@vaultcompass/vault-guard 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Vault & Compass LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/__tests__/integration/proxy-test-helpers.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Shared helpers for proxy integration tests.
+ *
+ * Each test file that uses these helpers must call `jest.mock('https')`
+ * at the module level (Jest hoists it before imports, ensuring proxy.ts
+ * gets the mocked version when it requires 'https').
+ *
+ * Usage in a test file:
+ *   jest.mock('https');
+ *   import * as https from 'https';
+ *   // Then call setupUpstreamMock(https, { ... }) inside each test.
+ */
+import * as http from 'http';
+export interface MockUpstreamOptions {
+    statusCode?: number;
+    contentType?: string;
+    body?: Buffer | string;
+    /** Milliseconds before the response body is emitted (simulate slow upstream). */
+    delayMs?: number;
+    /** If true, never emit 'end' — simulate a hung upstream. */
+    hang?: boolean;
+}
+/**
+ * Configure the already-mocked `https` module to behave as a specific upstream.
+ *
+ * @param mockHttps   The `https` module, which must have been replaced by
+ *                    `jest.mock('https')` before this file was imported.
+ * @param opts        Upstream response options.
+ * @returns           Arrays of captured request options and headers, populated
+ *                    on each upstream call.
+ */
+export declare function setupUpstreamMock(mockHttps: {
+    request: jest.Mock;
+}, opts?: MockUpstreamOptions): {
+    capturedOpts: http.RequestOptions[];
+    capturedHeaders: Record<string, string | string[] | undefined>[];
+};
+export interface RequestResult {
+    status: number;
+    body: string;
+    headers: http.IncomingHttpHeaders;
+}
+/** Make a POST request to the local proxy (not the upstream). */
+export declare function postToProxy(port: number, urlPath: string, body: string | object, extraHeaders?: Record<string, string>): Promise<RequestResult>;
+/** Create a fresh temp dir and return a sqlite path inside it. */
+export declare function makeTmpDbPath(): string;
+//# sourceMappingURL=proxy-test-helpers.d.ts.map

package/dist/__tests__/integration/proxy-test-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-test-helpers.d.ts","sourceRoot":"","sources":["../../../src/__tests__/integration/proxy-test-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAW7B,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,iFAAiF;IACjF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAOD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE;IAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAA;CAAE,EACjC,IAAI,GAAE,mBAAwB,GAC7B;IACD,YAAY,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;IACpC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC;CAClE,CAuDA;AAMD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,IAAI,CAAC,mBAAmB,CAAC;CACnC;AAED,iEAAiE;AACjE,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GAAG,MAAM,EACrB,YAAY,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACxC,OAAO,CAAC,aAAa,CAAC,CAkCxB;AAMD,kEAAkE;AAClE,wBAAgB,aAAa,IAAI,MAAM,CAGtC"}

