@sdt-tools/cli 0.2.0 → 0.2.5

package/dist/safer-alternative-QFVNLG3L.js

@@ -0,0 +1,89 @@
+import {
+  logger
+} from "./chunk-VM2H4LAO.js";
+import "./chunk-DGUM43GV.js";
+
+// src/commands/safer-alternative.ts
+import { promises as fs } from "fs";
+import { Command } from "commander";
+import { ai, saferAlternative } from "@sdt-tools/core";
+function saferAlternativeCommand() {
+  const cmd = new Command("safer-alternative");
+  cmd.description(
+    "AI-assist: propose a safer DDL alternative for a safety finding. Requires a configured AI provider (sdt ai status)."
+  ).requiredOption("--code <code>", "SafetyFindingCode (e.g. COLUMN_DROP, DROP_UNRECOVERABLE).").requiredOption("--fqn <fqn>", "Object FQN the finding refers to.").requiredOption("--object-type <type>", "Object type (e.g. TABLE, VIEW, STREAM).").requiredOption("--reason <text>", "Short reason text from the safety classifier.").option(
+    "--gate <gate>",
+    "Optional SafetyGate the finding raised (e.g. REQUIRE_ALLOW_DROP_COLUMN)."
+  ).option("--sql <path>", 'Path to a file with the dangerous DDL. Use "-" to read from stdin.').option("--context <path>", "Optional path to the surrounding source DDL.").option("--intent <text>", "Optional human-authored intent notes.").option("--format <fmt>", "Output format: text | json. Default text.", "text").option(
+    "--ai-max-spend <usd>",
+    "Refuse the call if today's estimated spend \u2265 this (USD). 0 = no cap.",
+    "0"
+  ).action(async (opts) => {
+    const dangerousSql = await readInput(
+      opts.sql,
+      '--sql is required (use a path or "-" for stdin).'
+    );
+    const contextSql = opts.context ? await fs.readFile(String(opts.context), "utf8") : void 0;
+    const finding = {
+      code: String(opts.code),
+      category: "DESTRUCTIVE",
+      fqn: String(opts.fqn),
+      objectType: String(opts.objectType),
+      reason: String(opts.reason),
+      gate: opts.gate ? String(opts.gate) : void 0
+    };
+    const result = await saferAlternative.suggestSaferAlternative(
+      {
+        finding,
+        dangerousSql,
+        contextSql,
+        intentNotes: opts.intent ? String(opts.intent) : void 0
+      },
+      {
+        completeFn: async (prompt) => {
+          const r = await ai.complete([{ role: "user", content: prompt }], {
+            feature: "safer-alternative",
+            maxSpendUsd: Number(opts.aiMaxSpend ?? "0") || 0
+          });
+          return r.text;
+        }
+      }
+    );
+    if (String(opts.format).toLowerCase() === "json") {
+      const { rawModelText: _omit, ...keep } = result;
+      console.log(JSON.stringify(keep, null, 2));
+      return;
+    }
+    logger.success(
+      `Confidence: ${result.confidence}${result.parseFailed ? " (parse failed)" : ""}`
+    );
+    logger.dim(`Reasoning: ${result.reasoning}`);
+    if (result.alternativeSql) {
+      console.log("");
+      console.log("--- Proposed safer DDL ---");
+      console.log(result.alternativeSql);
+    } else {
+      logger.warn("No safer alternative SQL was returned.");
+    }
+    if (result.requiredGates.length > 0) {
+      logger.dim(`Required gates: ${result.requiredGates.join(", ")}`);
+    }
+  });
+  return cmd;
+}
+async function readInput(pathOrDash, missingMessage) {
+  if (!pathOrDash) throw new Error(missingMessage);
+  const p = String(pathOrDash);
+  if (p === "-") {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+      chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+    }
+    return Buffer.concat(chunks).toString("utf8");
+  }
+  return fs.readFile(p, "utf8");
+}
+export {
+  saferAlternativeCommand
+};
+//# sourceMappingURL=safer-alternative-QFVNLG3L.js.map

package/dist/safer-alternative-QFVNLG3L.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/safer-alternative.ts"],"sourcesContent":["/**\n * `sdt safer-alternative` — call the AI provider to suggest a safer DDL\n * alternative for a flagged-as-dangerous migration step.\n *\n * Composes `@sdt-tools/core/saferAlternative.suggestSaferAlternative` with the\n * configured AI provider (`@sdt-tools/core/ai.complete`). The CLI is the thin\n * adapter; all the prompt-building and parsing lives in core so the\n * VS Code CodeLens / MCP server / future hosts share the same behavior.\n *\n * Inputs (all surfaced as flags):\n *   --code            SafetyFindingCode (e.g. COLUMN_DROP, DROP_UNRECOVERABLE)\n *   --fqn             Object FQN the finding refers to\n *   --object-type     Object type (e.g. TABLE, STREAM)\n *   --reason          Short reason from the safety classifier\n *   --gate            Optional SafetyGate (preserved on the suggestion)\n *   --sql <path>      Path to a file with the dangerous DDL (or \"-\" for stdin)\n *   --context <path>  Optional path to the surrounding source DDL\n *   --intent <text>   Optional human-authored intent notes\n *   --format          text | json (default text)\n */\nimport { promises as fs } from 'node:fs';\nimport { Command } from 'commander';\nimport { ai, saferAlternative, type safety } from '@sdt-tools/core';\nimport { logger } from '../util/logger.js';\n\nexport function saferAlternativeCommand(): Command {\n  const cmd = new Command('safer-alternative');\n  cmd\n    .description(\n      'AI-assist: propose a safer DDL alternative for a safety finding. Requires a configured AI provider (sdt ai status).',\n    )\n    .requiredOption('--code <code>', 'SafetyFindingCode (e.g. COLUMN_DROP, DROP_UNRECOVERABLE).')\n    .requiredOption('--fqn <fqn>', 'Object FQN the finding refers to.')\n    .requiredOption('--object-type <type>', 'Object type (e.g. TABLE, VIEW, STREAM).')\n    .requiredOption('--reason <text>', 'Short reason text from the safety classifier.')\n    .option(\n      '--gate <gate>',\n      'Optional SafetyGate the finding raised (e.g. REQUIRE_ALLOW_DROP_COLUMN).',\n    )\n    .option('--sql <path>', 'Path to a file with the dangerous DDL. Use \"-\" to read from stdin.')