@secr/cli 0.1.0

package/dist/commands/pull.js

@@ -0,0 +1,48 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import ora from "ora";
+import { requireProjectConfig } from "../lib/config.js";
+import { apiPullSecrets } from "../lib/api.js";
+export const pullCommand = new Command("pull")
+    .description("Pull secrets for the linked project and environment")
+    .option("--env <environment>", "Override the default environment")
+    .option("--json", "Output as JSON (alias for --format json)")
+    .option("--format <format>", "Output format: table, dotenv, json", "table")
+    .action(async (opts) => {
+    const config = requireProjectConfig();
+    const env = opts.env || config.defaultEnvironment;
+    const format = opts.json ? "json" : opts.format;
+    const spinner = ora(`Pulling secrets for ${chalk.cyan(config.project)}/${chalk.cyan(env)}...`).start();
+    try {
+        const { secrets } = await apiPullSecrets(config.org, config.project, env);
+        spinner.succeed(chalk.green(`Pulled ${chalk.bold(secrets.length)} secrets`));
+        if (format === "json") {
+            const envObj = {};
+            for (const s of secrets)
+                envObj[s.key] = s.value;
+            console.log(JSON.stringify(envObj, null, 2));
+        }
+        else if (format === "dotenv") {
+            for (const s of secrets) {
+                // Quote values that contain spaces, newlines, or special characters
+                const needsQuotes = /[\s#"'\\$`!]/.test(s.value);
+                const escaped = needsQuotes ? `"${s.value.replace(/["\\$`]/g, "\\$&")}"` : s.value;
+                console.log(`${s.key}=${escaped}`);
+            }
+        }
+        else {
+            console.log();
+            for (const s of secrets) {
+                console.log(chalk.dim(`  ${chalk.white(s.key)}=${chalk.dim("••••••••")}`));
+            }
+            console.log();
+            console.log(chalk.dim(`  Use ${chalk.cyan('secr run "your-command"')} to inject these as environment variables.`));
+            console.log();
+        }
+    }
+    catch (err) {
+        spinner.fail(chalk.red(err.message));
+        process.exit(1);
+    }
+});
+//# sourceMappingURL=pull.js.map

package/dist/commands/pull.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pull.js","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;KAC3C,WAAW,CAAC,qDAAqD,CAAC;KAClE,MAAM,CAAC,qBAAqB,EAAE,kCAAkC,CAAC;KACjE,MAAM,CAAC,QAAQ,EAAE,0CAA0C,CAAC;KAC5D,MAAM,CAAC,mBAAmB,EAAE,oCAAoC,EAAE,OAAO,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,kBAAkB,CAAC;IAElD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAEhD,MAAM,OAAO,GAAG,GAAG,CAAC,uBAAuB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IAEvG,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC1E,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAE7E,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,oEAAoE;gBACpE,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACjD,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBACnF,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,OAAO,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,EAAE,CAAC;YACd,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,CAAC,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,4CAA4C,CAAC,CAAC,CAAC;YACnH,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/commands/rotate-key.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const rotateKeyCommand: Command;
+//# sourceMappingURL=rotate-key.d.ts.map

package/dist/commands/rotate-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate-key.d.ts","sourceRoot":"","sources":["../../src/commands/rotate-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiBpC,eAAO,MAAM,gBAAgB,SA6BzB,CAAC"}

package/dist/commands/rotate-key.js

@@ -0,0 +1,39 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import ora from "ora";
+import readline from "node:readline";
+import { requireProjectConfig } from "../lib/config.js";
+import { resolveOrgId, apiRotateKey } from "../lib/api.js";
+function confirm(question) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer.trim().toLowerCase() === "y");
+        });
+    });
+}
+export const rotateKeyCommand = new Command("rotate-key")
+    .description("Rotate the encryption key for the linked project")
+    .option("--force", "Skip confirmation prompt")
+    .action(async (opts) => {
+    const config = requireProjectConfig();
+    if (!opts.force) {
+        const yes = await confirm(chalk.yellow(`  Rotate encryption key for ${chalk.bold(config.project)}? All secrets will be re-encrypted. (y/N) `));
+        if (!yes) {
+            console.log(chalk.dim("  Cancelled."));
+            return;
+        }
+    }
+    const spinner = ora("Rotating encryption key...").start();
+    try {
+        const orgId = await resolveOrgId(config.org);
+        const result = await apiRotateKey(orgId, config.project);
+        spinner.succeed(chalk.green(`Key rotated to v${chalk.bold(result.keyVersion)} — ${chalk.bold(result.secretsReEncrypted)} secret${result.secretsReEncrypted !== 1 ? "s" : ""} re-encrypted`));
+    }
+    catch (err) {
+        spinner.fail(chalk.red(err.message));
+        process.exit(1);
+    }
+});
+//# sourceMappingURL=rotate-key.js.map