package/dist/__tests__/integration/proxy-test-helpers.js

@@ -0,0 +1,146 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setupUpstreamMock = setupUpstreamMock;
+exports.postToProxy = postToProxy;
+exports.makeTmpDbPath = makeTmpDbPath;
+/**
+ * Shared helpers for proxy integration tests.
+ *
+ * Each test file that uses these helpers must call `jest.mock('https')`
+ * at the module level (Jest hoists it before imports, ensuring proxy.ts
+ * gets the mocked version when it requires 'https').
+ *
+ * Usage in a test file:
+ *   jest.mock('https');
+ *   import * as https from 'https';
+ *   // Then call setupUpstreamMock(https, { ... }) inside each test.
+ */
+const http = __importStar(require("http"));
+const events_1 = require("events");
+const stream_1 = require("stream");
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+/**
+ * Configure the already-mocked `https` module to behave as a specific upstream.
+ *
+ * @param mockHttps   The `https` module, which must have been replaced by
+ *                    `jest.mock('https')` before this file was imported.
+ * @param opts        Upstream response options.
+ * @returns           Arrays of captured request options and headers, populated
+ *                    on each upstream call.
+ */
+function setupUpstreamMock(mockHttps, opts = {}) {
+    const capturedOpts = [];
+    const capturedHeaders = [];
+    const { statusCode = 200, contentType = 'application/json', body = Buffer.from('{}'), delayMs = 0, hang = false, } = opts;
+    const bodyBuf = typeof body === 'string' ? Buffer.from(body) : body;
+    mockHttps.request.mockImplementation((reqOpts, callback) => {
+        capturedOpts.push(reqOpts);
+        capturedHeaders.push((reqOpts.headers ?? {}));
+        const mockReq = new events_1.EventEmitter();
+        mockReq.write = jest.fn(() => true);
+        mockReq.end = jest.fn(() => {
+            if (!callback)
+                return;
+            const res = Object.assign(new stream_1.Readable({ read() { } }), {
+                statusCode,
+                headers: { 'content-type': contentType },
+            });
+            if (hang) {
+                callback(res);
+                return;
+            }
+            callback(res);
+            const emit = () => {
+                res.push(bodyBuf);
+                res.push(null);
+            };
+            if (delayMs > 0) {
+                setTimeout(emit, delayMs);
+            }
+            else {
+                process.nextTick(emit);
+            }
+        });
+        return mockReq;
+    });
+    return { capturedOpts, capturedHeaders };
+}
+/** Make a POST request to the local proxy (not the upstream). */
+function postToProxy(port, urlPath, body, extraHeaders = {}) {
+    const bodyStr = typeof body === 'string' ? body : JSON.stringify(body);
+    const bodyBuf = Buffer.from(bodyStr);
+    return new Promise((resolve, reject) => {
+        const req = http.request({
+            hostname: '127.0.0.1',
+            port,
+            path: urlPath,
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                'content-length': String(bodyBuf.length),
+                ...extraHeaders,
+            },
+        }, res => {
+            const chunks = [];
+            res.on('data', (c) => chunks.push(c));
+            res.on('end', () => {
+                resolve({
+                    status: res.statusCode ?? 0,
+                    body: Buffer.concat(chunks).toString('utf8'),
+                    headers: res.headers,
+                });
+            });
+            res.on('error', reject);
+        });
+        req.on('error', reject);
+        req.write(bodyBuf);
+        req.end();
+    });
+}
+// ---------------------------------------------------------------------------
+// Temp DB helpers — each test suite gets a fresh isolated DB path
+// ---------------------------------------------------------------------------
+/** Create a fresh temp dir and return a sqlite path inside it. */
+function makeTmpDbPath() {
+    const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'vg-proxy-test-'));
+    return path_1.default.join(dir, 'test.sqlite');
+}
+//# sourceMappingURL=proxy-test-helpers.js.map

