@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/commands.js

@@ -0,0 +1,2012 @@
+"use strict";
+/**
+ * Additional CLI commands for Lattice
+ * These extend the core functionality with quality-of-life improvements
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateProjectSetup = validateProjectSetup;
+exports.configShow = configShow;
+exports.rulesExplain = rulesExplain;
+exports.diff = diff;
+exports.ci = ci;
+exports.completions = completions;
+exports.detectProjectType = detectProjectType;
+exports.doctorFix = doctorFix;
+exports.securityScan = securityScan;
+exports.loadAllowlist = loadAllowlist;
+exports.addToAllowlist = addToAllowlist;
+exports.generateSarifReport = generateSarifReport;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const child_process_1 = require("child_process");
+// ============================================================================
+// PACKAGE.JSON VALIDATION - Check if project is properly initialized
+// ============================================================================
+async function validateProjectSetup(cwd) {
+    const packageJsonPath = (0, path_1.join)(cwd, 'package.json');
+    try {
+        await fs_1.promises.access(packageJsonPath);
+        // Check if it's a valid JSON
+        try {
+            const content = await fs_1.promises.readFile(packageJsonPath, 'utf-8');
+            JSON.parse(content);
+            return { valid: true };
+        }
+        catch {
+            return {
+                valid: false,
+                error: 'package.json exists but is not valid JSON',
+                suggestion: 'Fix the JSON syntax in package.json',
+            };
+        }
+    }
+    catch {
+        return {
+            valid: false,
+            error: 'package.json not found',
+            suggestion: getProjectSetupSuggestion(cwd),
+        };
+    }
+}
+function getProjectSetupSuggestion(cwd) {
+    return `
+Lattice requires an existing project. To fix this:
+
+Option 1 - Initialize a new Next.js project:
+  npx create-next-app@latest . --typescript --tailwind --app
+
+Option 2 - Initialize a new Expo project:
+  npx create-expo-app@latest . --template blank-typescript
+
+Option 3 - Initialize a basic Node project:
+  npm init -y
+
+Then run 'npx latticeai' to add Lattice to your project.
+
+Note: Lattice adds guardrails and verification to existing projects.
+It does not create the base project structure.
+`;
+}
+async function configShow(options = {}) {
+    const cwd = options.cwd || process.cwd();
+    const configPath = (0, path_1.join)(cwd, '.lattice', 'config.json');
+    try {
+        const configContent = await fs_1.promises.readFile(configPath, 'utf-8');
+        const config = JSON.parse(configContent);
+        if (options.json) {
+            console.log(JSON.stringify(config, null, 2));
+            return;
+        }
+        console.log('\n📋 Lattice Configuration\n');
+        console.log('─'.repeat(50));
+        console.log(`  📁 Config file: .lattice/config.json`);
+        console.log('─'.repeat(50));
+        console.log('');
+        console.log('  Project Type:     ' + formatValue(config.projectType));
+        console.log('  Strictness:       ' + formatValue(config.strictnessPreset));
+        if (config.integrations) {
+            console.log('');
+            console.log('  Integrations:');
+            for (const [key, value] of Object.entries(config.integrations)) {
+                console.log(`    • ${key}: ${formatValue(value)}`);
+            }
+        }
+        // Show manifest info if available
+        const manifestPath = (0, path_1.join)(cwd, '.lattice', 'manifest.json');
+        try {
+            const manifestContent = await fs_1.promises.readFile(manifestPath, 'utf-8');
+            const manifest = JSON.parse(manifestContent);
+            console.log('');
+            console.log('  Manifest:');
+            console.log(`    • Generator:    v${manifest.generatorVersion || 'unknown'}`);
+            console.log(`    • Generated:    ${manifest.timestamp ? new Date(manifest.timestamp).toLocaleString() : 'unknown'}`);
+            console.log(`    • Files:        ${manifest.files?.length || 0}`);
+        }
+        catch {
+            // No manifest
+        }
+        // Show compliance info if available
+        const compliancePath = (0, path_1.join)(cwd, '.lattice', 'compliance.json');
+        try {
+            const complianceContent = await fs_1.promises.readFile(compliancePath, 'utf-8');
+            const compliance = JSON.parse(complianceContent);
+            const lastRun = compliance.history?.[0];
+            if (lastRun) {
+                console.log('');
+                console.log('  Last Verify:');
+                console.log(`    • Status:       ${lastRun.passed ? '✓ Passed' : '✗ Failed'}`);
+                console.log(`    • Time:         ${new Date(lastRun.timestamp).toLocaleString()}`);
+                console.log(`    • Checks:       ${lastRun.checksRun?.join(', ') || 'unknown'}`);
+            }
+        }
+        catch {
+            // No compliance
+        }
+        console.log('');
+        console.log('─'.repeat(50));
+        console.log('  Run: lattice config show --json  for raw output');
+        console.log('─'.repeat(50));
+        console.log('');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            console.log('\n✗ No Lattice configuration found.');
+            console.log('  Run: npx latticeai  to set up Lattice\n');
+            return;
+        }
+        throw error;
+    }
+}
+function formatValue(value) {
+    if (value === null || value === undefined)
+        return '(not set)';
+    if (typeof value === 'boolean')
+        return value ? 'yes' : 'no';
+    if (typeof value === 'object')
+        return JSON.stringify(value);
+    return String(value);
+}
+async function rulesExplain(options = {}) {
+    const cwd = options.cwd || process.cwd();
+    const rulesPath = (0, path_1.join)(cwd, '.cursor', 'rules.md');
+    try {
+        const rulesContent = await fs_1.promises.readFile(rulesPath, 'utf-8');
+        console.log('\n📖 Lattice Rules Explanation\n');
+        console.log('─'.repeat(60));
+        console.log('');
+        console.log('Lattice generates shared agent instructions for Cursor, Codex, and Claude.');
+        console.log('The legacy compatibility file at .cursor/rules.md contains:');
+        console.log('');
+        // Analyze the rules content
+        const sections = [];
+        if (rulesContent.includes('Version Protocol')) {
+            sections.push('📦 Version Protocol - Ensures AI uses correct package versions');
+        }
+        if (rulesContent.includes('Project Type')) {
+            sections.push('🏗️  Project Type - Specifies framework (Next.js, Expo, etc.)');
+        }
+        if (rulesContent.includes('Verification') || rulesContent.includes('verify')) {
+            sections.push('✓  Verification Rules - How to check code quality');
+        }
+        if (rulesContent.includes('CI') || rulesContent.includes('Continuous Integration')) {
+            sections.push('🔄 CI Enforcement - GitHub Actions workflow requirements');
+        }
+        if (rulesContent.includes('Architecture') || rulesContent.includes('directory structure')) {
+            sections.push('📁 Architecture - Directory structure and patterns');
+        }
+        if (sections.length > 0) {
+            console.log('Detected sections:');
+            for (const section of sections) {
+                console.log(`  ${section}`);
+            }
+        }
+        console.log('');
+        console.log('─'.repeat(60));
+        console.log('');
+        // Show stats
+        const lines = rulesContent.split('\n').length;
+        const headers = (rulesContent.match(/^#+\s/gm) || []).length;
+        const codeBlocks = (rulesContent.match(/```/g) || []).length / 2;
+        console.log('📊 Stats:');
+        console.log(`   Lines: ${lines}`);
+        console.log(`   Sections: ${headers}`);
+        console.log(`   Code blocks: ${Math.floor(codeBlocks)}`);
+        console.log('');
+        // Extract the LATTICE markers
+        const latticeMatch = rulesContent.match(/\x3c!-- LATTICE:START v([\d.]+)/);
+        if (latticeMatch) {
+            console.log(`🔖 Lattice version: ${latticeMatch[1]}`);
+        }
+        console.log('');
+        console.log('─'.repeat(60));
+        console.log('  View files: .cursor/rules.md, .cursor/rules/lattice-core.mdc, AGENTS.md');
+        console.log('  Regenerate: npx latticeai update');
+        console.log('─'.repeat(60));
+        console.log('');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            console.log('\n✗ No Lattice rules file found at .cursor/rules.md');
+            console.log('  Run: npx latticeai  to generate rules, AGENTS.md, and Claude settings\n');
+            return;
+        }
+        throw error;
+    }
+}
+async function diff(options = {}) {
+    const cwd = options.cwd || process.cwd();
+    const manifestPath = (0, path_1.join)(cwd, '.lattice', 'manifest.json');
+    try {
+        const manifestContent = await fs_1.promises.readFile(manifestPath, 'utf-8');
+        const manifest = JSON.parse(manifestContent);
+        const trackedFiles = manifest.files || [];
+        if (options.json) {
+            const changes = await computeChanges(cwd, trackedFiles);
+            console.log(JSON.stringify(changes, null, 2));
+            return;
+        }
+        console.log('\n📊 Lattice Diff\n');
+        console.log('Changes since last generation:\n');
+        const changes = await computeChanges(cwd, trackedFiles);
+        if (changes.modified.length === 0 && changes.deleted.length === 0 && changes.added.length === 0) {
+            console.log('  ✓ No changes detected\n');
+            return;
+        }
+        if (changes.modified.length > 0) {
+            console.log('  Modified:');
