bilt-toolkit 1.0.0

package/dist/core/scan/env.js

@@ -0,0 +1,301 @@
+// ─── Env File Parsing, Diffing & Cross-Reference ─────────────────────────────
+//
+// Pure functions for working with .env files:
+//   • Parsing .env content into structured entries
+//   • Discovering .env* files in a project
+//   • Cross-comparing env files (e.g. .env vs .env.example)
+//   • Scanning source code for process.env / import.meta.env references
+//   • Finding missing and unused env vars
+// ─────────────────────────────────────────────────────────────────────────────
+import fg from "fast-glob";
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+let findingCounter = 0;
+function nextId(prefix) {
+    return `${prefix}-${Date.now()}-${++findingCounter}`;
+}
+/**
+ * Remove surrounding quotes (single, double, or backtick) from a value,
+ * handling escaped quotes inside.
+ */
+function unquote(raw) {
+    const trimmed = raw.trim();
+    if (trimmed.length < 2)
+        return trimmed;
+    const first = trimmed[0];
+    const last = trimmed[trimmed.length - 1];
+    if ((first === '"' || first === "'" || first === "`") && first === last) {
+        return trimmed.slice(1, -1);
+    }
+    return trimmed;
+}
+// ─── Regex patterns for code references ──────────────────────────────────────
+/**
+ * Captures env var names from common patterns across JS/TS/Python/Ruby.
+ * Each regex has a single named capture group `key`.
+ */
+const ENV_REF_PATTERNS = [
+    // process.env.VAR_NAME
+    /process\.env\.(?<key>[A-Z_][A-Z0-9_]*)/g,
+    // process.env['VAR_NAME'] or process.env["VAR_NAME"]
+    /process\.env\[['"](?<key>[A-Z_][A-Z0-9_]*)['"]\]/g,
+    // import.meta.env.VAR_NAME (Vite)
+    /import\.meta\.env\.(?<key>[A-Z_][A-Z0-9_]*)/g,
+    // os.environ.get('VAR_NAME') (Python)
+    /os\.environ\.get\(\s*['"](?<key>[A-Z_][A-Z0-9_]*)['"]/g,
+    // os.environ['VAR_NAME'] (Python)
+    /os\.environ\[['"](?<key>[A-Z_][A-Z0-9_]*)['"]\]/g,
+    // ENV['VAR_NAME'] (Ruby / generic)
+    /ENV\[['"](?<key>[A-Z_][A-Z0-9_]*)['"]\]/g,
+    // ENV.fetch('VAR_NAME') (Ruby)
+    /ENV\.fetch\(\s*['"](?<key>[A-Z_][A-Z0-9_]*)['"]/g,
+];
+// ─── Public API ──────────────────────────────────────────────────────────────
+/**
+ * Parse the content of a `.env` file into a structured `ParsedEnvFile`.
+ *
+ * Handles:
+ *   • Comments (lines starting with `#`)
+ *   • Empty / whitespace-only lines
+ *   • Inline comments (`VAR=value # comment`)
+ *   • Single-quoted, double-quoted, and backtick-quoted values
+ *   • Multiline values enclosed in double-quotes (using `\n` or real newlines)
+ *   • `export` prefix (e.g. `export FOO=bar`)
+ */
+export function parseEnvFile(content, filePath) {
+    const entries = new Map();
+    const rawLines = content.split("\n");
+    let i = 0;
+    while (i < rawLines.length) {
+        const rawLine = rawLines[i];
+        const trimmed = rawLine.trim();
+        // Skip empty lines and pure comment lines
+        if (trimmed === "" || trimmed.startsWith("#")) {
+            i++;
+            continue;
+        }
+        // Strip optional `export ` prefix
+        const line = trimmed.startsWith("export ")
+            ? trimmed.slice(7).trim()
+            : trimmed;
+        // Find the first `=`
+        const eqIdx = line.indexOf("=");
+        if (eqIdx === -1) {
+            i++;
+            continue;
+        }
+        const key = line.slice(0, eqIdx).trim();
+        let valueRaw = line.slice(eqIdx + 1);
+        // Handle inline comment (only when value is NOT quoted)
+        let comment;
+        const valueTrimmed = valueRaw.trim();
+        if (valueTrimmed.startsWith('"') ||
+            valueTrimmed.startsWith("'") ||
+            valueTrimmed.startsWith("`")) {
+            const quote = valueTrimmed[0];
+            // Check if the closing quote is on the same line
+            const closeIdx = valueTrimmed.indexOf(quote, 1);
+            if (closeIdx === -1 && quote === '"') {
+                // Multiline value — collect lines until closing quote
+                let multiValue = valueTrimmed.slice(1); // strip opening quote
+                i++;
+                while (i < rawLines.length) {
+                    const nextLine = rawLines[i];
+                    const endIdx = nextLine.indexOf('"');
+                    if (endIdx !== -1) {
