@veilio-inc/cli 0.1.0

package/LICENSE

@@ -0,0 +1,248 @@
+# Veilio Community License
+
+_Version 1.0 · Effective 2026-08-08_
+
+**Copyright © 2026 Veilio**
+
+> **Plain-language summary (non-binding; the numbered terms below control).**
+> Use Veilio for anything you like — personally, or inside your company, including
+> to make money. Read it, fork it, change it, self-host it, ship products with it.
+> The one thing you may not do without written permission is sell Veilio itself:
+> reselling it, white-labeling it, or running it as a hosted service for other
+> people. Contributions are welcome. For a commercial or redistribution license,
+> email `hello@veilio.dev`.
+
+---
+
+## 1. Project Model
+
+This project follows a **source-available and community-driven development model** with a separate commercial Cloud Edition. The source is public and contributions are welcome, but this is deliberately **not an OSI-approved open-source license**: the commercial restrictions in Section 5 go beyond what that definition permits.
+
+The **Community Core** is publicly available and intended to be freely used, inspected, modified, forked, and improved by the community. Contributions from the community are welcome and are an important part of the project's development.
+
+The **Cloud Edition** is a separate commercial offering operated by Veilio. It provides hosted and managed functionality and may include additional proprietary features, infrastructure, services, and support.
+
+The Software may be used for personal purposes as well as for internal commercial purposes. Organizations may deploy and use the Software within their own businesses without requiring a commercial license.
+
+However, the Software may not be commercially redistributed, resold, white-labeled, or offered as a third-party hosted service without prior written permission from Veilio.
+
+The purpose of this model is to keep the core technology open and community-driven while allowing the project owner to maintain and commercially operate the official Cloud Edition.
+
+---
+
+## 2. Definitions
+
+For the purposes of this License:
+
+**"Software"** means the source code, binaries, documentation, configuration, and other materials distributed as part of this project.
+
+**"Community Core"** means the publicly available portion of the Software developed and distributed under this License.
+
+**"Modified Version"** means any work based on, derived from, or incorporating substantial portions of the Software.
+
+**"Cloud Edition"** means the hosted, managed, or subscription-based version of the Software operated and commercially provided by Veilio, including any proprietary services, infrastructure, features, or components associated with it.
+
+**"Commercial Distribution"** means selling, licensing, renting, leasing, sublicensing, or otherwise providing the Software or a Modified Version to third parties in exchange for payment or other commercial consideration.
+
+**"Hosted Service"** means making the Software or a Modified Version available to third parties over a network, including as a SaaS, PaaS, managed service, hosted application, or similar commercial offering.
+
+**"Competing Product"** means a commercially offered product or service whose primary purpose and core functionality substantially overlap with the Software or Cloud Edition.
+
+---
+
+## 3. Permissions
+
+Subject to the restrictions in this License, you are granted a worldwide, royalty-free, non-exclusive license to:
+
+* use the Software for personal purposes;
+* use the Software for internal commercial purposes;
+* inspect and study the source code;
+* modify the Software;
+* create forks and derivative works;
+* submit contributions, patches, bug fixes, and improvements to the project;
+* use modified versions for personal purposes or internal commercial operations;
+* share the Software and Modified Versions for non-commercial purposes.
+
+These permissions are intended to enable community development, experimentation, self-hosting, internal business use, and collaboration.
+
+---
+
+## 4. Internal Commercial Use
+
+Commercial use of the Software is permitted when the Software is used as an internal tool or component of your own business activities.
+
+For example, an organization may deploy the Software on its own infrastructure and use it to:
+
+* operate internal business processes;
+* support its employees;
+* develop its own products;
+* provide its own services;
+* manage its own operations; or
+* otherwise conduct its own commercial activities.
+
+The fact that an organization generates revenue through its business does not, by itself, constitute a violation of this License.
+
+The restriction applies to **commercializing the Software itself**, rather than using the Software as part of your own business.
+
+---
+
+## 5. Commercial Restrictions
+
+Without prior written permission from Veilio, you may not:
+
+### 5.1 Sell or Resell the Software
+
+Sell, license, rent, lease, sublicense, or otherwise commercially distribute the Software or a Modified Version as a standalone product.
+
+### 5.2 Offer the Software as a Hosted Service
+
+Operate the Software or a Modified Version as a commercial SaaS, PaaS, hosted application, managed service, or similar service for third parties.
+
+### 5.3 Create a Competing Commercial Product
+
+Use the Software or a Modified Version as the basis for a commercially offered product or service that substantially competes with the Cloud Edition.
+
+### 5.4 White-Label or Rebrand the Software
+
+Repackage, white-label, rebrand, or otherwise present the Software or a Modified Version as your own commercial software product.
+
+### 5.5 Commercially Redistribute Modified Versions
+
+Commercially distribute a Modified Version where the primary value or functionality being sold is provided by the Software.
+
+Requests for written permission may be sent to `hello@veilio.dev`.
+
+---
+
+## 6. Cloud Edition
+
+The Cloud Edition is the official commercial hosted offering of the project.
+
+The Cloud Edition may be provided through paid subscriptions and may include:
+
+* managed hosting;
+* automatic updates;
+* backups;
+* infrastructure and scalability;
+* monitoring;
+* enterprise functionality;
+* technical support;
+* proprietary features;
+* other hosted or managed services.
+
+The Community Core and Cloud Edition may share common code, concepts, or functionality. However, access to the Community Core does not grant any right to commercially operate a competing hosted version of the Cloud Edition.
+
+The Cloud Edition may be governed by separate Terms of Service, subscription agreements, privacy policies, and commercial licenses.
+
+---
+
+## 7. Forks and Modified Versions
+
+You are permitted to create forks and Modified Versions of the Software for:
+
+* personal use;
+* internal business use;
+* research;
+* education;
+* development;
+* experimentation; and
+* other purposes permitted by this License.
+
+Forks and Modified Versions must retain applicable copyright notices and a copy of this License.
+
+Creating a fork does not grant permission to commercially distribute that fork, offer it as a commercial Hosted Service, or use it to create a Competing Product.
+
+---
+
+## 8. Contributions
+
+Contributions to the Community Core are welcome.
+
+By submitting a contribution, you represent that you have the necessary rights to submit that contribution and agree that it may be incorporated into the project and distributed under this License.
+
+Unless otherwise agreed in writing, contributions will be made available under the same licensing terms as the Software.
+
+Contributors retain ownership of their original contributions to the extent permitted by applicable law.
+
+---
+
+## 9. Redistribution
+
+You may redistribute the Software and Modified Versions for non-commercial purposes, provided that:
+
+* applicable copyright notices are retained;
+* the original project is appropriately credited;
+* a copy of this License is included;
+* recipients are informed of the applicable licensing terms; and
+* the redistribution does not imply endorsement by Veilio.
+
+Commercial redistribution requires prior written permission from Veilio.
+
+---
+
+## 10. Attribution
+
+Redistributions of the Software or Modified Versions must retain:
+
+* applicable copyright notices;
+* notices identifying the original project; and
+* a copy of this License.
+
+You may add your own copyright notices for your modifications, provided that they do not imply ownership of the original Software.
+
+---
+
+## 11. Trademarks
+
+This License does not grant permission to use the project's name, logo, trademarks, service marks, domain names, or branding except as reasonably necessary to identify the original Software.
+
+You may not use the project's trademarks to imply endorsement, sponsorship, affiliation, or official status without prior written permission.
+
+Creating a fork does not grant the right to use the project's trademarks for that fork.
+
+---
+
+## 12. No Warranty
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED.
+
+TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE AUTHORS AND COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT.
+
+---
+
+## 13. Limitation of Liability
+
+TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL THE AUTHORS, COPYRIGHT HOLDERS, CONTRIBUTORS, OR PROJECT OWNERS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY ARISING FROM OR RELATED TO THE SOFTWARE OR THE USE OR INABILITY TO USE THE SOFTWARE.
+
+---
+
+## 14. Termination
+
+Your rights under this License terminate automatically if you materially violate its terms.
+
+Upon termination, you must cease the activities that are prohibited by this License.
+
+Permissions granted to recipients who are not in violation of this License remain unaffected.
+
+---
+
+## 15. Reservation of Rights
+
+All rights not expressly granted by this License are reserved by Veilio.
+
+In particular, this License does not grant rights to commercially sell, redistribute, host, white-label, or operate a competing commercial service based on the Software beyond the permissions expressly stated above.
+
+---
+
+## 16. License Versions
+
+The project owner may publish future versions of this License.
+
+Each version will be identified by a version number. Unless explicitly stated otherwise, versions of the Software already distributed under a particular version of this License remain subject to that version.
+
+---
+
+**Project:** Veilio
+**Copyright:** © 2026 Veilio
+**License:** Veilio Community License, Version 1.0
+**Contact:** `hello@veilio.dev`

