encrypted:")||c.startsWith("enc:"))r=!0}return t&&r?t:void 0}function Zn(e={}){let n=e.cwd||process.cwd(),t=S(n,e.file||".env"),r=S(n,e.keysFile||".env.keys");if(!P(t))return{success:!1,error:`File not found: ${t}`};try{let i,s,o=on(N(t,"utf-8"),k(e.file).publicKeyName);if(o)i=o;else if(P(r)){let a=N(r,"utf-8"),{parsed:u}=h(a),{publicKeyName:f,privateKeyName:E}=k(e.file);if(i=u[f]||"",s=u[E]||"",!i||!s){let g=U();i=g.publicKey,s=g.privateKey;let l=`
|
|
9
11
|
${f}="${i}"
|
|
10
|
-
${
|
|
11
|
-
`;
|
|
12
|
-
${
|
|
12
|
+
${E}="${s}"
|
|
13
|
+
`;D(r,a+l,"utf-8")}}else{let a=U();i=a.publicKey,s=a.privateKey;let{publicKeyName:u,privateKeyName:f}=k(e.file),E=`# .env.keys - Keep this file secure and never commit to source control
|
|
14
|
+
${u}="${i}"
|
|
13
15
|
${f}="${s}"
|
|
14
|
-
`;
|
|
15
|
-
\u2714 key added to ${e.keysFile||".env.keys"}`}}catch(i){return{success:!1,error:`Failed to encrypt: ${i instanceof Error?i.message:"Unknown error"}`}}}function
|
|
16
|
-
`),l=[];for(let v of
|
|
17
|
-
`);if(e.stdout)return{success:!0,output:
|
|
18
|
-
`),c=!1,
|
|
19
|
-
|
|
20
|
-
${
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
16
|
+
`;D(r,E,"utf-8")}let d=N(t,"utf-8"),c=Ae(d,i,k(e.file).publicKeyName,e);if(e.stdout)return{success:!0,output:c};return D(t,c,"utf-8"),{success:!0,output:`\u2714 encrypted (${e.file||".env"})
|
|
17
|
+
\u2714 key added to ${e.keysFile||".env.keys"}`}}catch(i){return{success:!1,error:`Failed to encrypt: ${i instanceof Error?i.message:"Unknown error"}`}}}function dn(e={}){let n=e.cwd||process.cwd(),t=S(n,e.file||".env"),r=S(n,e.keysFile||".env.keys");if(!P(t))return{success:!1,error:`File not found: ${t}`};if(!P(r))return{success:!1,error:`Keys file not found: ${r}`};try{let i=N(r,"utf-8"),{parsed:s}=h(i),c=((e.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),a=c?`DOTENV_PRIVATE_KEY_${c}`:"DOTENV_PRIVATE_KEY",u=s[a];if(!u)return{success:!1,error:`Private key not found: ${a}`};let f=[u];if(a!=="DOTENV_PRIVATE_KEY"&&s.DOTENV_PRIVATE_KEY&&s.DOTENV_PRIVATE_KEY!==u)f.push(s.DOTENV_PRIVATE_KEY);let g=N(t,"utf-8").split(`
|
|
18
|
+
`),l=[];for(let v of g){let T=v.trim();if(!T||T.startsWith("#")){l.push(v);continue}if(T.startsWith("DOTENV_PUBLIC_KEY"))continue;let O=T.match(/^([^=]+)=(.*)$/);if(!O||O[1]===void 0||O[2]===void 0){l.push(v);continue}let m=O[1].trim(),_=O[2].trim();if(_.startsWith('"')&&_.endsWith('"')||_.startsWith("'")&&_.endsWith("'"))_=_.slice(1,-1);let A=_.startsWith("encrypted:");if(e.key&&!m.includes(e.key))A=!1;if(A){let R,I;for(let G of f)try{R=L(_,G);break}catch(Ke){I=Ke}if(R===void 0)throw I instanceof Error?I:Error(`Unable to decrypt ${m}`);_=R}l.push(`${m}="${_}"`)}let y=l.join(`
|
|
19
|
+
`);if(e.stdout)return{success:!0,output:y};return D(t,y,"utf-8"),{success:!0,output:`\u2714 decrypted (${e.file||".env"})`}}catch(i){return{success:!1,error:`Failed to decrypt: ${i instanceof Error?i.message:"Unknown error"}`}}}function et(e,n,t={}){let r=t.cwd||process.cwd(),i=S(r,t.file||".env"),s=t.keysFile?S(r,t.keysFile):S(ne(i),".env.keys");try{let o="";if(P(i))o=N(i,"utf-8");let d=o.split(`
|
|
20
|
+
`),c=!1,a,E=((t.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),g=E?`DOTENV_PUBLIC_KEY_${E}`:"DOTENV_PUBLIC_KEY",l=E?`DOTENV_PRIVATE_KEY_${E}`:"DOTENV_PRIVATE_KEY",y=sn(o,t.file),v=y?.name??g;if(a=y?.key,a){let m=!1;if(P(s)){let A=N(s,"utf-8"),{parsed:R}=h(A);m=ee(t.file).some((I)=>Boolean(R[I]))}let _=ee(t.file).some((A)=>Boolean(process.env[A]));if(!m&&!_&&!ve(o))a=void 0}if(!t.plain&&!a&&ve(o))return{success:!1,error:`${t.file||".env"} already contains encrypted values, but no key that can be used to add another was found.
