kiriya 0.1.3 → 0.2.0

package/CHANGELOG.md

@@ -7,6 +7,25 @@ output shapes are kiriya's public API.
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-10-04
+
+### Added
+
+- `secrets scan` finds secrets committed into a folder's files: a token whose issuer gives it
+  a recognisable prefix, a PEM private key, a password inside a URL, or a JWT. It exits 1 when
+  anything is found, so a git hook or a CI step needs no output parsing. **A finding never
+  carries the secret** — `ghp_****`, `postgres://me:****@` — because a report that quoted the
+  value would copy it into scrollback and CI logs. Unlike every other command it reads hidden
+  files by default, since `.env` and `.npmrc` are where secrets sit, and it skips dependency
+  folders instead; `--all` scans those too. A line saying `kiriya:allow-secret`, on it or above
+  it, declares one deliberate, which is how test fixtures and documentation stay quiet.
+  Over MCP it needs `mcp.allowWrite`, as `clip paste` does.
+
+  It deliberately does not flag a line that merely assigns something named like a secret.
+  That rule serves `env show`, where the name and the value are already separate, and over
+  source code it is useless: against kiriya itself it matched 42 lines and every one was
+  syntax, such as `if (token === "--")` in the argv parser.
+
 ## [0.1.3] - 2026-10-03
 
 ### Added

package/README.md

@@ -87,6 +87,7 @@ option, what each does, and whether it can be undone.
 | [`open`](docs/modules/open.md) | Open a file or folder in its default application, or a web address in the browser. |
 | [`port`](docs/modules/port.md) | See which process listens on a TCP port, end it, or find a free port, the same on every OS. |
 | [`proc`](docs/modules/proc.md) | List, find and end processes, and show them as a tree, the same on every OS. |
+| [`secrets`](docs/modules/secrets.md) | Find secrets committed into a folder's files: tokens, private keys and passwords in plain sight. |
 | [`self-update`](docs/modules/self-update.md) | Ask the registry whether a newer kiriya exists, and install it with --apply. |
 | [`sys`](docs/modules/sys.md) | This machine and the developer tools on it, described the same way on every OS. |
 | [`wait`](docs/modules/wait.md) | Wait until a port listens, a web address answers or a file appears, the same way on every OS. |

package/dist/src/config/modules.js

@@ -13,6 +13,7 @@ import { netModule } from "../modules/net/net.module.js";
 import { openModule } from "../modules/open/open.module.js";
 import { portModule } from "../modules/port/port.module.js";
 import { procModule } from "../modules/proc/proc.module.js";
+import { secretsModule } from "../modules/secrets/secrets.module.js";
 import { selfUpdateModule } from "../modules/self-update/self-update.module.js";
 import { sysModule } from "../modules/sys/sys.module.js";
 import { waitModule } from "../modules/wait/wait.module.js";
@@ -36,5 +37,6 @@ export const BUILT_IN_MODULES = [
     completionModule,
     waitModule,
     selfUpdateModule,
+    secretsModule,
 ];
 //# sourceMappingURL=modules.js.map

package/dist/src/{modules/files → core}/application/text-files.js

@@ -1,7 +1,7 @@
 import path from "node:path";
-import { walk } from "../../../core/application/walk.js";
-import { KiriyaError } from "../../../core/domain/errors.js";
-import { globToRegExp } from "../../../core/domain/glob.js";
+import { walk } from "./walk.js";
+import { KiriyaError } from "../domain/errors.js";
+import { globToRegExp } from "../domain/glob.js";
 import { decodeText, MAX_TEXT_BYTES } from "../domain/text-encoding.js";
 /** A text file, or null when it is binary, larger than MAX_TEXT_BYTES, or unreadable. */
 export async function readTextFile(fileSystem, content, target) {
@@ -35,7 +35,10 @@ export async function selectFiles(fileSystem, paths, selection) {
             files.push(target);
         }
         else if (stat?.kind === "directory") {
-            for await (const entry of walk(fileSystem, target, { all: selection.all })) {
+            const options = selection.skipDirectories === undefined
+                ? { all: selection.all }
+                : { all: selection.all, skipDirectories: selection.skipDirectories };
+            for await (const entry of walk(fileSystem, target, options)) {
                 if (entry.kind === "file" && keep(entry.name, entry.rel))
                     files.push(entry.path);
             }

