sandstream-kit 1.0.0

package/dist/secrets-onecli.js

@@ -0,0 +1,113 @@
+/**
+ * OneCLI integration (https://github.com/onecli/onecli).
+ *
+ * OneCLI is a local HTTP gateway that intercepts outbound agent requests and
+ * injects credentials. Agents see a placeholder; the gateway swaps it for the
+ * real value at egress. This module lets `kit secrets` register entries
+ * with OneCLI directly, so the real credential lives in OneCLI's encrypted
+ * store and never reaches the agent process.
+ *
+ * Auth: API key in `ONECLI_API_KEY` (Bearer oc_*) — generate from the web UI
+ * at http://localhost:10254/settings/api-keys before first use.
+ */
+import { randomBytes } from "node:crypto";
+const DEFAULT_API_URL = "http://127.0.0.1:10254";
+const DEFAULT_GATEWAY_URL = "http://127.0.0.1:10255";
+export function resolveOneCliConfig() {
+    return {
+        apiUrl: process.env.ONECLI_API_URL || DEFAULT_API_URL,
+        gatewayUrl: process.env.ONECLI_GATEWAY_URL || DEFAULT_GATEWAY_URL,
+        apiKey: process.env.ONECLI_API_KEY,
+    };
+}
+export async function checkOneCliStatus(cfg = resolveOneCliConfig()) {
+    const status = {
+        reachable: false,
+        authenticated: false,
+        apiUrl: cfg.apiUrl,
+        gatewayUrl: cfg.gatewayUrl,
+    };
+    try {
+        const res = await fetch(`${cfg.apiUrl}/api/health`, {
+            signal: AbortSignal.timeout(3000),
+        });
+        if (!res.ok) {
+            status.error = `health check returned ${res.status}`;
+            return status;
+        }
+        status.reachable = true;
+        const body = (await res.json().catch(() => null));
+        if (body?.version)
+            status.version = body.version;
+    }
+    catch (err) {
+        status.error = err instanceof Error ? err.message : String(err);
+        return status;
+    }
+    if (!cfg.apiKey) {
+        status.error =
+            "ONECLI_API_KEY not set — generate one at /settings/api-keys";
+        return status;
+    }
+    try {
+        const res = await fetch(`${cfg.apiUrl}/api/user`, {
+            headers: { Authorization: `Bearer ${cfg.apiKey}` },
+            signal: AbortSignal.timeout(3000),
+        });
+        status.authenticated = res.ok;
+        if (!res.ok)
+            status.error = `auth check returned ${res.status}`;
+    }
+    catch (err) {
+        status.error = err instanceof Error ? err.message : String(err);
+    }
+    return status;
+}
+/**
+ * Registers a secret with OneCLI. Returns the created secret's id.
+ *
+ * Caller is responsible for writing a placeholder to `.env.local` separately —
+ * OneCLI doesn't generate or return one, since the gateway matches by host
+ * pattern, not by placeholder value.
+ */
+export async function registerSecretInOneCli(input, cfg = resolveOneCliConfig()) {
+    if (!cfg.apiKey) {
+        throw new Error("ONECLI_API_KEY not set — generate one in OneCLI's UI (Settings → API Keys)");
+    }
+    const body = {
+        name: input.name,
+        type: "generic",
+        value: input.value,
+        hostPattern: input.hostPattern,
+        pathPattern: input.pathPattern,
+        injectionConfig: input.injectionConfig ?? {
+            headerName: "Authorization",
+            valueFormat: "Bearer {value}",
+        },
+    };
+    const res = await fetch(`${cfg.apiUrl}/api/secrets`, {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${cfg.apiKey}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(10000),
+    });
+    if (!res.ok) {
+        const text = await res.text().catch(() => "");
+        throw new Error(`OneCLI POST /api/secrets returned ${res.status}: ${text}`);
+    }
+    const json = (await res.json());
+    return { id: json.id, name: json.name };
+}
+/**
+ * Generates a placeholder value to write into `.env.local`. The actual value
+ * is irrelevant to OneCLI — the gateway matches by host pattern — but a
+ * recognizable prefix (`PCLI_`) helps grep/audit tooling identify which
+ * env vars are gateway-routed.
