env-guardrail 0.1.0

package/dist/chunk-636KQXX3.js

@@ -0,0 +1,70 @@
+// src/scanner.ts
+import fs from "fs";
+import { glob } from "glob";
+import { parse } from "@babel/parser";
+import traverseModule from "@babel/traverse";
+var traverse = traverseModule.default || traverseModule;
+function scanCodebase(rootDir = ".") {
+  const files = glob.sync("**/*.{js,jsx,ts,tsx}", {
+    cwd: rootDir,
+    ignore: ["node_modules/**", "dist/**", ".next/**", "build/**"]
+  });
+  const discovered = [];
+  for (const file of files) {
+    try {
+      const code = fs.readFileSync(file, "utf-8");
+      const ast = parse(code, {
+        sourceType: "module",
+        plugins: ["typescript", "jsx"]
+      });
+      traverse(ast, {
+        MemberExpression(path) {
+          const node = path.node;
+          if (node.object.type === "MemberExpression" && node.object.object?.name === "process" && node.object.property?.name === "env" && node.property.type === "Identifier") {
+            discovered.push({
+              key: node.property.name,
+              filePath: file,
+              line: node.loc?.start.line || 0
+            });
+          }
+          if (node.object.type === "MemberExpression" && node.object.object?.type === "MetaProperty" && node.object.property?.name === "env" && node.property.type === "Identifier") {
+            discovered.push({
+              key: node.property.name,
+              filePath: file,
+              line: node.loc?.start.line || 0
+            });
+          }
+        }
+      });
+    } catch {
+    }
+  }
+  return discovered;
+}
+
+// src/envParser.ts
+import fs2 from "fs";
+import dotenv from "dotenv";
+var SECRET_PATTERNS = [
+  /sk_live_[0-9a-zA-Z]{24,}/,
+  /AKIA[0-9A-Z]{16}/,
+  /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9/,
+  /-----BEGIN PRIVATE KEY-----/
+];
+function parseEnvFile(envPath = ".env") {
+  const map = /* @__PURE__ */ new Map();
+  if (!fs2.existsSync(envPath)) return map;
+  const content = fs2.readFileSync(envPath, "utf-8");
+  const parsed = dotenv.parse(content);
+  for (const [key, value] of Object.entries(parsed)) {
+    const isSecret = SECRET_PATTERNS.some((pattern) => pattern.test(value));
+    map.set(key, { key, value, isPotentialSecret: isSecret });
+  }
+  return map;
+}
+
+export {
+  scanCodebase,
+  parseEnvFile
+};
+//# sourceMappingURL=chunk-636KQXX3.js.map

package/dist/chunk-636KQXX3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/scanner.ts","../src/envParser.ts"],"sourcesContent":["import fs from 'node:fs';\nimport {glob}from 'glob';\nimport { parse } from '@babel/parser';\nimport traverseModule from '@babel/traverse';\n\nconst traverse = (traverseModule as any).default || traverseModule;\n\nexport interface DiscoveredKey {\n  key: string;\n  filePath: string;\n  line: number;\n}\n\nexport function scanCodebase(rootDir = '.'): DiscoveredKey[] {\n  const files = glob.sync('**/*.{js,jsx,ts,tsx}', {\n    cwd: rootDir,\n    ignore: ['node_modules/**', 'dist/**', '.next/**', 'build/**'],\n  });\n\n  const discovered: DiscoveredKey[] = [];\n\n  for (const file of files) {\n    try {\n      const code = fs.readFileSync(file, 'utf-8');\n      const ast = parse(code, {\n        sourceType: 'module',\n        plugins: ['typescript', 'jsx'],\n      });\n\n      traverse(ast, {\n        MemberExpression(path: any) {\n          const node = path.node;\n          // Detect process.env.KEY\n          if (\n            node.object.type === 'MemberExpression' &&\n            node.object.object?.name === 'process' &&\n            node.object.property?.name === 'env' &&\n            node.property.type === 'Identifier'\n          ) {\n            discovered.push({\n              key: node.property.name,\n              filePath: file,\n              line: node.loc?.start.line || 0,\n            });\n          }\n          // Detect import.meta.env.KEY\n          if (\n            node.object.type === 'MemberExpression' &&\n            node.object.object?.type === 'MetaProperty' &&\n            node.object.property?.name === 'env' &&\n            node.property.type === 'Identifier'\n          ) {\n            discovered.push({\n              key: node.property.name,\n              filePath: file,\n              line: node.loc?.start.line || 0,\n            });\n          }\n        },\n      });\n    } catch {\n      // Ignore unparseable or non-JS files\n    }\n  }\n\n  return discovered;\n}","import fs from 'node:fs';\nimport dotenv from 'dotenv';\n\nexport interface EnvVariable {\n  key: string;\n  value: string;\n  isPotentialSecret: boolean;\n}\n\n// High-risk pattern detector (Stripe, AWS, JWT, generic private keys)\nconst SECRET_PATTERNS = [\n  /sk_live_[0-9a-zA-Z]{24,}/,\n  /AKIA[0-9A-Z]{16}/,\n  /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9/,\n  /-----BEGIN PRIVATE KEY-----/,\n];\n\nexport function parseEnvFile(envPath = '.env'): Map<string, EnvVariable> {\n  const map = new Map<string, EnvVariable>();\n  if (!fs.existsSync(envPath)) return map;\n\n  const content = fs.readFileSync(envPath, 'utf-8');\n  const parsed = dotenv.parse(content);\n\n  for (const [key, value] of Object.entries(parsed)) {\n    const isSecret = SECRET_PATTERNS.some((pattern) => pattern.test(value));\n    map.set(key, { key, value, isPotentialSecret: isSecret });\n  }\n\n  return map;\n}"],"mappings":";AAAA,OAAO,QAAQ;AACf,SAAQ,YAAU;AAClB,SAAS,aAAa;AACtB,OAAO,oBAAoB;AAE3B,IAAM,WAAY,eAAuB,WAAW;AAQ7C,SAAS,aAAa,UAAU,KAAsB;AAC3D,QAAM,QAAQ,KAAK,KAAK,wBAAwB;AAAA,IAC9C,KAAK;AAAA,IACL,QAAQ,CAAC,mBAAmB,WAAW,YAAY,UAAU;AAAA,EAC/D,CAAC;AAED,QAAM,aAA8B,CAAC;AAErC,aAAW,QAAQ,OAAO;AACxB,QAAI;AACF,YAAM,OAAO,GAAG,aAAa,MAAM,OAAO;AAC1C,YAAM,MAAM,MAAM,MAAM;AAAA,QACtB,YAAY;AAAA,QACZ,SAAS,CAAC,cAAc,KAAK;AAAA,MAC/B,CAAC;AAED,eAAS,KAAK;AAAA,QACZ,iBAAiB,MAAW;AAC1B,gBAAM,OAAO,KAAK;AAElB,cACE,KAAK,OAAO,SAAS,sBACrB,KAAK,OAAO,QAAQ,SAAS,aAC7B,KAAK,OAAO,UAAU,SAAS,SAC/B,KAAK,SAAS,SAAS,cACvB;AACA,uBAAW,KAAK;AAAA,cACd,KAAK,KAAK,SAAS;AAAA,cACnB,UAAU;AAAA,cACV,MAAM,KAAK,KAAK,MAAM,QAAQ;AAAA,YAChC,CAAC;AAAA,UACH;AAEA,cACE,KAAK,OAAO,SAAS,sBACrB,KAAK,OAAO,QAAQ,SAAS,kBAC7B,KAAK,OAAO,UAAU,SAAS,SAC/B,KAAK,SAAS,SAAS,cACvB;AACA,uBAAW,KAAK;AAAA,cACd,KAAK,KAAK,SAAS;AAAA,cACnB,UAAU;AAAA,cACV,MAAM,KAAK,KAAK,MAAM,QAAQ;AAAA,YAChC,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO;AACT;;;AClEA,OAAOA,SAAQ;AACf,OAAO,YAAY;AASnB,IAAM,kBAAkB;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,aAAa,UAAU,QAAkC;AACvE,QAAM,MAAM,oBAAI,IAAyB;AACzC,MAAI,CAACA,IAAG,WAAW,OAAO,EAAG,QAAO;AAEpC,QAAM,UAAUA,IAAG,aAAa,SAAS,OAAO;AAChD,QAAM,SAAS,OAAO,MAAM,OAAO;AAEnC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,UAAM,WAAW,gBAAgB,KAAK,CAAC,YAAY,QAAQ,KAAK,KAAK,CAAC;AACtE,QAAI,IAAI,KAAK,EAAE,KAAK,OAAO,mBAAmB,SAAS,CAAC;AAAA,EAC1D;AAEA,SAAO;AACT;","names":["fs"]}

