sandstream-kit 1.1.0 → 1.3.0

package/dist/commands/audit.d.ts

@@ -0,0 +1 @@
+export declare function cmdAudit(): Promise<boolean>;

package/dist/commands/audit.js

@@ -0,0 +1,99 @@
+// `kit audit` commands — extracted from cli.ts (split step 4).
+import { readSecretAuditEvents, groupBySecret, summarize } from "../audit-secrets.js";
+import { readAuditLog } from "../audit.js";
+import { printAuditTable } from "../output.js";
+import { loadConfig } from "../config.js";
+import { resolveConfigPath } from "../cli-shared.js";
+import { c } from "../utils/colors.js";
+import { hasFlag, flagValue } from "../utils/flags.js";
+async function cmdAuditSecrets() {
+    const args = process.argv.slice(4); // after "audit secrets"
+    const sinceIdx = args.indexOf("--since-days");
+    const sinceDays = sinceIdx >= 0 && args[sinceIdx + 1] ? parseInt(args[sinceIdx + 1], 10) : 30;
+    const keyFilter = flagValue(args, "--key");
+    const jsonMode = hasFlag(args, "--json");
+    const events = await readSecretAuditEvents(process.cwd(), sinceDays);
+    const { reports, unattributed } = groupBySecret(events);
+    const filteredReports = keyFilter
+        ? reports.filter((r) => r.key === keyFilter)
+        : reports;
+    const summary = summarize(filteredReports, sinceDays);
+    if (jsonMode) {
+        console.log(JSON.stringify({ summary, reports: filteredReports, unattributed }, null, 2));
+        return true;
+    }
+    console.log(`${c.bold}${c.cyan}kit audit secrets${c.reset}  ${c.dim}(last ${sinceDays}d)${c.reset}`);
+    console.log(`${c.dim}${"─".repeat(50)}${c.reset}\n`);
+    if (events.length === 0) {
+        console.log(`${c.dim}No secret-related events in audit log (.kit-audit.jsonl).${c.reset}\n`);
+        return true;
+    }
+    console.log(`${c.bold}${summary.totalEvents}${c.reset} event(s) across ${c.bold}${summary.keyCount}${c.reset} key(s)`);
+    if (summary.topKey) {
+        console.log(`${c.dim}Most touched: ${c.bold}${summary.topKey.key}${c.reset}${c.dim} (${summary.topKey.count} events)${c.reset}`);
+    }
+    console.log();
+    for (const r of filteredReports.slice(0, 20)) {
+        console.log(`${c.bold}${r.key}${c.reset}  ${c.dim}(${r.events.length} events)${c.reset}`);
+        for (const e of r.events.slice(-10)) {
+            const icon = e.success ? `${c.green}✓${c.reset}` : `${c.red}✗${c.reset}`;
+            const ts = e.timestamp.slice(0, 19);
+            const agent = e.agent ? `[${e.agent}]` : "";
+            const detail = e.detail ? `  ${c.dim}${e.detail}${c.reset}` : "";
+            console.log(`  ${icon} ${ts}  ${e.operation}  ${c.dim}${agent}${c.reset}${detail}`);
+        }
+        if (r.events.length > 10) {
+            console.log(`  ${c.dim}… ${r.events.length - 10} earlier events truncated${c.reset}`);
+        }
+        console.log();
+    }
+    if (!keyFilter && unattributed.length > 0) {
+        console.log(`${c.dim}+ ${unattributed.length} event(s) couldn't be tied to a specific key. Use ${c.bold}--json${c.reset}${c.dim} for the full set.${c.reset}\n`);
+    }
+    return true;
+}
+export async function cmdAudit() {
+    const args = process.argv.slice(3);
+    // Sub-sub: kit audit secrets [--since-days N] [--key NAME] [--json]
+    if (args[0] === "secrets") {
+        return cmdAuditSecrets();
+    }
+    // Parse --limit N
+    let limit = 20;
+    const limitIdx = args.indexOf("--limit");
+    if (limitIdx !== -1 && args[limitIdx + 1]) {
+        const parsed = parseInt(args[limitIdx + 1], 10);
+        if (!isNaN(parsed) && parsed > 0)
+            limit = parsed;
+    }
+    // Parse --operation <name>
+    let operationFilter;
+    const opIdx = args.indexOf("--operation");
+    if (opIdx !== -1 && args[opIdx + 1]) {
+        operationFilter = args[opIdx + 1];
+    }
+    // Determine log file path (use config if available, else default)
+    let logFile = ".kit-audit.jsonl";
+    try {
+        const config = await loadConfig(resolveConfigPath());
+        const govFile = config.governance?.audit?.log_file;
+        if (govFile)
+            logFile = govFile;
+    }
+    catch {
+        // No .kit.toml — use default log file
+    }
+    let events = await readAuditLog(logFile, limit * 5); // read extra to allow filtering
+    if (operationFilter) {
+        events = events.filter((e) => e.operation.includes(operationFilter));
+    }
+    // Apply limit after filter
+    events = events.slice(-limit);
+    printAuditTable(events);
+    if (events.length > 0) {
+        console.log();
+        console.log(`${c.dim}Showing ${events.length} entries from ${logFile}${c.reset}`);
+    }
+    return true;
+}
+//# sourceMappingURL=audit.js.map