+ */
+export function generatePlaceholder() {
+    return `PCLI_${randomBytes(12).toString("base64url")}`;
+}
+//# sourceMappingURL=secrets-onecli.js.map

package/dist/secrets-onecli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-onecli.js","sourceRoot":"","sources":["../src/secrets-onecli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,eAAe,GAAG,wBAAwB,CAAC;AACjD,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAQrD,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,eAAe;QACrD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,mBAAmB;QACjE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;KACnC,CAAC;AACJ,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAoB,mBAAmB,EAAE;IAEzC,MAAM,MAAM,GAAiB;QAC3B,SAAS,EAAE,KAAK;QAChB,aAAa,EAAE,KAAK;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;KAC3B,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,aAAa,EAAE;YAClD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,CAAC,KAAK,GAAG,yBAAyB,GAAG,CAAC,MAAM,EAAE,CAAC;YACrD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAExC,CAAC;QACT,IAAI,IAAI,EAAE,OAAO;YAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IACnD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,CAAC,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK;YACV,6DAA6D,CAAC;QAChE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,WAAW,EAAE;YAChD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE,EAAE;YAClD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,MAAM,CAAC,aAAa,GAAG,GAAG,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,CAAC,KAAK,GAAG,uBAAuB,GAAG,CAAC,MAAM,EAAE,CAAC;IAClE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,CAAC,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAwBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA0B,EAC1B,MAAoB,mBAAmB,EAAE;IAEzC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,SAAkB;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI;YACxC,UAAU,EAAE,eAAe;YAC3B,WAAW,EAAE,gBAAgB;SAC9B;KACF,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,cAAc,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE;YACrC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC;IAChE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,QAAQ,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACzD,CAAC"}

package/dist/secrets-propagate.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Push a credential value to one or more deploy-platform secret stores.
+ *
+ * Used by `kit secrets rotate --propagate <targets>` so a rotated key
+ * lands in every place the running service reads it from, not just the
+ * upstream vault. Each adapter shells out to the platform's official CLI;
+ * the value is piped via stdin where the CLI supports it to keep it out of
+ * argv / process listings.
+ *
+ * Targets implemented:
+ *   - vercel       `vercel env add <name> <env>` (stdin)
+ *   - github       `gh secret set <name>` (stdin)
+ *   - fly          `fly secrets set <name>=<value> --stage` (argv — Fly has
+ *                  no stdin path; documented as a known leak surface)
+ *   - cloudflare   `wrangler secret put <name>` (stdin)
+ *   - railway      `railway variables --set <name>=<value>` (argv)
+ *   - aws-ssm      `aws ssm put-parameter --name <key> --value file:///dev/stdin
+ *                  --type SecureString --overwrite` (stdin via --value file://)
+ */
+export type PropagationTarget = "vercel" | "github" | "fly" | "cloudflare" | "railway" | "aws-ssm";
+export declare const ALL_TARGETS: PropagationTarget[];
+export interface PropagationResult {
+    target: PropagationTarget;
+    ok: boolean;
+    detail: string;
+    /** True if the value passed through argv at any point (informational). */
+    valueInArgv: boolean;
+}
+export interface PropagationOptions {
+    /** Logical env to write into (Vercel: "production"|"preview"|"development"). */
+    env?: "production" | "preview" | "development";
+    /** Vercel scope (team or user). */
+    vercelScope?: string;
+    /** GitHub repo (owner/name). Inferred from `gh repo view` when omitted. */
+    githubRepo?: string;
+    /** Fly app name. Required for fly. */
+    flyApp?: string;
+    /** Cloudflare worker name. Required for cloudflare. */
+    cfWorker?: string;
+    /** Railway service id. */
+    railwayService?: string;
+    /** AWS region for SSM. */
+    awsRegion?: string;
+    /** Optional override path prefix for SSM (default: `/kit/`). */
+    awsSsmPrefix?: string;
+}
+export declare function propagate(name: string, value: string, targets: PropagationTarget[], opts?: PropagationOptions): Promise<PropagationResult[]>;
+export declare function parseTargets(spec: string): PropagationTarget[];

package/dist/secrets-propagate.js

@@ -0,0 +1,201 @@
+/**
+ * Push a credential value to one or more deploy-platform secret stores.
+ *
+ * Used by `kit secrets rotate --propagate <targets>` so a rotated key
+ * lands in every place the running service reads it from, not just the
+ * upstream vault. Each adapter shells out to the platform's official CLI;
+ * the value is piped via stdin where the CLI supports it to keep it out of
+ * argv / process listings.