+            for (const file of changes.modified) {
+                console.log(`    • ${file}`);
+            }
+            console.log('');
+        }
+        if (changes.deleted.length > 0) {
+            console.log('  Deleted:');
+            for (const file of changes.deleted) {
+                console.log(`    ✗ ${file}`);
+            }
+            console.log('');
+        }
+        if (changes.added.length > 0) {
+            console.log('  New (untracked by Lattice):');
+            for (const file of changes.added.slice(0, 10)) {
+                console.log(`    + ${file}`);
+            }
+            if (changes.added.length > 10) {
+                console.log(`    ... and ${changes.added.length - 10} more`);
+            }
+            console.log('');
+        }
+        console.log('─'.repeat(50));
+        console.log('  Run: npx latticeai update  to regenerate rules');
+        console.log('─'.repeat(50));
+        console.log('');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            console.log('\n✗ No Lattice manifest found.');
+            console.log('  Run: npx latticeai  to set up Lattice\n');
+            return;
+        }
+        throw error;
+    }
+}
+async function computeChanges(cwd, trackedFiles) {
+    const changes = {
+        modified: [],
+        deleted: [],
+        added: [],
+    };
+    for (const file of trackedFiles) {
+        const fullPath = (0, path_1.join)(cwd, file.path);
+        try {
+            await fs_1.promises.access(fullPath);
+            // File exists - could check hash for modification
+            // For now, we just check existence
+        }
+        catch {
+            changes.deleted.push(file.path);
+        }
+    }
+    // Check for new config files in .lattice or .cursor
+    const latticeDir = (0, path_1.join)(cwd, '.lattice');
+    const cursorDir = (0, path_1.join)(cwd, '.cursor');
+    try {
+        const latticeFiles = await fs_1.promises.readdir(latticeDir);
+        for (const file of latticeFiles) {
+            const relativePath = `.lattice/${file}`;
+            if (!trackedFiles.some((f) => f.path === relativePath)) {
+                changes.added.push(relativePath);
+            }
+        }
+    }
+    catch {
+        // Directory doesn't exist
+    }
+    try {
+        const cursorFiles = await fs_1.promises.readdir(cursorDir);
+        for (const file of cursorFiles) {
+            const relativePath = `.cursor/${file}`;
+            if (!trackedFiles.some((f) => f.path === relativePath)) {
+                changes.added.push(relativePath);
+            }
+        }
+    }
+    catch {
+        // Directory doesn't exist
+    }
+    return changes;
+}
+async function ci(options = {}) {
+    const cwd = options.cwd || process.cwd();
+    const provider = options.provider || 'github';
+    // Read config to determine project type
+    let projectType = 'nextjs';
+    try {
+        const configPath = (0, path_1.join)(cwd, '.lattice', 'config.json');
+        const configContent = await fs_1.promises.readFile(configPath, 'utf-8');
+        const config = JSON.parse(configContent);
+        projectType = config.projectType || 'nextjs';
+    }
+    catch {
+        // Use default
+    }
+    const isExpo = projectType === 'expo-eas';
+    let workflow;
+    if (provider === 'github') {
+        workflow = generateGitHubWorkflow(isExpo);
+        const outputPath = (0, path_1.join)(cwd, '.github', 'workflows', 'ci.yml');
+        if (options.dryRun) {
+            console.log('\n📄 Generated GitHub Actions Workflow:\n');
+            console.log(workflow);
+            console.log(`\nWould write to: ${outputPath}`);
+            return;
+        }
+        await fs_1.promises.mkdir((0, path_1.dirname)(outputPath), { recursive: true });
+        await fs_1.promises.writeFile(outputPath, workflow);
+        console.log(`\n✓ Generated: ${outputPath}\n`);
+    }
+    else {
+        workflow = generateGitLabCI(isExpo);
+        const outputPath = (0, path_1.join)(cwd, '.gitlab-ci.yml');
+        if (options.dryRun) {
+            console.log('\n📄 Generated GitLab CI:\n');
+            console.log(workflow);
+            console.log(`\nWould write to: ${outputPath}`);
+            return;
+        }
+        await fs_1.promises.writeFile(outputPath, workflow);
+        console.log(`\n✓ Generated: ${outputPath}\n`);
+    }
+}
+function generateGitHubWorkflow(isExpo) {
+    const buildStep = isExpo
+        ? ''
+        : `
+      - name: Build
+        run: npm run build`;
+    return `name: CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      
+      - name: Setup Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: '24.22.0'
+          cache: 'npm'
+      
+      - name: Install dependencies
+        run: npm ci
+      
+      - name: Lint
+        run: npm run lint
+      
+      - name: Typecheck
+        run: npm run typecheck
+      
+      - name: Test
+        run: npm run test
+${buildStep}
+`;
+}
+function generateGitLabCI(isExpo) {
+    const buildJob = isExpo
+        ? ''
+        : `
+build:
+  stage: build
+  script:
+    - npm run build
+`;
+    return `image: node:24.22.0
+
+stages:
+  - verify
+  - build
+
+cache:
+  paths:
+    - node_modules/
+
+before_script:
+  - npm ci
+
+lint:
+  stage: verify
+  script:
+    - npm run lint
+
+typecheck:
+  stage: verify
+  script:
+    - npm run typecheck
+
+test:
+  stage: verify
+  script:
+    - npm run test
+${buildJob}`;
+}
+function completions(shell) {
+    switch (shell) {
+        case 'bash':
+            console.log(generateBashCompletions());
+            break;
+        case 'zsh':
+            console.log(generateZshCompletions());
+            break;
+        case 'fish':
+            console.log(generateFishCompletions());
+            break;
+        case 'powershell':
+            console.log(generatePowerShellCompletions());
+            break;
+        default:
+            console.error(`Unknown shell: ${shell}`);
+            console.error('Supported: bash, zsh, fish, powershell');
+    }
+}
+function generateBashCompletions() {
+    return `# Lattice CLI bash completions
+# Add to ~/.bashrc: eval "$(lattice completions bash)"
+
+_lattice_completions() {
+    local cur="\${COMP_WORDS[COMP_CWORD]}"
+    local commands="init generate apply verify verify-rules doctor status drift progress bundle check update setup login logout whoami create config rules ci security-scan scan completions help"
+    
+    if [ "\${COMP_CWORD}" -eq 1 ]; then
+        COMPREPLY=( $(compgen -W "\${commands}" -- "\${cur}") )
+    elif [ "\${COMP_WORDS[1]}" = "bundle" ]; then
+        COMPREPLY=( $(compgen -W "update diff rollback" -- "\${cur}") )
+    elif [ "\${COMP_WORDS[1]}" = "config" ]; then
+        COMPREPLY=( $(compgen -W "show" -- "\${cur}") )
+    elif [ "\${COMP_WORDS[1]}" = "rules" ]; then
+        COMPREPLY=( $(compgen -W "explain" -- "\${cur}") )
+    elif [ "\${COMP_WORDS[1]}" = "completions" ]; then
+        COMPREPLY=( $(compgen -W "bash zsh fish powershell" -- "\${cur}") )
+    fi
+}
+
+complete -F _lattice_completions lattice
+complete -F _lattice_completions latticeai
+`;
+}
+function generateZshCompletions() {
+    return `#compdef lattice latticeai
+# Lattice CLI zsh completions
+# Add to ~/.zshrc: eval "$(lattice completions zsh)"
+
+_lattice() {
+    local commands=(
+        'init:Initialize Lattice configuration'
+        'generate:Generate the Lattice pack'
+        'apply:Apply pack to project'
+        'verify:Run verification checks'
+        'verify-rules:Verify rules file'
+        'doctor:Check environment'
+        'status:Show current status'
+        'drift:Detect configuration drift'
+        'progress:Show PROJECT_GUIDE.md progress'
+        'bundle:Manage bundles'
+        'check:Check for updates'
+        'update:Update Lattice rules'
+        'setup:Interactive setup'
+        'login:Authenticate with Lattice'
+        'logout:Remove credentials'
+        'whoami:Show login status'
+        'create:Create project from Architect'
+        'config:Configuration commands'
+        'rules:Rules commands'
+        'ci:Generate CI workflow'
+        'diff:Show changes since generation'
+        'security-scan:Scan for exposed secrets'
+        'scan:Scan for exposed secrets (alias)'
+        'completions:Generate shell completions'
+        'help:Show help'
+    )
+
+    _describe 'command' commands
+}
+
+compdef _lattice lattice
+compdef _lattice latticeai
+`;
+}
+function generateFishCompletions() {
+    return `# Lattice CLI fish completions
+# Add to ~/.config/fish/completions/lattice.fish
+
+complete -c lattice -f
+complete -c latticeai -f
+
+complete -c lattice -n "not __fish_seen_subcommand_from init generate apply verify verify-rules doctor status drift progress bundle check update setup login logout whoami create config rules ci diff completions help" -a init -d "Initialize Lattice"
+complete -c lattice -n "not __fish_seen_subcommand_from init generate apply verify verify-rules doctor status drift progress bundle check update setup login logout whoami create config rules ci diff completions help" -a generate -d "Generate pack"
+complete -c lattice -n "not __fish_seen_subcommand_from init generate apply verify verify-rules doctor status drift progress bundle check update setup login logout whoami create config rules ci diff completions help" -a apply -d "Apply pack"
+complete -c lattice -n "not __fish_seen_subcommand_from init generate apply verify verify-rules doctor status drift progress bundle check update setup login logout whoami create config rules ci diff completions help" -a verify -d "Run checks"
+complete -c lattice -n "not __fish_seen_subcommand_from init generate apply verify verify-rules doctor status drift progress bundle check update setup login logout whoami create config rules ci diff completions help" -a doctor -d "Check environment"
