@secr/cli 0.1.0

package/README.md

@@ -0,0 +1,64 @@
+# @secr/cli
+
+Command-line tool for [secr](https://secr.dev) — secrets management for teams.
+
+## Install
+
+```bash
+# Homebrew (macOS / Linux)
+brew tap secr-dev/secr
+brew install secr
+
+# npm
+npm install -g @secr/cli
+```
+
+## Quick Start
+
+```bash
+# Authenticate
+secr login
+
+# Create a project
+secr init
+
+# Add secrets
+secr set DATABASE_URL=postgres://...
+secr set --from-env .env
+
+# Use secrets (zero-disk injection)
+secr run "npm start"
+
+# Pull secrets
+secr pull --format dotenv > .env.local
+```
+
+## Commands
+
+| Command | Description |
+|---------|-------------|
+| `secr login` | Authenticate with secr |
+| `secr init` | Create a new project |
+| `secr link` | Link to an existing project |
+| `secr set` | Set one or more secrets |
+| `secr pull` | Pull decrypted secrets |
+| `secr run` | Run a command with secrets injected |
+| `secr ls` | List secret keys |
+| `secr delete` | Delete secrets |
+| `secr diff` | Compare environments |
+| `secr promote` | Copy secrets between environments |
+| `secr template` | Manage required key templates |
+| `secr scan` | Detect leaked secrets in your codebase |
+| `secr guard` | Install pre-commit secret scanning hook |
+| `secr env` | Manage environments |
+| `secr rotate-key` | Rotate project encryption key |
+| `secr log` | View audit log |
+| `secr completion` | Shell completions (bash/zsh/fish) |
+
+## Documentation
+
+Full docs at [secr.dev/docs](https://secr.dev/docs).
+
+## License
+
+MIT

package/dist/commands/completion.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const completionCommand: Command;
+//# sourceMappingURL=completion.d.ts.map

package/dist/commands/completion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"completion.d.ts","sourceRoot":"","sources":["../../src/commands/completion.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuBpC,eAAO,MAAM,iBAAiB,SA4B1B,CAAC"}

package/dist/commands/completion.js

@@ -0,0 +1,51 @@
+import { Command } from "commander";
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+import { dirname, join } from "path";
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const SHELLS = {
+    bash: {
+        file: "bash.sh",
+        hint: 'Add to ~/.bashrc:\n  eval "$(secr completion bash)"',
+    },
+    zsh: {
+        file: "zsh.sh",
+        hint: 'Add to ~/.zshrc:\n  eval "$(secr completion zsh)"',
+    },
+    fish: {
+        file: "fish.fish",
+        hint: "Save to ~/.config/fish/completions/secr.fish:\n  secr completion fish > ~/.config/fish/completions/secr.fish",
+    },
+};
+export const completionCommand = new Command("completion")
+    .description("Output shell completion script")
+    .argument("<shell>", "Shell type: bash, zsh, or fish")
+    .action((shell) => {
+    const config = SHELLS[shell];
+    if (!config) {
+        console.error(`Unknown shell: ${shell}. Supported: bash, zsh, fish`);
+        process.exit(1);
+    }
+    const scriptPath = join(__dirname, "..", "completions", config.file);
+    try {
+        const script = readFileSync(scriptPath, "utf-8");
+        // Script to stdout, install hints to stderr so piping works
+        process.stdout.write(script);
+        process.stderr.write(`\n# Install:\n# ${config.hint}\n`);
+    }
+    catch {
+        // Try from the same directory (when completions are next to commands in dist/)
+        const altPath = join(__dirname, "completions", config.file);
+        try {
+            const script = readFileSync(altPath, "utf-8");
+            process.stdout.write(script);
+            process.stderr.write(`\n# Install:\n# ${config.hint}\n`);
+        }
+        catch {
+            console.error(`Completion script not found. Ensure the package is installed correctly.`);
+            process.exit(1);
+        }
+    }
+});
+//# sourceMappingURL=completion.js.map