package/dist/src/core/domain/secrets.js

@@ -1,7 +1,7 @@
 import { splitWords } from "./text-case.js";
 const SECRET_ASSIGNMENT = /(pass(word)?|pwd|secret|token|api[-_]?key)\s*[=:]/i;
 const PRIVATE_KEY = /-----BEGIN [A-Z ]*PRIVATE KEY-----/;
-/** `scheme://user:password@host`. */
+/** `scheme://user:password@host`. kiriya:allow-secret */
 const URL_CREDENTIALS = /[a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:[^\s/@]+@/i;
 /** A JSON Web Token: two base64url JSON parts, then the signature. */
 const JWT = /eyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\./;
@@ -15,6 +15,57 @@ export function looksSecret(value) {
         JWT.test(value) ||
         PREFIXED_TOKEN.test(value.trim()));
 }
+export const SECRET_KINDS = ["private-key", "url-credentials", "jwt", "token"];
+/**
+ * Patterns that identify a secret by its own shape, for finding one inside a line of a file.
+ *
+ * `SECRET_ASSIGNMENT` is deliberately not here. It serves `looksSecret`, which judges a whole
+ * value where the name and the value are already separate, and it is useless over source code:
+ * run against kiriya itself it matched 42 lines and every one was wrong — `if (token === "--")`
+ * in the argv parser, `decodeJwt(token: string)`, `readonly secret: Uint8Array`. A scanner that
+ * cries wolf 42 times gets turned off, so it scans only for what cannot be mistaken for syntax.
+ */
+const SCANNED = [
+    { kind: "private-key", pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
+    { kind: "url-credentials", pattern: /[a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:[^\s/@]+@/gi },
+    { kind: "jwt", pattern: /eyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*/g },
+    {
+        kind: "token",
+        pattern: /(?:(?:ghp|gho|ghu|ghs|ghr)_|github_pat_|glpat-|xox[abprs]-|npm_|sk-)[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}/g,
+    },
+];
+/** Every secret in one piece of text, earliest first, without overlaps. */
+export function findSecrets(text) {
+    const found = [];
+    const taken = [];
+    for (const { kind, pattern } of SCANNED) {
+        for (const match of text.matchAll(pattern)) {
+            const start = match.index;
+            const end = start + match[0].length;
+            if (taken.some((range) => start < range.end && end > range.start))
+                continue;
+            taken.push({ start, end });
+            found.push({ kind, start, length: match[0].length });
+        }
+    }
+    return found.sort((a, b) => a.start - b.start);
+}
+/**
+ * What may be printed about a match: enough to recognise whose secret it is, never enough to
+ * use it. A finding that carried the value would copy it into scrollback, CI logs and issue
+ * comments, which is the opposite of the point.
+ */
+export function redactSecret(text, match) {
+    const value = text.slice(match.start, match.start + match.length);
+    // The marker line is not itself secret, and it is what tells you what you are looking at.
+    if (match.kind === "private-key")
+        return value;
+    const prefix = /^(?:(?:ghp|gho|ghu|ghs|ghr)_|github_pat_|glpat-|xox[abprs]-|npm_|sk-|AKIA|eyJ)/.exec(value);
+    if (prefix !== null)
+        return `${prefix[0]}****`;
+    const scheme = /^[a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:/i.exec(value);
+    return scheme === null ? "****" : `${scheme[0]}****@`;
+}
 const SECRET_WORDS = new Set([
     "password",
     "passwd",