+complete -c lattice -n "not __fish_seen_subcommand_from init generate apply verify verify-rules doctor status drift progress bundle check update setup login logout whoami create config rules ci diff completions help" -a status -d "Show status"
+complete -c lattice -n "not __fish_seen_subcommand_from init generate apply verify verify-rules doctor status drift progress bundle check update setup login logout whoami create config rules ci diff completions help" -a login -d "Authenticate"
+complete -c lattice -n "not __fish_seen_subcommand_from init generate apply verify verify-rules doctor status drift progress bundle check update setup login logout whoami create config rules ci diff completions help" -a create -d "Create from Architect"
+complete -c lattice -n "not __fish_seen_subcommand_from init generate apply verify verify-rules doctor status drift progress bundle check update setup login logout whoami create config rules ci diff completions help" -a config -d "Config commands"
+complete -c lattice -n "not __fish_seen_subcommand_from init generate apply verify verify-rules doctor status drift progress bundle check update setup login logout whoami create config rules ci diff security-scan scan completions help" -a ci -d "Generate CI"
+complete -c lattice -n "not __fish_seen_subcommand_from init generate apply verify verify-rules doctor status drift progress bundle check update setup login logout whoami create config rules ci diff security-scan scan completions help" -a security-scan -d "Scan for exposed secrets"
+complete -c lattice -n "not __fish_seen_subcommand_from init generate apply verify verify-rules doctor status drift progress bundle check update setup login logout whoami create config rules ci diff security-scan scan completions help" -a scan -d "Scan for exposed secrets (alias)"
+complete -c lattice -n "not __fish_seen_subcommand_from init generate apply verify verify-rules doctor status drift progress bundle check update setup login logout whoami create config rules ci diff security-scan scan completions help" -a completions -d "Shell completions"
+complete -c lattice -n "not __fish_seen_subcommand_from init generate apply verify verify-rules doctor status drift progress bundle check update setup login logout whoami create config rules ci diff security-scan scan completions help" -a help -d "Show help"
+
+complete -c lattice -n "__fish_seen_subcommand_from bundle" -a "update diff rollback"
+complete -c lattice -n "__fish_seen_subcommand_from config" -a "show"
+complete -c lattice -n "__fish_seen_subcommand_from rules" -a "explain"
+complete -c lattice -n "__fish_seen_subcommand_from completions" -a "bash zsh fish powershell"
+
+# Copy for latticeai alias
+complete -c latticeai -w lattice
+`;
+}
+function generatePowerShellCompletions() {
+    return `# Lattice CLI PowerShell completions
+# Add to $PROFILE: Invoke-Expression (lattice completions powershell | Out-String)
+
+$scriptblock = {
+    param($wordToComplete, $commandAst, $cursorPosition)
+
+    $commands = @(
+        @{ Name = 'init'; Description = 'Initialize Lattice configuration' }
+        @{ Name = 'generate'; Description = 'Generate the Lattice pack' }
+        @{ Name = 'apply'; Description = 'Apply pack to project' }
+        @{ Name = 'verify'; Description = 'Run verification checks' }
+        @{ Name = 'verify-rules'; Description = 'Verify rules file' }
+        @{ Name = 'doctor'; Description = 'Check environment' }
+        @{ Name = 'status'; Description = 'Show current status' }
+        @{ Name = 'drift'; Description = 'Detect configuration drift' }
+        @{ Name = 'progress'; Description = 'Show PROJECT_GUIDE.md progress' }
+        @{ Name = 'bundle'; Description = 'Manage bundles' }
+        @{ Name = 'check'; Description = 'Check for updates' }
+        @{ Name = 'update'; Description = 'Update Lattice rules' }
+        @{ Name = 'setup'; Description = 'Interactive setup' }
+        @{ Name = 'login'; Description = 'Authenticate with Lattice' }
+        @{ Name = 'logout'; Description = 'Remove credentials' }
+        @{ Name = 'whoami'; Description = 'Show login status' }
+        @{ Name = 'create'; Description = 'Create project from Architect' }
+        @{ Name = 'config'; Description = 'Configuration commands' }
+        @{ Name = 'rules'; Description = 'Rules commands' }
+        @{ Name = 'ci'; Description = 'Generate CI workflow' }
+        @{ Name = 'diff'; Description = 'Show changes since generation' }
+        @{ Name = 'security-scan'; Description = 'Scan for exposed secrets' }
+        @{ Name = 'scan'; Description = 'Scan for exposed secrets (alias)' }
+        @{ Name = 'completions'; Description = 'Generate shell completions' }
+        @{ Name = 'help'; Description = 'Show help' }
+    )
+
+    $commands | Where-Object { $_.Name -like "$wordToComplete*" } | ForEach-Object {
+        [System.Management.Automation.CompletionResult]::new($_.Name, $_.Name, 'ParameterValue', $_.Description)
+    }
+}
+
+Register-ArgumentCompleter -Native -CommandName lattice -ScriptBlock $scriptblock
+Register-ArgumentCompleter -Native -CommandName latticeai -ScriptBlock $scriptblock
+`;
+}
+// ============================================================================
+// DETECT PROJECT TYPE
+// ============================================================================
+async function detectProjectType(cwd) {
+    const packageJsonPath = (0, path_1.join)(cwd, 'package.json');
+    try {
+        const packageContent = await fs_1.promises.readFile(packageJsonPath, 'utf-8');
+        const pkg = JSON.parse(packageContent);
+        const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+        // Check for Next.js
+        if (deps['next']) {
+            return {
+                projectType: 'nextjs',
+                confidence: 'high',
+                reason: 'Found "next" in dependencies',
+            };
+        }
+        // Check for Expo
+        if (deps['expo']) {
+            return {
+                projectType: 'expo-eas',
+                confidence: 'high',
+                reason: 'Found "expo" in dependencies',
+            };
+        }
+        // Check for React Native without Expo
+        if (deps['react-native'] && !deps['expo']) {
+            return {
+                projectType: 'expo-eas',
+                confidence: 'medium',
+                reason: 'Found "react-native" (assuming Expo)',
+            };
+        }
+        // Check for other React frameworks
+        if (deps['react']) {
+            return {
+                projectType: 'nextjs',
+                confidence: 'low',
+                reason: 'Found "react" but no framework - assuming Next.js',
+            };
+        }
+        return {
+            projectType: null,
+            confidence: 'low',
+            reason: 'Could not detect project type from dependencies',
+        };
+    }
+    catch {
+        return {
+            projectType: null,
+            confidence: 'low',
+            reason: 'No package.json found',
+        };
+    }
+}
+async function doctorFix(options = {}) {
+    const cwd = options.cwd || process.cwd();
+    const results = [];
+    // 1. Check for missing required scripts in package.json
+    const packageJsonPath = (0, path_1.join)(cwd, 'package.json');
+    try {
+        const packageContent = await fs_1.promises.readFile(packageJsonPath, 'utf-8');
+        const pkg = JSON.parse(packageContent);
+        const scripts = pkg.scripts || {};
+        const requiredScripts = ['lint', 'typecheck', 'test', 'build'];
+        let modified = false;
+        for (const script of requiredScripts) {
+            if (!scripts[script]) {
+                const defaultScript = getDefaultScript(script, pkg);
+                if (!options.dryRun) {
+                    pkg.scripts = pkg.scripts || {};
+                    pkg.scripts[script] = defaultScript;
+                    modified = true;
+                }
+                results.push({
+                    issue: `Missing script: ${script}`,
+                    fixed: !options.dryRun,
+                    action: `Added "${script}": "${defaultScript}"`,
+                });
+            }
+        }
+        if (modified && !options.dryRun) {
+            await fs_1.promises.writeFile(packageJsonPath, JSON.stringify(pkg, null, 2) + '\n');
+        }
+    }
+    catch {
+        results.push({
+            issue: 'No package.json found',
+            fixed: false,
+            action: 'Create package.json manually',
+        });
+    }
+    // 2. Check for .gitignore
+    const gitignorePath = (0, path_1.join)(cwd, '.gitignore');
+    try {
+        await fs_1.promises.access(gitignorePath);
+    }
+    catch {
+        if (!options.dryRun) {
+            const defaultGitignore = `node_modules/
+.next/
+dist/
+.env.local
+.env*.local
+*.log
+.DS_Store
+`;
+            await fs_1.promises.writeFile(gitignorePath, defaultGitignore);
+        }
+        results.push({
+            issue: 'Missing .gitignore',
+            fixed: !options.dryRun,
+            action: 'Created default .gitignore',
+        });
+    }
+    // 3. Check for tsconfig.json if TypeScript is installed
+    try {
+        const packageContent = await fs_1.promises.readFile(packageJsonPath, 'utf-8');
+        const pkg = JSON.parse(packageContent);
+        const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+        if (deps['typescript']) {
+            const tsconfigPath = (0, path_1.join)(cwd, 'tsconfig.json');
+            try {
+                await fs_1.promises.access(tsconfigPath);
+            }
+            catch {
+                results.push({
+                    issue: 'TypeScript installed but no tsconfig.json',
+                    fixed: false,
+                    action: 'Run: npx tsc --init',
+                });
+            }
+        }
+    }
+    catch {
