code-secret-handler 1.0.0

package/LICENSE

@@ -0,0 +1,79 @@
+Copyright (c) 2024 Vic (vic.grambo@gmail.com)
+
+PolyForm Noncommercial License 1.0.0
+
+Acceptance
+
+In order to get any license under these terms, you must agree to them as both strict obligations and conditions to all your licenses.
+
+Use Grant
+
+The licensor grants you a non-exclusive, royalty-free, worldwide, non-sublicensable, non-transferable license to use, copy, distribute, make available, and prepare derivative works of the software, in each case for your personal and noncommercial purposes only.
+
+Noncommercial Purposes
+
+Any of the following uses of the software counts as a noncommercial purpose:
+
+  * Personal research, study, learning, private entertainment, or hobby projects without any anticipated commercial application.
+  * Use by a charitable organization, educational institution, public research organization, public safety or health organization, environmental protection organization, or government institution.
+
+Commercial Use Reserved
+
+Any use of the software to directly or indirectly generate revenue, reduce costs, or obtain a commercial advantage for a business, company, organization, or for-profit entity requires a separate commercial license granted in writing by the licensor.
+
+This includes, but is not limited to:
+  * Use within a company, startup, agency, or any for-profit organization.
+  * Running the tool as part of an automated CI/CD pipeline in a commercial context.
+  * Offering services built on or using this tool to paying customers.
+  * Any use by a GitHub Organization, GitLab Group, or equivalent entity.
+
+Commercial Licensing
+
+To obtain a commercial license, please contact:
+
+  Vic — vic.grambo@gmail.com
+
+Commercial licensees will receive a license key to be set as:
+  CSH_LICENSE_KEY=<your-key>
+
+Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you also gets a copy of these terms or the URL for them above, as well as copies of any plain-text lines beginning with "Required Notice:" that the licensor provides with the software.
+
+No Other Rights
+
+These terms do not allow you to sublicense or transfer any of your licenses to anyone else, or prevent the licensor from granting licenses to anyone else.
+
+Patent Defense
+
+If you make any written claim that the software infringes or contributes to infringement of any patent, your license for the software granted under these terms ends immediately. If your company makes such a claim, your license ends immediately for work on behalf of your company.
+
+Violations
+
+The first time you are notified in writing that you have violated any of these terms, your license can nonetheless continue if you come into full compliance with these terms within 30 days of receiving that notice. If any violation of these terms is willful, the 30-day cure period above does not apply.
+
+No Liability
+
+As far as the law allows, the software comes as is, without any warranty or condition, and the licensor will not be liable to you for any damages arising out of these terms or the use or nature of the software, under any kind of legal claim.
+
+Telemetry Disclosure
+
+This software collects anonymous usage telemetry to assist with license compliance monitoring. The following data is collected when the tool is run:
+
+  * Tool version, operating system, and Node.js version
+  * Git remote URL, repository owner, and repository name
+  * Git platform (GitHub, GitLab, Bitbucket, or other)
+  * Whether the repository owner is an Organization or personal User
+  * Whether a commercial license key was provided
+  * Timestamp of the run
+
+No source code, file contents, secret values, or personally identifiable information is ever collected.
+
+To opt out of telemetry collection, set the following environment variable:
+  CSH_TELEMETRY=0
+
+Definitions
+
+"The licensor" refers to Vic (vic.grambo@gmail.com), the individual who makes the software available under these terms.
+
+"The software" refers to the code-secret-handler CLI tool and all associated source code, binaries, and documentation made available under this license.