+ *
+ * Targets implemented:
+ *   - vercel       `vercel env add <name> <env>` (stdin)
+ *   - github       `gh secret set <name>` (stdin)
+ *   - fly          `fly secrets set <name>=<value> --stage` (argv — Fly has
+ *                  no stdin path; documented as a known leak surface)
+ *   - cloudflare   `wrangler secret put <name>` (stdin)
+ *   - railway      `railway variables --set <name>=<value>` (argv)
+ *   - aws-ssm      `aws ssm put-parameter --name <key> --value file:///dev/stdin
+ *                  --type SecureString --overwrite` (stdin via --value file://)
+ */
+import { spawn } from "node:child_process";
+export const ALL_TARGETS = [
+    "vercel",
+    "github",
+    "fly",
+    "cloudflare",
+    "railway",
+    "aws-ssm",
+];
+/**
+ * Spawns a CLI with the value piped via stdin. Returns the exit code +
+ * captured stderr for diagnostics. The value never appears in argv.
+ */
+async function spawnWithStdin(cmd, args, stdinValue) {
+    return new Promise((resolve) => {
+        const child = spawn(cmd, args, { stdio: ["pipe", "pipe", "pipe"] });
+        let stderr = "";
+        child.stderr.on("data", (chunk) => {
+            stderr += chunk.toString();
+        });
+        child.on("error", (err) => {
+            resolve({ code: 127, stderr: err.message });
+        });
+        child.on("close", (code) => {
+            resolve({ code: code ?? 1, stderr });
+        });
+        child.stdin.write(stdinValue);
+        child.stdin.end();
+    });
+}
+async function propagateVercel(name, value, opts) {
+    const env = opts.env ?? "production";
+    // vercel env add accepts the value via stdin when invoked non-interactively
+    // and printed to a stream that has no TTY.
+    const args = ["env", "add", name, env];
+    if (opts.vercelScope)
+        args.push("--scope", opts.vercelScope);
+    // Remove existing first so add doesn't error on duplicate.
+    await spawnWithStdin("vercel", ["env", "rm", name, env, "--yes", ...(opts.vercelScope ? ["--scope", opts.vercelScope] : [])], "");
+    const { code, stderr } = await spawnWithStdin("vercel", args, value);
+    return {
+        target: "vercel",
+        ok: code === 0,
+        detail: code === 0 ? `pushed to vercel env=${env}` : `vercel exit ${code}: ${stderr.split("\n")[0]}`,
+        valueInArgv: false,
+    };
+}
+async function propagateGithub(name, value, opts) {
+    const args = ["secret", "set", name];
+    if (opts.githubRepo)
+        args.push("--repo", opts.githubRepo);
+    if (opts.env === "production")
+        args.push("--env", "production");
+    if (opts.env === "preview")
+        args.push("--env", "preview");
+    // gh secret set reads value from stdin when --body is not provided.
+    const { code, stderr } = await spawnWithStdin("gh", args, value);
+    return {
+        target: "github",
+        ok: code === 0,
+        detail: code === 0 ? `pushed to github secrets` : `gh exit ${code}: ${stderr.split("\n")[0]}`,
+        valueInArgv: false,
+    };
+}
+async function propagateFly(name, value, opts) {
+    if (!opts.flyApp) {
+        return {
+            target: "fly",
+            ok: false,
+            detail: "fly: --fly-app <name> required",
+            valueInArgv: false,
+        };
+    }
+    // `fly secrets set` reads KEY=VALUE pairs from argv; no stdin path.
+    // Value is visible in `ps` for the duration of the call.
