code-secret-handler 1.0.0

package/dist/interactive/confirm.js

@@ -0,0 +1,72 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.confirmChanges = confirmChanges;
+exports.askBackupPreference = askBackupPreference;
+exports.askEnvFilePath = askEnvFilePath;
+const prompts_1 = require("@inquirer/prompts");
+const chalk_1 = __importDefault(require("chalk"));
+const path_1 = __importDefault(require("path"));
+/**
+ * Shows a summary of planned changes and asks the user to confirm before proceeding.
+ * Returns true if the user approves, false if they decline.
+ */
+async function confirmChanges(summary, noRewrite) {
+    if (summary.totalFindings === 0)
+        return false;
+    console.log('\n' + chalk_1.default.bold.yellow('📋  Planned Changes:'));
+    console.log(chalk_1.default.gray('─'.repeat(60)));
+    // Group by file
+    const byFile = new Map();
+    for (const f of summary.findings) {
+        if (!byFile.has(f.file))
+            byFile.set(f.file, []);
+        byFile.get(f.file).push(f);
+    }
+    // Print .env changes
+    console.log(chalk_1.default.bold(`\n  1. Write to ${chalk_1.default.underline(summary.envFile)}:`));
+    for (const f of summary.findings) {
+        console.log(chalk_1.default.green(`     + ${f.envKey}="***"`));
+    }
+    if (!noRewrite) {
+        console.log(chalk_1.default.bold(`\n  2. Rewrite ${byFile.size} source file(s):`));
+        for (const [filePath, fileFindings] of byFile) {
+            const relPath = path_1.default.relative(summary.targetDir, filePath);
+            console.log(chalk_1.default.cyan(`     📄 ${relPath}  (${fileFindings.length} change(s))`));
+        }
+    }
+    console.log(chalk_1.default.gray('\n─'.repeat(60)));
+    const answer = await (0, prompts_1.confirm)({
+        message: `Apply ${summary.totalFindings} change(s) to .env${noRewrite ? '' : ' and source files'}?`,
+        default: true,
+    });
+    return answer;
+}
+/**
+ * Asks the user to confirm backup before proceeding.
+ * Returns 'backup', 'skip', or 'abort'.
+ */
+async function askBackupPreference() {
+    const choice = await (0, prompts_1.select)({
+        message: 'Source files will be modified. How would you like to handle backups?',
+        choices: [
+            { name: 'Create .bak backup of each modified file', value: 'backup' },
+            { name: 'Skip backup (rely on Git)', value: 'skip' },
+            { name: 'Abort — do not make any changes', value: 'abort' },
+        ],
+    });
+    return choice;
+}
+/**
+ * Prompts for a custom .env file path override.
+ */
+async function askEnvFilePath(defaultPath) {
+    const answer = await (0, prompts_1.input)({
+        message: 'Path for the .env file:',
+        default: defaultPath,
+    });
+    return answer;
+}
+//# sourceMappingURL=confirm.js.map

package/dist/interactive/confirm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm.js","sourceRoot":"","sources":["../../src/interactive/confirm.ts"],"names":[],"mappings":";;;;;;;;AAAA,+CAA2D;AAC3D,kDAA0B;AAC1B,gDAAwB;AAGxB;;;GAGG;AACI,KAAK,yBAAyB,OAAoB,EAAE,SAAkB;IAC3E,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE9C,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,eAAK,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAExC,gBAAgB;IAChB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,qBAAqB;IACrB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,mBAAmB,eAAK,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAChF,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC;QACzE,KAAK,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,MAAM,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,cAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,WAAW,OAAO,MAAM,YAAY,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE1C,MAAM,MAAM,GAAG,MAAM,IAAA,iBAAO,EAAC;QAC3B,OAAO,EAAE,SAAS,OAAO,CAAC,aAAa,qBAAqB,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,GAAG;QACnG,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACI,KAAK;IACV,MAAM,MAAM,GAAG,MAAM,IAAA,gBAAM,EAAC;QAC1B,OAAO,EAAE,sEAAsE;QAC/E,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,0CAA0C,EAAE,KAAK,EAAE,QAAQ,EAAE;YACrE,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,EAAE;YACpD,EAAE,IAAI,EAAE,iCAAiC,EAAE,KAAK,EAAE,OAAO,EAAE;SAC5D;KACF,CAAC,CAAC;IACH,OAAO,MAAqC,CAAC;AAC/C,CAAC;AAED;;GAEG;AACI,KAAK,yBAAyB,WAAmB;IACtD,MAAM,MAAM,GAAG,MAAM,IAAA,eAAK,EAAC;QACzB,OAAO,EAAE,yBAAyB;QAClC,OAAO,EAAE,WAAW;KACrB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/license/gitContext.d.ts

