envspect 0.1.0

package/dist/cli.js

@@ -0,0 +1,721 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { Command } from "commander";
+
+// src/commands/scan.ts
+import { existsSync as existsSync2 } from "fs";
+import { resolve as resolve2 } from "path";
+import { createSpinner } from "nanospinner";
+
+// src/types/index.ts
+var ExitCode = {
+  SUCCESS: 0,
+  SCAN_ISSUES_FOUND: 1,
+  AUDIT_SECRETS_FOUND: 2,
+  FILE_NOT_FOUND: 3,
+  CONFIG_ERROR: 4,
+  ERROR: 5
+};
+
+// src/core/parser.ts
+import { readFile } from "fs/promises";
+async function parseEnvFile(filePath) {
+  try {
+    const content = await readFile(filePath, "utf8");
+    return parseEnvContent(content, filePath);
+  } catch (error) {
+    throw new Error(`Failed to read file at ${filePath}: ${error.message}`);
+  }
+}
+function parseEnvContent(content, filePath = "unknown") {
+  const entries = [];
+  const errors = [];
+  const lines = content.split(/\r?\n/);
+  let i = 0;
+  while (i < lines.length) {
+    const rawLine = lines[i];
+    const trimmed = rawLine.trim();
+    if (!trimmed) {
+      i++;
+      continue;
+    }
+    if (trimmed.startsWith("#")) {
+      entries.push({
+        key: "",
+        value: "",
+        line: i + 1,
+        isComment: true,
+        comment: trimmed.substring(1).trim(),
+        raw: rawLine
+      });
+      i++;
+      continue;
+    }
+    const matchLine = trimmed.startsWith("export ") ? trimmed.substring(7).trimStart() : trimmed;
+    const eqIdx = matchLine.indexOf("=");
+    if (eqIdx === -1) {
+      errors.push({ line: i + 1, message: 'Malformed line, missing "="', raw: rawLine });
+      i++;
+      continue;
+    }
+    const key = matchLine.substring(0, eqIdx).trim();
+    let valueStr = matchLine.substring(eqIdx + 1).trim();
+    let comment = void 0;
+    if (valueStr.startsWith('"') || valueStr.startsWith("'") || valueStr.startsWith("`")) {
+      const quoteChar = valueStr[0];
+      if (quoteChar === '"' || quoteChar === "`") {
+        let endIndex = valueStr.indexOf(quoteChar, 1);
+        let valueLines = [valueStr];
+        let multilineRaw = [rawLine];
+        let currentLineIdx = i;
+        while (endIndex === -1 && currentLineIdx < lines.length - 1) {
+          currentLineIdx++;
+          const nextLine = lines[currentLineIdx];
+          valueLines.push(nextLine);
+          multilineRaw.push(nextLine);
+          endIndex = nextLine.indexOf(quoteChar);
+        }
+        if (endIndex === -1) {
+          errors.push({ line: i + 1, message: `Unmatched ${quoteChar}`, raw: multilineRaw.join("\n") });
+          i = currentLineIdx + 1;
+          continue;
+        } else {
+          valueStr = valueLines.join("\n");
+          const finalRaw = multilineRaw.join("\n");
+          const extractedValue = valueStr.substring(1, valueStr.lastIndexOf(quoteChar));
+          const afterQuote = valueStr.substring(valueStr.lastIndexOf(quoteChar) + 1).trim();
+          if (afterQuote.startsWith("#")) {
+            comment = afterQuote.substring(1).trim();
+          }
+          entries.push({
+            key,
+            value: extractedValue,
+            line: i + 1,
+            isComment: false,
+            comment,
+            raw: finalRaw
+          });
+          i = currentLineIdx + 1;
+          continue;
+        }
+      } else {
+        const endIndex = valueStr.indexOf(quoteChar, 1);
+        if (endIndex === -1) {
+          errors.push({ line: i + 1, message: "Unmatched single quote", raw: rawLine });
+          i++;
+          continue;
+        }
+        const extractedValue = valueStr.substring(1, endIndex);
+        const afterQuote = valueStr.substring(endIndex + 1).trim();
+        if (afterQuote.startsWith("#")) {
+          comment = afterQuote.substring(1).trim();