package/dist/commands/rotate-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate-key.js","sourceRoot":"","sources":["../../src/commands/rotate-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,QAAQ,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE3D,SAAS,OAAO,CAAC,QAAgB;IAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/B,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC,YAAY,CAAC;KACtD,WAAW,CAAC,kDAAkD,CAAC;KAC/D,MAAM,CAAC,SAAS,EAAE,0BAA0B,CAAC;KAC7C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IAEtC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,KAAK,CAAC,MAAM,CAAC,+BAA+B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,4CAA4C,CAAC,CACpH,CAAC;QACF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,4BAA4B,CAAC,CAAC,KAAK,EAAE,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACzD,OAAO,CAAC,OAAO,CACb,KAAK,CAAC,KAAK,CACT,mBAAmB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,UAAU,MAAM,CAAC,kBAAkB,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,CAC/J,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/commands/run.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const runCommand: Command;
+//# sourceMappingURL=run.d.ts.map

package/dist/commands/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOpC,eAAO,MAAM,UAAU,SAgDnB,CAAC"}

package/dist/commands/run.js

@@ -0,0 +1,47 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import ora from "ora";
+import { spawn } from "node:child_process";
+import { requireProjectConfig } from "../lib/config.js";
+import { apiPullSecrets } from "../lib/api.js";
+export const runCommand = new Command("run")
+    .description("Run a command with secrets injected as environment variables")
+    .argument("<command>", "The command to run (wrap in quotes)")
+    .option("--env <environment>", "Override the default environment")
+    .action(async (cmd, opts) => {
+    const config = requireProjectConfig();
+    const env = opts.env || config.defaultEnvironment;
+    const spinner = ora(chalk.dim("Injecting secrets...")).start();
+    try {
+        const { secrets } = await apiPullSecrets(config.org, config.project, env);
+        // Build environment with secrets injected
+        const secretEnv = {};
+        for (const s of secrets) {
+            secretEnv[s.key] = s.value;
+        }
+        spinner.succeed(chalk.green(`${chalk.bold(secrets.length)} secrets loaded → running ${chalk.cyan(cmd)}`));
+        console.log();
+        // Parse the command string
+        const parts = cmd.match(/(?:[^\s"]+|"[^"]*")+/g) || [cmd];
+        const command = parts[0].replace(/"/g, "");
+        const args = parts.slice(1).map((a) => a.replace(/"/g, ""));
+        // Spawn the child process with secrets + existing env vars
+        const child = spawn(command, args, {
+            env: { ...process.env, ...secretEnv },
+            stdio: "inherit",
+            shell: true,
+        });
+        child.on("exit", (code) => {
+            process.exit(code || 0);
+        });
+        child.on("error", (err) => {
+            console.error(chalk.red(`\n✗ Failed to start process: ${err.message}`));
+            process.exit(1);
+        });
+    }
+    catch (err) {
+        spinner.fail(chalk.red(err.message));
+        process.exit(1);
+    }
+});
+//# sourceMappingURL=run.js.map

package/dist/commands/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC;KACzC,WAAW,CAAC,8DAA8D,CAAC;KAC3E,QAAQ,CAAC,WAAW,EAAE,qCAAqC,CAAC;KAC5D,MAAM,CAAC,qBAAqB,EAAE,kCAAkC,CAAC;KACjE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAC1B,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,kBAAkB,CAAC;IAElD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IAE/D,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAE1E,0CAA0C;QAC1C,MAAM,SAAS,GAA2B,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QAC7B,CAAC;QAED,OAAO,CAAC,OAAO,CACb,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,6BAA6B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CACzF,CAAC;QACF,OAAO,CAAC,GAAG,EAAE,CAAC;QAEd,2BAA2B;QAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAEpE,2DAA2D;QAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YACjC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE;YACrC,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/commands/scan.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const scanCommand: Command;
+//# sourceMappingURL=scan.d.ts.map