package/dist/commands/completion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"completion.js","sourceRoot":"","sources":["../../src/commands/completion.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAErC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,MAAM,MAAM,GAAmD;IAC7D,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,qDAAqD;KAC5D;IACD,GAAG,EAAE;QACH,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,mDAAmD;KAC1D;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,8GAA8G;KACrH;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,OAAO,CAAC,YAAY,CAAC;KACvD,WAAW,CAAC,gCAAgC,CAAC;KAC7C,QAAQ,CAAC,SAAS,EAAE,gCAAgC,CAAC;KACrD,MAAM,CAAC,CAAC,KAAa,EAAE,EAAE;IACxB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,kBAAkB,KAAK,8BAA8B,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACjD,4DAA4D;QAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,+EAA+E;QAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;YACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/commands/config.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const configCommand: Command;
+//# sourceMappingURL=config.d.ts.map

package/dist/commands/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiEpC,eAAO,MAAM,aAAa,SAGE,CAAC"}

package/dist/commands/config.js

@@ -0,0 +1,66 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import ora from "ora";
+import { readFileSync, writeFileSync } from "node:fs";
+import { requireProjectConfig } from "../lib/config.js";
+import { resolveOrgId, apiExportProjectConfig, apiImportProjectConfig } from "../lib/api.js";
+const exportCommand = new Command("export")
+    .description("Export project config (environments and templates)")
+    .option("-o, --output <file>", "Write config to a file instead of stdout")
+    .action(async (opts) => {
+    const config = requireProjectConfig();
+    const spinner = ora("Exporting project config...").start();
+    try {
+        const orgId = await resolveOrgId(config.org);
+        const result = await apiExportProjectConfig(orgId, config.project);
+        const json = JSON.stringify(result, null, 2);
+        if (opts.output) {
+            writeFileSync(opts.output, json + "\n", "utf-8");
+            spinner.succeed(chalk.green(`Config written to ${chalk.bold(opts.output)}`));
+        }
+        else {
+            spinner.stop();
+            console.log(json);
+        }
+    }
+    catch (err) {
+        spinner.fail(chalk.red(err.message));
+        process.exit(1);
+    }
+});
+const importCommand = new Command("import")
+    .description("Import project config (environments and templates)")
+    .argument("<file>", "JSON config file to import")
+    .action(async (file) => {
+    const projectConfig = requireProjectConfig();
+    const spinner = ora("Importing project config...").start();
+    try {
+        const raw = readFileSync(file, "utf-8");
+        const config = JSON.parse(raw);
+        const orgId = await resolveOrgId(projectConfig.org);
+        const result = await apiImportProjectConfig(orgId, projectConfig.project, config);
+        const parts = [];
+        if (result.environments.created > 0) {
+            parts.push(`${result.environments.created} environment${result.environments.created !== 1 ? "s" : ""} created`);
+        }
+        if (result.environments.skipped > 0) {
+            parts.push(`${result.environments.skipped} environment${result.environments.skipped !== 1 ? "s" : ""} skipped`);
+        }
+        if (result.templates.created > 0) {
+            parts.push(`${result.templates.created} template${result.templates.created !== 1 ? "s" : ""} created`);
+        }
+        if (result.templates.skipped > 0) {
+            parts.push(`${result.templates.skipped} template${result.templates.skipped !== 1 ? "s" : ""} skipped`);
+        }
+        spinner.succeed(chalk.green(parts.length > 0 ? parts.join(", ") : "Nothing to import"));
+    }
+    catch (err) {
+        spinner.fail(chalk.red(err.message));
+        process.exit(1);
+    }
+});
+export const configCommand = new Command("config")
+    .description("Export and import project configuration")
+    .addCommand(exportCommand)
+    .addCommand(importCommand);
+//# sourceMappingURL=config.js.map

package/dist/commands/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAE7F,MAAM,aAAa,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC;KACxC,WAAW,CAAC,oDAAoD,CAAC;KACjE,MAAM,CAAC,qBAAqB,EAAE,0CAA0C,CAAC;KACzE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,GAAG,CAAC,6BAA6B,CAAC,CAAC,KAAK,EAAE,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAE7C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;YACjD,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,qBAAqB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,aAAa,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC;KACxC,WAAW,CAAC,oDAAoD,CAAC;KACjE,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;KAChD,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;IAC7B,MAAM,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,6BAA6B,CAAC,CAAC,KAAK,EAAE,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE/B,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAElF,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,eAAe,MAAM,CAAC,YAAY,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QAClH,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,eAAe,MAAM,CAAC,YAAY,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QAClH,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,YAAY,MAAM,CAAC,SAAS,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,YAAY,MAAM,CAAC,SAAS,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACzG,CAAC;QAED,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC;KAC/C,WAAW,CAAC,yCAAyC,CAAC;KACtD,UAAU,CAAC,aAAa,CAAC;KACzB,UAAU,CAAC,aAAa,CAAC,CAAC"}