@@ -0,0 +1,16 @@
+export type GitPlatform = 'github' | 'gitlab' | 'bitbucket' | 'other';
+export type AccountType = 'Organization' | 'User' | 'unknown';
+export interface GitContext {
+    repoUrl: string;
+    owner: string;
+    repoName: string;
+    platform: GitPlatform;
+    accountType: AccountType;
+}
+/**
+ * Reads the git remote origin URL from the target directory, parses it,
+ * and (for GitHub repos) checks whether the owner is an Org or personal User.
+ * Returns null if the directory has no git remote or is not a git repo.
+ */
+export declare function getGitContext(targetDir: string): Promise<GitContext | null>;
+//# sourceMappingURL=gitContext.d.ts.map

package/dist/license/gitContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitContext.d.ts","sourceRoot":"","sources":["../../src/license/gitContext.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;AACtE,MAAM,MAAM,WAAW,GAAG,cAAc,GAAG,MAAM,GAAG,SAAS,CAAC;AAE9D,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,WAAW,CAAC;IACtB,WAAW,EAAE,WAAW,CAAC;CAC1B;AAkFD;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA2BjF"}

package/dist/license/gitContext.js

@@ -0,0 +1,117 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getGitContext = getGitContext;
+const child_process_1 = require("child_process");
+const https_1 = __importDefault(require("https"));
+// ─── Parse remote URL ─────────────────────────────────────────────────────────
+/**
+ * Parses a git remote URL (SSH or HTTPS) into owner, repo, and platform.
+ * Supports:
+ *   git@github.com:owner/repo.git
+ *   https://github.com/owner/repo.git
+ *   git@gitlab.com:owner/repo.git
+ *   https://bitbucket.org/owner/repo.git
+ */
+function parseRemoteUrl(remoteUrl) {
+    // SSH format: git@<host>:<owner>/<repo>.git
+    const sshMatch = remoteUrl.match(/git@([^:]+):([^/]+)\/(.+?)(?:\.git)?$/);
+    if (sshMatch) {
+        const host = sshMatch[1].toLowerCase();
+        const owner = sshMatch[2];
+        const repoName = sshMatch[3];
+        return { owner, repoName, platform: detectPlatform(host) };
+    }
+    // HTTPS format: https://<host>/<owner>/<repo>.git
+    const httpsMatch = remoteUrl.match(/https?:\/\/([^/]+)\/([^/]+)\/(.+?)(?:\.git)?$/);
+    if (httpsMatch) {
+        const host = httpsMatch[1].toLowerCase();
+        const owner = httpsMatch[2];
+        const repoName = httpsMatch[3];
+        return { owner, repoName, platform: detectPlatform(host) };
+    }
+    return null;
+}
+function detectPlatform(host) {
+    if (host.includes('github'))
+        return 'github';
+    if (host.includes('gitlab'))
+        return 'gitlab';
+    if (host.includes('bitbucket'))
+        return 'bitbucket';
+    return 'other';
+}
+// ─── GitHub API: org vs user ──────────────────────────────────────────────────
+/**
+ * Calls the public unauthenticated GitHub API to determine whether an owner
+ * is a personal User or an Organization. Returns 'unknown' on any failure.
+ */
+function fetchGitHubAccountType(owner) {
+    return new Promise((resolve) => {
+        const options = {
+            hostname: 'api.github.com',
+            path: `/users/${encodeURIComponent(owner)}`,
+            method: 'GET',
+            headers: {
+                'User-Agent': 'code-secret-handler',
+                'Accept': 'application/vnd.github+json',
+            },
+        };
+        const req = https_1.default.request(options, (res) => {
+            let data = '';
+            res.on('data', (chunk) => { data += chunk; });
+            res.on('end', () => {
+                try {
+                    const json = JSON.parse(data);
+                    if (json.type === 'Organization')
+                        resolve('Organization');
+                    else if (json.type === 'User')
+                        resolve('User');
+                    else
+                        resolve('unknown');
+                }
+                catch {
+                    resolve('unknown');
+                }
+            });
+        });
+        req.on('error', () => resolve('unknown'));
+        req.setTimeout(4000, () => { req.destroy(); resolve('unknown'); });
+        req.end();
+    });
+}
+// ─── Main export ──────────────────────────────────────────────────────────────
+/**
+ * Reads the git remote origin URL from the target directory, parses it,
+ * and (for GitHub repos) checks whether the owner is an Org or personal User.
+ * Returns null if the directory has no git remote or is not a git repo.
+ */
+async function getGitContext(targetDir) {
+    try {
+        const rawUrl = (0, child_process_1.execSync)(`git -C "${targetDir}" config --get remote.origin.url`, {
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 4000,
+        })
+            .toString()
+            .trim();
+        if (!rawUrl)
+            return null;
+        const parsed = parseRemoteUrl(rawUrl);
+        if (!parsed)
+            return null;
+        const { owner, repoName, platform } = parsed;
+        // Only query GitHub API for GitHub repos (GitLab/Bitbucket have different APIs)
+        let accountType = 'unknown';
+        if (platform === 'github') {
+            accountType = await fetchGitHubAccountType(owner);
+        }
+        return { repoUrl: rawUrl, owner, repoName, platform, accountType };
+    }
+    catch {
+        // Not a git repo, no remote, or git not installed — silently ignore
+        return null;
+    }
+}
+//# sourceMappingURL=gitContext.js.map