package/dist/__tests__/integration/proxy-test-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-test-helpers.js","sourceRoot":"","sources":["../../../src/__tests__/integration/proxy-test-helpers.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+CA,8CA6DC;AAaD,kCAuCC;AAOD,sCAGC;AA1KD;;;;;;;;;;;GAWG;AACH,2CAA6B;AAC7B,mCAAsC;AACtC,mCAAkC;AAClC,4CAAoB;AACpB,gDAAwB;AACxB,4CAAoB;AAqBpB;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAC/B,SAAiC,EACjC,OAA4B,EAAE;IAK9B,MAAM,YAAY,GAA0B,EAAE,CAAC;IAC/C,MAAM,eAAe,GAAoD,EAAE,CAAC;IAE5E,MAAM,EACJ,UAAU,GAAG,GAAG,EAChB,WAAW,GAAG,kBAAkB,EAChC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EACxB,OAAO,GAAG,CAAC,EACX,IAAI,GAAG,KAAK,GACb,GAAG,IAAI,CAAC;IAET,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEpE,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAClC,CAAC,OAA4B,EAAE,QAA8C,EAAE,EAAE;QAC/E,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3B,eAAe,CAAC,IAAI,CAClB,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAkD,CACzE,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,qBAAY,EAAuB,CAAC;QACxD,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE;YACzB,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAEtB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,iBAAQ,CAAC,EAAE,IAAI,KAAI,CAAC,EAAE,CAAC,EAAE;gBACrD,UAAU;gBACV,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAA4B;aACnE,CAAyB,CAAC;YAE3B,IAAI,IAAI,EAAE,CAAC;gBACT,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YAED,QAAQ,CAAC,GAAG,CAAC,CAAC;YAEd,MAAM,IAAI,GAAG,GAAG,EAAE;gBAChB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC,CAAC;YAEF,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChB,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC,CACF,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;AAC3C,CAAC;AAYD,iEAAiE;AACjE,SAAgB,WAAW,CACzB,IAAY,EACZ,OAAe,EACf,IAAqB,EACrB,eAAuC,EAAE;IAEzC,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAErC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CACtB;YACE,QAAQ,EAAE,WAAW;YACrB,IAAI;YACJ,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;gBACxC,GAAG,YAAY;aAChB;SACF,EACD,GAAG,CAAC,EAAE;YACJ,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,OAAO,CAAC;oBACN,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;oBAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC5C,OAAO,EAAE,GAAG,CAAC,OAAO;iBACrB,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAE9E,kEAAkE;AAClE,SAAgB,aAAa;IAC3B,MAAM,GAAG,GAAG,YAAE,CAAC,WAAW,CAAC,cAAI,CAAC,IAAI,CAAC,YAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACrE,OAAO,cAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AACvC,CAAC"}

package/dist/cli-entry.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli-entry.d.ts.map

package/dist/cli-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-entry.d.ts","sourceRoot":"","sources":["../src/cli-entry.ts"],"names":[],"mappings":""}

package/dist/cli-entry.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const cli_1 = require("./cli");
+const program = (0, cli_1.buildCli)();
+// Parse arguments and execute command
+program.parseAsync().then(() => {
+    // Successful completion
+    process.exit(0);
+}).catch((error) => {
+    // Handle errors
+    console.error(error);
+    process.exit(1);
+});
+//# sourceMappingURL=cli-entry.js.map

package/dist/cli-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-entry.js","sourceRoot":"","sources":["../src/cli-entry.ts"],"names":[],"mappings":";;;AAEA,+BAAiC;AAEjC,MAAM,OAAO,GAAG,IAAA,cAAQ,GAAE,CAAC;AAE3B,sCAAsC;AACtC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;IAC7B,wBAAwB;IACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACjB,gBAAgB;IAChB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function buildCli(): Command;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAkBpC,wBAAgB,QAAQ,IAAI,OAAO,CAkOlC"}

