cf-envsync 0.3.5 → 0.3.7

package/dist/index.js

@@ -13196,9 +13196,14 @@ async function loadEnvFile(filePath, env2, projectRoot, encryption) {
   }
   if (encryption === "password") {
     const envMap = parsePlainEnv(content);
+    const hasEncryptedValues = Object.values(envMap).some((v2) => v2.startsWith("envsync:v1:"));
     const password = findPassword(env2, projectRoot);
-    if (!password)
+    if (!password) {
+      if (hasEncryptedValues) {
+        throw new Error(`${filePath} contains encrypted values but no password found. ` + `Set ENVSYNC_PASSWORD${env2 ? `_${env2.toUpperCase()}` : ""} or create .env.password`);
+      }
       return envMap;
+    }
     return decryptEnvMap(envMap, password);
   }
   const privateKey = findPrivateKey(env2, projectRoot);
@@ -14942,6 +14947,15 @@ var init_encrypt = __esm(() => {
       }
       const content = await readFile(envFilePath);
       const lines = parseLines(content);
+      const firstEncrypted = lines.find((l2) => l2.key && l2.value && isEnvsyncEncrypted(l2.value.trim()));
+      if (firstEncrypted) {
+        try {
+          decryptValue(firstEncrypted.value.trim(), password);
+        } catch {
+          consola.error(`Password mismatch: cannot decrypt existing value for ${firstEncrypted.key}. ` + `The current password differs from the one used to encrypt existing values.`);
+          process.exit(1);
+        }
+      }
       let encryptedCount = 0;
       let skippedCount = 0;
       const outputLines = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cf-envsync",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "description": "Sync .env files to Cloudflare Workers secrets, .dev.vars, and more",
   "type": "module",
   "exports": {