sandstream-kit 1.0.0

package/dist/check-design.js

@@ -0,0 +1,256 @@
+/**
+ * Design / a11y / structural enforcement.
+ *
+ * Built-in checks (zero extra deps):
+ *   - Static a11y: scans .tsx/.jsx for common omissions
+ *       <img> without alt
+ *       <button> with no text/aria-label
+ *       <a> without text/aria-label or href
+ *       form inputs without an associated <label>/aria-labelledby
+ *   - Design-token consistency: flags hex colors / px values that
+ *     bypass the design-tokens module (configurable token glob).
+ *   - File-naming convention: optional regex per directory.
+ *
+ * Heavy checks (axe-core, Percy) are delegated to external tools via
+ * the plugin contract — see docs/PLUGIN_CHECKS.md.
+ */
+import { readdir, readFile, access } from "node:fs/promises";
+import { join, resolve, relative, extname } from "node:path";
+async function pathExists(p) {
+    try {
+        await access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function walkSources(root, exts) {
+    const out = [];
+    async function visit(dir) {
+        let entries;
+        try {
+            entries = await readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            const full = join(dir, e.name);
+            if (e.isDirectory()) {
+                if (e.name === "node_modules" || e.name === "dist" || e.name === ".next")
+                    continue;
+                if (e.name.startsWith("."))
+                    continue;
+                await visit(full);
+                continue;
+            }
+            if (e.isFile() && exts.includes(extname(e.name)))
+                out.push(full);
+        }
+    }
+    await visit(root);
+    return out;
+}
+const A11Y_RULES = [
+    {
+        id: "img-alt",
+        pattern: /<img\s+(?![^>]*\balt\s*=)[^>]*\/?>/,
+        description: "<img> without alt attribute",
+    },
+    {
+        id: "button-empty",
+        // <button>...</button> with NO text content and no aria-label / aria-labelledby
+        pattern: /<button\s+(?![^>]*\baria-label(?:ledby)?\s*=)[^>]*>\s*<\/button>/,
+        description: "<button> with no text or aria-label",
+    },
+    {
+        id: "anchor-no-href",
+        pattern: /<a\s+(?![^>]*\bhref\s*=)[^>]*>/,
+        description: "<a> without href",
+    },
+    {
+        id: "input-no-label",
+        // <input> with no aria-label/aria-labelledby (label-association is harder
+        // to verify statically, so we only flag the obvious missing-aria case)
+        pattern: /<input\s+(?![^>]*\baria-label(?:ledby)?\s*=)(?![^>]*\btype\s*=\s*['"](?:hidden|submit|button)['"])[^>]*\/?>/,
+        description: "<input> without aria-label (and not type=hidden/submit/button)",
+    },
+];
+async function scanA11y(srcRoots) {
+    const findings = [];
+    for (const root of srcRoots) {
+        if (!(await pathExists(root)))
+            continue;
+        const files = await walkSources(root, [".tsx", ".jsx", ".astro", ".vue"]);
+        for (const file of files) {
+            let content;
+            try {
+                content = await readFile(file, "utf-8");
+            }
+            catch {
+                continue;
+            }
+            const lines = content.split("\n");
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                for (const rule of A11Y_RULES) {
+                    if (rule.pattern.test(line)) {
+                        findings.push({
+                            file: relative(process.cwd(), file),
+                            line: i + 1,
+                            rule: rule.id,
+                            snippet: line.trim().slice(0, 120),
+                        });
+                    }
+                }
+            }
+        }
+    }
+    return findings;
+}
+async function scanTokenBypass(srcRoots, tokenFiles) {
+    const findings = [];
+    for (const root of srcRoots) {
+        if (!(await pathExists(root)))
+            continue;
+        const files = await walkSources(root, [".ts", ".tsx", ".css", ".scss", ".module.css"]);
+        for (const file of files) {
+            // Allow token-definition files themselves to use raw values.
+            if (tokenFiles.some((t) => file.includes(t)))
+                continue;
+            let content;
+            try {
+                content = await readFile(file, "utf-8");
+            }
+            catch {
+                continue;
+            }
+            const lines = content.split("\n");
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                const hex = line.match(/#[0-9a-f]{3,8}\b/i);
+                if (hex) {
+                    findings.push({