package/dist/cli.js

@@ -0,0 +1,241 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildCli = buildCli;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const commander_1 = require("commander");
+const scan_1 = require("./commands/scan");
+const install_hook_1 = require("./commands/install-hook");
+const tokens_1 = require("./commands/tokens");
+const fix_1 = require("./commands/fix");
+const check_1 = require("./commands/check");
+const statusline_1 = require("./commands/statusline");
+const suggest_model_1 = require("./commands/suggest-model");
+const proxy_1 = require("./commands/proxy");
+const data_1 = require("./commands/data");
+const config_1 = require("./commands/config");
+function readCliVersion() {
+    const pkgPath = path.join(__dirname, '..', 'package.json');
+    const raw = fs.readFileSync(pkgPath, 'utf-8');
+    return JSON.parse(raw).version;
+}
+function buildCli() {
+    const program = new commander_1.Command();
+    program
+        .name('vault-guard')
+        .description('Security and optimization layer for AI-native coding')
+        .version(readCliVersion());
+    const configCmd = program.command('config').description('Inspect and validate Vault Guard configuration');
+    configCmd
+        .command('validate')
+        .description('Validate the nearest .vault-guard.json (structure + scanner load)')
+        .action(async () => {
+        const exitCode = await (0, config_1.configValidateCommand)(process.cwd());
+        if (exitCode !== 0)
+            process.exit(exitCode);
+    });
+    // Scan command
+    program
+        .command('scan')
+        .description('Scan files for secrets')
+        .argument('[path]', 'Path to scan', '.')
+        .option('-f, --format <format>', 'Output format: text | json | sarif', 'text')
+        .option('--staged', 'Scan git staged files only (uses index vs HEAD)', false)
+        .action(async (path, options) => {
+        const format = options.format ?? 'text';
+        const exitCode = await (0, scan_1.scanCommand)(path, format, Boolean(options.staged));
+        if (exitCode !== 0) {
+            process.exit(exitCode);
+        }
+    });
+    // Install-hook command
+    program
+        .command('install-hook')
+        .description('Install pre-commit hook (runs vault-guard scan --staged)')
+        .option('-m, --manager <manager>', 'Hook integration: native | husky | lefthook | precommit', 'native')
+        .action(async (options) => {
+        const m = (options.manager ?? 'native').toLowerCase();
+        if (!['native', 'husky', 'lefthook', 'precommit'].includes(m)) {
+            console.error(`Unknown manager: ${options.manager}`);
+            process.exit(1);
+        }
+        await (0, install_hook_1.installHookCommand)(m);
+    });
+    // Tokens command
+    program
+        .command('tokens')
+        .description('Show token usage')
+        .action(async () => {
+        await (0, tokens_1.tokensCommand)();
+    });
+    // Fix command
+    program
+        .command('fix')
+        .description('Show remediation steps for secrets')
+        .argument('[files...]', 'Files to check')
+        .action(async (files) => {
+        const exitCode = await (0, fix_1.fixCommand)(files);
+        if (exitCode !== 0) {
+            process.exit(exitCode);
+        }
+    });
+    // Check command
+    program
+        .command('check')
+        .description('Quick check')
+        .argument('[files...]', 'Files to check')
+        .action(async (files) => {
+        const exitCode = await (0, check_1.checkCommand)(files);
+        if (exitCode !== 0) {
+            process.exit(exitCode);
+        }
+    });
+    program
+        .command('statusline')
+        .description('Emit status fields for editor statuslines (JSON)')
+        .option('--json', 'Print machine-readable JSON (default)', true)
+        .option('--human', 'Print human-readable summary instead of JSON')
+        .action((options) => {
+        const asJson = options.human ? false : options.json !== false;
+        (0, statusline_1.statuslineCommand)(asJson);
+    });
+    program
+        .command('suggest-model')
+        .description('Heuristic model hint from local telemetry (opt-in)')
+        .option('--json', 'Print JSON', false)
+        .option('--cwd <dir>', 'Optional cwd context label')
+        .option('--language <lang>', 'Optional language label (e.g. tsx)')
+        .action((options) => {
+        (0, suggest_model_1.suggestModelCommand)({
+            json: Boolean(options.json),
+            cwd: options.cwd,
+            language: options.language,
+        });
+    });
+    program
+        .command('proxy')
+        .description('Opt-in local Anthropic HTTP forwarder with usage logging (MVP)')
+        .requiredOption('--listen <host:port>', 'Bind address, e.g. 127.0.0.1:8765')