package/dist/src/core/infrastructure/platform/windows/windows-trash.adapter.js

@@ -45,6 +45,42 @@ for ($i = 0; $i -lt $paths.Length; $i++) {
   } catch { "error|$i|$($_.Exception.Message)" }
 }
 `;
+/**
+ * What the script's output means, separate from running it. Constrained Language Mode needs a
+ * WDAC or AppLocker policy to reproduce, which no test machine has, so that branch is reached
+ * here instead of being left to a machine nobody has.
+ */
+export function readTrashResult(stdout, stderr, paths) {
+    const lines = stdout
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line !== "");
+    const mode = lines.find((line) => line.startsWith("mode|"))?.slice(5) ?? "unknown";
+    if (mode !== "FullLanguage")
+        throw new CapabilityUnavailableError("core.trash.windows.language-mode", { mode });
+    const byIndex = new Map();
+    for (const line of lines) {
+        const [status, indexText, ...rest] = line.split("|");
+        if (indexText === undefined || !/^[0-9]+$/.test(indexText))
+            continue;
+        const index = Number(indexText);
+        const path = paths[index] ?? "";
+        if (status === "ok")
+            byIndex.set(index, { path, ok: true });
+        else if (status === "network")
+            byIndex.set(index, { path, ok: false, reason: message("core.trash.windows.network") });
+        else if (status === "drive") {
+            byIndex.set(index, { path, ok: false, reason: message("core.trash.windows.drive", { drive: rest.join("|") }) });
+        }
+        else
+            byIndex.set(index, { path, ok: false, reason: message("core.trash.failed", { detail: rest.join("|") }) });
+    }
+    return paths.map((path, index) => byIndex.get(index) ?? {
+        path,
+        ok: false,
+        reason: message("core.trash.failed", { detail: stderr.trim().split(/\r?\n/)[0] ?? "no result" }),
+    });
+}
 export class WindowsTrashAdapter {
     location = "core.trash.location.recycle-bin";
     async send(paths) {
@@ -52,35 +88,7 @@ export class WindowsTrashAdapter {
             env: { KIRIYA_TRASH_PATHS: paths.join(NEWLINE) },
             timeoutMs: 10 * 60_000,
         });
-        const lines = result.stdout
-            .split(/\r?\n/)
-            .map((line) => line.trim())
-            .filter((line) => line !== "");
-        const mode = lines.find((line) => line.startsWith("mode|"))?.slice(5) ?? "unknown";
-        if (mode !== "FullLanguage")
-            throw new CapabilityUnavailableError("core.trash.windows.language-mode", { mode });
-        const byIndex = new Map();
-        for (const line of lines) {
-            const [status, indexText, ...rest] = line.split("|");
-            if (indexText === undefined || !/^[0-9]+$/.test(indexText))
-                continue;
-            const index = Number(indexText);
-            const path = paths[index] ?? "";
-            if (status === "ok")
-                byIndex.set(index, { path, ok: true });
-            else if (status === "network")
-                byIndex.set(index, { path, ok: false, reason: message("core.trash.windows.network") });
-            else if (status === "drive") {
-                byIndex.set(index, { path, ok: false, reason: message("core.trash.windows.drive", { drive: rest.join("|") }) });
-            }
-            else
-                byIndex.set(index, { path, ok: false, reason: message("core.trash.failed", { detail: rest.join("|") }) });
-        }
-        return paths.map((path, index) => byIndex.get(index) ?? {
-            path,
-            ok: false,
-            reason: message("core.trash.failed", { detail: result.stderr.trim().split(/\r?\n/)[0] ?? "no result" }),
-        });
+        return readTrashResult(result.stdout, result.stderr, paths);
     }
 }
 //# sourceMappingURL=windows-trash.adapter.js.map

package/dist/src/i18n/locales/en.js

@@ -667,6 +667,25 @@ export const en = {
     "wait.file.gone": "{path} is gone, after {seconds} s",
     "wait.file.timed-out": "{path} did not appear within {seconds} s",
     "wait.file.still-there": "{path} was still there after {seconds} s",
+    "secrets.summary": "Find secrets committed into a folder's files: tokens, private keys and passwords in plain sight",
+    "secrets.about": "Reads the files under a folder and reports anything that looks like a secret: a token " +
+        "whose issuer gives it a recognisable prefix, a private key, a password in a URL, a JWT, " +
+        "or a line that assigns one. It uses the same judgement as the rest of kiriya, so what " +
+        "env show hides and config set refuses is what this finds. Nothing is sent anywhere and " +
+        "nothing changes. A finding never carries the secret itself, only enough to recognise it, " +
+        "because a report that quoted it would copy it into scrollback and CI logs. Exits 1 when " +
+        "anything is found, so a hook or a CI step needs no output parsing. A line saying " +
+        "kiriya:allow-secret, on it or above it, declares that one deliberate.",
+    "secrets.scan.summary": "Scan a folder's files for tokens, private keys and passwords, without printing them",
+    "secrets.scan.arg.paths": "Folders or files to scan; the current folder by default",
+    "secrets.scan.option.all": "Also look inside dependency folders such as node_modules; hidden files are read either way",
+    "secrets.scan.option.limit": "Stop after this many findings; 500 by default",
+    "secrets.scan.clean": "No secrets found in {checked} file(s)",
+    "secrets.scan.counted": "{count} finding(s) in {checked} file(s)",
+    "secrets.scan.found": "{count} possible secret(s) found",
+    "secrets.scan.allowed": "{count} marked deliberate with kiriya:allow-secret",
+    "secrets.scan.truncated": "The list stopped at --limit; there may be more.",
+    "secrets.scan.how-allow": "A line with kiriya:allow-secret on it, or above it, is left alone.",
     "self-update.summary": "Ask the registry whether a newer kiriya exists, and install it with --apply",
     "self-update.about": "Asks npm's registry which version it serves as latest and compares it with this one. " +
         "Without --apply it changes nothing, so it is safe to run just to find out. With --apply " +