\n    .option('--context <path>', 'Optional path to the surrounding source DDL.')\n    .option('--intent <text>', 'Optional human-authored intent notes.')\n    .option('--format <fmt>', 'Output format: text | json. Default text.', 'text')\n    .option(\n      '--ai-max-spend <usd>',\n      \"Refuse the call if today's estimated spend ≥ this (USD). 0 = no cap.\",\n      '0',\n    )\n    .action(async (opts) => {\n      const dangerousSql = await readInput(\n        opts.sql,\n        '--sql is required (use a path or \"-\" for stdin).',\n      );\n      const contextSql = opts.context ? await fs.readFile(String(opts.context), 'utf8') : undefined;\n\n      const finding: safety.SafetyFinding = {\n        code: String(opts.code) as safety.SafetyFindingCode,\n        category: 'DESTRUCTIVE',\n        fqn: String(opts.fqn),\n        objectType: String(opts.objectType) as safety.SafetyFinding['objectType'],\n        reason: String(opts.reason),\n        gate: opts.gate ? (String(opts.gate) as safety.SafetyGate) : undefined,\n      };\n\n      const result = await saferAlternative.suggestSaferAlternative(\n        {\n          finding,\n          dangerousSql,\n          contextSql,\n          intentNotes: opts.intent ? String(opts.intent) : undefined,\n        },\n        {\n          completeFn: async (prompt) => {\n            const r = await ai.complete([{ role: 'user', content: prompt }], {\n              feature: 'safer-alternative',\n              maxSpendUsd: Number(opts.aiMaxSpend ?? '0') || 0,\n            });\n            return r.text;\n          },\n        },\n      );\n\n      if (String(opts.format).toLowerCase() === 'json') {\n        // Strip rawModelText from JSON output by default — it bloats the\n        // payload for downstream tooling. Keep it accessible via --format text.\n        const { rawModelText: _omit, ...keep } = result;\n        console.log(JSON.stringify(keep, null, 2));\n        return;\n      }\n\n      logger.success(\n        `Confidence: ${result.confidence}${result.parseFailed ? ' (parse failed)' : ''}`,\n      );\n      logger.dim(`Reasoning: ${result.reasoning}`);\n      if (result.alternativeSql) {\n        console.log('');\n        console.log('--- Proposed safer DDL ---');\n        console.log(result.alternativeSql);\n      } else {\n        logger.warn('No safer alternative SQL was returned.');\n      }\n      if (result.requiredGates.length > 0) {\n        logger.dim(`Required gates: ${result.requiredGates.join(', ')}`);\n      }\n    });\n  return cmd;\n}\n\nasync function readInput(pathOrDash: unknown, missingMessage: string): Promise<string> {\n  if (!pathOrDash) throw new Error(missingMessage);\n  const p = String(pathOrDash);\n  if (p === '-') {\n    const chunks: Buffer[] = [];\n    for await (const chunk of process.stdin) {\n      chunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : (chunk as Buffer));\n    }\n    return Buffer.concat(chunks).toString('utf8');\n  }\n  return fs.readFile(p, 'utf8');\n}\n"],"mappings":";;;;;;AAoBA,SAAS,YAAY,UAAU;AAC/B,SAAS,eAAe;AACxB,SAAS,IAAI,wBAAqC;AAG3C,SAAS,0BAAmC;AACjD,QAAM,MAAM,IAAI,QAAQ,mBAAmB;AAC3C,MACG;AAAA,IACC;AAAA,EACF,EACC,eAAe,iBAAiB,2DAA2D,EAC3F,eAAe,eAAe,mCAAmC,EACjE,eAAe,wBAAwB,yCAAyC,EAChF,eAAe,mBAAmB,+CAA+C,EACjF;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,gBAAgB,oEAAoE,EAC3F,OAAO,oBAAoB,8CAA8C,EACzE,OAAO,mBAAmB,uCAAuC,EACjE,OAAO,kBAAkB,6CAA6C,MAAM,EAC5E;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACC,OAAO,OAAO,SAAS;AACtB,UAAM,eAAe,MAAM;AAAA,MACzB,KAAK;AAAA,MACL;AAAA,IACF;AACA,UAAM,aAAa,KAAK,UAAU,MAAM,GAAG,SAAS,OAAO,KAAK,OAAO,GAAG,MAAM,IAAI;AAEpF,UAAM,UAAgC;AAAA,MACpC,MAAM,OAAO,KAAK,IAAI;AAAA,MACtB,UAAU;AAAA,MACV,KAAK,OAAO,KAAK,GAAG;AAAA,MACpB,YAAY,OAAO,KAAK,UAAU;AAAA,MAClC,QAAQ,OAAO,KAAK,MAAM;AAAA,MAC1B,MAAM,KAAK,OAAQ,OAAO,KAAK,IAAI,IAA0B;AAAA,IAC/D;AAEA,UAAM,SAAS,MAAM,iBAAiB;AAAA,MACpC;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA,aAAa,KAAK,SAAS,OAAO,KAAK,MAAM,IAAI;AAAA,MACnD;AAAA,MACA;AAAA,QACE,YAAY,OAAO,WAAW;AAC5B,gBAAM,IAAI,MAAM,GAAG,SAAS,CAAC,EAAE,MAAM,QAAQ,SAAS,OAAO,CAAC,GAAG;AAAA,YAC/D,SAAS;AAAA,YACT,aAAa,OAAO,KAAK,cAAc,GAAG,KAAK;AAAA,UACjD,CAAC;AACD,iBAAO,EAAE;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAEA,QAAI,OAAO,KAAK,MAAM,EAAE,YAAY,MAAM,QAAQ;AAGhD,YAAM,EAAE,cAAc,OAAO,GAAG,KAAK,IAAI;AACzC,cAAQ,IAAI,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AACzC;AAAA,IACF;AAEA,WAAO;AAAA,MACL,eAAe,OAAO,UAAU,GAAG,OAAO,cAAc,oBAAoB,EAAE;AAAA,IAChF;AACA,WAAO,IAAI,cAAc,OAAO,SAAS,EAAE;AAC3C,QAAI,OAAO,gBAAgB;AACzB,cAAQ,IAAI,EAAE;AACd,cAAQ,IAAI,4BAA4B;AACxC,cAAQ,IAAI,OAAO,cAAc;AAAA,IACnC,OAAO;AACL,aAAO,KAAK,wCAAwC;AAAA,IACtD;AACA,QAAI,OAAO,cAAc,SAAS,GAAG;AACnC,aAAO,IAAI,mBAAmB,OAAO,cAAc,KAAK,IAAI,CAAC,EAAE;AAAA,IACjE;AAAA,EACF,CAAC;AACH,SAAO;AACT;AAEA,eAAe,UAAU,YAAqB,gBAAyC;AACrF,MAAI,CAAC,WAAY,OAAM,IAAI,MAAM,cAAc;AAC/C,QAAM,IAAI,OAAO,UAAU;AAC3B,MAAI,MAAM,KAAK;AACb,UAAM,SAAmB,CAAC;AAC1B,qBAAiB,SAAS,QAAQ,OAAO;AACvC,aAAO,KAAK,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAK,KAAgB;AAAA,IAChF;AACA,WAAO,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM;AAAA,EAC9C;AACA,SAAO,GAAG,SAAS,GAAG,MAAM;AAC9B;","names":[]}

package/dist/safety-7QWRSUEZ.js

@@ -0,0 +1,168 @@
+import {
+  logger
+} from "./chunk-VM2H4LAO.js";
+import "./chunk-DGUM43GV.js";
+
+// src/commands/safety.ts
+import { Command } from "commander";
+import { safety as safetyApi } from "@sdt-tools/core";
+function safetyCommand() {
+  const cmd = new Command("safety");
+  cmd.description(
+    "Inspect the safety-finding catalog. See `sdt safety list` and `sdt safety explain <code>`."
+  );
+  cmd.command("list").description("List every known finding code with category + one-line summary.").option("--format <format>", "Output format: table | json", "table").option(
+    "--category <kind>",
+    "Filter to one category: unrecoverable | destructive | expensive | warning. Default: all."