package/dist/license/gitContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitContext.js","sourceRoot":"","sources":["../../src/license/gitContext.ts"],"names":[],"mappings":";;;;;;AAAA,iDAAyC;AACzC,kDAA0B;AAe1B,iFAAiF;AAEjF;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,SAAiB;IACvC,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC1E,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7D,CAAC;IAED,kDAAkD;IAClD,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACpF,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7D,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IACnD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iFAAiF;AAEjF;;;GAGG;AACH,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG;YACd,QAAQ,EAAE,gBAAgB;YAC1B,IAAI,EAAE,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE;YAC3C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,YAAY,EAAE,qBAAqB;gBACnC,QAAQ,EAAE,6BAA6B;aACxC;SACF,CAAC;QAEF,MAAM,GAAG,GAAG,eAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzC,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsB,CAAC;oBACnD,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc;wBAAE,OAAO,CAAC,cAAc,CAAC,CAAC;yBACrD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;wBAAE,OAAO,CAAC,MAAM,CAAC,CAAC;;wBAC1C,OAAO,CAAC,SAAS,CAAC,CAAC;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,CAAC,SAAS,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1C,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACI,KAAK,wBAAwB,SAAiB;IACnD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,WAAW,SAAS,kCAAkC,EAAE;YAC9E,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CAAC;aACC,QAAQ,EAAE;aACV,IAAI,EAAE,CAAC;QAEV,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QAE7C,gFAAgF;QAChF,IAAI,WAAW,GAAgB,SAAS,CAAC;QACzC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,WAAW,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/license/licenseCheck.d.ts

@@ -0,0 +1,22 @@
+import { GitContext } from './gitContext';
+export interface LicenseCheckResult {
+    /** Whether execution is allowed to continue */
+    allowed: boolean;
+    /** Whether a valid commercial license key was provided */
+    licenseKeyProvided: boolean;
+}
+/**
+ * Performs the full license check:
+ *
+ * 1. If CSH_LICENSE_KEY is set → validate it online against Supabase.
+ *    - Valid   → allow (commercial user with a valid key)
+ *    - Invalid → treat as unlicensed org and block
+ *
+ * 2. If no key and the owner is a GitHub Organization → hard-block with banner.
+ *
+ * 3. All other cases (personal user, unknown, no git remote) → allow freely.
+ *
+ * Hard-blocks call process.exit(1).
+ */
+export declare function checkLicense(gitCtx: GitContext | null): Promise<LicenseCheckResult>;
+//# sourceMappingURL=licenseCheck.d.ts.map

package/dist/license/licenseCheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"licenseCheck.d.ts","sourceRoot":"","sources":["../../src/license/licenseCheck.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AA2F1C,MAAM,WAAW,kBAAkB;IACjC,+CAA+C;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA2BzF"}