package/README.md

@@ -0,0 +1,221 @@
+# 🔐 Code Secret Handler
+
+A **language-agnostic CLI tool** that scans any codebase for hardcoded secrets, lists them with full context, moves them to a `.env` file, and rewrites source files with the correct environment variable accessor for each language.
+
+---
+
+## Features
+
+- 🔍 **Deep scanning** — 179+ secret types detected across 10 rule categories (AWS, GCP, Azure, GitHub, Stripe, Twilio, OpenAI, Anthropic, Discord, Telegram, Supabase, JWT, SSH keys, database URIs, SMTP, and many more)
+- 🌐 **Language-aware rewriting** — auto-detects file language and uses the correct env-var syntax:
+  - `process.env.KEY` (JavaScript/TypeScript)
+  - `os.environ.get('KEY')` (Python)
+  - `System.getenv("KEY")` (Java/Kotlin)
+  - `os.Getenv("KEY")` (Go)
+  - `ENV['KEY']` (Ruby)
+  - `getenv('KEY')` (PHP)
+  - `Environment.GetEnvironmentVariable("KEY")` (C#)
+  - `std::env::var("KEY")` (Rust)
+  - `$KEY` / `$env:KEY` (Shell/PowerShell)
+  - `${KEY}` (YAML, TOML, properties files)
+- 📋 **Multiple report formats** — console (colored), JSON, CSV, Markdown
+- 🔒 **Collision-safe** — appends `_2`, `_3`, etc. for duplicate env key names
+- 🧠 **Respects `.gitignore`** — only scans tracked files, skips `node_modules`, `dist`, etc.
+- 🛡️ **Interactive** — asks before making any changes, with backup option
+- 🔍 **Dry-run mode** — scan and report without modifying anything
+
+---
+
+## Installation
+
+```bash
+# Run directly with npx (no install needed)
+npx code-secret-handler ./my-project
+
+# Or install globally
+npm install -g code-secret-handler
+csh ./my-project
+```
+
+---
+
+## Usage
+
+```bash
+csh [target-dir] [options]
+```
+
+### Options
+
+| Flag | Description | Default |
+|------|-------------|---------|
+| `[target-dir]` | Directory to scan | `.` (current dir) |
+| `-r, --report <format>` | Report format: `console` \| `json` \| `csv` \| `markdown` | `console` |
+| `-o, --output <file>` | Report output file path | Auto-derived |
+| `-e, --env-file <path>` | Target `.env` file path | `./.env` |
+| `--dry-run` | Scan only — no file modifications | `false` |
+| `--no-rewrite` | Write `.env` but skip source-file rewriting | `false` |
+| `-v, --version` | Show version | |
+| `-h, --help` | Show help | |
+
+### Examples
+
+```bash
+# Scan current directory (interactive)
+csh .
+
+# Dry run — see what would be found without changes
+csh ./my-app --dry-run
+
+# Write Markdown report to a file
+csh ./my-app -r markdown -o security-report.md
+
+# Use a custom .env file location
+csh ./my-app -e config/.env
+
+# Write .env but do NOT rewrite source files
+csh ./my-app --no-rewrite
+
+# JSON report
+csh ./my-app -r json -o findings.json
+
+# CSV report for spreadsheet import
+csh ./my-app -r csv
+```
+
+---
+
+## How It Works
+
+```
+CLI args
+  └─► File Walker (respects .gitignore)
+        └─► Detector (179+ regex rules, line-by-line)
+              └─► Findings  { file, line, col, type, rawValue, envKey }
+                    ├─► Reporter (console/json/csv/markdown)
+                    └─► [Interactive confirmation]
+                          ├─► Env Writer  →  .env
+                          └─► Rewriter    →  patched source files
+```
+
+### Detection Rules
+
+| Category | Rules | Examples |
+|----------|-------|----------|
+| AWS | 10 | Access Key ID (`AKIA…`), Secret Key, Session Token, ARN, S3 bucket, MWS key, CloudFront |
+| GCP | 11 | API Key (`AIza…`), OAuth Client, Service Account, Maps, reCAPTCHA, Firebase DB URL |
+| Azure | 8 | Storage connection strings, SAS tokens, Service Bus, CosmosDB, Client/Tenant ID |
+| GitHub | 4 | `ghp_`, `gho_`, `ghs_`, `github_pat_` tokens |
+| GitLab | 2 | `glpat-` Personal Access Tokens, Runner registration tokens |
+| Stripe | 3 | `sk_live_`, `sk_test_`, `rk_live_`, `whsec_` webhook secrets |