package/dist/src/modules/files/application/compare-paths.use-case.js

@@ -5,7 +5,7 @@ import { NotFoundError, UsageError } from "../../../core/domain/errors.js";
 import { RawReader } from "../../../core/domain/input-schema.js";
 import { message } from "../../../core/domain/message.js";
 import { byCodePoint } from "../../../core/domain/names.js";
-import { readTextFile } from "./text-files.js";
+import { readTextFile } from "../../../core/application/text-files.js";
 export const compareSpec = {
     id: "files.compare",
     summary: "files.compare.summary",

package/dist/src/modules/files/application/find-files.use-case.js

@@ -3,7 +3,7 @@ import { done } from "../../../core/domain/command.js";
 import { NotFoundError } from "../../../core/domain/errors.js";
 import { RawReader } from "../../../core/domain/input-schema.js";
 import { globToRegExp } from "../../../core/domain/glob.js";
-import { parseExtensions } from "../domain/filters.js";
+import { parseExtensions } from "../../../core/domain/filters.js";
 import { parseSize, parseTime } from "../domain/values.js";
 import { walk } from "../../../core/application/walk.js";
 export const FIND_TYPES = ["file", "dir"];

package/dist/src/modules/files/application/read-text.use-case.js

@@ -3,8 +3,8 @@ import { done } from "../../../core/domain/command.js";
 import { NotFoundError, OperationFailedError, UsageError } from "../../../core/domain/errors.js";
 import { RawReader } from "../../../core/domain/input-schema.js";
 import { formatBytes } from "../../../core/domain/values/bytes.js";
-import { MAX_TEXT_BYTES, splitLines } from "../domain/text-encoding.js";
-import { readTextFile } from "./text-files.js";
+import { MAX_TEXT_BYTES, splitLines } from "../../../core/domain/text-encoding.js";
+import { readTextFile } from "../../../core/application/text-files.js";
 export const readSpec = {
     id: "files.read",
     summary: "files.read.summary",

package/dist/src/modules/files/application/replace-text.use-case.js

@@ -4,9 +4,9 @@ import { done, preview } from "../../../core/domain/command.js";
 import { KiriyaError, UsageError } from "../../../core/domain/errors.js";
 import { RawReader } from "../../../core/domain/input-schema.js";
 import { message } from "../../../core/domain/message.js";
-import { parseExtensions } from "../domain/filters.js";
-import { encodeText, escapeRegExp } from "../domain/text-encoding.js";
-import { readTextFile, selectFiles } from "./text-files.js";
+import { parseExtensions } from "../../../core/domain/filters.js";
+import { encodeText, escapeRegExp } from "../../../core/domain/text-encoding.js";
+import { readTextFile, selectFiles } from "../../../core/application/text-files.js";
 /** Changed lines shown per file. */
 const SAMPLE_LINES = 3;
 export const replaceSpec = {

package/dist/src/modules/files/application/search-text.use-case.js

@@ -2,9 +2,9 @@ import { expandPaths } from "../../../core/application/paths.js";
 import { done } from "../../../core/domain/command.js";
 import { UsageError } from "../../../core/domain/errors.js";
 import { RawReader } from "../../../core/domain/input-schema.js";
-import { parseExtensions } from "../domain/filters.js";
-import { escapeRegExp } from "../domain/text-encoding.js";
-import { readTextFile, selectFiles } from "./text-files.js";
+import { parseExtensions } from "../../../core/domain/filters.js";
+import { escapeRegExp } from "../../../core/domain/text-encoding.js";
+import { readTextFile, selectFiles } from "../../../core/application/text-files.js";
 /** Longer matching lines are cut here, so one minified file cannot flood the terminal. */
 const LINE_LIMIT = 240;
 export const grepSpec = {