+        }
+        entries.push({
+          key,
+          value: extractedValue,
+          line: i + 1,
+          isComment: false,
+          comment,
+          raw: rawLine
+        });
+        i++;
+        continue;
+      }
+    }
+    const hashIdx = valueStr.indexOf("#");
+    let value = valueStr;
+    if (hashIdx !== -1) {
+      value = valueStr.substring(0, hashIdx).trim();
+      comment = valueStr.substring(hashIdx + 1).trim();
+    }
+    entries.push({
+      key,
+      value,
+      line: i + 1,
+      isComment: false,
+      comment,
+      raw: rawLine
+    });
+    i++;
+  }
+  return { entries, filePath, errors };
+}
+
+// src/core/differ.ts
+function diffEnvFiles(source, target, options = {}) {
+  const sourceMap = /* @__PURE__ */ new Map();
+  const targetMap = /* @__PURE__ */ new Map();
+  for (const entry of source) {
+    if (!entry.isComment && entry.key) {
+      sourceMap.set(entry.key, entry);
+    }
+  }
+  for (const entry of target) {
+    if (!entry.isComment && entry.key) {
+      targetMap.set(entry.key, entry);
+    }
+  }
+  const missing = [];
+  const extra = [];
+  const empty = [];
+  let matched = 0;
+  for (const [key, entry] of sourceMap.entries()) {
+    if (!targetMap.has(key)) {
+      missing.push(entry);
+    } else {
+      matched++;
+    }
+  }
+  for (const [key, entry] of targetMap.entries()) {
+    if (!sourceMap.has(key)) {
+      extra.push(entry);
+    }
+    if (entry.value.trim() === "") {
+      empty.push(entry);
+    }
+  }
+  return {
+    missing,
+    extra,
+    empty,
+    matched,
+    sourceFile: "source",
+    targetFile: "target"
+  };
+}
+
+// src/utils/logger.ts
+import pc from "picocolors";
+var log = {
+  /** Informational message */
+  info: (msg) => console.log(pc.cyan("\u2139"), msg),
+  /** Success message */
+  success: (msg) => console.log(pc.green("\u2714"), msg),
+  /** Warning message */
+  warn: (msg) => console.log(pc.yellow("\u26A0"), msg),
+  /** Error message */
+  error: (msg) => console.error(pc.red("\u2716"), msg),
+  /** Debug message (only when ENVSPECT_DEBUG is set) */
+  debug: (msg) => {
+    if (process.env.ENVSPECT_DEBUG) {
+      console.log(pc.gray(`[debug] ${msg}`));
+    }
+  },
+  /** Dim/muted text */
+  dim: (msg) => console.log(pc.dim(msg)),
+  /** Bold header */
+  header: (msg) => console.log(`
+${pc.bold(pc.underline(msg))}
+`),
+  /** Raw console.log (no prefix) */
+  raw: (msg) => console.log(msg),
+  /** Blank line */
+  newline: () => console.log()
+};
+var c = {
+  red: pc.red,
+  green: pc.green,
+  yellow: pc.yellow,
+  cyan: pc.cyan,
+  dim: pc.dim,
+  bold: pc.bold,
+  underline: pc.underline,
+  gray: pc.gray
+};
+
+// src/core/reporter.ts
+function formatScanResult(result, format) {
+  const { diff, duration } = result;
+  if (format === "json") {
+    return JSON.stringify(result, null, 2);
+  }
+  if (format === "minimal") {
+    let out2 = "";
+    diff.missing.forEach((m) => out2 += `MISSING: ${m.key}
+`);
+    diff.extra.forEach((e) => out2 += `EXTRA: ${e.key}
+`);
+    diff.empty.forEach((e) => out2 += `EMPTY: ${e.key}
+`);
+    return out2.trim();
+  }
+  let out = c.bold(`\u250C\u2500 Env Diff Report \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
+`);
+  out += `\u2502 Source: ${diff.sourceFile}
+`;
+  out += `\u2502 Target: ${diff.targetFile}
+`;
+  out += `\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
+
+`;
+  if (diff.missing.length > 0) {
+    out += c.red(c.bold(`Missing Keys (${diff.missing.length}):
+`));
+    diff.missing.forEach((m) => out += `  - ${c.red(m.key)}
+`);
+  }
+  if (diff.extra.length > 0) {
+    out += c.yellow(c.bold(`
+Extra Keys (${diff.extra.length}):
+`));
+    diff.extra.forEach((e) => out += `  - ${c.yellow(e.key)}
+`);
+  }