+| Twilio | 3 | Account SID, Auth Token, API Key (`SK…`) |
+| Slack | 3 | `xoxb-`/`xoxp-` tokens, webhook URLs, signing secrets |
+| JWT / Auth | 11 | JWT secrets, session, NextAuth, Flask, Rails `secret_key_base`, CSRF, OAuth2 |
+| SSH / PEM | 10 | RSA, EC, DSA, OpenSSH, PGP private key blocks, PKCS12 |
+| Database | 19 | PostgreSQL, MySQL, MongoDB, Redis, MSSQL, Elasticsearch, RabbitMQ, Cassandra, Oracle, CockroachDB, Neo4j, InfluxDB, Kafka |
+| Network | 12 | SMTP, proxy URLs, LDAP, CI/CD deploy tokens, Apple APNs, webhook URLs |
+| AI / ML | 6 | OpenAI (`sk-`), Anthropic (`sk-ant-`), Hugging Face (`hf_`), Pinecone, Cohere, Replicate (`r8_`) |
+| Payments | 5 | Square (`EAA…`), Razorpay, Braintree, Plaid, PayPal |
+| SaaS | 8 | Notion (`secret_`), Linear (`lin_api_`), Airtable, HubSpot, Zendesk, Intercom, Jira, PagerDuty |
+| DevOps | 7 | Vercel, DigitalOcean, Terraform Cloud, HashiCorp Vault, Confluent, Docker Hub, Heroku |
+| Analytics | 8 | Amplitude, Mixpanel, Segment, New Relic (`NRAK-`), Datadog, Dynatrace, Grafana, Sentry |
+| Generic | 21 | API keys/secrets, passwords, bearer tokens, HMAC keys, webhook secrets, license keys, connection strings |
+| Other | 16 | Cloudflare, Cloudinary, Algolia, Mapbox, Shopify, Auth0, Okta, Firebase, LaunchDarkly, Discord, Telegram, Mailgun, Mailchimp, SendGrid, NPM, Pusher |
+
+---
+
+## After Running
+
+1. **Verify** the `.env` file was created with the correct values.
+2. **Add `.env` to `.gitignore`** — the tool reminds you, but please double-check!
+3. **Rotate secrets** that may have been committed to Git history previously.
+4. **Review** modified source files before committing.
+5. **Share `.env.example`** (with placeholder values) with your team.
+
+---
+
+## Development
+
+```bash
+git clone <repo>
+cd code-secret-handler
+npm install
+
+# Run in dev mode
+npm run dev -- ./path/to/scan
+
+# Build
+npm run build
+
+# Type-check
+npm run lint
+```
+
+---
+
+## Telemetry
+
+`code-secret-handler` collects **anonymous usage telemetry** to help the author monitor license compliance and understand how the tool is being used.
+
+### What is collected
+
+| Data | Example |
+|------|---------|
+| Tool version | `1.0.0` |
+| OS platform | `linux`, `darwin`, `win32` |
+| Node.js version | `v20.11.0` |
+| Git remote URL | `https://github.com/owner/repo` |
+| Repo owner & name | `owner`, `repo` |
+| Git platform | `github`, `gitlab`, `bitbucket` |
+| Account type | `Organization` or `User` |
+| License key provided | `true` / `false` |
+| Timestamp | ISO 8601 |
+
+### What is NOT collected
+
+- ❌ Source code or file contents
+- ❌ Secret values or credentials
+- ❌ Personal identifiable information
+- ❌ Anything beyond the fields listed above
+
+### Opt out
+
+Set `CSH_TELEMETRY=0` in your environment to disable all telemetry:
+
+```bash
+CSH_TELEMETRY=0 csh ./my-project
+# or permanently in your shell profile:
+export CSH_TELEMETRY=0
+```
+
+---
+
+## License
+
+**PolyForm Noncommercial License 1.0.0**
+Copyright (c) 2024 Vic — vic.grambo@gmail.com
+
+### ✅ Free for
+
+- Individual developers for personal projects, learning, research, or hobby use
+- Non-profit organizations, educational institutions, public research organizations, and government institutions
+
+### ❌ Not free for
+
+- Companies, startups, agencies, or any for-profit organization
+- Any use that directly or indirectly generates revenue or commercial advantage
+- Running the tool within a commercial CI/CD pipeline or product
+
+### 💼 Commercial licensing
+
+If you represent an organization or wish to use this tool commercially, please contact:
+
+**vic.grambo@gmail.com**
+
+Commercial licensees receive a license key. Set it as an environment variable before running the tool:
+
+```bash
+CSH_LICENSE_KEY=<your-key> csh ./my-project
+```
+
+The full license text is available in the [LICENSE](./LICENSE) file.