package/dist/commands/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/commands/audit.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEvD,KAAK,UAAU,eAAe;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,SAAS,GACb,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEzC,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACrE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,eAAe,GAAG,SAAS;QAC/B,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC;QAC5C,CAAC,CAAC,OAAO,CAAC;IACZ,MAAM,OAAO,GAAG,SAAS,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAEtD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAC7E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,oBAAoB,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,SAAS,SAAS,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACrG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAErD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,CAAC,GAAG,4DAA4D,CAAC,CAAC,KAAK,IAAI,CAChF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,SAAS,CAC1G,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,WAAW,CAAC,CAAC,KAAK,EAAE,CACpH,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,WAAW,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1F,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACzE,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,EAAE,KAAK,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,MAAM,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,4BAA4B,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;IAED,IAAI,CAAC,SAAS,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,CAAC,GAAG,KAAK,YAAY,CAAC,MAAM,qDAAqD,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,qBAAqB,CAAC,CAAC,KAAK,IAAI,CACpJ,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,oEAAoE;IACpE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,eAAe,EAAE,CAAC;IAC3B,CAAC;IAED,kBAAkB;IAClB,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;YAAE,KAAK,GAAG,MAAM,CAAC;IACnD,CAAC;IAED,2BAA2B;IAC3B,IAAI,eAAmC,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QACpC,eAAe,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,kEAAkE;IAClE,IAAI,OAAO,GAAG,kBAAkB,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC;QACnD,IAAI,OAAO;YAAE,OAAO,GAAG,OAAO,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;IAED,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,gCAAgC;IAErF,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,eAAgB,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,2BAA2B;IAC3B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;IAE9B,eAAe,CAAC,MAAM,CAAC,CAAC;IAExB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,WAAW,MAAM,CAAC,MAAM,iBAAiB,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/commands/auth.d.ts

@@ -0,0 +1 @@
+export declare function cmdAuth(): Promise<boolean>;