+    const { code, stderr } = await spawnWithStdin("fly", ["secrets", "set", `${name}=${value}`, "--app", opts.flyApp, "--stage"], "");
+    return {
+        target: "fly",
+        ok: code === 0,
+        detail: code === 0 ? `pushed to fly app=${opts.flyApp}` : `fly exit ${code}: ${stderr.split("\n")[0]}`,
+        valueInArgv: true,
+    };
+}
+async function propagateCloudflare(name, value, opts) {
+    if (!opts.cfWorker) {
+        return {
+            target: "cloudflare",
+            ok: false,
+            detail: "cloudflare: --cf-worker <name> required",
+            valueInArgv: false,
+        };
+    }
+    const { code, stderr } = await spawnWithStdin("wrangler", ["secret", "put", name, "--name", opts.cfWorker], value);
+    return {
+        target: "cloudflare",
+        ok: code === 0,
+        detail: code === 0 ? `pushed to cloudflare worker=${opts.cfWorker}` : `wrangler exit ${code}: ${stderr.split("\n")[0]}`,
+        valueInArgv: false,
+    };
+}
+async function propagateRailway(name, value, opts) {
+    // `railway variables --set KEY=VALUE` — value in argv (no stdin path).
+    const args = ["variables", "--set", `${name}=${value}`];
+    if (opts.railwayService)
+        args.push("--service", opts.railwayService);
+    const { code, stderr } = await spawnWithStdin("railway", args, "");
+    return {
+        target: "railway",
+        ok: code === 0,
+        detail: code === 0 ? `pushed to railway` : `railway exit ${code}: ${stderr.split("\n")[0]}`,
+        valueInArgv: true,
+    };
+}
+async function propagateAwsSsm(name, value, opts) {
+    const prefix = opts.awsSsmPrefix ?? "/kit/";
+    const paramName = `${prefix}${name}`.replace(/\/+/g, "/");
+    // `aws ssm put-parameter --value file:///dev/stdin` reads the value from
+    // stdin instead of argv.
+    const args = [
+        "ssm",
+        "put-parameter",
+        "--name",
+        paramName,
+        "--value",
+        "file:///dev/stdin",
+        "--type",
+        "SecureString",
+        "--overwrite",
+    ];
+    if (opts.awsRegion)
+        args.push("--region", opts.awsRegion);
+    const { code, stderr } = await spawnWithStdin("aws", args, value);
+    return {
+        target: "aws-ssm",
+        ok: code === 0,
+        detail: code === 0 ? `pushed to aws-ssm path=${paramName}` : `aws exit ${code}: ${stderr.split("\n")[0]}`,
+        valueInArgv: false,
+    };
+}
+const ADAPTERS = {
+    vercel: propagateVercel,
+    github: propagateGithub,
+    fly: propagateFly,
+    cloudflare: propagateCloudflare,
+    railway: propagateRailway,
+    "aws-ssm": propagateAwsSsm,
+};
+export async function propagate(name, value, targets, opts = {}) {
+    const results = [];
+    for (const t of targets) {
+        const adapter = ADAPTERS[t];
+        if (!adapter) {
+            results.push({
+                target: t,
+                ok: false,
+                detail: `unknown target: ${t}`,
+                valueInArgv: false,
+            });
+            continue;
+        }
+        try {
+            results.push(await adapter(name, value, opts));
+        }
+        catch (err) {
+            results.push({
+                target: t,
+                ok: false,
+                detail: err instanceof Error ? err.message.split("\n")[0] : String(err),
+                valueInArgv: false,
+            });
+        }
+    }
+    return results;
+}
+export function parseTargets(spec) {
+    const known = new Set(ALL_TARGETS);
+    return spec
+        .split(",")
+        .map((t) => t.trim())
+        .filter((t) => known.has(t));
+}
+//# sourceMappingURL=secrets-propagate.js.map

package/dist/secrets-propagate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-propagate.js","sourceRoot":"","sources":["../src/secrets-propagate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAU3C,MAAM,CAAC,MAAM,WAAW,GAAwB;IAC9C,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,YAAY;IACZ,SAAS;IACT,SAAS;CACV,CAAC;AA6BF;;;GAGG;AACH,KAAK,UAAU,cAAc,CAC3B,GAAW,EACX,IAAc,EACd,UAAkB;IAElB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9B,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,IAAY,EACZ,KAAa,EACb,IAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,YAAY,CAAC;IACrC,4EAA4E;IAC5E,2CAA2C;IAC3C,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,WAAW;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7D,2DAA2D;IAC3D,MAAM,cAAc,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClI,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACrE,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,EAAE,EAAE,IAAI,KAAK,CAAC;QACd,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC,CAAC,eAAe,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;QACpG,WAAW,EAAE,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,IAAY,EACZ,KAAa,EACb,IAAwB;IAExB,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,UAAU;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,IAAI,CAAC,GAAG,KAAK,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAChE,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,oEAAoE;IACpE