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const commander_1 = require("commander");
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+const chalk_1 = __importDefault(require("chalk"));
+const scanner_1 = require("./scanner");
+const envWriter_1 = require("./env/envWriter");
+const rewriter_1 = require("./rewriter");
+const reporter_1 = require("./reporter");
+const confirm_1 = require("./interactive/confirm");
+const gitContext_1 = require("./license/gitContext");
+const licenseCheck_1 = require("./license/licenseCheck");
+const telemetry_1 = require("./license/telemetry");
+const pkg = JSON.parse(fs_1.default.readFileSync(path_1.default.join(__dirname, '..', 'package.json'), 'utf-8'));
+const program = new commander_1.Command();
+program
+    .name('code-secret-handler')
+    .alias('csh')
+    .description(chalk_1.default.cyan('🔐 Scans your codebase for hardcoded secrets, moves them to .env, and rewrites source files.'))
+    .version(pkg.version, '-v, --version', 'Output the current version')
+    .argument('[target-dir]', 'Directory to scan (default: current directory)', '.')
+    .option('-r, --report <format>', 'Report format: console | json | csv | markdown', 'console')
+    .option('-o, --output <file>', 'Report output file path (auto-derived if omitted)')
+    .option('-e, --env-file <path>', 'Target .env file path', '.env')
+    .option('--dry-run', 'Scan and report only — do not write any files', false)
+    .option('--no-rewrite', 'Write .env but skip source-file rewriting')
+    .addHelpText('after', `
+${chalk_1.default.bold('Examples:')}
+  ${chalk_1.default.cyan('$ csh .')}                                  Scan current directory
+  ${chalk_1.default.cyan('$ csh ./my-app --dry-run')}                Scan without modifying files
+  ${chalk_1.default.cyan('$ csh ./my-app -r markdown -o report.md')} Scan and write Markdown report
+  ${chalk_1.default.cyan('$ csh ./my-app -e secrets/.env')}          Use a custom .env path
+  ${chalk_1.default.cyan('$ csh ./my-app --no-rewrite')}             Write .env only, skip source rewrites
+  `);
+program.action(async (targetDirArg, opts) => {
+    console.log(chalk_1.default.bold.cyan('\n🔐  Code Secret Handler\n'));
+    const targetDir = path_1.default.resolve(targetDirArg || '.');
+    // ── License & telemetry (runs before anything else) ──────────────────────
+    const gitCtx = await (0, gitContext_1.getGitContext)(targetDir);
+    const { licenseKeyProvided } = await (0, licenseCheck_1.checkLicense)(gitCtx);
+    (0, telemetry_1.sendTelemetry)(gitCtx, licenseKeyProvided);
+    // ─────────────────────────────────────────────────────────────────────────
+    const report = (opts['report'] || 'console').toLowerCase();
+    const envFile = path_1.default.resolve(targetDir, opts['envFile'] || '.env');
+    const dryRun = Boolean(opts['dryRun']);
+    const noRewrite = !Boolean(opts['rewrite']);
+    const outputArg = opts['output'];
+    const outputPath = outputArg
+        ? path_1.default.resolve(outputArg)
+        : report !== 'console'
+            ? (0, reporter_1.defaultOutputPath)(report, targetDir)
+            : undefined;
+    const _options = { targetDir, report, output: outputPath, envFile, dryRun, noRewrite };
+    if (!fs_1.default.existsSync(targetDir) || !fs_1.default.statSync(targetDir).isDirectory()) {
+        console.error(chalk_1.default.red(`❌  Target directory not found: ${targetDir}`));
+        process.exit(1);
+    }
+    const validFormats = ['console', 'json', 'csv', 'markdown'];
+    if (!validFormats.includes(report)) {
+        console.error(chalk_1.default.red(`❌  Invalid report format: "${report}". Choose from: ${validFormats.join(', ')}`));
+        process.exit(1);
+    }