package/dist/commands/auth.js

@@ -0,0 +1,121 @@
+// `kit auth` commands (TOTP enrollment + elevation) — extracted from cli.ts (split step 3).
+import { grantElevation, clearElevation, readElevation, verifyTotp, elevationTtlMinutes, enrollTotp, resolveTotpSecret, } from "../elevation.js";
+import { isNonInteractive } from "../environment.js";
+import { promptConfirm } from "../utils/prompt.js";
+import { c } from "../utils/colors.js";
+import { hasFlag, flagValue } from "../utils/flags.js";
+export async function cmdAuth() {
+    const sub = process.argv[3];
+    if (sub === "elevate")
+        return cmdAuthElevate();
+    if (sub === "status")
+        return cmdAuthStatus();
+    if (sub === "revoke")
+        return cmdAuthRevoke();
+    if (sub === "setup-totp")
+        return cmdAuthSetupTotp();
+    console.error(`${c.red}Usage: kit auth [elevate | status | revoke | setup-totp]${c.reset}`);
+    return false;
+}
+async function cmdAuthSetupTotp() {
+    // kit auth setup-totp [--issuer <name>] [--account <user@host>] [--overwrite]
+    const args = process.argv.slice(4);
+    const issuerIdx = args.indexOf("--issuer");
+    const accountIdx = args.indexOf("--account");
+    const overwrite = hasFlag(args, "--overwrite");
+    const issuer = issuerIdx >= 0 ? args[issuerIdx + 1] : "kit";
+    const defaultAccount = `${process.env.USER ?? "user"}@${process.env.HOSTNAME ?? "host"}`;
+    const accountName = accountIdx >= 0 ? args[accountIdx + 1] : defaultAccount;
+    console.log(`${c.bold}${c.cyan}kit auth setup-totp${c.reset}`);
+    console.log(`${c.dim}${"─".repeat(50)}${c.reset}\n`);
+    let result;
+    try {
+        result = await enrollTotp({ accountName, issuer, overwrite });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`${c.red}✗ ${msg}${c.reset}`);
+        console.error(`${c.dim}If you intentionally want to replace the existing secret, re-run with ${c.bold}--overwrite${c.reset}${c.dim} (your old authenticator entry will stop working).${c.reset}\n`);
+        return false;
+    }
+    console.log(`  ${c.green}✓${c.reset} secret written to ${result.filePath}  ${c.dim}(chmod 600)${c.reset}\n`);
+    console.log(`${c.bold}Provisioning URI:${c.reset}`);
+    console.log(`  ${c.dim}${result.uri}${c.reset}\n`);
+    console.log(`${c.bold}Or enter the secret manually in your authenticator app:${c.reset}`);
+    console.log(`  ${c.bold}Secret:${c.reset}  ${result.secret}`);
+    console.log(`  ${c.bold}Account:${c.reset} ${accountName}`);
+    console.log(`  ${c.bold}Issuer:${c.reset}  ${issuer}\n`);
+    console.log(`${c.bold}Verify enrollment — the next 6-digit code should be:${c.reset}`);
+    console.log(`  ${c.bold}${result.currentCode}${c.reset}  ${c.dim}(or the one shown in your authenticator right now)${c.reset}\n`);
+    console.log(`${c.dim}Future ${c.bold}kit auth elevate${c.reset}${c.dim} runs will prompt for the TOTP code automatically.${c.reset}`);
+    console.log(`${c.dim}Override with ${c.bold}KIT_TOTP_SECRET=...${c.reset}${c.dim} in CI / scripted contexts.${c.reset}\n`);
+    return true;
+}
+async function cmdAuthElevate() {
+    const args = process.argv.slice(4);
+    const scope = flagValue(args, "--scope") ?? "all";
+    const ttlIdx = args.indexOf("--ttl-minutes");
+    if (ttlIdx >= 0 && args[ttlIdx + 1]) {
+        const n = parseInt(args[ttlIdx + 1], 10);
+        if (Number.isFinite(n) && n > 0 && n <= 240) {
+            process.env.KIT_ELEVATION_TTL_MINUTES = String(n);
+        }
+    }
+    console.log(`${c.bold}${c.cyan}kit auth elevate${c.reset}  ${c.dim}(scope=${scope})${c.reset}`);
+    console.log(`${c.dim}${"─".repeat(50)}${c.reset}\n`);
+    if (isNonInteractive()) {
+        console.error(`${c.red}✗ Elevation requires an interactive TTY. Cannot run from agent / CI.${c.reset}`);
+        console.error(`${c.dim}For CI deploy jobs that legitimately need a destructive op, set ${c.bold}KIT_ELEVATED=1${c.reset}${c.dim} (and audit-log the use).${c.reset}\n`);
+        return false;
+    }
+    // Resolve from env first, then ~/.kit/totp-secret (created by
+    // `kit auth setup-totp`).
+    const totpSecret = await resolveTotpSecret();
+    let method = "yes-prompt";
+    if (totpSecret) {
+        method = "totp";
+        const readline = await import("node:readline/promises");
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+        try {
+            const code = (await rl.question(`Enter 6-digit TOTP from your authenticator: `)).trim();
+            if (!verifyTotp(code, totpSecret)) {
+                console.error(`${c.red}✗ Invalid TOTP code.${c.reset}`);
+                return false;
+            }
+        }
+        finally {
+            rl.close();
+        }
+    }
+    else {
+        const ok = await promptConfirm(`Confirm elevation [type YES, default no in 15s]: `, 15_000, false);
+        if (!ok) {
+            console.log(`${c.dim}Aborted.${c.reset}`);
+            return false;
+        }
+    }
+    const state = await grantElevation(scope, method);
+    console.log(`  ${c.green}✓${c.reset} elevated  ${c.dim}scope=${state.scope}  method=${state.method}  expires=${state.expiresAt}${c.reset}`);
+    console.log(`\n${c.dim}Destructive secret ops (rotate, migrate, onecli register, propagate) are unlocked for ${elevationTtlMinutes()}m. Run ${c.bold}kit auth revoke${c.reset}${c.dim} to drop early.${c.reset}\n`);
+    return true;
+}
+async function cmdAuthStatus() {
+    const state = await readElevation(process.cwd());
+    if (!state) {
+        console.log(`${c.dim}Not elevated.${c.reset}`);
+        return true;
+    }
+    const expires = Date.parse(state.expiresAt);
+    const valid = Number.isFinite(expires) && expires > Date.now();
+    const status = valid
+        ? `${c.green}active${c.reset}  ${c.dim}(expires ${state.expiresAt})${c.reset}`
+        : `${c.red}expired${c.reset}  ${c.dim}(at ${state.expiresAt})${c.reset}`;
+    console.log(`${status}  scope=${state.scope}  method=${state.method}  granter=${state.granter}`);
+    return true;
+}
+async function cmdAuthRevoke() {
+    await clearElevation(process.cwd());
+    console.log(`${c.green}✓${c.reset} elevation marker cleared.`);
+    return true;
+}
+//# sourceMappingURL=auth.js.map