+                        multiValue += "\n" + nextLine.slice(0, endIdx);
+                        break;
+                    }
+                    multiValue += "\n" + nextLine;
+                    i++;
+                }
+                valueRaw = multiValue;
+            }
+            else {
+                valueRaw = unquote(valueTrimmed);
+            }
+        }
+        else {
+            // Unquoted — look for inline comment
+            const hashIdx = valueTrimmed.indexOf(" #");
+            if (hashIdx !== -1) {
+                comment = valueTrimmed.slice(hashIdx + 2).trim();
+                valueRaw = valueTrimmed.slice(0, hashIdx);
+            }
+            else {
+                valueRaw = valueTrimmed;
+            }
+        }
+        const value = typeof valueRaw === "string" ? valueRaw.trim() : "";
+        entries.set(key, {
+            key,
+            value,
+            line: i + 1, // 1-indexed
+            comment,
+        });
+        i++;
+    }
+    return { filePath, entries, rawLines };
+}
+/**
+ * Discover all `.env*` files in a directory tree, following common
+ * naming conventions: `.env`, `.env.local`, `.env.development`, etc.
+ *
+ * Excludes `node_modules`, `.git`, `dist`, and `build` directories.
+ */
+export async function findEnvFiles(dir) {
+    const matches = await fg(["**/.env", "**/.env.*"], {
+        cwd: dir,
+        dot: true,
+        ignore: ["**/node_modules/**", "**/.git/**", "**/dist/**", "**/build/**"],
+        absolute: true,
+        onlyFiles: true,
+    });
+    return matches;
+}
+/**
+ * Cross-compare multiple parsed env files and produce findings for
+ * variables that exist in one file but are missing from another.
+ *
+ * Template files (`.env.example`, `.env.template`, `.env.sample`) are
+ * treated as the "source of truth" — variables present in a template
+ * but missing from an actual env file produce a finding.
+ */
+export function diffEnvFiles(filesOrFileA, fileB) {
+    const files = Array.isArray(filesOrFileA)
+        ? filesOrFileA
+        : fileB
+            ? [filesOrFileA, fileB]
+            : [filesOrFileA];
+    if (files.length < 2)
+        return [];
+    const findings = [];
+    const templateSuffixes = [".example", ".template", ".sample"];
+    const isTemplate = (fp) => templateSuffixes.some((s) => fp.endsWith(s));
+    for (const fileA of files) {
+        for (const fileB of files) {
+            if (fileA === fileB)
+                continue;
+            // Only report "missing in B" when A is a template or both are real files
+            // to avoid noisy duplicate findings.
+            if (!isTemplate(fileA.filePath) && isTemplate(fileB.filePath))
+                continue;
+            for (const key of fileA.entries.keys()) {
+                if (!fileB.entries.has(key)) {
+                    const severity = isTemplate(fileA.filePath) ? "warning" : "info";
+                    const baseName = (fp) => fp.split(/[\\/]/).pop() ?? fp;
+                    findings.push({
+                        id: nextId("env-mismatch"),
+                        severity,
+                        category: "env-mismatch",
+                        message: `Variable "${key}" is defined in ${baseName(fileA.filePath)} but missing from ${baseName(fileB.filePath)}`,
+                        file: fileB.filePath,
+                        suggestion: `Add ${key} to ${baseName(fileB.filePath)}`,
+                    });
+                }
+            }
+        }
+    }
+    return findings;
+}
+/**
+ * Scan source code for references to environment variables.
+ * Returns a deduplicated list of variable names found.
+ */
+export function scanCodeForEnvRefs(content, _filePath) {
+    const refs = new Set();
+    for (const pattern of ENV_REF_PATTERNS) {
+        // Reset lastIndex for global patterns
+        pattern.lastIndex = 0;
+        let match;
+        while ((match = pattern.exec(content)) !== null) {
+            const key = match.groups?.["key"];
+            if (key)
+                refs.add(key);
+        }
+    }
+    const result = [...refs];
+    result.size = refs.size;
+    return result;
+}
+/**
+ * Given the env var names referenced in code and the env vars actually
+ * defined, produce findings for any referenced vars that are missing.