package/README.md

@@ -0,0 +1,121 @@
+# @veilio-inc/cli
+
+Anonymize code before it reaches an LLM, restore it after — from a terminal, a pipe, or a pre-commit hook.
+
+```bash
+veilio scrub src/billing.ts | pbcopy     # mask, then paste anywhere
+pbpaste | veilio restore                 # bring the answer back
+git diff --cached | veilio scan          # refuse to commit a live key
+```
+
+## Install
+
+```bash
+npm install -g @veilio-inc/cli     # or run it without installing:
+npx @veilio-inc/cli scrub src/billing.ts
+```
+
+Requires Node 24 or newer. No account, no API key, and no network call on any of
+the commands below — `packages/cli/tests/purity.test.ts` traps the network
+globals and fails if one is ever introduced.
+
+## Commands
+
+| Command              | Purpose                                                               |
+| -------------------- | --------------------------------------------------------------------- |
+| `scrub [files...]`   | Mask identifiers, redact credentials. Reads stdin when given no file. |
+| `restore [files...]` | Swap placeholders back, strip AI-generated noise.                     |
+| `scan [files...]`    | Detect credentials only. Never rewrites. Exits 1 on findings.         |
+| `map`                | Show the symbol map (`--clear` to wipe it).                           |
+
+## Options
+
+```
+-l, --language <lang>   auto (default), typescript, python, go, java, csharp,
+                        rust, ruby, php, c, sql
+-s, --secrets <policy>  redact (default) | warn | off
+-p, --preamble          Prepend the downstream-AI note and placeholder legend
+-m, --map <path>        Use a specific map file
+    --json              Machine-readable output (scan, map)
+    --strict            scan: also fail on advisory findings
+-q, --quiet             Suppress the stderr summary
+```
+
+## Piping
+
+Transformed code goes to **stdout**; summaries, warnings and errors go to **stderr**. That split is what makes the CLI composable — the summary stays visible without corrupting the pipe.
+
+## Exit codes
+
+| Code | Meaning                                |
+| ---- | -------------------------------------- |
+| 0    | Clean                                  |
+| 1    | Findings that should stop the pipeline |
+| 2    | Usage or IO error                      |
+
+As a pre-commit hook:
+
+```bash
+#!/bin/sh
+git diff --cached | veilio scan || {
+  echo "Commit blocked: credentials detected." >&2
+  exit 1
+}
+```
+
+## The symbol map
+
+`scrub` writes `.veilio/map.json` at the project root and `restore` reads it, so placeholders stay stable across runs and across a whole session. The store is created `0600` with its own `.gitignore` — it holds the real identifier names, so committing it would undo the anonymization for anyone reading the repo.
+
+Redacted credentials are **not** in the map. `restore` cannot bring them back, by construction.
+
+## In CI
+
+### GitHub Action
+
+```yaml
+- uses: veilio-inc/veilio/packages/cli@v0.1.0
+  with:
+    strict: false # also fail on emails / private IPs
+    sarif: veilio.sarif # optional: upload to code scanning
+```
+
+**This example does not work yet, and needs two things that do not exist.** The
+`@v0.1.0` ref is a git tag on this repository — the only tags here are
+`engine-v*`, cut by semantic-release for the engine — and the Action's own script
+runs `npx --yes @veilio-inc/cli@<version>`, which needs the package on npm.
+Publishing supplies the second; the first is a tag someone has to cut, and note
+that `v*.*.*` is also what triggers the Community Edition release workflow, so
+the two are not independent.
+
+Scans the **pull-request diff** by default, not the whole tree. A repo adopting
+this mid-life almost always has a historical finding somewhere; blocking every PR
+on that is how a security check gets switched off in week one. Pass `paths:` to
+scan a fixed set instead.
+
+Findings land in the job summary and, with `sarif:`, in GitHub code scanning.
+Reports carry truncated previews only — a stored, shareable artifact must never
+contain the credential it is reporting.
+
+### Pre-commit
+
+Via the [pre-commit framework](https://pre-commit.com):
+
+```yaml
+repos:
+  - repo: https://github.com/veilio-inc/veilio
+    rev: v0.1.0
+    hooks:
+      - id: veilio-scan
+```
+
+Or a plain git hook:
+
+```bash
+cp packages/cli/hooks/pre-commit .git/hooks/pre-commit
+chmod +x .git/hooks/pre-commit
+```
+
+It scans the **staged** diff — what you are about to commit is what matters, and
+a finding in an unstaged scratch file shouldn't block you. `--no-verify`
+overrides, as usual.

package/dist/args.d.ts

@@ -0,0 +1,30 @@
+import { type LanguageOption } from '@veilio-inc/engine';
+import type { SecretPolicy } from '@veilio-inc/engine';
+export type Command = 'scrub' | 'restore' | 'scan' | 'map' | 'help' | 'version';
+export interface ParsedArgs {
+    command: Command;
+    /** Positional file paths. Empty means read stdin (or, for `scan`, error). */
+    files: string[];
+    language: LanguageOption;
+    secrets: SecretPolicy;
+    /** Prepend the downstream-AI preamble and legend to scrub output. */
+    preamble: boolean;
+    /** Override the map store location. */
+    mapPath: string | null;
+    /** Machine-readable output (scan). */
+    json: boolean;
+    /** Suppress the human-readable summary on stderr. */
+    quiet: boolean;
+    /** `map --clear` wipes the store. */
+    clear: boolean;
+    /** Treat medium-severity findings as failures too (scan). */
+    strict: boolean;
+    /** Keep JSDoc blocks when restoring. */
+    keepDocs: boolean;
+    /** Allow a map write that would drop entries already on disk. */
+    force: boolean;
+}
+export declare class UsageError extends Error {
+}
+export declare function parseArgs(argv: readonly string[]): ParsedArgs;
+//# sourceMappingURL=args.d.ts.map

