@stacksjs/env 0.74.36 → 0.74.37

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.js CHANGED
@@ -1,35 +1,35 @@
1
1
  // @bun
2
- import mn from"process";import{projectPath as Rn}from"@stacksjs/path";import De from"fs";import{existsSync as V}from"fs";import{readFileSync as J}from"fs";import{resolve as M}from"path";import{createCipheriv as ie,createDecipheriv as se,createHash as H,createPrivateKey as Le,createPublicKey as oe,diffieHellman as de,generateKeyPairSync as ce,hkdfSync as ae,randomBytes as j}from"crypto";var X="x25519-public:",Q="x25519-private:",w="encrypted:v2:",q="encrypted:",ue=Buffer.from("stacks-env:v2","utf8"),fe="Environment decryption failed: authentication or format error";function Ee(e){if(e.length===32)return e;return H("sha256").update(e).digest()}function In(e,n){let t=j(16),r=ie("aes-256-gcm",Ee(n),t);return{ciphertext:Buffer.concat([r.update(e,"utf8"),r.final()]).toString("hex"),iv:t.toString("hex"),authTag:r.getAuthTag().toString("hex")}}function ke(e,n,t,r){try{let i=se("aes-256-gcm",Ee(n),Buffer.from(t,"hex"));return i.setAuthTag(Buffer.from(r,"hex")),Buffer.concat([i.update(Buffer.from(e,"hex")),i.final()]).toString("utf8")}catch{throw Error("Decryption failed: authentication or format error")}}function C(e){return e.toString("base64url")}function b(e,n,t){if(typeof e!=="string"||e.length>0&&!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${n} is not canonical base64url`);let r=Buffer.from(e,"base64url");if(C(r)!==e)throw Error(`${n} is not canonical base64url`);if(t!==void 0&&r.length!==t)throw Error(`${n} has an invalid length`);return r}function Ue(e){if(!e.startsWith(X))throw Error("Legacy or invalid public key. Run buddy env:rotate before creating new ciphertext.");let n=oe({key:b(e.slice(X.length),"public key"),format:"der",type:"spki"});if(n.asymmetricKeyType!=="x25519")throw Error("Public key is not X25519");return n}function $e(e){if(!e.startsWith(Q))throw Error("Private key is not a version 2 X25519 key");let n=Le({key:b(e.slice(Q.length),"private key"),format:"der",type:"pkcs8"});if(n.asymmetricKeyType!=="x25519")throw Error("Private key is not X25519");return n}function le(e){return Buffer.from(`stacks-env:v2;${e.epk};${e.salt};${e.nonce}`,"utf8")}function U(){let{publicKey:e,privateKey:n}=ce("x25519"),t=e.export({format:"der",type:"spki"}),r=n.export({format:"der",type:"pkcs8"});return{publicKey:`${X}${C(t)}`,privateKey:`${Q}${C(r)}`}}function B(e,n){let t=Ue(n),r=ce("x25519"),i=C(r.publicKey.export({format:"der",type:"spki"})),s=j(16),o=j(12),d=de({privateKey:r.privateKey,publicKey:t}),c=Buffer.from(ae("sha256",d,s,ue,32)),a={epk:i,salt:C(s),nonce:C(o)};try{let u=ie("aes-256-gcm",c,o);u.setAAD(le(a));let f=Buffer.concat([u.update(e,"utf8"),u.final()]),E={v:2,...a,ciphertext:C(f),tag:C(u.getAuthTag())};return`${w}${C(Buffer.from(JSON.stringify(E),"utf8"))}`}finally{d.fill(0),c.fill(0)}}function xe(e){let n=b(e.slice(w.length),"envelope").toString("utf8"),t=JSON.parse(n);if(!t||typeof t!=="object"||Array.isArray(t))throw Error("envelope is not an object");let r=Object.keys(t).sort(),i=["ciphertext","epk","nonce","salt","tag","v"];if(r.length!==i.length||r.some((s,o)=>s!==i[o]))throw Error("envelope fields are invalid");if(t.v!==2)throw Error("envelope version is unsupported");for(let s of["epk","salt","nonce","ciphertext","tag"])if(typeof t[s]!=="string")throw Error(`${s} is invalid`);return t}function we(e,n){try{let t=xe(e),r=$e(n),i=oe({key:b(t.epk,"ephemeral public key"),format:"der",type:"spki"});if(i.asymmetricKeyType!=="x25519")throw Error("ephemeral key is not X25519");let s=b(t.salt,"salt",16),o=b(t.nonce,"nonce",12),d=b(t.ciphertext,"ciphertext"),c=b(t.tag,"tag",16),a=de({privateKey:r,publicKey:i}),u=Buffer.from(ae("sha256",a,s,ue,32));try{let f=se("aes-256-gcm",u,o);return f.setAAD(le(t)),f.setAuthTag(c),Buffer.concat([f.update(d),f.final()]).toString("utf8")}finally{a.fill(0),u.fill(0)}}catch{throw Error(fe)}}function Be(e,n){try{if(!/^[0-9a-f]{64}$/.test(n))throw Error("invalid legacy private key");let t=Buffer.from(e.slice(q.length),"base64");if(t.length<32)throw Error("invalid legacy payload");let r=H("sha256").update(Buffer.from(n,"hex")).digest(),i=H("sha256").update(r).digest();return ke(t.subarray(32).toString("hex"),i,t.subarray(0,16).toString("hex"),t.subarray(16,32).toString("hex"))}catch{throw Error(fe)}}function Nn(e){return e.startsWith(q)&&!e.startsWith(w)}function L(e,n){if(!e.startsWith(q))return e;return e.startsWith(w)?we(e,n):Be(e,n)}function hn(e,n,t){return B(L(e,n),t)}function Pn(e){let n=e.match(/^DOTENV_PRIVATE_KEY_(.+)$/);return n&&n[1]?n[1].toLowerCase():""}function z(e=""){return e?process.env[`DOTENV_PRIVATE_KEY_${e.toUpperCase()}`]:process.env.DOTENV_PRIVATE_KEY}import{spawnSync as Ve}from"child_process";import{readFileSync as Me}from"fs";import{arch as Fe,hostname as Ye,platform as pe,release as We,userInfo as Ge}from"os";import{basename as He,dirname as je,resolve as Xe}from"path";function h(e,n={}){let t={},r=[],i=[],s=e.split(`
2
+ import Rn from"process";import{projectPath as vn}from"@stacksjs/path";import Ce from"fs";import{existsSync as M}from"fs";import{readFileSync as Z}from"fs";import{resolve as F}from"path";import{createCipheriv as se,createDecipheriv as oe,createHash as j,createPrivateKey as ke,createPublicKey as de,diffieHellman as ce,generateKeyPairSync as ae,hkdfSync as ue,randomBytes as X}from"crypto";var Q="x25519-public:",q="x25519-private:",B="encrypted:v2:",z="encrypted:",fe=Buffer.from("stacks-env:v2","utf8"),le="Environment decryption failed: authentication or format error";function Ee(e){if(e.length===32)return e;return j("sha256").update(e).digest()}function Nn(e,n){let t=X(16),r=se("aes-256-gcm",Ee(n),t);return{ciphertext:Buffer.concat([r.update(e,"utf8"),r.final()]).toString("hex"),iv:t.toString("hex"),authTag:r.getAuthTag().toString("hex")}}function xe(e,n,t,r){try{let i=oe("aes-256-gcm",Ee(n),Buffer.from(t,"hex"));return i.setAuthTag(Buffer.from(r,"hex")),Buffer.concat([i.update(Buffer.from(e,"hex")),i.final()]).toString("utf8")}catch{throw Error("Decryption failed: authentication or format error")}}function C(e){return e.toString("base64url")}function b(e,n,t){if(typeof e!=="string"||e.length>0&&!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${n} is not canonical base64url`);let r=Buffer.from(e,"base64url");if(C(r)!==e)throw Error(`${n} is not canonical base64url`);if(t!==void 0&&r.length!==t)throw Error(`${n} has an invalid length`);return r}function Ue(e){if(!e.startsWith(Q))throw Error("Legacy or invalid public key. Run buddy env:rotate before creating new ciphertext.");let n=de({key:b(e.slice(Q.length),"public key"),format:"der",type:"spki"});if(n.asymmetricKeyType!=="x25519")throw Error("Public key is not X25519");return n}function $e(e){if(!e.startsWith(q))throw Error("Private key is not a version 2 X25519 key");let n=ke({key:b(e.slice(q.length),"private key"),format:"der",type:"pkcs8"});if(n.asymmetricKeyType!=="x25519")throw Error("Private key is not X25519");return n}function pe(e){return Buffer.from(`stacks-env:v2;${e.epk};${e.salt};${e.nonce}`,"utf8")}function x(){let{publicKey:e,privateKey:n}=ae("x25519"),t=e.export({format:"der",type:"spki"}),r=n.export({format:"der",type:"pkcs8"});return{publicKey:`${Q}${C(t)}`,privateKey:`${q}${C(r)}`}}function V(e,n){let t=Ue(n),r=ae("x25519"),i=C(r.publicKey.export({format:"der",type:"spki"})),s=X(16),o=X(12),d=ce({privateKey:r.privateKey,publicKey:t}),c=Buffer.from(ue("sha256",d,s,fe,32)),a={epk:i,salt:C(s),nonce:C(o)};try{let u=se("aes-256-gcm",c,o);u.setAAD(pe(a));let f=Buffer.concat([u.update(e,"utf8"),u.final()]),E={v:2,...a,ciphertext:C(f),tag:C(u.getAuthTag())};return`${B}${C(Buffer.from(JSON.stringify(E),"utf8"))}`}finally{d.fill(0),c.fill(0)}}function we(e){let n=b(e.slice(B.length),"envelope").toString("utf8"),t=JSON.parse(n);if(!t||typeof t!=="object"||Array.isArray(t))throw Error("envelope is not an object");let r=Object.keys(t).sort(),i=["ciphertext","epk","nonce","salt","tag","v"];if(r.length!