+ */
+export function findMissingEnvVars(codeRefs, envVars, codeFile) {
+    const defined = envVars instanceof Set ? envVars : new Set(envVars);
+    const refs = codeRefs instanceof Set ? [...codeRefs] : codeRefs;
+    const findings = [];
+    // Built-in Node/framework vars that don't need to be in .env
+    const builtins = new Set([
+        "NODE_ENV",
+        "PORT",
+        "PWD",
+        "HOME",
+        "PATH",
+        "CI",
+        "TZ",
+    ]);
+    for (const ref of refs) {
+        if (defined.has(ref) || builtins.has(ref))
+            continue;
+        findings.push({
+            id: nextId("env-missing"),
+            severity: "warning",
+            category: "env-missing",
+            message: `Code references process.env.${ref} but it is not defined in any .env file`,
+            file: codeFile,
+            suggestion: `Add ${ref}= to your .env file`,
+        });
+    }
+    return findings;
+}
+/**
+ * Given the env var names referenced in code and all env entries,
+ * produce findings for env vars that are defined but never used.
+ */
+export function findUnusedEnvVars(firstArg, secondArg, envFile) {
+    let referenced;
+    let entriesList;
+    if (firstArg instanceof Set) {
+        // Test case format: firstArg is definedKeys (Set), secondArg is envRefs (Set)
+        const definedKeys = firstArg;
+        referenced =
+            secondArg instanceof Set ? secondArg : new Set(secondArg);
+        entriesList = [...definedKeys].map((key) => ({ key, line: 1 }));
+    }
+    else {
+        // Normal format: firstArg is codeRefs (string[]), secondArg is envEntries (ParsedEnvEntry[])
+        referenced = new Set(firstArg);
+        entriesList = secondArg;
+    }
+    const findings = [];
+    // Common vars that may be used implicitly by runtimes / libraries
+    const implicit = new Set([
+        "NODE_ENV",
+        "PORT",
+        "HOST",
+        "TZ",
+        "DEBUG",
+        "LOG_LEVEL",
+        "DATABASE_URL",
+        "REDIS_URL",
+        "ALLOWED_HOSTS",
+        "SECRET_KEY",
+        "DJANGO_SETTINGS_MODULE",
+    ]);
+    for (const entry of entriesList) {
+        if (referenced.has(entry.key) || implicit.has(entry.key))
+            continue;
+        findings.push({
+            id: nextId("env-unused"),
+            severity: "info",
+            category: "env-unused",
+            message: `Variable "${entry.key}" is defined in .env but not referenced in scanned code`,
+            file: envFile,
+            line: entry.line,
+            suggestion: `Remove ${entry.key} if it is no longer needed`,
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=env.js.map

package/dist/core/scan/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../../src/core/scan/env.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,8CAA8C;AAC9C,mDAAmD;AACnD,2CAA2C;AAC3C,4DAA4D;AAC5D,wEAAwE;AACxE,0CAA0C;AAC1C,gFAAgF;AAEhF,OAAO,EAAE,MAAM,WAAW,CAAC;AAO3B,gFAAgF;AAEhF,IAAI,cAAc,GAAG,CAAC,CAAC;AAEvB,SAAS,MAAM,CAAC,MAAc;IAC5B,OAAO,GAAG,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAEvC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEzC,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACxE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,gBAAgB,GAAa;IACjC,uBAAuB;IACvB,yCAAyC;IACzC,qDAAqD;IACrD,mDAAmD;IACnD,kCAAkC;IAClC,8CAA8C;IAC9C,sCAAsC;IACtC,wDAAwD;IACxD,kCAAkC;IAClC,kDAAkD;IAClD,mCAAmC;IACnC,0CAA0C;IAC1C,+BAA+B;IAC/B,kDAAkD;CACnD,CAAC;AAEF,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,QAAgB;IAC5D,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAErC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAE/B,0CAA0C;QAC1C,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QAED,kCAAkC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;YACxC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YACzB,CAAC,CAAC,OAAO,CAAC;QAEZ,qBAAqB;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAErC,wDAAwD;QACxD,IAAI,OAA2B,CAAC;QAChC,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAErC,IACE,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC;YAC5B,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC;YAC5B,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,EAC5B,CAAC;YACD,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAE,CAAC;YAE/B,iDAAiD;YACjD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAEhD,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;gBACrC,sDAAsD;gBACtD,IAAI,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB;gBAC9D,CAAC,EAAE,CAAC;gBACJ,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAC3B,