package/dist/cli.cjs

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/cli.ts
+var import_commander = require("commander");
+var import_picocolors = __toESM(require("picocolors"), 1);
+
+// src/scanner.ts
+var import_node_fs = __toESM(require("fs"), 1);
+var import_glob = require("glob");
+var import_parser = require("@babel/parser");
+var import_traverse = __toESM(require("@babel/traverse"), 1);
+var traverse = import_traverse.default.default || import_traverse.default;
+function scanCodebase(rootDir = ".") {
+  const files = import_glob.glob.sync("**/*.{js,jsx,ts,tsx}", {
+    cwd: rootDir,
+    ignore: ["node_modules/**", "dist/**", ".next/**", "build/**"]
+  });
+  const discovered = [];
+  for (const file of files) {
+    try {
+      const code = import_node_fs.default.readFileSync(file, "utf-8");
+      const ast = (0, import_parser.parse)(code, {
+        sourceType: "module",
+        plugins: ["typescript", "jsx"]
+      });
+      traverse(ast, {
+        MemberExpression(path) {
+          const node = path.node;
+          if (node.object.type === "MemberExpression" && node.object.object?.name === "process" && node.object.property?.name === "env" && node.property.type === "Identifier") {
+            discovered.push({
+              key: node.property.name,
+              filePath: file,
+              line: node.loc?.start.line || 0
+            });
+          }
+          if (node.object.type === "MemberExpression" && node.object.object?.type === "MetaProperty" && node.object.property?.name === "env" && node.property.type === "Identifier") {
+            discovered.push({
+              key: node.property.name,
+              filePath: file,
+              line: node.loc?.start.line || 0
+            });
+          }
+        }
+      });
+    } catch {
+    }
+  }
+  return discovered;
+}
+
+// src/envParser.ts
+var import_node_fs2 = __toESM(require("fs"), 1);
+var import_dotenv = __toESM(require("dotenv"), 1);
+var SECRET_PATTERNS = [
+  /sk_live_[0-9a-zA-Z]{24,}/,
+  /AKIA[0-9A-Z]{16}/,
+  /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9/,
+  /-----BEGIN PRIVATE KEY-----/
+];
+function parseEnvFile(envPath = ".env") {
+  const map = /* @__PURE__ */ new Map();
+  if (!import_node_fs2.default.existsSync(envPath)) return map;
+  const content = import_node_fs2.default.readFileSync(envPath, "utf-8");
+  const parsed = import_dotenv.default.parse(content);
+  for (const [key, value] of Object.entries(parsed)) {
+    const isSecret = SECRET_PATTERNS.some((pattern) => pattern.test(value));
+    map.set(key, { key, value, isPotentialSecret: isSecret });
+  }
+  return map;
+}
+
+// src/cli.ts
+var program = new import_commander.Command();
+program.name("env-guardrail").description("Audit environment variables against codebase usage").version("0.1.0");
+program.command("check").option("-e, --env <path>", "Path to target .env file", ".env").action((options) => {
+  console.log(import_picocolors.default.cyan("\n\u{1F50D} Scanning codebase for environment variables...\n"));
+  const codeUsage = scanCodebase(".");
+  const envVariables = parseEnvFile(options.env);
+  const usedKeys = new Set(codeUsage.map((u) => u.key));
+  let errorCount = 0;
+  let warningCount = 0;
+  for (const usage of codeUsage) {
+    if (!envVariables.has(usage.key)) {
+      console.log(
+        `${import_picocolors.default.red("\u2716 MISSING KEY")}  ${import_picocolors.default.bold(usage.key)}
+               Found in: ${import_picocolors.default.dim(`${usage.filePath}:${usage.line}`)}
+               Action: Define this variable in ${options.env}
+`
+      );
+      errorCount++;
+    }
+  }
+  for (const [key] of envVariables.entries()) {
+    if (!usedKeys.has(key)) {
+      console.log(
+        `${import_picocolors.default.yellow("\u26A0 UNUSED KEY")}   ${import_picocolors.default.bold(key)}
+               Defined in: ${import_picocolors.default.dim(options.env)}
+               Action: No references found in codebase.
+`
+      );
+      warningCount++;
+    }
+  }
+  for (const [key, variable] of envVariables.entries()) {
+    if (variable.isPotentialSecret) {
+      console.log(
+        `${import_picocolors.default.red("\u2716 SECRET LEAK")}  ${import_picocolors.default.bold(key)}
+               Defined in: ${import_picocolors.default.dim(options.env)}
+               Action: Value looks like an unmasked production secret key.
+`
+      );
+      errorCount++;
+    }
+  }
+  console.log(import_picocolors.default.dim("--------------------------------------------------"));
+  if (errorCount === 0 && warningCount === 0) {
+    console.log(import_picocolors.default.green("\u2714 All environment variables are consistent! No leaks detected.\n"));
+    process.exit(0);
+  } else {
+    console.log(
+      `Result: ${import_picocolors.default.red(`${errorCount} error(s)`)}, ${import_picocolors.default.yellow(`${warningCount} warning(s)`)}
+`
+    );
+    if (errorCount > 0) process.exit(1);
+  }
+});
+program.parse(process.argv);
+//# sourceMappingURL=cli.cjs.map