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACjE,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,EAAE,EAAE,IAAI,KAAK,CAAC;QACd,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,WAAW,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;QAC7F,WAAW,EAAE,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,KAAa,EACb,IAAwB;IAExB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO;YACL,MAAM,EAAE,KAAK;YACb,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gCAAgC;YACxC,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC;IACD,oEAAoE;IACpE,yDAAyD;IACzD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAC3C,KAAK,EACL,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EACvE,EAAE,CACH,CAAC;IACF,OAAO;QACL,MAAM,EAAE,KAAK;QACb,EAAE,EAAE,IAAI,KAAK,CAAC;QACd,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,qBAAqB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;QACtG,WAAW,EAAE,IAAI;KAClB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,IAAY,EACZ,KAAa,EACb,IAAwB;IAExB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,yCAAyC;YACjD,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAC3C,UAAU,EACV,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAChD,KAAK,CACN,CAAC;IACF,OAAO;QACL,MAAM,EAAE,YAAY;QACpB,EAAE,EAAE,IAAI,KAAK,CAAC;QACd,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,+BAA+B,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,iBAAiB,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;QACvH,WAAW,EAAE,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,IAAY,EACZ,KAAa,EACb,IAAwB;IAExB,uEAAuE;IACvE,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,cAAc;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IACrE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACnE,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,EAAE,EAAE,IAAI,KAAK,CAAC;QACd,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;QAC3F,WAAW,EAAE,IAAI;KAClB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,IAAY,EACZ,KAAa,EACb,IAAwB;IAExB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC;IAC5C,MAAM,SAAS,GAAG,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1D,yEAAyE;IACzE,yBAAyB;IACzB,MAAM,IAAI,GAAG;QACX,KAAK;QACL,eAAe;QACf,QAAQ;QACR,SAAS;QACT,SAAS;QACT,mBAAmB;QACnB,QAAQ;QACR,cAAc;QACd,aAAa;KACd,CAAC;IACF,IAAI,IAAI,CAAC,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAClE,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,EAAE,EAAE,IAAI,KAAK,CAAC;QACd,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,0BAA0B,SAAS,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;QACzG,WAAW,EAAE,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAGV;IACF,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,eAAe;IACvB,GAAG,EAAE,YAAY;IACjB,UAAU,EAAE,mBAAmB;IAC/B,OAAO,EAAE,gBAAgB;IACzB,SAAS,EAAE,eAAe;CAC3B,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAY,EACZ,KAAa,EACb,OAA4B,EAC5B,OAA2B,EAAE;IAE7B,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,CAAC;gBACT,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,mBAAmB,CAAC,EAAE;gBAC9B,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,CAAC;gBACT,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACvE,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACnC,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAA0B,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAsB,CAAC,CAAC,CAAC;AAC9E,CAAC"}

package/dist/secrets-pull.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `kit secrets pull --from <platform> --env <env>` — read env-vars
+ * from a deploy-platform (Vercel / Fly / Cloudflare / GitHub Actions)
+ * and write them into the local vault. Closes the "I forgot what
+ * value is in Vercel" gap that drove the kjorre incident.
+ *
+ * Read-only by nature of the source side (vendor REST is GET-only here).
+ * Write side honors KIT_READ_ONLY=1 via writeSecretToBackend.
+ */
+import type { SecretsConfig } from "./config.js";
+export type PullSource = "vercel" | "github" | "fly" | "cloudflare";
+export interface PullOptions {
+    source: PullSource;
+    /** Deploy-platform-specific environment name (production / preview / dev). */
+    env?: string;
+    /** Project / repo / app identifier passed to the source plugin. */
+    projectId?: string;
+    /** Skip writing to vault; just list what would be pulled. */
+    dryRun?: boolean;
+    /** Target vault store. Defaults to config.secrets.store. */
+    store?: SecretsConfig["store"];
+}
+export interface PullResult {
+    source: PullSource;
+    discovered: number;
+    written: number;
+    skipped: number;
+    items: Array<{
+        key: string;
+        status: "written" | "skipped" | "would-write";
+        detail: string;
+    }>;
+}
+export declare function pullSecrets(config: SecretsConfig | undefined, opts: PullOptions): Promise<PullResult>;

package/dist/secrets-pull.js

@@ -0,0 +1,118 @@
+/**
+ * `kit secrets pull --from <platform> --env <env>` — read env-vars
+ * from a deploy-platform (Vercel / Fly / Cloudflare / GitHub Actions)
+ * and write them into the local vault. Closes the "I forgot what
+ * value is in Vercel" gap that drove the kjorre incident.