package/dist/args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAIA,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEtD,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;AAE/E,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAA;IAChB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,QAAQ,EAAE,cAAc,CAAA;IACxB,OAAO,EAAE,YAAY,CAAA;IACrB,qEAAqE;IACrE,QAAQ,EAAE,OAAO,CAAA;IACjB,uCAAuC;IACvC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,sCAAsC;IACtC,IAAI,EAAE,OAAO,CAAA;IACb,qDAAqD;IACrD,KAAK,EAAE,OAAO,CAAA;IACd,qCAAqC;IACrC,KAAK,EAAE,OAAO,CAAA;IACd,6DAA6D;IAC7D,MAAM,EAAE,OAAO,CAAA;IACf,wCAAwC;IACxC,QAAQ,EAAE,OAAO,CAAA;IACjB,iEAAiE;IACjE,KAAK,EAAE,OAAO,CAAA;CACf;AAED,qBAAa,UAAW,SAAQ,KAAK;CAAG;AAaxC,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAgG7D"}

package/dist/args.js

@@ -0,0 +1,108 @@
+// Hand-rolled argument parsing. The engine ships zero runtime dependencies as a
+// privacy invariant (an audited supply chain is the point), and a CLI that
+// wraps it should not undo that for the sake of flag parsing.
+import { LANGUAGES } from '@veilio-inc/engine';
+export class UsageError extends Error {
+}
+const COMMANDS = new Set(['scrub', 'restore', 'scan', 'map', 'help', 'version']);
+const SECRET_POLICIES = new Set(['redact', 'warn', 'off']);
+const LANGUAGE_VALUES = new Set([...LANGUAGES, 'auto']);
+function requireValue(flag, value) {
+    if (value === undefined || value.startsWith('-')) {
+        throw new UsageError(`${flag} requires a value`);
+    }
+    return value;
+}
+export function parseArgs(argv) {
+    const parsed = {
+        command: 'help',
+        files: [],
+        language: 'auto',
+        secrets: 'redact',
+        preamble: false,
+        mapPath: null,
+        json: false,
+        quiet: false,
+        clear: false,
+        strict: false,
+        keepDocs: false,
+        force: false,
+    };
+    if (argv.length === 0)
+        return parsed;
+    let i = 0;
+    const first = argv[0];
+    if (!first.startsWith('-')) {
+        if (!COMMANDS.has(first)) {
+            throw new UsageError(`unknown command "${first}"`);
+        }
+        parsed.command = first;
+        i = 1;
+    }
+    for (; i < argv.length; i++) {
+        const arg = argv[i];
+        switch (arg) {
+            case '-h':
+            case '--help':
+                parsed.command = 'help';
+                break;
+            case '-v':
+            case '--version':
+                parsed.command = 'version';
+                break;
+            case '-l':
+            case '--language': {
+                const value = requireValue(arg, argv[++i]);
+                if (!LANGUAGE_VALUES.has(value)) {
+                    throw new UsageError(`unknown language "${value}" — expected auto or one of: ${LANGUAGES.join(', ')}`);
+                }
+                parsed.language = value;
+                break;
+            }
+            case '-s':
+            case '--secrets': {
+                const value = requireValue(arg, argv[++i]);
+                if (!SECRET_POLICIES.has(value)) {
+                    throw new UsageError(`--secrets must be redact, warn, or off (got "${value}")`);
+                }
+                parsed.secrets = value;
+                break;
+            }
+            case '-m':
+            case '--map':
+                parsed.mapPath = requireValue(arg, argv[++i]);
+                break;
+            case '-p':
+            case '--preamble':
+                parsed.preamble = true;
+                break;
+            case '--json':
+                parsed.json = true;
+                break;
+            case '-q':
+            case '--quiet':
+                parsed.quiet = true;
+                break;
+            case '--clear':
+                parsed.clear = true;
+                break;
+            case '--strict':
+                parsed.strict = true;
+                break;
+            case '--keep-docs':
+                parsed.keepDocs = true;
+                break;
+            case '-f':
+            case '--force':
+                parsed.force = true;
+                break;
+            default:
+                if (arg.startsWith('-') && arg !== '-') {
+                    throw new UsageError(`unknown flag "${arg}"`);
+                }
+                parsed.files.push(arg);
+        }
+    }
+    return parsed;
+}
+//# sourceMappingURL=args.js.map

package/dist/args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,2EAA2E;AAC3E,8DAA8D;AAE9D,OAAO,EAAE,SAAS,EAAsC,MAAM,oBAAoB,CAAA;AA6BlF,MAAM,OAAO,UAAW,SAAQ,KAAK;CAAG;AAExC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAU,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AACzF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;AACxE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA;AAE/D,SAAS,YAAY,CAAC,IAAY,EAAE,KAAyB;IAC3D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAA;IAClD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,MAAM,MAAM,GAAe;QACzB,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,KAAK;KACb,CAAA;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAA;IAEpC,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACrB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAgB,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,UAAU,CAAC,oBAAoB,KAAK,GAAG,CAAC,CAAA;QACpD,CAAC;QACD,MAAM,CAAC,OAAO,GAAG,KAAgB,CAAA;QACjC,CAAC,GAAG,CAAC,CAAA;IACP,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC;YACV,KAAK,QAAQ;gBACX,MAAM,CAAC,OAAO,GAAG,MAAM,CAAA;gBACvB,MAAK;YACP,KAAK,IAAI,CAAC;YACV,KAAK,WAAW;gBACd,MAAM,CAAC,OAAO,GAAG,SAAS,CAAA;gBAC1B,MAAK;YACP,KAAK,IAAI,CAAC;YACV,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC1C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChC,MAAM,IAAI,UAAU,CAClB,qBAAqB,KAAK,gCAAgC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjF,CAAA;gBACH,CAAC;gBACD,MAAM,CAAC,QAAQ,GAAG,KAA0B,CAAA;gBAC5C,MAAK;YACP,CAAC;YACD,KAAK,IAAI,CAAC;YACV,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC1C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAqB,CAAC,EAAE,CAAC;oBAChD,MAAM,IAAI,UAAU,CAAC,gDAAgD,KAAK,IAAI,CAAC,CAAA;gBACjF,CAAC;gBACD,MAAM,CAAC,OAAO,GAAG,KAAqB,CAAA;gBACtC,MAAK;YACP,CAAC;YACD,KAAK,IAAI,CAAC;YACV,KAAK,OAAO;gBACV,MAAM,CAAC,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC7C,MAAK;YACP,KAAK,IAAI,CAAC;YACV,KAAK,YAAY;gBACf,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAA;gBACtB,MAAK;YACP,KAAK,QAAQ;gBACX,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;gBAClB,MAAK;YACP,KAAK,IAAI,CAAC;YACV,KAAK,SAAS;gBACZ,MAAM,CAAC,KAAK,GAAG,IAAI,CAAA;gBACnB,MAAK;YACP,KAAK,SAAS;gBACZ,MAAM,CAAC,KAAK,GAAG,IAAI,CAAA;gBACnB,MAAK;YACP,KAAK,UAAU;gBACb,MAAM,CAAC,MAAM,GAAG,IAAI,CAAA;gBACpB,MAAK;YACP,KAAK,aAAa;gBAChB,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAA;gBACtB,MAAK;YACP,KAAK,IAAI,CAAC;YACV,KAAK,SAAS;gBACZ,MAAM,CAAC,KAAK,GAAG,IAAI,CAAA;gBACnB,MAAK;YACP;gBACE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;oBACvC,MAAM,IAAI,UAAU,CAAC,iBAAiB,GAAG,GAAG,CAAC,CAAA;gBAC/C,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/commands.d.ts

