leakfix 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Safayet Hossain
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,166 @@
+# leakfix
+
+[![npm](https://img.shields.io/npm/v/leakfix)](https://www.npmjs.com/package/leakfix)
+[![CI](https://github.com/safayet404/leakfix/actions/workflows/ci.yml/badge.svg)](https://github.com/safayet404/leakfix/actions/workflows/ci.yml)
+
+**Leaked a secret? leakfix replaces it without taking your app down.**
+
+Finding a leaked `.env` is the easy part. GitHub and others will tell you about
+it, and some providers revoke the key on the spot, which takes your app down.
+The hard part is the cleanup: mint a new credential, update the deployment,
+redeploy, check the app still works, and only then kill the old one. leakfix does
+that for you, and undoes everything if any step fails.
+
+```
+$ leakfix scan
+Found 3 secret(s), 3 committed to git:
+  ● .env:5   MONGODB_URI         mongodb+srv://app:••••••@cluster0.mongodb.net/app  ← committed to git
+  ● .env:8   JWT_SECRET          k3J••••••Qa                                        ← committed to git
+  ● .env:10  JWT_REFRESH_SECRET  p9X••••••7w                                        ← committed to git
+
+$ leakfix rotate
+Rotation plan: MONGODB_URI (MongoDB Atlas user app), JWT_SECRET, JWT_REFRESH_SECRET
+  1. Create database user app-lf20261001 with the same roles as app
+  2. Generate a new random JWT_SECRET
+  3. Generate a new random JWT_REFRESH_SECRET
+  4. Set MONGODB_URI on Vercel project api (production)
+  5. Set JWT_SECRET on Vercel project api (production)
+  6. Set JWT_REFRESH_SECRET on Vercel project api (production)
+  7. Redeploy api to production and wait until it is ready
+  8. Health check https://api.example.com/health
+  9. Delete leaked database user app  (after everything above succeeded)
+Dry run. Run again with --yes to execute.
+```
+
+## How a rotation stays safe
+
+1. **New credential next to the old one.** For MongoDB, leakfix creates a new
+   database user with the same roles, so both work for a moment.
+2. **Switch.** It updates every affected environment variable, then does one redeploy.
+3. **Verify.** It waits for the deployment to be ready and calls your health URL.
+4. **Revoke.** Only then does it delete the leaked credential.
+
+If anything fails before step 4, leakfix undoes the completed steps in reverse,
+redeploys the previous configuration, and removes the credential it created.
+Production never points at something that doesn't exist. If step 4 itself
+fails, leakfix does **not** roll back to the leaked credential. It tells you what
+to finish by hand.
+
+Every step is written to `leakfix-audit.jsonl`. The log never contains secret values.
+
+## Supported (v0.1)
+
+| Secret | Rotation |
+|---|---|
+| MongoDB Atlas connection string | ✅ new database user, same roles; old user deleted |
+| JWT signing secrets | ✅ new random secret (users sign in again) |
+| Deployment | ✅ Vercel (env vars + production redeploy) |
+| SMTP passwords, other API keys | 📝 detected, with instructions to rotate by hand |
+
+Planned: Render and Railway deployments, Stripe, SendGrid and Resend keys, a GitHub App that
+reacts to pushes and opens the clean-up PR, and an approval mode ("rotate?" → one click).
+
+## Setup
+
+Needs Node.js 22 or newer. Nothing to install:
+
+```bash
+npx leakfix scan          # in your repo: which secrets are committed?
+```
+
+Or install it: `npm i -g leakfix`.
+
+Then let leakfix find the rest:
+
+```bash
+npx leakfix init
+```
+
+```
+✓ Committed secrets to rotate: MONGODB_URI, JWT_SECRET, JWT_REFRESH_SECRET
+✓ Vercel token works (signed in as you)
+✓ Vercel project: my-api (deploys you/my-api)
+✓ Set for production on Vercel: MONGODB_URI, JWT_SECRET, JWT_REFRESH_SECRET
+✓ Health check: https://my-api.vercel.app/health → 200
+✓ Atlas project: my-project (cluster Cluster0)
+✓ Atlas service account can manage database user app
+Wrote ./leakfix.config.json (no secrets in it; safe to commit)
+Ready. Next: leakfix rotate shows the plan; leakfix rotate --yes runs it.
+```
+
+`init` only reads. It finds the Vercel project from `.vercel/project.json` or the
+git remote, the Atlas project from the cluster in your connection string, and a
+health route on the project's domain. Anything missing comes with the exact
+fix: where to create the token, which Atlas role to pick, and which IP range to
+allow (a `/24`, so a home ISP changing your IP doesn't break it).
+
+The config it writes looks like this, if you'd rather write it yourself:
+
+```json
+{
+  "vercel": { "project": "my-api", "teamId": "team_xxx" },
+  "atlas": { "groupId": "<Atlas project id>" },
+  "healthUrl": "https://my-api.vercel.app/api/health"
+}
+```
+
+Credentials come only from the environment, never from the repo:
+
+| Variable | Where to get it | Needs |
+|---|---|---|
+| `LEAKFIX_VERCEL_TOKEN` | vercel.com/account/tokens | access to the project's team |
+| `LEAKFIX_ATLAS_CLIENT_ID` / `LEAKFIX_ATLAS_CLIENT_SECRET` | Atlas → Organization → Access Manager → Service Accounts | permission to manage database users in the project |
+
+Then:
+
+```bash
+leakfix init                # find projects, check access, write leakfix.config.json
+leakfix rotate              # dry run: prints the plan
+leakfix rotate --yes        # do it
+leakfix fix-repo            # stop tracking .env files, add .gitignore entries and .env.example
+```
+
+To mark a fake value as intentional, put `leakfix:allow` in a comment on the same
+line, or `leakfix:allow-file` in the first lines of a file full of test fixtures.
+
+`fix-repo` doesn't rewrite history. The old file stays in past commits,
+which is why rotating is what actually protects you.
+
+## Block leaks in pull requests
+
+Add leakfix to any repo's CI. The check fails when a secret is committed, before it
+reaches `main`:
+
+```yaml
+# .github/workflows/leakfix.yml
+name: leakfix
+on: [push, pull_request]
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: safayet404/leakfix@main
+```
+
+Or run it in Docker, with nothing to install:
+
+```bash
+docker build -t leakfix https://github.com/safayet404/leakfix.git
+docker run --rm -v "$PWD:/repo" leakfix scan /repo
+```
+
+## Development
+
+```bash
+pnpm install
+pnpm dev scan ../my-api   # run from source
+pnpm test        # runs whole rotations against an in-memory Atlas + Vercel, including failures
+pnpm typecheck
+```
+
+CI runs the tests on Node 22 and 24, builds the Docker image, and scans this
+repo with it on every push.
+
+Releases: bump `version` in package.json, then push a matching tag (`git tag v0.2.0 && git push --tags`).
+CI publishes to npm through Trusted Publishing (no stored token, signed provenance) and creates the GitHub release.