package/dist/license/licenseCheck.js

@@ -0,0 +1,119 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkLicense = checkLicense;
+const https_1 = __importDefault(require("https"));
+const chalk_1 = __importDefault(require("chalk"));
+// ─── Config ───────────────────────────────────────────────────────────────────
+const SUPABASE_URL = 'https://onzfespujyixmzcrsrmc.supabase.co';
+const SUPABASE_ANON_KEY = 'sb_publishable_wmKRmr4EANLYfpJyllpxRQ_IZUCOn9o';
+const CONTACT_EMAIL = 'vic.grambo@gmail.com';
+// ─── Supabase license key validator ──────────────────────────────────────────
+/**
+ * Checks the `license_keys` table in Supabase for a matching active key.
+ * Returns true if the key is valid and active.
+ */
+function validateKeyOnline(licenseKey) {
+    return new Promise((resolve) => {
+        const encodedKey = encodeURIComponent(licenseKey);
+        const url = new URL(`/rest/v1/license_keys?key=eq.${encodedKey}&is_active=eq.true&select=key`, SUPABASE_URL);
+        const options = {
+            hostname: url.hostname,
+            path: url.pathname + url.search,
+            method: 'GET',
+            headers: {
+                'apikey': SUPABASE_ANON_KEY,
+                'Authorization': `Bearer ${SUPABASE_ANON_KEY}`,
+                'Accept': 'application/json',
+            },
+        };
+        const req = https_1.default.request(options, (res) => {
+            let data = '';
+            res.on('data', (chunk) => { data += chunk; });
+            res.on('end', () => {
+                try {
+                    const rows = JSON.parse(data);
+                    resolve(Array.isArray(rows) && rows.length > 0);
+                }
+                catch {
+                    resolve(false);
+                }
+            });
+        });
+        req.on('error', () => resolve(false));
+        req.setTimeout(6000, () => { req.destroy(); resolve(false); });
+        req.end();
+    });
+}
+// ─── Hard-block banner ────────────────────────────────────────────────────────
+function printBlockBanner(gitCtx) {
+    const owner = gitCtx?.owner ?? 'Unknown';
+    const repo = gitCtx ? `${gitCtx.owner}/${gitCtx.repoName}` : 'Unknown';
+    const type = gitCtx?.accountType === 'Organization' ? 'GitHub Organization' : 'Organization / Company';
+    const w = 65;
+    const line = '─'.repeat(w);
+    console.log('\n' + chalk_1.default.red('┌' + line + '┐'));
+    const title = '  🚫  COMMERCIAL USE DETECTED — LICENSE REQUIRED';
+    console.log(chalk_1.default.red('│') + chalk_1.default.bold.red(title.padEnd(w)) + chalk_1.default.red('│'));
+    console.log(chalk_1.default.red('│' + ' '.repeat(w) + '│'));
+    const rows = [
+        `  This tool is free for personal use only.`,
+        `  The scanned repo appears to belong to an organization:`,
+        ``,
+        `  Owner  : ${owner}  (${type})`,
+        `  Repo   : ${repo}`,
+        ``,
+        `  To use code-secret-handler commercially or within an`,
+        `  organization, you must obtain a commercial license.`,
+        ``,
+        `  Contact : ${CONTACT_EMAIL}`,
+        `  Set     : CSH_LICENSE_KEY=<your-key>  to proceed`,
+        ``,
+        `  To opt out of telemetry: CSH_TELEMETRY=0`,
+    ];
+    for (const row of rows) {
+        console.log(chalk_1.default.red('│') + chalk_1.default.yellow(row.padEnd(w)) + chalk_1.default.red('│'));
+    }
+    console.log(chalk_1.default.red('└' + line + '┘') + '\n');
+}
+/**
+ * Performs the full license check:
+ *
+ * 1. If CSH_LICENSE_KEY is set → validate it online against Supabase.
+ *    - Valid   → allow (commercial user with a valid key)
+ *    - Invalid → treat as unlicensed org and block
+ *
+ * 2. If no key and the owner is a GitHub Organization → hard-block with banner.
+ *
+ * 3. All other cases (personal user, unknown, no git remote) → allow freely.
+ *
+ * Hard-blocks call process.exit(1).
+ */
+async function checkLicense(gitCtx) {
+    const licenseKey = process.env['CSH_LICENSE_KEY']?.trim();
+    // ── Step 1: License key provided → validate online ──────────────────────────
+    if (licenseKey) {
+        console.log(chalk_1.default.gray('  🔑  Validating commercial license key…'));
+        const valid = await validateKeyOnline(licenseKey);
+        if (valid) {
+            console.log(chalk_1.default.green('  ✅  Commercial license verified. Thank you!\n'));
+            return { allowed: true, licenseKeyProvided: true };
+        }
+        else {
+            // Invalid key — treat as unlicensed org
+            console.log(chalk_1.default.red('  ❌  License key is invalid or expired.\n'));
+            printBlockBanner(gitCtx);
+            process.exit(1);
+        }
+    }
+    // ── Step 2: No key → check if this is an org repo ───────────────────────────
+    if (gitCtx?.accountType === 'Organization') {
+        printBlockBanner(gitCtx);
+        process.exit(1);
+    }
+    // ── Step 3: Personal user, unknown, or no git context → allow freely ────────
+    return { allowed: true, licenseKeyProvided: false };
+}
+//# sourceMappingURL=licenseCheck.js.map