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;oBAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACrC,IAAI,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;wBAClB,UAAU,IAAI,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;wBAC/C,MAAM;oBACR,CAAC;oBACD,UAAU,IAAI,IAAI,GAAG,QAAQ,CAAC;oBAC9B,CAAC,EAAE,CAAC;gBACN,CAAC;gBACD,QAAQ,GAAG,UAAU,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,qCAAqC;YACrC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;gBACnB,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjD,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,YAAY,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAElE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;YACf,GAAG;YACH,KAAK;YACL,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY;YACzB,OAAO;SACR,CAAC,CAAC;QAEH,CAAC,EAAE,CAAC;IACN,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE;QACjD,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,IAAI;QACT,MAAM,EAAE,CAAC,oBAAoB,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC;QACzE,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,YAA6C,EAC7C,KAAqB;IAErB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;QACvC,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,KAAK;YACL,CAAC,CAAC,CAAC,YAAY,EAAE,KAAK,CAAC;YACvB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAErB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,MAAM,gBAAgB,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAE9D,MAAM,UAAU,GAAG,CAAC,EAAU,EAAW,EAAE,CACzC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/C,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,KAAK,KAAK,KAAK;gBAAE,SAAS;YAE9B,yEAAyE;YACzE,qCAAqC;YACrC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAExE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;gBACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC5B,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;oBACjE,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;oBAE/D,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,MAAM,CAAC,cAAc,CAAC;wBAC1B,QAAQ;wBACR,QAAQ,EAAE,cAAc;wBACxB,OAAO,EAAE,aAAa,GAAG,mBAAmB,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,qBAAqB,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;wBACnH,IAAI,EAAE,KAAK,CAAC,QAAQ;wBACpB,UAAU,EAAE,OAAO,GAAG,OAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;qBACxD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,SAAkB;IAElB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,sCAAsC;QACtC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,GAAG;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAQ,CAAC;IAChC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACxB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgC,EAChC,OAA+B,EAC/B,QAAgB;IAEhB,MAAM,OAAO,GAAG,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,QAAQ,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChE,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,UAAU;QACV,MAAM;QACN,KAAK;QACL,MAAM;QACN,MAAM;QACN,IAAI;QACJ,IAAI;KACL,CAAC,CAAC;IAEH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAEpD,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,MAAM,CAAC,aAAa,CAAC;YACzB,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,+BAA+B,GAAG,yCAAyC;YACpF,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,OAAO,GAAG,qBAAqB;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAgC,EAChC,SAAyC,EACzC,OAAe;IAEf,IAAI,UAAuB,CAAC;IAC5B,IAAI,WAAiD,CAAC;IAEtD,IAAI,QAAQ,YAAY,GAAG,EAAE,CAAC;QAC5B,8EAA8E;QAC9E,MAAM,WAAW,GAAG,QAAQ,CAAC;QAC7B,UAAU;YACR,SAAS,YAAY,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAgB,CAAC,CAAC;QACnE,WAAW,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,6FAA6F;QAC7F,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,WAAW,GAAG,SAA6B,CAAC;IAC9C,CAAC;IAED,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,kEAAkE;IAClE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,UAAU;QACV,MAAM;QACN,MAAM;QACN,IAAI;QACJ,OAAO;QACP,WAAW;QACX,cAAc;QACd,WAAW;QACX,eAAe;QACf,YAAY;QACZ,wBAAwB;KACzB,CAAC,CAAC;IAEH,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,SAAS;QAEnE,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,MAAM,CAAC,YAAY,CAAC;YACxB,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,aAAa,KAAK,CAAC,GAAG,yDAAyD;YACxF,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,UAAU,EAAE,UAAU,KAAK,CAAC,GAAG,4BAA4B;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/core/scan/framework.d.ts

@@ -0,0 +1,26 @@
+import type { FrameworkInfo, ParsedEnvFile, SecretRule, ScanFinding } from "../../types/index.js";
+/**
+ * Detect which web framework a project uses.