+        // No package.json
+    }
+    return results;
+}
+function getDefaultScript(name, pkg) {
+    const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
+    const isNext = !!deps['next'];
+    const isExpo = !!deps['expo'];
+    switch (name) {
+        case 'lint':
+            return 'eslint . --ext .ts,.tsx,.js,.jsx';
+        case 'typecheck':
+            return 'tsc --noEmit';
+        case 'test':
+            if (deps['jest'])
+                return 'jest --passWithNoTests';
+            if (deps['vitest'])
+                return 'vitest run';
+            return 'echo "No tests configured" && exit 0';
+        case 'build':
+            if (isNext)
+                return 'next build';
+            if (isExpo)
+                return 'expo prebuild';
+            return 'tsc';
+        default:
+            return `echo "TODO: add ${name} script"`;
+    }
+}
+// Common secret patterns
+const SECRET_PATTERNS = [
+    // Generic API Keys - catch various naming patterns
+    {
+        name: 'API Key',
+        pattern: /(?:api[_-]?key|apikey|api[_-]?token|api[_-]?secret)\s*[:=]\s*['"]([a-zA-Z0-9_\-+/=]{20,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'API_KEY',
+    },
+    // API Key in camelCase/PascalCase
+    {
+        name: 'API Key',
+        pattern: /(?:apiKey|apiToken|apiSecret|ApiKey|ApiToken|ApiSecret)\s*[:=]\s*['"]([a-zA-Z0-9_\-+/=]{20,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'API_KEY',
+    },
+    // Environment variable style API keys (ALL_CAPS format)
+    {
+        name: 'API Key (Env Var Format)',
+        pattern: /([A-Z][A-Z0-9_]*API[_-]?KEY|[A-Z][A-Z0-9_]*API[_-]?TOKEN)\s*[:=]\s*['"]([a-zA-Z0-9_\-+/=]{20,})['"]/g,
+        severity: 'critical',
+        envVarName: (match) => {
+            // match[1] is the variable name, match[2] is the value
+            if (match && match[1]) {
+                return match[1];
+            }
+            return 'API_KEY';
+        },
+    },
+    // Generic secret/token patterns (catch-all for unknown services)
+    {
+        name: 'Secret/Token',
+        pattern: /(?:secret|token|auth[_-]?token|access[_-]?token)\s*[:=]\s*['"]([a-zA-Z0-9_\-+/=]{32,})['"]/gi,
+        severity: 'high',
+        envVarName: (match) => {
+            const varName = match[0].match(/(\w+)\s*[:=]/)?.[1]?.toUpperCase().replace(/[_-]/g, '_') || 'SECRET';
+            return varName;
+        },
+    },
+    // AI/ML Service API Keys
+    {
+        name: 'Anthropic API Key',
+        pattern: /(?:anthropic[_-]?api[_-]?key|ANTHROPIC_API_KEY)\s*[:=]\s*['"](sk-ant-[a-zA-Z0-9\-_]{95,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'ANTHROPIC_API_KEY',
+    },
+    {
+        name: 'OpenAI API Key',
+        pattern: /(?:openai[_-]?api[_-]?key|OPENAI_API_KEY)\s*[:=]\s*['"](sk-[a-zA-Z0-9]{32,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'OPENAI_API_KEY',
+    },
+    {
+        name: 'Replicate API Token',
+        pattern: /(?:replicate[_-]?api[_-]?token|REPLICATE_API_TOKEN)\s*[:=]\s*['"](r8_[a-zA-Z0-9\-_]{37,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'REPLICATE_API_TOKEN',
+    },
+    {
+        name: 'Google Gemini API Key',
+        pattern: /(?:google[_-]?gemini[_-]?api[_-]?key|GOOGLE_GEMINI_API_KEY|gemini[_-]?api[_-]?key)\s*[:=]\s*['"](AIza[0-9A-Za-z\-_]{35})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'GOOGLE_GEMINI_API_KEY',
+    },
+    {
+        name: 'Google API Key',
+        pattern: /(?:google[_-]?api[_-]?key|GOOGLE_API_KEY)\s*[:=]\s*['"](AIza[0-9A-Za-z\-_]{35})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'GOOGLE_API_KEY',
+    },
+    {
+        name: 'Cohere API Key',
+        pattern: /(?:cohere[_-]?api[_-]?key|COHERE_API_KEY)\s*[:=]\s*['"]([a-zA-Z0-9\-_]{40,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'COHERE_API_KEY',
+    },
+    {
+        name: 'Hugging Face Token',
+        pattern: /(?:huggingface[_-]?token|hf[_-]?token|HUGGINGFACE_TOKEN)\s*[:=]\s*['"](hf_[a-zA-Z0-9\-_]{37,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'HUGGINGFACE_TOKEN',
+    },
+    {
+        name: 'Together AI API Key',
+        pattern: /(?:together[_-]?ai[_-]?api[_-]?key|TOGETHER_API_KEY)\s*[:=]\s*['"]([a-zA-Z0-9\-_]{40,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'TOGETHER_API_KEY',
+    },
+    {
+        name: 'Groq API Key',
+        pattern: /(?:groq[_-]?api[_-]?key|GROQ_API_KEY)\s*[:=]\s*['"](gsk_[a-zA-Z0-9\-_]{48,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'GROQ_API_KEY',
+    },
+    {
+        name: 'Perplexity API Key',
+        pattern: /(?:perplexity[_-]?api[_-]?key|PERPLEXITY_API_KEY)\s*[:=]\s*['"](pplx-[a-zA-Z0-9\-_]{40,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'PERPLEXITY_API_KEY',
+    },
+    {
+        name: 'AWS Access Key',
+        pattern: /(?:aws[_-]?access[_-]?key[_-]?id|aws_access_key)\s*[:=]\s*['"](AKIA[0-9A-Z]{16})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'AWS_ACCESS_KEY_ID',
+    },
+    {
+        name: 'AWS Secret Key',
+        pattern: /(?:aws[_-]?secret[_-]?access[_-]?key|aws_secret_key)\s*[:=]\s*['"]([a-zA-Z0-9/+=]{40})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'AWS_SECRET_ACCESS_KEY',
+    },
+    {
+        name: 'GitHub Token',
+        pattern: /(?:github[_-]?token|gh_token|ghp_)\s*[:=]\s*['"](ghp_[a-zA-Z0-9]{36})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'GITHUB_TOKEN',
+    },
+    {
+        name: 'Stripe Key',
+        pattern: /(?:stripe[_-]?(?:secret|private)[_-]?key|sk_live_)\s*[:=]\s*['"](sk_(live|test)_[a-zA-Z0-9]{24,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'STRIPE_SECRET_KEY',
+    },
+    {
+        name: 'Stripe Publishable Key',
+        pattern: /(?:stripe[_-]?publishable[_-]?key|pk_live_)\s*[:=]\s*['"](pk_(live|test)_[a-zA-Z0-9]{24,})['"]/gi,
+        severity: 'high',
+        envVarName: () => 'STRIPE_PUBLISHABLE_KEY',
+    },
+    {
+        name: 'JWT Secret',
+        pattern: /(?:jwt[_-]?secret|jwt_secret)\s*[:=]\s*['"]([a-zA-Z0-9_\-]{32,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'JWT_SECRET',
+    },
+    {
+        name: 'Database Password',
+        pattern: /(?:db[_-]?password|database[_-]?password|password)\s*[:=]\s*['"]([^'"]{8,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'DB_PASSWORD',
+    },
+    {
+        name: 'MongoDB Connection String',
+        pattern: /(?:mongodb[_-]?uri|mongo[_-]?connection)\s*[:=]\s*['"](mongodb(?:\+srv)?:\/\/[^'"]+)['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'MONGODB_URI',
+    },
+    {
+        name: 'PostgreSQL Connection String',
+        pattern: /(?:postgres[_-]?uri|postgresql[_-]?connection|DATABASE_URL)\s*[:=]\s*['"](postgres(?:ql)?:\/\/[^'"]+)['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'DATABASE_URL',
+    },
+    {
+        name: 'Private Key',
+        pattern: /(?:private[_-]?key|-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----)/gi,
+        severity: 'critical',
+        envVarName: () => 'PRIVATE_KEY',
+    },
+    {
+        name: 'OAuth Client Secret',
+        pattern: /(?:oauth[_-]?client[_-]?secret|client[_-]?secret)\s*[:=]\s*['"]([a-zA-Z0-9_\-]{20,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'OAUTH_CLIENT_SECRET',
+    },
+    {
+        name: 'SendGrid API Key',
+        pattern: /(?:sendgrid[_-]?api[_-]?key)\s*[:=]\s*['"](SG\.[a-zA-Z0-9_\-]{22}\.[a-zA-Z0-9_\-]{43})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'SENDGRID_API_KEY',
+    },
+    {
+        name: 'Twilio Auth Token',
+        pattern: /(?:twilio[_-]?auth[_-]?token)\s*[:=]\s*['"]([a-zA-Z0-9]{32})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'TWILIO_AUTH_TOKEN',
+    },
+    {
+        name: 'Slack Webhook URL',
+        pattern: /(?:slack[_-]?webhook)\s*[:=]\s*['"](https:\/\/hooks\.slack\.com\/services\/[^'"]+)['"]/gi,
+        severity: 'high',
+        envVarName: () => 'SLACK_WEBHOOK_URL',
+    },
+    {
+        name: 'Firebase Service Account',
+        pattern: /(?:firebase[_-]?service[_-]?account|GOOGLE_APPLICATION_CREDENTIALS)\s*[:=]\s*['"]([^'"]+\.json)['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'FIREBASE_SERVICE_ACCOUNT',
+    },
+    // Cloud Services
+    {
+        name: 'Azure Connection String',
+        pattern: /(?:azure[_-]?connection[_-]?string|AZURE_STORAGE_CONNECTION_STRING)\s*[:=]\s*['"](DefaultEndpointsProtocol=https[^'"]+)['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'AZURE_STORAGE_CONNECTION_STRING',
+    },
+    {
+        name: 'GCP Service Account Key',
+        pattern: /(?:gcp[_-]?service[_-]?account|GOOGLE_APPLICATION_CREDENTIALS|GCP_SERVICE_ACCOUNT)\s*[:=]\s*['"]([^'"]+\.json)['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'GCP_SERVICE_ACCOUNT_KEY',
+    },
+    {
+        name: 'Vercel Token',
+        pattern: /(?:vercel[_-]?token|VERCEL_TOKEN)\s*[:=]\s*['"]([a-zA-Z0-9_\-]{40,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'VERCEL_TOKEN',
+    },
+    {
+        name: 'Netlify Token',
+        pattern: /(?:netlify[_-]?token|NETLIFY_TOKEN)\s*[:=]\s*['"]([a-zA-Z0-9_\-]{40,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'NETLIFY_TOKEN',
+    },
+    {
+        name: 'Heroku API Key',
+        pattern: /(?:heroku[_-]?api[_-]?key|HEROKU_API_KEY)\s*[:=]\s*['"]([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'HEROKU_API_KEY',
+    },
+    // Additional Database Services
+    {
+        name: 'Redis Connection String',
+        pattern: /(?:redis[_-]?url|REDIS_URL|redis[_-]?connection)\s*[:=]\s*['"](redis[s]?:\/\/[^'"]+)['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'REDIS_URL',
+    },
+    {
+        name: 'MySQL Connection String',
+        pattern: /(?:mysql[_-]?uri|MYSQL_URL|mysql[_-]?connection)\s*[:=]\s*['"](mysql:\/\/[^'"]+)['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'MYSQL_URL',
+    },
+    {
+        name: 'Supabase Anon Key',
+        pattern: /(?:supabase[_-]?anon[_-]?key|SUPABASE_ANON_KEY)\s*[:=]\s*['"](eyJ[a-zA-Z0-9_\-]{100,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'SUPABASE_ANON_KEY',