+                        file: relative(process.cwd(), file),
+                        line: i + 1,
+                        kind: "raw-hex",
+                        match: hex[0],
+                    });
+                }
+                const px = line.match(/\b\d{2,}px\b/);
+                if (px && !line.includes("border")) {
+                    findings.push({
+                        file: relative(process.cwd(), file),
+                        line: i + 1,
+                        kind: "raw-px",
+                        match: px[0],
+                    });
+                }
+            }
+        }
+    }
+    return findings;
+}
+export async function checkDesign(opts = {}) {
+    const srcRoots = (opts.srcRoots ?? ["src", "app", "components"]).map((d) => resolve(process.cwd(), d));
+    const tokenFiles = opts.tokenFiles ?? ["design-tokens", "tokens.ts", "theme.ts"];
+    const enforce = opts.enforce ?? false;
+    const results = [];
+    // Only run if at least one source root exists AND has tsx/jsx/component
+    // files. kit's own src/ is pure TypeScript with no React, so this
+    // returns "skip" here.
+    let anyComponentRoot = false;
+    for (const root of srcRoots) {
+        if (await pathExists(root)) {
+            const files = await walkSources(root, [".tsx", ".jsx", ".astro", ".vue"]);
+            if (files.length > 0) {
+                anyComponentRoot = true;
+                break;
+            }
+        }
+    }
+    if (!anyComponentRoot) {
+        results.push({
+            category: "design",
+            name: "a11y (static scan)",
+            status: "skip",
+            detail: "no tsx/jsx/astro/vue files found",
+        });
+        return results;
+    }
+    // A11y
+    const a11y = await scanA11y(srcRoots);
+    const a11yBaseline = new Set(opts.baseline?.a11y ?? []);
+    const newA11y = a11y.filter((f) => !a11yBaseline.has(`${f.file}:${f.rule}`));
+    if (a11y.length === 0) {
+        results.push({
+            category: "design",
+            name: "a11y (static scan)",
+            status: "pass",
+            detail: "no obvious a11y omissions",
+        });
+    }
+    else if (newA11y.length === 0) {
+        results.push({
+            category: "design",
+            name: "a11y (static scan)",
+            status: "warn",
+            detail: `${a11y.length} pre-existing a11y finding(s) (baseline-frozen)`,
+            severity: "low",
+        });
+    }
+    else {
+        results.push({
+            category: "design",
+            name: "a11y (static scan)",
+            status: enforce ? "fail" : "warn",
+            detail: `${newA11y.length} new a11y finding(s) (${a11y.length} total)`,
+            severity: enforce ? "high" : "medium",
+            files: newA11y.slice(0, 10).map((f) => `${f.file}:${f.line} [${f.rule}] ${f.snippet}`),
+        });
+    }
+    // Design tokens
+    const tokenFindings = await scanTokenBypass(srcRoots, tokenFiles);
+    const tokenBaseline = new Set(opts.baseline?.tokens ?? []);
+    const newTokens = tokenFindings.filter((f) => !tokenBaseline.has(`${f.file}:${f.kind}:${f.match}`));
+    if (tokenFindings.length === 0) {
+        results.push({
+            category: "design",
+            name: "design-token consistency",
+            status: "pass",
+            detail: "no raw hex/px values found in components",
+        });
+    }
+    else if (newTokens.length === 0) {
+        results.push({
+            category: "design",
+            name: "design-token consistency",
+            status: "warn",
+            detail: `${tokenFindings.length} pre-existing raw value(s) (baseline-frozen)`,
+            severity: "low",
+        });
+    }
+    else {
+        results.push({
+            category: "design",
+            name: "design-token consistency",
+            status: enforce ? "fail" : "warn",
+            detail: `${newTokens.length} new raw value(s) — should use design tokens`,
+            severity: enforce ? "high" : "medium",
+            files: newTokens.slice(0, 10).map((f) => `${f.file}:${f.line} ${f.kind}=${f.match}`),
+        });
+    }
+    return results;
+}
+/** Exposed so `kit baseline freeze` can snapshot these into .kit-baseline.json. */
+export async function collectDesignKeys() {
+    const srcRoots = ["src", "app", "components"].map((d) => resolve(process.cwd(), d));
+    const a11y = await scanA11y(srcRoots);
+    const tokens = await scanTokenBypass(srcRoots, ["design-tokens", "tokens.ts", "theme.ts"]);
+    return {
+        a11y: a11y.map((f) => `${f.file}:${f.rule}`),
+        tokens: tokens.map((f) => `${f.file}:${f.kind}:${f.match}`),
+    };
+}
+//# sourceMappingURL=check-design.js.map