+  ).action((opts) => {
+    const codes = safetyApi.listFindingCodes();
+    let entries = codes.map((c) => safetyApi.explainFinding(c)).filter((e) => e !== void 0);
+    if (opts.category) {
+      const want = opts.category.toUpperCase();
+      const valid = ["UNRECOVERABLE", "DESTRUCTIVE", "EXPENSIVE", "WARNING"];
+      if (!valid.includes(want)) {
+        logger.error(
+          `Unknown --category "${opts.category}". Use one of: ${valid.join(" | ").toLowerCase()}.`
+        );
+        process.exitCode = 1;
+        return;
+      }
+      entries = entries.filter((e) => e.category === want);
+    }
+    if ((opts.format ?? "table") === "json") {
+      process.stdout.write(JSON.stringify(entries, null, 2) + "\n");
+      return;
+    }
+    if (entries.length === 0) {
+      logger.dim("(no entries match the filter)");
+      return;
+    }
+    printList(entries);
+  });
+  cmd.command("explain").description('Expand a finding code into a deep "why this is dangerous" page.').argument("<code>", "The finding code (e.g. DROP_UNRECOVERABLE, COLUMN_TYPE_CHANGE)").option("--format <format>", "Output format: text | json | markdown", "text").action((codeArg, opts) => {
+    const code = codeArg.toUpperCase();
+    const entry = safetyApi.explainFinding(code);
+    if (!entry) {
+      logger.error(`Unknown safety finding code: "${codeArg}"`);
+      logger.dim("  Try: sdt safety list");
+      process.exitCode = 1;
+      return;
+    }
+    const format = (opts.format ?? "text").toLowerCase();
+    if (format === "json") {
+      process.stdout.write(JSON.stringify(entry, null, 2) + "\n");
+      return;
+    }
+    if (format === "markdown") {
+      process.stdout.write(renderMarkdown(entry) + "\n");
+      return;
+    }
+    printDeep(entry);
+  });
+  return cmd;
+}
+function printList(entries) {
+  const byCategory = /* @__PURE__ */ new Map();
+  for (const e of entries) {
+    const arr = byCategory.get(e.category) ?? [];
+    arr.push(e);
+    byCategory.set(e.category, arr);
+  }
+  const order = [
+    "UNRECOVERABLE",
+    "DESTRUCTIVE",
+    "EXPENSIVE",
+    "WARNING"
+  ];
+  for (const cat of order) {
+    const arr = byCategory.get(cat);
+    if (!arr || arr.length === 0) continue;
+    console.log(`# ${cat} (${arr.length})`);
+    for (const e of arr) {
+      console.log(`  ${e.code}`);
+      console.log(`    ${e.title}`);
+      console.log(`    ${e.summary}`);
+    }
+    console.log("");
+  }
+  console.log("Use `sdt safety explain <code>` for the full per-finding write-up.");
+}
+function printDeep(entry) {
+  console.log(`${entry.code}  [${entry.category}]`);
+  console.log(entry.title);
+  console.log("");
+  console.log("Summary");
+  console.log(`  ${entry.summary}`);
+  console.log("");
+  console.log("Why this is dangerous");
+  for (const line of wrap(entry.whyDangerous, 76)) {
+    console.log(`  ${line}`);
+  }
+  console.log("");
+  console.log("What cannot be reversed");
+  for (const item of entry.cannotBeReversed) console.log(`  - ${item}`);
+  console.log("");
+  console.log("Safer alternatives");
+  for (const item of entry.saferAlternatives) console.log(`  - ${item}`);
+  console.log("");
+  if (entry.requiredGates.length > 0) {
+    console.log("Required gates to allow this finding through");
+    for (const g of entry.requiredGates) console.log(`  - ${g}`);
+    console.log("");
+  }
+  if (entry.example) {
+    console.log("Example");
+    console.log(`  ${entry.example}`);
+  }
+}
+function renderMarkdown(entry) {
+  const lines = [];
+  lines.push(`## ${entry.code} \u2014 ${entry.title}`);
+  lines.push("");
+  lines.push(`**Category:** ${entry.category}`);
+  lines.push("");
+  lines.push(`**Summary:** ${entry.summary}`);
+  lines.push("");
+  lines.push("### Why this is dangerous");
+  lines.push(entry.whyDangerous);
+  lines.push("");
+  lines.push("### What cannot be reversed");
+  for (const item of entry.cannotBeReversed) lines.push(`- ${item}`);
+  lines.push("");
+  lines.push("### Safer alternatives");
+  for (const item of entry.saferAlternatives) lines.push(`- ${item}`);
+  if (entry.requiredGates.length > 0) {
+    lines.push("");
+    lines.push("### Required gates");
+    for (const g of entry.requiredGates) lines.push(`- \`${g}\``);
+  }
+  if (entry.example) {
+    lines.push("");
+    lines.push("### Example");
+    lines.push("```");
+    lines.push(entry.example);
+    lines.push("```");
+  }
+  return lines.join("\n");
+}
+function wrap(text, width) {
+  const words = text.split(/\s+/);
+  const lines = [];
+  let current = "";
+  for (const word of words) {
+    if (current.length === 0) {
+      current = word;
+    } else if (current.length + 1 + word.length <= width) {
+      current += " " + word;
+    } else {
+      lines.push(current);
+      current = word;
+    }
+  }
+  if (current.length > 0) lines.push(current);
+  return lines;
+}
+export {
+  safetyCommand
+};
+//# sourceMappingURL=safety-7QWRSUEZ.js.map