+        .option('--allow-env-fallback', 'Permit fallback to ANTHROPIC_API_KEY when caller omits x-api-key. ' +
+        'Off by default — see SECURITY.md before enabling.', false)
+        .option('--allow-public', 'Permit binding a non-loopback address. Off by default — exposing this ' +
+        'proxy on the network combined with --allow-env-fallback is a credit-card ' +
+        'draining footgun.', false)
+        .option('--max-rpm <n>', 'Optional cap on forwarded POST /v1/messages requests per rolling 60s window (per process)')
+        .action(async (options) => {
+        try {
+            let maxRpm;
+            if (options.maxRpm !== undefined && options.maxRpm !== '') {
+                const n = Number(options.maxRpm);
+                if (!Number.isFinite(n) || n < 1) {
+                    console.error('--max-rpm must be a positive number');
+                    process.exit(1);
+                }
+                maxRpm = Math.floor(n);
+            }
+            const handle = await (0, proxy_1.proxyCommand)({
+                listen: options.listen,
+                allowEnvFallback: Boolean(options.allowEnvFallback),
+                allowPublic: Boolean(options.allowPublic),
+                maxRpm,
+            });
+            let signalled = false;
+            const onSignal = (signal) => {
+                if (signalled)
+                    return;
+                signalled = true;
+                void handle
+                    .shutdown(signal)
+                    .catch(() => {
+                    /* shutdown is best-effort */
+                })
+                    .finally(() => process.exit(0));
+            };
+            process.on('SIGINT', onSignal);
+            process.on('SIGTERM', onSignal);
+            await new Promise(() => {
+                /* keep process alive until a signal triggers shutdown */
+            });
+        }
+        catch (e) {
+            console.error(String(e));
+            process.exit(1);
+        }
+    });
+    // `data` parent command — inspects, exports, and resets the local
+    // telemetry database at `~/.vault-guard/usage.sqlite`. No subcommand
+    // shows help; this avoids an empty command landing.
+    const dataCmd = program
+        .command('data')
+        .description('Inspect, export, or reset local telemetry (~/.vault-guard/usage.sqlite)');
+    dataCmd
+        .command('status')
+        .description('Show a privacy-respecting summary of the local telemetry database')
+        .option('--json', 'Print JSON', false)
+        .action(async (options) => {
+        const exitCode = await (0, data_1.dataStatusCommand)({ json: Boolean(options.json) });
+        if (exitCode !== 0)
+            process.exit(exitCode);
+    });
+    dataCmd
+        .command('reset')
+        .description('Delete the local telemetry database and its WAL/SHM sidecars')
+        .option('-y, --yes', 'Skip the interactive confirmation prompt', false)
+        .option('--dry-run', 'Print what would be deleted without touching the filesystem', false)
+        .option('--json', 'Print JSON', false)
+        .action(async (options) => {
+        const exitCode = await (0, data_1.dataResetCommand)({
+            yes: Boolean(options.yes),
+            dryRun: Boolean(options.dryRun),
+            json: Boolean(options.json),
+        });
+        if (exitCode !== 0)
+            process.exit(exitCode);
+    });
+    dataCmd
+        .command('export')
+        .description('Dump usage_events and session_events to a local file')
+        .requiredOption('-o, --output <file>', 'Output file path (will be created with mode 0600)')
+        .option('--format <format>', 'Output format: json | jsonl', 'json')
+        .action(async (options) => {
+        const fmt = options.format === 'jsonl' ? 'jsonl' : 'json';
+        const exitCode = await (0, data_1.dataExportCommand)({ output: options.output, format: fmt });
+        if (exitCode !== 0)
+            process.exit(exitCode);
+    });
+    return program;
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoBA,4BAkOC;AAtPD,uCAAyB;AACzB,2CAA6B;AAC7B,yCAAoC;AACpC,0CAA4D;AAC5D,0DAA6D;AAC7D,8CAAkD;AAClD,wCAA4C;AAC5C,4CAAgD;AAChD,sDAA0D;AAC1D,4DAA+D;AAC/D,4CAAgD;AAChD,0CAAyF;AACzF,8CAA0D;AAE1D,SAAS,cAAc;IACrB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,OAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC,OAAO,CAAC;AAC1D,CAAC;AAED,SAAgB,QAAQ;IACtB,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,aAAa,CAAC;SACnB,WAAW,CAAC,sDAAsD,CAAC;SACnE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAE7B,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,gDAAgD,CAAC,CAAC;IAE1G,SAAS;SACN,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,mEAAmE,CAAC;SAChF,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,QAAQ,GAAG,MAAM,IAAA,8BAAqB,EAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5