package/dist/license/licenseCheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"licenseCheck.js","sourceRoot":"","sources":["../../src/license/licenseCheck.ts"],"names":[],"mappings":";;;;;;AAAA,kDAA0B;AAC1B,kDAA0B;AAG1B,iFAAiF;AAEjF,MAAM,YAAY,GAAG,0CAA0C,CAAC;AAChE,MAAM,iBAAiB,GAAG,gDAAgD,CAAC;AAC3E,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAE7C,gFAAgF;AAEhF;;;GAGG;AACH,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,gCAAgC,UAAU,+BAA+B,EACzE,YAAY,CACb,CAAC;QAEF,MAAM,OAAO,GAAG;YACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;YAC/B,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,QAAQ,EAAE,iBAAiB;gBAC3B,eAAe,EAAE,UAAU,iBAAiB,EAAE;gBAC9C,QAAQ,EAAE,kBAAkB;aAC7B;SACF,CAAC;QAEF,MAAM,GAAG,GAAG,eAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzC,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC;oBAC3C,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAClD,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,CAAC,KAAK,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACtC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AAEjF,SAAS,gBAAgB,CAAC,MAAyB;IACjD,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,SAAS,CAAC;IACzC,MAAM,IAAI,GAAI,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,MAAM,IAAI,GAAI,MAAM,EAAE,WAAW,KAAK,cAAc,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,wBAAwB,CAAC;IACxG,MAAM,CAAC,GAAG,EAAE,CAAC;IACb,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAE3B,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,eAAK,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,kDAAkD,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,eAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,eAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAElD,MAAM,IAAI,GAAG;QACX,4CAA4C;QAC5C,0DAA0D;QAC1D,EAAE;QACF,cAAc,KAAK,MAAM,IAAI,GAAG;QAChC,cAAc,IAAI,EAAE;QACpB,EAAE;QACF,wDAAwD;QACxD,uDAAuD;QACvD,EAAE;QACF,eAAe,aAAa,EAAE;QAC9B,oDAAoD;QACpD,EAAE;QACF,4CAA4C;KAC7C,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,eAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,eAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;AAClD,CAAC;AAWD;;;;;;;;;;;;GAYG;AACI,KAAK,uBAAuB,MAAyB;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC;IAE1D,+EAA+E;IAC/E,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAElD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC,CAAC;YAC3E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,wCAAwC;YACxC,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,CAAC;YACpE,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,IAAI,MAAM,EAAE,WAAW,KAAK,cAAc,EAAE,CAAC;QAC3C,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,+EAA+E;IAC/E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;AACtD,CAAC"}

package/dist/license/telemetry.d.ts

@@ -0,0 +1,17 @@
+import { GitContext } from './gitContext';
+/**
+ * Sends a non-blocking, fire-and-forget telemetry ping to Supabase.
+ *
+ * Opt-out: set CSH_TELEMETRY=0 in the environment.
+ *
+ * What is collected:
+ *   - Tool version, OS, Node.js version
+ *   - Git remote URL, owner, repo name, platform (github/gitlab/etc.)
+ *   - Whether the owner is an Org or personal User (via public GitHub API)
+ *   - Whether a commercial license key was provided
+ *   - Timestamp
+ *
+ * Nothing sensitive is ever collected (no secrets, no file contents, no code).
+ */
+export declare function sendTelemetry(gitCtx: GitContext | null, licenseKeyProvided: boolean): void;
+//# sourceMappingURL=telemetry.d.ts.map

package/dist/license/telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../../src/license/telemetry.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AA+D1C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,EAAE,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAwB1F"}