package/dist/cli.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli.ts","../src/scanner.ts","../src/envParser.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { Command } from 'commander';\nimport pc from 'picocolors';\nimport { scanCodebase } from './scanner.js';\nimport { parseEnvFile } from './envParser.js';\n\nconst program = new Command();\n\nprogram\n  .name('env-guardrail')\n  .description('Audit environment variables against codebase usage')\n  .version('0.1.0');\n\nprogram\n  .command('check')\n  .option('-e, --env <path>', 'Path to target .env file', '.env')\n  .action((options) => {\n    console.log(pc.cyan('\\n🔍 Scanning codebase for environment variables...\\n'));\n\n    const codeUsage = scanCodebase('.');\n    const envVariables = parseEnvFile(options.env);\n\n    const usedKeys = new Set(codeUsage.map((u) => u.key));\n    let errorCount = 0;\n    let warningCount = 0;\n\n    // 1. Check for Missing Variables\n    for (const usage of codeUsage) {\n      if (!envVariables.has(usage.key)) {\n        console.log(\n          `${pc.red('✖ MISSING KEY')}  ${pc.bold(usage.key)}\\n` +\n          `               Found in: ${pc.dim(`${usage.filePath}:${usage.line}`)}\\n` +\n          `               Action: Define this variable in ${options.env}\\n`\n        );\n        errorCount++;\n      }\n    }\n\n    // 2. Check for Unused Variables\n    for (const [key] of envVariables.entries()) {\n      if (!usedKeys.has(key)) {\n        console.log(\n          `${pc.yellow('⚠ UNUSED KEY')}   ${pc.bold(key)}\\n` +\n          `               Defined in: ${pc.dim(options.env)}\\n` +\n          `               Action: No references found in codebase.\\n`\n        );\n        warningCount++;\n      }\n    }\n\n    // 3. Check for Secret Leaks\n    for (const [key, variable] of envVariables.entries()) {\n      if (variable.isPotentialSecret) {\n        console.log(\n          `${pc.red('✖ SECRET LEAK')}  ${pc.bold(key)}\\n` +\n          `               Defined in: ${pc.dim(options.env)}\\n` +\n          `               Action: Value looks like an unmasked production secret key.\\n`\n        );\n        errorCount++;\n      }\n    }\n\n    // Summary output\n    console.log(pc.dim('--------------------------------------------------'));\n    if (errorCount === 0 && warningCount === 0) {\n      console.log(pc.green('✔ All environment variables are consistent! No leaks detected.\\n'));\n      process.exit(0);\n    } else {\n      console.log(\n        `Result: ${pc.red(`${errorCount} error(s)`)}, ${pc.yellow(`${warningCount} warning(s)`)}\\n`\n      );\n      if (errorCount > 0) process.exit(1);\n    }\n  });\n\nprogram.parse(process.argv);","import fs from 'node:fs';\nimport {glob}from 'glob';\nimport { parse } from '@babel/parser';\nimport traverseModule from '@babel/traverse';\n\nconst traverse = (traverseModule as any).default || traverseModule;\n\nexport interface DiscoveredKey {\n  key: string;\n  filePath: string;\n  line: number;\n}\n\nexport function scanCodebase(rootDir = '.'): DiscoveredKey[] {\n  const files = glob.sync('**/*.{js,jsx,ts,tsx}', {\n    cwd: rootDir,\n    ignore: ['node_modules/**', 'dist/**', '.next/**', 'build/**'],\n  });\n\n  const discovered: DiscoveredKey[] = [];\n\n  for (const file of files) {\n    try {\n      const code = fs.readFileSync(file, 'utf-8');\n      const ast = parse(code, {\n        sourceType: 'module',\n        plugins: ['typescript', 'jsx'],\n      });\n\n      traverse(ast, {\n        MemberExpression(path: any) {\n          const node = path.node;\n          // Detect process.env.KEY\n          if (\n            node.object.type === 'MemberExpression' &&\n            node.object.object?.name === 'process' &&\n            node.object.property?.name === 'env' &&\n            node.property.type === 'Identifier'\n          ) {\n            discovered.push({\n              key: node.property.name,\n              filePath: file,\n              line: node.loc?.start.line || 0,\n            });\n          }\n          // Detect import.meta.env.KEY\n          if (\n            node.object.type === 'MemberExpression' &&\n            node.object.object?.type === 'MetaProperty' &&\n            node.object.property?.name === 'env' &&\n            node.property.type === 'Identifier'\n          ) {\n            discovered.push({\n              key: node.property.name,\n              filePath: file,\n              line: node.loc?.start.line || 0,\n            });\n          }\n        },\n      });\n    } catch {\n      // Ignore unparseable or non-JS files\n    }\n  }\n\n  return discovered;\n}","import fs from 'node:fs';\nimport dotenv from 'dotenv';\n\nexport interface EnvVariable {\n  key: string;\n  value: string;\n  isPotentialSecret: boolean;\n}\n\n// High-risk pattern detector (Stripe, AWS, JWT, generic private keys)\nconst SECRET_PATTERNS = [\n  /sk_live_[0-9a-zA-Z]{24,}/,\n  /AKIA[0-9A-Z]{16}/,\n  /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9/,\n  /-----BEGIN PRIVATE KEY-----/,\n];\n\nexport function parseEnvFile(envPath = '.env'): Map<string, EnvVariable> {\n  const map = new Map<string, EnvVariable>();\n  if (!fs.existsSync(envPath)) return map;\n\n  const content = fs.readFileSync(envPath, 'utf-8');\n  const parsed = dotenv.parse(content);\n\n  for (const [key, value] of Object.entries(parsed)) {\n    const isSecret = SECRET_PATTERNS.some((pattern) => pattern.test(value));\n    map.set(key, { key, value, isPotentialSecret: isSecret });\n  }\n\n  return map;\n}"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AACA,uBAAwB;AACxB,wBAAe;;;ACFf,qBAAe;AACf,kBAAkB;AAClB,oBAAsB;AACtB,sBAA2B;AAE3B,IAAM,WAAY,gBAAAA,QAAuB,WAAW,gBAAAA;AAQ7C,SAAS,aAAa,UAAU,KAAsB;AAC3D,QAAM,QAAQ,iBAAK,KAAK,wBAAwB;AAAA,IAC9C,KAAK;AAAA,IACL,QAAQ,CAAC,mBAAmB,WAAW,YAAY,UAAU;AAAA,EAC/D,CAAC;AAED,QAAM,aAA8B,CAAC;AAErC,aAAW,QAAQ,OAAO;AACxB,QAAI;AACF,YAAM,OAAO,eAAAC,QAAG,aAAa,MAAM,OAAO;AAC1C,YAAM,UAAM,qBAAM,MAAM;AAAA,QACtB,YAAY;AAAA,QACZ,SAAS,CAAC,cAAc,KAAK;AAAA,MAC/B,CAAC;AAED,eAAS,KAAK;AAAA,QACZ,iBAAiB,MAAW;AAC1B,gBAAM,OAAO,KAAK;AAElB,cACE,KAAK,OAAO,SAAS,sBACrB,KAAK,OAAO,QAAQ,SAAS,aAC7B,KAAK,OAAO,UAAU,SAAS,SAC/B,KAAK,SAAS,SAAS,cACvB;AACA,uBAAW,KAAK;AAAA,cACd,KAAK,KAAK,SAAS;AAAA,cACnB,UAAU;AAAA,cACV,MAAM,KAAK,KAAK,MAAM,QAAQ;AAAA,YAChC,CAAC;AAAA,UACH;AAEA,cACE,KAAK,OAAO,SAAS,sBACrB,KAAK,OAAO,QAAQ,SAAS,kBAC7B,KAAK,OAAO,UAAU,SAAS,SAC/B,KAAK,SAAS,SAAS,cACvB;AACA,uBAAW,KAAK;AAAA,cACd,KAAK,KAAK,SAAS;AAAA,cACnB,UAAU;AAAA,cACV,MAAM,KAAK,KAAK,MAAM,QAAQ;AAAA,YAChC,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO;AACT;;;AClEA,IAAAC,kBAAe;AACf,oBAAmB;AASnB,IAAM,kBAAkB;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,aAAa,UAAU,QAAkC;AACvE,QAAM,MAAM,oBAAI,IAAyB;AACzC,MAAI,CAAC,gBAAAC,QAAG,WAAW,OAAO,EAAG,QAAO;AAEpC,QAAM,UAAU,gBAAAA,QAAG,aAAa,SAAS,OAAO;AAChD,QAAM,SAAS,cAAAC,QAAO,MAAM,OAAO;AAEnC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,UAAM,WAAW,gBAAgB,KAAK,CAAC,YAAY,QAAQ,KAAK,KAAK,CAAC;AACtE,QAAI,IAAI,KAAK,EAAE,KAAK,OAAO,mBAAmB,SAAS,CAAC;AAAA,EAC1D;AAEA,SAAO;AACT;;;AFxBA,IAAM,UAAU,IAAI,yBAAQ;AAE5B,QACG,KAAK,eAAe,EACpB,YAAY,oDAAoD,EAChE,QAAQ,OAAO;AAElB,QACG,QAAQ,OAAO,EACf,OAAO,oBAAoB,4BAA4B,MAAM,EAC7D,OAAO,CAAC,YAAY;AACnB,UAAQ,IAAI,kBAAAC,QAAG,KAAK,8DAAuD,CAAC;AAE5E,QAAM,YAAY,aAAa,GAAG;AAClC,QAAM,eAAe,aAAa,QAAQ,GAAG;AAE7C,QAAM,WAAW,IAAI,IAAI,UAAU,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;AACpD,MAAI,aAAa;AACjB,MAAI,eAAe;AAGnB,aAAW,SAAS,WAAW;AAC7B,QAAI,CAAC,aAAa,IAAI,MAAM,GAAG,GAAG;AAChC,cAAQ;AAAA,QACN,GAAG,kBAAAA,QAAG,IAAI,oBAAe,CAAC,KAAK,kBAAAA,QAAG,KAAK,MAAM,GAAG,CAAC;AAAA,2BACrB,kBAAAA,QAAG,IAAI,GAAG,MAAM,QAAQ,IAAI,MAAM,IAAI,EAAE,CAAC;AAAA,iDACnB,QAAQ,GAAG;AAAA;AAAA,MAC/D;AACA;AAAA,IACF;AAAA,EACF;AAGA,aAAW,CAAC,GAAG,KAAK,aAAa,QAAQ,GAAG;AAC1C,QAAI,CAAC,SAAS,IAAI,GAAG,GAAG;AACtB,cAAQ;AAAA,QACN,GAAG,kBAAAA,QAAG,OAAO,mBAAc,CAAC,MAAM,kBAAAA,QAAG,KAAK,GAAG,CAAC;AAAA,6BAChB,kBAAAA,QAAG,IAAI,QAAQ,GAAG,CAAC;AAAA;AAAA;AAAA,MAEnD;AACA;AAAA,IACF;AAAA,EACF;AAGA,aAAW,CAAC,KAAK,QAAQ,KAAK,aAAa,QAAQ,GAAG;AACpD,QAAI,SAAS,mBAAmB;AAC9B,cAAQ;AAAA,QACN,GAAG,kBAAAA,QAAG,IAAI,oBAAe,CAAC,KAAK,kBAAAA,QAAG,KAAK,GAAG,CAAC;AAAA,6BACb,kBAAAA,QAAG,IAAI,QAAQ,GAAG,CAAC;AAAA;AAAA;AAAA,MAEnD;AACA;AAAA,IACF;AAAA,EACF;AAGA,UAAQ,IAAI,kBAAAA,QAAG,IAAI,oDAAoD,CAAC;AACxE,MAAI,eAAe,KAAK,iBAAiB,GAAG;AAC1C,YAAQ,IAAI,kBAAAA,QAAG,MAAM,uEAAkE,CAAC;AACxF,YAAQ,KAAK,CAAC;AAAA,EAChB,OAAO;AACL,YAAQ;AAAA,MACN,WAAW,kBAAAA,QAAG,IAAI,GAAG,UAAU,WAAW,CAAC,KAAK,kBAAAA,QAAG,OAAO,GAAG,YAAY,aAAa,CAAC;AAAA;AAAA,IACzF;AACA,QAAI,aAAa,EAAG,SAAQ,KAAK,CAAC;AAAA,EACpC;AACF,CAAC;AAEH,QAAQ,MAAM,QAAQ,IAAI;","names":["traverseModule","fs","import_node_fs","fs","dotenv","pc"]}

