dotenv-gad 1.4.2 → 1.5.0

package/dist/cli/commands/rotate.js

@@ -0,0 +1,160 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import ora from "ora";
+import { createInterface } from "node:readline/promises";
+import { existsSync, readFileSync, writeFileSync, copyFileSync } from "node:fs";
+import dotenv from "dotenv";
+import { generateKeyPair, encryptEnvValue, decryptEnvValue, isEncryptedValue, loadPrivateKey, } from "../../crypto.js";
+import { loadSchema } from "./utils.js";
+async function confirm(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = await rl.question(question);
+        return answer.trim().toLowerCase() === "y";
+    }
+    finally {
+        rl.close();
+    }
+}
+export default function (_program) {
+    return new Command("rotate")
+        .description("Rotate encryption keys: decrypt all fields, generate a new key pair, re-encrypt")
+        .option("--keys <file>", "Path to the .env.keys file", ".env.keys")
+        .option("-f, --force", "Skip confirmation prompt")
+        .action(async (opts, command) => {
+        const rootOpts = command.parent.opts();
+        const envPath = rootOpts.env ?? ".env";
+        const schemaPath = rootOpts.schema ?? "env.schema.ts";
+        const keysPath = opts.keys;
+        const spinner = ora("Loading schema…").start();
+        try {
+            const schema = await loadSchema(schemaPath);
+            const encryptedFields = Object.keys(schema).filter((k) => schema[k].encrypted === true);
+            if (encryptedFields.length === 0) {
+                spinner.info(chalk.dim("No fields with encrypted: true in schema. Nothing to rotate."));
+                return;
+            }
+            spinner.text = `Reading ${envPath}…`;
+            let envContent;
+            try {
+                envContent = readFileSync(envPath, "utf8");
+            }
+            catch {
+                spinner.fail(chalk.red(`Cannot read ${envPath}`));
+                process.exit(1);
+            }
+            const parsed = dotenv.parse(envContent);
+            spinner.text = "Loading current private key…";
+            const oldPrivateKeyHex = loadPrivateKey({ keysPath });
+            if (!oldPrivateKeyHex) {
+                spinner.fail(chalk.red("Current private key not found.\n" +
+                    `  Checked: ${keysPath} and ENVGAD_PRIVATE_KEY env var\n` +
+                    "  Cannot rotate without the current private key."));
+                process.exit(1);
+            }
+            // Identify which fields have encrypted values in the .env file
+            const toRotate = encryptedFields.filter((k) => parsed[k] && isEncryptedValue(parsed[k]));
+            spinner.stop();
+            if (toRotate.length === 0) {
+                console.log(chalk.dim("No encrypted values found in .env to rotate."));
+                return;
+            }
+            console.log(chalk.bold(`\nKey rotation will affect ${toRotate.length} field(s):\n`) +
+                toRotate.map((k) => chalk.dim(`  • ${k}`)).join("\n") +
+                "\n\n" +
+                chalk.yellow("This operation will:\n") +
+                chalk.dim("  1. Decrypt all encrypted values with the current private key\n") +
+                chalk.dim("  2. Generate a new X25519 key pair\n") +
+                chalk.dim("  3. Re-encrypt all values with the new public key\n") +
+                chalk.dim("  4. Write the new public key to " + envPath + "\n") +
+                chalk.dim("  5. Save the old private key as ENVGAD_PRIVATE_KEY_OLD in " + keysPath + "\n") +
+                chalk.dim("  6. Write the new private key to " + keysPath + "\n"));
+            if (!opts.force) {
+                const ok = await confirm("   Proceed with key rotation? (y/N): ");
+                if (!ok) {
+                    console.log(chalk.dim("\nAborted."));
+                    return;
+                }
+                console.log();
+            }
+            const spinner2 = ora("Step 1/4: Decrypting current values…").start();
+            // Decrypt all encrypted values with the old key
+            const decrypted = {};
+            const decryptErrors = [];
+            for (const key of toRotate) {
+                try {
+                    decrypted[key] = decryptEnvValue(parsed[key], oldPrivateKeyHex, key);