+    },
+    {
+        name: 'Supabase Service Role Key',
+        pattern: /(?:supabase[_-]?service[_-]?role[_-]?key|SUPABASE_SERVICE_ROLE_KEY)\s*[:=]\s*['"](eyJ[a-zA-Z0-9_\-]{100,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'SUPABASE_SERVICE_ROLE_KEY',
+    },
+    // Authentication Services
+    {
+        name: 'Auth0 Client Secret',
+        pattern: /(?:auth0[_-]?client[_-]?secret|AUTH0_CLIENT_SECRET)\s*[:=]\s*['"]([a-zA-Z0-9_\-]{32,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'AUTH0_CLIENT_SECRET',
+    },
+    {
+        name: 'Clerk Secret Key',
+        pattern: /(?:clerk[_-]?secret[_-]?key|CLERK_SECRET_KEY)\s*[:=]\s*['"](sk_[a-z]_[a-zA-Z0-9_\-]{50,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'CLERK_SECRET_KEY',
+    },
+    // Email Services
+    {
+        name: 'Mailgun API Key',
+        pattern: /(?:mailgun[_-]?api[_-]?key|MAILGUN_API_KEY)\s*[:=]\s*['"](key-[a-f0-9]{32})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'MAILGUN_API_KEY',
+    },
+    {
+        name: 'Postmark API Key',
+        pattern: /(?:postmark[_-]?api[_-]?key|POSTMARK_API_KEY)\s*[:=]\s*['"]([a-zA-Z0-9_\-]{40,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'POSTMARK_API_KEY',
+    },
+    {
+        name: 'Resend API Key',
+        pattern: /(?:resend[_-]?api[_-]?key|RESEND_API_KEY)\s*[:=]\s*['"](re_[a-zA-Z0-9_\-]{40,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'RESEND_API_KEY',
+    },
+    // Monitoring & Error Tracking
+    {
+        name: 'Sentry DSN',
+        pattern: /(?:sentry[_-]?dsn|SENTRY_DSN)\s*[:=]\s*['"](https:\/\/[a-f0-9]{32}@[^'"]+\/[0-9]+)['"]/gi,
+        severity: 'high',
+        envVarName: () => 'SENTRY_DSN',
+    },
+    {
+        name: 'Datadog API Key',
+        pattern: /(?:datadog[_-]?api[_-]?key|DD_API_KEY)\s*[:=]\s*['"]([a-f0-9]{32})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'DD_API_KEY',
+    },
+    {
+        name: 'New Relic License Key',
+        pattern: /(?:newrelic[_-]?license[_-]?key|NEW_RELIC_LICENSE_KEY)\s*[:=]\s*['"]([a-f0-9]{40})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'NEW_RELIC_LICENSE_KEY',
+    },
+    // Payment Services
+    {
+        name: 'PayPal Client Secret',
+        pattern: /(?:paypal[_-]?client[_-]?secret|PAYPAL_CLIENT_SECRET)\s*[:=]\s*['"]([a-zA-Z0-9_\-]{40,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'PAYPAL_CLIENT_SECRET',
+    },
+    {
+        name: 'Square Access Token',
+        pattern: /(?:square[_-]?access[_-]?token|SQUARE_ACCESS_TOKEN)\s*[:=]\s*['"](EAAA[a-zA-Z0-9_\-]{40,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'SQUARE_ACCESS_TOKEN',
+    },
+    // Communication Services
+    {
+        name: 'Discord Bot Token',
+        pattern: /(?:discord[_-]?bot[_-]?token|DISCORD_BOT_TOKEN)\s*[:=]\s*['"]([MN][A-Za-z\d]{23}\.[\w-]{6}\.[\w-]{27})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'DISCORD_BOT_TOKEN',
+    },
+    {
+        name: 'Discord Webhook URL',
+        pattern: /(?:discord[_-]?webhook|DISCORD_WEBHOOK)\s*[:=]\s*['"](https:\/\/discord\.com\/api\/webhooks\/[^'"]+)['"]/gi,
+        severity: 'high',
+        envVarName: () => 'DISCORD_WEBHOOK_URL',
+    },
+    {
+        name: 'Telegram Bot Token',
+        pattern: /(?:telegram[_-]?bot[_-]?token|TELEGRAM_BOT_TOKEN)\s*[:=]\s*['"]([0-9]{8,10}:[a-zA-Z0-9_-]{35})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'TELEGRAM_BOT_TOKEN',
+    },
+    // Search & CDN Services
+    {
+        name: 'Algolia API Key',
+        pattern: /(?:algolia[_-]?api[_-]?key|ALGOLIA_API_KEY)\s*[:=]\s*['"]([a-f0-9]{32})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'ALGOLIA_API_KEY',
+    },
+    {
+        name: 'Cloudinary URL',
+        pattern: /(?:cloudinary[_-]?url|CLOUDINARY_URL)\s*[:=]\s*['"](cloudinary:\/\/[^'"]+)['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'CLOUDINARY_URL',
+    },
+    // CI/CD Services
+    {
+        name: 'CircleCI Token',
+        pattern: /(?:circleci[_-]?token|CIRCLE_TOKEN)\s*[:=]\s*['"]([a-f0-9]{40})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'CIRCLE_TOKEN',
+    },
+    {
+        name: 'Travis CI Token',
+        pattern: /(?:travis[_-]?ci[_-]?token|TRAVIS_TOKEN)\s*[:=]\s*['"]([a-zA-Z0-9_\-]{22})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'TRAVIS_TOKEN',
+    },
+    // Analytics & Mobile Services
+    {
+        name: 'RevenueCat API Key',
+        pattern: /(?:revenuecat[_-]?api[_-]?key|revenue[_-]?cat[_-]?key|REVENUECAT_API_KEY)\s*[:=]\s*['"](test_[a-zA-Z0-9_\-]{30,}|rcat_[a-zA-Z0-9_\-]{30,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'REVENUECAT_API_KEY',
+    },
+    {
+        name: 'Amplitude API Key',
+        pattern: /(?:amplitude[_-]?api[_-]?key|AMPLITUDE_API_KEY)\s*[:=]\s*['"]([a-f0-9]{32})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'AMPLITUDE_API_KEY',
+    },
+    {
+        name: 'Mixpanel Token',
+        pattern: /(?:mixpanel[_-]?token|MIXPANEL_TOKEN)\s*[:=]\s*['"]([a-f0-9]{32})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'MIXPANEL_TOKEN',
+    },
+    {
+        name: 'Segment Write Key',
+        pattern: /(?:segment[_-]?write[_-]?key|SEGMENT_WRITE_KEY)\s*[:=]\s*['"]([a-zA-Z0-9_\-]{20,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'SEGMENT_WRITE_KEY',
+    },
+    // Email addresses in config files (especially sensitive ones)
+    {
+        name: 'Email Address in Config',
+        pattern: /(?:email|apple[_-]?id|admin[_-]?email|contact[_-]?email|appleId)\s*[:=]\s*['"]([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,})['"]/gi,
+        severity: 'medium',
+        envVarName: (match) => {
+            const varName = match[0].match(/(\w+)\s*[:=]/)?.[1]?.toUpperCase().replace(/[_-]/g, '_') || 'EMAIL';
+            return varName;
+        },
+    },
+    // Catch emails in JSON config files (eas.json, app.config.js, etc.) - only in config files
+    // Only trigger if the field name suggests it's sensitive (appleId, email, adminEmail, etc.)
+    {
+        name: 'Email in JSON Config',
+        pattern: /(?:appleId|apple[_-]?id|email|admin[_-]?email|contact[_-]?email|support[_-]?email)\s*[:=]\s*['"]([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,})['"]/gi,
+        severity: 'medium',
+        envVarName: () => 'EMAIL',
+    },
+    // Generic hex strings that look like API keys (32+ chars) - catch any hex string that looks like a key
+    {
+        name: 'Hex API Key',
+        pattern: /(?:key|api[_-]?key|token|amplitude|analytics)\s*[:=]\s*['"]([a-f0-9]{32,})['"]/gi,
+        severity: 'high',
+        envVarName: (match) => {
+            const varName = match[0].match(/(\w+)\s*[:=]/)?.[1]?.toUpperCase().replace(/[_-]/g, '_') || 'API_KEY';
+            return varName;
+        },
+    },
+    // Catch any hex string in assignment (very generic, catches Amplitude and similar)
+    // Only trigger if it's in a context that suggests it's a key (near "key", "api", "token", etc.)
+    {
+        name: 'Hex String (Potential Key)',
+        pattern: /(?:key|api|token|secret|amplitude|analytics|mixpanel|amplitudeKey|apiKey).*[:=]\s*['"]([a-f0-9]{32})['"]/gi,
+        severity: 'high',
+        envVarName: () => 'API_KEY',
+    },
+    // Very generic: catch any 32-char hex string that's assigned (Amplitude, Mixpanel, etc.)
+    // This is more aggressive but necessary to catch keys with generic variable names
+    {
+        name: 'Hex API Key (Generic)',
+        pattern: /(?:const|let|var|export\s+const)\s+\w*(?:key|api|token|id|secret)\w*\s*[:=]\s*['"]([a-f0-9]{32})['"]/gi,
+        severity: 'high',
+        envVarName: () => 'API_KEY',
+    },
+    // Fallback patterns (catches || 'secret' or ?? 'secret')
+    {
+        name: 'Hardcoded Secret Fallback',
+        pattern: /\|\|\s*['"]([a-zA-Z0-9_\-+/=]{20,})['"]|\?\?\s*['"]([a-zA-Z0-9_\-+/=]{20,})['"]/gi,
+        severity: 'high',
+        envVarName: () => 'SECRET',
+    },
+    // Test keys (often start with test_)
+    {
+        name: 'Test API Key',
+        pattern: /(?:test[_-]?key|test[_-]?api[_-]?key|TEST_KEY)\s*[:=]\s*['"](test_[a-zA-Z0-9_\-]{20,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'TEST_API_KEY',
+    },
+    // Generic test_ prefixed keys (catches RevenueCat and others) - very generic to catch any test_ key
+    {
+        name: 'Test Key (test_ prefix)',
+        pattern: /[:=]\s*['"](test_[a-zA-Z0-9_\-]{25,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'TEST_API_KEY',
+    },
+    // RevenueCat specific (catches rcat_ prefix too)
+    {
+        name: 'RevenueCat Key',
+        pattern: /[:=]\s*['"](rcat_[a-zA-Z0-9_\-]{25,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'REVENUECAT_API_KEY',
+    },
+    // Ultra-generic patterns - catch secrets regardless of variable naming
+    // These are aggressive but necessary to catch all secrets
+    // Any string that looks like an API key (20+ alphanumeric chars) in assignment
+    {
+        name: 'Potential API Key (Generic)',
+        pattern: /[:=]\s*['"]([a-zA-Z0-9_\-+/=]{32,})['"]/g,
+        severity: 'medium',
+        envVarName: () => 'API_KEY',
+    },
+    // Any hex string 32+ chars (common for API keys)
+    {
+        name: 'Potential Hex Key',
+        pattern: /[:=]\s*['"]([a-f0-9]{32,})['"]/gi,
+        severity: 'medium',
+        envVarName: () => 'API_KEY',
+    },
+    // Base64-like strings (40+ chars, common for tokens)
+    {
+        name: 'Potential Base64 Token',
+        pattern: /[:=]\s*['"]([A-Za-z0-9+/=]{40,})['"]/g,
+        severity: 'medium',
+        envVarName: () => 'TOKEN',
+    },
+    // Any string starting with common prefixes
+    {
+        name: 'Potential Key (Common Prefix)',
+        pattern: /[:=]\s*['"](sk[_-][a-zA-Z0-9_\-]{20,}|pk[_-][a-zA-Z0-9_\-]{20,}|rk[_-][a-zA-Z0-9_\-]{20,})['"]/gi,
+        severity: 'high',
+        envVarName: () => 'API_KEY',
+    },
+    // JWT tokens (eyJ...)