+ *
+ * Read-only by nature of the source side (vendor REST is GET-only here).
+ * Write side honors KIT_READ_ONLY=1 via writeSecretToBackend.
+ */
+import { writeSecretToBackend } from "./secrets-migrate.js";
+/**
+ * Fetches env-vars from the source platform. Each source uses its
+ * existing kit-plugin's read-only API. Tokens come from the operator's
+ * shell env per plugin convention (VERCEL_TOKEN, GITHUB_TOKEN, FLY_API_TOKEN,
+ * CLOUDFLARE_API_TOKEN).
+ */
+async function fetchFromSource(source, projectId, env) {
+    if (source === "vercel") {
+        const { makeClient, listEnvVars } = await import("sandstream-kit-plugin-vercel");
+        const client = makeClient();
+        const all = await listEnvVars(client, projectId);
+        return all
+            .filter((e) => env ? (e.target ?? []).includes(env) : true)
+            .map((e) => ({
+            key: e.key,
+            value: e.value ?? "",
+            target: e.target,
+        }))
+            .filter((e) => e.value.length > 0);
+    }
+    if (source === "github") {
+        // GitHub Actions secrets are write-only via the API (you can list names
+        // but never read values back). We surface name-only so the operator
+        // knows what's defined upstream.
+        const { makeClient, listRepoSecrets } = await import("sandstream-kit-plugin-github");
+        const [owner, repo] = projectId.split("/");
+        if (!owner || !repo) {
+            throw new Error("github source requires projectId in 'owner/repo' format");
+        }
+        const client = makeClient();
+        const secrets = await listRepoSecrets(client, owner, repo);
+        // Returning empty value — operator must hand-fill from another source.
+        return secrets.map((s) => ({ key: s.name, value: "" }));
+    }
+    if (source === "fly") {
+        // Fly secret VALUES are not retrievable via API (digest-only). Same
+        // name-only path as GitHub.
+        const { makeClient, listAppSecrets } = await import("sandstream-kit-plugin-fly");
+        const client = makeClient();
+        const secrets = await listAppSecrets(client, projectId);
+        return secrets.map((s) => ({ key: s.name, value: "" }));
+    }
+    if (source === "cloudflare") {
+        const { makeClient, listWorkerSecrets } = await import("sandstream-kit-plugin-cloudflare");
+        const client = makeClient();
+        const secrets = await listWorkerSecrets(client, projectId);
+        return secrets.map((s) => ({ key: s.name, value: "" }));
+    }
+    throw new Error(`Unknown pull source: ${source}`);
+}
+export async function pullSecrets(config, opts) {
+    if (!opts.projectId) {
+        throw new Error("--project <id> required");
+    }
+    const source = opts.source;
+    const env = opts.env;
+    const found = await fetchFromSource(source, opts.projectId, env);
+    const result = {
+        source,
+        discovered: found.length,
+        written: 0,
+        skipped: 0,
+        items: [],
+    };
+    const store = opts.store ?? config?.store;
+    for (const item of found) {
+        if (!item.value) {
+            result.items.push({
+                key: item.key,
+                status: "skipped",
+                detail: source === "github" || source === "fly" || source === "cloudflare"
+                    ? "vendor API does not expose secret value (name-only)"
+                    : "empty value at source",
+            });
+            result.skipped++;
+            continue;
+        }
+        if (opts.dryRun) {
+            result.items.push({
+                key: item.key,
+                status: "would-write",
+                detail: `would write to ${store ?? "(no store configured)"}`,
+            });
+            continue;
+        }
+        if (!store || store === "env") {
+            result.items.push({
+                key: item.key,
+                status: "skipped",
+                detail: "no vault backend configured ([secrets].store)",
+            });
+            result.skipped++;
+            continue;
+        }
+        const write = await writeSecretToBackend(store, item.key, item.value);
+        result.items.push({
+            key: item.key,
+            status: write.ok ? "written" : "skipped",
+            detail: write.detail,
+        });
+        if (write.ok)
+            result.written++;
+        else
+            result.skipped++;
+    }
+    return result;
+}
+//# sourceMappingURL=secrets-pull.js.map