package/dist/license/telemetry.js

@@ -0,0 +1,87 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sendTelemetry = sendTelemetry;
+const https_1 = __importDefault(require("https"));
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+// ─── Config (baked in at publish time) ───────────────────────────────────────
+const SUPABASE_URL = 'https://onzfespujyixmzcrsrmc.supabase.co';
+const SUPABASE_ANON_KEY = 'sb_publishable_wmKRmr4EANLYfpJyllpxRQ_IZUCOn9o';
+const TABLE = 'csh_telemetry';
+// ─── Version helper ───────────────────────────────────────────────────────────
+function getToolVersion() {
+    try {
+        const pkgPath = path_1.default.join(__dirname, '..', '..', 'package.json');
+        const pkg = JSON.parse(fs_1.default.readFileSync(pkgPath, 'utf-8'));
+        return pkg.version ?? 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+// ─── HTTP POST (no external deps — pure Node https) ──────────────────────────
+function postToSupabase(payload) {
+    const body = JSON.stringify(payload);
+    const url = new URL(`/rest/v1/${TABLE}`, SUPABASE_URL);
+    const options = {
+        hostname: url.hostname,
+        path: url.pathname,
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'Content-Length': Buffer.byteLength(body),
+            'apikey': SUPABASE_ANON_KEY,
+            'Authorization': `Bearer ${SUPABASE_ANON_KEY}`,
+            'Prefer': 'return=minimal',
+        },
+    };
+    const req = https_1.default.request(options);
+    req.on('error', () => { });
+    req.setTimeout(6000, () => { req.destroy(); });
+    req.write(body);
+    req.end();
+}
+// ─── Main export ──────────────────────────────────────────────────────────────
+/**
+ * Sends a non-blocking, fire-and-forget telemetry ping to Supabase.
+ *
+ * Opt-out: set CSH_TELEMETRY=0 in the environment.
+ *
+ * What is collected:
+ *   - Tool version, OS, Node.js version
+ *   - Git remote URL, owner, repo name, platform (github/gitlab/etc.)
+ *   - Whether the owner is an Org or personal User (via public GitHub API)
+ *   - Whether a commercial license key was provided
+ *   - Timestamp
+ *
+ * Nothing sensitive is ever collected (no secrets, no file contents, no code).
+ */
+function sendTelemetry(gitCtx, licenseKeyProvided) {
+    // Respect opt-out
+    const telemetryEnv = process.env['CSH_TELEMETRY'];
+    if (telemetryEnv === '0' || telemetryEnv === 'false')
+        return;
+    const payload = {
+        tool_version: getToolVersion(),
+        os_platform: process.platform,
+        node_version: process.version,
+        repo_url: gitCtx?.repoUrl ?? null,
+        owner: gitCtx?.owner ?? null,
+        repo_name: gitCtx?.repoName ?? null,
+        git_platform: gitCtx?.platform ?? null,
+        account_type: gitCtx?.accountType ?? null,
+        license_key_provided: licenseKeyProvided,
+        timestamp: new Date().toISOString(),
+    };
+    // Fully async — does not await, does not block the CLI
+    try {
+        postToSupabase(payload);
+    }
+    catch {
+        // Never crash the CLI due to telemetry
+    }
+}
+//# sourceMappingURL=telemetry.js.map

package/dist/license/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../../src/license/telemetry.ts"],"names":[],"mappings":";;;;;;AAAA,kDAA0B;AAC1B,4CAAoB;AACpB,gDAAwB;AAGxB,gFAAgF;AAEhF,MAAM,YAAY,GAAG,0CAA0C,CAAC;AAChE,MAAM,iBAAiB,GAAG,gDAAgD,CAAC;AAC3E,MAAM,KAAK,GAAG,eAAe,CAAC;AAiB9B,iFAAiF;AAEjF,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAyB,CAAC;QAClF,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF,SAAS,cAAc,CAAC,OAAyB;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,KAAK,EAAE,EAAE,YAAY,CAAC,CAAC;IAEvD,MAAM,OAAO,GAAG;QACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,IAAI,EAAE,GAAG,CAAC,QAAQ;QAClB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;YACzC,QAAQ,EAAE,iBAAiB;YAC3B,eAAe,EAAE,UAAU,iBAAiB,EAAE;YAC9C,QAAQ,EAAE,gBAAgB;SAC3B;KACF,CAAC;IAEF,MAAM,GAAG,GAAG,eAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAuC,CAAC,CAAC,CAAC;IAC/D,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChB,GAAG,CAAC,GAAG,EAAE,CAAC;AACZ,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;;;;GAaG;AACH,uBAA8B,MAAyB,EAAE,kBAA2B;IAClF,kBAAkB;IAClB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAClD,IAAI,YAAY,KAAK,GAAG,IAAI,YAAY,KAAK,OAAO;QAAE,OAAO;IAE7D,MAAM,OAAO,GAAqB;QAChC,YAAY,EAAE,cAAc,EAAE;QAC9B,WAAW,EAAE,OAAO,CAAC,QAAQ;QAC7B,YAAY,EAAE,OAAO,CAAC,OAAO;QAC7B,QAAQ,EAAE,MAAM,EAAE,OAAO,IAAI,IAAI;QACjC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,IAAI;QAC5B,SAAS,EAAE,MAAM,EAAE,QAAQ,IAAI,IAAI;QACnC,YAAY,EAAE,MAAM,EAAE,QAAQ,IAAI,IAAI;QACtC,YAAY,EAAE,MAAM,EAAE,WAAW,IAAI,IAAI;QACzC,oBAAoB,EAAE,kBAAkB;QACxC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,uDAAuD;IACvD,IAAI,CAAC;QACH,cAAc,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;AACH,CAAC"}