+    {
+        name: 'JWT Token',
+        pattern: /[:=]\s*['"](eyJ[A-Za-z0-9\-_]{20,}\.[A-Za-z0-9\-_]{20,}\.[A-Za-z0-9\-_]{20,})['"]/g,
+        severity: 'critical',
+        envVarName: () => 'JWT_TOKEN',
+    },
+    // Connection strings (common patterns)
+    {
+        name: 'Connection String',
+        pattern: /[:=]\s*['"]((?:mongodb|postgres|mysql|redis|amqp|https?):\/\/[^'"]{20,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'CONNECTION_STRING',
+    },
+    // AWS keys (AKIA prefix)
+    {
+        name: 'AWS Access Key',
+        pattern: /[:=]\s*['"](AKIA[0-9A-Z]{16})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'AWS_ACCESS_KEY_ID',
+    },
+    // Private keys (PEM format)
+    {
+        name: 'Private Key (PEM)',
+        pattern: /-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----[\s\S]{50,}-----END\s+(?:RSA\s+)?PRIVATE\s+KEY-----/gi,
+        severity: 'critical',
+        envVarName: () => 'PRIVATE_KEY',
+    },
+    // OAuth tokens
+    {
+        name: 'OAuth Token',
+        pattern: /[:=]\s*['"](ya29\.[A-Za-z0-9\-_]{50,}|1\/\/[A-Za-z0-9\-_]{50,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'OAUTH_TOKEN',
+    },
+    // Generic password pattern (8+ chars, not just "password")
+    {
+        name: 'Password',
+        pattern: /(?:password|pwd|passwd|secret[_-]?key)\s*[:=]\s*['"]([^'"]{8,})['"]/gi,
+        severity: 'critical',
+        envVarName: () => 'PASSWORD',
+    },
+];
+// Files to ignore during scan
+const IGNORE_PATTERNS = [
+    /node_modules/,
+    /\.git/,
+    /dist/,
+    /build/,
+    /\.next/,
+    /\.env/,
+    /\.env\.local/,
+    /\.env\.example/,
+    /package-lock\.json/,
+    /yarn\.lock/,
+    /pnpm-lock\.yaml/,
+    /\.lattice/,
+];
+// File extensions to scan - comprehensive list of all text-based files that could be publicly exposed
+const SCAN_EXTENSIONS = [
+    // Source code
+    '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs',
+    // Config files
+    '.json', '.yaml', '.yml', '.toml', '.ini', '.conf', '.config',
+    // Web files (publicly exposed)
+    '.html', '.htm', '.css', '.scss', '.sass', '.less', '.styl',
+    // Documentation (could contain examples with secrets)
+    '.md', '.txt', '.rst', '.adoc',
+    // Scripts
+    '.sh', '.bash', '.zsh', '.fish', '.ps1', '.bat', '.cmd',
+    // Docker & deployment
+    '.dockerfile', '.dockerignore', '.gitignore', '.gitattributes',
+    // Environment files
+    '.env', '.env.local', '.env.production', '.env.development',
+    // Config variants
+    '.config.js', '.config.ts', '.config.json', '.config.yaml',
+    // App configs
+    'app.json', 'app.config.js', 'app.config.ts',
+    // Build configs
+    'webpack.config.js', 'vite.config.js', 'rollup.config.js',
+    'next.config.js', 'nuxt.config.js', 'svelte.config.js',
+    // Other configs
+    'tsconfig.json', 'jsconfig.json', 'tailwind.config.js',
+    'postcss.config.js', 'babel.config.js', 'jest.config.js',
+    // EAS config
+    'eas.json',
+    // No extension but important files
+    'Dockerfile', 'docker-compose.yml', 'Makefile', 'Procfile',
+];
+async function shouldScanFile(filePath, cwd) {
+    const relativePath = (0, path_1.relative)(cwd, filePath);
+    const fileName = relativePath.split(/[/\\]/).pop() || '';
+    const lowerPath = relativePath.toLowerCase();
+    // Check ignore patterns
+    for (const pattern of IGNORE_PATTERNS) {
+        if (pattern.test(relativePath)) {
+            return false;
+        }
+    }
+    // Check if file has no extension but is a known config file
+    const noExtConfigFiles = ['Dockerfile', 'Makefile', 'Procfile', 'docker-compose.yml', 'eas.json', 'app.json'];
+    if (noExtConfigFiles.includes(fileName) || noExtConfigFiles.some(name => lowerPath.includes(name.toLowerCase()))) {
+        return true;
+    }
+    // Check file extension - handle files with multiple dots like app.config.js
+    const lastDot = relativePath.lastIndexOf('.');
+    if (lastDot === -1) {
+        // No extension - check if it's a config file by name
+        if (fileName.includes('config') || fileName.includes('Config')) {
+            return true;
+        }
+        return false;
+    }
+    const ext = relativePath.substring(lastDot).toLowerCase();
+    const baseName = relativePath.substring(0, lastDot).toLowerCase();
+    // Check if extension matches directly
+    if (SCAN_EXTENSIONS.some(e => e.toLowerCase() === ext)) {
+        return true;
+    }
+    // Check for compound extensions like .config.js, .config.ts
+    if (ext === '.js' || ext === '.ts' || ext === '.json' || ext === '.yaml' || ext === '.yml') {
+        if (baseName.endsWith('.config') || baseName.includes('.config.')) {
+            return true;
+        }
+    }
+    // Check for build config files (webpack.config.js, vite.config.js, etc.)
+    if (baseName.includes('webpack.config') || baseName.includes('vite.config') ||
+        baseName.includes('rollup.config') || baseName.includes('next.config') ||
+        baseName.includes('nuxt.config') || baseName.includes('svelte.config') ||
+        baseName.includes('tailwind.config') || baseName.includes('postcss.config') ||
+        baseName.includes('babel.config') || baseName.includes('jest.config') ||
+        baseName.includes('tsconfig') || baseName.includes('jsconfig') ||
+        baseName.includes('app.config')) {
+        return true;
+    }
+    // Scan any text file that could be publicly exposed
+    // This is aggressive but necessary for security
+    const textFileExtensions = ['.txt', '.log', '.xml', '.svg', '.vue', '.svelte', '.astro'];
+    if (textFileExtensions.includes(ext)) {
+        return true;
+    }
+    return false;
+}
+// Validate secret formats
+async function validateSecret(type, value) {
+    // OpenAI API Key validation
+    if (type.includes('OpenAI')) {
+        if (!value.startsWith('sk-')) {
+            return {
+                isValid: false,
+                reason: 'OpenAI keys must start with "sk-"',
+                suggestions: ['Check if this is a valid OpenAI API key'],
+            };
+        }
+        if (value.length < 32) {
+            return {
+                isValid: false,
+                reason: 'OpenAI keys must be at least 32 characters',
+                suggestions: ['Key appears truncated'],
+            };
+        }
+        return { isValid: true };
+    }
+    // AWS Access Key validation
+    if (type.includes('AWS')) {
+        if (!value.startsWith('AKIA')) {
+            return {
+                isValid: false,
+                reason: 'AWS access keys must start with "AKIA"',
+                suggestions: ['This may not be a valid AWS access key'],
+            };
+        }
+        if (value.length !== 20) {
+            return {
+                isValid: false,
+                reason: 'AWS access keys must be exactly 20 characters',
+                suggestions: ['Key length is incorrect'],
+            };
+        }
+        return { isValid: true };
+    }
+    // JWT Token validation
+    if (type.includes('JWT')) {
+        const parts = value.split('.');
+        if (parts.length !== 3) {
+            return {
+                isValid: false,
+                reason: 'JWT tokens must have 3 parts separated by dots',
+                suggestions: ['Invalid JWT format'],
+            };
+        }
+        return { isValid: true };
+    }
+    // Generic hex validation
+    if (/^[a-f0-9]{32,}$/i.test(value)) {
+        return { isValid: true };
+    }
+    // Generic base64 validation
+    if (/^[A-Za-z0-9+/=]{40,}$/.test(value)) {
+        return { isValid: true };
+    }
+    return {
+        isValid: false,
+        reason: 'Unknown secret format',
+        suggestions: ['Verify this is a valid secret'],
+    };
+}
+async function scanFileForSecrets(filePath, cwd) {
+    const findings = [];
+    try {
+        const content = await fs_1.promises.readFile(filePath, 'utf-8');
+        const lines = content.split('\n');
+        for (const pattern of SECRET_PATTERNS) {
+            let match;
+            const regex = new RegExp(pattern.pattern.source, pattern.pattern.flags);
+            while ((match = regex.exec(content)) !== null) {
+                if (match.index === undefined)
+                    continue;
+                const lineNumber = content.substring(0, match.index).split('\n').length;
+                const line = lines[lineNumber - 1] || '';
+                const column = match.index - content.substring(0, match.index).lastIndexOf('\n');
+                // Extract the secret value
+                // For ALL_CAPS pattern: match[1]=varName, match[2]=value
+                // For other patterns: match[1]=value
+                let secretValue;
+                if (match.length > 2 && match[2] !== undefined && match[2] !== '') {
+                    secretValue = match[2];
+                }
+                else if (match[1] !== undefined && match[1] !== '') {
+                    secretValue = match[1];
+                }
+                else {
+                    secretValue = match[0];
+                }
+                // Validate the secret
+                const validation = await validateSecret(pattern.name, secretValue);
+                // Skip if already using environment variable (but not if it's a fallback like process.env.KEY || 'hardcoded')
+                // Check if the line has a hardcoded value as a fallback
+                const hasEnvVar = line.includes('process.env') || line.includes('import.meta.env') || line.includes('process.env');
+                const hasFallback = line.includes('||') || line.includes('??') || line.includes('||') || line.includes('??');
+                // If it's using env var AND has NO fallback, skip (it's safe)
+                // BUT if it has a fallback, that's still a security issue - flag it
+                if (hasEnvVar && !hasFallback) {
+                    continue;
+                }
+                // Also skip if it's clearly a comment or documentation example
+                // (but be careful - some secrets are in comments!)