package/dist/safety-7QWRSUEZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/safety.ts"],"sourcesContent":["/**\n * `sdt safety` — inspect safety-finding codes.\n *\n * Subcommands:\n *   sdt safety list                       — list every known finding code with a one-line summary\n *   sdt safety explain <code>             — deep explainer for a single code: why it is dangerous,\n *                                           what cannot be reversed, safer alternatives, required gates\n *\n * The finding codes are stable identifiers attached to every `SafetyFinding`\n * the classifier emits during `sdt compare` / `sdt publish`. When the user\n * sees a finding they don't understand, they can copy the code and ask:\n *\n *     sdt safety explain DROP_UNRECOVERABLE\n *\n * See `docs/UX_PLAYBOOK.md` §3 (dangerous-op UX) and\n * `docs/AI_FEATURES.md` use case C2.\n */\nimport { Command } from 'commander';\nimport { safety as safetyApi } from '@sdt-tools/core';\nimport type { FindingExplanation, SafetyFindingCode } from '@sdt-tools/core/safety';\nimport { logger } from '../util/logger.js';\n\nexport function safetyCommand(): Command {\n  const cmd = new Command('safety');\n  cmd.description(\n    'Inspect the safety-finding catalog. See `sdt safety list` and `sdt safety explain <code>`.',\n  );\n\n  cmd\n    .command('list')\n    .description('List every known finding code with category + one-line summary.')\n    .option('--format <format>', 'Output format: table | json', 'table')\n    .option(\n      '--category <kind>',\n      'Filter to one category: unrecoverable | destructive | expensive | warning. Default: all.',\n    )\n    .action((opts: { format?: string; category?: string }) => {\n      const codes = safetyApi.listFindingCodes();\n      let entries = codes\n        .map((c) => safetyApi.explainFinding(c))\n        .filter((e): e is FindingExplanation => e !== undefined);\n      if (opts.category) {\n        const want = opts.category.toUpperCase();\n        const valid = ['UNRECOVERABLE', 'DESTRUCTIVE', 'EXPENSIVE', 'WARNING'];\n        if (!valid.includes(want)) {\n          logger.error(\n            `Unknown --category \"${opts.category}\". Use one of: ${valid.join(' | ').toLowerCase()}.`,\n          );\n          process.exitCode = 1;\n          return;\n        }\n        entries = entries.filter((e) => e.category === want);\n      }\n      if ((opts.format ?? 'table') === 'json') {\n        process.stdout.write(JSON.stringify(entries, null, 2) + '\\n');\n        return;\n      }\n      if (entries.length === 0) {\n        logger.dim('(no entries match the filter)');\n        return;\n      }\n      printList(entries);\n    });\n\n  cmd\n    .command('explain')\n    .description('Expand a finding code into a deep \"why this is dangerous\" page.')\n    .argument('<code>', 'The finding code (e.g. DROP_UNRECOVERABLE, COLUMN_TYPE_CHANGE)')\n    .option('--format <format>', 'Output format: text | json | markdown', 'text')\n    .action((codeArg: string, opts: { format?: string }) => {\n      const code = codeArg.toUpperCase() as SafetyFindingCode;\n      const entry = safetyApi.explainFinding(code);\n      if (!entry) {\n        logger.error(`Unknown safety finding code: \"${codeArg}\"`);\n        logger.dim('  Try: sdt safety list');\n        process.exitCode = 1;\n        return;\n      }\n      const format = (opts.format ?? 'text').toLowerCase();\n      if (format === 'json') {\n        process.stdout.write(JSON.stringify(entry, null, 2) + '\\n');\n        return;\n      }\n      if (format === 'markdown') {\n        process.stdout.write(renderMarkdown(entry) + '\\n');\n        return;\n      }\n      printDeep(entry);\n    });\n\n  return cmd;\n}\n\nfunction printList(entries: readonly FindingExplanation[]): void {\n  const byCategory = new Map<FindingExplanation['category'], FindingExplanation[]>();\n  for (const e of entries) {\n    const arr = byCategory.get(e.category) ?? [];\n    arr.push(e);\n    byCategory.set(e.category, arr);\n  }\n  const order: FindingExplanation['category'][] = [\n    'UNRECOVERABLE',\n    'DESTRUCTIVE',\n    'EXPENSIVE',\n    'WARNING',\n  ];\n  for (const cat of order) {\n    const arr = byCategory.get(cat);\n    if (!arr || arr.length === 0) continue;\n    console.log(`# ${cat} (${arr.length})`);\n    for (const e of arr) {\n      console.log(`  ${e.code}`);\n      console.log(`    ${e.title}`);\n      console.log(`    ${e.summary}`);\n    }\n    console.log('');\n  }\n  console.log('Use `sdt safety explain <code>` for the full per-finding write-up.');\n}\n\nfunction printDeep(entry: FindingExplanation): void {\n  console.log(`${entry.code}  [${entry.category}]`);\n  console.log(entry.title);\n  console.log('');\n  console.log('Summary');\n  console.log(`  ${entry.summary}`);\n  console.log('');\n  console.log('Why this is dangerous');\n  for (const line of wrap(entry.whyDangerous, 76)) {\n    console.log(`  ${line}`);\n  }\n  console.log('');\n  console.log('What cannot be reversed');\n  for (const item of entry.cannotBeReversed) console.log(`  - ${item}`);\n  console.log('');\n  console.log('Safer alternatives');\n  for (const item of entry.saferAlternatives) console.log(`  - ${item}`);\n  console.log('');\n  if (entry.requiredGates.length > 0) {\n    console.log('Required gates to allow this finding through');\n    for (const g of entry.requiredGates) console.log(`  - ${g}`);\n    console.log('');\n  }\n  if (entry.example) {\n    console.log('Example');\n    console.log(`  ${entry.example}`);\n  }\n}\n\nfunction renderMarkdown(entry: FindingExplanation): string {\n  const lines: string[] = [];\n  lines.push(`## ${entry.code} — ${entry.title}`);\n  lines.push('');\n  lines.push(`**Category:** ${entry.category}`);\n  lines.push('');\n  lines.push(`**Summary:** ${entry.summary}`);\n  lines.push('');\n  lines.push('### Why this is dangerous');\n  lines.push(entry.whyDangerous);\n  lines.push('');\n  lines.push('### What cannot be reversed');\n  for (const item of entry.cannotBeReversed) lines.push(`- ${item}`);\n  lines.push('');\n  lines.push('### Safer alternatives');\n  for (const item of entry.saferAlternatives) lines.push(`- ${item}`);\n  if (entry.requiredGates.length > 0) {\n    lines.push('');\n    lines.push('### Required gates');\n    for (const g of entry.requiredGates) lines.push(`- \\`${g}\\``);\n  }\n  if (entry.example) {\n    lines.push('');\n    lines.push('### Example');\n    lines.push('```');\n    lines.push(entry.example);\n    lines.push('```');\n  }\n  return lines.join('\\n');\n}\n\n/** Word-wrap a paragraph to fit `width` characters per line. */\nfunction wrap(text: string, width: number): string[] {\n  const words = text.split(/\\s+/);\n  const lines: string[] = [];\n  let current = '';\n  for (const word of words) {\n    if (current.length === 0) {\n      current = word;\n    } else if (current.length + 1 + word.length <= width) {\n      current += ' ' + word;\n    } else {\n      lines.push(current);\n      current = word;\n    }\n  }\n  if (current.length > 0) lines.push(current);\n  return lines;\n}\n"],"mappings":";;;;;;AAiBA,SAAS,eAAe;AACxB,SAAS,UAAU,iBAAiB;AAI7B,SAAS,gBAAyB;AACvC,QAAM,MAAM,IAAI,QAAQ,QAAQ;AAChC,MAAI;AAAA,IACF;AAAA,EACF;AAEA,MACG,QAAQ,MAAM,EACd,YAAY,iEAAiE,EAC7E,OAAO,qBAAqB,+BAA+B,OAAO,EAClE;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,CAAC,SAAiD;AACxD,UAAM,QAAQ,UAAU,iBAAiB;AACzC,QAAI,UAAU,MACX,IAAI,CAAC,MAAM,UAAU,eAAe,CAAC,CAAC,EACtC,OAAO,CAAC,MAA+B,MAAM,MAAS;AACzD,QAAI,KAAK,UAAU;AACjB,YAAM,OAAO,KAAK,SAAS,YAAY;AACvC,YAAM,QAAQ,CAAC,iBAAiB,eAAe,aAAa,SAAS;AACrE,UAAI,CAAC,MAAM,SAAS,IAAI,GAAG;AACzB,eAAO;AAAA,UACL,uBAAuB,KAAK,QAAQ,kBAAkB,MAAM,KAAK,KAAK,EAAE,YAAY,CAAC;AAAA,QACvF;AACA,gBAAQ,WAAW;AACnB;AAAA,MACF;AACA,gBAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,aAAa,IAAI;AAAA,IACrD;AACA,SAAK,KAAK,UAAU,aAAa,QAAQ;AACvC,cAAQ,OAAO,MAAM,KAAK,UAAU,SAAS,MAAM,CAAC,IAAI,IAAI;AAC5D;AAAA,IACF;AACA,QAAI,QAAQ,WAAW,GAAG;AACxB,aAAO,IAAI,+BAA+B;AAC1C;AAAA,IACF;AACA,cAAU,OAAO;AAAA,EACnB,CAAC;AAEH,MACG,QAAQ,SAAS,EACjB,YAAY,iEAAiE,EAC7E,SAAS,UAAU,gEAAgE,EACnF,OAAO,qBAAqB,yCAAyC,MAAM,EAC3E,OAAO,CAAC,SAAiB,SAA8B;AACtD,UAAM,OAAO,QAAQ,YAAY;AACjC,UAAM,QAAQ,UAAU,eAAe,IAAI;AAC3C,QAAI,CAAC,OAAO;AACV,aAAO,MAAM,iCAAiC,OAAO,GAAG;AACxD,aAAO,IAAI,wBAAwB;AACnC,cAAQ,WAAW;AACnB;AAAA,IACF;AACA,UAAM,UAAU,KAAK,UAAU,QAAQ,YAAY;AACnD,QAAI,WAAW,QAAQ;AACrB,cAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,MAAM,CAAC,IAAI,IAAI;AAC1D;AAAA,IACF;AACA,QAAI,WAAW,YAAY;AACzB,cAAQ,OAAO,MAAM,eAAe,KAAK,IAAI,IAAI;AACjD;AAAA,IACF;AACA,cAAU,KAAK;AAAA,EACjB,CAAC;AAEH,SAAO;AACT;AAEA,SAAS,UAAU,SAA8C;AAC/D,QAAM,aAAa,oBAAI,IAA0D;AACjF,aAAW,KAAK,SAAS;AACvB,UAAM,MAAM,WAAW,IAAI,EAAE,QAAQ,KAAK,CAAC;AAC3C,QAAI,KAAK,CAAC;AACV,eAAW,IAAI,EAAE,UAAU,GAAG;AAAA,EAChC;AACA,QAAM,QAA0C;AAAA,IAC9C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,aAAW,OAAO,OAAO;AACvB,UAAM,MAAM,WAAW,IAAI,GAAG;AAC9B,QAAI,CAAC,OAAO,IAAI,WAAW,EAAG;AAC9B,YAAQ,IAAI,KAAK,GAAG,KAAK,IAAI,MAAM,GAAG;AACtC,eAAW,KAAK,KAAK;AACnB,cAAQ,IAAI,KAAK,EAAE,IAAI,EAAE;AACzB,cAAQ,IAAI,OAAO,EAAE,KAAK,EAAE;AAC5B,cAAQ,IAAI,OAAO,EAAE,OAAO,EAAE;AAAA,IAChC;AACA,YAAQ,IAAI,EAAE;AAAA,EAChB;AACA,UAAQ,IAAI,oEAAoE;AAClF;AAEA,SAAS,UAAU,OAAiC;AAClD,UAAQ,IAAI,GAAG,MAAM,IAAI,MAAM,MAAM,QAAQ,GAAG;AAChD,UAAQ,IAAI,MAAM,KAAK;AACvB,UAAQ,IAAI,EAAE;AACd,UAAQ,IAAI,SAAS;AACrB,UAAQ,IAAI,KAAK,MAAM,OAAO,EAAE;AAChC,UAAQ,IAAI,EAAE;AACd,UAAQ,IAAI,uBAAuB;AACnC,aAAW,QAAQ,KAAK,MAAM,cAAc,EAAE,GAAG;AAC/C,YAAQ,IAAI,KAAK,IAAI,EAAE;AAAA,EACzB;AACA,UAAQ,IAAI,EAAE;AACd,UAAQ,IAAI,yBAAyB;AACrC,aAAW,QAAQ,MAAM,iBAAkB,SAAQ,IAAI,OAAO,IAAI,EAAE;AACpE,UAAQ,IAAI,EAAE;AACd,UAAQ,IAAI,oBAAoB;AAChC,aAAW,QAAQ,MAAM,kBAAmB,SAAQ,IAAI,OAAO,IAAI,EAAE;AACrE,UAAQ,IAAI,EAAE;AACd,MAAI,MAAM,cAAc,SAAS,GAAG;AAClC,YAAQ,IAAI,8CAA8C;AAC1D,eAAW,KAAK,MAAM,cAAe,SAAQ,IAAI,OAAO,CAAC,EAAE;AAC3D,YAAQ,IAAI,EAAE;AAAA,EAChB;AACA,MAAI,MAAM,SAAS;AACjB,YAAQ,IAAI,SAAS;AACrB,YAAQ,IAAI,KAAK,MAAM,OAAO,EAAE;AAAA,EAClC;AACF;AAEA,SAAS,eAAe,OAAmC;AACzD,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,MAAM,MAAM,IAAI,WAAM,MAAM,KAAK,EAAE;AAC9C,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,iBAAiB,MAAM,QAAQ,EAAE;AAC5C,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,gBAAgB,MAAM,OAAO,EAAE;AAC1C,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,2BAA2B;AACtC,QAAM,KAAK,MAAM,YAAY;AAC7B,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,6BAA6B;AACxC,aAAW,QAAQ,MAAM,iBAAkB,OAAM,KAAK,KAAK,IAAI,EAAE;AACjE,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,wBAAwB;AACnC,aAAW,QAAQ,MAAM,kBAAmB,OAAM,KAAK,KAAK,IAAI,EAAE;AAClE,MAAI,MAAM,cAAc,SAAS,GAAG;AAClC,UAAM,KAAK,EAAE;AACb,UAAM,KAAK,oBAAoB;AAC/B,eAAW,KAAK,MAAM,cAAe,OAAM,KAAK,OAAO,CAAC,IAAI;AAAA,EAC9D;AACA,MAAI,MAAM,SAAS;AACjB,UAAM,KAAK,EAAE;AACb,UAAM,KAAK,aAAa;AACxB,UAAM,KAAK,KAAK;AAChB,UAAM,KAAK,MAAM,OAAO;AACxB,UAAM,KAAK,KAAK;AAAA,EAClB;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAGA,SAAS,KAAK,MAAc,OAAyB;AACnD,QAAM,QAAQ,KAAK,MAAM,KAAK;AAC9B,QAAM,QAAkB,CAAC;AACzB,MAAI,UAAU;AACd,aAAW,QAAQ,OAAO;AACxB,QAAI,QAAQ,WAAW,GAAG;AACxB,gBAAU;AAAA,IACZ,WAAW,QAAQ,SAAS,IAAI,KAAK,UAAU,OAAO;AACpD,iBAAW,MAAM;AAAA,IACnB,OAAO;AACL,YAAM,KAAK,OAAO;AAClB,gBAAU;AAAA,IACZ;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,EAAG,OAAM,KAAK,OAAO;AAC1C,SAAO;AACT;","names":[]}

package/dist/savings-RHIXP6IT.js

@@ -0,0 +1,95 @@
+import "./chunk-DGUM43GV.js";
+
+// src/commands/savings.ts
+import { promises as fs } from "fs";
+import os from "os";
+import path from "path";
+import { Command } from "commander";
+import { discovery } from "@sdt-tools/core";
+import chalk from "chalk";
+var DEFAULT_STORE = path.join(os.homedir(), ".sdt", "token-savings.json");
+async function loadCounter(storePath) {
+  try {
+    const raw = await fs.readFile(storePath, "utf8");
+    return discovery.TokenSavingsCounter.deserialize(JSON.parse(raw));
+  } catch {
+    return new discovery.TokenSavingsCounter();
+  }
+}
+async function saveCounter(storePath, counter) {
+  await fs.mkdir(path.dirname(storePath), { recursive: true });
+  await fs.writeFile(storePath, JSON.stringify(counter.serialize(), null, 2) + "\n", "utf8");