package/dist/cli.js

@@ -0,0 +1,162 @@
+#!/usr/bin/env node
+// leakfix: rotate leaked secrets without downtime.
+//
+//   leakfix scan [dir]                  find secrets and whether git tracks them
+//   leakfix init [dir]                  find the Vercel/Atlas projects, check access, write the config
+//   leakfix rotate [dir]                show the rotation plan (dry run)
+//   leakfix rotate [dir] --yes          run it
+//   leakfix fix-repo [dir]              untrack .env files, ignore them, add .env.example
+//
+// Credentials come from the environment, never from the repo:
+//   LEAKFIX_VERCEL_TOKEN, LEAKFIX_ATLAS_CLIENT_ID, LEAKFIX_ATLAS_CLIENT_SECRET
+// Project settings live in leakfix.config.json (see README).
+import { execFileSync } from "node:child_process";
+import { appendFileSync, existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { parseArgs } from "node:util";
+import { scanRepo } from "./detect/scan.js";
+import { execute } from "./engine/plan.js";
+import { init } from "./engine/init.js";
+import { fixRepo } from "./engine/repo.js";
+import { buildPlans, describeFinding } from "./engine/rotations.js";
+const c = {
+    red: (s) => `\x1b[31m${s}\x1b[0m`, green: (s) => `\x1b[32m${s}\x1b[0m`,
+    yellow: (s) => `\x1b[33m${s}\x1b[0m`, dim: (s) => `\x1b[2m${s}\x1b[0m`, bold: (s) => `\x1b[1m${s}\x1b[0m`,
+};
+const configFile = (root, path) => (path ? resolve(path) : join(root, "leakfix.config.json"));
+function loadConfig(root, path) {
+    const file = configFile(root, path);
+    if (!existsSync(file))
+        return {};
+    return JSON.parse(readFileSync(file, "utf8"));
+}
+/** "owner/repo" of the origin remote, if it is a GitHub-style URL. */
+function gitRepo(root) {
+    try {
+        const url = execFileSync("git", ["-C", root, "remote", "get-url", "origin"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+        return /[:/]([^/:]+\/[^/]+?)(?:\.git)?$/.exec(url)?.[1];
+    }
+    catch {
+        return undefined;
+    }
+}
+const credentials = () => ({
+    vercelToken: process.env.LEAKFIX_VERCEL_TOKEN,
+    atlasClientId: process.env.LEAKFIX_ATLAS_CLIENT_ID,
+    atlasClientSecret: process.env.LEAKFIX_ATLAS_CLIENT_SECRET,
+});
+async function main() {
+    const { values, positionals } = parseArgs({
+        allowPositionals: true,
+        options: {
+            yes: { type: "boolean", short: "y", default: false },
+            config: { type: "string", short: "c" },
+            help: { type: "boolean", short: "h", default: false },
+        },
+    });
+    const [command = "scan", dir = "."] = positionals;
+    const root = resolve(dir);
+    if (values.help || !["scan", "init", "rotate", "fix-repo"].includes(command)) {
+        // The usage text is the comment block at the top of this file (kept in the build).
+        const lines = readFileSync(new URL(import.meta.url), "utf8").split("\n").slice(1);
+        const usage = lines.slice(0, lines.findIndex((l) => !l.startsWith("//")));
+        console.log(usage.map((l) => l.replace(/^\/\/ ?/, "")).join("\n"));
+        return;
+    }
+    const findings = scanRepo(root);
+    const leaked = findings.filter((f) => f.tracked);
+    if (command === "scan") {
+        if (!findings.length)
+            return console.log(c.green("No secrets found."));
+        console.log(c.bold(`Found ${findings.length} secret(s), ${leaked.length} committed to git:\n`));
+        for (const f of findings)
+            console.log(`  ${f.tracked ? c.red("●") : c.dim("○")} ${describeFinding(f)}  ${c.dim(f.kind)}`);
+        if (leaked.length) {
+            console.log(`\n${c.red("Committed secrets must be treated as leaked, even after you delete the file.")}`);
+            console.log(`Next: ${c.bold("leakfix rotate")} to replace them, then ${c.bold("leakfix fix-repo")} to stop tracking .env files.`);
+        }
+        process.exitCode = leaked.length ? 1 : 0;
+        return;
+    }
+    if (command === "fix-repo") {
+        const fix = fixRepo(root, findings);
+        if (!fix.untracked.length)
+            return console.log(c.green("No tracked .env files."));
+        console.log(`Stopped tracking: ${fix.untracked.join(", ")}`);
+        if (fix.gitignoreAdded.length)
+            console.log(`Added to .gitignore: ${fix.gitignoreAdded.join(" ")}`);
+        if (fix.example)
+            console.log(`Created ${fix.example} (variable names only)`);
+        console.log(c.yellow("\nThe files stay in your git history. Rotating the secrets (leakfix rotate) is what actually protects you."));
+        console.log(`Review with ${c.bold("git status")}, then commit and push.`);
+        return;
+    }
+    if (command === "init") {
+        const existing = loadConfig(root, values.config);
+        console.log(c.bold("leakfix init") + c.dim("  (reads only; changes nothing on Vercel or Atlas)\n"));
+        const result = await init({ root, leaked, existing, creds: credentials(), gitRepo: gitRepo(root) });
+        for (const check of result.checks) {
+            const mark = { ok: c.green("✓"), warn: c.yellow("!"), todo: c.red("✗") }[check.status];
+            console.log(`${mark} ${check.label}`);
+            for (const line of check.fix ?? [])
+                console.log(c.dim(`    → ${line}`));
+        }
+        if (JSON.stringify(result.config) !== JSON.stringify(existing)) {
+            const file = configFile(root, values.config);
+            writeFileSync(file, JSON.stringify(result.config, null, 2) + "\n");
+            console.log(`\nWrote ${file} ${c.dim("(no secrets in it; safe to commit)")}`);
+        }
+        console.log(result.ready
+            ? `\n${c.green("Ready.")} Next: ${c.bold("leakfix rotate")} shows the plan; ${c.bold("leakfix rotate --yes")} runs it.`
+            : `\n${c.red("Not ready yet.")} Fix the ✗ items, then run ${c.bold("leakfix init")} again.`);
+        process.exitCode = result.ready ? 0 : 1;
+        return;
+    }
+    // rotate
+    const cfg = loadConfig(root, values.config);
+    const { plans, manual } = buildPlans(leaked, cfg, credentials());
+    if (!leaked.length)
+        return console.log(c.green("No committed secrets to rotate."));
+    for (const plan of plans) {
+        console.log(c.bold(`\nRotation plan: ${plan.target}`));
+        plan.steps.forEach((s, i) => console.log(`  ${i + 1}. ${s.title}${s.final ? c.dim("  (after everything above succeeded)") : ""}`));
+    }
+    if (manual.length) {
+        console.log(c.bold(`\nNeeds you (${manual.length}):`));
+        for (const m of manual)
+            console.log(`  ${c.yellow("!")} ${describeFinding(m.finding)}\n    ${c.dim(m.reason)}\n    → ${m.howTo}`);
+    }
+    if (!plans.length)
+        return;
+    if (!values.yes) {
+        console.log(c.dim(`\nDry run. Run again with --yes to execute.`));
+        return;
+    }
+    const auditFile = join(root, "leakfix-audit.jsonl");
+    let failed = false;
+    for (const plan of plans) {
+        console.log(c.bold(`\nRotating: ${plan.target}`));
+        const result = await execute(plan, (e) => {
+            appendFileSync(auditFile, JSON.stringify(e) + "\n");
+            const mark = { ok: c.green("✓"), failed: c.red("✗"), undone: c.yellow("↺"), "undo-failed": c.red("‼"), skipped: c.dim("–") }[e.status];
+            console.log(`  ${mark} ${e.step}${e.error ? c.dim(`  (${e.error})`) : ""}`);
+        });
+        if (!result.ok && result.rolledBack) {
+            failed = true;
+            console.log(c.red(`  Rotation rolled back. Production is still on the previous credentials.`));
+        }
+        else if (!result.ok) {
+            failed = true;
+            console.log(c.yellow(`  Production now uses the new credentials, but: ${result.error}`));
+        }
+        else {
+            console.log(c.green(`  Done. The leaked credentials no longer work.`));
+        }
+    }
+    console.log(c.dim(`\nAudit log: ${auditFile} (contains no secret values)`));
+    process.exitCode = failed ? 1 : 0;
+}
+main().catch((err) => {
+    console.error(c.red(err instanceof Error ? err.message : String(err)));
+    process.exitCode = 2;
+});