+                if (line.trim().startsWith('//') || line.trim().startsWith('*') || line.trim().startsWith('#')) {
+                    // Only skip if it's clearly an example (contains "example", "demo", "placeholder")
+                    if (line.toLowerCase().includes('example') || line.toLowerCase().includes('demo') ||
+                        line.toLowerCase().includes('placeholder') || line.toLowerCase().includes('your_')) {
+                        continue;
+                    }
+                }
+                findings.push({
+                    file: (0, path_1.relative)(cwd, filePath),
+                    line: lineNumber,
+                    column: column - 1,
+                    type: pattern.name,
+                    severity: pattern.severity,
+                    value: secretValue.substring(0, 20) + '...',
+                    suggestion: pattern.envVarName ? `Use ${pattern.envVarName(match)} environment variable` : 'Move to environment variable',
+                    validation: validation,
+                });
+            }
+        }
+    }
+    catch (error) {
+        // Skip files that can't be read (binary, etc.)
+        if (error.code !== 'EISDIR') {
+            // Silently skip
+        }
+    }
+    return findings;
+}
+async function getAllFiles(dir, cwd) {
+    const files = [];
+    try {
+        const entries = await fs_1.promises.readdir(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            const fullPath = (0, path_1.join)(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (await shouldScanFile(fullPath, cwd)) {
+                    files.push(...await getAllFiles(fullPath, cwd));
+                }
+            }
+            else if (entry.isFile()) {
+                if (await shouldScanFile(fullPath, cwd)) {
+                    files.push(fullPath);
+                }
+            }
+        }
+    }
+    catch {
+        // Skip directories we can't read
+    }
+    return files;
+}
+async function ensureGitignore(cwd) {
+    const gitignorePath = (0, path_1.join)(cwd, '.gitignore');
+    const envPatterns = [
+        '.env',
+        '.env.local',
+        '.env*.local',
+        '.env.production',
+        '.env.development',
+    ];
+    let gitignoreContent = '';
+    try {
+        gitignoreContent = await fs_1.promises.readFile(gitignorePath, 'utf-8');
+    }
+    catch {
+        // .gitignore doesn't exist, create it
+    }
+    let needsUpdate = false;
+    for (const pattern of envPatterns) {
+        if (!gitignoreContent.includes(pattern)) {
+            gitignoreContent += `\n${pattern}`;
+            needsUpdate = true;
+        }
+    }
+    if (needsUpdate) {
+        await fs_1.promises.writeFile(gitignorePath, gitignoreContent.trim() + '\n', 'utf-8');
+    }
+}
+async function fixSecretInFile(filePath, finding, envVarName, cwd) {
+    try {
+        let content = await fs_1.promises.readFile(filePath, 'utf-8');
+        const lines = content.split('\n');
+        const lineIndex = finding.line - 1;
+        if (lineIndex >= lines.length) {
+            return false;
+        }
+        const originalLine = lines[lineIndex];
+        // Try to extract the variable name and replace the value
+        // Pattern: variableName = "secret" or variableName: "secret"
+        const assignmentMatch = originalLine.match(/(\w+)\s*[:=]\s*['"]([^'"]+)['"]/);
+        if (assignmentMatch) {
+            const varName = assignmentMatch[1];
+            const isJson = filePath.endsWith('.json');
+            if (isJson) {
+                // For JSON files, replace with environment variable reference comment
+                const newLine = originalLine.replace(/['"]([^'"]+)['"]/, `"${envVarName}" // TODO: Replace with process.env.${envVarName} in code`);
+                lines[lineIndex] = newLine;
+            }
+            else {
+                // For code files, replace with process.env reference
+                const isNext = filePath.match(/\.(ts|tsx|js|jsx)$/);
+                const envRef = isNext ? `process.env.${envVarName}` : `process.env.${envVarName}`;
+                const newLine = originalLine.replace(/['"]([^'"]+)['"]/, `\`\${${envRef}}\``);
+                lines[lineIndex] = newLine;
+            }
+            content = lines.join('\n');
+            await fs_1.promises.writeFile(filePath, content, 'utf-8');
+            return true;
+        }
+    }
+    catch {
+        return false;
+    }
+    return false;
+}
+async function addToEnvFile(cwd, envVarName, secretValue) {
+    const envPath = (0, path_1.join)(cwd, '.env.local');
+    let envContent = '';
+    try {
+        envContent = await fs_1.promises.readFile(envPath, 'utf-8');
+    }
+    catch {
+        // File doesn't exist, create it
+    }
+    // Check if variable already exists
+    if (envContent.includes(`${envVarName}=`)) {
+        return; // Already exists
+    }
+    envContent += `\n${envVarName}=${secretValue}\n`;
+    await fs_1.promises.writeFile(envPath, envContent.trim() + '\n', 'utf-8');
+}
+async function securityScan(options = {}) {
+    const cwd = options.cwd || process.cwd();
+    const findings = [];
+    const errors = [];
+    let fixed = 0;
+    let totalFilesScanned = 0;
+    try {
+        // 1. Scan current files
+        const files = await getAllFiles(cwd, cwd);
+        totalFilesScanned = files.length;
+        for (const file of files) {
+            const fileFindings = await scanFileForSecrets(file, cwd);
+            findings.push(...fileFindings);
+        }
+        // 2. Scan git history if requested
+        if (options.scanGitHistory) {
+            try {
+                const gitFindings = await scanGitHistory(cwd);
+                findings.push(...gitFindings);
+            }
+            catch (error) {
+                errors.push(`Git history scan failed: ${error.message}`);
+            }
+        }
+        // 3. Validate .env files are properly gitignored
+        if (options.checkEnvFiles !== false) {
+            try {
+                const envIssues = await validateEnvFiles(cwd);
+                if (envIssues.length > 0) {
+                    errors.push(...envIssues);
+                }
+            }
+            catch (error) {
+                errors.push(`Env file validation failed: ${error.message}`);
+            }
+        }
+        if (options.fix && findings.length > 0) {
+            // Group findings by file for efficient processing
+            const findingsByFile = new Map();
+            for (const finding of findings) {
+                const fullPath = (0, path_1.join)(cwd, finding.file);
+                if (!findingsByFile.has(fullPath)) {
+                    findingsByFile.set(fullPath, []);
+                }
+                findingsByFile.get(fullPath).push(finding);
+            }
+            // Ensure .gitignore includes .env files
+            await ensureGitignore(cwd);
+            // Fix each finding
+            for (const [filePath, fileFindings] of findingsByFile.entries()) {
+                try {
+                    const content = await fs_1.promises.readFile(filePath, 'utf-8');
+                    const lines = content.split('\n');
+                    for (const finding of fileFindings) {
+                        // Determine environment variable name
+                        const pattern = SECRET_PATTERNS.find(p => p.name === finding.type);
+                        if (!pattern || !pattern.envVarName) {
+                            continue;
+                        }
+                        // Re-scan the line to get the full secret value
+                        const lineIndex = finding.line - 1;
+                        if (lineIndex >= lines.length) {
+                            continue;
+                        }
+                        const line = lines[lineIndex];
+                        const regex = new RegExp(pattern.pattern.source, pattern.pattern.flags);
+                        const match = regex.exec(line);
+                        if (match) {
+                            // Extract the secret value
+                            // For ALL_CAPS pattern: match[1]=varName, match[2]=value
+                            // For other patterns: match[1]=value
+                            let secretValue;
+                            if (match.length > 2 && match[2] !== undefined && match[2] !== '') {
+                                secretValue = match[2];
+                            }
+                            else if (match[1] !== undefined && match[1] !== '') {
+                                secretValue = match[1];
+                            }
+                            else {
+                                secretValue = match[0];
+                            }
+                            const envVarName = pattern.envVarName(match);
+                            // Add to .env file
+                            await addToEnvFile(cwd, envVarName, secretValue);
+                            // Fix in source file
+                            if (await fixSecretInFile(filePath, finding, envVarName, cwd)) {
+                                fixed++;
+                            }
+                        }
+                    }
+                }
+                catch (error) {
+                    errors.push(`Failed to fix ${filePath}: ${error.message}`);
+                }
+            }
+        }
+    }
+    catch (error) {
+        errors.push(`Scan error: ${error.message}`);
+    }
+    // Install pre-commit hook if requested
+    if (options.installHook) {
+        try {
+            await installPreCommitHook(cwd, options.hookPath);
+        }
+        catch (error) {
+            errors.push(`Failed to install pre-commit hook: ${error.message}`);
+        }
+    }
+    // Generate summary
+    const summary = {
+        totalFilesScanned,
+        criticalFindings: findings.filter(f => f.severity === 'critical').length,
+        highFindings: findings.filter(f => f.severity === 'high').length,
+        mediumFindings: findings.filter(f => f.severity === 'medium').length,
+        gitHistoryFindings: findings.filter(f => f.file.startsWith('git:')).length,
+        envFileIssues: errors.filter(e => e.includes('.env') || e.includes('gitignore')).length,
+    };
+    // Export report if requested
+    if (options.exportPath) {
+        const format = options.exportFormat || (options.sarif ? 'sarif' : 'json');
+        let content;
+        if (format === 'sarif') {
+            content = JSON.stringify(generateSarifReport({ findings, fixed, errors, summary }, cwd), null, 2);
+        }
+        else {
+            content = JSON.stringify({ findings, fixed, errors, summary }, null, 2);
+        }