package/dist/commands/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/commands/scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAWpC,eAAO,MAAM,WAAW,SAuFpB,CAAC"}

package/dist/commands/scan.js

@@ -0,0 +1,83 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import ora from "ora";
+import { scanDirectory, scanStagedFiles, checkGitignoreForEnv, SECRET_PATTERNS } from "../lib/scanner.js";
+const SEVERITY_COLORS = {
+    high: chalk.red,
+    medium: chalk.yellow,
+    low: chalk.dim,
+};
+export const scanCommand = new Command("scan")
+    .description("Scan for leaked secrets in your codebase")
+    .argument("[directory]", "Directory to scan", ".")
+    .option("--pre-commit", "Scan only git staged files")
+    .option("--json", "Output results as JSON")
+    .option("--list-patterns", "List all detection patterns")
+    .option("--exclude <paths...>", "Additional paths to skip")
+    .action(async (directory, opts) => {
+    if (opts.listPatterns) {
+        console.log(chalk.bold("\nSecret Detection Patterns:\n"));
+        for (const p of SECRET_PATTERNS) {
+            const color = SEVERITY_COLORS[p.severity] || chalk.white;
+            console.log(`  ${color(`[${p.severity.toUpperCase()}]`)} ${chalk.bold(p.name)}`);
+            console.log(`         ${chalk.dim(p.description)}\n`);
+        }
+        console.log(`  ${SECRET_PATTERNS.length} patterns total\n`);
+        return;
+    }
+    const spinner = ora("Scanning for secrets...").start();
+    let result;
+    if (opts.preCommit) {
+        result = scanStagedFiles();
+    }
+    else {
+        result = scanDirectory({ directory, exclude: opts.exclude });
+    }
+    // Also check .gitignore
+    const gitignoreFindings = opts.preCommit ? [] : checkGitignoreForEnv(directory);
+    const allFindings = [...result.findings, ...gitignoreFindings];
+    spinner.stop();
+    if (opts.json) {
+        console.log(JSON.stringify({
+            findings: allFindings,
+            filesScanned: result.filesScanned,
+            duration: result.duration,
+            clean: allFindings.length === 0,
+        }, null, 2));
+        if (allFindings.length > 0)
+            process.exit(1);
+        return;
+    }
+    console.log();
+    if (allFindings.length === 0) {
+        console.log(chalk.green("  ✓ No secrets found!"));
+        console.log(chalk.dim(`  Scanned ${result.filesScanned} files in ${result.duration}ms\n`));
+        return;
+    }
+    // Group by file
+    const byFile = new Map();
+    for (const f of allFindings) {
+        const existing = byFile.get(f.file) || [];
+        existing.push(f);
+        byFile.set(f.file, existing);
+    }
+    const highCount = allFindings.filter((f) => f.severity === "high").length;
+    const medCount = allFindings.filter((f) => f.severity === "medium").length;
+    const lowCount = allFindings.filter((f) => f.severity === "low").length;
+    console.log(chalk.red.bold(`  ✗ Found ${allFindings.length} potential secret(s)\n`));
+    for (const [file, findings] of byFile) {
+        console.log(chalk.underline(`  ${file}`));
+        for (const f of findings) {
+            const color = SEVERITY_COLORS[f.severity] || chalk.white;
+            const loc = f.line > 0 ? `L${f.line}:${f.column}` : "";
+            console.log(`    ${color(`[${f.severity.toUpperCase()}]`)} ${f.patternName} ${chalk.dim(loc)}`);
+            console.log(`           ${chalk.dim(f.redactedMatch)}`);
+        }
+        console.log();
+    }
+    console.log(chalk.dim(`  ${highCount} high, ${medCount} medium, ${lowCount} low | ${result.filesScanned} files scanned in ${result.duration}ms`));
+    console.log();
+    console.log(chalk.cyan("  Tip: Run `secr guard install` to prevent committing secrets.\n"));
+    process.exit(1);
+});
+//# sourceMappingURL=scan.js.map