package/dist/commands/delete.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const deleteCommand: Command;
+//# sourceMappingURL=delete.d.ts.map

package/dist/commands/delete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../src/commands/delete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiBpC,eAAO,MAAM,aAAa,SA0CtB,CAAC"}

package/dist/commands/delete.js

@@ -0,0 +1,58 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import ora from "ora";
+import readline from "node:readline";
+import { requireProjectConfig } from "../lib/config.js";
+import { apiDeleteSecret, apiBulkDeleteSecrets } from "../lib/api.js";
+function confirm(question) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer.trim().toLowerCase() === "y");
+        });
+    });
+}
+export const deleteCommand = new Command("delete")
+    .description("Delete one or more secrets")
+    .argument("<keys...>", "Secret key(s) to delete")
+    .option("--env <environment>", "Override the default environment")
+    .option("--force", "Skip confirmation prompt")
+    .action(async (keys, opts) => {
+    const config = requireProjectConfig();
+    const env = opts.env || config.defaultEnvironment;
+    if (!opts.force) {
+        const keyList = keys.length === 1 ? chalk.bold(keys[0]) : keys.map((k) => chalk.bold(k)).join(", ");
+        const yes = await confirm(chalk.yellow(`  Delete ${keyList} from ${config.project}/${env}? (y/N) `));
+        if (!yes) {
+            console.log(chalk.dim("  Cancelled."));
+            return;
+        }
+    }
+    if (keys.length === 1) {
+        const spinner = ora(`Deleting ${chalk.cyan(keys[0])}...`).start();
+        try {
+            await apiDeleteSecret(config.org, config.project, env, keys[0]);
+            spinner.succeed(chalk.green(`${chalk.bold(keys[0])} deleted from ${config.project}/${env}`));
+        }
+        catch (err) {
+            spinner.fail(chalk.red(err.message));
+            process.exit(1);
+        }
+    }
+    else {
+        const spinner = ora(`Deleting ${chalk.cyan(String(keys.length))} secrets...`).start();
+        try {
+            const result = await apiBulkDeleteSecrets(config.org, config.project, env, keys);
+            spinner.succeed(chalk.green(`${result.deleted} deleted from ${config.project}/${env}`));
+            if (result.notFound.length > 0) {
+                console.log(chalk.yellow(`  Not found: ${result.notFound.join(", ")}`));
+            }
+        }
+        catch (err) {
+            spinner.fail(chalk.red(err.message));
+            process.exit(1);
+        }
+    }
+});
+//# sourceMappingURL=delete.js.map

package/dist/commands/delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.js","sourceRoot":"","sources":["../../src/commands/delete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,QAAQ,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAEtE,SAAS,OAAO,CAAC,QAAgB;IAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/B,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC;KAC/C,WAAW,CAAC,4BAA4B,CAAC;KACzC,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC;KAChD,MAAM,CAAC,qBAAqB,EAAE,kCAAkC,CAAC;KACjE,MAAM,CAAC,SAAS,EAAE,0BAA0B,CAAC;KAC7C,MAAM,CAAC,KAAK,EAAE,IAAc,EAAE,IAAI,EAAE,EAAE;IACrC,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,kBAAkB,CAAC;IAElD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpG,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,KAAK,CAAC,MAAM,CAAC,YAAY,OAAO,SAAS,MAAM,CAAC,OAAO,IAAI,GAAG,UAAU,CAAC,CAC1E,CAAC;QACF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,MAAM,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/F,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC,KAAK,EAAE,CAAC;QACtF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACjF,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,iBAAiB,MAAM,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;YACxF,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/commands/diff.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const diffCommand: Command;
+//# sourceMappingURL=diff.d.ts.map

package/dist/commands/diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../src/commands/diff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,eAAO,MAAM,WAAW,SAgEpB,CAAC"}