package/dist/commands/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,OAAO,EACL,cAAc,EACd,cAAc,EACd,aAAa,EACb,UAAU,EACV,mBAAmB,EACnB,UAAU,EACV,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,cAAc,EAAE,CAAC;IAC/C,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,aAAa,EAAE,CAAC;IAC7C,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,aAAa,EAAE,CAAC;IAC7C,IAAI,GAAG,KAAK,YAAY;QAAE,OAAO,gBAAgB,EAAE,CAAC;IACpD,OAAO,CAAC,KAAK,CACX,GAAG,CAAC,CAAC,GAAG,2DAA2D,CAAC,CAAC,KAAK,EAAE,CAC7E,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,gBAAgB;IAC7B,8EAA8E;IAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAE/C,MAAM,MAAM,GAAG,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5D,MAAM,cAAc,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,EAAE,CAAC;IACzF,MAAM,WAAW,GAAG,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;IAE5E,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,sBAAsB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAErD,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,KAAK,CACX,GAAG,CAAC,CAAC,GAAG,yEAAyE,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,qDAAqD,CAAC,CAAC,KAAK,IAAI,CACrL,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,sBAAsB,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAC7G,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,oBAAoB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,0DAA0D,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,uDAAuD,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,qDAAqD,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAClI,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,qDAAqD,CAAC,CAAC,KAAK,EAAE,CACzH,CAAC;IACF,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,sBAAsB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,8BAA8B,CAAC,CAAC,KAAK,IAAI,CAC9G,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,cAAc;IAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,KAAK,CAAC;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAChG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAErD,IAAI,gBAAgB,EAAE,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CACX,GAAG,CAAC,CAAC,GAAG,uEAAuE,CAAC,CAAC,KAAK,EAAE,CACzF,CAAC;QACF,OAAO,CAAC,KAAK,CACX,GAAG,CAAC,CAAC,GAAG,mEAAmE,CAAC,CAAC,IAAI,iBAAiB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,4BAA4B,CAAC,CAAC,KAAK,IAAI,CACzJ,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8DAA8D;IAC9D,0BAA0B;IAC1B,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAC7C,IAAI,MAAM,GAA0B,YAAY,CAAC;IAEjD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,GAAG,MAAM,CAAC;QAChB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACxD,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAC7B,8CAA8C,CAC/C,CAAC,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;gBAClC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,uBAAuB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBACxD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,GAAG,MAAM,aAAa,CAC5B,mDAAmD,EACnD,MAAM,EACN,KAAK,CACN,CAAC;QACF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC,GAAG,SAAS,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,MAAM,aAAa,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,EAAE,CAC/H,CAAC;IACF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,GAAG,yFAAyF,mBAAmB,EAAE,UAAU,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,KAAK,IAAI,CACvM,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAG,KAAK;QAClB,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,EAAE;QAC9E,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,OAAO,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAC3E,OAAO,CAAC,GAAG,CACT,GAAG,MAAM,WAAW,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,MAAM,aAAa,KAAK,CAAC,OAAO,EAAE,CACpF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,4BAA4B,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/commands/env.d.ts