==i.length||r.some((s,o)=>s!==i[o]))throw Error("envelope fields are invalid");if(t.v!==2)throw Error("envelope version is unsupported");for(let s of["epk","salt","nonce","ciphertext","tag"])if(typeof t[s]!=="string")throw Error(`${s} is invalid`);return t}function Be(e,n){try{let t=we(e),r=$e(n),i=de({key:b(t.epk,"ephemeral public key"),format:"der",type:"spki"});if(i.asymmetricKeyType!=="x25519")throw Error("ephemeral key is not X25519");let s=b(t.salt,"salt",16),o=b(t.nonce,"nonce",12),d=b(t.ciphertext,"ciphertext"),c=b(t.tag,"tag",16),a=ce({privateKey:r,publicKey:i}),u=Buffer.from(ue("sha256",a,s,fe,32));try{let f=oe("aes-256-gcm",u,o);return f.setAAD(pe(t)),f.setAuthTag(c),Buffer.concat([f.update(d),f.final()]).toString("utf8")}finally{a.fill(0),u.fill(0)}}catch{throw Error(le)}}function Ve(e,n){try{if(!/^[0-9a-f]{64}$/.test(n))throw Error("invalid legacy private key");let t=Buffer.from(e.slice(z.length),"base64");if(t.length<32)throw Error("invalid legacy payload");let r=j("sha256").update(Buffer.from(n,"hex")).digest(),i=j("sha256").update(r).digest();return xe(t.subarray(32).toString("hex"),i,t.subarray(0,16).toString("hex"),t.subarray(16,32).toString("hex"))}catch{throw Error(le)}}function hn(e){return e.startsWith(z)&&!e.startsWith(B)}function L(e,n){if(!e.startsWith(z))return e;return e.startsWith(B)?Be(e,n):Ve(e,n)}function Pn(e,n,t){return V(L(e,n),t)}function Dn(e){let n=e.match(/^DOTENV_PRIVATE_KEY_(.+)$/);return n&&n[1]?n[1].toLowerCase():""}function J(e=""){return e?process.env[`DOTENV_PRIVATE_KEY_${e.toUpperCase()}`]:process.env.DOTENV_PRIVATE_KEY}import{spawnSync as Me}from"child_process";import{readFileSync as Fe}from"fs";import{arch as Ye,hostname as We,platform as ge,release as Ge,userInfo as He}from"os";import{basename as je,dirname as Xe,resolve as Qe}from"path";function h(e,n={}){let t={},r=[],i=[],s=e.split(`
3
3
  `);for(let o of s){let d=o.trim();if(!d||d.startsWith("#"))continue;if(d.startsWith("DOTENV_PUBLIC_KEY=")){let f=d.match(/^DOTENV_PUBLIC_KEY=["']?([^"'\n]+)["']?/);if(f&&f[1]!==void 0)t.DOTENV_PUBLIC_KEY=f[1];continue}let c=d.match(/^([^=]+)=(.*)$/);if(!c||c[1]===void 0||c[2]===void 0)continue;let a=c[1].trim(),u=c[2].trim();if(u.startsWith('"')&&u.endsWith('"')||u.startsWith("'")&&u.endsWith("'")){if(u=u.slice(1,-1),u.includes("\\n"))u=u.replace(/\\n/g,`
4
- `)}if(u.startsWith("encrypted:")||u.startsWith("enc:")){if(!n.privateKey){i.push(a);continue}try{let f=u.startsWith("enc:")?`encrypted:${u.slice(4)}`:u;u=L(f,n.privateKey)}catch(f){r.push(`Failed to decrypt ${a}: ${f instanceof Error?f.message:"Unknown error"}`)}}u=Qe(u,{...n.processEnv||process.env,...t}),u=Ze(u),t[a]=u}return{parsed:t,errors:r,skippedEncrypted:i}}function Qe(e,n){return e.replace(/\$\{([^}]+)\}/g,(t,r)=>{let i=r.match(/^([^:\-+]+)(:-|-)(.+)$/);if(i){let[,o,d,c]=i,a=n[o];if(d===":-")return a||c;else return a!==void 0?a:c}let s=r.match(/^([^:\-+]+)(:?\+)(.+)$/);if(s){let[,o,d,c]=s,a=n[o];if(d===":+")return a?c:"";else return a!==void 0?c:""}return n[r]||""})}var qe=new Set(["date","hostname","whoami","uname","pwd","echo","printf","cat","basename","dirname"]);function ze(e){let n=[],t="",r=null,i=!1;for(let s of e.trim()){if(i){t+=s,i=!1;continue}if(s==="\\"&&r!=="'"){i=!0;continue}if(r){if(s===r)r=null;else t+=s;continue}if(s==='"'||s==="'"){r=s;continue}if(/\s/.test(s)){if(t)n.push(t),t="";continue}t+=s}if(i||r)throw Error("Command substitution contains an unterminated escape or quote");if(t)n.push(t);return n}function Je(e){let[n,...t]=e,r=t.some((i)=>i.startsWith("-"));if(n==="echo"&&!r)return t.join(" ");if(n==="printf"&&t.length===1&&!t[0]?.includes("%"))return t[0];if(n==="hostname"&&t.length===0)return Ye();if(n==="whoami"&&t.length===0)return Ge().username;if(n==="pwd"&&t.length===0)return process.cwd();if(n==="basename"&&t.length===1)return He(t[0]??"");if(n==="dirname"&&t.length===1)return je(t[0]??"");if(n==="cat"&&t.length>0&&!r)return t.map((i)=>Me(Xe(process.cwd(),i),"utf8")).join("");if(n==="uname"){let i=t[0]??"-s";if(t.length<=1&&i==="-m")return Fe();if(t.length<=1&&i==="-r")return We();if(t.length<=1&&i==="-s")return{aix:"AIX",android:"Android",cygwin:"CYGWIN",darwin:"Darwin",freebsd:"FreeBSD",haiku:"Haiku",linux:"Linux",netbsd:"NetBSD",openbsd:"OpenBSD",sunos:"SunOS",win32:"Windows_NT"}[pe()]??pe()}return}function Ze(e){return e.replace(/\$\(([^)]+)\)/g,(n,t)=>{try{let r=ze(t),i=r[0];if(!i||!qe.has(i))return console.warn(`[env] Blocked command substitution for disallowed command: ${i}`),"";let s=Je(r);if(s!==void 0)return s.trim();let o=Ve(i,r.slice(1),{encoding:"utf8",env:process.env});if(o.status===0)return o.stdout.trim();let d=o.stderr.trim();console.warn(`[env] Command substitution failed (exit code ${o.status??"unknown"}): ${i}${d?`: ${d}`:""}`)}catch(r){console.warn(`[env] Command substitution error: ${r instanceof Error?r.message:String(r)}`)}return""})}async function Un(e,n={}){let t={},r=[],i=[];for(let s of e)try{let o=Bun.file(s);if(!o.size)continue;let d=await o.text(),{parsed:c,errors:a,skippedEncrypted:u}=h(d,n);r.push(...a),i.push(...u);for(let[f,E]of Object.entries(c)){if(!n.overload&&t[f]!==void 0)continue;t[f]=E}}catch(o){if(o?.code==="ENOENT")continue;r.push(`Failed to read ${s}: ${o instanceof Error?o.message:String(o)}`)}return{parsed:t,errors:r,skippedEncrypted:i}}function x(e){return typeof e==="string"&&(e.startsWith("encrypted:")||e.startsWith("enc:"))}function K(e){if(!e||x(e))return;let n=e.trim().toLowerCase();if(!/^[a-z0-9_-]+$/.test(n))return;if(n==="prod")return"production";if(n==="stage")return"staging";if(n==="dev")return"development";return n}var F=null,Y,W;function en(e,n,t=".env.keys"){let r=M(n,t);if(!V(r))return;try{let{parsed:i}=h(J(r,"utf-8"));if(e){let s=i[`DOTENV_PRIVATE_KEY_${e.toUpperCase()}`];if(s)return s}return i.DOTENV_PRIVATE_KEY}catch{return}}function Z(e={}){return K(e.env)||W||K("development")||K(process.env.DOTENV_ENV)||K(process.env.APP_ENV)||"development"}function nn(e={}){let n=Z(e),t=e.cwd||process.cwd();if(F===n)return Y;let r=z(n);if(!r)r=process.env.DOTENV_PRIVATE_KEY;if(!r)r=en(n,t);return F=n,Y=r,r}function Fn(){F=null,Y=void 0,W=void 0}function ge(e,n={}){if(!x(e))return e;let t=nn(n);if(!t)return;try{let r=e.startsWith("enc:")?`encrypted:${e.slice(4)}`:e;return L(r,t)}catch{return}}function _e(e={}){let{path:n=[".env"],overload:t=!1,env:r,privateKey:i,keysFile:s=".env.keys",quiet:o=!1,cwd:d=process.cwd()}=e,c=Array.isArray(n)?n:[n],a=[],u=0,f=new Set(Object.entries(process.env).filter(([,g])=>g!==void 0&&!x(g)).map(([g])=>g)),E=i;if(!E&&s){let g=M(d,s);if(V(g))try{let l=J(g,"utf-8"),{parsed:y}=h(l);if(r){let v=`DOTENV_PRIVATE_KEY_${r.toUpperCase()}`;E=y[v]}else E=y.DOTENV_PRIVATE_KEY}catch(l){a.push(`Failed to load keys file: ${l instanceof Error?l.message:"Unknown error"}`)}}if(!E)E=z(r||"");for(let g of c){let l=M(d,g);if(!V(l)){if(!o)a.push(`File not found: ${l}`);continue}try{let y=J(l,"utf-8"),{parsed:v,errors:T,skippedEncrypted:O}=h(y,{privateKey:E,processEnv:process.env});if(a.push(...T),O.length>0){for(let I of O)if(x(process.env[I]))delete process.env[I];let _=r?`DOTENV_PRIVATE_KEY_${r.toUpperCase()}`:"DOTENV_PRIVATE_KEY",A=O.slice(0,5).join(", "),R=O.length>5?`, \u2026 +${O.length-5} more`:"";console.warn(`[env] warning: skipped ${O.length} encrypted value(s) in ${g} (${_} not set; defaults apply): ${A}${R}`)}let m=0;for(let[_,A]of Object.entries(v)){if(_==="DOTENV_PUBLIC_KEY")continue;let R=process.env[_],I=x(R)&&A!==R;if(t||!f.has(_)||I)process.env[_]=A,u++,m++}if(!o&&!process.env.__ENV_LOADED__)console.error(`[env] loaded ${m}/${Object.keys(v).length} variables from ${g}`),process.env.__ENV_LOADED__="1"}catch(y){a.push(`Failed to load ${l}: ${y instanceof Error?y.message:"Unknown error"}`)}}return{loaded:u,errors:a}}function tn(e={}){return{name:"env-plugin",setup(n){_e(e)}}}function Yn(e={}){let n=K(e.env)||K("development")||K(process.env.DOTENV_ENV)||K(process.env.APP_ENV)||"development",t=e.cwd||process.cwd();if(W!==n)W=n,F=null,Y=void 0;let r=[],i=(d)=>{if(!r.includes(d)&&V(M(t,d)))r.push(d)};i(".env"),i(".env.local");let s=`.env.${n}`,o=`.env.${n}.local`;return i(s),i(o),_e({...e,path:r,env:n})}var Gn=tn;var ye={APP_ENV:["local","dev","development","staging","prod","production"],DB_CONNECTION:["mysql","sqlite","postgres","singlestore","vitess","dynamodb"],DB_MIGRATE_FRESH:["allow","confirm","disabled"],MAIL_MAILER:["smtp","mailgun","ses","log","sendgrid","mailtrap","capture"],SEARCH_ENGINE_DRIVER:["opensearch","meilisearch","algolia","typesense"],FRONTEND_APP_ENV:["development","staging","production"]};function Hn(e){return e}import{existsSync as P,readFileSync as N,renameSync as Te,rmSync as me,writeFileSync as D}from"fs";import{basename as Re,dirname as ne,resolve as S}from"path";function Jn(e,n){if(e)return e;let t=String(n??"").trim();if(!t||t==="development"||t==="dev"||t==="local")return"";if(!/^[\w.-]+$/.test(t))return"";return`.env.${t}`}function Oe(e,n){return(!n.key||e.includes(n.key))&&(!n.excludeKey||!e.includes(n.excludeKey))}function rn(e,n){let t=[];for(let r of e.split(`