package/dist/commands/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/commands/scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,eAAe,EAAoB,MAAM,mBAAmB,CAAC;AAE5H,MAAM,eAAe,GAA0C;IAC7D,IAAI,EAAE,KAAK,CAAC,GAAG;IACf,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,GAAG,EAAE,KAAK,CAAC,GAAG;CACf,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;KAC3C,WAAW,CAAC,0CAA0C,CAAC;KACvD,QAAQ,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC;KACjD,MAAM,CAAC,cAAc,EAAE,4BAA4B,CAAC;KACpD,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC;KAC1C,MAAM,CAAC,iBAAiB,EAAE,6BAA6B,CAAC;KACxD,MAAM,CAAC,sBAAsB,EAAE,0BAA0B,CAAC;KAC1D,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;IAChC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjF,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,eAAe,CAAC,MAAM,mBAAmB,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,yBAAyB,CAAC,CAAC,KAAK,EAAE,CAAC;IAEvD,IAAI,MAAM,CAAC;IACX,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,GAAG,eAAe,EAAE,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,aAAa,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,wBAAwB;IACxB,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChF,MAAM,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,iBAAiB,CAAC,CAAC;IAE/D,OAAO,CAAC,IAAI,EAAE,CAAC;IAEf,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,QAAQ,EAAE,WAAW;YACrB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,WAAW,CAAC,MAAM,KAAK,CAAC;SAChC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAEb,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5C,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,YAAY,aAAa,MAAM,CAAC,QAAQ,MAAM,CAAC,CAAC,CAAC;QAC3F,OAAO;IACT,CAAC;IAED,gBAAgB;IAChB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1C,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAC1E,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IAC3E,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC;IAExE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,WAAW,CAAC,MAAM,wBAAwB,CAAC,CAAC,CAAC;IAErF,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC;YACzD,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,OAAO,CAAC,GAAG,CACT,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CACnF,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CACnB,KAAK,SAAS,UAAU,QAAQ,YAAY,QAAQ,UAAU,MAAM,CAAC,YAAY,qBAAqB,MAAM,CAAC,QAAQ,IAAI,CAC1H,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC,CAAC;IAE5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/commands/set.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const setCommand: Command;
+//# sourceMappingURL=set.d.ts.map

package/dist/commands/set.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set.d.ts","sourceRoot":"","sources":["../../src/commands/set.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,eAAO,MAAM,UAAU,SAyDnB,CAAC"}

package/dist/commands/set.js

@@ -0,0 +1,54 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import ora from "ora";
+import { requireProjectConfig, parseEnvFile } from "../lib/config.js";
+import { apiSetSecret, apiBulkSetSecrets } from "../lib/api.js";
+export const setCommand = new Command("set")
+    .description("Set a secret (KEY=value) or import from .env file")
+    .argument("[keyvalue]", "Secret in KEY=value format")
+    .option("--from-env <path>", "Import secrets from a .env file")
+    .option("--env <environment>", "Override the default environment")
+    .action(async (keyvalue, opts) => {
+    const config = requireProjectConfig();
+    const env = opts.env || config.defaultEnvironment;
+    // Bulk import from .env file
+    if (opts.fromEnv) {
+        const spinner = ora(`Importing from ${opts.fromEnv}...`).start();
+        try {
+            const secrets = parseEnvFile(opts.fromEnv);
+            if (secrets.length === 0) {
+                spinner.warn(chalk.yellow("No secrets found in the file"));
+                return;
+            }
+            const result = await apiBulkSetSecrets(config.org, config.project, env, secrets);
+            spinner.succeed(chalk.green(`Imported ${chalk.bold(result.total)} secrets (${result.created} new, ${result.updated} updated)`));
+        }
+        catch (err) {
+            spinner.fail(chalk.red(err.message));
+            process.exit(1);
+        }
+        return;
+    }
+    // Single secret set
+    if (!keyvalue) {
+        console.error(chalk.red("✗ Provide a KEY=value pair or use --from-env <path>"));
+        process.exit(1);
+    }
+    const eqIndex = keyvalue.indexOf("=");
+    if (eqIndex === -1) {
+        console.error(chalk.red("✗ Invalid format. Use KEY=value"));
+        process.exit(1);
+    }
+    const key = keyvalue.slice(0, eqIndex);
+    const value = keyvalue.slice(eqIndex + 1);
+    const spinner = ora(`Setting ${chalk.cyan(key)}...`).start();
+    try {
+        const result = await apiSetSecret(config.org, config.project, env, key, value);
+        spinner.succeed(chalk.green(`${chalk.bold(key)} set (v${result.version}) in ${config.project}/${env}`));
+    }
+    catch (err) {
+        spinner.fail(chalk.red(err.message));
+        process.exit(1);
+    }
+});
+//# sourceMappingURL=set.js.map