D,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEL,eAAe;IACf,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,wBAAwB,CAAC;SACrC,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,CAAC;SACvC,MAAM,CAAC,uBAAuB,EAAE,oCAAoC,EAAE,MAAM,CAAC;SAC7E,MAAM,CAAC,UAAU,EAAE,iDAAiD,EAAE,KAAK,CAAC;SAC5E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,OAA6C,EAAE,EAAE;QAC5E,MAAM,MAAM,GAAI,OAAO,CAAC,MAAuB,IAAI,MAAM,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,IAAA,kBAAW,EAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1E,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,uBAAuB;IACvB,OAAO;SACJ,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CACL,yBAAyB,EACzB,yDAAyD,EACzD,QAAQ,CACT;SACA,MAAM,CAAC,KAAK,EAAE,OAA4B,EAAE,EAAE;QAC7C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,CAAC,WAAW,EAIpC,CAAC;QAChB,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,IAAA,iCAAkB,EAAC,CAAC,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEL,iBAAiB;IACjB,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,kBAAkB,CAAC;SAC/B,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,IAAA,sBAAa,GAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEL,cAAc;IACd,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,oCAAoC,CAAC;SACjD,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;SACxC,MAAM,CAAC,KAAK,EAAE,KAAe,EAAE,EAAE;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAA,gBAAU,EAAC,KAAK,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,gBAAgB;IAChB,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,aAAa,CAAC;SAC1B,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;SACxC,MAAM,CAAC,KAAK,EAAE,KAAe,EAAE,EAAE;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAA,oBAAY,EAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,kDAAkD,CAAC;SAC/D,MAAM,CAAC,QAAQ,EAAE,uCAAuC,EAAE,IAAI,CAAC;SAC/D,MAAM,CAAC,SAAS,EAAE,8CAA8C,CAAC;SACjE,MAAM,CAAC,CAAC,OAA4C,EAAE,EAAE;QACvD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC;QAC9D,IAAA,8BAAiB,EAAC,MAAM,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,oDAAoD,CAAC;SACjE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC;SACrC,MAAM,CAAC,aAAa,EAAE,4BAA4B,CAAC;SACnD,MAAM,CAAC,mBAAmB,EAAE,oCAAoC,CAAC;SACjE,MAAM,CAAC,CAAC,OAA4D,EAAE,EAAE;QACvE,IAAA,mCAAmB,EAAC;YAClB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,gEAAgE,CAAC;SAC7E,cAAc,CACb,sBAAsB,EACtB,mCAAmC,CACpC;SACA,MAAM,CACL,sBAAsB,EACtB,oEAAoE;QAClE,mDAAmD,EACrD,KAAK,CACN;SACA,MAAM,CACL,gBAAgB,EAChB,wEAAwE;QACtE,2EAA2E;QAC3E,mBAAmB,EACrB,KAAK,CACN;SACA,MAAM,CACL,eAAe,EACf,2FAA2F,CAC5F;SACA,MAAM,CACL,KAAK,EAAE,OAKN,EAAE,EAAE;QACH,IAAI,CAAC;YACH,IAAI,MAA0B,CAAC;YAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC1D,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjC,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;oBACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAA,oBAAY,EAAC;gBAChC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC;gBACnD,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;gBACzC,MAAM;aACP,CAAC,CAAC;YAEH,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,MAAM,QAAQ,GAAG,CAAC,MAAsB,EAAQ,EAAE;gBAChD,IAAI,SAAS;oBAAE,OAAO;gBACtB,SAAS,GAAG,IAAI,CAAC;gBACjB,KAAK,MAAM;qBACR,QAAQ,CAAC,MAAM,CAAC;qBAChB,KAAK,CAAC,GAAG,EAAE;oBACV,6BAA6B;gBAC/B,CAAC,CAAC;qBACD,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,CAAC,CAAC;YACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAEhC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE;gBACrB,yDAAyD;YAC3D,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CACF,CAAC;IAEJ,kEAAkE;IAClE,qEAAqE;IACrE,oDAAoD;IACpD,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,yEAAyE,CAAC,CAAC;IAE1F,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,mEAAmE,CAAC;SAChF,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC;SACrC,MAAM,CAAC,KAAK,EAAE,OAA2B,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAiB,EAAC,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1E,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,8DAA8D,CAAC;SAC3E,MAAM,CAAC,WAAW,EAAE,0CAA0C,EAAE,KAAK,CAAC;SACtE,MAAM,CAAC,WAAW,EAAE,6DAA6D,EAAE,KAAK,CAAC;SACzF,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC;SACrC,MAAM,CAAC,KAAK,EAAE,OAA4D,EAAE,EAAE;QAC7E,MAAM,QAAQ,GAAG,MAAM,IAAA,uBAAgB,EAAC;YACtC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;YACzB,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YAC/B,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;SAC5B,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,sDAAsD,CAAC;SACnE,cAAc,CAAC,qBAAqB,EAAE,mDAAmD,CAAC;SAC1F,MAAM,CAAC,mBAAmB,EAAE,6BAA6B,EAAE,MAAM,CAAC;SAClE,MAAM,CAAC,KAAK,EAAE,OAA4C,EAAE,EAAE;QAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAiB,EAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAClF,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEL,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/commands/check.d.ts