5
- `)){let i=r.trim();if(!i||i.startsWith("#"))continue;if(i.startsWith("DOTENV_PUBLIC_KEY"))continue;let s=i.match(/^([^=]+)=(.*)$/);if(!s||s[1]===void 0)continue;let o=s[1].trim();if(Oe(o,n))t.push(o)}return t}function Ae(e,n,t,r){let i=["#/-------------------[DOTENV_PUBLIC_KEY]--------------------/","#/ versioned X25519 encryption for .env files /","#/ [how it works](https://stacksjs.com/encryption) /","#/----------------------------------------------------------/",`${t}="${n}"`,""],s=!1;for(let o of e.split(`
6
- `)){let d=o.trim();if(d.startsWith("#/"))continue;if(d.startsWith("DOTENV_PUBLIC_KEY"))continue;if(!d&&!s)continue;if(!d||d.startsWith("#")){s=!0,i.push(o);continue}s=!0;let c=d.match(/^([^=]+)=(.*)$/);if(!c||c[1]===void 0||c[2]===void 0){i.push(o);continue}let a=c[1].trim(),u=c[2].trim();if(u.startsWith('"')&&u.endsWith('"')||u.startsWith("'")&&u.endsWith("'"))u=u.slice(1,-1);if(Oe(a,r)&&!u.startsWith("encrypted:"))u=B(u,n);i.push(`${a}="${u}"`)}return i.join(`
7
- `)}function k(e){let t=((e||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase();return{publicKeyName:t?`DOTENV_PUBLIC_KEY_${t}`:"DOTENV_PUBLIC_KEY",privateKeyName:t?`DOTENV_PRIVATE_KEY_${t}`:"DOTENV_PRIVATE_KEY"}}function Se(e){let{publicKeyName:n}=k(e);return n==="DOTENV_PUBLIC_KEY"?[n]:[n,"DOTENV_PUBLIC_KEY"]}function ee(e){let{privateKeyName:n}=k(e);return n==="DOTENV_PRIVATE_KEY"?[n]:[n,"DOTENV_PRIVATE_KEY"]}function ve(e){for(let n of e.split(`
8
- `)){let t=n.trim();if(!t||t.startsWith("#"))continue;let r=t.match(/^([^=]+)=(.*)$/);if(!r?.[1]||r[2]===void 0)continue;let i=r[2].trim().replace(/^["']|["']$/g,"");if(i.startsWith("encrypted:")||i.startsWith("enc:"))return!0}return!1}function sn(e,n){let t=Se(n);for(let r of e.split(`
9
- `)){let i=r.trim();if(!i||i.startsWith("#"))continue;let s=i.match(/^([^=]+)=["']?([^"'\n]+)["']?/);if(!s?.[1]||!s[2])continue;let o=s[1].trim();if(t.includes(o))return{name:o,key:s[2]}}return}function on(e,n){let t,r=!1;for(let i of e.split(`
10
- `)){let s=i.trim();if(!s||s.startsWith("#"))continue;let o=s.match(/^([^=]+)=(.*)$/);if(!o?.[1]||o[2]===void 0)continue;let d=o[1].trim(),c=o[2].trim().replace(/^["']|["']$/g,"");if(d===n)t=c;else if(c.startsWith("encrypted:")||c.startsWith("enc:"))r=!0}return t&&r?t:void 0}function Zn(e={}){let n=e.cwd||process.cwd(),t=S(n,e.file||".env"),r=S(n,e.keysFile||".env.keys");if(!P(t))return{success:!1,error:`File not found: ${t}`};try{let i,s,o=on(N(t,"utf-8"),k(e.file).publicKeyName);if(o)i=o;else if(P(r)){let a=N(r,"utf-8"),{parsed:u}=h(a),{publicKeyName:f,privateKeyName:E}=k(e.file);if(i=u[f]||"",s=u[E]||"",!i||!s){let g=U();i=g.publicKey,s=g.privateKey;let l=`
4
+ `)}if(u.startsWith("encrypted:")||u.startsWith("enc:")){if(!n.privateKey){i.push(a);continue}try{let f=u.startsWith("enc:")?`encrypted:${u.slice(4)}`:u;u=L(f,n.privateKey)}catch(f){r.push(`Failed to decrypt ${a}: ${f instanceof Error?f.message:"Unknown error"}`)}}u=qe(u,{...n.processEnv||process.env,...t}),u=en(u),t[a]=u}return{parsed:t,errors:r,skippedEncrypted:i}}function qe(e,n){return e.replace(/\$\{([^}]+)\}/g,(t,r)=>{let i=r.match(/^([^:\-+]+)(:-|-)(.+)$/);if(i){let[,o,d,c]=i,a=n[o];if(d===":-")return a||c;else return a!==void 0?a:c}let s=r.match(/^([^:\-+]+)(:?\+)(.+)$/);if(s){let[,o,d,c]=s,a=n[o];if(d===":+")return a?c:"";else return a!==void 0?c:""}return n[r]||""})}var ze=new Set(["date","hostname","whoami","uname","pwd","echo","printf","cat","basename","dirname"]);function Je(e){let n=[],t="",r=null,i=!1;for(let s of e.trim()){if(i){t+=s,i=!1;continue}if(s==="\\"&&r!=="'"){i=!0;continue}if(r){if(s===r)r=null;else t+=s;continue}if(s==='"'||s==="'"){r=s;continue}if(/\s/.test(s)){if(t)n.push(t),t="";continue}t+=s}if(i||r)throw Error("Command substitution contains an unterminated escape or quote");if(t)n.push(t);return n}function Ze(e){let[n,...t]=e,r=t.some((i)=>i.startsWith("-"));if(n==="echo"&&!r)return t.join(" ");if(n==="printf"&&t.length===1&&!t[0]?.includes("%"))return t[0];if(n==="hostname"&&t.length===0)return We();if(n==="whoami"&&t.length===0)return He().username;if(n==="pwd"&&t.length===0)return process.cwd();if(n==="basename"&&t.length===1)return je(t[0]??"");if(n==="dirname"&&t.length===1)return Xe(t[0]??"");if(n==="cat"&&t.length>0&&!r)return t.map((i)=>Fe(Qe(process.cwd(),i),"utf8")).join("");if(n==="uname"){let i=t[0]??"-s";if(t.length<=1&&i==="-m")return Ye();if(t.length<=1&&i==="-r")return Ge();if(t.length<=1&&i==="-s")return{aix:"AIX",android:"Android",cygwin:"CYGWIN",darwin:"Darwin",freebsd:"FreeBSD",haiku:"Haiku",linux:"Linux",netbsd:"NetBSD",openbsd:"OpenBSD",sunos:"SunOS",win32:"Windows_NT"}[ge()]??ge()}return}function en(e){return e.replace(/\$\(([^)]+)\)/g,(n,t)=>{try{let r=Je(t),i=r[0];if(!i||!ze.has(i))return console.warn(`[env] Blocked command substitution for disallowed command: ${i}`),"";let s=Ze(r);if(s!==void 0)return s.trim();let o=Me(i,r.slice(1),{encoding:"utf8",env:process.env});if(o.status===0)return o.stdout.trim();let d=o.stderr.trim();console.warn(`[env] Command substitution failed (exit code ${o.status??"unknown"}): ${i}${d?`: ${d}`:""}`)}catch(r){console.warn(`[env] Command substitution error: ${r instanceof Error?r.message:String(r)}`)}return""})}async function Un(e,n={}){let t={},r=[],i=[];for(let s of e)try{let o=Bun.file(s);if(!o.size)continue;let d=await o.text(),{parsed:c,errors:a,skippedEncrypted:u}=h(d,n);r.push(...a),i.push(...u);for(let[f,E]of Object.entries(c)){if(!n.overload&&t[f]!==void 0)continue;t[f]=E}}catch(o){if(o?.code==="ENOENT")continue;r.push(`Failed to read ${s}: ${o instanceof Error?o.message:String(o)}`)}return{parsed:t,errors:r,skippedEncrypted:i}}function U(e){return typeof e==="string"&&(e.startsWith("encrypted:")||e.startsWith("enc:"))}function K(e){if(!e||U(e))return;let n=e.trim().toLowerCase();if(!/^[a-z0-9_-]+$/.test(n))return;if(n==="prod")return"production";if(n==="stage")return"staging";if(n==="dev")return"development";return n}var Y=null,W,G;function nn(e,n,t=".env.keys"){let r=F(n,t);if(!M(r))return;try{let{parsed:i}=h(Z(r,"utf-8"));if(e){let s=i[`DOTENV_PRIVATE_KEY_${e.toUpperCase()}`];if(s)return s}return i.DOTENV_PRIVATE_KEY}catch{return}}function ee(e={}){return K(e.env)||G||K("development")||K(process.env.DOTENV_ENV)||K(process.env.APP_ENV)||"development"}function tn(e={}){let n=ee(e),t=e.cwd||process.cwd();if(Y===n)return W;let r=J(n);if(!r)r=process.env.DOTENV_PRIVATE_KEY;if(!r)r=nn(n,t);return Y=n,W=r,r}function Yn(){Y=null,W=void 0,G=void 0}function _e(e,n={}){if(!U(e))return e;let t=tn(n);if(!t)return;try{let r=e.startsWith("enc:")?`encrypted:${e.slice(4)}`:e;return L(r,t)}catch{return}}function ye(e={}){let{path:n=[".env"],overload:t=!1,env:r,privateKey:i,keysFile:s=".env.keys",quiet:o=!1,cwd:d=process.cwd()}=e,c=Array.isArray(n)?n:[n],a=[],u=0,f=new Set(Object.entries(process.env).filter(([,g])=>g!