@@ -0,0 +1,19 @@
+import type { ParsedArgs } from './args.js';
+export interface Io {
+    cwd: string;
+    stdin: () => Promise<string>;
+    stdout: (text: string) => void;
+    stderr: (text: string) => void;
+}
+/** Exit codes are the contract for CI and pre-commit hooks:
+ *  0 clean, 1 findings that should stop the pipeline, 2 usage/IO failure. */
+export declare const EXIT_OK = 0;
+export declare const EXIT_FINDINGS = 1;
+export declare const EXIT_ERROR = 2;
+export declare function runScrub(args: ParsedArgs, io: Io): Promise<number>;
+export declare function runRestore(args: ParsedArgs, io: Io): Promise<number>;
+/** Detect-only pass for pre-commit hooks and CI. Never rewrites anything. */
+export declare function runScan(args: ParsedArgs, io: Io): Promise<number>;
+export declare function runMap(args: ParsedArgs, io: Io): Promise<number>;
+export declare const HELP = "veilio \u2014 anonymize code before it reaches an LLM, restore it after.\n\nUSAGE\n  veilio <command> [files...] [options]\n\nCOMMANDS\n  scrub [files...]     Mask identifiers and redact credentials. Reads stdin when\n                       no file is given. Writes the symbol map to .veilio/map.json.\n  restore [files...]   Swap placeholders back and strip AI-generated noise.\n  scan [files...]      Detect credentials only; never rewrites. Exits 1 when it\n                       finds something \u2014 use it in a pre-commit hook or CI.\n  map                  Show the current symbol map (--clear to wipe it).\n\nOPTIONS\n  -l, --language <lang>   auto (default), typescript, python, go, java, csharp,\n                          rust, ruby, php, c, sql\n  -s, --secrets <policy>  redact (default) | warn | off\n  -p, --preamble          Prepend the downstream-AI note and placeholder legend\n  -m, --map <path>        Use a specific map file\n      --json              Machine-readable output (scan, map)\n      --strict            scan: also fail on advisory findings\n      --keep-docs         restore: keep JSDoc blocks the model wrote\n  -f, --force             Allow a map write that would drop existing entries\n  -q, --quiet             Suppress the all-clear summary (findings always show)\n  -h, --help              Show this help\n  -v, --version           Show the version\n\nEXIT CODES\n  0  clean    1  findings that should stop the pipeline    2  usage or IO error\n\nEXAMPLES\n  veilio scrub src/billing.ts | pbcopy\n  pbpaste | veilio restore\n  git diff --cached | veilio scan       # pre-commit gate\n  veilio scan 'src/**/*.ts' --json > findings.json\n\nTransformed code goes to stdout; everything else goes to stderr, so the CLI\ncomposes in a pipe.\n";
+//# sourceMappingURL=commands.d.ts.map

package/dist/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAG3C,MAAM,WAAW,EAAE;IACjB,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC9B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAC/B;AAED;6EAC6E;AAC7E,eAAO,MAAM,OAAO,IAAI,CAAA;AACxB,eAAO,MAAM,aAAa,IAAI,CAAA;AAC9B,eAAO,MAAM,UAAU,IAAI,CAAA;AAsB3B,wBAAsB,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAyDxE;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAsD1E;AAED,6EAA6E;AAC7E,wBAAsB,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAiCvE;AAED,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBtE;AAED,eAAO,MAAM,IAAI,svDAsChB,CAAA"}