package/dist/detect/rules.js

@@ -0,0 +1,36 @@
+// What leakfix looks for. Each rule recognises one kind of credential that leakfix
+// knows how to rotate (or, for "generic", at least report).
+//
+// Detection is deliberately simple and explainable: env-style KEY=value lines
+// and connection strings. Broad pattern libraries (gitleaks, trufflehog) find
+// far more; leakfix's job is what happens *after* a leak is found.
+export const RULES = [
+    {
+        kind: "mongodb-uri",
+        description: "MongoDB connection string with a username and password",
+        value: /mongodb(?:\+srv)?:\/\/[^\s:@/'"]+:[^\s@/'"]+@[^\s'"]+/,
+    },
+    {
+        kind: "jwt-secret",
+        description: "Secret used to sign JSON Web Tokens",
+        key: /^(?:[A-Z0-9_]*_)?JWT(?:_[A-Z0-9]+)*_SECRET$|^(?:ACCESS|REFRESH)_TOKEN_SECRET$/,
+    },
+    {
+        kind: "smtp-password",
+        description: "SMTP / email account password",
+        key: /^(?:SMTP|MAIL|EMAIL)_(?:PASS|PASSWORD)$/,
+    },
+    {
+        kind: "vercel-token",
+        description: "Vercel access token",
+        key: /^VERCEL_(?:ACCESS_)?TOKEN$/,
+    },
+    {
+        kind: "generic",
+        description: "Variable whose name suggests a secret",
+        key: /(?:SECRET|PASSWORD|PASSWD|PRIVATE_KEY|API_KEY|ACCESS_KEY|TOKEN)$/,
+    },
+];
+/** Values that are obviously placeholders, not real secrets. */
+// Also shell expansions ($VAR, ${VAR}, $(command)): the value is produced at run time, not written down.
+export const PLACEHOLDER = /^(?:|changeme|change_me|your[_-].*|<.*>|\$\{.*\}|\$\(.*\)|\$[A-Za-z_]\w*|x+|\*+|example.*|dummy|test|secret|password|null|undefined)$/i;

package/dist/detect/scan.js

@@ -0,0 +1,91 @@
+import { execFileSync } from "node:child_process";
+import { readFileSync, statSync } from "node:fs";
+import { join, basename } from "node:path";
+import { PLACEHOLDER, RULES } from "./rules.js";
+/** Put this in a comment on a line to tell leakfix the value is intentional (test fixtures, docs). */
+export const ALLOW = "leakfix:allow";
+/** In the first lines of a file: skip the whole file (test fixtures full of fake secrets). */
+export const ALLOW_FILE = "leakfix:allow-file";
+const ENV_LINE = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/;
+function unquote(raw) {
+    let v = raw.trim();
+    const hash = v.search(/\s+#/); // trailing comment on unquoted values
+    if (!/^["']/.test(v) && hash >= 0)
+        v = v.slice(0, hash);
+    if (/^(["']).*\1$/.test(v))
+        v = v.slice(1, -1);
+    return v.trim();
+}
+/** Scan text (one file) for secrets. */
+export function scanText(text, file, tracked = false) {
+    const findings = [];
+    const lines = text.split(/\r?\n/);
+    lines.forEach((lineText, i) => {
+        if (lineText.includes(ALLOW))
+            return; // explicitly marked as a fake / intended value
+        const env = ENV_LINE.exec(lineText);
+        if (env) {
+            const key = env[1];
+            const value = unquote(env[2]);
+            if (!value || PLACEHOLDER.test(value))
+                return;
+            const byValue = RULES.find((r) => r.value?.test(value));
+            const byKey = RULES.find((r) => r.key?.test(key));
+            const rule = byValue ?? byKey;
+            if (rule)
+                findings.push({ kind: rule.kind, file, line: i + 1, key, value, tracked });
+            return;
+        }
+        // Connection strings can also sit in code or config files.
+        for (const rule of RULES) {
+            const m = rule.value?.exec(lineText);
+            if (m)
+                findings.push({ kind: rule.kind, file, line: i + 1, value: m[0], tracked });
+        }
+    });
+    return findings;
+}
+function git(cwd, args) {
+    return execFileSync("git", ["-C", cwd, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+}
+const SKIP = /(?:^|\/)(?:node_modules|\.git|dist|build|\.next|vendor)\//;
+const LIKELY = /(?:^|\/)\.env(?:\.[\w.-]+)?$|\.(?:js|ts|mjs|cjs|json|ya?ml|toml|php|py|env)$/;
+/**
+ * Scan a git repository's tracked files plus any .env files lying around.
+ * Untracked .env files are reported too (tracked=false) because they show
+ * which secrets exist, but only tracked ones count as leaked.
+ */
+export function scanRepo(root) {
+    const tracked = new Set(git(root, ["ls-files"]).split("\n").filter(Boolean));
+    // Untracked .env files, whether git-ignored or not.
+    const untrackedEnv = [
+        ...git(root, ["ls-files", "--others", "--exclude-standard"]).split("\n"),
+        ...git(root, ["ls-files", "--others", "--ignored", "--exclude-standard"]).split("\n"),
+    ].filter((f) => f && /(?:^|\/)\.env(?:\.[\w.-]+)?$/.test(f));
+    const findings = [];
+    for (const file of [...tracked, ...untrackedEnv]) {
+        if (SKIP.test(file) || !LIKELY.test(file) || basename(file) === ".env.example")
+            continue;
+        const path = join(root, file);
+        try {
+            if (statSync(path).size > 1_000_000)
+                continue;
+            const text = readFileSync(path, "utf8");
+            // A whole file of intentional fakes (test fixtures) can opt out near its top.
+            if (text.split("\n", 5).some((l) => l.includes(ALLOW_FILE)))
+                continue;
+            findings.push(...scanText(text, file, tracked.has(file)));
+        }
+        catch { /* deleted or unreadable */ }
+    }
+    return findings;
+}
+/** Mask a secret for display: keep a hint of the start and end only. */
+export function mask(value) {
+    const uri = /^(mongodb(?:\+srv)?:\/\/)([^:]+):[^@]+@(.+)$/.exec(value);
+    if (uri)
+        return `${uri[1]}${uri[2]}:••••••@${uri[3]}`;
+    if (value.length <= 8)
+        return "••••••";
+    return `${value.slice(0, 3)}••••••${value.slice(-2)}`;
+}