package/dist/commands/diff.js

@@ -0,0 +1,68 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import ora from "ora";
+import { requireProjectConfig } from "../lib/config.js";
+import { apiPullSecrets } from "../lib/api.js";
+export const diffCommand = new Command("diff")
+    .description("Compare secrets between two environments")
+    .requiredOption("--env <envs...>", "Two environments to compare (e.g., --env staging production)")
+    .option("--reveal", "Show actual values (default: redacted)")
+    .action(async (opts) => {
+    if (!opts.env || opts.env.length !== 2) {
+        console.error(chalk.red("Provide exactly two environments: --env staging production"));
+        process.exit(1);
+    }
+    const config = requireProjectConfig();
+    const [envA, envB] = opts.env;
+    const spinner = ora(chalk.dim(`Comparing ${envA} <> ${envB}...`)).start();
+    try {
+        const [resultA, resultB] = await Promise.all([
+            apiPullSecrets(config.org, config.project, envA),
+            apiPullSecrets(config.org, config.project, envB),
+        ]);
+        const mapA = new Map(resultA.secrets.map((s) => [s.key, s.value]));
+        const mapB = new Map(resultB.secrets.map((s) => [s.key, s.value]));
+        const allKeys = new Set([...mapA.keys(), ...mapB.keys()]);
+        spinner.stop();
+        console.log();
+        console.log(chalk.dim(`  Comparing ${chalk.white(envA)} <> ${chalk.white(envB)} in ${config.project}`));
+        console.log();
+        let diffs = 0;
+        for (const key of [...allKeys].sort()) {
+            const inA = mapA.has(key);
+            const inB = mapB.has(key);
+            if (inA && !inB) {
+                console.log(chalk.red(`  - ${key}  (only in ${envA})`));
+                diffs++;
+            }
+            else if (!inA && inB) {
+                console.log(chalk.green(`  + ${key}  (only in ${envB})`));
+                diffs++;
+            }
+            else if (mapA.get(key) !== mapB.get(key)) {
+                if (opts.reveal) {
+                    console.log(chalk.yellow(`  ~ ${key}`));
+                    console.log(chalk.dim(`      ${envA}: ${mapA.get(key)}`));
+                    console.log(chalk.dim(`      ${envB}: ${mapB.get(key)}`));
+                }
+                else {
+                    console.log(chalk.yellow(`  ~ ${key}  (values differ)`));
+                }
+                diffs++;
+            }
+        }
+        if (diffs === 0) {
+            console.log(chalk.green("  Environments are identical"));
+        }
+        else {
+            console.log();
+            console.log(chalk.dim(`  ${diffs} difference${diffs !== 1 ? "s" : ""} found`));
+        }
+        console.log();
+    }
+    catch (err) {
+        spinner.fail(chalk.red(err.message));
+        process.exit(1);
+    }
+});
+//# sourceMappingURL=diff.js.map

package/dist/commands/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../src/commands/diff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;KAC3C,WAAW,CAAC,0CAA0C,CAAC;KACvD,cAAc,CAAC,iBAAiB,EAAE,8DAA8D,CAAC;KACjG,MAAM,CAAC,UAAU,EAAE,wCAAwC,CAAC;KAC5D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC;IAE9B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC3C,cAAc,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;YAChD,cAAc,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;SACjD,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAE1D,OAAO,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxG,OAAO,CAAC,GAAG,EAAE,CAAC;QAEd,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAE1B,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,GAAG,cAAc,IAAI,GAAG,CAAC,CAAC,CAAC;gBACxD,KAAK,EAAE,CAAC;YACV,CAAC;iBAAM,IAAI,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,cAAc,IAAI,GAAG,CAAC,CAAC,CAAC;gBAC1D,KAAK,EAAE,CAAC;YACV,CAAC;iBAAM,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC;oBACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;oBAC1D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC5D,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC;gBAC3D,CAAC;gBACD,KAAK,EAAE,CAAC;YACV,CAAC;QACH,CAAC;QAED,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/commands/env.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const envCommand: Command;
+//# sourceMappingURL=env.d.ts.map

package/dist/commands/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/commands/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAapC,eAAO,MAAM,UAAU,SACc,CAAC"}