package/dist/src/modules/secrets/application/scan-secrets.use-case.js

@@ -0,0 +1,108 @@
+import { DEPENDENCY_DIRECTORIES } from "../../../config/dependency-directories.js";
+import { expandPaths } from "../../../core/application/paths.js";
+import { readTextFile, selectFiles } from "../../../core/application/text-files.js";
+import { done } from "../../../core/domain/command.js";
+import { RawReader } from "../../../core/domain/input-schema.js";
+import { message } from "../../../core/domain/message.js";
+import { parseExtensions } from "../../../core/domain/filters.js";
+import { findSecrets, redactSecret } from "../../../core/domain/secrets.js";
+import { splitLines } from "../../../core/domain/text-encoding.js";
+import { isAllowed } from "../domain/allow-marker.js";
+export const scanSpec = {
+    id: "secrets.scan",
+    summary: "secrets.scan.summary",
+    examples: ["kiriya secrets scan", "kiriya secrets scan src --ext .ts", "kiriya secrets scan --json"],
+    safety: "read",
+    idempotent: true,
+    // Nothing is sent anywhere, which is most of why anyone would use it.
+    usesNetwork: false,
+    runsUserCommands: false,
+    // The findings point straight at secrets, as `proc list --full` and `clip paste` do.
+    sensitive: true,
+    input: {
+        positionals: [
+            { name: "paths", description: "secrets.scan.arg.paths", required: false, variadic: true, path: true },
+        ],
+        options: {
+            ext: { type: "string", description: "files.option.ext", valueName: "<extensions>", multiple: true },
+            name: { type: "string", description: "files.option.name", valueName: "<glob>" },
+            all: { type: "boolean", description: "secrets.scan.option.all" },
+            limit: { type: "string", description: "secrets.scan.option.limit", valueName: "<n>" },
+        },
+        parse(raw) {
+            const reader = new RawReader(raw);
+            return {
+                paths: reader.positionalsFrom(0),
+                extensions: parseExtensions(reader.strings("ext")),
+                name: reader.string("name"),
+                all: reader.flag("all"),
+                limit: reader.positiveInteger("limit", 500),
+            };
+        },
+    },
+};
+export class ScanSecrets {
+    fileSystem;
+    content;
+    spec = scanSpec;
+    constructor(fileSystem, content) {
+        this.fileSystem = fileSystem;
+        this.content = content;
+    }
+    async execute(input, context) {
+        const targets = input.paths.length === 0 ? ["."] : input.paths;
+        // Hidden files are where secrets live — .env, .npmrc, .git-credentials — so unlike the rest
+        // of kiriya this walks them by default, and keeps dependency folders out instead. --all
+        // drops that guard for someone who really does want to scan what they installed.
+        const roots = await expandPaths(this.fileSystem, targets, context.cwd, true);
+        const files = await selectFiles(this.fileSystem, roots, {
+            all: true,
+            extensions: input.extensions,
+            name: input.name,
+            ...(input.all ? {} : { skipDirectories: DEPENDENCY_DIRECTORIES }),
+        });
+        const findings = [];
+        let checked = 0;
+        let skipped = 0;
+        let allowed = 0;
+        let truncated = false;
+        for (const file of files) {
+            const text = await readTextFile(this.fileSystem, this.content, file);
+            if (text === null) {
+                skipped += 1;
+                continue;
+            }
+            checked += 1;
+            const lines = splitLines(text.text);
+            for (const [index, line] of lines.entries()) {
+                for (const match of findSecrets(line)) {
+                    if (isAllowed(lines, index)) {
+                        allowed += 1;
+                        continue;
+                    }
+                    if (findings.length >= input.limit) {
+                        truncated = true;
+                        break;
+                    }
+                    findings.push({
+                        path: file,
+                        line: index + 1,
+                        column: match.start + 1,
+                        kind: match.kind,
+                        sample: redactSecret(line, match),
+                    });
+                }
+                if (truncated)
+                    break;
+            }
+            if (truncated)
+                break;
+        }
+        const data = { findings, checked, skipped, allowed, truncated };
+        // Found means exit 1, so a hook or a CI step needs no output parsing, as files compare does.
+        if (findings.length === 0)
+            return done(data);
+        return done(data, { failures: [message("secrets.scan.found", { count: findings.length })] });
+    }
+}
+//# sourceMappingURL=scan-secrets.use-case.js.map