+                }
+                catch (err) {
+                    decryptErrors.push(`${key}: ${err instanceof Error ? err.message : "decryption failed"}`);
+                }
+            }
+            if (decryptErrors.length > 0) {
+                spinner2.fail(chalk.red("Decryption failed for some fields. Aborting rotation."));
+                for (const e of decryptErrors) {
+                    console.error(chalk.red(`  ✗ ${e}`));
+                }
+                console.log(chalk.dim("\nNo changes were written. Your .env and .env.keys are unchanged."));
+                process.exit(1);
+            }
+            spinner2.text = "Step 2/4: Generating new key pair…";
+            // Generate new key pair
+            const { publicKeyHex: newPublicKeyHex, privateKeyHex: newPrivateKeyHex } = generateKeyPair();
+            spinner2.text = "Step 3/4: Re-encrypting values with new key…";
+            // Re-encrypt all values with the new public key
+            const reEncrypted = {};
+            for (const key of toRotate) {
+                reEncrypted[key] = encryptEnvValue(decrypted[key], newPublicKeyHex, key);
+            }
+            spinner2.text = "Step 4/4: Writing updated files…";
+            // Update .env — replace all encrypted values and the public key
+            let updatedEnvContent = envContent;
+            // Update ENVGAD_PUBLIC_KEY
+            if (/^ENVGAD_PUBLIC_KEY=/m.test(updatedEnvContent)) {
+                updatedEnvContent = updatedEnvContent.replace(/^ENVGAD_PUBLIC_KEY=.*$/m, `ENVGAD_PUBLIC_KEY=${newPublicKeyHex}`);
+            }
+            else {
+                const sep = updatedEnvContent.endsWith("\n") ? "" : "\n";
+                updatedEnvContent += `${sep}ENVGAD_PUBLIC_KEY=${newPublicKeyHex}\n`;
+            }
+            const replaceRegexes = Object.fromEntries(Object.keys(reEncrypted).map((k) => [k, new RegExp(`^(${k}\\s*=).*$`, "m")]));
+            for (const [key, value] of Object.entries(reEncrypted)) {
+                updatedEnvContent = updatedEnvContent.replace(replaceRegexes[key], `$1${value}`);
+            }
+            copyFileSync(envPath, `${envPath}.bak`);
+            writeFileSync(envPath, updatedEnvContent);
+            // Update .env.keys — keep old key as ENVGAD_PRIVATE_KEY_OLD
+            const keysFileContent = "# KEEP THIS FILE SECRET — DO NOT COMMIT TO GIT\n" +
+                "# Share securely via 1Password, Vault, or a secure channel\n" +
+                `ENVGAD_PRIVATE_KEY=${newPrivateKeyHex}\n` +
+                `\n# Previous key (kept for emergency access)\n` +
+                `ENVGAD_PRIVATE_KEY_OLD=${oldPrivateKeyHex}\n`;
+            // Back up old .env.keys before overwriting
+            if (existsSync(keysPath)) {
+                copyFileSync(keysPath, `${keysPath}.bak`);
+            }
+            writeFileSync(keysPath, keysFileContent, { mode: 0o600 });
+            spinner2.succeed(chalk.green("Key rotation complete!"));
+            console.log(`\n${chalk.green("✓")} ${toRotate.length} field(s) re-encrypted in ${chalk.bold(envPath)}\n` +
+                `${chalk.green("✓")} New public key written to ${chalk.bold(envPath)}\n` +
+                `${chalk.green("✓")} New private key written to ${chalk.bold(keysPath)}\n` +
+                `${chalk.dim(`✓ Previous private key preserved as ENVGAD_PRIVATE_KEY_OLD in ${keysPath}`)}\n` +
+                chalk.dim(`✓ Backup of old ${envPath} saved as ${envPath}.bak\n`) +
+                (existsSync(`${keysPath}.bak`)
+                    ? chalk.dim(`✓ Backup of old ${keysPath} saved as ${keysPath}.bak\n`)
+                    : "") +
+                "\n" +
+                chalk.yellow("Next steps:\n") +
+                chalk.dim("  • Distribute the new .env.keys to team members\n") +
+                chalk.dim("  • Update ENVGAD_PRIVATE_KEY in CI/CD secrets\n") +
+                chalk.dim("  • Run: ") +
+                chalk.cyan("npx dotenv-gad verify") +
+                chalk.dim(" to confirm decryption works with the new key"));
+        }
+        catch (error) {
+            spinner.stop();
+            console.error(chalk.red("Unexpected error:"), error);
+            process.exit(2);
+        }
+    });
+}