package/dist/cli.d.cts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/cli.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/cli.js

@@ -0,0 +1,65 @@
+#!/usr/bin/env node
+import {
+  parseEnvFile,
+  scanCodebase
+} from "./chunk-636KQXX3.js";
+
+// src/cli.ts
+import { Command } from "commander";
+import pc from "picocolors";
+var program = new Command();
+program.name("env-guardrail").description("Audit environment variables against codebase usage").version("0.1.0");
+program.command("check").option("-e, --env <path>", "Path to target .env file", ".env").action((options) => {
+  console.log(pc.cyan("\n\u{1F50D} Scanning codebase for environment variables...\n"));
+  const codeUsage = scanCodebase(".");
+  const envVariables = parseEnvFile(options.env);
+  const usedKeys = new Set(codeUsage.map((u) => u.key));
+  let errorCount = 0;
+  let warningCount = 0;
+  for (const usage of codeUsage) {
+    if (!envVariables.has(usage.key)) {
+      console.log(
+        `${pc.red("\u2716 MISSING KEY")}  ${pc.bold(usage.key)}
+               Found in: ${pc.dim(`${usage.filePath}:${usage.line}`)}
+               Action: Define this variable in ${options.env}
+`
+      );
+      errorCount++;
+    }
+  }
+  for (const [key] of envVariables.entries()) {
+    if (!usedKeys.has(key)) {
+      console.log(
+        `${pc.yellow("\u26A0 UNUSED KEY")}   ${pc.bold(key)}
+               Defined in: ${pc.dim(options.env)}
+               Action: No references found in codebase.
+`
+      );
+      warningCount++;
+    }
+  }
+  for (const [key, variable] of envVariables.entries()) {
+    if (variable.isPotentialSecret) {
+      console.log(
+        `${pc.red("\u2716 SECRET LEAK")}  ${pc.bold(key)}
+               Defined in: ${pc.dim(options.env)}
+               Action: Value looks like an unmasked production secret key.
+`
+      );
+      errorCount++;
+    }
+  }
+  console.log(pc.dim("--------------------------------------------------"));
+  if (errorCount === 0 && warningCount === 0) {
+    console.log(pc.green("\u2714 All environment variables are consistent! No leaks detected.\n"));
+    process.exit(0);
+  } else {
+    console.log(
+      `Result: ${pc.red(`${errorCount} error(s)`)}, ${pc.yellow(`${warningCount} warning(s)`)}
+`
+    );
+    if (errorCount > 0) process.exit(1);
+  }
+});
+program.parse(process.argv);
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { Command } from 'commander';\nimport pc from 'picocolors';\nimport { scanCodebase } from './scanner.js';\nimport { parseEnvFile } from './envParser.js';\n\nconst program = new Command();\n\nprogram\n  .name('env-guardrail')\n  .description('Audit environment variables against codebase usage')\n  .version('0.1.0');\n\nprogram\n  .command('check')\n  .option('-e, --env <path>', 'Path to target .env file', '.env')\n  .action((options) => {\n    console.log(pc.cyan('\\n🔍 Scanning codebase for environment variables...\\n'));\n\n    const codeUsage = scanCodebase('.');\n    const envVariables = parseEnvFile(options.env);\n\n    const usedKeys = new Set(codeUsage.map((u) => u.key));\n    let errorCount = 0;\n    let warningCount = 0;\n\n    // 1. Check for Missing Variables\n    for (const usage of codeUsage) {\n      if (!envVariables.has(usage.key)) {\n        console.log(\n          `${pc.red('✖ MISSING KEY')}  ${pc.bold(usage.key)}\\n` +\n          `               Found in: ${pc.dim(`${usage.filePath}:${usage.line}`)}\\n` +\n          `               Action: Define this variable in ${options.env}\\n`\n        );\n        errorCount++;\n      }\n    }\n\n    // 2. Check for Unused Variables\n    for (const [key] of envVariables.entries()) {\n      if (!usedKeys.has(key)) {\n        console.log(\n          `${pc.yellow('⚠ UNUSED KEY')}   ${pc.bold(key)}\\n` +\n          `               Defined in: ${pc.dim(options.env)}\\n` +\n          `               Action: No references found in codebase.\\n`\n        );\n        warningCount++;\n      }\n    }\n\n    // 3. Check for Secret Leaks\n    for (const [key, variable] of envVariables.entries()) {\n      if (variable.isPotentialSecret) {\n        console.log(\n          `${pc.red('✖ SECRET LEAK')}  ${pc.bold(key)}\\n` +\n          `               Defined in: ${pc.dim(options.env)}\\n` +\n          `               Action: Value looks like an unmasked production secret key.\\n`\n        );\n        errorCount++;\n      }\n    }\n\n    // Summary output\n    console.log(pc.dim('--------------------------------------------------'));\n    if (errorCount === 0 && warningCount === 0) {\n      console.log(pc.green('✔ All environment variables are consistent! No leaks detected.\\n'));\n      process.exit(0);\n    } else {\n      console.log(\n        `Result: ${pc.red(`${errorCount} error(s)`)}, ${pc.yellow(`${warningCount} warning(s)`)}\\n`\n      );\n      if (errorCount > 0) process.exit(1);\n    }\n  });\n\nprogram.parse(process.argv);"],"mappings":";;;;;;;AACA,SAAS,eAAe;AACxB,OAAO,QAAQ;AAIf,IAAM,UAAU,IAAI,QAAQ;AAE5B,QACG,KAAK,eAAe,EACpB,YAAY,oDAAoD,EAChE,QAAQ,OAAO;AAElB,QACG,QAAQ,OAAO,EACf,OAAO,oBAAoB,4BAA4B,MAAM,EAC7D,OAAO,CAAC,YAAY;AACnB,UAAQ,IAAI,GAAG,KAAK,8DAAuD,CAAC;AAE5E,QAAM,YAAY,aAAa,GAAG;AAClC,QAAM,eAAe,aAAa,QAAQ,GAAG;AAE7C,QAAM,WAAW,IAAI,IAAI,UAAU,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;AACpD,MAAI,aAAa;AACjB,MAAI,eAAe;AAGnB,aAAW,SAAS,WAAW;AAC7B,QAAI,CAAC,aAAa,IAAI,MAAM,GAAG,GAAG;AAChC,cAAQ;AAAA,QACN,GAAG,GAAG,IAAI,oBAAe,CAAC,KAAK,GAAG,KAAK,MAAM,GAAG,CAAC;AAAA,2BACrB,GAAG,IAAI,GAAG,MAAM,QAAQ,IAAI,MAAM,IAAI,EAAE,CAAC;AAAA,iDACnB,QAAQ,GAAG;AAAA;AAAA,MAC/D;AACA;AAAA,IACF;AAAA,EACF;AAGA,aAAW,CAAC,GAAG,KAAK,aAAa,QAAQ,GAAG;AAC1C,QAAI,CAAC,SAAS,IAAI,GAAG,GAAG;AACtB,cAAQ;AAAA,QACN,GAAG,GAAG,OAAO,mBAAc,CAAC,MAAM,GAAG,KAAK,GAAG,CAAC;AAAA,6BAChB,GAAG,IAAI,QAAQ,GAAG,CAAC;AAAA;AAAA;AAAA,MAEnD;AACA;AAAA,IACF;AAAA,EACF;AAGA,aAAW,CAAC,KAAK,QAAQ,KAAK,aAAa,QAAQ,GAAG;AACpD,QAAI,SAAS,mBAAmB;AAC9B,cAAQ;AAAA,QACN,GAAG,GAAG,IAAI,oBAAe,CAAC,KAAK,GAAG,KAAK,GAAG,CAAC;AAAA,6BACb,GAAG,IAAI,QAAQ,GAAG,CAAC;AAAA;AAAA;AAAA,MAEnD;AACA;AAAA,IACF;AAAA,EACF;AAGA,UAAQ,IAAI,GAAG,IAAI,oDAAoD,CAAC;AACxE,MAAI,eAAe,KAAK,iBAAiB,GAAG;AAC1C,YAAQ,IAAI,GAAG,MAAM,uEAAkE,CAAC;AACxF,YAAQ,KAAK,CAAC;AAAA,EAChB,OAAO;AACL,YAAQ;AAAA,MACN,WAAW,GAAG,IAAI,GAAG,UAAU,WAAW,CAAC,KAAK,GAAG,OAAO,GAAG,YAAY,aAAa,CAAC;AAAA;AAAA,IACzF;AACA,QAAI,aAAa,EAAG,SAAQ,KAAK,CAAC;AAAA,EACpC;AACF,CAAC;AAEH,QAAQ,MAAM,QAAQ,IAAI;","names":[]}