package/dist/commands.js

@@ -0,0 +1,216 @@
+// Command implementations.
+//
+// Two rules hold everywhere here:
+//   1. Transformed code goes to stdout and nothing else does, so the CLI can sit
+//      in a pipe (`veilio scrub src/billing.ts | pbcopy`).
+//   2. Summaries, warnings and errors go to stderr, so they stay visible without
+//      corrupting that pipe.
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { anonymize, detectSecrets, hasBlockingSecrets, restore, summarizeSecrets, withAiPreamble, LANGUAGE_LABELS, STRIPPABLE_TYPES, BIN_NAME, STORE_DIR, } from '@veilio-inc/engine';
+import { clearMap, loadMap, resolveMapPath, saveMap } from './store.js';
+/** Exit codes are the contract for CI and pre-commit hooks:
+ *  0 clean, 1 findings that should stop the pipeline, 2 usage/IO failure. */
+export const EXIT_OK = 0;
+export const EXIT_FINDINGS = 1;
+export const EXIT_ERROR = 2;
+async function readInput(args, io) {
+    if (args.files.length === 0)
+        return io.stdin();
+    return args.files.map((f) => readFileSync(resolve(io.cwd, f), 'utf8')).join('\n');
+}
+function formatFinding(f, file) {
+    const where = file ? `${file}:${f.line}:${f.column}` : `line ${f.line}:${f.column}`;
+    const state = f.redacted ? 'redacted' : 'left in place';
+    return `  ${f.severity.padEnd(8)} ${where}  ${f.label} — ${f.preview} (${state})`;
+}
+function summaryLine(findings) {
+    const s = summarizeSecrets(findings);
+    const parts = [];
+    if (s.critical)
+        parts.push(`${s.critical} critical`);
+    if (s.high)
+        parts.push(`${s.high} high`);
+    if (s.medium)
+        parts.push(`${s.medium} advisory`);
+    return parts.join(', ');
+}
+export async function runScrub(args, io) {
+    const source = await readInput(args, io);
+    const mapPath = resolveMapPath(args.mapPath, io.cwd);
+    const existingMap = loadMap(mapPath);
+    const result = anonymize(source, {
+        existingMap,
+        language: args.language,
+        secrets: args.secrets,
+    });
+    saveMap(mapPath, result.map, { force: args.force });
+    io.stdout(args.preamble ? withAiPreamble(result.anonymized, result.map) : result.anonymized);
+    // Survives --quiet. Everything else here describes work that went right; this
+    // says the masking itself may be wrong. No marker matched, so the file was
+    // tokenised with TypeScript rules — in a Ruby file that means `#` comments
+    // were read as code and their prose masked, and in the other direction a
+    // language whose comment syntax we did not apply had its prose left in the
+    // clear. Output that looks anonymised and is not is the one thing a pipeline
+    // must not swallow.
+    if (result.languageFallback) {
+        io.stderr(`${BIN_NAME}: no language marker matched — masked as ${LANGUAGE_LABELS[result.language]}, which may be wrong. ` +
+            `Pass --language to be sure.\n`);
+    }
+    if (!args.quiet) {
+        const added = Object.keys(result.map).length - Object.keys(existingMap).length;
+        io.stderr(`${BIN_NAME}: ${LANGUAGE_LABELS[result.language]} — ${added} new placeholder${added === 1 ? '' : 's'}, ${Object.keys(result.map).length} in map\n`);
+        // Under --quiet, unlike the language warning above. Nearly every real file
+        // has a comment beside code, so this fires on almost every run; surviving
+        // --quiet would defeat the flag and teach people to stop passing it. The
+        // engine reports it on every result either way, so nothing is hidden from a
+        // caller that wants it.
+        if (result.comments.total > 0) {
+            const { total, inline, characters } = result.comments;
+            const where = inline === 0 ? 'above the code' : `${inline} inside the body`;
+            io.stderr(`${BIN_NAME}: ${total} comment${total === 1 ? '' : 's'} (${where}) left as written — ` +
+                `${characters} characters of prose are NOT masked. Names and ticket numbers in them go out as typed.\n`);
+        }
+        if (result.secrets.length > 0) {
+            io.stderr(`${BIN_NAME}: credentials detected — ${summaryLine(result.secrets)}\n`);
+            for (const f of result.secrets)
+                io.stderr(`${formatFinding(f)}\n`);
+            if (result.secrets.some((f) => f.redacted)) {
+                io.stderr(`${BIN_NAME}: redacted values are NOT recoverable on restore. Rotate anything real.\n`);
+            }
+        }
+    }
+    return EXIT_OK;
+}
+export async function runRestore(args, io) {
+    const source = await readInput(args, io);
+    const mapPath = resolveMapPath(args.mapPath, io.cwd);
+    const map = loadMap(mapPath);
+    if (Object.keys(map).length === 0) {
+        // Restoring against an empty map returns the input verbatim, which looks
+        // like success. Say so instead.
+        io.stderr(`${BIN_NAME}: no symbol map at ${mapPath} — run "${BIN_NAME} scrub" first.\n`);
+        return EXIT_ERROR;
+    }
+    // Without --keep-docs the default strips JSDoc along with the narration and
+    // TODOs. That is right for noise, wrong when the model was asked to document
+    // its output — so the escape hatch is a flag, not a code change.
+    const strip = args.keepDocs ? STRIPPABLE_TYPES.filter((t) => t !== 'jsdoc') : 'all';
+    const result = restore(source, map, { strip });
+    io.stdout(result.restored);
+    const { resolved, missing, unresolved } = result.report;
+    // A token the map cannot explain is a finding, not a summary line: the text on
+    // stdout now contains something that means nothing, and the user is about to
+    // paste it into an editor. --quiet suppresses the all-clear, never findings —
+    // the same contract `scan` follows.
+    if (unresolved.length > 0) {
+        io.stderr(`${BIN_NAME}: ${unresolved.length} placeholder-shaped token${unresolved.length === 1 ? '' : 's'} not in the map — ` +
+            `${unresolved.join(', ')}\n`);
+        io.stderr(`${BIN_NAME}: the AI invented or altered these; they are still in the output above.\n`);
+    }
+    if (!args.quiet) {
+        io.stderr(`${BIN_NAME}: restored ${resolved.length} of ${Object.keys(map).length} placeholders, stripped ${result.strippedCount} AI artifact${result.strippedCount === 1 ? '' : 's'}\n`);
+        // Usually innocent — an answer about one function omits the rest of the
+        // file — so this sits under --quiet with the summary rather than above it.
+        if (missing.length > 0) {
+            io.stderr(`${BIN_NAME}: ${missing.length} placeholder${missing.length === 1 ? '' : 's'} did not appear in the input; ` +
+                `if the AI covered the whole file, it renamed them and those names are not recoverable from this text.\n`);
+        }
+    }
+    // Deliberately still EXIT_OK. `restore` writes usable text to stdout even when
+    // a token is unexplained, and exiting non-zero would break every
+    // `... | veilio restore > file` pipeline under `set -e` for a warning the user
+    // can act on. Gating that behind a flag is a separate decision from reporting.
+    return EXIT_OK;
+}
+/** Detect-only pass for pre-commit hooks and CI. Never rewrites anything. */
+export async function runScan(args, io) {
+    const targets = args.files.length > 0
+        ? args.files.map((f) => ({ name: f, text: readFileSync(resolve(io.cwd, f), 'utf8') }))
+        : [{ name: '<stdin>', text: await io.stdin() }];
+    const all = [];
+    for (const target of targets) {
+        for (const finding of detectSecrets(target.text)) {
+            all.push({ file: target.name, finding });
+        }
+    }
+    if (args.json) {
+        io.stdout(`${JSON.stringify(all.map((r) => ({ file: r.file, ...r.finding })), null, 2)}\n`);
+    }
+    else if (all.length === 0) {
+        if (!args.quiet)
+            io.stderr(`${BIN_NAME}: no credentials detected\n`);
+    }
+    else {
+        io.stderr(`${BIN_NAME}: ${summaryLine(all.map((r) => r.finding))}\n`);
+        for (const { file, finding } of all)
+            io.stderr(`${formatFinding(finding, file)}\n`);
+    }
+    const findings = all.map((r) => r.finding);
+    // Default gate is critical/high. --strict also fails on advisory findings,
+    // for teams whose policy covers customer emails and internal hostnames.
+    const fail = args.strict ? findings.length > 0 : hasBlockingSecrets(findings);
+    return fail ? EXIT_FINDINGS : EXIT_OK;
+}
+export async function runMap(args, io) {
+    const mapPath = resolveMapPath(args.mapPath, io.cwd);
+    if (args.clear) {
+        const removed = clearMap(mapPath);
+        io.stderr(removed ? `${BIN_NAME}: cleared ${mapPath}\n` : `${BIN_NAME}: no map at ${mapPath}\n`);
+        return EXIT_OK;
+    }
+    const map = loadMap(mapPath);
+    const entries = Object.entries(map);
+    if (args.json) {
+        io.stdout(`${JSON.stringify(map, null, 2)}\n`);
+        return EXIT_OK;
+    }
+    if (entries.length === 0) {
+        io.stderr(`${BIN_NAME}: no map at ${mapPath}\n`);
+        return EXIT_OK;
+    }
+    io.stderr(`${BIN_NAME}: ${entries.length} placeholders at ${mapPath}\n`);
+    for (const [placeholder, real] of entries)
+        io.stdout(`${placeholder}\t${real}\n`);
+    return EXIT_OK;
+}
+export const HELP = `${BIN_NAME} — anonymize code before it reaches an LLM, restore it after.
+
+USAGE
+  ${BIN_NAME} <command> [files...] [options]
+
+COMMANDS
+  scrub [files...]     Mask identifiers and redact credentials. Reads stdin when
+                       no file is given. Writes the symbol map to ${STORE_DIR}/map.json.
+  restore [files...]   Swap placeholders back and strip AI-generated noise.
+  scan [files...]      Detect credentials only; never rewrites. Exits 1 when it
+                       finds something — use it in a pre-commit hook or CI.
+  map                  Show the current symbol map (--clear to wipe it).
+
+OPTIONS
+  -l, --language <lang>   auto (default), typescript, python, go, java, csharp,
+                          rust, ruby, php, c, sql
+  -s, --secrets <policy>  redact (default) | warn | off
+  -p, --preamble          Prepend the downstream-AI note and placeholder legend
+  -m, --map <path>        Use a specific map file
+      --json              Machine-readable output (scan, map)
+      --strict            scan: also fail on advisory findings
+      --keep-docs         restore: keep JSDoc blocks the model wrote
+  -f, --force             Allow a map write that would drop existing entries
+  -q, --quiet             Suppress the all-clear summary (findings always show)
+  -h, --help              Show this help
+  -v, --version           Show the version
+
+EXIT CODES
+  0  clean    1  findings that should stop the pipeline    2  usage or IO error
+
+EXAMPLES
+  ${BIN_NAME} scrub src/billing.ts | pbcopy
+  pbpaste | ${BIN_NAME} restore
+  git diff --cached | ${BIN_NAME} scan       # pre-commit gate
+  ${BIN_NAME} scan 'src/**/*.ts' --json > findings.json
+
+Transformed code goes to stdout; everything else goes to stderr, so the CLI
+composes in a pipe.
+`;
+//# sourceMappingURL=commands.js.map