package/dist/reporter/console.d.ts

@@ -0,0 +1,3 @@
+import { ScanSummary } from '../types';
+export declare function printConsoleReport(summary: ScanSummary): void;
+//# sourceMappingURL=console.d.ts.map

package/dist/reporter/console.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"console.d.ts","sourceRoot":"","sources":["../../src/reporter/console.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAqB,MAAM,UAAU,CAAC;AA8B1D,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CA4E7D"}

package/dist/reporter/console.js

@@ -0,0 +1,96 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.printConsoleReport = printConsoleReport;
+const chalk_1 = __importDefault(require("chalk"));
+const path_1 = __importDefault(require("path"));
+const SEVERITY_COLORS = {
+    critical: (s) => chalk_1.default.bgRed.white.bold(s),
+    high: (s) => chalk_1.default.red.bold(s),
+    medium: (s) => chalk_1.default.yellow.bold(s),
+    low: (s) => chalk_1.default.blue(s),
+};
+const SEVERITY_ICONS = {
+    critical: '🚨',
+    high: '🔴',
+    medium: '🟡',
+    low: '🔵',
+};
+function maskValue(value) {
+    if (value.length <= 8)
+        return '*'.repeat(value.length);
+    return value.slice(0, 4) + '*'.repeat(Math.min(value.length - 8, 20)) + value.slice(-4);
+}
+function groupByFile(findings) {
+    const map = new Map();
+    for (const f of findings) {
+        if (!map.has(f.file))
+            map.set(f.file, []);
+        map.get(f.file).push(f);
+    }
+    return map;
+}
+function printConsoleReport(summary) {
+    const { findings, filesScanned, filesWithSecrets, totalFindings, dryRun, envFile, scannedAt } = summary;
+    console.log('\n' + chalk_1.default.bold.cyan('═'.repeat(70)));
+    console.log(chalk_1.default.bold.cyan('  🔐  CODE SECRET HANDLER — Scan Report'));
+    console.log(chalk_1.default.bold.cyan('═'.repeat(70)));
+    console.log(chalk_1.default.gray(`  Scanned at : ${scannedAt}`));
+    console.log(chalk_1.default.gray(`  Target dir : ${summary.targetDir}`));
+    console.log(chalk_1.default.gray(`  Env file   : ${envFile}`));
+    if (dryRun)
+        console.log(chalk_1.default.yellow('  ⚠️  DRY RUN MODE — No files were modified'));
+    console.log('');
+    if (totalFindings === 0) {
+        console.log(chalk_1.default.green.bold('  ✅  No hardcoded secrets detected. Great job!\n'));
+        return;
+    }
+    // Summary line
+    console.log(chalk_1.default.bold(`  Found ${chalk_1.default.red(String(totalFindings))} secret(s) across `) +
+        chalk_1.default.bold(`${chalk_1.default.red(String(filesWithSecrets))} file(s) `) +
+        chalk_1.default.gray(`(${filesScanned} files scanned)`));
+    console.log('');
+    // Severity breakdown
+    const bySeverity = { critical: 0, high: 0, medium: 0, low: 0 };
+    for (const f of findings)
+        bySeverity[f.rule.severity]++;
+    console.log('  Severity breakdown:');
+    for (const [sev, count] of Object.entries(bySeverity)) {
+        if (count === 0)
+            continue;
+        const colored = SEVERITY_COLORS[sev];
+        console.log(`    ${SEVERITY_ICONS[sev]}  ${colored(sev.padEnd(8))}  ${count}`);
+    }
+    console.log('');
+    // Per-file findings
+    const byFile = groupByFile(findings);
+    for (const [filePath, fileFindings] of byFile) {
+        const relPath = path_1.default.relative(summary.targetDir, filePath);
+        console.log(chalk_1.default.underline.bold(`  📄 ${relPath}`));
+        for (const f of fileFindings) {
+            const sevColor = SEVERITY_COLORS[f.rule.severity];
+            const icon = SEVERITY_ICONS[f.rule.severity];
+            console.log(`    ${icon} ${sevColor(`[${f.rule.severity.toUpperCase()}]`)} ` +
+                chalk_1.default.cyan(`Line ${f.line}:${f.column}`) +
+                `  ${chalk_1.default.gray(f.rule.description)}`);
+            console.log(`       Rule ID : ${chalk_1.default.gray(f.rule.id)}`);
+            console.log(`       Value   : ${chalk_1.default.red(maskValue(f.rawValue))}`);
+            console.log(`       Env Key : ${chalk_1.default.green(f.envKey)}`);
+            if (!dryRun) {
+                console.log(`       Context : ${chalk_1.default.dim(f.lineContent.trim().slice(0, 80))}`);
+            }
+            console.log('');
+        }
+    }
+    console.log(chalk_1.default.bold.cyan('═'.repeat(70)));
+    if (!dryRun) {
+        console.log(chalk_1.default.green.bold(`\n  ✅  ${totalFindings} secret(s) moved to ${chalk_1.default.underline(envFile)}`));
+        console.log(chalk_1.default.yellow(`  ⚠️  Verify source file changes, then add .env to .gitignore!\n`));
+    }
+    else {
+        console.log(chalk_1.default.yellow(`\n  ℹ️  Dry run complete. Run without --dry-run to apply changes.\n`));
+    }
+}
+//# sourceMappingURL=console.js.map