|
|
21
|
+
Generating one would leave every existing encrypted value unreadable.
|
|
22
|
+
Provide the private key as ${ee(t.file)[0]} in the environment, restore ${s}, or use --plain to write this value unencrypted.`};if(!t.plain&&!a){let m=U();a=m.publicKey;let _="";if(P(s))_=N(s,"utf-8");_+=`
|
|
23
|
+
${g}="${m.publicKey}"
|
|
24
|
+
${l}="${m.privateKey}"
|
|
25
|
+
`,D(s,_,"utf-8");let A=Se(t.file);for(let R=d.length-1;R>=0;R--){let I=d[R];if(I!==void 0&&A.some((G)=>I.trim().startsWith(`${G}=`)))d.splice(R,1)}d.unshift(`${v}="${a}"`)}let T=n;if(!t.plain&&a)T=B(n,a);for(let m=0;m<d.length;m++){let _=d[m];if(_===void 0)continue;if(_.trim().startsWith(`${e}=`)){d[m]=`${e}="${T}"`,c=!0;break}}if(!c)d.push(`${e}="${T}"`);let O=d.join(`
|
|
26
|
+
`);return D(i,O,"utf-8"),{success:!0,output:`set ${e}${t.plain?"":" with encryption"} (${t.file||".env"})`}}catch(o){return{success:!1,error:`Failed to set: ${o instanceof Error?o.message:"Unknown error"}`}}}function nt(e,n={}){let t=n.cwd||process.cwd(),r=S(t,n.file||".env");if(!P(r))return{success:!1,error:`File not found: ${r}`};try{let i,s=S(t,n.keysFile||".env.keys"),c=((n.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),a=c?`DOTENV_PRIVATE_KEY_${c}`:"DOTENV_PRIVATE_KEY";if(P(s)){let l=N(s,"utf-8"),{parsed:y}=h(l);i=y[a]}if(!i)i=process.env[a];let u=N(r,"utf-8"),{parsed:f}=h(u,{privateKey:i});if(e&&!n.all){let l=f[e];if(l===void 0)return{success:!1,error:`Key not found: ${e}`};return{success:!0,output:l}}let E=n.all?{...process.env,...f}:f,g;switch(n.format){case"shell":g=Object.entries(E).map(([l,y])=>`${l}=${y}`).join(" ");break;case"eval":g=Object.entries(E).map(([l,y])=>`${l}="${y}"`).join(`
|
|
27
|
+
`);break;case"json":default:g=n.prettyPrint?JSON.stringify(E,null,2):JSON.stringify(E);break}return{success:!0,output:g}}catch(i){return{success:!1,error:`Failed to get: ${i instanceof Error?i.message:"Unknown error"}`}}}function tt(e,n={}){let t=n.cwd||process.cwd(),r=S(t,n.keysFile||".env.keys");if(!P(r))return{success:!1,error:`Keys file not found: ${r}`};try{let i=N(r,"utf-8"),{parsed:s}=h(i),c=((n.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),a=c?`DOTENV_PUBLIC_KEY_${c}`:"DOTENV_PUBLIC_KEY",u=c?`DOTENV_PRIVATE_KEY_${c}`:"DOTENV_PRIVATE_KEY";if(e){let g=s[e];if(!g)return{success:!1,error:`Key not found: ${e}`};return{success:!0,output:g}}let f={[a]:s[a],[u]:s[u]};return{success:!0,output:n.format==="shell"?`${a}=${f[a]} ${u}=${f[u]}`:JSON.stringify(f)}}catch(i){return{success:!1,error:`Failed to get keypair: ${i instanceof Error?i.message:"Unknown error"}`}}}function cn(e,n,t,r){let i=e.split(`
|
|
24
28
|
`),s=!1,o=!1;for(let d=0;d<i.length;d++){let c=i[d];if(c===void 0)continue;if(c.startsWith(`${t}=`))i[d]=`${t}="${n.publicKey}"`,s=!0;else if(c.startsWith(`${r}=`))i[d]=`${r}="${n.privateKey}"`,o=!0}if(!s)i.push(`${t}="${n.publicKey}"`);if(!o)i.push(`${r}="${n.privateKey}"`);return`${i.join(`