+        await fs_1.promises.writeFile(options.exportPath, content, 'utf-8');
+        console.log(`✅ Report exported to: ${options.exportPath}`);
+    }
+    return { findings, fixed, errors, summary };
+}
+// Scan git history for secrets
+async function scanGitHistory(cwd) {
+    const findings = [];
+    try {
+        // Check if git is available
+        const { execSync } = require('child_process');
+        // Get all commits
+        const commits = execSync('git log --all --pretty=format:"%H"', {
+            cwd,
+            encoding: 'utf-8',
+            stdio: 'pipe'
+        }).trim().split('\n').filter(Boolean);
+        // Scan each commit's diff
+        for (const commit of commits.slice(0, 100)) { // Limit to last 100 commits for performance
+            try {
+                const diff = execSync(`git show ${commit}`, {
+                    cwd,
+                    encoding: 'utf-8',
+                    stdio: 'pipe',
+                    maxBuffer: 10 * 1024 * 1024 // 10MB buffer
+                });
+                // Scan diff for secrets
+                for (const pattern of SECRET_PATTERNS) {
+                    const regex = new RegExp(pattern.pattern.source, pattern.pattern.flags);
+                    let match;
+                    while ((match = regex.exec(diff)) !== null) {
+                        if (match.index === undefined)
+                            continue;
+                        findings.push({
+                            file: `git:${commit.substring(0, 8)}`,
+                            line: 0,
+                            column: 0,
+                            type: `${pattern.name} (in git history)`,
+                            severity: pattern.severity,
+                            value: (match[1] || match[0]).substring(0, 20) + '...',
+                            suggestion: `Secret found in git history. Consider: 1) Rotating the secret, 2) Using git-filter-repo to remove it, 3) Using BFG Repo-Cleaner`,
+                        });
+                    }
+                }
+            }
+            catch (error) {
+                // Skip commits that can't be read
+                continue;
+            }
+        }
+    }
+    catch (error) {
+        // Git not available or not a git repo
+        throw new Error(`Git history scan failed: ${error.message}`);
+    }
+    return findings;
+}
+// Validate .env files are properly gitignored
+async function validateEnvFiles(cwd) {
+    const issues = [];
+    try {
+        const gitignorePath = (0, path_1.join)(cwd, '.gitignore');
+        // Check if .gitignore exists
+        let gitignoreContent = '';
+        try {
+            gitignoreContent = await fs_1.promises.readFile(gitignorePath, 'utf-8');
+        }
+        catch {
+            issues.push('⚠️  No .gitignore file found. Create one to protect .env files.');
+            return issues;
+        }
+        // Check if .env files are tracked by git
+        try {
+            const allFiles = (0, child_process_1.execSync)('git ls-files', {
+                cwd,
+                encoding: 'utf-8',
+                stdio: 'pipe'
+            }).trim().split('\n');
+            const trackedEnvFiles = allFiles.filter((f) => f.includes('.env') && !f.includes('.env.example'));
+            if (trackedEnvFiles.length > 0) {
+                issues.push(`🚨 CRITICAL: .env files are tracked in git: ${trackedEnvFiles.join(', ')}`);
+                issues.push('   Action required: Remove from git with: git rm --cached <file>');
+            }
+        }
+        catch {
+            // Git not available
+        }
+        // Check if .env files exist but aren't in .gitignore
+        const envFiles = ['.env', '.env.local', '.env.production', '.env.development'];
+        for (const envFile of envFiles) {
+            const envPath = (0, path_1.join)(cwd, envFile);
+            try {
+                await fs_1.promises.access(envPath);
+                // File exists, check if it's in .gitignore
+                // Check for explicit filename, or patterns like .env*, .env.*, .env.local, etc.
+                const isExplicitlyIgnored = gitignoreContent.includes(envFile);
+                const hasEnvPattern = gitignoreContent.includes('.env*') || gitignoreContent.includes('.env.*');
+                const isEnvFile = envFile.startsWith('.env');
+                // Use git check-ignore to verify (most accurate)
+                let isActuallyIgnored = false;
+                try {
+                    const checkResult = (0, child_process_1.execSync)(`git check-ignore "${envFile}"`, {
+                        cwd,
+                        encoding: 'utf-8',
+                        stdio: 'pipe'
+                    }).trim();
+                    isActuallyIgnored = checkResult === envFile;
+                }
+                catch {
+                    // git check-ignore returns non-zero if file is NOT ignored
+                    isActuallyIgnored = false;
+                }
+                // Only warn if file exists AND is not actually ignored by git
+                if (!isActuallyIgnored && !isExplicitlyIgnored && !hasEnvPattern) {
+                    issues.push(`⚠️  ${envFile} exists but may not be in .gitignore`);
+                }
+            }
+            catch {
+                // File doesn't exist, that's fine
+            }
+        }
+    }
+    catch (error) {
+        // Not a git repo or git not available
+        issues.push(`⚠️  Could not validate .env files: ${error.message}`);
+    }
+    return issues;
+}
+const ALLOWLIST_FILE = '.lattice/security-allowlist.json';
+async function loadAllowlist(cwd) {
+    const allowlistPath = (0, path_1.join)(cwd, ALLOWLIST_FILE);
+    try {
+        const content = await fs_1.promises.readFile(allowlistPath, 'utf-8');
+        return JSON.parse(content);
+    }
+    catch {
+        return { patterns: [] };
+    }
+}
+async function saveAllowlist(cwd, allowlist) {
+    const allowlistPath = (0, path_1.join)(cwd, ALLOWLIST_FILE);
+    const allowlistDir = (0, path_1.dirname)(allowlistPath);
+    await fs_1.promises.mkdir(allowlistDir, { recursive: true });
+    await fs_1.promises.writeFile(allowlistPath, JSON.stringify(allowlist, null, 2));
+}
+function isAllowlisted(finding, allowlist, cwd) {
+    const relativeFile = (0, path_1.relative)(cwd, finding.file);
+    return allowlist.patterns.some(pattern => {
+        return pattern.file === relativeFile &&
+            pattern.line === finding.line &&
+            pattern.type === finding.type;
+    });
+}
+async function addToAllowlist(cwd, finding, reason) {
+    const allowlist = await loadAllowlist(cwd);
+    const relativeFile = (0, path_1.relative)(cwd, finding.file);
+    allowlist.patterns.push({
+        file: relativeFile,
+        line: finding.line,
+        type: finding.type,
+        reason,
+        addedBy: process.env.USER || process.env.USERNAME || 'unknown',
+        addedAt: new Date().toISOString(),
+    });
+    await saveAllowlist(cwd, allowlist);
+}
+// Install pre-commit hook
+async function installPreCommitHook(cwd, hookPath) {
+    const gitHooksDir = (0, path_1.join)(cwd, '.git', 'hooks');
+    const hookFile = hookPath || (0, path_1.join)(gitHooksDir, 'pre-commit');
+    try {
+        // Check if .git/hooks exists
+        await fs_1.promises.access(gitHooksDir);
+    }
+    catch {
+        throw new Error('Not a git repository. Run "git init" first.');
+    }
+    // Get the CLI path - try to find it relative to the hook location
+    // In a published package, this would be in node_modules/@m2-ai/lattice-cli/dist/index.js
+    // For development, it's in packages/cli/dist/index.js
+    let cliPath;
+    try {
+        // Try to find the CLI in node_modules first (when installed as package)
+        const nodeModulesPath = (0, path_1.join)(cwd, 'node_modules', '@latticeai', 'cli', 'dist', 'index.js');
+        await fs_1.promises.access(nodeModulesPath);
+        cliPath = nodeModulesPath;
+    }
+    catch {
+        // Fall back to npx/latticeai command
+        cliPath = 'latticeai';
+    }
+    const hookContent = process.platform === 'win32'
+        ? `@echo off
+REM Lattice Security Scan Pre-commit Hook
+REM Generated by: lattice security-scan --install-hook
+
+${cliPath === 'latticeai' ? 'npx' : 'node'} "${cliPath}" security-scan --scan-git-history
+
+if %errorlevel% neq 0 (
+  echo.
+  echo ❌ Pre-commit hook failed: Security scan detected secrets
+  echo 💡 Tip: Run 'lattice security-scan --fix' to fix issues
+  exit /b 1
+)
+`
+        : `#!/bin/sh
+# Lattice Security Scan Pre-commit Hook
+# Generated by: lattice security-scan --install-hook
+
+${cliPath === 'latticeai' ? 'npx' : 'node'} "${cliPath}" security-scan --scan-git-history
+
+# Exit with error if scan fails
+if [ $? -ne 0 ]; then
+  echo ""
+  echo "❌ Pre-commit hook failed: Security scan detected secrets"
+  echo "💡 Tip: Run 'lattice security-scan --fix' to fix issues"
+  exit 1
+fi
+`;
+    await fs_1.promises.writeFile(hookFile, hookContent, { mode: process.platform === 'win32' ? undefined : 0o755 });
+    console.log(`✅ Pre-commit hook installed at: ${hookFile}`);
+    console.log(`   The hook will run security scans before each commit.`);
+}
+function generateSarifReport(result, cwd) {
+    const severityMap = {
+        critical: 'error',
+        high: 'error',
+        medium: 'warning',
+    };
+    return {
+        version: '2.1.0',
+        $schema: 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json',
+        runs: [{
+                tool: {
+                    driver: {
+                        name: 'Lattice Security Scan',
+                        version: '0.7.1',
+                    },
+                },
+                results: result.findings.map(finding => ({
+                    ruleId: finding.type.replace(/\s+/g, '_').replace(/[^a-zA-Z0-9_]/g, '_'),
+                    level: severityMap[finding.severity] || 'warning',
+                    message: {
+                        text: `${finding.type} found: ${finding.value}`,
+                    },
+                    locations: [{
+                            physicalLocation: {
+                                artifactLocation: {
+                                    uri: finding.file.replace(/\\/g, '/'), // Normalize path separators
+                                },
+                                region: {
+                                    startLine: finding.line || 1,
+                                    startColumn: finding.column || 1,
+                                },
+                            },
+                        }],
+                })),
+            }],
+    };
+}
+//# sourceMappingURL=commands.js.map