package/dist/src/modules/secrets/domain/allow-marker.js

@@ -0,0 +1,23 @@
+/**
+ * A line may say that the secret on it is deliberate, which test fixtures and documentation
+ * need: a scanner whose first run on its own repository is all false positives gets turned
+ * off and never run again. The marker sits next to what it excuses and shows up in review,
+ * which an ignore file in a corner does not.
+ */
+const MARKER = /kiriya:allow-secret/;
+/**
+ * Whether the secret on this line was declared deliberate: by a marker on the line, or on
+ * either neighbour.
+ *
+ * The line below counts because a formatter moves trailing comments. Prettier, which this
+ * repository runs, reflowed `for (… "-----BEGIN RSA PRIVATE KEY-----"]) { // kiriya:allow-secret`
+ * onto the next line and silently unmarked the fixture. A marker a formatter can move is no
+ * marker, so both neighbours count.
+ */
+export function isAllowed(lines, index) {
+    return [index - 1, index, index + 1].some((at) => {
+        const line = lines[at];
+        return line !== undefined && MARKER.test(line);
+    });
+}
+//# sourceMappingURL=allow-marker.js.map

package/dist/src/modules/secrets/presentation/secrets.view.js

@@ -0,0 +1,29 @@
+import { message } from "../../../core/domain/message.js";
+/** Longer samples are cut here, so a minified line cannot flood the terminal. */
+const SAMPLE_LIMIT = 60;
+export const scanView = (output, format) => {
+    if (output.findings.length === 0) {
+        const clean = message("secrets.scan.clean", { checked: output.checked });
+        const lines = [format.green(format.text(clean))];
+        if (output.allowed > 0)
+            lines.push(format.dim(format.text(message("secrets.scan.allowed", { count: output.allowed }))));
+        return lines;
+    }
+    const kindWidth = Math.max(...output.findings.map((finding) => finding.kind.length));
+    const places = output.findings.map((finding) => `${format.path(finding.path)}:${finding.line}:${finding.column}`);
+    const placeWidth = Math.max(...places.map((place) => place.length));
+    const lines = output.findings.map((finding, index) => {
+        const place = (places[index] ?? "").padEnd(placeWidth);
+        const sample = finding.sample.length > SAMPLE_LIMIT ? `${finding.sample.slice(0, SAMPLE_LIMIT)}…` : finding.sample;
+        return `  ${format.yellow(place)}  ${finding.kind.padEnd(kindWidth)}  ${sample}`;
+    });
+    lines.push("", format.text(message("secrets.scan.counted", { count: output.findings.length, checked: output.checked })));
+    if (output.allowed > 0)
+        lines.push(format.dim(format.text(message("secrets.scan.allowed", { count: output.allowed }))));
+    if (output.truncated)
+        lines.push(format.dim(format.text(message("secrets.scan.truncated"))));
+    // Say how to excuse one, because a fixture flagged with no way out is why scanners get turned off.
+    lines.push(format.dim(format.text(message("secrets.scan.how-allow"))));
+    return lines;
+};
+//# sourceMappingURL=secrets.view.js.map

package/dist/src/modules/secrets/secrets.module.js

@@ -0,0 +1,13 @@
+import { ScanSecrets } from "./application/scan-secrets.use-case.js";
+import { scanView } from "./presentation/secrets.view.js";
+export const secretsModule = {
+    id: "secrets",
+    summary: "secrets.summary",
+    about: "secrets.about",
+    examples: ["kiriya secrets scan", "kiriya secrets scan src --ext ts,js", "kiriya secrets scan --json"],
+    guide: "https://github.com/SatPaingOo/kiriya/blob/main/docs/modules/secrets.md",
+    register(registrar, ports) {
+        registrar.add(new ScanSecrets(ports.fileSystem, ports.fileContent), scanView);
+    },
+};
+//# sourceMappingURL=secrets.module.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kiriya",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "description": "One command-line toolbox for everyday developer work that behaves the same on Windows, Linux and macOS.",
   "mcpName": "io.github.SatPaingOo/kiriya",
   "license": "MIT",