package/dist/engine/init.js

@@ -0,0 +1,255 @@
+// `leakfix init`: find everything a rotation needs, check that it works, and say
+// exactly what to do about anything missing. Nothing here changes any service.
+import { existsSync, readFileSync } from "node:fs";
+import { basename, join } from "node:path";
+import { AtlasClient, parseMongoUri } from "../providers/atlas.js";
+import { HttpError, request } from "../providers/http.js";
+import { VercelClient } from "../providers/vercel.js";
+const HEALTH_PATHS = ["/health", "/api/health", "/healthz", "/api/healthz"];
+export async function init(input) {
+    const { leaked, existing, creds, fetchImpl = fetch } = input;
+    const checks = [];
+    const config = structuredClone(existing);
+    const done = () => ({ checks, config, ready: !checks.some((c) => c.status === "todo") });
+    const keys = [...new Set(leaked.filter((f) => f.key && (f.kind === "mongodb-uri" || f.kind === "jwt-secret")).map((f) => f.key))];
+    const mongo = leaked.find((f) => f.key && f.kind === "mongodb-uri");
+    if (!keys.length) {
+        checks.push({ status: "ok", label: "No committed secrets that leakfix rotates automatically. `leakfix scan` lists everything it found." });
+        return done();
+    }
+    checks.push({ status: "ok", label: `Committed secrets to rotate: ${keys.join(", ")}` });
+    await checkVercel(checks, config, keys, input, fetchImpl);
+    if (mongo)
+        await checkAtlas(checks, config, mongo, creds, fetchImpl);
+    return done();
+}
+async function checkVercel(checks, config, keys, input, fetchImpl) {
+    const { root, creds, gitRepo } = input;
+    if (!creds.vercelToken) {
+        checks.push({
+            status: "todo", label: "No Vercel token (LEAKFIX_VERCEL_TOKEN)",
+            fix: [
+                "Create one at https://vercel.com/account/settings/tokens (an expiry of 1 day is enough).",
+                `Then, in this terminal: ${hiddenExport("LEAKFIX_VERCEL_TOKEN")}`,
+            ],
+        });
+        return;
+    }
+    try {
+        const me = await new VercelClient(creds.vercelToken, undefined, fetchImpl).user();
+        checks.push({ status: "ok", label: `Vercel token works (signed in as ${me.username})` });
+    }
+    catch (err) {
+        checks.push({ status: "todo", label: `Vercel rejected the token (${errText(err)})`, fix: ["Create a new one at https://vercel.com/account/settings/tokens"] });
+        return;
+    }
+    // Which project? Config first, then the folder's `vercel link`, then the git remote.
+    if (!config.vercel) {
+        const found = linkedProject(root) ?? await projectForRepo(creds.vercelToken, gitRepo, basename(root), fetchImpl);
+        if ("project" in found) {
+            config.vercel = { project: found.project, ...(found.teamId ? { teamId: found.teamId } : {}) };
+            checks.push({ status: "ok", label: `Vercel project: ${found.project}${found.via ? ` (${found.via})` : ""}` });
+        }
+        else {
+            checks.push({
+                status: "todo", label: "Could not tell which Vercel project deploys this repo",
+                fix: [
+                    `Set "vercel": { "project": "<name>" } in leakfix.config.json${found.names.length ? `. Your projects: ${found.names.join(", ")}` : ""}`,
+                    "For a team project, add its \"teamId\" too.",
+                ],
+            });
+            return;
+        }
+    }
+    else {
+        checks.push({ status: "ok", label: `Vercel project: ${config.vercel.project} (from leakfix.config.json)` });
+    }
+    const vercel = new VercelClient(creds.vercelToken, config.vercel.teamId, fetchImpl);
+    const project = config.vercel.project;
+    try {
+        const missing = [];
+        for (const key of keys)
+            if (!(await vercel.findEnv(project, key)).length)
+                missing.push(key);
+        if (missing.length) {
+            checks.push({
+                status: "todo", label: `Not set for production on Vercel: ${missing.join(", ")}`,
+                fix: [`leakfix replaces existing values. Add them under Project → Settings → Environment Variables (Production), or remove them from the rotation.`],
+            });
+        }
+        else {
+            checks.push({ status: "ok", label: `Set for production on Vercel: ${keys.join(", ")}` });
+        }
+    }
+    catch (err) {
+        checks.push({ status: "todo", label: `Cannot read ${project}'s environment variables (${errText(err)})`, fix: ["Check the project name and that the token can access its team."] });
+        return;
+    }
+    // A health URL lets leakfix notice a broken deploy before revoking the old credential.
+    if (config.healthUrl) {
+        const status = await probe(config.healthUrl, fetchImpl);
+        checks.push(status && status < 300
+            ? { status: "ok", label: `Health check: ${config.healthUrl} → ${status}` }
+            : { status: "todo", label: `Health check ${config.healthUrl} answered ${status ?? "nothing"}`, fix: ["Fix the URL in leakfix.config.json, or remove healthUrl."] });
+        return;
+    }
+    let domains = [];
+    try {
+        domains = await vercel.domains(project);
+    }
+    catch { /* fall through to the warning */ }
+    for (const domain of domains) {
+        for (const path of HEALTH_PATHS) {
+            const url = `https://${domain}${path}`;
+            const status = await probe(url, fetchImpl);
+            if (status && status < 300) {
+                config.healthUrl = url;
+                checks.push({
+                    status: "ok", label: `Health check: ${url} → ${status}`,
+                    fix: ["Make sure this route fails when the database is unreachable; otherwise it can't catch a bad credential."],
+                });
+                return;
+            }
+        }
+    }
+    checks.push({
+        status: "warn", label: `No health URL found${domains.length ? ` on ${domains.join(", ")}` : ""}`,
+        fix: [
+            "Without one, leakfix only knows the deploy built, not that the app can reach its database.",
+            "Add a route that pings the database, then set \"healthUrl\" in leakfix.config.json.",
+        ],
+    });
+}
+async function checkAtlas(checks, config, mongo, creds, fetchImpl) {
+    let parts;
+    try {
+        parts = parseMongoUri(mongo.value);
+    }
+    catch {
+        checks.push({ status: "warn", label: `${mongo.key} has no username/password: nothing to rotate on Atlas` });