|
|
25
29
|
`).replace(/\n+$/,"")}
|
|
26
|
-
`}function
|
|
27
|
-
`)}}let
|
|
28
|
-
`)};let f=
|
|
29
|
-
`).map((n)=>n.trim()).filter(Boolean).filter((n)=>n!==".env.example").filter((n)=>/(?:^|\/)\.env(?:\.|$)/.test(n)).filter((n)=>!n.endsWith(".env.keys"))}function
|
|
30
|
-
`),o=s.findIndex((
|
|
31
|
-
`))}function
|
|
30
|
+
`}function rt(e={}){let n=dn({file:e.file,keysFile:e.keysFile,stdout:!0,cwd:e.cwd});if(!n.success)return n;if(n.output===void 0)return{success:!1,error:"Rotation produced no decrypted content"};let t=e.cwd||process.cwd(),r=e.file||".env",i=e.keysFile||".env.keys",s=S(t,r),o=S(t,i),{publicKeyName:d,privateKeyName:c}=k(e.file);if(e.dryRun){let T=rn(n.output,e);return{success:!0,output:["Dry run: nothing was written.",`${r}: ${T.length} value${T.length===1?"":"s"} would be re-encrypted under a new ${d}.`,`${i}: ${d} and ${c} would be replaced.`,`The current ${c} decrypts nothing once that happens, so keep a copy until the rotation is verified.`].join(`
|
|
31
|
+
`)}}let a=U(),u=Ae(n.output,a.publicKey,d,e);if(e.stdout)return{success:!0,output:u,notice:[`Nothing was written. To adopt the output above, put this keypair in ${i}:`,"",`${d}="${a.publicKey}"`,`${c}="${a.privateKey}"`,"","Without it that output cannot be decrypted. Run without --stdout to have both applied together."].join(`
|
|
32
|
+
`)};let f=N(s),E=N(o),g=cn(E.toString("utf8"),a,d,c),l=`${process.pid}-${Date.now()}`,y=S(ne(s),`.${Re(s)}.${l}.rotate`),v=S(ne(o),`.${Re(o)}.${l}.rotate`);try{D(y,u,{encoding:"utf8",mode:384}),D(v,g,{encoding:"utf8",mode:384}),Te(y,s);try{Te(v,o)}catch(T){throw D(s,f),T}return{success:!0,output:`\u2714 rotated (${r}) to encrypted:v2`}}catch(T){if(!P(o))D(o,E,{mode:384});return{success:!1,error:`Failed to rotate without exposing plaintext: ${T instanceof Error?T.message:"Unknown error"}`}}finally{me(y,{force:!0}),me(v,{force:!0})}}function an(e){return typeof e==="string"&&(e.startsWith("encrypted:")||e.startsWith("enc:"))}var un=/(?:^|_)(?:PASSWORD|PASSWD|SECRET|TOKEN|APIKEY|API_KEY|CREDENTIAL|CREDENTIALS|PRIVATE|SALT|DSN|CERT|CIPHER|SIGNATURE|WEBHOOK)(?:_|$)|(?:^|_)(?:ACCESS|SECRET)_KEY(?:_|$)|_KEY$/,fn=/^DOTENV_(?:PUBLIC|PRIVATE)_KEY/,En=/^\$\{[^}]+\}$/;function st(e,n={}){let{placeholders:t={},strict:r=!1}=n,i=[];for(let[s,o]of Object.entries(e)){if(!o||o.trim()==="")continue;if(an(o))continue;if(fn.test(s))continue;if(En.test(o.trim()))continue;let d=un.test(s),c=Object.prototype.hasOwnProperty.call(t,s)&&t[s]===o;if(d&&!c){i.push({key:s,reason:"plaintext-secret"});continue}if(r)i.push({key:s,reason:"plaintext-value"})}return i}function ot(e){return e.split(`
|
|
33
|
+