package/dist/check-design.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-design.js","sourceRoot":"","sources":["../src/check-design.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAW7D,KAAK,UAAU,UAAU,CAAC,CAAS;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAc;IACrD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,UAAU,KAAK,CAAC,GAAW;QAC9B,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpB,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;oBAAE,SAAS;gBACnF,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACrC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,GAAG,CAAC;AACb,CAAC;AASD,MAAM,UAAU,GAAgE;IAC9E;QACE,EAAE,EAAE,SAAS;QACb,OAAO,EAAE,oCAAoC;QAC7C,WAAW,EAAE,6BAA6B;KAC3C;IACD;QACE,EAAE,EAAE,cAAc;QAClB,gFAAgF;QAChF,OAAO,EAAE,kEAAkE;QAC3E,WAAW,EAAE,qCAAqC;KACnD;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,gCAAgC;QACzC,WAAW,EAAE,kBAAkB;KAChC;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,0EAA0E;QAC1E,uEAAuE;QACvE,OAAO,EAAE,6GAA6G;QACtH,WAAW,EAAE,gEAAgE;KAC9E;CACF,CAAC;AAEF,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;YAAE,SAAS;QACxC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;oBAC9B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC5B,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC;4BACnC,IAAI,EAAE,CAAC,GAAG,CAAC;4BACX,IAAI,EAAE,IAAI,CAAC,EAAE;4BACb,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;yBACnC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AASD,KAAK,UAAU,eAAe,CAC5B,QAAkB,EAClB,UAAoB;IAEpB,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;YAAE,SAAS;QACxC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;QACvF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,6DAA6D;YAC7D,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YACvD,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBAC5C,IAAI,GAAG,EAAE,CAAC;oBACR,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC;wBACnC,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,IAAI,EAAE,SAAS;wBACf,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;qBACd,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;gBACtC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACnC,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC;wBACnC,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,IAAI,EAAE,QAAQ;wBACd,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;qBACb,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAK9B,EAAE;IACJ,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACzE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAC1B,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,OAAO,GAAwB,EAAE,CAAC;IAExC,wEAAwE;IACxE,kEAAkE;IAClE,uBAAuB;IACvB,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,gBAAgB,GAAG,IAAI,CAAC;gBACxB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,kCAAkC;SAC3C,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO;IACP,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAE7E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,2BAA2B;SACpC,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,iDAAiD;YACvE,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACjC,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,yBAAyB,IAAI,CAAC,MAAM,SAAS;YACtE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;YACrC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;SACvF,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB;IAChB,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAC5D,CAAC;IAEF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,0CAA0C;SACnD,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,8CAA8C;YAC7E,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACjC,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,8CAA8C;YACzE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;YACrC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;SACrF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IAC3F,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC"}

package/dist/check-gitignore.d.ts

@@ -0,0 +1,39 @@
+/**
+ * .gitignore validator. Checks that the project's `.gitignore` covers the
+ * paths that historically leak credentials when accidentally committed.
+ *
+ * Two operations:
+ *   - `verify(cwd)` — returns the list of patterns that should be present
+ *                     but aren't
+ *   - `patch(cwd)`  — appends missing entries to `.gitignore` (or creates
+ *                     the file). Idempotent — re-running is a no-op.
+ *
+ * `.gitignore` semantics are minimal here: we string-match by line, ignore
+ * comments, and require an exact pattern match (no globbing equivalence —
+ * if the user has `**.env*` instead of `.env*`, kit still nudges them).
+ */
+export interface IgnoreCheckResult {
+    exists: boolean;
+    presentPatterns: string[];
+    missingPatterns: {
+        pattern: string;
+        reason: string;
+    }[];
+}
+export declare function checkGitignore(cwd?: string): Promise<IgnoreCheckResult>;
+/**
+ * Appends the missing patterns to `.gitignore`, creating the file if needed.
+ * Adds a single kit-managed block at the bottom so we can recognize it on
+ * re-runs and not duplicate.
+ */
+export declare function patchGitignore(cwd?: string): Promise<{
+    added: number;
+    written: boolean;
+}>;
+/**
+ * Lightweight tracked-file scanner — walks the git index for paths that
+ * SHOULD have been ignored but aren't. Returns the offending tracked
+ * filenames. Useful for the "already committed before .gitignore was set
+ * up" case where adding the pattern doesn't help.
+ */
+export declare function findCommittedSensitive(cwd?: string): Promise<string[]>;