package/dist/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,EAAE;AACF,kCAAkC;AAClC,iFAAiF;AACjF,2DAA2D;AAC3D,iFAAiF;AACjF,6BAA6B;AAE7B,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EACL,SAAS,EACT,aAAa,EACb,kBAAkB,EAClB,OAAO,EACP,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,QAAQ,EACR,SAAS,GAEV,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AASvE;6EAC6E;AAC7E,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAA;AACxB,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAA;AAC9B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAA;AAE3B,KAAK,UAAU,SAAS,CAAC,IAAgB,EAAE,EAAM;IAC/C,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAA;IAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACnF,CAAC;AAED,SAAS,aAAa,CAAC,CAAgB,EAAE,IAAa;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAA;IACnF,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,CAAA;IACvD,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,OAAO,KAAK,KAAK,GAAG,CAAA;AACnF,CAAC;AAED,SAAS,WAAW,CAAC,QAAkC;IACrD,MAAM,CAAC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IACpC,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,CAAC,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,WAAW,CAAC,CAAA;IACpD,IAAI,CAAC,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,CAAA;IACxC,IAAI,CAAC,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,WAAW,CAAC,CAAA;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAgB,EAAE,EAAM;IACrD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACxC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,CAAA;IACpD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAEpC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE;QAC/B,WAAW;QACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAA;IAEF,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;IACnD,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAE5F,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,oBAAoB;IACpB,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,EAAE,CAAC,MAAM,CACP,GAAG,QAAQ,4CAA4C,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB;YAC7G,+BAA+B,CAClC,CAAA;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAA;QAC9E,EAAE,CAAC,MAAM,CACP,GAAG,QAAQ,KAAK,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,WAAW,CACnJ,CAAA;QACD,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,4EAA4E;QAC5E,wBAAwB;QACxB,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAA;YACrD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,MAAM,kBAAkB,CAAA;YAC3E,EAAE,CAAC,MAAM,CACP,GAAG,QAAQ,KAAK,KAAK,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,sBAAsB;gBACpF,GAAG,UAAU,0FAA0F,CAC1G,CAAA;QACH,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,EAAE,CAAC,MAAM,CAAC,GAAG,QAAQ,4BAA4B,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YACjF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;gBAAE,EAAE,CAAC,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YAClE,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3C,EAAE,CAAC,MAAM,CACP,GAAG,QAAQ,2EAA2E,CACvF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAgB,EAAE,EAAM;IACvD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACxC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,CAAA;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAE5B,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,yEAAyE;QACzE,gCAAgC;QAChC,EAAE,CAAC,MAAM,CAAC,GAAG,QAAQ,sBAAsB,OAAO,WAAW,QAAQ,kBAAkB,CAAC,CAAA;QACxF,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,iEAAiE;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACnF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9C,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAE1B,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,MAAM,CAAA;IAEvD,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,oCAAoC;IACpC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,EAAE,CAAC,MAAM,CACP,GAAG,QAAQ,KAAK,UAAU,CAAC,MAAM,4BAA4B,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,oBAAoB;YACjH,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAC/B,CAAA;QACD,EAAE,CAAC,MAAM,CACP,GAAG,QAAQ,2EAA2E,CACvF,CAAA;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,EAAE,CAAC,MAAM,CACP,GAAG,QAAQ,cAAc,QAAQ,CAAC,MAAM,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,2BAA2B,MAAM,CAAC,aAAa,eAAe,MAAM,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAC9K,CAAA;QACD,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,EAAE,CAAC,MAAM,CACP,GAAG,QAAQ,KAAK,OAAO,CAAC,MAAM,eAAe,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,gCAAgC;gBAC1G,yGAAyG,CAC5G,CAAA;QACH,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,iEAAiE;IACjE,+EAA+E;IAC/E,+EAA+E;IAC/E,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAgB,EAAE,EAAM;IACpD,MAAM,OAAO,GACX,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACnB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAEnD,MAAM,GAAG,GAA+C,EAAE,CAAA;IAC1D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;QAC1C,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,EAAE,CAAC,MAAM,CACP,GAAG,IAAI,CAAC,SAAS,CACf,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAChD,IAAI,EACJ,CAAC,CACF,IAAI,CACN,CAAA;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,EAAE,CAAC,MAAM,CAAC,GAAG,QAAQ,6BAA6B,CAAC,CAAA;IACtE,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,MAAM,CAAC,GAAG,QAAQ,KAAK,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAA;QACrE,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG;YAAE,EAAE,CAAC,MAAM,CAAC,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IACrF,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IAC1C,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IAC7E,OAAO,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAA;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAgB,EAAE,EAAM;IACnD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,CAAA;IAEpD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;QACjC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,QAAQ,aAAa,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,eAAe,OAAO,IAAI,CAAC,CAAA;QAChG,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;QAC9C,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,EAAE,CAAC,MAAM,CAAC,GAAG,QAAQ,eAAe,OAAO,IAAI,CAAC,CAAA;QAChD,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,EAAE,CAAC,MAAM,CAAC,GAAG,QAAQ,KAAK,OAAO,CAAC,MAAM,oBAAoB,OAAO,IAAI,CAAC,CAAA;IACxE,KAAK,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,OAAO;QAAE,EAAE,CAAC,MAAM,CAAC,GAAG,WAAW,KAAK,IAAI,IAAI,CAAC,CAAA;IACjF,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,GAAG,QAAQ;;;IAG3B,QAAQ;;;;oEAIwD,SAAS;;;;;;;;;;;;;;;;;;;;;;;;IAwBzE,QAAQ;cACE,QAAQ;wBACE,QAAQ;IAC5B,QAAQ;;;;CAIX,CAAA"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import { type Io } from './commands.js';
+export declare const VERSION = "0.1.0";
+/** Testable entry point: everything that touches the process is injected. */
+export declare function main(argv: readonly string[], io: Io): Promise<number>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAA2D,KAAK,EAAE,EAAE,MAAM,eAAe,CAAA;AAIhG,eAAO,MAAM,OAAO,UAAU,CAAA;AAE9B,6EAA6E;AAC7E,wBAAsB,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAiC3E"}