`).map((n)=>n.trim()).filter(Boolean).filter((n)=>n!==".env.example").filter((n)=>/(?:^|\/)\.env(?:\.|$)/.test(n)).filter((n)=>!n.endsWith(".env.keys"))}function Ie(e){return`${e.replace(/[^a-z0-9]/gi,"").toUpperCase()}_`}function ln(e,n={}){let t=n.self?Ie(n.self):void 0,r=(n.tenants??[]).filter((o)=>typeof o==="string"&&o.trim().length>0).map((o)=>({slug:o,prefix:Ie(o)})).filter(({prefix:o})=>o!==t).sort((o,d)=>d.prefix.length-o.prefix.length),i={},s={};for(let[o,d]of Object.entries(e)){let c=r.find(({prefix:a})=>o.startsWith(a));if(c){(s[c.slug]??={})[o]=d;continue}i[o]=d}return{own:i,foreign:s}}function ct(e,n={}){return ln(e,n).own}function at(e){return Object.entries(e.foreign).map(([n,t])=>({tenant:n,keys:Object.keys(t).sort()})).sort((n,t)=>n.tenant.localeCompare(t.tenant))}import p from"process";import{platform as pn}from"os";var Ne=typeof Bun<"u",he=typeof p<"u"&&p.versions?.node!==void 0,gn=Ne?"bun":he?"node":"unknown",lt={name:gn,version:Ne?Bun.version:he?p.version:void 0},re=pn(),pt=re==="win32",gt=re==="darwin",_t=re==="linux",Pe=Boolean(p.stdout?.isTTY),yt=typeof globalThis.window<"u",_n=Boolean(p.env.CI||p.env.CONTINUOUS_INTEGRATION||p.env.BUILD_NUMBER||p.env.RUN_ID),Tt=Boolean(p.env.DEBUG||p.env.VERBOSE||p.argv.includes("--debug")||p.argv.includes("--verbose")),yn=_n||!Pe,mt=Boolean(!yn&&(Pe||p.env.COLORTERM||p.env.FORCE_COLOR||p.env.TERM&&p.env.TERM!=="dumb")),te={github:{name:"GitHub Actions",detected:Boolean(p.env.GITHUB_ACTIONS)},gitlab:{name:"GitLab CI",detected:Boolean(p.env.GITLAB_CI)},circle:{name:"CircleCI",detected:Boolean(p.env.CIRCLECI)},travis:{name:"Travis CI",detected:Boolean(p.env.TRAVIS)},jenkins:{name:"Jenkins",detected:Boolean(p.env.JENKINS_URL)},vercel:{name:"Vercel",detected:Boolean(p.env.VERCEL)},netlify:{name:"Netlify",detected:Boolean(p.env.NETLIFY)},heroku:{name:"Heroku",detected:Boolean(p.env.DYNO)},aws:{name:"AWS",detected:Boolean(p.env.AWS_REGION||p.env.AWS_LAMBDA_FUNCTION_NAME)},azure:{name:"Azure",detected:Boolean(p.env.AZURE_HTTP_USER_AGENT)},cloudflare:{name:"Cloudflare",detected:Boolean(p.env.CF_PAGES)},railway:{name:"Railway",detected:Boolean(p.env.RAILWAY_ENVIRONMENT)},render:{name:"Render",detected:Boolean(p.env.RENDER)}},Tn=Object.keys(te).find((e)=>{let n=te[e];return n!==void 0&&n.detected})||"unknown",Rt=te[Tn]||{name:"Unknown",detected:!1};var Ce=new Set;function vn(e){if(Ce.has(e))return;Ce.add(e);let n=Z();console.warn(`[env] warning: "${e}" is encrypted but no usable private key was found for the "${n}" environment; falling back to its default. Set DOTENV_PRIVATE_KEY_${n.toUpperCase()} or ship .env.keys.`)}var On={get:(e,n)=>{let t=e,r=t[n];if(typeof r==="string"&&(r.startsWith("encrypted:")||r.startsWith("enc:"))){let s=ge(r);if(s===void 0){vn(n),delete t[n];return}t[n]=s,r=s}let i=["_PORT","_TIMEOUT","_TTL","_SIZE","_LIMIT","_MAX","_MIN","_INTERVAL","_RETRIES","_CONCURRENCY","_WORKERS","_CONNECTIONS"];if(typeof r==="string"&&/^\d+$/.test(r)&&!r.startsWith("0")&&i.some((s)=>n.endsWith(s)))return Number(r);if(typeof r==="string"){let s=r.toLowerCase();if(s==="true")return!0;if(s==="false")return!1}return r},set:(e,n,t)=>Reflect.set(e,n,t,e),deleteProperty:(e,n)=>Reflect.deleteProperty(e,n)};function An(){return typeof Bun<"u"?Bun.env:mn.env}var be=new Proxy(An(),On);function ht(e,n,t){let r=t?.path||Rn(".env"),s=De.readFileSync(r,"utf-8").split(`