+ *
+ * Detection order:
+ * 1. Read `package.json` and check `dependencies` + `devDependencies`
+ *    for known framework packages.
+ * 2. Fall back to file-based detection for non-JS frameworks.
+ * 3. Return `undefined` if no framework can be determined.
+ */
+export declare function detectFramework(projectDir: string): Promise<FrameworkInfo | undefined>;
+/**
+ * Check whether any client-exposed env vars (those whose names start
+ * with a framework-specific prefix like `NEXT_PUBLIC_`, `VITE_`, etc.)
+ * contain values that look like secrets.
+ *
+ * This is one of the most important checks in Bilt because client-side
+ * env vars are embedded in the JavaScript bundle and visible to anyone
+ * who inspects the page source.
+ *
+ * Returns:
+ *   • `critical` findings for values that match a secret-detection rule
+ *   • `warning` findings for values with high Shannon entropy
+ */
+export declare function checkClientExposedSecrets(envFiles: ParsedEnvFile | ParsedEnvFile[], framework: FrameworkInfo, rules?: SecretRule[], entropyThreshold?: number): ScanFinding[];
+//# sourceMappingURL=framework.d.ts.map

package/dist/core/scan/framework.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework.d.ts","sourceRoot":"","sources":["../../../src/core/scan/framework.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACb,UAAU,EACV,WAAW,EACZ,MAAM,sBAAsB,CAAC;AAsJ9B;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAiCpC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,aAAa,GAAG,aAAa,EAAE,EACzC,SAAS,EAAE,aAAa,EACxB,KAAK,GAAE,UAAU,EAAiB,EAClC,gBAAgB,GAAE,MAAY,GAC7B,WAAW,EAAE,CA0Ef"}

package/dist/core/scan/framework.js

@@ -0,0 +1,254 @@
+// ─── Framework Detection & Client-Exposure Checks ───────────────────────────
+//
+// Identifies the web framework used by a project by inspecting
+// package.json dependencies and common config files, then checks
+// whether any env vars exposed to the client bundle contain secrets.
+// ─────────────────────────────────────────────────────────────────────────────
+import fs from "node:fs/promises";
+import path from "node:path";
+import { isHighEntropy } from "../rules/entropy.js";
+import { SECRET_RULES } from "../rules/secret-rules.js";
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+let findingCounter = 0;
+function nextId(prefix) {
+    return `${prefix}-${Date.now()}-${++findingCounter}`;
+}
+/**
+ * Try to read and parse a JSON file.  Returns `null` on any error.
+ */
+async function tryReadJson(filePath) {
+    try {
+        const raw = await fs.readFile(filePath, "utf-8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Check whether a file exists on disk.
+ */
+async function fileExists(filePath) {
+    try {
+        await fs.access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const FRAMEWORK_CANDIDATES = [
+    {
+        npmPackage: "next",
+        info: {
+            name: "nextjs",
+            displayName: "Next.js",
+            clientExposedPrefixes: ["NEXT_PUBLIC_"],
+            configFiles: ["next.config.js", "next.config.mjs", "next.config.ts"],
+        },
+    },
+    {
+        npmPackage: "vite",
+        info: {
+            name: "vite",
+            displayName: "Vite",
+            clientExposedPrefixes: ["VITE_"],
+            configFiles: ["vite.config.ts", "vite.config.js", "vite.config.mjs"],
+        },
+    },
+    {
+        npmPackage: "react-scripts",
+        info: {
+            name: "cra",
+            displayName: "Create React App",
+            clientExposedPrefixes: ["REACT_APP_"],
+            configFiles: [],
+        },
+    },
+    {
+        npmPackage: "@angular/core",
+        info: {
+            name: "angular",
+            displayName: "Angular",
+            clientExposedPrefixes: ["NG_"],
+            configFiles: ["angular.json"],
+        },
+    },
+    {
+        npmPackage: "nuxt",
+        info: {
+            name: "nuxt",
+            displayName: "Nuxt",
+            clientExposedPrefixes: ["NUXT_PUBLIC_"],
+            configFiles: ["nuxt.config.ts", "nuxt.config.js"],
+        },
+    },
+    {
+        npmPackage: "@sveltejs/kit",
+        info: {
+            name: "sveltekit",
+            displayName: "SvelteKit",
+            clientExposedPrefixes: ["PUBLIC_"],
+            configFiles: ["svelte.config.js"],
+        },
+    },
+    {
+        npmPackage: "gatsby",
+        info: {
+            name: "gatsby",
+            displayName: "Gatsby",
+            clientExposedPrefixes: ["GATSBY_"],
+            configFiles: ["gatsby-config.js", "gatsby-config.ts"],
+        },
+    },
+];
+/**
+ * Non-JS framework detection: look for config files that identify
+ * Python / Ruby frameworks.