+        return;
+    }
+    const host = parts.rest.split(/[/?]/)[0];
+    if (!host.endsWith(".mongodb.net")) {
+        checks.push({ status: "warn", label: `${mongo.key} points at ${host}, not MongoDB Atlas: rotate this one by hand` });
+        return;
+    }
+    if (!creds.atlasClientId || !creds.atlasClientSecret) {
+        const ip = await publicIp(fetchImpl);
+        checks.push({
+            status: "todo", label: "No MongoDB Atlas service account (LEAKFIX_ATLAS_CLIENT_ID / LEAKFIX_ATLAS_CLIENT_SECRET)",
+            fix: [
+                "Atlas → your organization → Applications → Service Accounts → Create service account.",
+                `Give it the role "Project Database Access Admin" on the project that has the cluster ${host}.`,
+                `Add this computer to its API Access List: ${ip ? `${range(ip)}  (your IP is ${ip}; the range survives it changing)` : "your public IP"}.`,
+                `Then, in this terminal: export LEAKFIX_ATLAS_CLIENT_ID=<client id>; ${hiddenExport("LEAKFIX_ATLAS_CLIENT_SECRET")}`,
+            ],
+        });
+        return;
+    }
+    const atlas = new AtlasClient(creds.atlasClientId, creds.atlasClientSecret, fetchImpl);
+    let groupId = config.atlas?.groupId;
+    try {
+        if (!groupId) {
+            for (const project of await atlas.listProjects()) {
+                const clusters = await atlas.listClusters(project.id);
+                const cluster = clusters.find((c) => [c.connectionStrings?.standardSrv, c.connectionStrings?.standard].some((s) => s?.includes(host)));
+                if (cluster) {
+                    groupId = project.id;
+                    config.atlas = { groupId };
+                    checks.push({ status: "ok", label: `Atlas project: ${project.name} (cluster ${cluster.name})` });
+                    break;
+                }
+            }
+            if (!groupId) {
+                checks.push({
+                    status: "todo", label: `The service account can't see a project with the cluster ${host}`,
+                    fix: [`Give it the role "Project Database Access Admin" on that project (Atlas → Project → Project Settings → Applications).`],
+                });
+                return;
+            }
+        }
+        await atlas.getUser(groupId, parts.username);
+        checks.push({ status: "ok", label: `Atlas service account can manage database user ${parts.username}` });
+    }
+    catch (err) {
+        checks.push(atlasProblem(err, parts.username));
+    }
+}
+function atlasProblem(err, username) {
+    const text = errText(err);
+    const ip = /IP address ([\d.]+) is not allowed/.exec(text)?.[1];
+    if (ip) {
+        return {
+            status: "todo", label: `Atlas blocks this computer's IP (${ip})`,
+            fix: [`Add ${range(ip)} to the service account's API Access List (Organization → Applications → Service Accounts → your account). The range keeps working when your ISP changes your IP.`],
+        };
+    }
+    if (err instanceof HttpError && err.status === 401) {
+        return { status: "todo", label: "Atlas rejected the service account credentials", fix: ["Check LEAKFIX_ATLAS_CLIENT_ID / LEAKFIX_ATLAS_CLIENT_SECRET, or create a new secret for the service account."] };
+    }
+    if (err instanceof HttpError && err.status === 404) {
+        return { status: "warn", label: `Atlas has no database user ${username}: it may already be deleted (then the leaked password is dead already)` };
+    }
+    if (err instanceof HttpError && err.status === 403) {
+        return { status: "todo", label: `The service account may not manage database users (${text})`, fix: [`Give it "Project Database Access Admin" on the project (not "Project Data Access Admin").`] };
+    }
+    return { status: "todo", label: `Atlas: ${text}` };
+}
+/** `vercel link` leaves .vercel/project.json with the project and its owner. */
+function linkedProject(root) {
+    const file = join(root, ".vercel", "project.json");
+    if (!existsSync(file))
+        return undefined;
+    try {
+        const { projectId, orgId } = JSON.parse(readFileSync(file, "utf8"));
+        if (!projectId)
+            return undefined;
+        return { project: projectId, ...(orgId?.startsWith("team_") ? { teamId: orgId } : {}), via: ".vercel/project.json" };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Look through every project the token can see for one that deploys this repo. */
+async function projectForRepo(token, gitRepo, folder, fetchImpl) {
+    const personal = new VercelClient(token, undefined, fetchImpl);
+    const scopes = [undefined, ...(await personal.teams().catch(() => [])).map((t) => t.id)];
+    const all = [];
+    for (const teamId of scopes) {
+        const projects = await new VercelClient(token, teamId, fetchImpl).projects().catch(() => []);
+        all.push(...projects.map((p) => ({ p, teamId })));
+    }
+    const pick = (hit, via) => hit && { project: hit.p.name, ...(hit.teamId ? { teamId: hit.teamId } : {}), via };
+    const [org, repo] = (gitRepo ?? "").toLowerCase().split("/");
+    const byRepo = repo ? all.filter(({ p }) => p.link?.repo?.toLowerCase() === repo && (!org || p.link?.org?.toLowerCase() === org)) : [];
+    if (byRepo.length === 1)
+        return pick(byRepo[0], `deploys ${gitRepo}`);
+    const byName = all.filter(({ p }) => p.name.toLowerCase() === folder.toLowerCase());
+    if (byName.length === 1)
+        return pick(byName[0], "same name as this folder");
+    return { names: all.map(({ p }) => p.name).slice(0, 15) };
+}
+async function probe(url, fetchImpl) {
+    try {
+        const res = await fetchImpl(url, { signal: AbortSignal.timeout(15_000) });
+        await res.body?.cancel();
+        return res.status;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function publicIp(fetchImpl) {
+    try {
+        return (await request(fetchImpl, "ipify", "https://api.ipify.org?format=json")).ip;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** 113.212.108.26 → 113.212.108.0/24: home ISPs often move you within this range. */
+const range = (ip) => `${ip.split(".").slice(0, 3).join(".")}.0/24`;
+/** Reads a secret without echoing it or saving it in shell history (works in bash and zsh). */
+const hiddenExport = (name) => `stty -echo; printf '${name}: '; read ${name}; stty echo; echo; export ${name}`;
+const errText = (err) => (err instanceof Error ? err.message : String(err));