==void 0&&!U(g)).map(([g])=>g)),E=i;if(!E&&s){let g=F(d,s);if(M(g))try{let p=Z(g,"utf-8"),{parsed:y}=h(p);if(r){let v=`DOTENV_PRIVATE_KEY_${r.toUpperCase()}`;E=y[v]}else E=y.DOTENV_PRIVATE_KEY}catch(p){a.push(`Failed to load keys file: ${p instanceof Error?p.message:"Unknown error"}`)}}if(!E)E=J(r||"");for(let g of c){let p=F(d,g);if(!M(p)){if(!o)a.push(`File not found: ${p}`);continue}try{let y=Z(p,"utf-8"),{parsed:v,errors:T,skippedEncrypted:O}=h(y,{privateKey:E,processEnv:process.env});if(a.push(...T),O.length>0){for(let I of O)if(U(process.env[I]))delete process.env[I];let _=r?`DOTENV_PRIVATE_KEY_${r.toUpperCase()}`:"DOTENV_PRIVATE_KEY",A=O.slice(0,5).join(", "),R=O.length>5?`, \u2026 +${O.length-5} more`:"";console.warn(`[env] warning: skipped ${O.length} encrypted value(s) in ${g} (${_} not set; defaults apply): ${A}${R}`)}let m=0;for(let[_,A]of Object.entries(v)){if(_==="DOTENV_PUBLIC_KEY")continue;let R=process.env[_],I=U(R)&&A!==R;if(t||!f.has(_)||I)process.env[_]=A,u++,m++}if(!o&&!process.env.__ENV_LOADED__)console.error(`[env] loaded ${m}/${Object.keys(v).length} variables from ${g}`),process.env.__ENV_LOADED__="1"}catch(y){a.push(`Failed to load ${p}: ${y instanceof Error?y.message:"Unknown error"}`)}}return{loaded:u,errors:a}}function rn(e={}){return{name:"env-plugin",setup(n){ye(e)}}}function Wn(e={}){let n=K(e.env)||K("development")||K(process.env.DOTENV_ENV)||K(process.env.APP_ENV)||"development",t=e.cwd||process.cwd();if(G!==n)G=n,Y=null,W=void 0;let r=[],i=(d)=>{if(!r.includes(d)&&M(F(t,d)))r.push(d)};i(".env"),i(".env.local");let s=`.env.${n}`,o=`.env.${n}.local`;return i(s),i(o),ye({...e,path:r,env:n})}var Hn=rn;var Te={APP_ENV:["local","dev","development","staging","prod","production"],DB_CONNECTION:["mysql","sqlite","postgres","singlestore","vitess","dynamodb"],DB_MIGRATE_FRESH:["allow","confirm","disabled"],MAIL_MAILER:["smtp","mailgun","ses","log","sendgrid","mailtrap","capture"],SEARCH_ENGINE_DRIVER:["opensearch","meilisearch","algolia","typesense"],FRONTEND_APP_ENV:["development","staging","production"]};function jn(e){return e}import{existsSync as P,readFileSync as N,renameSync as me,rmSync as Re,writeFileSync as D}from"fs";import{basename as ve,dirname as te,resolve as S}from"path";function Zn(e,n){if(e)return e;let t=String(n??"").trim();if(!t||t==="development"||t==="dev"||t==="local")return"";if(!/^[\w.-]+$/.test(t))return"";return`.env.${t}`}function Ae(e,n){return(!n.key||e.includes(n.key))&&(!n.excludeKey||!e.includes(n.excludeKey))}function sn(e,n){let t=[];for(let r of e.split(`
5
+ `)){let i=r.trim();if(!i||i.startsWith("#"))continue;if(i.startsWith("DOTENV_PUBLIC_KEY"))continue;let s=i.match(/^([^=]+)=(.*)$/);if(!s||s[1]===void 0)continue;let o=s[1].trim();if(Ae(o,n))t.push(o)}return t}function Se(e,n,t,r){let i=["#/-------------------[DOTENV_PUBLIC_KEY]--------------------/","#/ versioned X25519 encryption for .env files /","#/ [how it works](https://stacksjs.com/encryption) /","#/----------------------------------------------------------/",`${t}="${n}"`,""],s=!1;for(let o of e.split(`
6
+ `)){let d=o.trim();if(d.startsWith("#/"))continue;if(d.startsWith("DOTENV_PUBLIC_KEY"))continue;if(!d&&!s)continue;if(!d||d.startsWith("#")){s=!0,i.push(o);continue}s=!0;let c=d.match(/^([^=]+)=(.*)$/);if(!c||c[1]===void 0||c[2]===void 0){i.push(o);continue}let a=c[1].trim(),u=c[2].trim();if(u.startsWith('"')&&u.endsWith('"')||u.startsWith("'")&&u.endsWith("'"))u=u.slice(1,-1);if(Ae(a,r)&&!u.startsWith("encrypted:"))u=V(u,n);i.push(`${a}="${u}"`)}return i.join(`
7
+ `)}function k(e){let t=((e||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase();return{publicKeyName:t?`DOTENV_PUBLIC_KEY_${t}`:"DOTENV_PUBLIC_KEY",privateKeyName:t?`DOTENV_PRIVATE_KEY_${t}`:"DOTENV_PRIVATE_KEY"}}function Ie(e){let{publicKeyName:n}=k(e);return n==="DOTENV_PUBLIC_KEY"?[n]:[n,"DOTENV_PUBLIC_KEY"]}function ne(e){let{privateKeyName:n}=k(e);return n==="DOTENV_PRIVATE_KEY"?[n]:[n,"DOTENV_PRIVATE_KEY"]}function Oe(e){for(let n of e.split(`
8
+ `)){let t=n.trim();if(!t||t.startsWith("#"))continue;let r=t.match(/^([^=]+)=(.*)$/);if(!r?.[1]||r[2]===void 0)continue;let i=r[2].trim().replace(/^["']|["']$/g,"");if(i.startsWith("encrypted:")||i.startsWith("enc:"))return!0}return!1}function on(e,n){let t=Ie(n);for(let r of e.split(`
9
+ `)){let i=r.trim();if(!i||i.startsWith("#"))continue;let s=i.match(/^([^=]+)=["']?([^"'\n]+)["']?/);if(!s?.[1]||!s[2])continue;let o=s[1].trim();if(t.includes(o))return{name:o,key:s[2]}}return}function dn(e,n){let t,r=!1;for(let i of e.split(`
10
+ `)){let s=i.trim();if(!s||s.startsWith("#"))continue;let o=s.match(/^([^=]+)=(.*)$/);if(!o?.[1]||o[2]===void 0)continue;let d=o[1].trim(),c=o[2].trim().replace(/^["']|["']$/g,"");if(d===n)t=c;else if(c.startsWith("encrypted:")||c.startsWith("enc:"))r=!0}return t&&r?t:void 0}function et(e={}){let n=e.cwd||process.cwd(),t=S(n,e.file||".env"),r=S(n,e.keysFile||".env.keys");if(!P(t))return{success:!1,error:`File not found: ${t}`};try{let i,s,o=dn(N(t,"utf-8"),k(e.file).publicKeyName);if(o)i=o;else if(P(r)){let a=N(r,"utf-8"),{parsed:u}=h(a),{publicKeyName:f,privateKeyName:E}=k(e.file);if(i=u[f]||"",s=u[E]||"",!i||!s){let g=x();i=g.publicKey,s=g.privateKey;let p=`
11
11
  ${f}="${i}"
12
12
  ${E}="${s}"
13
- `;D(r,a+l,"utf-8")}}else{let a=U();i=a.publicKey,s=a.privateKey;let{publicKeyName:u,privateKeyName:f}=k(e.file),E=`# .env.keys - Keep this file secure and never commit to source control
13
+ `;D(r,a+p,"utf-8")}}else{let a=x();i=a.publicKey,s=a.privateKey;let{publicKeyName:u,privateKeyName:f}=k(e.file),E=`# .env.keys - Keep this file secure and never commit to source control
14
14
  ${u}="${i}"
15
15
  ${f}="${s}"
16
- `;D(r,E,"utf-8")}let d=N(t,"utf-8"),c=Ae(d,i,k(e.file).publicKeyName,e);if(e.stdout)return{success:!0,output:c};return D(t,c,"utf-8"),{success:!0,output:`\u2714 encrypted (${e.file||".env"})
17
- \u2714 key added to ${e.keysFile||".env.keys"}`}}catch(i){return{success:!1,error:`Failed to encrypt: ${i instanceof Error?i.message:"Unknown error"}`}}}function dn(e={}){let n=e.cwd||process.cwd(),t=S(n,e.file||".env"),r=S(n,e.keysFile||".env.keys");if(!P(t))return{success:!1,error:`File not found: ${t}`};if(!P(r))return{success:!1,error:`Keys file not found: ${r}`};try{let i=N(r,"utf-8"),{parsed:s}=h(i),c=((e.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),a=c?`DOTENV_PRIVATE_KEY_${c}`:"DOTENV_PRIVATE_KEY",u=s[a];if(!u)return{success:!1,error:`Private key not found: ${a}`};let f=[u];if(a!=="DOTENV_PRIVATE_KEY"&&s.DOTENV_PRIVATE_KEY&&s.DOTENV_PRIVATE_KEY!==u)f.push(s.DOTENV_PRIVATE_KEY);let g=N(t,"utf-8").split(`
18
- `),l=[];for(let v of g){let T=v.trim();if(!T||T.startsWith("#")){l.push(v);continue}if(T.startsWith("DOTENV_PUBLIC_KEY"))continue;let O=T.match(/^([^=]+)=(.*)$/);if(!O||O[1]===void 0||O[2]===void 0){l.push(v);continue}let m=O[1].trim(),_=O[2].trim();if(_.startsWith('"')&&_.endsWith('"')||_.startsWith("'")&&_.endsWith("'"))_=_.slice(1,-1);let A=_.startsWith("encrypted:");if(e.key&&!m.includes(e.key))A=!1;if(A){let R,I;for(let G of f)try{R=L(_,G);break}catch(Ke){I=Ke}if(R===void 0)throw I instanceof Error?I:Error(`Unable to decrypt ${m}`);_=R}l.push(`${m}="${_}"`)}let y=l.join(`
19
- `);if(e.stdout)return{success:!0,output:y};return D(t,y,"utf-8"),{success:!0,output:`\u2714 decrypted (${e.file||".env"})`}}catch(i){return{success:!1,error:`Failed to decrypt: ${i instanceof Error?i.message:"Unknown error"}`}}}function et(e,n,t={}){let r=t.cwd||process.cwd(),i=S(r,t.file||".env"),s=t.keysFile?S(r,t.keysFile):S(ne(i),".env.keys");try{let o="";if(P(i))o=N(i,"utf-8");let d=o.split(`
20
- `),c=!1,a,E=((t.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),g=E?`DOTENV_PUBLIC_KEY_${E}`:"DOTENV_PUBLIC_KEY",l=E?`DOTENV_PRIVATE_KEY_${E}`:"DOTENV_PRIVATE_KEY",y=sn(o,t.file),v=y?.name??g;if(a=y?.key,a){let m=!1;if(P(s)){let A=N(s,"utf-8"),{parsed:R}=h(A);m=ee(t.file).some((I)=>Boolean(R[I]))}let _=ee(t.file).some((A)=>Boolean(process.env[A]));if(!m&&!_&&!ve(o))a=void 0}if(!t.plain&&!a&&ve(o))return{success:!1,error:`${t.file||".env"} already contains encrypted values, but no key that can be used to add another was found.