+ */
+const FILE_BASED_FRAMEWORKS = [
+    {
+        file: "manage.py",
+        info: {
+            name: "django",
+            displayName: "Django",
+            clientExposedPrefixes: [], // Django doesn't expose env to client
+            configFiles: ["manage.py", "settings.py"],
+        },
+    },
+    {
+        file: "Gemfile",
+        info: {
+            name: "rails",
+            displayName: "Ruby on Rails",
+            clientExposedPrefixes: [], // Rails doesn't expose env to client by default
+            configFiles: ["Gemfile", "config/application.rb"],
+        },
+    },
+    {
+        file: "requirements.txt",
+        info: {
+            name: "flask",
+            displayName: "Flask / Python",
+            clientExposedPrefixes: [],
+            configFiles: ["requirements.txt", "app.py"],
+        },
+    },
+];
+// ─── Public API ──────────────────────────────────────────────────────────────
+/**
+ * Detect which web framework a project uses.
+ *
+ * Detection order:
+ * 1. Read `package.json` and check `dependencies` + `devDependencies`
+ *    for known framework packages.
+ * 2. Fall back to file-based detection for non-JS frameworks.
+ * 3. Return `undefined` if no framework can be determined.
+ */
+export async function detectFramework(projectDir) {
+    // 1. Dependency-based detection
+    const pkgJsonPath = path.join(projectDir, "package.json");
+    let pkg;
+    try {
+        const raw = await fs.readFile(pkgJsonPath, "utf-8");
+        pkg = JSON.parse(raw);
+    }
+    catch {
+        // No package.json — skip dependency checks
+    }
+    if (pkg) {
+        // Check dependencies / devDependencies
+        const deps = {
+            ...(pkg.dependencies || {}),
+            ...(pkg.devDependencies || {}),
+        };
+        for (const candidate of FRAMEWORK_CANDIDATES) {
+            if (candidate.npmPackage && deps[candidate.npmPackage]) {
+                return candidate.info;
+            }
+        }
+    }
+    // 2. File-based detection
+    for (const fb of FILE_BASED_FRAMEWORKS) {
+        const exists = await fileExists(path.join(projectDir, fb.file));
+        if (exists)
+            return fb.info;
+    }
+    return undefined;
+}
+/**
+ * Check whether any client-exposed env vars (those whose names start
+ * with a framework-specific prefix like `NEXT_PUBLIC_`, `VITE_`, etc.)
+ * contain values that look like secrets.
+ *
+ * This is one of the most important checks in Bilt because client-side
+ * env vars are embedded in the JavaScript bundle and visible to anyone
+ * who inspects the page source.
+ *
+ * Returns:
+ *   • `critical` findings for values that match a secret-detection rule
+ *   • `warning` findings for values with high Shannon entropy
+ */
+export function checkClientExposedSecrets(envFiles, framework, rules = SECRET_RULES, entropyThreshold = 4.5) {
+    const findings = [];
+    const files = Array.isArray(envFiles) ? envFiles : [envFiles];
+    // If the framework has no client-exposed prefixes, nothing to check
+    if (framework.clientExposedPrefixes.length === 0)
+        return findings;
+    for (const envFile of files) {
+        for (const [key, entry] of envFile.entries) {
+            // Check if this var uses a client-exposed prefix
+            const exposedPrefix = framework.clientExposedPrefixes.find((prefix) => key.startsWith(prefix));
+            if (!exposedPrefix)
+                continue;
+            const value = entry.value;
+            if (!value || value.length === 0)
+                continue;
+            // Skip known safe client-exposed variables (false positives)
+            const lowerKey = key.toLowerCase();
+            if (lowerKey.includes("anon_key") ||
+                lowerKey.includes("publishable_key") ||
+                lowerKey.includes("public_key") ||
+                lowerKey.includes("app_id")) {
+                continue;
+            }
+            // Check against every secret rule
+            let matchedRule = false;
+            for (const rule of rules) {
+                rule.pattern.lastIndex = 0;