@@ -0,0 +1 @@
+export declare function cmdEnv(): Promise<boolean>;

package/dist/commands/env.js

@@ -0,0 +1,149 @@
+// `kit env` commands — extracted from cli.ts (split step 2).
+import { loadConfig, resolveActiveEnvironment } from "../config.js";
+import { KNOWN_ENVS, writeActiveEnv, readActiveEnv } from "../env-switch.js";
+import { promptConfirm } from "../utils/prompt.js";
+import { inspectEnv } from "../env-inspect.js";
+import { isNonInteractive } from "../environment.js";
+import { c } from "../utils/colors.js";
+import { hasFlag } from "../utils/flags.js";
+import { resolveConfigPath } from "../cli-shared.js";
+async function cmdEnvList() {
+    let config;
+    try {
+        // Load base config without env merge so we can inspect [env.*] sections
+        config = await loadConfig(resolveConfigPath(), "dev");
+    }
+    catch {
+        console.log(`${c.dim}No .kit.toml found — no environments configured.${c.reset}`);
+        return true;
+    }
+    const activeEnv = resolveActiveEnvironment();
+    const envSections = config.env ?? {};
+    const envNames = ["dev", ...Object.keys(envSections).filter((k) => k !== "dev")];
+    console.log(`${c.bold}${c.cyan}Environments${c.reset}  ${c.dim}(active: ${activeEnv})${c.reset}\n`);
+    for (const name of envNames) {
+        const isActive = name === activeEnv;
+        const marker = isActive ? `${c.green}●${c.reset} ` : "  ";
+        const override = envSections[name];
+        if (!override) {
+            console.log(`  ${marker}${c.bold}${name}${c.reset}  ${c.dim}base config (default)${c.reset}`);
+            continue;
+        }
+        // Summarise which keys are overridden
+        const overrideKeys = [];
+        if (override.tools)
+            overrideKeys.push(`tools(${Object.keys(override.tools).join(",")})`);
+        if (override.secrets)
+            overrideKeys.push(`secrets.store=${override.secrets.store ?? "?"}`);
+        if (override.services)
+            overrideKeys.push(`services(${Object.keys(override.services).join(",")})`);
+        if (override.governance)
+            overrideKeys.push("governance");
+        if (override.skills)
+            overrideKeys.push("skills");
+        const summary = overrideKeys.length > 0 ? overrideKeys.join(", ") : "no overrides";
+        console.log(`  ${marker}${c.bold}${name}${c.reset}  ${c.dim}${summary}${c.reset}`);
+    }
+    if (Object.keys(envSections).length === 0) {
+        console.log(`${c.dim}\nNo [env.*] sections defined in .kit.toml.${c.reset}`);
+        console.log(`${c.dim}Add [env.staging.*] or [env.production.*] to configure per-environment overrides.${c.reset}`);
+    }
+    console.log();
+    return true;
+}
+async function cmdEnvSwitch() {
+    // argv layout: [node, cli.js, "env", "switch", "<target>"]
+    const target = process.argv[4];
+    if (!target || !KNOWN_ENVS.includes(target)) {
+        console.error(`${c.red}Usage: kit env switch <${KNOWN_ENVS.join("|")}>${c.reset}`);
+        return false;
+    }
+    const env = target;
+    console.log(`${c.bold}${c.cyan}kit env switch ${env}${c.reset}`);
+    console.log(`${c.dim}${"─".repeat(50)}${c.reset}\n`);
+    if (env === "prod" && !isNonInteractive()) {
+        console.log(`${c.red}⚠ Switching to ${c.bold}prod${c.reset}${c.red} unlocks production credentials in this shell.${c.reset}`);
+        console.log(`${c.dim}Anything that reads ${c.bold}.env.local${c.reset}${c.dim} after this point can call live services.${c.reset}\n`);
+        const ok = await promptConfirm(`Continue? [y/N] (auto-no in 10s): `, 10_000, false);
+        if (!ok) {
+            console.log(`${c.dim}Aborted — active env unchanged.${c.reset}`);