package/dist/engine/plan.js

@@ -0,0 +1,53 @@
+// A rotation is a list of small, reversible steps. The engine runs them in
+// order; if one fails, it undoes the completed ones in reverse, so a half-done
+// rotation never leaves the app pointing at a credential that doesn't exist.
+export async function execute(plan, log = () => { }) {
+    const events = [];
+    const emit = (step, status, error) => {
+        const e = { at: new Date().toISOString(), target: plan.target, step, status, ...(error ? { error } : {}) };
+        events.push(e);
+        log(e);
+    };
+    const done = [];
+    const finalErrors = [];
+    for (const step of plan.steps) {
+        try {
+            await step.run();
+            emit(step.title, "ok");
+            done.push(step);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            emit(step.title, "failed", message);
+            // Past the point of no return the app already runs on the new credential
+            // and passed its checks. Rolling back would put it back on the leaked
+            // one, so record the failure, try the remaining final steps, and report.
+            if (step.final) {
+                finalErrors.push(`${step.title}: ${message}`);
+                continue;
+            }
+            // Roll back everything that can be rolled back, newest first.
+            for (const prev of [...done].reverse()) {
+                if (prev.final || !prev.undo)
+                    continue;
+                try {
+                    await prev.undo();
+                    emit(prev.title, "undone");
+                }
+                catch (undoErr) {
+                    emit(prev.title, "undo-failed", undoErr instanceof Error ? undoErr.message : String(undoErr));
+                }
+            }
+            for (const rest of plan.steps.slice(plan.steps.indexOf(step) + 1))
+                emit(rest.title, "skipped");
+            return { target: plan.target, ok: false, rolledBack: true, error: message, events };
+        }
+    }
+    if (finalErrors.length) {
+        return {
+            target: plan.target, ok: false, rolledBack: false, events,
+            error: `Rotated, but finish these by hand: ${finalErrors.join("; ")}`,
+        };
+    }
+    return { target: plan.target, ok: true, rolledBack: false, events };
+}

package/dist/engine/repo.js

@@ -0,0 +1,41 @@
+// Stop tracking leaked env files: untrack them, ignore them, and leave an
+// .env.example with the variable names only (never the values).
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync, writeFileSync, appendFileSync } from "node:fs";
+import { join } from "node:path";
+const ENV_FILE = /(?:^|\/)\.env(?:\.[\w.-]+)?$/;
+function git(root, args) {
+    return execFileSync("git", ["-C", root, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+}
+export function fixRepo(root, findings) {
+    const files = [...new Set(findings.filter((f) => f.tracked && ENV_FILE.test(f.file)).map((f) => f.file))];
+    const result = { untracked: [], gitignoreAdded: [] };
+    if (!files.length)
+        return result;
+    for (const file of files) {
+        git(root, ["rm", "--cached", "--quiet", "--", file]);
+        result.untracked.push(file);
+    }
+    const gi = join(root, ".gitignore");
+    const current = existsSync(gi) ? readFileSync(gi, "utf8") : "";
+    const want = [".env", ".env.*", "!.env.example"].filter((p) => !current.split(/\r?\n/).includes(p));
+    if (want.length) {
+        appendFileSync(gi, `${current && !current.endsWith("\n") ? "\n" : ""}# secrets (added by leakfix)\n${want.join("\n")}\n`);
+        result.gitignoreAdded = want;
+    }
+    const example = join(root, ".env.example");
+    if (!existsSync(example)) {
+        const keys = new Set();
+        for (const file of files) {
+            for (const line of readFileSync(join(root, file), "utf8").split(/\r?\n/)) {
+                const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(line);
+                if (m)
+                    keys.add(m[1]);
+            }
+        }
+        writeFileSync(example, [...keys].map((k) => `${k}=`).join("\n") + "\n");
+        result.example = ".env.example";
+    }
+    git(root, ["add", "--", ".gitignore", ...(result.example ? [".env.example"] : [])]);
+    return result;
+}

