Prepare 0.1.0: one dotenv grammar, path policy, redactor, and safer writes

- parseDotenv, validate, and every edit share the round-trip document parser
- Path policy helpers (isEnvFile, isSensitiveEnvFile, isEnvSitterPepperFile) used by envsitter-guard
- CLI file commands run through the library file operations
- EnvSitter#redactor() and the redact command replace secret-looking values in text
- Writes keep file permissions and go through symlinks; new files are 0600
- An existing pepper is never replaced; a new .envsitter/ gets a .gitignore
- set/add/copy into empty files write clean output
- Regexes with g/y flags no longer skip keys
- TypeScript 6, Node 22+ engines, prepack build, dist/test excluded from the package

src/test/paths.test.ts

@@ -0,0 +1,34 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import { isEnvFile, isEnvSitterPepperFile, isExampleEnvFile, isSensitiveEnvFile } from '../index.js';
+
+test('isEnvFile recognizes dotenv file names in any directory', () => {
+  for (const name of ['.env', '.env.local', '.env.production.local', 'api.env', 'config.env.local', 'nested/dir/.env', 'C:\\app\\.env.keys', '.ENV']) {
+    assert.equal(isEnvFile(name), true, name);
+  }
+
+  for (const name of ['env', '.envrc', 'environment.ts', 'src/env.ts', 'app.env.ts', '.env.d.ts', 'vite-env.d.ts', 'README.md', '.envsitter/pepper']) {
+    assert.equal(isEnvFile(name), false, name);
+  }
+});
+
+test('isSensitiveEnvFile excludes example and template files', () => {
+  for (const name of ['.env', '.env.local', 'api.env', '.env.example.local', 'deploy/.env.production']) {
+    assert.equal(isSensitiveEnvFile(name), true, name);
+  }
+
+  for (const name of ['.env.example', '.env.sample', '.env.template', '.env.dist', '.env.default', '.env.defaults', 'api.env.example', 'src/index.ts']) {
+    assert.equal(isSensitiveEnvFile(name), false, name);
+  }
+
+  assert.equal(isExampleEnvFile('api.env.sample'), true);
+});
+
+test('isEnvSitterPepperFile matches the default pepper location only', () => {
+  assert.equal(isEnvSitterPepperFile('.envsitter/pepper'), true);
+  assert.equal(isEnvSitterPepperFile('/repo/.envsitter/pepper'), true);
+  assert.equal(isEnvSitterPepperFile('C:\\repo\\.envsitter\\pepper'), true);
+  assert.equal(isEnvSitterPepperFile('.envsitter/pepper.bak'), false);
+  assert.equal(isEnvSitterPepperFile('pepper'), false);
+});