package/dist/secrets-pull.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-pull.js","sourceRoot":"","sources":["../src/secrets-pull.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAwB5D;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAkB,EAClB,SAAiB,EACjB,GAAY;IAEZ,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAC9C,8BAAwC,CACzC,CAAC;QACF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACjD,OAAO,GAAG;aACP,MAAM,CAAC,CAAC,CAAwC,EAAE,EAAE,CACnD,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAC5C;aACA,GAAG,CAAC,CAAC,CAAqD,EAAE,EAAE,CAAC,CAAC;YAC/D,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC;aACF,MAAM,CAAC,CAAC,CAAoB,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,wEAAwE;QACxE,oEAAoE;QACpE,iCAAiC;QACjC,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAClD,8BAAwC,CACzC,CAAC;QACF,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC3D,uEAAuE;QACvE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,oEAAoE;QACpE,4BAA4B;QAC5B,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CACjD,2BAAqC,CACtC,CAAC;QACF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACxD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CACpD,kCAA4C,CAC7C,CAAC;QACF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC3D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAiC,EACjC,IAAiB;IAEjB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,MAAM,GAAe;QACzB,MAAM;QACN,UAAU,EAAE,KAAK,CAAC,MAAM;QACxB,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,EAAE;KACV,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,EAAE,KAAK,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;gBAChB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,SAAS;gBACjB,MAAM,EACJ,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,YAAY;oBAChE,CAAC,CAAC,qDAAqD;oBACvD,CAAC,CAAC,uBAAuB;aAC9B,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;gBAChB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,kBAAkB,KAAK,IAAI,uBAAuB,EAAE;aAC7D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;gBAChB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,+CAA+C;aACxD,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;YAChB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACxC,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,EAAE;YAAE,MAAM,CAAC,OAAO,EAAE,CAAC;;YAC1B,MAAM,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/secrets-purge-history.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Destructive git-history secret scrubbing — opt-in only.
+ *
+ * When a credential lands in a committed file the next thing to do is
+ * rotate it; the value in `git log` keeps leaking until the history is
+ * rewritten. This module wraps `git filter-repo` (preferred) or `bfg-repo-
+ * cleaner` (fallback) to remove the value from every commit in the repo.
+ *
+ * **Destructive**: rewrites every commit hash from the first affected commit
+ * forward, force-pushing is required afterwards, and every existing clone
+ * (including CI runners, teammates' laptops, deploy pipelines that fork
+ * from the same remote) must re-clone — pulling won't catch up cleanly.
+ *
+ * For this reason the CLI surface always requires:
+ *   1. A live elevation marker (from `kit auth elevate`)
+ *   2. An explicit `--force-history` flag — no auto-run, no default
+ *   3. Confirmation prompt with the full impact spelled out, unless
+ *      `--yes` is set (CI escape hatch; still requires elevation)
+ */
+export type Tool = "git-filter-repo" | "bfg";
+export interface ToolStatus {
+    filterRepoAvailable: boolean;
+    bfgAvailable: boolean;
+}
+export declare function detectTools(): Promise<ToolStatus>;
+export interface PurgePreview {
+    pattern: string;
+    matchedCommits: number;
+    matchedFiles: string[];
+    sampleHashes: string[];
+}
+/**
+ * Reports how many commits in the current branch's history reference the
+ * pattern. Useful for showing impact before the destructive step.
+ */
+export declare function previewMatches(pattern: string, cwd?: string): Promise<PurgePreview>;
+export interface PurgeResult {
+    toolUsed: Tool;
+    ok: boolean;
+    detail: string;
+}
+/**
+ * Runs `git filter-repo --replace-text <file>` where the replacement file
+ * contains one regex per line in `pattern==>***REDACTED***` syntax. Falls
+ * back to `bfg --replace-text` when filter-repo is missing. The replacement
+ * file is created in a tempdir and removed after the run.
+ *
+ * Caller is responsible for:
+ *   - confirming the destructive action with the user
+ *   - holding a fresh elevation marker
+ *   - communicating "force-push + re-clone for everyone" afterwards
+ */
+export declare function purgeHistory(patterns: string[], cwd?: string): Promise<PurgeResult>;