package/dist/index.js

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+import { parseArgs, UsageError } from './args.js';
+import { EXIT_ERROR, HELP, runMap, runRestore, runScan, runScrub } from './commands.js';
+import { realpathSync } from 'node:fs';
+import { pathToFileURL } from 'node:url';
+export const VERSION = '0.1.0';
+/** Testable entry point: everything that touches the process is injected. */
+export async function main(argv, io) {
+    let args;
+    try {
+        args = parseArgs(argv);
+    }
+    catch (err) {
+        if (err instanceof UsageError) {
+            io.stderr(`veilio: ${err.message}\n\nRun "veilio --help" for usage.\n`);
+            return EXIT_ERROR;
+        }
+        throw err;
+    }
+    try {
+        switch (args.command) {
+            case 'help':
+                io.stdout(HELP);
+                return 0;
+            case 'version':
+                io.stdout(`${VERSION}\n`);
+                return 0;
+            case 'scrub':
+                return await runScrub(args, io);
+            case 'restore':
+                return await runRestore(args, io);
+            case 'scan':
+                return await runScan(args, io);
+            case 'map':
+                return await runMap(args, io);
+        }
+    }
+    catch (err) {
+        io.stderr(`veilio: ${err instanceof Error ? err.message : String(err)}\n`);
+        return EXIT_ERROR;
+    }
+}
+function readStdin() {
+    return new Promise((resolvePromise, rejectPromise) => {
+        // A TTY with no piped input would hang forever waiting for EOF. Fail with
+        // usage guidance instead of appearing to freeze.
+        if (process.stdin.isTTY) {
+            rejectPromise(new Error('no input — pass a file or pipe to stdin'));
+            return;
+        }
+        let data = '';
+        process.stdin.setEncoding('utf8');
+        process.stdin.on('data', (chunk) => (data += chunk));
+        process.stdin.on('end', () => resolvePromise(data));
+        process.stdin.on('error', rejectPromise);
+    });
+}
+/**
+ * Was this file run as a program, or imported?
+ *
+ * The obvious form of this check — comparing `import.meta.url` to
+ * `file://${process.argv[1]}` — is wrong in the one way that matters, and it
+ * shipped: npm installs a binary as a SYMLINK in `node_modules/.bin`, so
+ * `argv[1]` is the link while `import.meta.url` is the file it resolves to. The
+ * two never match, the branch below never runs, and `veilio --version` prints
+ * nothing and exits 0. Installed fine, did nothing, said nothing.
+ *
+ * `realpathSync` resolves the link. `pathToFileURL` handles the rest of what
+ * string interpolation got wrong: a path containing a space or any non-ASCII
+ * character needs percent-encoding, and a Windows path needs `file:///C:/...`
+ * rather than `file://C:\...`.
+ *
+ * Wrapped because `argv[1]` may name something unstattable — `node --eval`, or a
+ * file deleted mid-run. Not a program then, which is the safe reading.
+ */
+function invokedAsProgram() {
+    const argv1 = process.argv[1];
+    if (argv1 === undefined)
+        return false;
+    try {
+        return import.meta.url === pathToFileURL(realpathSync(argv1)).href;
+    }
+    catch {
+        return false;
+    }
+}
+if (invokedAsProgram()) {
+    const io = {
+        cwd: process.cwd(),
+        stdin: readStdin,
+        stdout: (text) => process.stdout.write(text),
+        stderr: (text) => process.stderr.write(text),
+    };
+    main(process.argv.slice(2), io).then((code) => {
+        process.exitCode = code;
+    }, (err) => {
+        process.stderr.write(`veilio: ${err instanceof Error ? err.message : String(err)}\n`);
+        process.exitCode = EXIT_ERROR;
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAW,MAAM,eAAe,CAAA;AAChG,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAA;AAE9B,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAuB,EAAE,EAAM;IACxD,IAAI,IAAI,CAAA;IACR,IAAI,CAAC;QACH,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;YAC9B,EAAE,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,OAAO,sCAAsC,CAAC,CAAA;YACvE,OAAO,UAAU,CAAA;QACnB,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IAED,IAAI,CAAC;QACH,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,KAAK,MAAM;gBACT,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBACf,OAAO,CAAC,CAAA;YACV,KAAK,SAAS;gBACZ,EAAE,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,CAAC,CAAA;gBACzB,OAAO,CAAC,CAAA;YACV,KAAK,OAAO;gBACV,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YACjC,KAAK,SAAS;gBACZ,OAAO,MAAM,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YACnC,KAAK,MAAM;gBACT,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAChC,KAAK,KAAK;gBACR,OAAO,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,MAAM,CAAC,WAAW,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC1E,OAAO,UAAU,CAAA;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QACnD,0EAA0E;QAC1E,iDAAiD;QACjD,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAA;YACnE,OAAM;QACR,CAAC;QACD,IAAI,IAAI,GAAG,EAAE,CAAA;QACb,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACjC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAA;QACpD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAA;QACnD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,gBAAgB;IACvB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACrC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,IAAI,gBAAgB,EAAE,EAAE,CAAC;IACvB,MAAM,EAAE,GAAO;QACb,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5C,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;KAC7C,CAAA;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAClC,CAAC,IAAI,EAAE,EAAE;QACP,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAA;IACzB,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACrF,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAA;IAC/B,CAAC,CACF,CAAA;AACH,CAAC"}

package/dist/store.d.ts

@@ -0,0 +1,41 @@
+import { STORE_DIR, type SymbolMap } from '@veilio-inc/engine';
+export { STORE_DIR };
+export declare const STORE_FILE = "map.json";
+/** Walk up from `from` looking for an existing store or a repo root, so running
+ *  the CLI in a subdirectory still finds the project's map. Falls back to
+ *  `from` when neither is found. */
+export declare function findProjectRoot(from: string): string;
+/** Resolve the map file path: explicit override, else the project store. */
+export declare function resolveMapPath(override: string | null, cwd: string): string;
+export interface StoredMap {
+    map: SymbolMap;
+    /** Schema marker so a future format change can be detected rather than
+     *  silently misread as a map. */
+    version: 1;
+}
+/** Read the stored map, or an empty map when there is none. Throws only when a
+ *  file exists but cannot be understood — silently starting from empty there
+ *  would orphan every placeholder the user already has in flight. */
+export declare function loadMap(path: string): SymbolMap;
+export declare class MapOverwriteError extends Error {
+}
+/**
+ * Write the map, refusing a write that would lose entries already on disk.
+ *
+ * Not a guard on every write. `scrub` loads the existing map, hands it to
+ * `anonymize` as `existingMap` and saves the union, so the normal path only ever
+ * grows the file — demanding a flag for that would mean typing `--force` on
+ * every second command, which is how a safety prompt becomes muscle memory and
+ * stops being read.
+ *
+ * What it refuses is the write that actually destroys something: one whose map
+ * no longer explains a placeholder the file already had. That map is the only
+ * means of restoring output produced with it, and once the entry is gone the
+ * text that used it can never be read back. Reachable by pointing `--map` at
+ * another session's store, or by a future caller that forgets to load first.
+ */
+export declare function saveMap(path: string, map: SymbolMap, options?: {
+    force?: boolean;
+}): void;
+export declare function clearMap(path: string): boolean;
+//# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9D,OAAO,EAAE,SAAS,EAAE,CAAA;AACpB,eAAO,MAAM,UAAU,aAAa,CAAA;AAEpC;;oCAEoC;AACpC,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQpD;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAG3E;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,SAAS,CAAA;IACd;qCACiC;IACjC,OAAO,EAAE,CAAC,CAAA;CACX;AAOD;;qEAEqE;AACrE,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAgB/C;AAED,qBAAa,iBAAkB,SAAQ,KAAK;CAAG;AAE/C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,IAAI,CA8B7F;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAI9C"}