+    let summary = await (0, scanner_1.runScanner)(targetDir, envFile);
+    summary.dryRun = dryRun;
+    if (outputPath)
+        summary.reportFile = outputPath;
+    const reportFile = (0, reporter_1.runReporter)(report, summary, outputPath);
+    if (reportFile) {
+        console.log(chalk_1.default.green(`\n  📄 Report written to: ${chalk_1.default.underline(reportFile)}\n`));
+    }
+    if (summary.totalFindings === 0)
+        process.exit(0);
+    if (dryRun) {
+        console.log(chalk_1.default.yellow('  ℹ️  Dry run mode — no changes applied.\n'));
+        process.exit(0);
+    }
+    const approved = await (0, confirm_1.confirmChanges)(summary, noRewrite);
+    if (!approved) {
+        console.log(chalk_1.default.yellow('\n  ❌  Aborted — no changes made.\n'));
+        process.exit(0);
+    }
+    let backupChoice = 'skip';
+    if (!noRewrite && summary.totalFindings > 0) {
+        backupChoice = await (0, confirm_1.askBackupPreference)();
+        if (backupChoice === 'abort') {
+            console.log(chalk_1.default.yellow('\n  ❌  Aborted — no changes made.\n'));
+            process.exit(0);
+        }
+    }
+    const written = (0, envWriter_1.writeEnvFile)(envFile, summary.findings);
+    console.log(chalk_1.default.green(`\n  ✅  ${written} secret(s) written to ${chalk_1.default.underline(envFile)}`));
+    if (!noRewrite) {
+        const results = (0, rewriter_1.rewriteFiles)(summary.findings, false);
+        let totalRewrites = 0;
+        for (const result of results) {
+            if (result.replacements === 0)
+                continue;
+            if (backupChoice === 'backup') {
+                fs_1.default.writeFileSync(`${result.filePath}.bak`, result.originalContent, 'utf-8');
+            }
+            totalRewrites += result.replacements;
+            const relPath = path_1.default.relative(targetDir, result.filePath);
+            console.log(chalk_1.default.cyan(`  ✏️  ${relPath}`) +
+                chalk_1.default.gray(` — ${result.replacements} replacement(s)`) +
+                (result.dotenvInjected ? chalk_1.default.yellow(' + dotenv injected') : ''));
+        }
+        console.log(chalk_1.default.green(`\n  ✅  ${totalRewrites} replacement(s) across ${results.filter(r => r.replacements > 0).length} file(s)`));
+    }
+    console.log(chalk_1.default.bold.yellow('\n  ⚠️  IMPORTANT:'));
+    console.log(chalk_1.default.yellow('     1. Add .env to your .gitignore if not already done.'));
+    console.log(chalk_1.default.yellow('     2. Rotate any secrets that may have been committed to Git history.'));
+    console.log(chalk_1.default.yellow('     3. Review all modified source files before committing.\n'));
+    process.exit(0);
+});
+program.parse(process.argv);
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;;;;;AAEA,yCAAoC;AACpC,gDAAwB;AACxB,4CAAoB;AACpB,kDAA0B;AAE1B,uCAAuC;AACvC,+CAA+C;AAC/C,yCAA0C;AAC1C,yCAA4D;AAC5D,mDAA4E;AAC5E,qDAAqD;AACrD,yDAAsD;AACtD,mDAAoD;AAEpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAE,CAAC,YAAY,CAAC,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CACrE,CAAC;AAEF,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,qBAAqB,CAAC;KAC3B,KAAK,CAAC,KAAK,CAAC;KACZ,WAAW,CACV,eAAK,CAAC,IAAI,CAAC,8FAA8F,CAAC,CAC3G;KACA,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,4BAA4B,CAAC;KACnE,QAAQ,CAAC,cAAc,EAAE,gDAAgD,EAAE,GAAG,CAAC;KAC/E,MAAM,CAAC,uBAAuB,EAAE,gDAAgD,EAAE,SAAS,CAAC;KAC5F,MAAM,CAAC,qBAAqB,EAAE,mDAAmD,CAAC;KAClF,MAAM,CAAC,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,CAAC;KAChE,MAAM,CAAC,WAAW,EAAE,+CAA+C,EAAE,KAAK,CAAC;KAC3E,MAAM,CAAC,cAAc,EAAE,2CAA2C,CAAC;KACnE,WAAW,CAAC,OAAO,EAAE;EACtB,eAAK,CAAC,IAAI,CAAC,WAAW,CAAC;IACrB,eAAK,CAAC,IAAI,CAAC,SAAS,CAAC;IACrB,eAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC;IACtC,eAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC;IACrD,eAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC;IAC5C,eAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC;GAC1C,CAAC,CAAC;AAEL,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,YAAoB,EAAE,IAA6B,EAAE,EAAE;IAC3E,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAE5D,MAAM,SAAS,GAAG,cAAI,CAAC,OAAO,CAAC,YAAY,IAAI,GAAG,CAAC,CAAC;IAEpD,4EAA4E;IAC5E,MAAM,MAAM,GAAG,MAAM,IAAA,0BAAa,EAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,IAAA,2BAAY,EAAC,MAAM,CAAC,CAAC;IAC1D,IAAA,yBAAa,EAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC1C,4EAA4E;IAE5E,MAAM,MAAM,GAAG,CAAE,IAAI,CAAC,QAAQ,CAAY,IAAI,SAAS,CAAC,CAAC,WAAW,EAAkB,CAAC;IACvF,MAAM,OAAO,GAAG,cAAI,CAAC,OAAO,CAAC,SAAS,EAAG,IAAI,CAAC,SAAS,CAAY,IAAI,MAAM,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAuB,CAAC;IACvD,MAAM,UAAU,GAAG,SAAS;QAC1B,CAAC,CAAC,cAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACzB,CAAC,CAAC,MAAM,KAAK,SAAS;YACtB,CAAC,CAAC,IAAA,4BAAiB,EAAC,MAAM,EAAE,SAAS,CAAC;YACtC,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,QAAQ,GAAe,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAEnG,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,YAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACvE,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,kCAAkC,SAAS,EAAE,CAAC,CAAC,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,YAAY,GAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IAC5E,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,8BAA8B,MAAM,mBAAmB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,GAAG,MAAM,IAAA,oBAAU,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACnD,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IACxB,IAAI,UAAU;QAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;IAEhD,MAAM,UAAU,GAAG,IAAA,sBAAW,EAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAC5D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,6BAA6B,eAAK,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAEjD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,4CAA4C,CAAC,CAAC,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAc,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,YAAY,GAAgC,MAAM,CAAC;IACvD,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;QAC5C,YAAY,GAAG,MAAM,IAAA,6BAAmB,GAAE,CAAC;QAC3C,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,wBAAY,EAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,UAAU,OAAO,yBAAyB,eAAK,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAE/F,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,IAAA,uBAAY,EAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtD,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC;gBAAE,SAAS;YACxC,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;gBAC9B,YAAE,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,QAAQ,MAAM,EAAE,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAC9E,CAAC;YACD,aAAa,IAAI,MAAM,CAAC,YAAY,CAAC;YACrC,MAAM,OAAO,GAAG,cAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1D,OAAO,CAAC,GAAG,CACT,eAAK,CAAC,IAAI,CAAC,SAAS,OAAO,EAAE,CAAC;gBAC9B,eAAK,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,YAAY,iBAAiB,CAAC;gBACtD,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,eAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,UAAU,aAAa,0BAA0B,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC;IACtI,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,0DAA0D,CAAC,CAAC,CAAC;IACtF,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,yEAAyE,CAAC,CAAC,CAAC;IACrG,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,+DAA+D,CAAC,CAAC,CAAC;IAE3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/env/envWriter.d.ts