package/dist/commands/set.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set.js","sourceRoot":"","sources":["../../src/commands/set.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEhE,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC;KACzC,WAAW,CAAC,mDAAmD,CAAC;KAChE,QAAQ,CAAC,YAAY,EAAE,4BAA4B,CAAC;KACpD,MAAM,CAAC,mBAAmB,EAAE,iCAAiC,CAAC;KAC9D,MAAM,CAAC,qBAAqB,EAAE,kCAAkC,CAAC;KACjE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;IAC/B,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,kBAAkB,CAAC;IAElD,6BAA6B;IAC7B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,GAAG,CAAC,kBAAkB,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YACjF,OAAO,CAAC,OAAO,CACb,KAAK,CAAC,KAAK,CACT,YAAY,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,MAAM,CAAC,OAAO,SAAS,MAAM,CAAC,OAAO,WAAW,CAClG,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IAED,oBAAoB;IACpB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC,CAAC;QAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IAE1C,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/E,OAAO,CAAC,OAAO,CACb,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,OAAO,QAAQ,MAAM,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC,CACvF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/commands/template.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const templateCommand: Command;
+//# sourceMappingURL=template.d.ts.map

package/dist/commands/template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"template.d.ts","sourceRoot":"","sources":["../../src/commands/template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,eAAO,MAAM,eAAe,SAC6B,CAAC"}