package/dist/store.js

@@ -0,0 +1,113 @@
+// Symbol-map persistence.
+//
+// The map is what makes the round trip work: scrub writes it, restore reads it.
+// It lives in the project, not a global cache, because placeholder numbering is
+// only meaningful within one codebase — sharing `__CLS__1` across unrelated
+// projects would collide names and restore the wrong identifiers.
+//
+// The map holds real identifier names, so it is written 0600 and the store
+// directory carries a .gitignore. Committing it would undo the anonymization
+// for anyone reading the repo.
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { STORE_DIR } from '@veilio-inc/engine';
+export { STORE_DIR };
+export const STORE_FILE = 'map.json';
+/** Walk up from `from` looking for an existing store or a repo root, so running
+ *  the CLI in a subdirectory still finds the project's map. Falls back to
+ *  `from` when neither is found. */
+export function findProjectRoot(from) {
+    let dir = resolve(from);
+    for (;;) {
+        if (existsSync(join(dir, STORE_DIR)) || existsSync(join(dir, '.git')))
+            return dir;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return resolve(from);
+        dir = parent;
+    }
+}
+/** Resolve the map file path: explicit override, else the project store. */
+export function resolveMapPath(override, cwd) {
+    if (override !== null)
+        return resolve(cwd, override);
+    return join(findProjectRoot(cwd), STORE_DIR, STORE_FILE);
+}
+function isSymbolMap(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return false;
+    return Object.values(value).every((v) => typeof v === 'string');
+}
+/** Read the stored map, or an empty map when there is none. Throws only when a
+ *  file exists but cannot be understood — silently starting from empty there
+ *  would orphan every placeholder the user already has in flight. */
+export function loadMap(path) {
+    if (!existsSync(path))
+        return {};
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch {
+        throw new Error(`map file at ${path} is not valid JSON`);
+    }
+    if (typeof parsed !== 'object' || parsed === null) {
+        throw new Error(`map file at ${path} is malformed`);
+    }
+    const map = parsed.map;
+    if (!isSymbolMap(map)) {
+        throw new Error(`map file at ${path} is malformed`);
+    }
+    return map;
+}
+export class MapOverwriteError extends Error {
+}
+/**
+ * Write the map, refusing a write that would lose entries already on disk.
+ *
+ * Not a guard on every write. `scrub` loads the existing map, hands it to
+ * `anonymize` as `existingMap` and saves the union, so the normal path only ever
+ * grows the file — demanding a flag for that would mean typing `--force` on
+ * every second command, which is how a safety prompt becomes muscle memory and
+ * stops being read.
+ *
+ * What it refuses is the write that actually destroys something: one whose map
+ * no longer explains a placeholder the file already had. That map is the only
+ * means of restoring output produced with it, and once the entry is gone the
+ * text that used it can never be read back. Reachable by pointing `--map` at
+ * another session's store, or by a future caller that forgets to load first.
+ */
+export function saveMap(path, map, options = {}) {
+    if (!options.force && existsSync(path)) {
+        const dropped = Object.entries(loadMap(path)).filter(([placeholder, real]) => map[placeholder] !== real);
+        if (dropped.length > 0) {
+            const shown = dropped
+                .slice(0, 3)
+                .map(([p]) => p)
+                .join(', ');
+            throw new MapOverwriteError(`refusing to overwrite ${path}: ${dropped.length} existing placeholder${dropped.length === 1 ? '' : 's'} ` +
+                `(${shown}${dropped.length > 3 ? ', …' : ''}) would be lost, and text already anonymized with them ` +
+                `could never be restored. Pass --force to overwrite anyway.`);
+        }
+    }
+    const dir = dirname(path);
+    mkdirSync(dir, { recursive: true });
+    // A store directory inside a repo must never be committed — it holds the real
+    // names the anonymization exists to hide.
+    const ignore = join(dir, '.gitignore');
+    if (dir.endsWith(STORE_DIR) && !existsSync(ignore)) {
+        writeFileSync(ignore, '*\n', { mode: 0o600 });
+    }
+    const payload = { version: 1, map };
+    writeFileSync(path, `${JSON.stringify(payload, null, 2)}\n`, { mode: 0o600 });
+    // writeFileSync only applies `mode` when creating the file; enforce it on
+    // rewrite too so a pre-existing world-readable map gets locked down.
+    chmodSync(path, 0o600);
+}
+export function clearMap(path) {
+    if (!existsSync(path))
+        return false;
+    rmSync(path);
+    return true;
+}
+//# sourceMappingURL=store.js.map

package/dist/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAC1B,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,4EAA4E;AAC5E,kEAAkE;AAClE,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,+BAA+B;AAE/B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC/F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,SAAS,EAAkB,MAAM,oBAAoB,CAAA;AAE9D,OAAO,EAAE,SAAS,EAAE,CAAA;AACpB,MAAM,CAAC,MAAM,UAAU,GAAG,UAAU,CAAA;AAEpC;;oCAEoC;AACpC,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvB,SAAS,CAAC;QACR,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,GAAG,CAAA;QACjF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAA;QACxC,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,QAAuB,EAAE,GAAW;IACjE,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACpD,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;AAC1D,CAAC;AASD,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrF,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAA;AACjE,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAA;IAChC,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,oBAAoB,CAAC,CAAA;IAC1D,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,eAAe,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,GAAG,GAAI,MAA4B,CAAC,GAAG,CAAA;IAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,eAAe,CAAC,CAAA;IACrD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,OAAO,iBAAkB,SAAQ,KAAK;CAAG;AAE/C;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,GAAc,EAAE,UAA+B,EAAE;IACrF,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAClD,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,IAAI,CACnD,CAAA;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,OAAO;iBAClB,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;iBACf,IAAI,CAAC,IAAI,CAAC,CAAA;YACb,MAAM,IAAI,iBAAiB,CACzB,yBAAyB,IAAI,KAAK,OAAO,CAAC,MAAM,wBAAwB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;gBACxG,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,yDAAyD;gBACpG,4DAA4D,CAC/D,CAAA;QACH,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnC,8EAA8E;IAC9E,0CAA0C;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;IACtC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,OAAO,GAAc,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAA;IAC9C,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7E,0EAA0E;IAC1E,qEAAqE;IACrE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AACxB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IACnC,MAAM,CAAC,IAAI,CAAC,CAAA;IACZ,OAAO,IAAI,CAAA;AACb,CAAC"}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@veilio-inc/cli",
+  "version": "0.1.0",
+  "description": "Anonymize identifiers and redact credentials in source code before it reaches an LLM — from the terminal, a pipe, or a pre-commit hook.",
+  "type": "module",
+  "bin": {
+    "veilio": "dist/index.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=24"
+  },
+  "keywords": [
+    "anonymizer",
+    "llm",
+    "ai",
+    "privacy",
+    "secret-scanning",
+    "pre-commit",
+    "cli",
+    "veilio"
+  ],
+  "license": "SEE LICENSE IN LICENSE",
+  "dependencies": {
+    "@veilio-inc/engine": "^1.4.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf dist",
+    "prepublishOnly": "npm run clean && npm run typecheck && npm run build && npm run test",
+    "typecheck": "tsc --noEmit -p tsconfig.typecheck.json",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage"
+  },
+  "devDependencies": {
+    "@vitest/coverage-v8": "^4.1.10",
+    "typescript": "^5.4.0",
+    "vitest": "^4.1.10"
+  },
+  "exports": {
+    ".": "./dist/index.js",
+    "./store": "./dist/store.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/veilio-inc/veilio.git",
+    "directory": "packages/cli"
+  },
+  "bugs": {
+    "url": "https://github.com/veilio-inc/veilio/issues"
+  },
+  "homepage": "https://github.com/veilio-inc/veilio/tree/main/packages/cli#readme",
+  "publishConfig": {
+    "access": "public"
+  }
+}