package/dist/cli/commands/status.js

@@ -0,0 +1,116 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import ora from "ora";
+import { existsSync, readFileSync } from "node:fs";
+import dotenv from "dotenv";
+import { isEncryptedValue, loadPrivateKey } from "../../crypto.js";
+import { loadSchema } from "./utils.js";
+export default function (_program) {
+    return new Command("status")
+        .description("Show encryption status of all schema fields in the .env file")
+        .option("--keys <file>", "Path to .env.keys file", ".env.keys")
+        .action(async (opts, command) => {
+        const rootOpts = command.parent.opts();
+        const envPath = rootOpts.env ?? ".env";
+        const schemaPath = rootOpts.schema ?? "env.schema.ts";
+        const keysPath = opts.keys;
+        const spinner = ora("Loading schema…").start();
+        try {
+            const schema = await loadSchema(schemaPath);
+            let envContent = "";
+            if (existsSync(envPath)) {
+                envContent = readFileSync(envPath, "utf8");
+            }
+            const parsed = dotenv.parse(envContent);
+            // Check key availability
+            const hasPublicKey = Boolean(parsed.ENVGAD_PUBLIC_KEY);
+            const privateKeyHex = loadPrivateKey({ keysPath });
+            spinner.stop();
+            const schemaKeys = Object.keys(schema);
+            const encryptedSchemaKeys = new Set(schemaKeys.filter((k) => schema[k].encrypted));
+            console.log(chalk.bold("\nEnvironment Encryption Status"));
+            console.log(chalk.dim("─".repeat(52)));
+            let correctCount = 0;
+            let warningCount = 0;
+            for (const key of schemaKeys) {
+                const rule = schema[key];
+                const value = parsed[key];
+                const needsEncryption = rule.encrypted === true;
+                const valueIsEncrypted = value ? isEncryptedValue(value) : false;
+                const valueMissing = value == null || value === "";
+                let icon;
+                let label;
+                let note;
+                if (valueMissing) {
+                    if (needsEncryption) {
+                        icon = chalk.dim("○");
+                        label = chalk.dim("missing");
+                        note = chalk.dim("(encrypted when present)");
+                    }
+                    else {
+                        icon = chalk.dim("○");
+                        label = chalk.dim("missing");
+                        note = "";
+                    }
+                }
+                else if (needsEncryption && valueIsEncrypted) {
+                    icon = chalk.green("✓");
+                    label = chalk.green("encrypted");
+                    note = chalk.dim("(correct)");
+                    correctCount++;
+                }
+                else if (needsEncryption && !valueIsEncrypted) {
+                    icon = chalk.yellow("⚠");
+                    label = chalk.yellow("plaintext");
+                    note = chalk.yellow("(should be encrypted — run: npx dotenv-gad encrypt)");
+                    warningCount++;
+                }
+                else if (!needsEncryption && valueIsEncrypted) {
+                    icon = chalk.red("✗");
+                    label = chalk.red("encrypted");
+                    note = chalk.red("(schema lacks encrypted: true)");
+                    warningCount++;
+                }
+                else {
+                    icon = chalk.green("✓");
+                    label = chalk.dim("plaintext");
+                    note = chalk.dim("(no encryption required)");
+                    correctCount++;
+                }
+                const keyDisplay = chalk.bold(key.padEnd(24));
+                console.log(`  ${icon} ${keyDisplay} ${label}  ${note}`);
+            }
+            console.log(chalk.dim("─".repeat(52)));
+            // Key availability summary
+            console.log();
+            if (hasPublicKey) {
+                console.log(`  ${chalk.green("✓")} ${chalk.dim("Public key (ENVGAD_PUBLIC_KEY): present in " + envPath)}`);
+            }
+            else {
+                console.log(`  ${chalk.yellow("⚠")} ${chalk.yellow("Public key (ENVGAD_PUBLIC_KEY): missing — run: npx dotenv-gad keygen")}`);
+            }
+            if (privateKeyHex) {
+                const src = existsSync(keysPath) ? keysPath : "ENVGAD_PRIVATE_KEY env var";
+                console.log(`  ${chalk.green("✓")} ${chalk.dim("Private key (ENVGAD_PRIVATE_KEY): found in " + src)}`);
+            }
+            else {
+                console.log(`  ${chalk.dim("○")} ${chalk.dim("Private key (ENVGAD_PRIVATE_KEY): not found (needed for decryption only)")}`);
+            }
+            console.log();
+            const encryptedTotal = encryptedSchemaKeys.size;
+            if (warningCount > 0) {
+                console.log(chalk.yellow(`  ${warningCount} issue(s) detected`) +
+                    chalk.dim(`, ${correctCount} correct, ${encryptedTotal} field(s) require encryption`));
+                process.exit(1);
+            }
+            else {
+                console.log(chalk.green(`  All ${schemaKeys.length} field(s) are correctly configured`));
+            }
+        }
+        catch (error) {
+            spinner.stop();
+            console.error(chalk.red("Unexpected error:"), error);
+            process.exit(2);
+        }
+    });
+}