+}
+function savingsCommand() {
+  const cmd = new Command("savings");
+  cmd.description("Show estimated AI token savings from using deterministic SDT surfaces.").option("--store <path>", "Override the savings JSON store path.", DEFAULT_STORE).option("--format <fmt>", "Output format: text | json.", "text").option("--top <n>", "Show top N channels by tokens saved (text format only).", "5").option("--reset", "Clear all recorded savings and exit.").action(async (opts) => {
+    const storePath = String(opts.store ?? DEFAULT_STORE);
+    const fmt = String(opts.format ?? "text").toLowerCase();
+    const topN = Math.max(1, Math.floor(parseInt(String(opts.top ?? "5"), 10) || 5));
+    if (opts.reset) {
+      const counter2 = new discovery.TokenSavingsCounter();
+      await saveCounter(storePath, counter2);
+      process.stdout.write(chalk.green("\u2705 Savings counter reset.\n"));
+      return;
+    }
+    const counter = await loadCounter(storePath);
+    const summary = counter.summary();
+    if (fmt === "json") {
+      const weeks2 = counter.summarizeByWeek();
+      const top2 = counter.topChannels(topN);
+      process.stdout.write(
+        JSON.stringify({ summary, weeklyBreakdown: weeks2, topChannels: top2 }, null, 2) + "\n"
+      );
+      return;
+    }
+    if (summary.eventCount === 0) {
+      process.stdout.write(
+        chalk.dim(
+          "  No savings recorded yet.\n  SDT records a saving every time you use explain, discover, lineage, or similar\n  deterministic surfaces instead of asking an AI.\n"
+        )
+      );
+      return;
+    }
+    const thousands = (n) => n >= 1e3 ? `${(n / 1e3).toFixed(1)}k` : String(n);
+    process.stdout.write("\n");
+    process.stdout.write(
+      chalk.bold(`  ${thousands(summary.totalTokens)} tokens saved`) + chalk.dim(` across ${summary.eventCount} interactions`) + "\n"
+    );
+    if (summary.sinceFirst) {
+      process.stdout.write(chalk.dim(`  Tracking since ${summary.sinceFirst.slice(0, 10)}
+`));
+    }
+    process.stdout.write("\n");
+    const top = counter.topChannels(topN);
+    if (top.length > 0) {
+      process.stdout.write(chalk.dim("  Top surfaces:\n"));
+      for (const { channel, tokens } of top) {
+        process.stdout.write(
+          `    ${chalk.cyan(channel.padEnd(28))}${thousands(tokens)} tokens
+`
+        );
+      }
+      process.stdout.write("\n");
+    }
+    const weeks = counter.summarizeByWeek().slice(0, 4);
+    if (weeks.length > 0) {
+      process.stdout.write(chalk.dim("  Weekly:\n"));
+      for (const bucket of weeks) {
+        process.stdout.write(
+          `    ${chalk.dim(bucket.week.padEnd(10))}${thousands(bucket.tokens)} tokens
+`
+        );
+      }
+      process.stdout.write("\n");
+    }
+    process.stdout.write(
+      chalk.dim(`  Store: ${storePath}
+`) + chalk.dim("  sdt savings --reset  \xB7  sdt savings --format json\n")
+    );
+  });
+  return cmd;
+}
+export {
+  savingsCommand
+};
+//# sourceMappingURL=savings-RHIXP6IT.js.map

package/dist/savings-RHIXP6IT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/savings.ts"],"sourcesContent":["/**\n * `sdt savings` — display estimated AI token savings accumulated by using\n * deterministic SDT surfaces instead of LLM calls.\n *\n * DSC.8: token-savings counter CLI.\n *\n *   $ sdt savings\n *   $ sdt savings --format json\n *   $ sdt savings --top 5\n *   $ sdt savings --reset\n *\n * Persistence: `~/.sdt/token-savings.json` (override with `--store <path>`).\n * The substrate (`@sdt-tools/core TokenSavingsCounter`) is pure in-memory; this\n * file is the disk-I/O boundary.\n *\n * Mirrors `Databricks/packages/cli/src/commands/savings.ts`.\n */\nimport { promises as fs } from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\nimport { Command } from 'commander';\nimport { discovery } from '@sdt-tools/core';\nimport chalk from 'chalk';\n\nconst DEFAULT_STORE = path.join(os.homedir(), '.sdt', 'token-savings.json');\n\nasync function loadCounter(storePath: string): Promise<discovery.TokenSavingsCounter> {\n  try {\n    const raw = await fs.readFile(storePath, 'utf8');\n    return discovery.TokenSavingsCounter.deserialize(JSON.parse(raw) as unknown);\n  } catch {\n    return new discovery.TokenSavingsCounter();\n  }\n}\n\nasync function saveCounter(\n  storePath: string,\n  counter: discovery.TokenSavingsCounter,\n): Promise<void> {\n  await fs.mkdir(path.dirname(storePath), { recursive: true });\n  await fs.writeFile(storePath, JSON.stringify(counter.serialize(), null, 2) + '\\n', 'utf8');\n}\n\nexport function savingsCommand(): Command {\n  const cmd = new Command('savings');\n  cmd\n    .description('Show estimated AI token savings from using deterministic SDT surfaces.')\n    .option('--store <path>', 'Override the savings JSON store path.', DEFAULT_STORE)\n    .option('--format <fmt>', 'Output format: text | json.', 'text')\n    .option('--top <n>', 'Show top N channels by tokens saved (text format only).', '5')\n    .option('--reset', 'Clear all recorded savings and exit.')\n    .action(async (opts) => {\n      const storePath = String(opts.store ?? DEFAULT_STORE);\n      const fmt = String(opts.format ?? 'text').toLowerCase();\n      const topN = Math.max(1, Math.floor(parseInt(String(opts.top ?? '5'), 10) || 5));\n\n      if (opts.reset) {\n        const counter = new discovery.TokenSavingsCounter();\n        await saveCounter(storePath, counter);\n        process.stdout.write(chalk.green('✅ Savings counter reset.