16
+ `;D(r,E,"utf-8")}let d=N(t,"utf-8"),c=Se(d,i,k(e.file).publicKeyName,e);if(e.stdout)return{success:!0,output:c};return D(t,c,"utf-8"),{success:!0,output:`\u2714 encrypted (${e.file||".env"})
17
+ \u2714 key added to ${e.keysFile||".env.keys"}`}}catch(i){return{success:!1,error:`Failed to encrypt: ${i instanceof Error?i.message:"Unknown error"}`}}}function cn(e={}){let n=e.cwd||process.cwd(),t=S(n,e.file||".env"),r=S(n,e.keysFile||".env.keys");if(!P(t))return{success:!1,error:`File not found: ${t}`};if(!P(r))return{success:!1,error:`Keys file not found: ${r}`};try{let i=N(r,"utf-8"),{parsed:s}=h(i),c=((e.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),a=c?`DOTENV_PRIVATE_KEY_${c}`:"DOTENV_PRIVATE_KEY",u=s[a];if(!u)return{success:!1,error:`Private key not found: ${a}`};let f=[u];if(a!=="DOTENV_PRIVATE_KEY"&&s.DOTENV_PRIVATE_KEY&&s.DOTENV_PRIVATE_KEY!==u)f.push(s.DOTENV_PRIVATE_KEY);let g=N(t,"utf-8").split(`
18
+ `),p=[];for(let v of g){let T=v.trim();if(!T||T.startsWith("#")){p.push(v);continue}if(T.startsWith("DOTENV_PUBLIC_KEY"))continue;let O=T.match(/^([^=]+)=(.*)$/);if(!O||O[1]===void 0||O[2]===void 0){p.push(v);continue}let m=O[1].trim(),_=O[2].trim();if(_.startsWith('"')&&_.endsWith('"')||_.startsWith("'")&&_.endsWith("'"))_=_.slice(1,-1);let A=_.startsWith("encrypted:");if(e.key&&!m.includes(e.key))A=!1;if(A){let R,I;for(let H of f)try{R=L(_,H);break}catch(Le){I=Le}if(R===void 0)throw I instanceof Error?I:Error(`Unable to decrypt ${m}`);_=R}p.push(`${m}="${_}"`)}let y=p.join(`
19
+ `);if(e.stdout)return{success:!0,output:y};return D(t,y,"utf-8"),{success:!0,output:`\u2714 decrypted (${e.file||".env"})`}}catch(i){return{success:!1,error:`Failed to decrypt: ${i instanceof Error?i.message:"Unknown error"}`}}}function nt(e,n,t={}){let r=t.cwd||process.cwd(),i=S(r,t.file||".env"),s=t.keysFile?S(r,t.keysFile):S(te(i),".env.keys");try{let o="";if(P(i))o=N(i,"utf-8");let d=o.split(`
20
+ `),c=!1,a,E=((t.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),g=E?`DOTENV_PUBLIC_KEY_${E}`:"DOTENV_PUBLIC_KEY",p=E?`DOTENV_PRIVATE_KEY_${E}`:"DOTENV_PRIVATE_KEY",y=on(o,t.file),v=y?.name??g;if(a=y?.key,a){let m=!1;if(P(s)){let A=N(s,"utf-8"),{parsed:R}=h(A);m=ne(t.file).some((I)=>Boolean(R[I]))}let _=ne(t.file).some((A)=>Boolean(process.env[A]));if(!m&&!_&&!Oe(o))a=void 0}if(!t.plain&&!a&&Oe(o))return{success:!1,error:`${t.file||".env"} already contains encrypted values, but no key that can be used to add another was found.
21
21
  Generating one would leave every existing encrypted value unreadable.
22
- Provide the private key as ${ee(t.file)[0]} in the environment, restore ${s}, or use --plain to write this value unencrypted.`};if(!t.plain&&!a){let m=U();a=m.publicKey;let _="";if(P(s))_=N(s,"utf-8");_+=`
22
+ Provide the private key as ${ne(t.file)[0]} in the environment, restore ${s}, or use --plain to write this value unencrypted.`};if(!t.plain&&!a){let m=x();a=m.publicKey;let _="";if(P(s))_=N(s,"utf-8");_+=`
23
23
  ${g}="${m.publicKey}"
24
- ${l}="${m.privateKey}"
25
- `,D(s,_,"utf-8");let A=Se(t.file);for(let R=d.length-1;R>=0;R--){let I=d[R];if(I!==void 0&&A.some((G)=>I.trim().startsWith(`${G}=`)))d.splice(R,1)}d.unshift(`${v}="${a}"`)}let T=n;if(!t.plain&&a)T=B(n,a);for(let m=0;m<d.length;m++){let _=d[m];if(_===void 0)continue;if(_.trim().startsWith(`${e}=`)){d[m]=`${e}="${T}"`,c=!0;break}}if(!c)d.push(`${e}="${T}"`);let O=d.join(`
26
- `);return D(i,O,"utf-8"),{success:!0,output:`set ${e}${t.plain?"":" with encryption"} (${t.file||".env"})`}}catch(o){return{success:!1,error:`Failed to set: ${o instanceof Error?o.message:"Unknown error"}`}}}function nt(e,n={}){let t=n.cwd||process.cwd(),r=S(t,n.file||".env");if(!P(r))return{success:!1,error:`File not found: ${r}`};try{let i,s=S(t,n.keysFile||".env.keys"),c=((n.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),a=c?`DOTENV_PRIVATE_KEY_${c}`:"DOTENV_PRIVATE_KEY";if(P(s)){let l=N(s,"utf-8"),{parsed:y}=h(l);i=y[a]}if(!i)i=process.env[a];let u=N(r,"utf-8"),{parsed:f}=h(u,{privateKey:i});if(e&&!n.all){let l=f[e];if(l===void 0)return{success:!1,error:`Key not found: ${e}`};return{success:!0,output:l}}let E=n.all?{...process.env,...f}:f,g;switch(n.format){case"shell":g=Object.entries(E).map(([l,y])=>`${l}=${y}`).join(" ");break;case"eval":g=Object.entries(E).map(([l,y])=>`${l}="${y}"`).join(`
27
- `);break;case"json":default:g=n.prettyPrint?JSON.stringify(E,null,2):JSON.stringify(E);break}return{success:!0,output:g}}catch(i){return{success:!1,error:`Failed to get: ${i instanceof Error?i.message:"Unknown error"}`}}}function tt(e,n={}){let t=n.cwd||process.cwd(),r=S(t,n.keysFile||".env.keys");if(!P(r))return{success:!1,error:`Keys file not found: ${r}`};try{let i=N(r,"utf-8"),{parsed:s}=h(i),c=((n.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),a=c?`DOTENV_PUBLIC_KEY_${c}`:"DOTENV_PUBLIC_KEY",u=c?`DOTENV_PRIVATE_KEY_${c}`:"DOTENV_PRIVATE_KEY";if(e){let g=s[e];if(!g)return{success:!1,error:`Key not found: ${e}`};return{success:!0,output:g}}let f={[a]:s[a],[u]:s[u]};return{success:!0,output:n.format==="shell"?`${a}=${f[a]} ${u}=${f[u]}`:JSON.stringify(f)}}catch(i){return{success:!1,error:`Failed to get keypair: ${i instanceof Error?i.message:"Unknown error"}`}}}function cn(e,n,t,r){let i=e.split(`
24
+ ${p}="${m.privateKey}"
25
+ `,D(s,_,"utf-8");let A=Ie(t.file);for(let R=d.length-1;R>=0;R--){let I=d[R];if(I!==void 0&&A.some((H)=>I.trim().startsWith(`${H}=`)))d.splice(R,1)}d.unshift(`${v}="${a}"`)}let T=n;if(!t.plain&&a)T=V(n,a);for(let m=0;m<d.length;m++){let _=d[m];if(_===void 0)continue;if(_.trim().startsWith(`${e}=`)){d[m]=`${e}="${T}"`,c=!0;break}}if(!c)d.push(`${e}="${T}"`);let O=d.join(`
26
+ `);return D(i,O,"utf-8"),{success:!0,output:`set ${e}${t.plain?"":" with encryption"} (${t.file||".env"})`}}catch(o){return{success:!1,error:`Failed to set: ${o instanceof Error?o.message:"Unknown error"}`}}}function tt(e,n={}){let t=n.cwd||process.cwd(),r=S(t,n.file||".env");if(!P(r))return{success:!1,error:`File not found: ${r}`};try{let i,s=S(t,n.keysFile||".env.keys"),c=((n.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),a=c?`DOTENV_PRIVATE_KEY_${c}`:"DOTENV_PRIVATE_KEY";if(P(s)){let p=N(s,"utf-8"),{parsed:y}=h(p);i=y[a]}if(!i)i=process.env[a];let u=N(r,"utf-8"),{parsed:f}=h(u,{privateKey:i});if(e&&!n.all){let p=f[e];if(p===void 0)return{success:!1,error:`Key not found: ${e}`};return{success:!0,output:p}}let E=n.all?{...process.env,...f}:f,g;switch(n.format){case"shell":g=Object.entries(E).map(([p,y])=>`${p}=${y}`).join(" ");break;case"eval":g=Object.entries(E).map(([p,y])=>`${p}="${y}"`).join(`
27
+ `);break;case"json":default:g=n.prettyPrint?JSON.stringify(E,null,2):JSON.stringify(E);break}return{success:!0,output:g}}catch(i){return{success:!1,error:`Failed to get: ${i instanceof Error?i.message:"Unknown error"}`}}}function rt(e,n={}){let t=n.cwd||process.cwd(),r=S(t,n.keysFile||".env.keys");if(!P(r))return{success:!1,error:`Keys file not found: ${r}`};try{let i=N(r,"utf-8"),{parsed:s}=h(i),c=((n.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),a=c?`DOTENV_PUBLIC_KEY_${c}`:"DOTENV_PUBLIC_KEY",u=c?`DOTENV_PRIVATE_KEY_${c}`:"DOTENV_PRIVATE_KEY";if(e){let g=s[e];if(!g)return{success:!1,error:`Key not found: ${e}`};return{success:!0,output:g}}let f={[a]:s[a],[u]:s[u]};return{success:!0,output:n.format==="shell"?`${a}=${f[a]} ${u}=${f[u]}`:JSON.stringify(f)}}catch(i){return{success:!1,error:`Failed to get keypair: ${i instanceof Error?i.message:"Unknown error"}`}}}function an(e,n,t,r){let i=e.split(`
28
28
  `),s=!1,o=!1;for(let d=0;d<i.length;d++){let c=i[d];if(c===void 0)continue;if(c.startsWith(`${t}=`))i[d]=`${t}="${n.publicKey}"`,s=!0;else if(c.startsWith(`${r}=`))i[d]=`${r}="${n.privateKey}"`,o=!0}if(!s)i.push(`${t}="${n.publicKey}"`);if(!o)i.push(`${r}="${n.privateKey}"`);return`${i.join(`