+  if (diff.empty.length > 0) {
+    out += c.cyan(c.bold(`
+Empty Keys (${diff.empty.length}):
+`));
+    diff.empty.forEach((e) => out += `  - ${c.cyan(e.key)}
+`);
+  }
+  out += c.gray(`
+Matched: ${diff.matched} | Duration: ${duration.toFixed(2)}ms
+`);
+  return out;
+}
+function formatAuditReport(report, format) {
+  if (format === "json") {
+    return JSON.stringify(report, null, 2);
+  }
+  if (format === "minimal") {
+    return report.findings.map((f) => `${f.filePath}:${f.line} [${f.rule.severity}] ${f.rule.name} - ${f.match}`).join("\n");
+  }
+  let out = c.bold(`\u250C\u2500 Audit Report \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
+`);
+  out += `\u2502 Files Scanned: ${report.filesScanned}
+`;
+  out += `\u2502 Findings: ${report.findings.length}
+`;
+  out += `\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
+
+`;
+  if (report.findings.length === 0) {
+    out += c.green("No secrets or issues found. \u2728\n");
+  } else {
+    report.findings.forEach((f) => {
+      let colorFn = c.cyan;
+      if (f.rule.severity === "critical") colorFn = c.red;
+      else if (f.rule.severity === "high") colorFn = c.yellow;
+      out += `${colorFn(c.bold(`[${f.rule.severity.toUpperCase()}]`))} ${f.rule.name} in ${f.filePath}:${f.line}
+`;
+      out += `  Match:   ${f.match}
+`;
+      out += `  Context: ${c.dim(f.context)}
+
+`;
+    });
+  }
+  out += c.gray(`Duration: ${report.duration.toFixed(2)}ms
+`);
+  return out;
+}
+
+// src/utils/config.ts
+import { readFile as readFile2 } from "fs/promises";
+import { resolve, join } from "path";
+import { existsSync } from "fs";
+var CONFIG_FILES = [
+  ".envspectrc",
+  ".envspectrc.json",
+  "envspect.config.json"
+];
+async function loadConfig(cwd) {
+  const root = resolve(cwd || process.cwd());
+  for (const fileName of CONFIG_FILES) {
+    const filePath = join(root, fileName);
+    if (!existsSync(filePath)) continue;
+    try {
+      const content = await readFile2(filePath, "utf-8");
+      const config = JSON.parse(content);
+      log.debug(`Loaded config from ${fileName}`);
+      return config;
+    } catch (err) {
+      log.warn(`Failed to parse config file: ${fileName}`);
+      log.debug(String(err));
+      return {};
+    }
+  }
+  log.debug("No config file found, using defaults");
+  return {};
+}
+var defaults = {
+  envFile: ".env",
+  exampleFile: ".env.example",
+  format: "table",
+  scan: {
+    strict: false
+  },
+  audit: {
+    include: ["**/*.{ts,tsx,js,jsx,py,rb,go,java,php,rs,yaml,yml,toml,json,xml,sh}"],
+    exclude: [
+      "**/node_modules/**",
+      "**/dist/**",
+      "**/build/**",
+      "**/.git/**",
+      "**/coverage/**",
+      "**/*.min.js",
+      "**/vendor/**",
+      "**/package-lock.json",
+      "**/pnpm-lock.yaml",
+      "**/yarn.lock"
+    ],
+    severity: "low"
+  }
+};
+
+// src/commands/scan.ts
+async function runScan(options) {
+  const cwd = options.cwd || process.cwd();
+  const config = await loadConfig(cwd);
+  const finalOptions = {
+    envFile: options.envFile ?? config.envFile ?? defaults.envFile,
+    exampleFile: options.exampleFile ?? config.exampleFile ?? defaults.exampleFile,
+    strict: options.strict ?? config.scan?.strict ?? defaults.scan.strict,
+    format: options.format ?? config.format ?? defaults.format,
+    silent: options.silent ?? false,
+    cwd
+  };
+  const envPath = resolve2(cwd, finalOptions.envFile);
+  const examplePath = resolve2(cwd, finalOptions.exampleFile);
+  if (!existsSync2(envPath)) {
+    log.error(`Missing .env file at ${envPath}`);
+    process.exit(ExitCode.FILE_NOT_FOUND);
+  }
+  if (!existsSync2(examplePath)) {
+    log.error(`Missing .env.example file at ${examplePath}`);
+    process.exit(ExitCode.FILE_NOT_FOUND);
+  }