package/dist/commands/env.js

@@ -0,0 +1,59 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import ora from "ora";
+import { requireProjectConfig } from "../lib/config.js";
+import { resolveOrgId, apiGetProject, apiCreateEnvironment } from "../lib/api.js";
+function toSlug(name) {
+    return name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-|-$/g, "");
+}
+export const envCommand = new Command("env")
+    .description("Manage environments");
+envCommand
+    .command("list")
+    .description("List environments for the linked project")
+    .action(async () => {
+    const config = requireProjectConfig();
+    const spinner = ora("Fetching environments...").start();
+    try {
+        const orgId = await resolveOrgId(config.org);
+        const project = await apiGetProject(orgId, config.project);
+        spinner.succeed(chalk.green(`Environments for ${chalk.bold(project.name)}`));
+        console.log();
+        for (const env of project.environments) {
+            const isCurrent = env.slug === config.defaultEnvironment;
+            const marker = isCurrent ? chalk.cyan(" (current)") : "";
+            console.log(chalk.dim(`  ${chalk.white(env.name)} (${env.slug})${marker}`));
+        }
+        console.log();
+    }
+    catch (err) {
+        spinner.fail(chalk.red(err.message));
+        process.exit(1);
+    }
+});
+envCommand
+    .command("create")
+    .description("Create a new environment")
+    .argument("<name>", "Environment name")
+    .action(async (name) => {
+    const config = requireProjectConfig();
+    const slug = toSlug(name);
+    if (!slug || slug.length < 2) {
+        console.error(chalk.red("  Could not generate a valid slug from that name."));
+        process.exit(1);
+    }
+    const spinner = ora(`Creating environment ${chalk.cyan(name)}...`).start();
+    try {
+        const orgId = await resolveOrgId(config.org);
+        const env = await apiCreateEnvironment(orgId, config.project, { name, slug });
+        spinner.succeed(chalk.green(`Environment ${chalk.bold(env.name)} (${env.slug}) created`));
+    }
+    catch (err) {
+        spinner.fail(chalk.red(err.message));
+        process.exit(1);
+    }
+});
+//# sourceMappingURL=env.js.map

package/dist/commands/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/commands/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAElF,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI;SACR,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC;KACzC,WAAW,CAAC,qBAAqB,CAAC,CAAC;AAEtC,UAAU;KACP,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,0CAA0C,CAAC;KACvD,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,GAAG,CAAC,0BAA0B,CAAC,CAAC,KAAK,EAAE,CAAC;IAExD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3D,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAE7E,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,kBAAkB,CAAC;YACzD,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,UAAU;KACP,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,0BAA0B,CAAC;KACvC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;KACtC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAE1B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC,CAAC;QAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,wBAAwB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IAE3E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC;IAC5F,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/commands/guard.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const guardCommand: Command;
+//# sourceMappingURL=guard.d.ts.map

package/dist/commands/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/commands/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAkHpC,eAAO,MAAM,YAAY,SAIG,CAAC"}