package/dist/commands/template.js

@@ -0,0 +1,109 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import ora from "ora";
+import { requireProjectConfig } from "../lib/config.js";
+import { apiListTemplates, apiAddTemplate, apiRemoveTemplate, apiValidateTemplate, } from "../lib/api.js";
+export const templateCommand = new Command("template")
+    .description("Manage secret templates (required keys)");
+templateCommand
+    .command("list")
+    .description("List template keys for the current project")
+    .action(async () => {
+    const config = requireProjectConfig();
+    const spinner = ora("Fetching templates...").start();
+    try {
+        const { templates } = await apiListTemplates(config.org, config.project);
+        spinner.stop();
+        if (templates.length === 0) {
+            console.log(chalk.dim("\n  No templates defined. Use `secr template add <key>` to add one.\n"));
+            return;
+        }
+        console.log(chalk.bold(`\n  Templates for ${config.project}\n`));
+        for (const t of templates) {
+            const req = t.required ? chalk.green("required") : chalk.dim("optional");
+            const desc = t.description ? chalk.dim(` — ${t.description}`) : "";
+            console.log(`  ${chalk.white(t.key)} (${req})${desc}`);
+        }
+        console.log();
+    }
+    catch (err) {
+        spinner.fail(chalk.red(err.message));
+        process.exit(1);
+    }
+});
+templateCommand
+    .command("add")
+    .description("Add a required key to the template")
+    .argument("<key>", "Secret key name (e.g. DATABASE_URL)")
+    .option("--description <desc>", "Description of what this key is for")
+    .option("--optional", "Mark as optional instead of required", false)
+    .action(async (key, opts) => {
+    const config = requireProjectConfig();
+    const spinner = ora(`Adding template key ${chalk.cyan(key)}...`).start();
+    try {
+        await apiAddTemplate(config.org, config.project, {
+            key,
+            description: opts.description,
+            required: !opts.optional,
+        });
+        spinner.succeed(chalk.green(`Template key ${chalk.bold(key)} added`));
+    }
+    catch (err) {
+        spinner.fail(chalk.red(err.message));
+        process.exit(1);
+    }
+});
+templateCommand
+    .command("remove")
+    .description("Remove a key from the template")
+    .argument("<key>", "Secret key name to remove")
+    .action(async (key) => {
+    const config = requireProjectConfig();
+    const spinner = ora(`Removing template key ${chalk.cyan(key)}...`).start();
+    try {
+        await apiRemoveTemplate(config.org, config.project, key);
+        spinner.succeed(chalk.green(`Template key ${chalk.bold(key)} removed`));
+    }
+    catch (err) {
+        spinner.fail(chalk.red(err.message));
+        process.exit(1);
+    }
+});
+templateCommand
+    .command("validate")
+    .description("Check if an environment has all required template keys")
+    .option("--env <environment>", "Environment to validate (default: from .secr.json)")
+    .action(async (opts) => {
+    const config = requireProjectConfig();
+    const env = opts.env || config.defaultEnvironment;
+    const spinner = ora(`Validating ${chalk.cyan(env)} against template...`).start();
+    try {
+        const result = await apiValidateTemplate(config.org, config.project, env);
+        spinner.stop();
+        if (result.valid) {
+            console.log(chalk.green(`\n  ✓ ${env} has all required template keys\n`));
+        }
+        else {
+            console.log(chalk.red(`\n  ✗ ${env} is missing required keys:\n`));
+            for (const key of result.missing) {
+                console.log(chalk.red(`    - ${key}`));
+            }
+            console.log();
+        }
+        if (result.extra.length > 0) {
+            console.log(chalk.dim(`  Extra keys (not in template):`));
+            for (const key of result.extra) {
+                console.log(chalk.dim(`    + ${key}`));
+            }
+            console.log();
+        }
+        if (!result.valid) {
+            process.exit(1);
+        }
+    }
+    catch (err) {
+        spinner.fail(chalk.red(err.message));
+        process.exit(1);
+    }
+});
+//# sourceMappingURL=template.js.map

package/dist/commands/template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"template.js","sourceRoot":"","sources":["../../src/commands/template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EACL,gBAAgB,EAAE,cAAc,EAAE,iBAAiB,EAAE,mBAAmB,GACzE,MAAM,eAAe,CAAC;AAEvB,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC;KACnD,WAAW,CAAC,yCAAyC,CAAC,CAAC;AAE1D,eAAe;KACZ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,4CAA4C,CAAC;KACzD,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,GAAG,CAAC,uBAAuB,CAAC,CAAC,KAAK,EAAE,CAAC;IAErD,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,EAAE,CAAC;QAEf,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC,CAAC;YAChG,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;QACjE,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACzE,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,eAAe;KACZ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,oCAAoC,CAAC;KACjD,QAAQ,CAAC,OAAO,EAAE,qCAAqC,CAAC;KACxD,MAAM,CAAC,sBAAsB,EAAE,qCAAqC,CAAC;KACrE,MAAM,CAAC,YAAY,EAAE,sCAAsC,EAAE,KAAK,CAAC;KACnE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAC1B,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,GAAG,CAAC,uBAAuB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IAEzE,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE;YAC/C,GAAG;YACH,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,eAAe;KACZ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,gCAAgC,CAAC;KAC7C,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAC;KAC9C,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IACpB,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,GAAG,CAAC,yBAAyB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IAE3E,IAAI,CAAC;QACH,MAAM,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,eAAe;KACZ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,wDAAwD,CAAC;KACrE,MAAM,CAAC,qBAAqB,EAAE,oDAAoD,CAAC;KACnF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,kBAAkB,CAAC;IAClD,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,KAAK,EAAE,CAAC;IAEjF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,EAAE,CAAC;QAEf,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,mCAAmC,CAAC,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,GAAG,8BAA8B,CAAC,CAAC,CAAC;YACnE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,CAAC;YAC1D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/commands/whoami.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const whoamiCommand: Command;
+//# sourceMappingURL=whoami.d.ts.map

package/dist/commands/whoami.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoami.d.ts","sourceRoot":"","sources":["../../src/commands/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,eAAO,MAAM,aAAa,SA2BtB,CAAC"}