+  const spinner = createSpinner("Scanning environment files...").start();
+  try {
+    const start = performance.now();
+    const envResult = await parseEnvFile(envPath);
+    const exampleResult = await parseEnvFile(examplePath);
+    if (envResult.errors.length > 0 || exampleResult.errors.length > 0) {
+      spinner.error({ text: "Failed to parse environment files" });
+      process.exit(ExitCode.ERROR);
+    }
+    const diff = diffEnvFiles(exampleResult.entries, envResult.entries, {
+      strict: finalOptions.strict
+    });
+    diff.sourceFile = examplePath;
+    diff.targetFile = envPath;
+    const duration = performance.now() - start;
+    spinner.success({ text: "Scan complete" });
+    const output = formatScanResult({ diff, duration }, finalOptions.format);
+    console.log(output);
+    if (diff.missing.length > 0 || diff.extra.length > 0) {
+      process.exit(ExitCode.SCAN_ISSUES_FOUND);
+    } else {
+      process.exit(ExitCode.SUCCESS);
+    }
+  } catch (error) {
+    spinner.error({ text: "An unexpected error occurred during scan" });
+    if (error instanceof Error) {
+      log.error(error.message);
+    }
+    process.exit(ExitCode.ERROR);
+  }
+}
+
+// src/commands/audit.ts
+import { resolve as resolve3 } from "path";
+import { createSpinner as createSpinner2 } from "nanospinner";
+
+// src/core/scanner.ts
+import { readdir, readFile as readFile3 } from "fs/promises";
+import { join as join2 } from "path";
+var severityLevels = {
+  critical: 4,
+  high: 3,
+  medium: 2,
+  low: 1
+};
+function globToRegex(glob) {
+  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
+  return new RegExp(`^${escaped}$`);
+}
+function matchGlobs(path, globs) {
+  if (globs.length === 0) return true;
+  return globs.some((glob) => globToRegex(glob).test(path));
+}
+async function walkDir(dir, includeGlobs, excludeGlobs, fileList = [], cwd = dir) {
+  try {
+    const files = await readdir(dir, { withFileTypes: true });
+    for (const file of files) {
+      const res = join2(dir, file.name);
+      const relPath = res.substring(cwd.length + 1).replace(/\\/g, "/");
+      if (file.isDirectory()) {
+        if (!matchGlobs(relPath, excludeGlobs)) {
+          await walkDir(res, includeGlobs, excludeGlobs, fileList, cwd);
+        }
+      } else {
+        if (matchGlobs(relPath, includeGlobs) && !matchGlobs(relPath, excludeGlobs)) {
+          fileList.push(res);
+        }
+      }
+    }
+  } catch (error) {
+  }
+  return fileList;
+}
+async function scanDirectory(options) {
+  const start = performance.now();
+  const findings = [];
+  let filesScanned = 0;
+  const targetFiles = await walkDir(options.cwd, options.include, options.exclude, [], options.cwd);
+  const minSevLevel = severityLevels[options.minSeverity];
+  for (const file of targetFiles) {
+    filesScanned++;
+    try {
+      const content = await readFile3(file, "utf8");
+      const lines = content.split(/\r?\n/);
+      const fileName = file.replace(/\\/g, "/").split("/").pop() || "";
+      const isEnvFile = fileName.endsWith(".env") || fileName.startsWith(".env");
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        for (const rule of options.rules) {
+          if (severityLevels[rule.severity] < minSevLevel) {
+            continue;
+          }
+          if (isEnvFile && !rule.allowInEnvFiles) {
+            continue;
+          }
+          const match = rule.pattern.exec(line);
+          if (match) {
+            const matchedText = match[0];
+            const redacted = matchedText.length > 4 ? matchedText.substring(0, 4) + "*".repeat(matchedText.length - 4) : "****";
+            findings.push({
+              rule,
+              filePath: file.substring(options.cwd.length + 1),
+              // relative path
+              line: i + 1,