package/dist/cli/commands/sync.js

@@ -3,7 +3,7 @@ import chalk from "chalk";
 import ora from "ora";
 import { writeFileSync } from "fs";
 import { loadSchema } from "./utils.js";
-export default function (program) {
+export default function (_program) {
     return new Command("sync")
         .description("Generate/update .env.example file")
         .option("--output <file>", "Output file path", ".env.example")
@@ -15,39 +15,37 @@ export default function (program) {
             if (!schema || typeof schema !== "object") {
                 throw new Error(`The schema loaded from "${rootOpts.schema}" is not valid.`);
             }
-            let exampleContent = "# Auto-generated by dotenv-gad\n\n";
+            const parts = ["# Auto-generated by dotenv-gad\n\n"];
             Object.entries(schema).forEach(([key, rule]) => {
                 if (rule.sensitive)
                     return;
-                // If this is a grouped object with properties, emit grouped entries
                 const eff = rule;
+                // If this is a grouped object with properties, emit grouped entries
                 if (eff.type === "object" && eff.properties) {
                     const prefix = eff.envPrefix || `${key}_`;
-                    exampleContent += `# ${eff.docs || "No description available"}\n`;
-                    exampleContent += `# Group: ${key} (prefix=${prefix})\n`;
+                    parts.push(`# ${eff.docs || "No description available"}\n`);
+                    parts.push(`# Group: ${key} (prefix=${prefix})\n`);
                     Object.entries(eff.properties).forEach(([prop, pRule]) => {
                         const pr = pRule;
                         if (pr.sensitive)
                             return;
-                        exampleContent += `# ${pr.docs || "No description available"}\n`;
-                        exampleContent += `# Type: ${pr.type}\n`;
+                        parts.push(`# ${pr.docs || "No description available"}\n`);
+                        parts.push(`# Type: ${pr.type}\n`);
                         if (pr.default !== undefined) {
-                            exampleContent += `# Default: ${JSON.stringify(pr.default)}\n`;
+                            parts.push(`# Default: ${JSON.stringify(pr.default)}\n`);
                         }
-                        exampleContent += `${prefix}${prop}=${pr.default ? JSON.stringify(pr.default) : ""}\n\n`;
+                        parts.push(`${prefix}${prop}=${pr.default ? JSON.stringify(pr.default) : ""}\n\n`);
                     });
                     return;
                 }
-                exampleContent += `# ${rule.docs || "No description available"}\n`;
-                exampleContent += `# Type: ${rule.type}\n`;
-                if (rule.default !== undefined) {
-                    exampleContent += `# Default: ${JSON.stringify(rule.default)}\n`;
+                parts.push(`# ${eff.docs || "No description available"}\n`);
+                parts.push(`# Type: ${eff.type}\n`);
+                if (eff.default !== undefined) {
+                    parts.push(`# Default: ${JSON.stringify(eff.default)}\n`);
                 }
-                exampleContent += `${key}=${rule.default
-                    ? JSON.stringify(rule.default)
-                    : ""}\n\n`;
+                parts.push(`${key}=${eff.default ? JSON.stringify(eff.default) : ""}\n\n`);
             });
-            writeFileSync(options.output, exampleContent.trim());
+            writeFileSync(options.output, parts.join("").trimEnd());
             spinner.succeed(chalk.green(`Generated ${options.output} successfully!`));
         }
         catch (error) {