package/dist/engine/rotations.js

@@ -0,0 +1,173 @@
+// Turns findings into one rotation plan per deployment target.
+//
+// Zero-downtime order, the core idea of leakfix:
+//   1. prepare    mint a NEW credential next to the leaked one (both work)
+//   2. switch     point the app's environment at the new credential
+//   3. redeploy   one production redeploy for all switched variables
+//   4. verify     health check against the new deployment
+//   5. revoke     delete the leaked credential (point of no return)
+// If anything before step 5 fails, every completed step is undone and the app
+// keeps running on the old credential.
+import { randomBytes } from "node:crypto";
+import { mask } from "../detect/scan.js";
+import { AtlasClient, buildMongoUri, parseMongoUri } from "../providers/atlas.js";
+import { request } from "../providers/http.js";
+import { VercelClient } from "../providers/vercel.js";
+const MANUAL_HOWTO = {
+    "smtp-password": "Create a new app password with your email provider, delete the old one, and update the variable.",
+    "vercel-token": "Delete the token at vercel.com/account/tokens and create a new one.",
+    generic: "Revoke this credential where it was issued, create a new one, and update the variable.",
+    "mongodb-uri": "Change the database user's password in MongoDB Atlas → Database Access, then update the variable.",
+    "jwt-secret": "Generate a new random secret (e.g. `openssl rand -hex 32`) and update the variable; users will need to sign in again.",
+};
+function today() {
+    return new Date().toISOString().slice(0, 10).replaceAll("-", "");
+}
+function mongoRotation(f, cfg, atlas) {
+    const old = parseMongoUri(f.value);
+    const newUser = `${old.username.replace(/-lf\d{8}(?:-\d+)?$/, "")}-lf${today()}`;
+    const newPassword = randomBytes(24).toString("base64url");
+    const groupId = cfg.atlas.groupId;
+    return {
+        envKey: f.key,
+        oldValue: f.value,
+        label: `${f.key} (MongoDB Atlas user ${old.username})`,
+        newValue: () => buildMongoUri(old, newUser, newPassword),
+        prepare: {
+            title: `Create database user ${newUser} with the same roles as ${old.username}`,
+            async run() {
+                const current = await atlas.getUser(groupId, old.username);
+                await atlas.createUser({
+                    groupId, databaseName: current.databaseName, username: newUser, password: newPassword,
+                    roles: current.roles, ...(current.scopes?.length ? { scopes: current.scopes } : {}),
+                    description: `Created by leakfix to replace leaked user ${old.username}`,
+                });
+            },
+            undo: () => atlas.deleteUser(groupId, newUser),
+        },
+        revoke: {
+            title: `Delete leaked database user ${old.username}`,
+            run: () => atlas.deleteUser(groupId, old.username),
+            final: true,
+        },
+    };
+}
+function jwtRotation(f) {
+    const value = randomBytes(48).toString("base64url");
+    return {
+        envKey: f.key,
+        oldValue: f.value,
+        label: `${f.key} (JWT signing secret)`,
+        newValue: () => value,
+        prepare: { title: `Generate a new random ${f.key}`, run: async () => { } },
+        // Nothing to revoke: once the app runs with the new secret, tokens signed
+        // with the leaked one stop verifying. Users sign in again.
+    };
+}
+export function buildPlans(findings, cfg, creds, fetchImpl = fetch) {
+    const manual = [];
+    const rotations = [];
+    const atlas = creds.atlasClientId && creds.atlasClientSecret
+        ? new AtlasClient(creds.atlasClientId, creds.atlasClientSecret, fetchImpl) : undefined;
+    // One finding per variable name (the same key often appears in .env and .env.local).
+    const seen = new Set();
+    for (const f of findings) {
+        const id = f.key ?? f.value;
+        if (seen.has(id))
+            continue;
+        seen.add(id);
+        const howTo = MANUAL_HOWTO[f.kind] ?? MANUAL_HOWTO.generic;
+        if (!f.key) {
+            manual.push({ finding: f, reason: "secret is written directly in code, not in an environment variable", howTo: `Move it to an environment variable, then: ${howTo}` });
+        }
+        else if (!cfg.vercel || !creds.vercelToken) {
+            manual.push({ finding: f, reason: "no deployment configured (set vercel.project and LEAKFIX_VERCEL_TOKEN)", howTo });
+        }
+        else if (f.kind === "mongodb-uri") {
+            if (!atlas || !cfg.atlas)
+                manual.push({ finding: f, reason: "no MongoDB Atlas access configured", howTo });
+            else
+                rotations.push(mongoRotation(f, cfg, atlas));
+        }
+        else if (f.kind === "jwt-secret") {
+            rotations.push(jwtRotation(f));
+        }
+        else {
+            manual.push({ finding: f, reason: `leakfix cannot rotate ${f.kind} credentials automatically yet`, howTo });
+        }
+    }
+    if (!rotations.length || !cfg.vercel || !creds.vercelToken)
+        return { plans: [], manual };
+    const project = cfg.vercel.project;
+    const vercel = new VercelClient(creds.vercelToken, cfg.vercel.teamId, fetchImpl);
+    const steps = [];
+    for (const r of rotations)
+        steps.push(r.prepare);
+    for (const r of rotations) {
+        const previous = [];
+        steps.push({
+            title: `Set ${r.envKey} on Vercel project ${project} (production)`,
+            async run() {
+                const entries = await vercel.findEnv(project, r.envKey);
+                if (!entries.length)
+                    throw new Error(`${r.envKey} is not set for production on Vercel project ${project}`);
+                // Remember what to restore on rollback. Never restore an empty value:
+                // if the platform hides the current one, use the leaked value from the repo.
+                for (const e of entries) {
+                    const value = e.value || r.oldValue;
+                    if (!value)
+                        throw new Error(`Cannot read the current value of ${r.envKey}; refusing to change it without a way back`);
+                    previous.push({ id: e.id, value });
+                }
+                for (const e of entries)
+                    await vercel.setEnv(project, e.id, r.newValue());
+            },
+            async undo() {
+                for (const p of previous)
+                    await vercel.setEnv(project, p.id, p.value);
+            },
+        });
+    }
+    let rolledBack = false;
+    steps.push({
+        title: `Redeploy ${project} to production and wait until it is ready`,
+        async run() {
+            const d = await vercel.redeploy(project);
+            await vercel.waitUntilReady(d.id);
+        },
+        // The env was restored by the previous steps' undo, which run after this
+        // one; a fresh redeploy is triggered once at the end of the rollback.
+        async undo() {
+            rolledBack = true;
+        },
+    });
+    if (cfg.healthUrl) {
+        const url = cfg.healthUrl;
+        steps.push({
+            title: `Health check ${url}`,
+            async run() {
+                await request(fetchImpl, "Health check", url, { method: "GET" });
+            },
+        });
+    }
+    for (const r of rotations)
+        if (r.revoke)
+            steps.push(r.revoke);
+    // Rollback tail. The first step's undo runs last, after every env variable is
+    // restored: redeploy first (so production is back on the old credential),
+    // and only then delete the credential minted in step 1.
+    const first = steps[0];
+    const originalUndo = first.undo;
+    first.undo = async () => {
+        if (rolledBack) {
+            const d = await vercel.redeploy(project);
+            await vercel.waitUntilReady(d.id);
+        }
+        await originalUndo?.();
+    };
+    const label = rotations.map((r) => r.label).join(", ");
+    return { plans: [{ target: label, steps }], manual };
+}
+export function describeFinding(f) {
+    return `${f.file}:${f.line}  ${f.key ?? "(inline)"}  ${mask(f.value)}${f.tracked ? "  ← committed to git" : ""}`;
+}

package/dist/providers/atlas.js

@@ -0,0 +1,62 @@
+// MongoDB Atlas Administration API v2.
+// Auth: a Service Account (OAuth 2.0 client credentials) with Project Owner
+// (or a role that can manage database users) on the project.
+import { request } from "./http.js";
+const BASE = "https://cloud.mongodb.com";
+const ACCEPT = "application/vnd.atlas.2023-01-01+json";
+export class AtlasClient {
+    clientId;
+    clientSecret;
+    fetchImpl;
+    token;
+    constructor(clientId, clientSecret, fetchImpl = fetch) {
+        this.clientId = clientId;
+        this.clientSecret = clientSecret;
+        this.fetchImpl = fetchImpl;
+    }
+    async auth() {
+        if (this.token && this.token.expires > Date.now() + 60_000)
+            return this.token.value;
+        const basic = Buffer.from(`${this.clientId}:${this.clientSecret}`).toString("base64");
+        const res = await request(this.fetchImpl, "Atlas", `${BASE}/api/oauth/token`, {
+            method: "POST",
+            headers: { Authorization: `Basic ${basic}`, "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+            body: "grant_type=client_credentials",
+        });
+        this.token = { value: res.access_token, expires: Date.now() + res.expires_in * 1000 };
+        return this.token.value;
+    }
+    async call(method, path, json) {
+        return request(this.fetchImpl, "Atlas", `${BASE}/api/atlas/v2${path}`, {
+            method,
+            headers: { Authorization: `Bearer ${await this.auth()}`, Accept: ACCEPT, ...(json ? { "Content-Type": ACCEPT } : {}) },
+            ...(json !== undefined ? { body: JSON.stringify(json) } : {}),
+        });
+    }
+    /** Projects ("groups") the service account can see. */
+    async listProjects() {
+        return (await this.call("GET", "/groups?itemsPerPage=500")).results;
+    }
+    async listClusters(groupId) {
+        return (await this.call("GET", `/groups/${groupId}/clusters?itemsPerPage=500`)).results;
+    }
+    getUser(groupId, username, databaseName = "admin") {
+        return this.call("GET", `/groups/${groupId}/databaseUsers/${databaseName}/${encodeURIComponent(username)}`);
+    }
+    createUser(user) {
+        return this.call("POST", `/groups/${user.groupId}/databaseUsers`, user);
+    }
+    deleteUser(groupId, username, databaseName = "admin") {
+        return this.call("DELETE", `/groups/${groupId}/databaseUsers/${databaseName}/${encodeURIComponent(username)}`);
+    }
+}
+/** Split mongodb[+srv]://user:pass@host/... into its parts. */
+export function parseMongoUri(uri) {
+    const m = /^(mongodb(?:\+srv)?:\/\/)([^:]+):([^@]+)@(.+)$/.exec(uri);
+    if (!m)
+        throw new Error("Not a MongoDB connection string with credentials");
+    return { scheme: m[1], username: decodeURIComponent(m[2]), password: decodeURIComponent(m[3]), rest: m[4] };
+}
+export function buildMongoUri(parts, username, password) {
+    return `${parts.scheme}${encodeURIComponent(username)}:${encodeURIComponent(password)}@${parts.rest}`;
+}