package/dist/index.cjs

@@ -0,0 +1,123 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  auditEnv: () => auditEnv
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/scanner.ts
+var import_node_fs = __toESM(require("fs"), 1);
+var import_glob = require("glob");
+var import_parser = require("@babel/parser");
+var import_traverse = __toESM(require("@babel/traverse"), 1);
+var traverse = import_traverse.default.default || import_traverse.default;
+function scanCodebase(rootDir = ".") {
+  const files = import_glob.glob.sync("**/*.{js,jsx,ts,tsx}", {
+    cwd: rootDir,
+    ignore: ["node_modules/**", "dist/**", ".next/**", "build/**"]
+  });
+  const discovered = [];
+  for (const file of files) {
+    try {
+      const code = import_node_fs.default.readFileSync(file, "utf-8");
+      const ast = (0, import_parser.parse)(code, {
+        sourceType: "module",
+        plugins: ["typescript", "jsx"]
+      });
+      traverse(ast, {
+        MemberExpression(path) {
+          const node = path.node;
+          if (node.object.type === "MemberExpression" && node.object.object?.name === "process" && node.object.property?.name === "env" && node.property.type === "Identifier") {
+            discovered.push({
+              key: node.property.name,
+              filePath: file,
+              line: node.loc?.start.line || 0
+            });
+          }
+          if (node.object.type === "MemberExpression" && node.object.object?.type === "MetaProperty" && node.object.property?.name === "env" && node.property.type === "Identifier") {
+            discovered.push({
+              key: node.property.name,
+              filePath: file,
+              line: node.loc?.start.line || 0
+            });
+          }
+        }
+      });
+    } catch {
+    }
+  }
+  return discovered;
+}
+
+// src/envParser.ts
+var import_node_fs2 = __toESM(require("fs"), 1);
+var import_dotenv = __toESM(require("dotenv"), 1);
+var SECRET_PATTERNS = [
+  /sk_live_[0-9a-zA-Z]{24,}/,
+  /AKIA[0-9A-Z]{16}/,
+  /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9/,
+  /-----BEGIN PRIVATE KEY-----/
+];
+function parseEnvFile(envPath = ".env") {
+  const map = /* @__PURE__ */ new Map();
+  if (!import_node_fs2.default.existsSync(envPath)) return map;
+  const content = import_node_fs2.default.readFileSync(envPath, "utf-8");
+  const parsed = import_dotenv.default.parse(content);
+  for (const [key, value] of Object.entries(parsed)) {
+    const isSecret = SECRET_PATTERNS.some((pattern) => pattern.test(value));
+    map.set(key, { key, value, isPotentialSecret: isSecret });
+  }
+  return map;
+}
+
+// src/index.ts
+function auditEnv(options = {}) {
+  const rootDir = options.rootDir || ".";
+  const envPath = options.envPath || ".env";
+  const usages = scanCodebase(rootDir);
+  const envMap = parseEnvFile(envPath);
+  const usedKeyNames = new Set(usages.map((u) => u.key));
+  const missingKeys = usages.filter((usage) => !envMap.has(usage.key));
+  const unusedKeys = Array.from(envMap.keys()).filter((key) => !usedKeyNames.has(key));
+  const leakedSecrets = Array.from(envMap.values()).filter((v) => v.isPotentialSecret);
+  return {
+    missingKeys,
+    unusedKeys,
+    leakedSecrets,
+    hasErrors: missingKeys.length > 0 || leakedSecrets.length > 0
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  auditEnv
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/scanner.ts","../src/envParser.ts"],"sourcesContent":[" // src/index.ts\n\n// 1. Mark type-only imports explicitly\nimport type { DiscoveredKey } from './scanner.js';\nimport type { EnvVariable } from './envParser.js';\n\n// 2. Value imports remain standard imports\nimport { scanCodebase } from './scanner.js';\nimport { parseEnvFile } from './envParser.js';\n\nexport interface AuditOptions {\n  rootDir?: string;\n  envPath?: string;\n}\n\nexport interface AuditReport {\n  missingKeys: DiscoveredKey[];\n  unusedKeys: string[];\n  leakedSecrets: EnvVariable[];\n  hasErrors: boolean;\n}\n\nexport function auditEnv(options: AuditOptions = {}): AuditReport {\n  const rootDir = options.rootDir || '.';\n  const envPath = options.envPath || '.env';\n\n  const usages = scanCodebase(rootDir);\n  const envMap = parseEnvFile(envPath);\n\n  const usedKeyNames = new Set(usages.map((u) => u.key));\n\n  const missingKeys = usages.filter((usage) => !envMap.has(usage.key));\n  const unusedKeys = Array.from(envMap.keys()).filter((key) => !usedKeyNames.has(key));\n  const leakedSecrets = Array.from(envMap.values()).filter((v) => v.isPotentialSecret);\n\n  return {\n    missingKeys,\n    unusedKeys,\n    leakedSecrets,\n    hasErrors: missingKeys.length > 0 || leakedSecrets.length > 0,\n  };\n}\n\nexport type { DiscoveredKey, EnvVariable };","import fs from 'node:fs';\nimport {glob}from 'glob';\nimport { parse } from '@babel/parser';\nimport traverseModule from '@babel/traverse';\n\nconst traverse = (traverseModule as any).default || traverseModule;\n\nexport interface DiscoveredKey {\n  key: string;\n  filePath: string;\n  line: number;\n}\n\nexport function scanCodebase(rootDir = '.'): DiscoveredKey[] {\n  const files = glob.sync('**/*.{js,jsx,ts,tsx}', {\n    cwd: rootDir,\n    ignore: ['node_modules/**', 'dist/**', '.next/**', 'build/**'],\n  });\n\n  const discovered: DiscoveredKey[] = [];\n\n  for (const file of files) {\n    try {\n      const code = fs.readFileSync(file, 'utf-8');\n      const ast = parse(code, {\n        sourceType: 'module',\n        plugins: ['typescript', 'jsx'],\n      });\n\n      traverse(ast, {\n        MemberExpression(path: any) {\n          const node = path.node;\n          // Detect process.env.KEY\n          if (\n            node.object.type === 'MemberExpression' &&\n            node.object.object?.name === 'process' &&\n            node.object.property?.name === 'env' &&\n            node.property.type === 'Identifier'\n          ) {\n            discovered.push({\n              key: node.property.name,\n              filePath: file,\n              line: node.loc?.start.line || 0,\n            });\n          }\n          // Detect import.meta.env.KEY\n          if (\n            node.object.type === 'MemberExpression' &&\n            node.object.object?.type === 'MetaProperty' &&\n            node.object.property?.name === 'env' &&\n            node.property.type === 'Identifier'\n          ) {\n            discovered.push({\n              key: node.property.name,\n              filePath: file,\n              line: node.loc?.start.line || 0,\n            });\n          }\n        },\n      });\n    } catch {\n      // Ignore unparseable or non-JS files\n    }\n  }\n\n  return discovered;\n}","import fs from 'node:fs';\nimport dotenv from 'dotenv';\n\nexport interface EnvVariable {\n  key: string;\n  value: string;\n  isPotentialSecret: boolean;\n}\n\n// High-risk pattern detector (Stripe, AWS, JWT, generic private keys)\nconst SECRET_PATTERNS = [\n  /sk_live_[0-9a-zA-Z]{24,}/,\n  /AKIA[0-9A-Z]{16}/,\n  /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9/,\n  /-----BEGIN PRIVATE KEY-----/,\n];\n\nexport function parseEnvFile(envPath = '.env'): Map<string, EnvVariable> {\n  const map = new Map<string, EnvVariable>();\n  if (!fs.existsSync(envPath)) return map;\n\n  const content = fs.readFileSync(envPath, 'utf-8');\n  const parsed = dotenv.parse(content);\n\n  for (const [key, value] of Object.entries(parsed)) {\n    const isSecret = SECRET_PATTERNS.some((pattern) => pattern.test(value));\n    map.set(key, { key, value, isPotentialSecret: isSecret });\n  }\n\n  return map;\n}"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,qBAAe;AACf,kBAAkB;AAClB,oBAAsB;AACtB,sBAA2B;AAE3B,IAAM,WAAY,gBAAAA,QAAuB,WAAW,gBAAAA;AAQ7C,SAAS,aAAa,UAAU,KAAsB;AAC3D,QAAM,QAAQ,iBAAK,KAAK,wBAAwB;AAAA,IAC9C,KAAK;AAAA,IACL,QAAQ,CAAC,mBAAmB,WAAW,YAAY,UAAU;AAAA,EAC/D,CAAC;AAED,QAAM,aAA8B,CAAC;AAErC,aAAW,QAAQ,OAAO;AACxB,QAAI;AACF,YAAM,OAAO,eAAAC,QAAG,aAAa,MAAM,OAAO;AAC1C,YAAM,UAAM,qBAAM,MAAM;AAAA,QACtB,YAAY;AAAA,QACZ,SAAS,CAAC,cAAc,KAAK;AAAA,MAC/B,CAAC;AAED,eAAS,KAAK;AAAA,QACZ,iBAAiB,MAAW;AAC1B,gBAAM,OAAO,KAAK;AAElB,cACE,KAAK,OAAO,SAAS,sBACrB,KAAK,OAAO,QAAQ,SAAS,aAC7B,KAAK,OAAO,UAAU,SAAS,SAC/B,KAAK,SAAS,SAAS,cACvB;AACA,uBAAW,KAAK;AAAA,cACd,KAAK,KAAK,SAAS;AAAA,cACnB,UAAU;AAAA,cACV,MAAM,KAAK,KAAK,MAAM,QAAQ;AAAA,YAChC,CAAC;AAAA,UACH;AAEA,cACE,KAAK,OAAO,SAAS,sBACrB,KAAK,OAAO,QAAQ,SAAS,kBAC7B,KAAK,OAAO,UAAU,SAAS,SAC/B,KAAK,SAAS,SAAS,cACvB;AACA,uBAAW,KAAK;AAAA,cACd,KAAK,KAAK,SAAS;AAAA,cACnB,UAAU;AAAA,cACV,MAAM,KAAK,KAAK,MAAM,QAAQ;AAAA,YAChC,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO;AACT;;;AClEA,IAAAC,kBAAe;AACf,oBAAmB;AASnB,IAAM,kBAAkB;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,aAAa,UAAU,QAAkC;AACvE,QAAM,MAAM,oBAAI,IAAyB;AACzC,MAAI,CAAC,gBAAAC,QAAG,WAAW,OAAO,EAAG,QAAO;AAEpC,QAAM,UAAU,gBAAAA,QAAG,aAAa,SAAS,OAAO;AAChD,QAAM,SAAS,cAAAC,QAAO,MAAM,OAAO;AAEnC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,UAAM,WAAW,gBAAgB,KAAK,CAAC,YAAY,QAAQ,KAAK,KAAK,CAAC;AACtE,QAAI,IAAI,KAAK,EAAE,KAAK,OAAO,mBAAmB,SAAS,CAAC;AAAA,EAC1D;AAEA,SAAO;AACT;;;AFRO,SAAS,SAAS,UAAwB,CAAC,GAAgB;AAChE,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,UAAU,QAAQ,WAAW;AAEnC,QAAM,SAAS,aAAa,OAAO;AACnC,QAAM,SAAS,aAAa,OAAO;AAEnC,QAAM,eAAe,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;AAErD,QAAM,cAAc,OAAO,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,MAAM,GAAG,CAAC;AACnE,QAAM,aAAa,MAAM,KAAK,OAAO,KAAK,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,aAAa,IAAI,GAAG,CAAC;AACnF,QAAM,gBAAgB,MAAM,KAAK,OAAO,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,iBAAiB;AAEnF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,YAAY,SAAS,KAAK,cAAc,SAAS;AAAA,EAC9D;AACF;","names":["traverseModule","fs","import_node_fs","fs","dotenv"]}