29
29
  `).replace(/\n+$/,"")}
30
- `}function rt(e={}){let n=dn({file:e.file,keysFile:e.keysFile,stdout:!0,cwd:e.cwd});if(!n.success)return n;if(n.output===void 0)return{success:!1,error:"Rotation produced no decrypted content"};let t=e.cwd||process.cwd(),r=e.file||".env",i=e.keysFile||".env.keys",s=S(t,r),o=S(t,i),{publicKeyName:d,privateKeyName:c}=k(e.file);if(e.dryRun){let T=rn(n.output,e);return{success:!0,output:["Dry run: nothing was written.",`${r}: ${T.length} value${T.length===1?"":"s"} would be re-encrypted under a new ${d}.`,`${i}: ${d} and ${c} would be replaced.`,`The current ${c} decrypts nothing once that happens, so keep a copy until the rotation is verified.`].join(`
31
- `)}}let a=U(),u=Ae(n.output,a.publicKey,d,e);if(e.stdout)return{success:!0,output:u,notice:[`Nothing was written. To adopt the output above, put this keypair in ${i}:`,"",`${d}="${a.publicKey}"`,`${c}="${a.privateKey}"`,"","Without it that output cannot be decrypted. Run without --stdout to have both applied together."].join(`
32
- `)};let f=N(s),E=N(o),g=cn(E.toString("utf8"),a,d,c),l=`${process.pid}-${Date.now()}`,y=S(ne(s),`.${Re(s)}.${l}.rotate`),v=S(ne(o),`.${Re(o)}.${l}.rotate`);try{D(y,u,{encoding:"utf8",mode:384}),D(v,g,{encoding:"utf8",mode:384}),Te(y,s);try{Te(v,o)}catch(T){throw D(s,f),T}return{success:!0,output:`\u2714 rotated (${r}) to encrypted:v2`}}catch(T){if(!P(o))D(o,E,{mode:384});return{success:!1,error:`Failed to rotate without exposing plaintext: ${T instanceof Error?T.message:"Unknown error"}`}}finally{me(y,{force:!0}),me(v,{force:!0})}}function an(e){return typeof e==="string"&&(e.startsWith("encrypted:")||e.startsWith("enc:"))}var un=/(?:^|_)(?:PASSWORD|PASSWD|SECRET|TOKEN|APIKEY|API_KEY|CREDENTIAL|CREDENTIALS|PRIVATE|SALT|DSN|CERT|CIPHER|SIGNATURE|WEBHOOK)(?:_|$)|(?:^|_)(?:ACCESS|SECRET)_KEY(?:_|$)|_KEY$/,fn=/^DOTENV_(?:PUBLIC|PRIVATE)_KEY/,En=/^\$\{[^}]+\}$/;function st(e,n={}){let{placeholders:t={},strict:r=!1}=n,i=[];for(let[s,o]of Object.entries(e)){if(!o||o.trim()==="")continue;if(an(o))continue;if(fn.test(s))continue;if(En.test(o.trim()))continue;let d=un.test(s),c=Object.prototype.hasOwnProperty.call(t,s)&&t[s]===o;if(d&&!c){i.push({key:s,reason:"plaintext-secret"});continue}if(r)i.push({key:s,reason:"plaintext-value"})}return i}function ot(e){return e.split(`
33
- `).map((n)=>n.trim()).filter(Boolean).filter((n)=>n!==".env.example").filter((n)=>/(?:^|\/)\.env(?:\.|$)/.test(n)).filter((n)=>!n.endsWith(".env.keys"))}function Ie(e){return`${e.replace(/[^a-z0-9]/gi,"").toUpperCase()}_`}function ln(e,n={}){let t=n.self?Ie(n.self):void 0,r=(n.tenants??[]).filter((o)=>typeof o==="string"&&o.trim().length>0).map((o)=>({slug:o,prefix:Ie(o)})).filter(({prefix:o})=>o!==t).sort((o,d)=>d.prefix.length-o.prefix.length),i={},s={};for(let[o,d]of Object.entries(e)){let c=r.find(({prefix:a})=>o.startsWith(a));if(c){(s[c.slug]??={})[o]=d;continue}i[o]=d}return{own:i,foreign:s}}function ct(e,n={}){return ln(e,n).own}function at(e){return Object.entries(e.foreign).map(([n,t])=>({tenant:n,keys:Object.keys(t).sort()})).sort((n,t)=>n.tenant.localeCompare(t.tenant))}import p from"process";import{platform as pn}from"os";var Ne=typeof Bun<"u",he=typeof p<"u"&&p.versions?.node!==void 0,gn=Ne?"bun":he?"node":"unknown",lt={name:gn,version:Ne?Bun.version:he?p.version:void 0},re=pn(),pt=re==="win32",gt=re==="darwin",_t=re==="linux",Pe=Boolean(p.stdout?.isTTY),yt=typeof globalThis.window<"u",_n=Boolean(p.env.CI||p.env.CONTINUOUS_INTEGRATION||p.env.BUILD_NUMBER||p.env.RUN_ID),Tt=Boolean(p.env.DEBUG||p.env.VERBOSE||p.argv.includes("--debug")||p.argv.includes("--verbose")),yn=_n||!Pe,mt=Boolean(!yn&&(Pe||p.env.COLORTERM||p.env.FORCE_COLOR||p.env.TERM&&p.env.TERM!=="dumb")),te={github:{name:"GitHub Actions",detected:Boolean(p.env.GITHUB_ACTIONS)},gitlab:{name:"GitLab CI",detected:Boolean(p.env.GITLAB_CI)},circle:{name:"CircleCI",detected:Boolean(p.env.CIRCLECI)},travis:{name:"Travis CI",detected:Boolean(p.env.TRAVIS)},jenkins:{name:"Jenkins",detected:Boolean(p.env.JENKINS_URL)},vercel:{name:"Vercel",detected:Boolean(p.env.VERCEL)},netlify:{name:"Netlify",detected:Boolean(p.env.NETLIFY)},heroku:{name:"Heroku",detected:Boolean(p.env.DYNO)},aws:{name:"AWS",detected:Boolean(p.env.AWS_REGION||p.env.AWS_LAMBDA_FUNCTION_NAME)},azure:{name:"Azure",detected:Boolean(p.env.AZURE_HTTP_USER_AGENT)},cloudflare:{name:"Cloudflare",detected:Boolean(p.env.CF_PAGES)},railway:{name:"Railway",detected:Boolean(p.env.RAILWAY_ENVIRONMENT)},render:{name:"Render",detected:Boolean(p.env.RENDER)}},Tn=Object.keys(te).find((e)=>{let n=te[e];return n!==void 0&&n.detected})||"unknown",Rt=te[Tn]||{name:"Unknown",detected:!1};var Ce=new Set;function vn(e){if(Ce.has(e))return;Ce.add(e);let n=Z();console.warn(`[env] warning: "${e}" is encrypted but no usable private key was found for the "${n}" environment; falling back to its default. Set DOTENV_PRIVATE_KEY_${n.toUpperCase()} or ship .env.keys.`)}var On={get:(e,n)=>{let t=e,r=t[n];if(typeof r==="string"&&(r.startsWith("encrypted:")||r.startsWith("enc:"))){let s=ge(r);if(s===void 0){vn(n),delete t[n];return}t[n]=s,r=s}let i=["_PORT","_TIMEOUT","_TTL","_SIZE","_LIMIT","_MAX","_MIN","_INTERVAL","_RETRIES","_CONCURRENCY","_WORKERS","_CONNECTIONS"];if(typeof r==="string"&&/^\d+$/.test(r)&&!r.startsWith("0")&&i.some((s)=>n.endsWith(s)))return Number(r);if(typeof r==="string"){let s=r.toLowerCase();if(s==="true")return!0;if(s==="false")return!1}return r},set:(e,n,t)=>Reflect.set(e,n,t,e),deleteProperty:(e,n)=>Reflect.deleteProperty(e,n)};function An(){return typeof Bun<"u"?Bun.env:mn.env}var be=new Proxy(An(),On);function ht(e,n,t){let r=t?.path||Rn(".env"),s=De.readFileSync(r,"utf-8").split(`
34
- `),o=s.findIndex((a)=>a.startsWith(`${e}=`)),c=/[\s"'#$\\]/.test(n)?`"${n.replace(/"/g,"\\\"")}"`:n;if(o!==-1)s[o]=`${e}=${c}`;else s.push(`${e}=${c}`);De.writeFileSync(r,s.join(`
35
- `))}function Pt(e=be){let n=[],t=e;for(let[r,i]of Object.entries(ye)){let s=t[r];if(s!==void 0&&s!==""&&!i.includes(String(s)))n.push(`${r}="${s}" is not valid. Allowed values: ${i.join(", ")}`)}return n}function Dt(e,n=be){let t=[],r=n;for(let i of e){let s=r[i];if(s===void 0||s===""||s===null)t.push(i)}if(t.length>0)throw Error(`[env] Missing required environment variable(s): ${t.join(", ")}. Set them in .env or your process environment before booting.`);return n}export{un as SECRET_NAME_PATTERN,Z as activeEnvName,ke as aesDecrypt,In as aesEncrypt,Yn as autoLoadEnv,sn as declaredEnvPublicKey,dn as decryptEnv,ge as decryptEnvValue,L as decryptValue,Hn as defineEnv,Zn as encryptEnv,B as encryptValue,be as env,ye as envEnum,ve as envHasCiphertext,k as envKeyNames,tn as envPlugin,ee as envPrivateKeyNames,Se as envPublicKeyNames,at as foreignTenantKeys,U as generateKeypair,nt as getEnv,tt as getKeypair,z as getPrivateKey,Pe as hasTTY,yt as hasWindow,Ne as isBun,_n as isCI,mt as isColorSupported,Tt as isDebug,an as isEncryptedValue,Nn as isLegacyEncryptedValue,_t as isLinux,gt as isMacOS,yn as isMinimal,he as isNode,pt as isWindows,_e as loadEnv,Un as loadEnvFiles,hn as migrateEncryptedValue,h as parse,Pn as parseEnvFromKey,ln as partitionTenantEnv,st as plaintextSecrets,re as platform,An as process,Tn as provider,Rt as providerInfo,Dt as requireEnv,Fn as resetPrivateKeyCache,Jn as resolveEnvFile,nn as resolvePrivateKey,on as reusableEnvPublicKey,rt as rotateKeypair,gn as runtime,lt as runtimeInfo,et as setEnv,ct as stripForeignTenantEnv,Ie as tenantEnvPrefix,ot as trackedEnvFiles,Pt as validateEnv,ht as writeEnv};
30