package/dist/check-gitignore.js

@@ -0,0 +1,156 @@
+/**
+ * .gitignore validator. Checks that the project's `.gitignore` covers the
+ * paths that historically leak credentials when accidentally committed.
+ *
+ * Two operations:
+ *   - `verify(cwd)` — returns the list of patterns that should be present
+ *                     but aren't
+ *   - `patch(cwd)`  — appends missing entries to `.gitignore` (or creates
+ *                     the file). Idempotent — re-running is a no-op.
+ *
+ * `.gitignore` semantics are minimal here: we string-match by line, ignore
+ * comments, and require an exact pattern match (no globbing equivalence —
+ * if the user has `**.env*` instead of `.env*`, kit still nudges them).
+ */
+import { readFile, writeFile, access, stat } from "node:fs/promises";
+import { resolve } from "node:path";
+const REQUIRED_PATTERNS = [
+    { pattern: ".env", reason: "default dotenv file", aliases: [".env*", "**/.env"] },
+    { pattern: ".env.local", reason: "local secrets materialized by kit secrets", aliases: [".env*"] },
+    { pattern: ".env.*.local", reason: "per-env local secrets", aliases: [".env*"] },
+    { pattern: "node_modules", reason: "dependency tree", aliases: ["node_modules/"] },
+    { pattern: ".kit/", reason: "kit local state (elevation, env, runtime)", aliases: [".kit", ".kit/*"] },
+    { pattern: ".kit-audit.jsonl", reason: "audit log can contain secret labels + paths" },
+    { pattern: "*.pem", reason: "PEM keys / certs" },
+    { pattern: "*.key", reason: "private keys" },
+    { pattern: "id_rsa", reason: "SSH private key", aliases: ["id_rsa*"] },
+    { pattern: "id_ed25519", reason: "SSH ed25519 private key", aliases: ["id_ed25519*"] },
+    { pattern: "*.p12", reason: "PKCS#12 bundle (TLS certs + keys)" },
+    { pattern: "*-service-account*.json", reason: "GCP service-account JSON keys" },
+];
+function parseGitignore(text) {
+    return text
+        .split("\n")
+        .map((l) => {
+        // Strip inline comments (everything after first unescaped `#`),
+        // matching how our patch helper writes `pattern  # reason`.
+        const hashIdx = l.indexOf("#");
+        const noComment = hashIdx >= 0 ? l.slice(0, hashIdx) : l;
+        return noComment.trim();
+    })
+        .filter((l) => l.length > 0);
+}
+export async function checkGitignore(cwd = process.cwd()) {
+    const path = resolve(cwd, ".gitignore");
+    let exists = false;
+    let lines = [];
+    try {
+        await access(path);
+        exists = true;
+        const text = await readFile(path, "utf-8");
+        lines = parseGitignore(text);
+    }
+    catch {
+        // file missing — every required pattern is "missing"
+    }
+    const present = new Set(lines);
+    const missing = [];
+    const matched = [];
+    for (const entry of REQUIRED_PATTERNS) {
+        const candidates = [entry.pattern, ...(entry.aliases ?? [])];
+        const found = candidates.find((p) => present.has(p));
+        if (found) {
+            matched.push(entry.pattern);
+        }
+        else {
+            missing.push({ pattern: entry.pattern, reason: entry.reason });
+        }
+    }
+    return {
+        exists,
+        presentPatterns: matched,
+        missingPatterns: missing,
+    };
+}
+/**
+ * Appends the missing patterns to `.gitignore`, creating the file if needed.
+ * Adds a single kit-managed block at the bottom so we can recognize it on
+ * re-runs and not duplicate.
+ */
+export async function patchGitignore(cwd = process.cwd()) {
+    const result = await checkGitignore(cwd);
+    if (result.missingPatterns.length === 0) {
+        return { added: 0, written: false };
+    }
+    const path = resolve(cwd, ".gitignore");
+    let existing = "";
+    try {
+        await access(path);
+        existing = await readFile(path, "utf-8");
+    }
+    catch {
+        existing = "";
+    }
+    // Find the kit-managed block; replace it if present so the same patch
+    // command stays idempotent.
+    const MARKER_START = "# ── kit security check-gitignore ── do not edit ──";
+    const MARKER_END = "# ── /kit ──";
+    const block = [
+        MARKER_START,
+        ...result.missingPatterns.map((m) => `${m.pattern}  # ${m.reason}`),
+        MARKER_END,
+        "",
+    ].join("\n");
+    let next;
+    if (existing.includes(MARKER_START) && existing.includes(MARKER_END)) {
+        const before = existing.split(MARKER_START)[0].trimEnd();
+        const after = existing.split(MARKER_END)[1] ?? "";
+        next = `${before}\n\n${block}${after}`;
+    }
+    else {
+        const trimmed = existing.trimEnd();
+        next = trimmed.length > 0 ? `${trimmed}\n\n${block}` : block;
+    }
+    await writeFile(path, next, "utf-8");
+    return { added: result.missingPatterns.length, written: true };
+}
+/**
+ * Lightweight tracked-file scanner — walks the git index for paths that
+ * SHOULD have been ignored but aren't. Returns the offending tracked
+ * filenames. Useful for the "already committed before .gitignore was set
+ * up" case where adding the pattern doesn't help.
+ */
+export async function findCommittedSensitive(cwd = process.cwd()) {
+    const { execFile } = await import("node:child_process");
+    const { promisify } = await import("node:util");
+    const exec = promisify(execFile);
+    try {
+        const { stdout } = await exec("git", ["ls-files"], { cwd, timeout: 5_000 });
+        const tracked = stdout.split("\n").filter(Boolean);
+        const offenders = [];
+        for (const path of tracked) {
+            const base = path.split("/").pop() ?? path;
+            // `.env`, `.env.local`, `.env.local.prod-backup`, etc.
+            // Excluded as harmless: any path that ends in `.template`,
+            // `.example`, `.sample` (covers `.env.staging.example` too).
+            if (/^\.env(\..+)?$/.test(base) &&
+                !/\.(template|example|sample)$/.test(base))
+                offenders.push(path);
+            if (base.endsWith(".pem") || base.endsWith(".key") || base.endsWith(".p12"))
+                offenders.push(path);
+            if (base === "id_rsa" || base.startsWith("id_rsa."))
+                offenders.push(path);
+            if (base === "id_ed25519" || base.startsWith("id_ed25519."))
+                offenders.push(path);
+            if (/-service-account.*\.json$/.test(base))
+                offenders.push(path);
+        }
+        return [...new Set(offenders)];
+    }
+    catch {
+        return [];
+    }
+}
+// Suppress unused-import warning for stat — kept for future size-cap checks.
+void stat;
+//# sourceMappingURL=check-gitignore.js.map