package/dist/cli/commands/utils.js

@@ -1,6 +1,6 @@
 import { readFileSync, writeFileSync } from "fs";
+import { createInterface } from "node:readline/promises";
 import Chalk from "chalk";
-import inquirer from "inquirer";
 // Re-export from the standalone schema loader (no CLI-only deps)
 export { loadSchema } from "../../schema-loader.js";
 /**
@@ -16,37 +16,43 @@ export { loadSchema } from "../../schema-loader.js";
  */
 export async function applyFix(issues, schema, envPath = ".env") {
     const envLines = readFileSync(envPath, "utf-8").split("\n");
-    for (const key in issues) {
-        if (!Object.prototype.hasOwnProperty.call(issues, key))
-            continue;
-        const issue = issues[key];
-        const rule = schema[key];
-        if (!rule) {
-            console.error(Chalk.red(`Error: Could not find rule for key ${key} in schema`));
-            continue;
-        }
-        const { value } = await inquirer.prompt({
-            type: "input",
-            name: "value",
-            message: `${Chalk.yellow(key)} (${rule.docs || "No description"})`,
-            default: rule.default !== undefined ? String(rule.default) : "",
-            validate: (input) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        for (const key in issues) {
+            if (!Object.prototype.hasOwnProperty.call(issues, key))
+                continue;
+            const rule = schema[key];
+            if (!rule) {
+                console.error(Chalk.red(`Error: Could not find rule for key ${key} in schema`));
+                continue;
+            }
+            const defaultValue = rule.default !== undefined ? String(rule.default) : "";
+            const hint = defaultValue ? Chalk.dim(` [${defaultValue}]`) : "";
+            const prompt = `${Chalk.yellow(key)} (${rule.docs || "No description"})${hint}: `;
+            let input;
+            while (true) {
+                const answer = await rl.question(prompt);
+                input = answer.trim() || defaultValue;
                 if (rule.required && !input) {
-                    return "Value is required";
+                    console.log(Chalk.red("  Value is required"));
+                    continue;
                 }
-                return true;
-            },
-        });
-        // Sanitize: strip newlines and carriage returns to prevent .env injection
-        const sanitized = String(value).replace(/[\r\n]/g, "");
-        const lineIndex = envLines.findIndex((line) => line.startsWith(`${key}=`));
-        if (lineIndex >= 0) {
-            envLines[lineIndex] = `${key}=${sanitized}`;
-        }
-        else {
-            envLines.push(`${key}=${sanitized}`);
+                break;
+            }
+            // Sanitize: strip newlines and carriage returns to prevent .env injection
+            const sanitized = input.replace(/[\r\n]/g, "");
+            const lineIndex = envLines.findIndex((line) => line.startsWith(`${key}=`));
+            if (lineIndex >= 0) {
+                envLines[lineIndex] = `${key}=${sanitized}`;
+            }
+            else {
+                envLines.push(`${key}=${sanitized}`);
+            }
         }
     }
+    finally {
+        rl.close();
+    }
     writeFileSync(envPath, envLines.join("\n"));
     console.log(Chalk.green(`Updated ${envPath} successfully!`));
 }