package/dist/index.d.cts

@@ -0,0 +1,25 @@
+interface DiscoveredKey {
+    key: string;
+    filePath: string;
+    line: number;
+}
+
+interface EnvVariable {
+    key: string;
+    value: string;
+    isPotentialSecret: boolean;
+}
+
+interface AuditOptions {
+    rootDir?: string;
+    envPath?: string;
+}
+interface AuditReport {
+    missingKeys: DiscoveredKey[];
+    unusedKeys: string[];
+    leakedSecrets: EnvVariable[];
+    hasErrors: boolean;
+}
+declare function auditEnv(options?: AuditOptions): AuditReport;
+
+export { type AuditOptions, type AuditReport, type DiscoveredKey, type EnvVariable, auditEnv };

package/dist/index.d.ts

@@ -0,0 +1,25 @@
+interface DiscoveredKey {
+    key: string;
+    filePath: string;
+    line: number;
+}
+
+interface EnvVariable {
+    key: string;
+    value: string;
+    isPotentialSecret: boolean;
+}
+
+interface AuditOptions {
+    rootDir?: string;
+    envPath?: string;
+}
+interface AuditReport {
+    missingKeys: DiscoveredKey[];
+    unusedKeys: string[];
+    leakedSecrets: EnvVariable[];
+    hasErrors: boolean;
+}
+declare function auditEnv(options?: AuditOptions): AuditReport;
+
+export { type AuditOptions, type AuditReport, type DiscoveredKey, type EnvVariable, auditEnv };