package/dist/check-gitignore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-gitignore.js","sourceRoot":"","sources":["../src/check-gitignore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAepC,MAAM,iBAAiB,GAAoB;IACzC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE;IACjF,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,2CAA2C,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE;IAClG,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,uBAAuB,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE;IAChF,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,EAAE;IAClF,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,2CAA2C,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;IACtG,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,6CAA6C,EAAE;IACtF,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAChD,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE;IAC5C,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE;IACtE,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE;IACtF,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,mCAAmC,EAAE;IACjE,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,+BAA+B,EAAE;CAChF,CAAC;AAEF,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,gEAAgE;QAChE,4DAA4D;QAC5D,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACxC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,OAAO,GAA0C,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,eAAe,EAAE,OAAO;QACxB,eAAe,EAAE,OAAO;KACzB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACtC,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACxC,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACnB,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;IAED,sEAAsE;IACtE,4BAA4B;IAC5B,MAAM,YAAY,GAAG,qDAAqD,CAAC;IAC3E,MAAM,UAAU,GAAG,cAAc,CAAC;IAClC,MAAM,KAAK,GAAG;QACZ,YAAY;QACZ,GAAG,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QACnE,UAAU;QACV,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,IAAI,IAAY,CAAC;IACjB,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,GAAG,GAAG,MAAM,OAAO,KAAK,GAAG,KAAK,EAAE,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/D,CAAC;IACD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACxD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAC3B,KAAK,EACL,CAAC,UAAU,CAAC,EACZ,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CACxB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;YAC3C,uDAAuD;YACvD,2DAA2D;YAC3D,6DAA6D;YAC7D,IACE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC3B,CAAC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC1C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClG,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1E,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClF,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,KAAK,IAAI,CAAC"}