|
|
34
|
+
`),o=s.findIndex((a)=>a.startsWith(`${e}=`)),c=/[\s"'#$\\]/.test(n)?`"${n.replace(/"/g,"\\\"")}"`:n;if(o!==-1)s[o]=`${e}=${c}`;else s.push(`${e}=${c}`);De.writeFileSync(r,s.join(`
|
|
35
|
+
`))}function Pt(e=be){let n=[],t=e;for(let[r,i]of Object.entries(ye)){let s=t[r];if(s!==void 0&&s!==""&&!i.includes(String(s)))n.push(`${r}="${s}" is not valid. Allowed values: ${i.join(", ")}`)}return n}function Dt(e,n=be){let t=[],r=n;for(let i of e){let s=r[i];if(s===void 0||s===""||s===null)t.push(i)}if(t.length>0)throw Error(`[env] Missing required environment variable(s): ${t.join(", ")}. Set them in .env or your process environment before booting.`);return n}export{un as SECRET_NAME_PATTERN,Z as activeEnvName,ke as aesDecrypt,In as aesEncrypt,Yn as autoLoadEnv,sn as declaredEnvPublicKey,dn as decryptEnv,ge as decryptEnvValue,L as decryptValue,Hn as defineEnv,Zn as encryptEnv,B as encryptValue,be as env,ye as envEnum,ve as envHasCiphertext,k as envKeyNames,tn as envPlugin,ee as envPrivateKeyNames,Se as envPublicKeyNames,at as foreignTenantKeys,U as generateKeypair,nt as getEnv,tt as getKeypair,z as getPrivateKey,Pe as hasTTY,yt as hasWindow,Ne as isBun,_n as isCI,mt as isColorSupported,Tt as isDebug,an as isEncryptedValue,Nn as isLegacyEncryptedValue,_t as isLinux,gt as isMacOS,yn as isMinimal,he as isNode,pt as isWindows,_e as loadEnv,Un as loadEnvFiles,hn as migrateEncryptedValue,h as parse,Pn as parseEnvFromKey,ln as partitionTenantEnv,st as plaintextSecrets,re as platform,An as process,Tn as provider,Rt as providerInfo,Dt as requireEnv,Fn as resetPrivateKeyCache,Jn as resolveEnvFile,nn as resolvePrivateKey,on as reusableEnvPublicKey,rt as rotateKeypair,gn as runtime,lt as runtimeInfo,et as setEnv,ct as stripForeignTenantEnv,Ie as tenantEnvPrefix,ot as trackedEnvFiles,Pt as validateEnv,ht as writeEnv};
|
package/package.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"name": "@stacksjs/env",
|
|
3
3
|
"type": "module",
|
|
4
4
|
"sideEffects": false,
|
|
5
|
-
"version": "0.74.
|
|
5
|
+
"version": "0.74.34",
|
|
6
6
|
"description": "Stacks env helper methods.",
|
|
7
7
|
"author": "Chris Breuer",
|
|
8
8
|
"contributors": [
|
|
@@ -56,10 +56,10 @@
|
|
|
56
56
|
"prepublishOnly": "bun run build"
|
|
57
57
|
},
|
|
58
58
|
"dependencies": {
|
|
59
|
-
"@stacksjs/path": "0.74.
|
|
59
|
+
"@stacksjs/path": "0.74.34"
|
|
60
60
|
},
|
|
61
61
|
"devDependencies": {
|
|
62
62
|
"better-dx": "^0.2.24",
|
|
63
|
-
"@stacksjs/validation": "0.74.
|
|
63
|
+
"@stacksjs/validation": "0.74.34"
|
|
64
64
|
}
|
|
65
65
|
}
|