@@ -0,0 +1,9 @@
+import { Finding } from '../types';
+/**
+ * Appends or creates a .env file with the given findings.
+ * Keys that already exist in the file are skipped (deduplication was done earlier).
+ *
+ * @returns number of entries written
+ */
+export declare function writeEnvFile(envFilePath: string, findings: Finding[]): number;
+//# sourceMappingURL=envWriter.d.ts.map

package/dist/env/envWriter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envWriter.d.ts","sourceRoot":"","sources":["../../src/env/envWriter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAsBnC;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CA6C7E"}

package/dist/env/envWriter.js

@@ -0,0 +1,76 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeEnvFile = writeEnvFile;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+/**
+ * Parses an existing .env file into a map of key → value.
+ */
+function parseEnvFile(filePath) {
+    const map = new Map();
+    if (!fs_1.default.existsSync(filePath))
+        return map;
+    const lines = fs_1.default.readFileSync(filePath, 'utf-8').split('\n');
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const eqIdx = trimmed.indexOf('=');
+        if (eqIdx < 1)
+            continue;
+        const key = trimmed.slice(0, eqIdx).trim();
+        const value = trimmed.slice(eqIdx + 1).trim().replace(/^['"`]|['"`]$/g, '');
+        map.set(key, value);
+    }
+    return map;
+}
+/**
+ * Appends or creates a .env file with the given findings.
+ * Keys that already exist in the file are skipped (deduplication was done earlier).
+ *
+ * @returns number of entries written
+ */
+function writeEnvFile(envFilePath, findings) {
+    const absPath = path_1.default.resolve(envFilePath);
+    // Ensure parent dir exists
+    const dir = path_1.default.dirname(absPath);
+    if (!fs_1.default.existsSync(dir)) {
+        fs_1.default.mkdirSync(dir, { recursive: true });
+    }
+    const existing = parseEnvFile(absPath);
+    const lines = [];
+    let written = 0;
+    // Group findings by source file for a readable header
+    const byFile = new Map();
+    for (const f of findings) {
+        if (!byFile.has(f.file))
+            byFile.set(f.file, []);
+        byFile.get(f.file).push(f);
+    }
+    const header = `\n# ─── Added by code-secret-handler on ${new Date().toISOString()} ───\n`;
+    lines.push(header);
+    for (const [file, fileFindings] of byFile) {
+        lines.push(`# Source: ${file}`);
+        for (const finding of fileFindings) {
+            if (existing.has(finding.envKey)) {
+                // Should not happen due to dedup, but be safe
+                finding.alreadyInEnv = true;
+                continue;
+            }
+            // Escape value: wrap in double quotes, escape embedded double quotes
+            const safeValue = finding.rawValue.replace(/"/g, '\\"');
+            lines.push(`${finding.envKey}="${safeValue}"`);
+            existing.set(finding.envKey, finding.rawValue);
+            written++;
+        }
+        lines.push('');
+    }
+    if (written > 0) {
+        fs_1.default.appendFileSync(absPath, lines.join('\n'), 'utf-8');
+    }
+    return written;
+}
+//# sourceMappingURL=envWriter.js.map

package/dist/env/envWriter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envWriter.js","sourceRoot":"","sources":["../../src/env/envWriter.ts"],"names":[],"mappings":";;;;;;AAAA,4CAAoB;AACpB,gDAAwB;AAGxB;;GAEG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAC;IAEzC,MAAM,KAAK,GAAG,YAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS;QACxB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC5E,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,sBAA6B,WAAmB,EAAE,QAAmB;IACnE,MAAM,OAAO,GAAG,cAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAE1C,2BAA2B;IAC3B,MAAM,GAAG,GAAG,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,YAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,sDAAsD;IACtD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,MAAM,MAAM,GAAG,2CAA2C,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC;IAC3F,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEnB,KAAK,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,MAAM,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QAChC,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,8CAA8C;gBAC9C,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,qEAAqE;YACrE,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACxD,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,GAAG,CAAC,CAAC;YAC/C,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC/C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,YAAE,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/env/keyNamer.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Sanitizes a string to be a valid env variable name:
+ *  - Upper-case
+ *  - Only alphanumeric and underscores
+ *  - Cannot start with a digit
+ */
+export declare function sanitizeEnvKey(key: string): string;
+/**
+ * Generates a collision-safe env key from a base name and a set of already-used keys.
+ * Appends _2, _3, ... until unique.
+ */
+export declare function makeUniqueKey(baseKey: string, usedKeys: Set<string>): string;
+//# sourceMappingURL=keyNamer.d.ts.map