@@ -0,0 +1,2 @@
+export declare function checkCommand(files: string[]): Promise<number>;
+//# sourceMappingURL=check.d.ts.map

package/dist/commands/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/commands/check.ts"],"names":[],"mappings":"AAKA,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA6BnE"}

package/dist/commands/check.js

@@ -0,0 +1,40 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkCommand = checkCommand;
+const vault_guard_core_1 = require("@vaultcompass/vault-guard-core");
+const chalk_1 = __importDefault(require("chalk"));
+const path_1 = __importDefault(require("path"));
+const scan_utils_1 = require("../utils/scan-utils");
+async function checkCommand(files) {
+    const scanner = new vault_guard_core_1.SecretScanner();
+    const filesToCheck = files.length > 0 ? files : ['.'];
+    console.log(chalk_1.default.blue('✅ Quick check\n'));
+    // Use async scanning logic with same safeguards as scan command
+    const results = await (0, scan_utils_1.scanFilesAsync)(filesToCheck, scanner, {
+        verbose: false,
+        skipBinary: true,
+        progress: false
+    });
+    if (results.length === 0) {
+        console.log(chalk_1.default.green.bold('✅ Clean:'), chalk_1.default.white('No secrets found\n'));
+        return 0; // Success exit code
+    }
+    else {
+        const totalSecrets = results.reduce((sum, r) => sum + r.matches.length, 0);
+        console.log(chalk_1.default.red.bold('🔴 BLOCKED:'), chalk_1.default.white(`Found ${totalSecrets} secret${totalSecrets > 1 ? 's' : ''}\n`));
+        // Display simplified results
+        for (const { file, matches } of results) {
+            const relativePath = relativePathCwd(file);
+            console.log(chalk_1.default.red('🔴'), chalk_1.default.white(`${relativePath}: ${matches.length} secret${matches.length > 1 ? 's' : ''}`));
+        }
+        console.log('');
+        return 1; // Error exit code (secrets found)
+    }
+}
+function relativePathCwd(filePath) {
+    return path_1.default.relative(process.cwd(), filePath);
+}
+//# sourceMappingURL=check.js.map

package/dist/commands/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/commands/check.ts"],"names":[],"mappings":";;;;;AAKA,oCA6BC;AAlCD,qEAA+D;AAC/D,kDAA0B;AAC1B,gDAAwB;AACxB,oDAAqD;AAE9C,KAAK,UAAU,YAAY,CAAC,KAAe;IAChD,MAAM,OAAO,GAAG,IAAI,gCAAa,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEtD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAE3C,gEAAgE;IAChE,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAc,EAAC,YAAY,EAAE,OAAO,EAAE;QAC1D,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,eAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC7E,OAAO,CAAC,CAAC,CAAC,oBAAoB;IAChC,CAAC;SAAM,CAAC;QACN,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,eAAK,CAAC,KAAK,CAAC,SAAS,YAAY,UAAU,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAExH,6BAA6B;QAC7B,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,OAAO,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,eAAK,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,OAAO,CAAC,MAAM,UAAU,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACzH,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,CAAC,CAAC,kCAAkC;IAC9C,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO,cAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;AAChD,CAAC"}