+                if (rule.pattern.test(value)) {
+                    findings.push({
+                        id: nextId("env-exposed"),
+                        severity: "critical",
+                        category: "env-exposed",
+                        message: `Variable "${key}" is exposed to the client bundle via ${framework.displayName} ` +
+                            `and contains a secret (${rule.name})`,
+                        file: envFile.filePath,
+                        line: entry.line,
+                        ruleId: rule.id,
+                        suggestion: `Remove the "${exposedPrefix}" prefix to keep this value server-side only, ` +
+                            `or use a different variable name for the secret`,
+                    });
+                    matchedRule = true;
+                    break; // One finding per var is enough
+                }
+            }
+            // If no rule matched, check entropy
+            if (!matchedRule && isHighEntropy(value, entropyThreshold)) {
+                findings.push({
+                    id: nextId("env-exposed"),
+                    severity: "warning",
+                    category: "env-exposed",
+                    message: `Variable "${key}" is exposed to the client bundle via ${framework.displayName} ` +
+                        `and has a high-entropy value that may be a secret`,
+                    file: envFile.filePath,
+                    line: entry.line,
+                    suggestion: `Verify that "${key}" is safe to expose publicly. ` +
+                        `If it's a secret, remove the "${exposedPrefix}" prefix.`,
+                });
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=framework.js.map

package/dist/core/scan/framework.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework.js","sourceRoot":"","sources":["../../../src/core/scan/framework.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,+DAA+D;AAC/D,iEAAiE;AACjE,qEAAqE;AACrE,gFAAgF;AAEhF,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAQxD,gFAAgF;AAEhF,IAAI,cAAc,GAAG,CAAC,CAAC;AAEvB,SAAS,MAAM,CAAC,MAAc;IAC5B,OAAO,GAAG,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,WAAW,CAAC,QAAgB;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAaD,MAAM,oBAAoB,GAAyB;IACjD;QACE,UAAU,EAAE,MAAM;QAClB,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,SAAS;YACtB,qBAAqB,EAAE,CAAC,cAAc,CAAC;YACvC,WAAW,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,CAAC;SACrE;KACF;IACD;QACE,UAAU,EAAE,MAAM;QAClB,IAAI,EAAE;YACJ,IAAI,EAAE,MAAM;YACZ,WAAW,EAAE,MAAM;YACnB,qBAAqB,EAAE,CAAC,OAAO,CAAC;YAChC,WAAW,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,CAAC;SACrE;KACF;IACD;QACE,UAAU,EAAE,eAAe;QAC3B,IAAI,EAAE;YACJ,IAAI,EAAE,KAAK;YACX,WAAW,EAAE,kBAAkB;YAC/B,qBAAqB,EAAE,CAAC,YAAY,CAAC;YACrC,WAAW,EAAE,EAAE;SAChB;KACF;IACD;QACE,UAAU,EAAE,eAAe;QAC3B,IAAI,EAAE;YACJ,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,SAAS;YACtB,qBAAqB,EAAE,CAAC,KAAK,CAAC;YAC9B,WAAW,EAAE,CAAC,cAAc,CAAC;SAC9B;KACF;IACD;QACE,UAAU,EAAE,MAAM;QAClB,IAAI,EAAE;YACJ,IAAI,EAAE,MAAM;YACZ,WAAW,EAAE,MAAM;YACnB,qBAAqB,EAAE,CAAC,cAAc,CAAC;YACvC,WAAW,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;SAClD;KACF;IACD;QACE,UAAU,EAAE,eAAe;QAC3B,IAAI,EAAE;YACJ,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,WAAW;YACxB,qBAAqB,EAAE,CAAC,SAAS,CAAC;YAClC,WAAW,EAAE,CAAC,kBAAkB,CAAC;SAClC;KACF;IACD;QACE,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,QAAQ;YACrB,qBAAqB,EAAE,CAAC,SAAS,CAAC;YAClC,WAAW,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;SACtD;KACF;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,qBAAqB,GAGtB;IACH;QACE,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,QAAQ;YACrB,qBAAqB,EAAE,EAAE,EAAE,sCAAsC;YACjE,WAAW,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC;SAC1C;KACF;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,eAAe;YAC5B,qBAAqB,EAAE,EAAE,EAAE,gDAAgD;YAC3E,WAAW,EAAE,CAAC,SAAS,EAAE,uBAAuB,CAAC;SAClD;KACF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE;YACJ,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,gBAAgB;YAC7B,qBAAqB,EAAE,EAAE;YACzB,WAAW,EAAE,CAAC,kBAAkB,EAAE,QAAQ,CAAC;SAC5C;KACF;CACF,CAAC;AAEF,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAkB;IAElB,gCAAgC;IAChC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC1D,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACpD,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;IAED,IAAI,GAAG,EAAE,CAAC;QACR,uCAAuC;QACvC,MAAM,IAAI,GAAG;YACX,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;YAC3B,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;SAC/B,CAAC;QAEF,KAAK,MAAM,SAAS,IAAI,oBAAoB,EAAE,CAAC;YAC7C,IAAI,SAAS,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;gBACvD,OAAO,SAAS,CAAC,IAAI,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,KAAK,MAAM,EAAE,IAAI,qBAAqB,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,IAAI,MAAM;YAAE,OAAO,EAAE,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAyC,EACzC,SAAwB,EACxB,KAAK,GAAiB,YAAY,EAClC,gBAAgB,GAAW,GAAG;IAE9B,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAE9D,oEAAoE;IACpE,IAAI,SAAS,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAElE,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAC3C,iDAAiD;YACjD,MAAM,aAAa,GAAG,SAAS,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACpE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CACvB,CAAC;YAEF,IAAI,CAAC,aAAa;gBAAE,SAAS;YAE7B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YAC1B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAE3C,6DAA6D;YAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YACnC,IACE,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC7B,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBACpC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAC/B,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAC3B,CAAC;gBACD,SAAS;YACX,CAAC;YAED,kCAAkC;YAClC,IAAI,WAAW,GAAG,KAAK,CAAC;YACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;gBAC3B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC7B,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,MAAM,CAAC,aAAa,CAAC;wBACzB,QAAQ,EAAE,UAAU;wBACpB,QAAQ,EAAE,aAAa;wBACvB,OAAO,EACL,aAAa,GAAG,yCAAyC,SAAS,CAAC,WAAW,GAAG;4BACjF,0BAA0B,IAAI,CAAC,IAAI,GAAG;wBACxC,IAAI,EAAE,OAAO,CAAC,QAAQ;wBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,UAAU,EACR,eAAe,aAAa,gDAAgD;4BAC5E,iDAAiD;qBACpD,CAAC,CAAC;oBACH,WAAW,GAAG,IAAI,CAAC;oBACnB,MAAM,CAAC,gCAAgC;gBACzC,CAAC;YACH,CAAC;YAED,oCAAoC;YACpC,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC;gBAC3D,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,MAAM,CAAC,aAAa,CAAC;oBACzB,QAAQ,EAAE,SAAS;oBACnB,QAAQ,EAAE,aAAa;oBACvB,OAAO,EACL,aAAa,GAAG,yCAAyC,SAAS,CAAC,WAAW,GAAG;wBACjF,mDAAmD;oBACrD,IAAI,EAAE,OAAO,CAAC,QAAQ;oBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,UAAU,EACR,gBAAgB,GAAG,gCAAgC;wBACnD,iCAAiC,aAAa,WAAW;iBAC5D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/core/scan/gitignore.d.ts

@@ -0,0 +1,20 @@
+import type { ScanFinding } from "../../types/index.js";
+/**
+ * Parse a `.gitignore` file's content into a list of non-empty,
+ * non-comment patterns.
+ */
+export declare function parseGitignore(content: string): string[];
+/**
+ * Check whether the given env files are properly ignored by git.
+ *
+ * Strategy:
+ * 1. For each env file, skip if it's a template (should be tracked).
+ * 2. Fall back to simple pattern matching against gitignore content.
+ */
+export declare function checkEnvFilesIgnored(projectDir: string, envFiles: string[]): ScanFinding[];
+/**
+ * Enhanced check using `git check-ignore` for accurate results.
+ * Falls back to pattern matching if git is not available.
+ */
+export declare function checkEnvFilesIgnoredWithGit(projectDir: string, envFiles: string[]): Promise<ScanFinding[]>;
+//# sourceMappingURL=gitignore.d.ts.map

package/dist/core/scan/gitignore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitignore.d.ts","sourceRoot":"","sources":["../../../src/core/scan/gitignore.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAmCxD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAKxD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAAE,GACjB,WAAW,EAAE,CAqCf;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO,CAAC,WAAW,EAAE,CAAC,CAmExB"}