package/dist/env/keyNamer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyNamer.d.ts","sourceRoot":"","sources":["../../src/env/keyNamer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAUlD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAO5E"}

package/dist/env/keyNamer.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeEnvKey = sanitizeEnvKey;
+exports.makeUniqueKey = makeUniqueKey;
+/**
+ * Sanitizes a string to be a valid env variable name:
+ *  - Upper-case
+ *  - Only alphanumeric and underscores
+ *  - Cannot start with a digit
+ */
+function sanitizeEnvKey(key) {
+    let sanitized = key
+        .toUpperCase()
+        .replace(/[^A-Z0-9_]/g, '_') // replace non-alphanum/underscore with _
+        .replace(/^[0-9]+/, '_'); // cannot start with digits
+    // Collapse multiple consecutive underscores
+    sanitized = sanitized.replace(/__+/g, '_').replace(/^_|_$/g, '');
+    return sanitized || 'SECRET';
+}
+/**
+ * Generates a collision-safe env key from a base name and a set of already-used keys.
+ * Appends _2, _3, ... until unique.
+ */
+function makeUniqueKey(baseKey, usedKeys) {
+    const sanitized = sanitizeEnvKey(baseKey);
+    if (!usedKeys.has(sanitized))
+        return sanitized;
+    let suffix = 2;
+    while (usedKeys.has(`${sanitized}_${suffix}`))
+        suffix++;
+    return `${sanitized}_${suffix}`;
+}
+//# sourceMappingURL=keyNamer.js.map

package/dist/env/keyNamer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyNamer.js","sourceRoot":"","sources":["../../src/env/keyNamer.ts"],"names":[],"mappings":";;;;AAAA;;;;;GAKG;AACH,wBAA+B,GAAW;IACxC,IAAI,SAAS,GAAG,GAAG;SAChB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAG,yCAAyC;SACvE,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAO,2BAA2B;IAE7D,4CAA4C;IAC5C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAEjE,OAAO,SAAS,IAAI,QAAQ,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,uBAA8B,OAAe,EAAE,QAAqB;IAClE,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAE/C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;QAAE,MAAM,EAAE,CAAC;IACxD,OAAO,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;AAClC,CAAC"}

package/dist/interactive/confirm.d.ts

@@ -0,0 +1,16 @@
+import { ScanSummary } from '../types';
+/**
+ * Shows a summary of planned changes and asks the user to confirm before proceeding.
+ * Returns true if the user approves, false if they decline.
+ */
+export declare function confirmChanges(summary: ScanSummary, noRewrite: boolean): Promise<boolean>;
+/**
+ * Asks the user to confirm backup before proceeding.
+ * Returns 'backup', 'skip', or 'abort'.
+ */
+export declare function askBackupPreference(): Promise<'backup' | 'skip' | 'abort'>;
+/**
+ * Prompts for a custom .env file path override.
+ */
+export declare function askEnvFilePath(defaultPath: string): Promise<string>;
+//# sourceMappingURL=confirm.d.ts.map

package/dist/interactive/confirm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm.d.ts","sourceRoot":"","sources":["../../src/interactive/confirm.ts"],"names":[],"mappings":"AAGA,OAAO,EAAW,WAAW,EAAE,MAAM,UAAU,CAAC;AAEhD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAmC/F;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC,CAUhF;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMzE"}