+              match: redacted,
+              context: line.trim().substring(0, 100)
+              // max 100 chars
+            });
+          }
+        }
+      }
+    } catch (e) {
+    }
+  }
+  return {
+    findings,
+    filesScanned,
+    rulesApplied: options.rules.length,
+    duration: performance.now() - start
+  };
+}
+
+// src/rules/default-rules.ts
+var defaultRules = [
+  // ── AWS ──
+  {
+    id: "aws-access-key",
+    name: "AWS Access Key ID",
+    description: "Detects AWS Access Key IDs (starts with AKIA)",
+    pattern: /(?:^|[^A-Za-z0-9/+=])AKIA[0-9A-Z]{16}(?:[^A-Za-z0-9/+=]|$)/,
+    severity: "critical",
+    allowInEnvFiles: true
+  },
+  {
+    id: "aws-secret-key",
+    name: "AWS Secret Access Key",
+    description: "Detects AWS Secret Access Keys (40 char base64)",
+    pattern: /(?:aws_secret_access_key|aws_secret)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/i,
+    severity: "critical",
+    allowInEnvFiles: true
+  },
+  // ── API Keys (Generic) ──
+  {
+    id: "generic-api-key",
+    name: "Generic API Key Assignment",
+    description: "Detects hardcoded API key assignments in source code",
+    pattern: /(?:api_key|apikey|api_secret|apisecret)\s*[=:]\s*['"][A-Za-z0-9_\-]{16,}['"]/i,
+    severity: "high",
+    allowInEnvFiles: true
+  },
+  // ── Private Keys ──
+  {
+    id: "private-key",
+    name: "Private Key",
+    description: "Detects PEM-encoded private keys",
+    pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,
+    severity: "critical",
+    allowInEnvFiles: false
+  },
+  // ── GitHub ──
+  {
+    id: "github-token",
+    name: "GitHub Token",
+    description: "Detects GitHub personal access tokens and fine-grained tokens",
+    pattern: /(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}/,
+    severity: "critical",
+    allowInEnvFiles: true
+  },
+  // ── Stripe ──
+  {
+    id: "stripe-key",
+    name: "Stripe API Key",
+    description: "Detects Stripe secret and publishable keys",
+    pattern: /(?:sk|pk)_(?:test|live)_[A-Za-z0-9]{24,}/,
+    severity: "critical",
+    allowInEnvFiles: true
+  },
+  // ── JWT ──
+  {
+    id: "jwt-token",
+    name: "JWT Token",
+    description: "Detects hardcoded JWT tokens",
+    pattern: /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/,
+    severity: "high",
+    allowInEnvFiles: true
+  },
+  // ── Database URLs ──
+  {
+    id: "database-url",
+    name: "Database Connection String",
+    description: "Detects database connection strings with credentials",
+    pattern: /(?:mongodb(?:\+srv)?|postgres(?:ql)?|mysql|redis|amqp):\/\/[^\s'"]+:[^\s'"]+@[^\s'"]+/i,
+    severity: "high",
+    allowInEnvFiles: true
+  },
+  // ── Passwords ──
+  {
+    id: "password-assignment",
+    name: "Password Assignment",
+    description: "Detects hardcoded password assignments in source code",
+    pattern: /(?:password|passwd|pwd|secret)\s*[=:]\s*['"][^'"]{8,}['"]/i,
+    severity: "high",
+    allowInEnvFiles: true
+  },
+  // ── Google ──
+  {
+    id: "google-api-key",
+    name: "Google API Key",
+    description: "Detects Google API keys",
+    pattern: /AIza[0-9A-Za-z_-]{35}/,
+    severity: "high",
+    allowInEnvFiles: true
+  },
+  // ── Slack ──
+  {
+    id: "slack-token",
+    name: "Slack Token",
+    description: "Detects Slack bot and user tokens",
+    pattern: /xox[bporsca]-[0-9]{10,}-[A-Za-z0-9-]+/,
+    severity: "high",
+    allowInEnvFiles: true
+  },
+  // ── SendGrid ──
+  {
+    id: "sendgrid-key",
+    name: "SendGrid API Key",
+    description: "Detects SendGrid API keys",
+    pattern: /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/,
+    severity: "high",
+    allowInEnvFiles: true
+  },
+  // ── Twilio ──
+  {
+    id: "twilio-key",
+    name: "Twilio API Key",