package/dist/commands/config.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Validate the nearest `.vault-guard.json` / `.vault-guard.local.json`.
+ * Exits 0 when missing (nothing to validate) or when structurally valid.
+ */
+export declare function configValidateCommand(cwd?: string): Promise<number>;
+//# sourceMappingURL=config.d.ts.map

package/dist/commands/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":"AAQA;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,GAAG,GAAE,MAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CA6CxF"}

package/dist/commands/config.js

@@ -0,0 +1,57 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configValidateCommand = configValidateCommand;
+const fs_1 = __importDefault(require("fs"));
+const chalk_1 = __importDefault(require("chalk"));
+const vault_guard_core_1 = require("@vaultcompass/vault-guard-core");
+/**
+ * Validate the nearest `.vault-guard.json` / `.vault-guard.local.json`.
+ * Exits 0 when missing (nothing to validate) or when structurally valid.
+ */
+async function configValidateCommand(cwd = process.cwd()) {
+    const configPath = (0, vault_guard_core_1.findVaultGuardConfigPath)(cwd);
+    if (!configPath) {
+        console.log(chalk_1.default.green('✓'), chalk_1.default.white('No Vault Guard config file in search path — nothing to validate.'));
+        return 0;
+    }
+    let raw;
+    try {
+        raw = fs_1.default.readFileSync(configPath, 'utf-8');
+    }
+    catch (e) {
+        const detail = e instanceof Error ? e.message : String(e);
+        console.error(chalk_1.default.red('❌'), chalk_1.default.white(`Failed to read ${configPath}: ${detail}`));
+        return 1;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (e) {
+        const detail = e instanceof Error ? e.message : String(e);
+        console.error(chalk_1.default.red('❌'), chalk_1.default.white(`Invalid JSON in ${configPath}: ${detail}`));
+        return 1;
+    }
+    const v = (0, vault_guard_core_1.validateVaultGuardConfig)(parsed);
+    if (!v.ok) {
+        console.error(chalk_1.default.red('❌'), chalk_1.default.white(configPath));
+        for (const err of v.errors) {
+            console.error(chalk_1.default.gray('  ·'), chalk_1.default.white(err));
+        }
+        return 1;
+    }
+    const scanner = new vault_guard_core_1.SecretScanner(v.config);
+    if (scanner.extraPatternRejections.length > 0) {
+        console.error(chalk_1.default.yellow('⚠'), chalk_1.default.white('Some extra_patterns were rejected and are not active:'));
+        for (const r of scanner.extraPatternRejections) {
+            console.error(chalk_1.default.gray('  ·'), chalk_1.default.white(`${r.id}: ${r.reason} — ${r.detail}`));
+        }
+        return 1;
+    }
+    console.log(chalk_1.default.green('✓'), chalk_1.default.white(`${configPath} is valid.`));
+    return 0;
+}
+//# sourceMappingURL=config.js.map

package/dist/commands/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":";;;;;AAYA,sDA6CC;AAzDD,4CAAoB;AACpB,kDAA0B;AAC1B,qEAIwC;AAExC;;;GAGG;AACI,KAAK,UAAU,qBAAqB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IACrE,MAAM,UAAU,GAAG,IAAA,2CAAwB,EAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,eAAK,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC,CAAC;QAC/G,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,eAAK,CAAC,KAAK,CAAC,kBAAkB,UAAU,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,eAAK,CAAC,KAAK,CAAC,mBAAmB,UAAU,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;QACvF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,CAAC,GAAG,IAAA,2CAAwB,EAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,eAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACvD,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,eAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,gCAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,eAAK,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC,CAAC;QACvG,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC;YAC/C,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,eAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,eAAK,CAAC,KAAK,CAAC,GAAG,UAAU,YAAY,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,CAAC;AACX,CAAC"}