\\n'));\n        return;\n      }\n\n      const counter = await loadCounter(storePath);\n      const summary = counter.summary();\n\n      if (fmt === 'json') {\n        const weeks = counter.summarizeByWeek();\n        const top = counter.topChannels(topN);\n        process.stdout.write(\n          JSON.stringify({ summary, weeklyBreakdown: weeks, topChannels: top }, null, 2) + '\\n',\n        );\n        return;\n      }\n\n      if (summary.eventCount === 0) {\n        process.stdout.write(\n          chalk.dim(\n            '  No savings recorded yet.\\n' +\n              '  SDT records a saving every time you use explain, discover, lineage, or similar\\n' +\n              '  deterministic surfaces instead of asking an AI.\\n',\n          ),\n        );\n        return;\n      }\n\n      const thousands = (n: number): string =>\n        n >= 1000 ? `${(n / 1000).toFixed(1)}k` : String(n);\n\n      process.stdout.write('\\n');\n      process.stdout.write(\n        chalk.bold(`  ${thousands(summary.totalTokens)} tokens saved`) +\n          chalk.dim(` across ${summary.eventCount} interactions`) +\n          '\\n',\n      );\n      if (summary.sinceFirst) {\n        process.stdout.write(chalk.dim(`  Tracking since ${summary.sinceFirst.slice(0, 10)}\\n`));\n      }\n      process.stdout.write('\\n');\n\n      const top = counter.topChannels(topN);\n      if (top.length > 0) {\n        process.stdout.write(chalk.dim('  Top surfaces:\\n'));\n        for (const { channel, tokens } of top) {\n          process.stdout.write(\n            `    ${chalk.cyan(channel.padEnd(28))}${thousands(tokens)} tokens\\n`,\n          );\n        }\n        process.stdout.write('\\n');\n      }\n\n      const weeks = counter.summarizeByWeek().slice(0, 4);\n      if (weeks.length > 0) {\n        process.stdout.write(chalk.dim('  Weekly:\\n'));\n        for (const bucket of weeks) {\n          process.stdout.write(\n            `    ${chalk.dim(bucket.week.padEnd(10))}${thousands(bucket.tokens)} tokens\\n`,\n          );\n        }\n        process.stdout.write('\\n');\n      }\n\n      process.stdout.write(\n        chalk.dim(`  Store: ${storePath}\\n`) +\n          chalk.dim('  sdt savings --reset  ·  sdt savings --format json\\n'),\n      );\n    });\n\n  return cmd;\n}\n"],"mappings":";;;AAiBA,SAAS,YAAY,UAAU;AAC/B,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,SAAS,eAAe;AACxB,SAAS,iBAAiB;AAC1B,OAAO,WAAW;AAElB,IAAM,gBAAgB,KAAK,KAAK,GAAG,QAAQ,GAAG,QAAQ,oBAAoB;AAE1E,eAAe,YAAY,WAA2D;AACpF,MAAI;AACF,UAAM,MAAM,MAAM,GAAG,SAAS,WAAW,MAAM;AAC/C,WAAO,UAAU,oBAAoB,YAAY,KAAK,MAAM,GAAG,CAAY;AAAA,EAC7E,QAAQ;AACN,WAAO,IAAI,UAAU,oBAAoB;AAAA,EAC3C;AACF;AAEA,eAAe,YACb,WACA,SACe;AACf,QAAM,GAAG,MAAM,KAAK,QAAQ,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;AAC3D,QAAM,GAAG,UAAU,WAAW,KAAK,UAAU,QAAQ,UAAU,GAAG,MAAM,CAAC,IAAI,MAAM,MAAM;AAC3F;AAEO,SAAS,iBAA0B;AACxC,QAAM,MAAM,IAAI,QAAQ,SAAS;AACjC,MACG,YAAY,wEAAwE,EACpF,OAAO,kBAAkB,yCAAyC,aAAa,EAC/E,OAAO,kBAAkB,+BAA+B,MAAM,EAC9D,OAAO,aAAa,2DAA2D,GAAG,EAClF,OAAO,WAAW,sCAAsC,EACxD,OAAO,OAAO,SAAS;AACtB,UAAM,YAAY,OAAO,KAAK,SAAS,aAAa;AACpD,UAAM,MAAM,OAAO,KAAK,UAAU,MAAM,EAAE,YAAY;AACtD,UAAM,OAAO,KAAK,IAAI,GAAG,KAAK,MAAM,SAAS,OAAO,KAAK,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AAE/E,QAAI,KAAK,OAAO;AACd,YAAMA,WAAU,IAAI,UAAU,oBAAoB;AAClD,YAAM,YAAY,WAAWA,QAAO;AACpC,cAAQ,OAAO,MAAM,MAAM,MAAM,iCAA4B,CAAC;AAC9D;AAAA,IACF;AAEA,UAAM,UAAU,MAAM,YAAY,SAAS;AAC3C,UAAM,UAAU,QAAQ,QAAQ;AAEhC,QAAI,QAAQ,QAAQ;AAClB,YAAMC,SAAQ,QAAQ,gBAAgB;AACtC,YAAMC,OAAM,QAAQ,YAAY,IAAI;AACpC,cAAQ,OAAO;AAAA,QACb,KAAK,UAAU,EAAE,SAAS,iBAAiBD,QAAO,aAAaC,KAAI,GAAG,MAAM,CAAC,IAAI;AAAA,MACnF;AACA;AAAA,IACF;AAEA,QAAI,QAAQ,eAAe,GAAG;AAC5B,cAAQ,OAAO;AAAA,QACb,MAAM;AAAA,UACJ;AAAA,QAGF;AAAA,MACF;AACA;AAAA,IACF;AAEA,UAAM,YAAY,CAAC,MACjB,KAAK,MAAO,IAAI,IAAI,KAAM,QAAQ,CAAC,CAAC,MAAM,OAAO,CAAC;AAEpD,YAAQ,OAAO,MAAM,IAAI;AACzB,YAAQ,OAAO;AAAA,MACb,MAAM,KAAK,KAAK,UAAU,QAAQ,WAAW,CAAC,eAAe,IAC3D,MAAM,IAAI,WAAW,QAAQ,UAAU,eAAe,IACtD;AAAA,IACJ;AACA,QAAI,QAAQ,YAAY;AACtB,cAAQ,OAAO,MAAM,MAAM,IAAI,oBAAoB,QAAQ,WAAW,MAAM,GAAG,EAAE,CAAC;AAAA,CAAI,CAAC;AAAA,IACzF;AACA,YAAQ,OAAO,MAAM,IAAI;AAEzB,UAAM,MAAM,QAAQ,YAAY,IAAI;AACpC,QAAI,IAAI,SAAS,GAAG;AAClB,cAAQ,OAAO,MAAM,MAAM,IAAI,mBAAmB,CAAC;AACnD,iBAAW,EAAE,SAAS,OAAO,KAAK,KAAK;AACrC,gBAAQ,OAAO;AAAA,UACb,OAAO,MAAM,KAAK,QAAQ,OAAO,EAAE,CAAC,CAAC,GAAG,UAAU,MAAM,CAAC;AAAA;AAAA,QAC3D;AAAA,MACF;AACA,cAAQ,OAAO,MAAM,IAAI;AAAA,IAC3B;AAEA,UAAM,QAAQ,QAAQ,gBAAgB,EAAE,MAAM,GAAG,CAAC;AAClD,QAAI,MAAM,SAAS,GAAG;AACpB,cAAQ,OAAO,MAAM,MAAM,IAAI,aAAa,CAAC;AAC7C,iBAAW,UAAU,OAAO;AAC1B,gBAAQ,OAAO;AAAA,UACb,OAAO,MAAM,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC,CAAC,GAAG,UAAU,OAAO,MAAM,CAAC;AAAA;AAAA,QACrE;AAAA,MACF;AACA,cAAQ,OAAO,MAAM,IAAI;AAAA,IAC3B;AAEA,YAAQ,OAAO;AAAA,MACb,MAAM,IAAI,YAAY,SAAS;AAAA,CAAI,IACjC,MAAM,IAAI,0DAAuD;AAAA,IACrE;AAAA,EACF,CAAC;AAEH,SAAO;AACT;","names":["counter","weeks","top"]}

package/dist/scan-secrets-5YCQ4UCU.js

@@ -0,0 +1,54 @@
+import "./chunk-DGUM43GV.js";
+
+// src/commands/scan-secrets.ts
+import { promises as fs } from "fs";
+import path from "path";
+import { Command } from "commander";
+import { pac, project, secretScanner } from "@sdt-tools/core";
+function scanSecretsCommand() {
+  const cmd = new Command("scan-secrets");
+  cmd.description("Scan a project or pac for hardcoded credentials in DDL bodies.").requiredOption("--source <path>", ".sdtproj or .sdtpac to scan.").option(
+    "--strict",
+    "Exit 1 on any finding (errors or warnings). Default: exit 1 on errors only.",
+    false
+  ).option("--format <fmt>", "table | json | markdown. Default table.", "table").option("-o, --out <path>", "Output file path. Defaults to stdout.").action(async (opts) => {
+    const sourcePath = String(opts.source);
+    const model = await loadModel(sourcePath);
+    const result = secretScanner.scanSecrets(model, { strict: opts.strict });