package/dist/commands/whoami.js

@@ -0,0 +1,32 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import ora from "ora";
+import { requireProjectConfig, loadCredentials } from "../lib/config.js";
+import { apiGetMe } from "../lib/api.js";
+export const whoamiCommand = new Command("whoami")
+    .description("Show current user, org, and linked project")
+    .action(async () => {
+    const creds = loadCredentials();
+    if (!creds?.token) {
+        console.log(chalk.red("\n  Not authenticated. Run `secr login` first.\n"));
+        process.exit(1);
+    }
+    const spinner = ora(chalk.dim("Loading...")).start();
+    try {
+        const me = await apiGetMe();
+        spinner.stop();
+        const config = requireProjectConfig();
+        console.log();
+        console.log(chalk.dim("  User:        ") + chalk.white(me.email));
+        console.log(chalk.dim("  Name:        ") + chalk.white(me.name));
+        console.log(chalk.dim("  Org:         ") + chalk.white(config.org));
+        console.log(chalk.dim("  Project:     ") + chalk.white(config.project));
+        console.log(chalk.dim("  Environment: ") + chalk.white(config.defaultEnvironment));
+        console.log();
+    }
+    catch (err) {
+        spinner.fail(chalk.red(err.message));
+        process.exit(1);
+    }
+});
+//# sourceMappingURL=whoami.js.map

package/dist/commands/whoami.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../src/commands/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC;KAC/C,WAAW,CAAC,4CAA4C,CAAC;KACzD,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,EAAE,CAAC;QAEf,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAEtC,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/completions/bash.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+# secr bash completion
+
+_secr_completions() {
+  local cur prev commands
+  cur="${COMP_WORDS[COMP_CWORD]}"
+  prev="${COMP_WORDS[COMP_CWORD-1]}"
+
+  commands="login logout whoami init link pull run set delete ls log diff env rotate-key promote template scan guard completion"
+
+  case "${prev}" in
+    secr)
+      COMPREPLY=($(compgen -W "${commands}" -- "${cur}"))
+      return 0
+      ;;
+    env)
+      COMPREPLY=($(compgen -W "list create" -- "${cur}"))
+      return 0
+      ;;
+    template)
+      COMPREPLY=($(compgen -W "list add remove validate" -- "${cur}"))
+      return 0
+      ;;
+    guard)
+      COMPREPLY=($(compgen -W "install uninstall status" -- "${cur}"))
+      return 0
+      ;;
+    completion)
+      COMPREPLY=($(compgen -W "bash zsh fish" -- "${cur}"))
+      return 0
+      ;;
+    --env)
+      COMPREPLY=($(compgen -W "development staging production" -- "${cur}"))
+      return 0
+      ;;
+    --format)
+      COMPREPLY=($(compgen -W "dotenv json table" -- "${cur}"))
+      return 0
+      ;;
+  esac
+
+  if [[ "${cur}" == -* ]]; then
+    local flags="--env --format --force --from --to --dry-run --overwrite --keys --description --help --version --json --pre-commit --list-patterns --from-env --token --limit --reveal"
+    COMPREPLY=($(compgen -W "${flags}" -- "${cur}"))
+    return 0
+  fi
+}
+
+complete -F _secr_completions secr