+    description: "Detects Twilio Account SID and Auth tokens",
+    pattern: /(?:AC[a-z0-9]{32}|SK[a-z0-9]{32})/,
+    severity: "high",
+    allowInEnvFiles: true
+  },
+  // ── npm ──
+  {
+    id: "npm-token",
+    name: "npm Access Token",
+    description: "Detects npm access tokens",
+    pattern: /npm_[A-Za-z0-9]{36}/,
+    severity: "critical",
+    allowInEnvFiles: true
+  },
+  // ── Discord ──
+  {
+    id: "discord-token",
+    name: "Discord Bot Token",
+    description: "Detects Discord bot tokens",
+    pattern: /[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27,}/,
+    severity: "critical",
+    allowInEnvFiles: true
+  }
+];
+
+// src/commands/audit.ts
+async function runAudit(options) {
+  const cwd = options.cwd || process.cwd();
+  const config = await loadConfig(cwd);
+  const finalOptions = {
+    include: options.include ?? config.audit?.include ?? defaults.audit.include,
+    exclude: options.exclude ?? config.audit?.exclude ?? defaults.audit.exclude,
+    severity: options.severity ?? config.audit?.severity ?? defaults.audit.severity,
+    format: options.format ?? config.format ?? defaults.format,
+    silent: options.silent ?? false,
+    cwd
+  };
+  const spinner = createSpinner2("Auditing codebase for secrets...").start();
+  try {
+    const report = await scanDirectory({
+      cwd: resolve3(cwd),
+      rules: defaultRules,
+      include: finalOptions.include,
+      exclude: finalOptions.exclude,
+      minSeverity: finalOptions.severity
+    });
+    spinner.success({ text: "Audit complete" });
+    const output = formatAuditReport(report, finalOptions.format);
+    console.log(output);
+    if (report.findings.length > 0) {
+      process.exit(ExitCode.AUDIT_SECRETS_FOUND);
+    } else {
+      process.exit(ExitCode.SUCCESS);
+    }
+  } catch (error) {
+    spinner.error({ text: "An unexpected error occurred during audit" });
+    if (error instanceof Error) {
+      log.error(error.message);
+    }
+    process.exit(ExitCode.ERROR);
+  }
+}
+
+// src/commands/sync.ts
+async function runSync() {
+  log.info(`Sync feature is coming in ${c.bold("v1.0")}!`);
+  log.dim("This will allow you to share encrypted .env files securely with your team.");
+}
+
+// src/cli.ts
+var program = new Command();
+program.name("envspect").description("Zero-config .env validation, secret leak detection, and team sync CLI").version("0.1.0").option("-f, --format <type>", "Output format (table, json, minimal)", "table").option("-s, --silent", "Suppress non-essential output", false).option("--cwd <path>", "Working directory", process.cwd());
+program.command("scan").description("Compare .env against .env.example").option("--env <file>", "Path to .env file", ".env").option("--example <file>", "Path to .env.example file", ".env.example").option("--strict", "Enable strict mode (fails on extra variables in .env)", false).action(async (options) => {
+  const globalOpts = program.opts();
+  await runScan({
+    ...globalOpts,
+    envFile: options.env,
+    exampleFile: options.example,
+    strict: options.strict,
+    format: globalOpts.format
+  });
+});
+program.command("audit").description("Scan codebase for hardcoded secrets").option("--include <globs...>", "Glob patterns to include").option("--exclude <globs...>", "Glob patterns to exclude").option("--severity <level>", "Minimum severity level to report", "low").action(async (options) => {
+  const globalOpts = program.opts();
+  await runAudit({
+    ...globalOpts,
+    ...options,
+    format: globalOpts.format
+  });
+});
+program.command("sync").description("Encrypted .env sync for teams (coming soon)").action(async () => {
+  await runSync();
+});
+if (process.argv.length <= 2) {
+  program.help();
+}
+program.parse();
+//# sourceMappingURL=cli.js.map