package/dist/index.js

@@ -0,0 +1,26 @@
+import {
+  parseEnvFile,
+  scanCodebase
+} from "./chunk-636KQXX3.js";
+
+// src/index.ts
+function auditEnv(options = {}) {
+  const rootDir = options.rootDir || ".";
+  const envPath = options.envPath || ".env";
+  const usages = scanCodebase(rootDir);
+  const envMap = parseEnvFile(envPath);
+  const usedKeyNames = new Set(usages.map((u) => u.key));
+  const missingKeys = usages.filter((usage) => !envMap.has(usage.key));
+  const unusedKeys = Array.from(envMap.keys()).filter((key) => !usedKeyNames.has(key));
+  const leakedSecrets = Array.from(envMap.values()).filter((v) => v.isPotentialSecret);
+  return {
+    missingKeys,
+    unusedKeys,
+    leakedSecrets,
+    hasErrors: missingKeys.length > 0 || leakedSecrets.length > 0
+  };
+}
+export {
+  auditEnv
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":[" // src/index.ts\n\n// 1. Mark type-only imports explicitly\nimport type { DiscoveredKey } from './scanner.js';\nimport type { EnvVariable } from './envParser.js';\n\n// 2. Value imports remain standard imports\nimport { scanCodebase } from './scanner.js';\nimport { parseEnvFile } from './envParser.js';\n\nexport interface AuditOptions {\n  rootDir?: string;\n  envPath?: string;\n}\n\nexport interface AuditReport {\n  missingKeys: DiscoveredKey[];\n  unusedKeys: string[];\n  leakedSecrets: EnvVariable[];\n  hasErrors: boolean;\n}\n\nexport function auditEnv(options: AuditOptions = {}): AuditReport {\n  const rootDir = options.rootDir || '.';\n  const envPath = options.envPath || '.env';\n\n  const usages = scanCodebase(rootDir);\n  const envMap = parseEnvFile(envPath);\n\n  const usedKeyNames = new Set(usages.map((u) => u.key));\n\n  const missingKeys = usages.filter((usage) => !envMap.has(usage.key));\n  const unusedKeys = Array.from(envMap.keys()).filter((key) => !usedKeyNames.has(key));\n  const leakedSecrets = Array.from(envMap.values()).filter((v) => v.isPotentialSecret);\n\n  return {\n    missingKeys,\n    unusedKeys,\n    leakedSecrets,\n    hasErrors: missingKeys.length > 0 || leakedSecrets.length > 0,\n  };\n}\n\nexport type { DiscoveredKey, EnvVariable };"],"mappings":";;;;;;AAsBO,SAAS,SAAS,UAAwB,CAAC,GAAgB;AAChE,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,UAAU,QAAQ,WAAW;AAEnC,QAAM,SAAS,aAAa,OAAO;AACnC,QAAM,SAAS,aAAa,OAAO;AAEnC,QAAM,eAAe,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;AAErD,QAAM,cAAc,OAAO,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,MAAM,GAAG,CAAC;AACnE,QAAM,aAAa,MAAM,KAAK,OAAO,KAAK,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,aAAa,IAAI,GAAG,CAAC;AACnF,QAAM,gBAAgB,MAAM,KAAK,OAAO,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,iBAAiB;AAEnF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,YAAY,SAAS,KAAK,cAAc,SAAS;AAAA,EAC9D;AACF;","names":[]}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "env-guardrail",
+  "version": "0.1.0",
+  "description": "Audit environment variables against codebase usage to catch missing keys, unused variables, and secret leaks.",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "env-guardrail": "./dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "prepublishOnly": "npm run build"
+  },
+  "devDependencies": {
+    "@types/babel__traverse": "^7.20.5",
+    "@types/node": "^20.11.0",
+    "tsup": "^8.0.0",
+    "typescript": "^5.3.0"
+  },
+  "dependencies": {
+    "@babel/parser": "^7.23.0",
+    "@babel/traverse": "^7.23.0",
+    "commander": "^12.0.0",
+    "dotenv": "^16.4.0",
+    "glob": "^10.3.0",
+    "picocolors": "^1.0.0"
+  }
+}

package/readme.md

@@ -0,0 +1,131 @@
+# env-guardrail 🛡️
+
+> Audit `.env` files against your codebase to catch missing variables, dead keys, and leaked production secrets before committing.
+
+## ⚡ Features
+
+* **AST Codebase Scanning**: Static analysis parsing powered by Babel AST to accurately detect `process.env.VAR` and `import.meta.env.VAR` lookups across JS, JSX, TS, and TSX files.
+
+* **Missing Variable Catching**: Flags environment variables referenced in code but missing from `.env` or `.env.example`.
+
+* **Dead/Unused Key Cleanup**: Identifies orphaned variables declared in `.env` files that have zero references in your codebase.
+
+* **Pre-Commit Secret Leak Prevention**: High-risk pattern scanner flags live production keys (Stripe, AWS, JWTs, RSA keys) inadvertently committed in local configuration files.
+
+* **Zero-Config CLI & Programmatic API**: Use as an automated CLI check in pre-commit hooks/CI, or integrate directly into custom build tools with full TypeScript types.
+
+## 📦 Installation
+
+```
+# Install globally for CLI usage
+npm install -g env-guardrail
+
+# Or install locally in your project
+npm install --save-dev env-guardrail
+
+```
+
+## 🚀 Quick Start
+
+Run a check in any repository root directory containing your source code and `.env` files:
+
+```
+npx env-guardrail check
+
+```
+
+### Example Terminal Output
+
+```
+🔍 Scanning codebase for environment variables...
+
+✖ MISSING KEY  DATABASE_URL
+               Found in: src/db/client.ts:12
+               Action: Define this variable in .env
+
+⚠ UNUSED KEY   OLD_REDIS_PORT
+               Defined in: .env
+               Action: No references found in codebase.
+
+✖ SECRET LEAK  STRIPE_SECRET_KEY
+               Defined in: .env
+               Action: Value looks like an unmasked production secret key.
+
+--------------------------------------------------
+Result: 2 error(s), 1 warning(s)
+
+```
+
+## 🛠️ CLI Options
+
+```
+env-guardrail check [options]
+
+```
+
+| Option | Shorthand | Default | Description | 
+ | ----- | ----- | ----- | ----- | 
+| `--env <path>` | `-e` | `.env` | Path to target environment file to audit | 
+| `--version` | `-v` | — | Display CLI version | 
+| `--help` | `-h` | — | Display help menu | 
+
+## 💻 Programmatic TypeScript API
+
+You can import `env-guardrail` into your Node.js scripts, Vite plugins, or custom test runners:
+
+```
+import { auditEnv } from 'env-guardrail';
+
+const report = auditEnv({
+  rootDir: './src',
+  envPath: '.env.local',
+});
+
+if (report.hasErrors) {
+  console.error('Missing variables:', report.missingKeys);
+  console.error('Potential secret leaks:', report.leakedSecrets);
+  process.exit(1);
+}
+
+```
+
+## 🔄 CI/CD & Git Hook Integration
+
+### 1. Husky Pre-Commit Hook
+
+Prevent committing broken configuration or leaked secrets locally:
+
+```
+npx husky add .husky/pre-commit "npx env-guardrail check"
+
+```
+
+### 2. GitHub Actions
+
+Fail pull requests early if required environment variables are missing from `.env.example`:
+
+```
+name: Audit Environment Configuration
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  env-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - run: npm ci
+      - run: npx env-guardrail check --env .env.example
+
+```
+
+## 📄 License
+
+MIT © Kaustubh Kashyap