package/dist/completions/fish.fish

@@ -0,0 +1,62 @@
+# secr fish completion
+
+# Disable file completions by default
+complete -c secr -f
+
+# Top-level commands
+complete -c secr -n '__fish_use_subcommand' -a login -d 'Authenticate with the secr platform'
+complete -c secr -n '__fish_use_subcommand' -a logout -d 'Clear saved credentials'
+complete -c secr -n '__fish_use_subcommand' -a whoami -d 'Show current user and linked project'
+complete -c secr -n '__fish_use_subcommand' -a init -d 'Create a new project interactively'
+complete -c secr -n '__fish_use_subcommand' -a link -d 'Link current directory to a project'
+complete -c secr -n '__fish_use_subcommand' -a pull -d 'Pull decrypted secrets'
+complete -c secr -n '__fish_use_subcommand' -a run -d 'Run a command with secrets injected'
+complete -c secr -n '__fish_use_subcommand' -a set -d 'Set one or more secrets'
+complete -c secr -n '__fish_use_subcommand' -a delete -d 'Delete a secret'
+complete -c secr -n '__fish_use_subcommand' -a ls -d 'List secret keys'
+complete -c secr -n '__fish_use_subcommand' -a log -d 'View audit log entries'
+complete -c secr -n '__fish_use_subcommand' -a diff -d 'Compare secrets between environments'
+complete -c secr -n '__fish_use_subcommand' -a env -d 'Manage environments'
+complete -c secr -n '__fish_use_subcommand' -a rotate-key -d 'Rotate the project encryption key'
+complete -c secr -n '__fish_use_subcommand' -a promote -d 'Promote secrets between environments'
+complete -c secr -n '__fish_use_subcommand' -a template -d 'Manage secret templates'
+complete -c secr -n '__fish_use_subcommand' -a scan -d 'Scan for leaked secrets'
+complete -c secr -n '__fish_use_subcommand' -a guard -d 'Manage pre-commit hook'
+complete -c secr -n '__fish_use_subcommand' -a completion -d 'Output shell completion script'
+
+# env subcommands
+complete -c secr -n '__fish_seen_subcommand_from env' -a list -d 'List environments'
+complete -c secr -n '__fish_seen_subcommand_from env' -a create -d 'Create an environment'
+
+# template subcommands
+complete -c secr -n '__fish_seen_subcommand_from template' -a list -d 'List template keys'
+complete -c secr -n '__fish_seen_subcommand_from template' -a add -d 'Add a template key'
+complete -c secr -n '__fish_seen_subcommand_from template' -a remove -d 'Remove a template key'
+complete -c secr -n '__fish_seen_subcommand_from template' -a validate -d 'Validate env against template'
+
+# guard subcommands
+complete -c secr -n '__fish_seen_subcommand_from guard' -a install -d 'Install pre-commit hook'
+complete -c secr -n '__fish_seen_subcommand_from guard' -a uninstall -d 'Remove pre-commit hook'
+complete -c secr -n '__fish_seen_subcommand_from guard' -a status -d 'Check hook status'
+
+# completion subcommands
+complete -c secr -n '__fish_seen_subcommand_from completion' -a bash -d 'Bash completion'
+complete -c secr -n '__fish_seen_subcommand_from completion' -a zsh -d 'Zsh completion'
+complete -c secr -n '__fish_seen_subcommand_from completion' -a fish -d 'Fish completion'
+
+# Common flags
+complete -c secr -n '__fish_seen_subcommand_from pull set delete ls run log diff' -l env -d 'Environment' -xa 'development staging production'
+complete -c secr -n '__fish_seen_subcommand_from pull' -l format -d 'Output format' -xa 'dotenv json table'
+complete -c secr -n '__fish_seen_subcommand_from delete' -l force -d 'Skip confirmation'
+complete -c secr -n '__fish_seen_subcommand_from set' -l from-env -d 'Import from .env file' -rF
+complete -c secr -n '__fish_seen_subcommand_from login' -l token -d 'Token for CI/headless login'
+complete -c secr -n '__fish_seen_subcommand_from diff' -l reveal -d 'Show actual values'
+complete -c secr -n '__fish_seen_subcommand_from promote' -l from -d 'Source environment' -xa 'development staging production'
+complete -c secr -n '__fish_seen_subcommand_from promote' -l to -d 'Target environment' -xa 'development staging production'
+complete -c secr -n '__fish_seen_subcommand_from promote' -l dry-run -d 'Preview without changes'
+complete -c secr -n '__fish_seen_subcommand_from promote' -l overwrite -d 'Overwrite existing'
+complete -c secr -n '__fish_seen_subcommand_from promote' -l keys -d 'Specific keys to promote'
+complete -c secr -n '__fish_seen_subcommand_from scan' -l pre-commit -d 'Scan staged files only'
+complete -c secr -n '__fish_seen_subcommand_from scan' -l json -d 'JSON output'
+complete -c secr -n '__fish_seen_subcommand_from scan' -l list-patterns -d 'Show detection patterns'
+complete -c secr -n '__fish_seen_subcommand_from log' -l limit -d 'Max entries to show'