+ `}function it(e={}){let n=cn({file:e.file,keysFile:e.keysFile,stdout:!0,cwd:e.cwd});if(!n.success)return n;if(n.output===void 0)return{success:!1,error:"Rotation produced no decrypted content"};let t=e.cwd||process.cwd(),r=e.file||".env",i=e.keysFile||".env.keys",s=S(t,r),o=S(t,i),{publicKeyName:d,privateKeyName:c}=k(e.file);if(e.dryRun){let T=sn(n.output,e);return{success:!0,output:["Dry run: nothing was written.",`${r}: ${T.length} value${T.length===1?"":"s"} would be re-encrypted under a new ${d}.`,`${i}: ${d} and ${c} would be replaced.`,`The current ${c} decrypts nothing once that happens, so keep a copy until the rotation is verified.`].join(`
31
+ `)}}let a=x(),u=Se(n.output,a.publicKey,d,e);if(e.stdout)return{success:!0,output:u,notice:[`Nothing was written. To adopt the output above, put this keypair in ${i}:`,"",`${d}="${a.publicKey}"`,`${c}="${a.privateKey}"`,"","Without it that output cannot be decrypted. Run without --stdout to have both applied together."].join(`
32
+ `)};let f=N(s),E=N(o),g=an(E.toString("utf8"),a,d,c),p=`${process.pid}-${Date.now()}`,y=S(te(s),`.${ve(s)}.${p}.rotate`),v=S(te(o),`.${ve(o)}.${p}.rotate`);try{D(y,u,{encoding:"utf8",mode:384}),D(v,g,{encoding:"utf8",mode:384}),me(y,s);try{me(v,o)}catch(T){throw D(s,f),T}return{success:!0,output:`\u2714 rotated (${r}) to encrypted:v2`}}catch(T){if(!P(o))D(o,E,{mode:384});return{success:!1,error:`Failed to rotate without exposing plaintext: ${T instanceof Error?T.message:"Unknown error"}`}}finally{Re(y,{force:!0}),Re(v,{force:!0})}}function un(e){return typeof e==="string"&&(e.startsWith("encrypted:")||e.startsWith("enc:"))}var fn=/(?:^|_)(?:PASSWORD|PASSWD|SECRET|TOKEN|APIKEY|API_KEY|CREDENTIAL|CREDENTIALS|PRIVATE|SALT|DSN|CERT|CIPHER|SIGNATURE|WEBHOOK)(?:_|$)|(?:^|_)(?:ACCESS|SECRET)_KEY(?:_|$)|_KEY$/,ln=/^DOTENV_(?:PUBLIC|PRIVATE)_KEY/,En=/^\$\{[^}]+\}$/;function ot(e,n={}){let{placeholders:t={},strict:r=!1}=n,i=[];for(let[s,o]of Object.entries(e)){if(!o||o.trim()==="")continue;if(un(o))continue;if(ln.test(s))continue;if(En.test(o.trim()))continue;let d=fn.test(s),c=Object.prototype.hasOwnProperty.call(t,s)&&t[s]===o;if(d&&!c){i.push({key:s,reason:"plaintext-secret"});continue}if(r)i.push({key:s,reason:"plaintext-value"})}return i}function dt(e){return e.split(`
33
+ `).map((n)=>n.trim()).filter(Boolean).filter((n)=>n!==".env.example").filter((n)=>/(?:^|\/)\.env(?:\.|$)/.test(n)).filter((n)=>!n.endsWith(".env.keys"))}function Ne(e){return`${e.replace(/[^a-z0-9]/gi,"").toUpperCase()}_`}function pn(e,n={}){let t=n.self?Ne(n.self):void 0,r=(n.tenants??[]).filter((o)=>typeof o==="string"&&o.trim().length>0).map((o)=>({slug:o,prefix:Ne(o)})).filter(({prefix:o})=>o!==t).sort((o,d)=>d.prefix.length-o.prefix.length),i={},s={};for(let[o,d]of Object.entries(e)){let c=r.find(({prefix:a})=>o.startsWith(a));if(c){(s[c.slug]??={})[o]=d;continue}i[o]=d}return{own:i,foreign:s}}function at(e,n={}){return pn(e,n).own}function ut(e){return Object.entries(e.foreign).map(([n,t])=>({tenant:n,keys:Object.keys(t).sort()})).sort((n,t)=>n.tenant.localeCompare(t.tenant))}import l from"process";import{platform as gn}from"os";var he=typeof Bun<"u",Pe=typeof l<"u"&&l.versions?.node!==void 0,_n=he?"bun":Pe?"node":"unknown",pt={name:_n,version:he?Bun.version:Pe?l.version:void 0},ie=gn(),gt=ie==="win32",_t=ie==="darwin",yt=ie==="linux",De=Boolean(l.stdout?.isTTY),Tt=typeof globalThis.window<"u";function w(){return l.env.APP_ENV||l.env.NODE_ENV||"local"}function mt(){return w()==="local"}function Rt(){let e=w();return e==="development"||e==="dev"||e==="local"}function vt(){return w()==="staging"}function Ot(){let e=w();return e==="production"||e==="prod"}function At(){let e=w();return e==="test"||e==="testing"}var yn=Boolean(l.env.CI||l.env.CONTINUOUS_INTEGRATION||l.env.BUILD_NUMBER||l.env.RUN_ID),St=Boolean(l.env.DEBUG||l.env.VERBOSE||l.argv.includes("--debug")||l.argv.includes("--verbose")),Tn=yn||!De,It=Boolean(!Tn&&(De||l.env.COLORTERM||l.env.FORCE_COLOR||l.env.TERM&&l.env.TERM!=="dumb")),re={github:{name:"GitHub Actions",detected:Boolean(l.env.GITHUB_ACTIONS)},gitlab:{name:"GitLab CI",detected:Boolean(l.env.GITLAB_CI)},circle:{name:"CircleCI",detected:Boolean(l.env.CIRCLECI)},travis:{name:"Travis CI",detected:Boolean(l.env.TRAVIS)},jenkins:{name:"Jenkins",detected:Boolean(l.env.JENKINS_URL)},vercel:{name:"Vercel",detected:Boolean(l.env.VERCEL)},netlify:{name:"Netlify",detected:Boolean(l.env.NETLIFY)},heroku:{name:"Heroku",detected:Boolean(l.env.DYNO)},aws:{name:"AWS",detected:Boolean(l.env.AWS_REGION||l.env.AWS_LAMBDA_FUNCTION_NAME)},azure:{name:"Azure",detected:Boolean(l.env.AZURE_HTTP_USER_AGENT)},cloudflare:{name:"Cloudflare",detected:Boolean(l.env.CF_PAGES)},railway:{name:"Railway",detected:Boolean(l.env.RAILWAY_ENVIRONMENT)},render:{name:"Render",detected:Boolean(l.env.RENDER)}},mn=Object.keys(re).find((e)=>{let n=re[e];return n!==void 0&&n.detected})||"unknown",Nt=re[mn]||{name:"Unknown",detected:!1};var be=new Set;function On(e){if(be.has(e))return;be.add(e);let n=ee();console.warn(`[env] warning: "${e}" is encrypted but no usable private key was found for the "${n}" environment; falling back to its default. Set DOTENV_PRIVATE_KEY_${n.toUpperCase()} or ship .env.keys.`)}var An={get:(e,n)=>{let t=e,r=t[n];if(typeof r==="string"&&(r.startsWith("encrypted:")||r.startsWith("enc:"))){let s=_e(r);if(s===void 0){On(n),delete t[n];return}t[n]=s,r=s}let i=["_PORT","_TIMEOUT","_TTL","_SIZE","_LIMIT","_MAX","_MIN","_INTERVAL","_RETRIES","_CONCURRENCY","_WORKERS","_CONNECTIONS"];if(typeof r==="string"&&/^\d+$/.test(r)&&!r.startsWith("0")&&i.some((s)=>n.endsWith(s)))return Number(r);if(typeof r==="string"){let s=r.toLowerCase();if(s==="true")return!0;if(s==="false")return!1}return r},set:(e,n,t)=>Reflect.set(e,n,t,e),deleteProperty:(e,n)=>Reflect.deleteProperty(e,n)};function Sn(){return typeof Bun<"u"?Bun.env:Rn.env}var Ke=new Proxy(Sn(),An);function Lt(e,n,t){let r=t?.path||vn(".env"),s=Ce.readFileSync(r,"utf-8").split(`
34
+ `),o=s.findIndex((a)=>a.startsWith(`${e}=`)),c=/[\s"'#$\\]/.test(n)?`"${n.replace(/"/g,"\\\"")}"`:n;if(o!==-1)s[o]=`${e}=${c}`;else s.push(`${e}=${c}`);Ce.writeFileSync(r,s.join(`
35
+ `))}function kt(e=Ke){let n=[],t=e;for(let[r,i]of Object.entries(Te)){let s=t[r];if(s!==void 0&&s!==""&&!i.includes(String(s)))n.push(`${r}="${s}" is not valid. Allowed values: ${i.join(", ")}`)}return n}function xt(e,n=Ke){let t=[],r=n;for(let i of e){let s=r[i];if(s===void 0||s===""||s===null)t.push(i)}if(t.length>0)throw Error(`[env] Missing required environment variable(s): ${t.join(", ")}. Set them in .env or your process environment before booting.`);return n}export{fn as SECRET_NAME_PATTERN,ee as activeEnvName,xe as aesDecrypt,Nn as aesEncrypt,w as appEnv,Wn as autoLoadEnv,on as declaredEnvPublicKey,cn as decryptEnv,_e as decryptEnvValue,L as decryptValue,jn as defineEnv,et as encryptEnv,V as encryptValue,Ke as env,Te as envEnum,Oe as envHasCiphertext,k as envKeyNames,rn as envPlugin,ne as envPrivateKeyNames,Ie as envPublicKeyNames,ut as foreignTenantKeys,x as generateKeypair,tt as getEnv,rt as getKeypair,J as getPrivateKey,De as hasTTY,Tt as hasWindow,he as isBun,yn as isCI,It as isColorSupported,St as isDebug,Rt as isDevelopment,un as isEncryptedValue,hn as isLegacyEncryptedValue,yt as isLinux,mt as isLocal,_t as isMacOS,Tn as isMinimal,Pe as isNode,Ot as isProduction,vt as isStaging,At as isTesting,gt as isWindows,ye as loadEnv,Un as loadEnvFiles,Pn as migrateEncryptedValue,h as parse,Dn as parseEnvFromKey,pn as partitionTenantEnv,ot as plaintextSecrets,ie as platform,Sn as process,mn as provider,Nt as providerInfo,xt as requireEnv,Yn as resetPrivateKeyCache,Zn as resolveEnvFile,tn as resolvePrivateKey,dn as reusableEnvPublicKey,it as rotateKeypair,_n as runtime,pt as runtimeInfo,nt as setEnv,at as stripForeignTenantEnv,Ne as tenantEnvPrefix,dt as trackedEnvFiles,kt as validateEnv,Lt as writeEnv};
package/dist/utils.d.ts CHANGED
@@ -1,3 +1,33 @@
1
+ /**
2
+ * Which environment the application is running as.