package/dist/providers/http.js

@@ -0,0 +1,30 @@
+/** Small fetch wrapper: JSON in/out, readable errors that never include secrets. */
+export class HttpError extends Error {
+    status;
+    service;
+    constructor(status, service, message) {
+        super(`${service} ${status}: ${message}`);
+        this.status = status;
+        this.service = service;
+    }
+}
+export async function request(fetchImpl, service, url, init = {}) {
+    const { json, headers, ...rest } = init;
+    const res = await fetchImpl(url, {
+        ...rest,
+        headers: { ...(json !== undefined ? { "Content-Type": "application/json" } : {}), ...headers },
+        ...(json !== undefined ? { body: JSON.stringify(json) } : {}),
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        let detail = text.slice(0, 300);
+        try {
+            const body = JSON.parse(text);
+            detail = body.detail ?? body.error?.message ?? body.message ?? body.errorCode ?? detail;
+        }
+        catch { /* not JSON */ }
+        throw new HttpError(res.status, service, String(detail));
+    }
+    return (text ? JSON.parse(text) : undefined);
+}
+export const sleep = (ms) => new Promise((r) => setTimeout(r, ms));

package/dist/providers/vercel.js

@@ -0,0 +1,88 @@
+// Vercel REST API: environment variables and redeploys.
+// Auth: an access token with access to the project's team.
+import { request, sleep } from "./http.js";
+const BASE = "https://api.vercel.com";
+export class VercelClient {
+    token;
+    teamId;
+    fetchImpl;
+    pollMs;
+    constructor(token, teamId, fetchImpl = fetch, pollMs = 5000) {
+        this.token = token;
+        this.teamId = teamId;
+        this.fetchImpl = fetchImpl;
+        this.pollMs = pollMs;
+    }
+    url(path, query = {}) {
+        const q = new URLSearchParams({ ...query, ...(this.teamId ? { teamId: this.teamId } : {}) });
+        const qs = q.toString();
+        return `${BASE}${path}${qs ? `?${qs}` : ""}`;
+    }
+    headers() {
+        return { Authorization: `Bearer ${this.token}` };
+    }
+    /** Who the token belongs to: a cheap way to check that it works. */
+    async user() {
+        return (await request(this.fetchImpl, "Vercel", this.url("/v2/user"), { headers: this.headers() })).user;
+    }
+    async teams() {
+        return (await request(this.fetchImpl, "Vercel", this.url("/v2/teams"), { headers: this.headers() })).teams;
+    }
+    async projects() {
+        return (await request(this.fetchImpl, "Vercel", this.url("/v9/projects", { limit: "100" }), { headers: this.headers() })).projects;
+    }
+    /** The project's own domains (not redirects), e.g. my-api.vercel.app. */
+    async domains(project) {
+        const res = await request(this.fetchImpl, "Vercel", this.url(`/v9/projects/${encodeURIComponent(project)}/domains`), { headers: this.headers() });
+        return res.domains.filter((d) => !d.redirect).map((d) => d.name);
+    }
+    async listEnv(project) {
+        const res = await request(this.fetchImpl, "Vercel", this.url(`/v10/projects/${encodeURIComponent(project)}/env`, { decrypt: "true" }), { headers: this.headers() });
+        return res.envs;
+    }
+    /** Production entries for a variable name (one key can have several targets). */
+    async findEnv(project, key) {
+        const all = await this.listEnv(project);
+        return all.filter((e) => e.key === key && [e.target].flat().includes("production"));
+    }
+    async setEnv(project, envId, value) {
+        await request(this.fetchImpl, "Vercel", this.url(`/v9/projects/${encodeURIComponent(project)}/env/${envId}`), {
+            method: "PATCH", headers: this.headers(), json: { value },
+        });
+    }
+    async latestProductionDeployment(project) {
+        const res = await request(this.fetchImpl, "Vercel", this.url("/v7/deployments", { projectId: project, target: "production", state: "READY", limit: "1" }), { headers: this.headers() });
+        const d = res.deployments[0];
+        if (!d)
+            throw new Error(`No ready production deployment found for ${project}`);
+        return { id: d.uid, url: d.url };
+    }
+    /** Redeploy the current production deployment so it picks up new env values. */
+    async redeploy(project) {
+        const latest = await this.latestProductionDeployment(project);
+        const current = await request(this.fetchImpl, "Vercel", this.url(`/v13/deployments/${latest.id}`), { headers: this.headers() });
+        // A deployment built from Git must be redeployed from the same commit: naming only the
+        // old deployment makes Vercel fail with git_info_fail.
+        const g = current.gitSource;
+        const source = g?.type && g.repoId && g.sha
+            ? { gitSource: { type: g.type, repoId: g.repoId, ref: g.ref, sha: g.sha } }
+            : { deploymentId: latest.id };
+        return request(this.fetchImpl, "Vercel", this.url("/v13/deployments", { forceNew: "1" }), {
+            method: "POST", headers: this.headers(), json: { name: project, project, target: "production", ...source },
+        });
+    }
+    async waitUntilReady(deploymentId, timeoutMs = 10 * 60_000) {
+        const deadline = Date.now() + timeoutMs;
+        while (Date.now() < deadline) {
+            const d = await request(this.fetchImpl, "Vercel", this.url(`/v13/deployments/${deploymentId}`), { headers: this.headers() });
+            if (d.readyState === "READY")
+                return d;
+            if (d.readyState === "ERROR" || d.readyState === "CANCELED") {
+                const why = [d.errorCode, d.errorMessage].filter(Boolean).join(": ");
+                throw new Error(`Deployment ${deploymentId} ended in ${d.readyState}${why ? ` (${why})` : ""}; build logs: https://vercel.com/deployments/${deploymentId}`);
+            }
+            await sleep(this.pollMs);
+        }
+        throw new Error(`Deployment ${deploymentId} was not ready after ${Math.round(timeoutMs / 60000)} min`);
+    }
+}

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "leakfix",
+  "version": "0.1.0",
+  "description": "Rotate leaked secrets automatically: detect, mint a new credential, redeploy, revoke the old one.",
+  "keywords": [
+    "secrets",
+    "secret-rotation",
+    "leaked-secrets",
+    "security",
+    "devsecops",
+    "mongodb-atlas",
+    "vercel",
+    "jwt",
+    "cli",
+    "github-action"
+  ],
+  "author": "Safayet Hossain",
+  "homepage": "https://github.com/safayet404/leakfix#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/safayet404/leakfix.git"
+  },
+  "bugs": "https://github.com/safayet404/leakfix/issues",
+  "type": "module",
+  "bin": {
+    "leakfix": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "dev": "tsx src/cli.ts",
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "prepublishOnly": "pnpm typecheck && pnpm test && pnpm build"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "license": "MIT",
+  "devDependencies": {
+    "@types/node": "^26.6.3",
+    "tsx": "^4.23.15",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.3"
+  },
+  "packageManager": "pnpm@11.21.0"
+}