package/dist/check-hooks.d.ts

@@ -0,0 +1,15 @@
+import type { HooksConfig } from "./config.js";
+export interface HookCheckResult {
+    hookName: string;
+    installed: boolean;
+    upToDate: boolean;
+    detail: string;
+}
+/**
+ * Check if git hooks are installed and up-to-date
+ */
+export declare function checkHooks(config: HooksConfig, gitDir?: string): Promise<HookCheckResult[]>;
+/**
+ * Check if git directory exists
+ */
+export declare function isGitRepository(gitDir?: string): boolean;

package/dist/check-hooks.js

@@ -0,0 +1,72 @@
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { existsSync } from "node:fs";
+/**
+ * Check if git hooks are installed and up-to-date
+ */
+export async function checkHooks(config, gitDir = ".git") {
+    const results = [];
+    const hooksDir = resolve(process.cwd(), gitDir, "hooks");
+    for (const [hookName, commands] of Object.entries(config)) {
+        if (!commands || commands.length === 0) {
+            continue;
+        }
+        const result = await checkHook(hooksDir, hookName, commands);
+        results.push(result);
+    }
+    return results;
+}
+/**
+ * Check a single git hook
+ */
+async function checkHook(hooksDir, hookName, commands) {
+    const hookPath = resolve(hooksDir, hookName);
+    // Check if hook file exists
+    if (!existsSync(hookPath)) {
+        return {
+            hookName,
+            installed: false,
+            upToDate: false,
+            detail: "not installed",
+        };
+    }
+    try {
+        // Read hook content
+        const content = await readFile(hookPath, "utf-8");
+        // Check if it's a kit-generated hook
+        if (!content.includes("# Generated by kit")) {
+            return {
+                hookName,
+                installed: true,
+                upToDate: false,
+                detail: "not managed by kit",
+            };
+        }
+        // Check if commands match
+        const upToDate = commands.every((cmd) => content.includes(cmd));
+        return {
+            hookName,
+            installed: true,
+            upToDate,
+            detail: upToDate
+                ? `${commands.length} command(s)`
+                : "outdated (run kit hooks install)",
+        };
+    }
+    catch (error) {
+        return {
+            hookName,
+            installed: true,
+            upToDate: false,
+            detail: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+/**
+ * Check if git directory exists
+ */
+export function isGitRepository(gitDir = ".git") {
+    const gitPath = resolve(process.cwd(), gitDir);
+    return existsSync(gitPath);
+}
+//# sourceMappingURL=check-hooks.js.map

package/dist/check-hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-hooks.js","sourceRoot":"","sources":["../src/check-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAUrC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAmB,EACnB,MAAM,GAAG,MAAM;IAEf,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAEzD,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,SAAS,CACtB,QAAgB,EAChB,QAAgB,EAChB,QAAkB;IAElB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE7C,4BAA4B;IAC5B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,QAAQ;YACR,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,eAAe;SACxB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,oBAAoB;QACpB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAElD,qCAAqC;QACrC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC5C,OAAO;gBACL,QAAQ;gBACR,SAAS,EAAE,IAAI;gBACf,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,oBAAoB;aAC7B,CAAC;QACJ,CAAC;QAED,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAEhE,OAAO;YACL,QAAQ;YACR,SAAS,EAAE,IAAI;YACf,QAAQ;YACR,MAAM,EAAE,QAAQ;gBACd,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,aAAa;gBACjC,CAAC,CAAC,kCAAkC;SACvC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,QAAQ;YACR,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,MAAM,GAAG,MAAM;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC"}

package/dist/check-lock.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Check lock file status
+ */
+import type { kitConfig } from "./config.js";
+export interface LockCheckResult {
+    category: "skills-lock" | "cli-lock";
+    exists: boolean;
+    inSync: boolean;
+    missing: string[];
+    detail: string;
+    authRequired?: string[];
+}
+/**
+ * Check lock files against config
+ */
+export declare function checkLockFiles(config: kitConfig): Promise<LockCheckResult[]>;