3
+ *
4
+ * These are FUNCTIONS, unlike the runtime and platform flags above, which are
5
+ * `const`s evaluated at import. `APP_ENV` is routinely set after the module
6
+ * graph is loaded - a test harness pinning `APP_ENV=test`, a CLI resolving
7
+ * `--env` - so a const would freeze whatever happened to be set when the first
8
+ * import ran and report the wrong environment for the rest of the process
9
+ * (stacksjs/stacks#2581).
10
+ *
11
+ * `NODE_ENV` is the fallback, since a plain `bun test` sets it and nothing
12
+ * else.
13
+ */
14
+ export declare function appEnv(): string;
15
+ /** Running as `local`. This is the default when nothing is set. */
16
+ export declare function isLocal(): boolean;
17
+ /**
18
+ * Running as `development` OR `local`.
19
+ *
20
+ * The two are one question at almost every call site - "is this a developer's
21
+ * machine" - and Stacks uses `local` where other frameworks use `development`,
22
+ * so a check for one that silently missed the other would be a trap.
23
+ */
24
+ export declare function isDevelopment(): boolean;
25
+ /** Running as `staging`. */
26
+ export declare function isStaging(): boolean;
27
+ /** Running as `production`. */
28
+ export declare function isProduction(): boolean;
29
+ /** Running under a test runner. */
30
+ export declare function isTesting(): boolean;
1
31
  // Runtime detection
2
32
  export declare const isBun: boolean;
3
33
  export declare const isNode: boolean;
package/dist/utils.js CHANGED
@@ -1,2 +1,2 @@
1
1
  // @bun
2
- import e from"process";import{platform as s}from"os";var a=typeof Bun<"u",d=typeof e<"u"&&e.versions?.node!==void 0,l=a?"bun":d?"node":"unknown",B={name:l,version:a?Bun.version:d?e.version:void 0},o=s(),b=o==="win32",I=o==="darwin",f=o==="linux",r=Boolean(e.stdout?.isTTY),E=typeof globalThis.window<"u",c=Boolean(e.env.CI||e.env.CONTINUOUS_INTEGRATION||e.env.BUILD_NUMBER||e.env.RUN_ID),R=Boolean(e.env.DEBUG||e.env.VERBOSE||e.argv.includes("--debug")||e.argv.includes("--verbose")),v=c||!r,N=Boolean(!v&&(r||e.env.COLORTERM||e.env.FORCE_COLOR||e.env.TERM&&e.env.TERM!=="dumb")),n={github:{name:"GitHub Actions",detected:Boolean(e.env.GITHUB_ACTIONS)},gitlab:{name:"GitLab CI",detected:Boolean(e.env.GITLAB_CI)},circle:{name:"CircleCI",detected:Boolean(e.env.CIRCLECI)},travis:{name:"Travis CI",detected:Boolean(e.env.TRAVIS)},jenkins:{name:"Jenkins",detected:Boolean(e.env.JENKINS_URL)},vercel:{name:"Vercel",detected:Boolean(e.env.VERCEL)},netlify:{name:"Netlify",detected:Boolean(e.env.NETLIFY)},heroku:{name:"Heroku",detected:Boolean(e.env.DYNO)},aws:{name:"AWS",detected:Boolean(e.env.AWS_REGION||e.env.AWS_LAMBDA_FUNCTION_NAME)},azure:{name:"Azure",detected:Boolean(e.env.AZURE_HTTP_USER_AGENT)},cloudflare:{name:"Cloudflare",detected:Boolean(e.env.CF_PAGES)},railway:{name:"Railway",detected:Boolean(e.env.RAILWAY_ENVIRONMENT)},render:{name:"Render",detected:Boolean(e.env.RENDER)}},u=Object.keys(n).find((i)=>{let t=n[i];return t!==void 0&&t.detected})||"unknown",T=n[u]||{name:"Unknown",detected:!1};export{r as hasTTY,E as hasWindow,a as isBun,c as isCI,N as isColorSupported,R as isDebug,f as isLinux,I as isMacOS,v as isMinimal,d as isNode,b as isWindows,o as platform,u as provider,T as providerInfo,l as runtime,B as runtimeInfo};
2
+ import e from"process";import{platform as l}from"os";var i=typeof Bun<"u",d=typeof e<"u"&&e.versions?.node!==void 0,c=i?"bun":d?"node":"unknown",f={name:c,version:i?Bun.version:d?e.version:void 0},r=l(),E=r==="win32",B=r==="darwin",N=r==="linux",s=Boolean(e.stdout?.isTTY),I=typeof globalThis.window<"u";function o(){return e.env.APP_ENV||e.env.NODE_ENV||"local"}function x(){return o()==="local"}function R(){let n=o();return n==="development"||n==="dev"||n==="local"}function T(){return o()==="staging"}function C(){let n=o();return n==="production"||n==="prod"}function g(){let n=o();return n==="test"||n==="testing"}var u=Boolean(e.env.CI||e.env.CONTINUOUS_INTEGRATION||e.env.BUILD_NUMBER||e.env.RUN_ID),A=Boolean(e.env.DEBUG||e.env.VERBOSE||e.argv.includes("--debug")||e.argv.includes("--verbose")),v=u||!s,_=Boolean(!v&&(s||e.env.COLORTERM||e.env.FORCE_COLOR||e.env.TERM&&e.env.TERM!=="dumb")),t={github:{name:"GitHub Actions",detected:Boolean(e.env.GITHUB_ACTIONS)},gitlab:{name:"GitLab CI",detected:Boolean(e.env.GITLAB_CI)},circle:{name:"CircleCI",detected:Boolean(e.env.CIRCLECI)},travis:{name:"Travis CI",detected:Boolean(e.env.TRAVIS)},jenkins:{name:"Jenkins",detected:Boolean(e.env.JENKINS_URL)},vercel:{name:"Vercel",detected:Boolean(e.env.VERCEL)},netlify:{name:"Netlify",detected:Boolean(e.env.NETLIFY)},heroku:{name:"Heroku",detected:Boolean(e.env.DYNO)},aws:{name:"AWS",detected:Boolean(e.env.AWS_REGION||e.env.AWS_LAMBDA_FUNCTION_NAME)},azure:{name:"Azure",detected:Boolean(e.env.AZURE_HTTP_USER_AGENT)},cloudflare:{name:"Cloudflare",detected:Boolean(e.env.CF_PAGES)},railway:{name:"Railway",detected:Boolean(e.env.RAILWAY_ENVIRONMENT)},render:{name:"Render",detected:Boolean(e.env.RENDER)}},p=Object.keys(t).find((n)=>{let a=t[n];return a!==void 0&&a.detected})||"unknown",O=t[p]||{name:"Unknown",detected:!1};export{o as appEnv,s as hasTTY,I as hasWindow,i as isBun,u as isCI,_ as isColorSupported,A as isDebug,R as isDevelopment,N as isLinux,x as isLocal,B as isMacOS,v as isMinimal,d as isNode,C as isProduction,T as isStaging,g as isTesting,E as isWindows,r as platform,p as provider,O as providerInfo,c as runtime,f as runtimeInfo};
package/package.json CHANGED
@@ -2,7 +2,7 @@
2
2
  "name": "@stacksjs/env",
3
3
  "type": "module",
4
4
  "sideEffects": false,
5
- "version": "0.74.36",
5
+ "version": "0.74.37",
6
6
  "description": "Stacks env helper methods.",
7
7
  "author": "Chris Breuer",
8
8
  "contributors": [
@@ -56,10 +56,10 @@
56
56
  "prepublishOnly": "bun run build"
57
57
  },
58
58
  "dependencies": {
59
- "@stacksjs/path": "0.74.36"
59
+ "@stacksjs/path": "0.74.37"
60
60
  },
61
61
  "devDependencies": {
62
62
  "better-dx": "^0.2.24",
63
- "@stacksjs/validation": "0.74.36"
63
+ "@stacksjs/validation": "0.74.37"
64
64
  }
65
65
  }