package/dist/reporter/console.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"console.js","sourceRoot":"","sources":["../../src/reporter/console.ts"],"names":[],"mappings":";;;;;;AAAA,kDAA0B;AAC1B,gDAAwB;AAGxB,MAAM,eAAe,GAA4C;IAC/D,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,eAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,eAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,eAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACnC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,eAAK,CAAC,IAAI,CAAC,CAAC,CAAC;CAC1B,CAAC;AAEF,MAAM,cAAc,GAA6B;IAC/C,QAAQ,EAAE,IAAI;IACd,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,IAAI;IACZ,GAAG,EAAE,IAAI;CACV,CAAC;AAEF,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,WAAW,CAAC,QAAmB;IACtC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAqB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4BAAmC,OAAoB;IACrD,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAExG,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,eAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,kBAAkB,SAAS,EAAE,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAC,CAAC;IACrD,IAAI,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC,CAAC;QAClF,OAAO;IACT,CAAC;IAED,eAAe;IACf,OAAO,CAAC,GAAG,CACT,eAAK,CAAC,IAAI,CAAC,WAAW,eAAK,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC;QAC3E,eAAK,CAAC,IAAI,CAAC,GAAG,eAAK,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,WAAW,CAAC;QAC7D,eAAK,CAAC,IAAI,CAAC,IAAI,YAAY,iBAAiB,CAAC,CAC9C,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,qBAAqB;IACrB,MAAM,UAAU,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,IAAI,KAAK,KAAK,CAAC;YAAE,SAAS;QAC1B,MAAM,OAAO,GAAG,eAAe,CAAC,GAAe,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,OAAO,cAAc,CAAC,GAAe,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,oBAAoB;IACpB,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,MAAM,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,cAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAC,CAAC;QAErD,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CACT,OAAO,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,GAAG;gBAChE,eAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBACxC,KAAK,eAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CACtC,CAAC;YACF,OAAO,CAAC,GAAG,CACT,oBAAoB,eAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAC5C,CAAC;YACF,OAAO,CAAC,GAAG,CACT,oBAAoB,eAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CACvD,CAAC;YACF,OAAO,CAAC,GAAG,CACT,oBAAoB,eAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAC5C,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CACT,oBAAoB,eAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CACnE,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,aAAa,uBAAuB,eAAK,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACxG,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,kEAAkE,CAAC,CAAC,CAAC;IAChG,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,qEAAqE,CAAC,CAAC,CAAC;IACnG,CAAC;AACH,CAAC"}

package/dist/reporter/csv.d.ts

@@ -0,0 +1,6 @@
+import { ScanSummary } from '../types';
+/**
+ * Writes a CSV report of the scan findings.
+ */
+export declare function writeCsvReport(summary: ScanSummary, outputPath: string): void;
+//# sourceMappingURL=csv.d.ts.map

package/dist/reporter/csv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csv.d.ts","sourceRoot":"","sources":["../../src/reporter/csv.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAevC;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAkC7E"}