package/dist/cli/commands/verify.js

@@ -0,0 +1,101 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import ora from "ora";
+import { existsSync, readFileSync } from "node:fs";
+import dotenv from "dotenv";
+import { decryptEnvValue, isEncryptedValue, loadPrivateKey } from "../../crypto.js";
+import { EncryptionKeyMissingError } from "../../errors.js";
+import { loadSchema } from "./utils.js";
+export default function (_program) {
+    return new Command("verify")
+        .description("Verify all encrypted fields can be decrypted with the current private key (no output)")
+        .option("--keys <file>", "Path to .env.keys file", ".env.keys")
+        .action(async (opts, command) => {
+        const rootOpts = command.parent.opts();
+        const envPath = rootOpts.env ?? ".env";
+        const schemaPath = rootOpts.schema ?? "env.schema.ts";
+        const keysPath = opts.keys;
+        const spinner = ora("Loading schema…").start();
+        try {
+            const schema = await loadSchema(schemaPath);
+            const encryptedFields = Object.keys(schema).filter((k) => schema[k].encrypted === true);
+            if (encryptedFields.length === 0) {
+                spinner.info(chalk.dim("No fields with encrypted: true in schema. Nothing to verify."));
+                return;
+            }
+            spinner.text = `Reading ${envPath}…`;
+            let envContent = "";
+            try {
+                envContent = existsSync(envPath) ? readFileSync(envPath, "utf8") : "";
+            }
+            catch {
+                spinner.fail(chalk.red(`Cannot read ${envPath}`));
+                process.exit(1);
+            }
+            const parsed = dotenv.parse(envContent);
+            spinner.text = "Loading private key…";
+            const privateKeyHex = loadPrivateKey({ keysPath });
+            if (!privateKeyHex) {
+                spinner.fail(chalk.red("Private key not found.\n" +
+                    `  Checked: ${keysPath} and ENVGAD_PRIVATE_KEY env var`));
+                process.exit(1);
+            }
+            spinner.text = `Verifying ${encryptedFields.length} encrypted field(s)…`;
+            const results = [];
+            for (const key of encryptedFields) {
+                const value = parsed[key];
+                if (value == null || value === "") {
+                    // No value present — skip (required check is handled by validate)
+                    continue;
+                }
+                if (!isEncryptedValue(value)) {
+                    results.push({ key, ok: false, reason: "value is plaintext (not encrypted)" });
+                    continue;
+                }
+                try {
+                    decryptEnvValue(value, privateKeyHex, key);
+                    results.push({ key, ok: true });
+                }
+                catch (err) {
+                    results.push({
+                        key,
+                        ok: false,
+                        reason: err instanceof Error ? err.message : "Decryption failed",
+                    });
+                }
+            }
+            spinner.stop();
+            const failed = results.filter((r) => !r.ok);
+            const passed = results.filter((r) => r.ok);
+            for (const { key, ok, reason } of results) {
+                if (ok) {
+                    console.log(`  ${chalk.green("✓")} ${chalk.bold(key)}`);
+                }
+                else {
+                    console.log(`  ${chalk.red("✗")} ${chalk.bold(key)}: ${chalk.red(reason ?? "failed")}`);
+                }
+            }
+            console.log();
+            if (failed.length > 0) {
+                console.log(chalk.red(`✗ ${failed.length} field(s) failed verification`) +
+                    chalk.dim(`, ${passed.length} passed`));
+                process.exit(1);
+            }
+            else if (passed.length === 0) {
+                console.log(chalk.dim("No encrypted values found in .env to verify."));
+            }
+            else {
+                console.log(chalk.green(`✓ All ${passed.length} encrypted field(s) verified successfully`));
+            }
+        }
+        catch (error) {
+            spinner.stop();
+            if (error instanceof EncryptionKeyMissingError) {
+                console.error(chalk.red(`\n✗ ${error.message}`));
+                process.exit(1);
+            }
+            console.error(chalk.red("Unexpected error:"), error);
+            process.exit(2);
+        }
+    });
+}

package/dist/cli/index.js

@@ -11,6 +11,12 @@ import typesCommand from "./commands/types.js";
 import initCommand from "./commands/init.js";
 import fixCommand from "./commands/fix.js";
 import docsCommand from "./commands/docs.js";
+import keygenCommand from "./commands/keygen.js";
+import encryptCommand from "./commands/encrypt.js";
+import decryptCommand from "./commands/decrypt.js";
+import statusCommand from "./commands/status.js";
+import verifyCommand from "./commands/verify.js";
+import rotateCommand from "./commands/rotate.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(join(__dirname, "../../package.json"), "utf-8"));
 export function createCLI() {
@@ -31,6 +37,12 @@ export function createCLI() {
         initCommand,
         fixCommand,
         docsCommand,
+        keygenCommand,
+        encryptCommand,
+        decryptCommand,
+        statusCommand,
+        verifyCommand,
+        rotateCommand,
     ];
     commands.forEach((command) => {
         const cmd = command(program);