+    const fmt = (opts.format ?? "table").toLowerCase();
+    let payload;
+    if (fmt === "json") {
+      payload = JSON.stringify(result, null, 2);
+    } else if (fmt === "markdown") {
+      payload = secretScanner.formatSecretReportMarkdown(result);
+    } else {
+      payload = secretScanner.formatSecretReport(result);
+    }
+    if (opts.out) {
+      const out = path.resolve(String(opts.out));
+      await fs.mkdir(path.dirname(out), { recursive: true });
+      await fs.writeFile(out, payload + (payload.endsWith("\n") ? "" : "\n"), "utf8");
+      console.error(
+        `Wrote ${out} (${result.findings.length} finding(s): ${result.errorCount} error(s), ${result.warningCount} warning(s)).`
+      );
+    } else {
+      process.stdout.write(payload + (payload.endsWith("\n") ? "" : "\n"));
+    }
+    if (result.errorCount > 0 || opts.strict && result.findings.length > 0) {
+      process.exitCode = 1;
+    }
+  });
+  return cmd;
+}
+async function loadModel(sourcePath) {
+  if (sourcePath.endsWith(".sdtpac")) {
+    const c = await pac.readPac(sourcePath);
+    return c.model;
+  }
+  const loaded = await project.loadProject(sourcePath);
+  return await project.parseProjectModel(loaded);
+}
+export {
+  scanSecretsCommand
+};
+//# sourceMappingURL=scan-secrets-5YCQ4UCU.js.map

package/dist/scan-secrets-5YCQ4UCU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/scan-secrets.ts"],"sourcesContent":["/**\n * `sdt scan-secrets` — scan a project's DDL bodies for hardcoded credentials.\n *\n * Covers: passwords (IDENTIFIED BY), OAuth client_secret literals, AWS keys,\n * OpenAI keys, GitHub tokens, Slack tokens, JWTs, PEM private-key blocks,\n * Snowflake account-locator URLs, and generic high-entropy credential fields.\n *\n * Exit codes:\n *   0 — clean (or only warnings in non-strict mode)\n *   1 — errors found (always) or any finding in --strict mode\n *\n * Mirrors `ddt scan-secrets`.\n */\nimport { promises as fs } from 'node:fs';\nimport path from 'node:path';\nimport { Command } from 'commander';\nimport { pac, project, secretScanner } from '@sdt-tools/core';\n\nexport function scanSecretsCommand(): Command {\n  const cmd = new Command('scan-secrets');\n  cmd\n    .description('Scan a project or pac for hardcoded credentials in DDL bodies.')\n    .requiredOption('--source <path>', '.sdtproj or .sdtpac to scan.')\n    .option(\n      '--strict',\n      'Exit 1 on any finding (errors or warnings). Default: exit 1 on errors only.',\n      false,\n    )\n    .option('--format <fmt>', 'table | json | markdown. Default table.', 'table')\n    .option('-o, --out <path>', 'Output file path. Defaults to stdout.')\n    .action(async (opts: { source: string; strict?: boolean; format?: string; out?: string }) => {\n      const sourcePath = String(opts.source);\n      const model = await loadModel(sourcePath);\n      const result = secretScanner.scanSecrets(model, { strict: opts.strict });\n\n      const fmt = (opts.format ?? 'table').toLowerCase();\n      let payload: string;\n      if (fmt === 'json') {\n        payload = JSON.stringify(result, null, 2);\n      } else if (fmt === 'markdown') {\n        payload = secretScanner.formatSecretReportMarkdown(result);\n      } else {\n        payload = secretScanner.formatSecretReport(result);\n      }\n\n      if (opts.out) {\n        const out = path.resolve(String(opts.out));\n        await fs.mkdir(path.dirname(out), { recursive: true });\n        await fs.writeFile(out, payload + (payload.endsWith('\\n') ? '' : '\\n'), 'utf8');\n        console.error(\n          `Wrote ${out} (${result.findings.length} finding(s): ${result.errorCount} error(s), ${result.warningCount} warning(s)).`,\n        );\n      } else {\n        process.stdout.write(payload + (payload.endsWith('\\n') ? '' : '\\n'));\n      }\n\n      if (result.errorCount > 0 || (opts.strict && result.findings.length > 0)) {\n        process.exitCode = 1;\n      }\n    });\n\n  return cmd;\n}\n\nasync function loadModel(sourcePath: string) {\n  if (sourcePath.endsWith('.sdtpac')) {\n    const c = await pac.readPac(sourcePath);\n    return c.model;\n  }\n  const loaded = await project.loadProject(sourcePath);\n  return await project.parseProjectModel(loaded);\n}\n"],"mappings":";;;AAaA,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AACjB,SAAS,eAAe;AACxB,SAAS,KAAK,SAAS,qBAAqB;AAErC,SAAS,qBAA8B;AAC5C,QAAM,MAAM,IAAI,QAAQ,cAAc;AACtC,MACG,YAAY,gEAAgE,EAC5E,eAAe,mBAAmB,8BAA8B,EAChE;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACC,OAAO,kBAAkB,2CAA2C,OAAO,EAC3E,OAAO,oBAAoB,uCAAuC,EAClE,OAAO,OAAO,SAA8E;AAC3F,UAAM,aAAa,OAAO,KAAK,MAAM;AACrC,UAAM,QAAQ,MAAM,UAAU,UAAU;AACxC,UAAM,SAAS,cAAc,YAAY,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC;AAEvE,UAAM,OAAO,KAAK,UAAU,SAAS,YAAY;AACjD,QAAI;AACJ,QAAI,QAAQ,QAAQ;AAClB,gBAAU,KAAK,UAAU,QAAQ,MAAM,CAAC;AAAA,IAC1C,WAAW,QAAQ,YAAY;AAC7B,gBAAU,cAAc,2BAA2B,MAAM;AAAA,IAC3D,OAAO;AACL,gBAAU,cAAc,mBAAmB,MAAM;AAAA,IACnD;AAEA,QAAI,KAAK,KAAK;AACZ,YAAM,MAAM,KAAK,QAAQ,OAAO,KAAK,GAAG,CAAC;AACzC,YAAM,GAAG,MAAM,KAAK,QAAQ,GAAG,GAAG,EAAE,WAAW,KAAK,CAAC;AACrD,YAAM,GAAG,UAAU,KAAK,WAAW,QAAQ,SAAS,IAAI,IAAI,KAAK,OAAO,MAAM;AAC9E,cAAQ;AAAA,QACN,SAAS,GAAG,KAAK,OAAO,SAAS,MAAM,gBAAgB,OAAO,UAAU,cAAc,OAAO,YAAY;AAAA,MAC3G;AAAA,IACF,OAAO;AACL,cAAQ,OAAO,MAAM,WAAW,QAAQ,SAAS,IAAI,IAAI,KAAK,KAAK;AAAA,IACrE;AAEA,QAAI,OAAO,aAAa,KAAM,KAAK,UAAU,OAAO,SAAS,SAAS,GAAI;AACxE,cAAQ,WAAW;AAAA,IACrB;AAAA,EACF,CAAC;AAEH,SAAO;AACT;AAEA,eAAe,UAAU,YAAoB;AAC3C,MAAI,WAAW,SAAS,SAAS,GAAG;AAClC,UAAM,IAAI,MAAM,IAAI,QAAQ,UAAU;AACtC,WAAO,EAAE;AAAA,EACX;AACA,QAAM,SAAS,MAAM,QAAQ,YAAY,UAAU;AACnD,SAAO,MAAM,QAAQ,kBAAkB,MAAM;AAC/C;","names":[]}