package/dist/commands/guard.js

@@ -0,0 +1,108 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import { existsSync, readFileSync, writeFileSync, unlinkSync, chmodSync } from "node:fs";
+import { join } from "node:path";
+import { execSync } from "node:child_process";
+const HOOK_MARKER = "# secr-guard-hook";
+const HOOK_SCRIPT = `#!/bin/sh
+${HOOK_MARKER}
+# Pre-commit hook installed by secr guard — scans staged files for leaked secrets.
+
+# Prefer local install, fall back to npx
+if [ -x "./node_modules/.bin/secr" ]; then
+  ./node_modules/.bin/secr scan --pre-commit
+elif command -v secr >/dev/null 2>&1; then
+  secr scan --pre-commit
+else
+  npx --yes @secr/cli scan --pre-commit
+fi
+`;
+function getGitDir() {
+    try {
+        return execSync("git rev-parse --git-dir", { encoding: "utf-8" }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+function getHookPath() {
+    const gitDir = getGitDir();
+    if (!gitDir)
+        return null;
+    return join(gitDir, "hooks", "pre-commit");
+}
+function isSecrHook(content) {
+    return content.includes(HOOK_MARKER);
+}
+const installCommand = new Command("install")
+    .description("Install a pre-commit hook that runs secr scan")
+    .option("--force", "Overwrite existing pre-commit hook")
+    .action((opts) => {
+    const hookPath = getHookPath();
+    if (!hookPath) {
+        console.error(chalk.red("  ✗ Not a git repository. Run this command inside a git repo.\n"));
+        process.exit(1);
+    }
+    if (existsSync(hookPath)) {
+        const existing = readFileSync(hookPath, "utf-8");
+        if (isSecrHook(existing)) {
+            console.log(chalk.yellow("  ⚡ secr guard hook is already installed.\n"));
+            return;
+        }
+        if (!opts.force) {
+            console.error(chalk.red("  ✗ A pre-commit hook already exists."));
+            console.error(chalk.dim("  Use --force to overwrite it.\n"));
+            process.exit(1);
+        }
+    }
+    writeFileSync(hookPath, HOOK_SCRIPT, { mode: 0o755 });
+    chmodSync(hookPath, 0o755);
+    console.log(chalk.green("  ✓ Pre-commit hook installed!"));
+    console.log(chalk.dim(`  ${hookPath}\n`));
+    console.log(chalk.dim("  Staged files will be scanned for secrets before every commit.\n"));
+});
+const uninstallCommand = new Command("uninstall")
+    .description("Remove the secr pre-commit hook")
+    .action(() => {
+    const hookPath = getHookPath();
+    if (!hookPath || !existsSync(hookPath)) {
+        console.log(chalk.dim("  No pre-commit hook found.\n"));
+        return;
+    }
+    const content = readFileSync(hookPath, "utf-8");
+    if (!isSecrHook(content)) {
+        console.log(chalk.yellow("  Pre-commit hook exists but was not installed by secr. Skipping.\n"));
+        return;
+    }
+    unlinkSync(hookPath);
+    console.log(chalk.green("  ✓ Pre-commit hook removed.\n"));
+});
+const statusCommand = new Command("status")
+    .description("Check if the secr pre-commit hook is installed")
+    .action(() => {
+    const hookPath = getHookPath();
+    if (!hookPath) {
+        console.log(chalk.dim("  Not a git repository.\n"));
+        return;
+    }
+    if (!existsSync(hookPath)) {
+        console.log(chalk.yellow("  ✗ No pre-commit hook installed."));
+        console.log(chalk.dim("  Run `secr guard install` to set one up.\n"));
+        return;
+    }
+    const content = readFileSync(hookPath, "utf-8");
+    if (isSecrHook(content)) {
+        console.log(chalk.green("  ✓ secr guard hook is active."));
+        console.log(chalk.dim(`  ${hookPath}\n`));
+    }
+    else {
+        console.log(chalk.yellow("  ⚠ A pre-commit hook exists but it's not from secr."));
+        console.log(chalk.dim(`  ${hookPath}\n`));
+    }
+});
+export const guardCommand = new Command("guard")
+    .description("Manage pre-commit hook for secret leak prevention")
+    .addCommand(installCommand)
+    .addCommand(uninstallCommand)
+    .addCommand(statusCommand);
+//# sourceMappingURL=guard.js.map

package/dist/commands/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/commands/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC,MAAM,WAAW,GAAG;EAClB,WAAW;;;;;;;;;;;CAWZ,CAAC;AAEF,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,yBAAyB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC;KAC1C,WAAW,CAAC,+CAA+C,CAAC;KAC5D,MAAM,CAAC,SAAS,EAAE,oCAAoC,CAAC;KACvD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;IACf,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC,CAAC;QAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC,CAAC;YAClE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,aAAa,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC,CAAC;AAC9F,CAAC,CAAC,CAAC;AAEL,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC,WAAW,CAAC;KAC9C,WAAW,CAAC,iCAAiC,CAAC;KAC9C,MAAM,CAAC,GAAG,EAAE;IACX,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,qEAAqE,CAAC,CAAC,CAAC;QACjG,OAAO;IACT,CAAC;IAED,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;AAC7D,CAAC,CAAC,CAAC;AAEL,MAAM,aAAa,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC;KACxC,WAAW,CAAC,gDAAgD,CAAC;KAC7D,MAAM,CAAC,GAAG,EAAE;IACX,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,mCAAmC,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;KAC7C,WAAW,CAAC,mDAAmD,CAAC;KAChE,UAAU,CAAC,cAAc,CAAC;KAC1B,UAAU,CAAC,gBAAgB,CAAC;KAC5B,UAAU,CAAC,aAAa,CAAC,CAAC"}

package/dist/commands/init.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const initCommand: Command;
+//# sourceMappingURL=init.d.ts.map

package/dist/commands/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwBpC,eAAO,MAAM,WAAW,SA6FpB,CAAC"}