+            return false;
+        }
+    }
+    const state = await writeActiveEnv(env, process.cwd());
+    console.log(`  ${c.green}✓${c.reset} active env is now ${c.bold}${state.env}${c.reset}  ${c.dim}(by ${state.switchedBy} at ${state.switchedAt})${c.reset}`);
+    if (env === "prod") {
+        console.log(`\n${c.dim}Re-run ${c.bold}kit secrets${c.reset}${c.dim} to materialize prod values into .env.local. ${c.bold}kit env switch dev${c.reset}${c.dim} when done.${c.reset}\n`);
+    }
+    else {
+        console.log(`\n${c.dim}Prod-scoped keys are now refused unless you switch back or set ${c.bold}KIT_PROD_OK=1${c.reset}${c.dim}.${c.reset}\n`);
+    }
+    return true;
+}
+async function cmdEnvCurrent() {
+    const state = await readActiveEnv(process.cwd());
+    if (!state) {
+        console.log(`${c.dim}No active env set (defaulting to ${c.bold}dev${c.reset}${c.dim}). Run ${c.bold}kit env switch <env>${c.reset}${c.dim} to set one.${c.reset}`);
+        console.log(`dev`);
+        return true;
+    }
+    const color = state.env === "prod" ? c.red : state.env === "staging" ? c.yellow : c.green;
+    console.log(`${color}${state.env}${c.reset}  ${c.dim}(set ${state.switchedAt} by ${state.switchedBy})${c.reset}`);
+    return true;
+}
+export async function cmdEnv() {
+    const args = process.argv.slice(2); // includes "env"
+    // Route subcommand: kit env list / switch / current / validate
+    if (args[1] === "list")
+        return cmdEnvList();
+    if (args[1] === "switch")
+        return cmdEnvSwitch();
+    if (args[1] === "current")
+        return cmdEnvCurrent();
+    const showValues = hasFlag(args, "--show-values");
+    const missingOnly = hasFlag(args, "--missing");
+    const jsonMode = hasFlag(args, "--json");
+    let config = {};
+    try {
+        config = await loadConfig(resolveConfigPath());
+    }
+    catch {
+        // Works without .kit.toml — shows .env.local contents only
+    }
+    const result = await inspectEnv(config, { showValues, missingOnly, cwd: process.cwd() });
+    if (jsonMode) {
+        console.log(JSON.stringify(result, null, 2));
+        return result.ok;
+    }
+    console.log(`${c.bold}${c.cyan}Environment${c.reset}`);
+    console.log(`${c.dim}${"─".repeat(50)}${c.reset}\n`);
+    if (!result.envLocalExists) {
+        console.log(`${c.yellow}⚠${c.reset}  .env.local not found — run ${c.bold}kit secrets${c.reset} to generate it\n`);
+    }
+    if (result.keys.length === 0) {
+        if (missingOnly) {
+            console.log(`${c.green}✓${c.reset}  All keys are set\n`);
+        }
+        else {
+            console.log(`${c.dim}No keys configured or found${c.reset}\n`);
+        }
+        return result.ok;
+    }
+    for (const key of result.keys) {
+        const icon = key.set ? `${c.green}✓${c.reset}` : `${c.red}✗${c.reset}`;
+        const valueStr = key.set
+            ? showValues
+                ? `${c.dim}${key.value}${c.reset}`
+                : `${c.dim}${key.redacted}${c.reset}`
+            : `${c.red}not set${c.reset}`;
+        const src = `${c.dim}[${key.source}]${c.reset}`;
+        console.log(`  ${icon} ${key.name}  ${valueStr}  ${src}`);
+    }
+    console.log();
+    if (!result.ok && !missingOnly) {
+        console.log(`${c.dim}Run ${c.reset}${c.bold}kit env --missing${c.reset}${c.dim} to see only unset keys${c.reset}`);
+        console.log(`${c.dim}Run ${c.reset}${c.bold}kit secrets${c.reset}${c.dim} to generate .env.local${c.reset}\n`);
+    }
+    return result.ok;
+}
+//# sourceMappingURL=env.js.map

package/dist/commands/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/commands/env.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAkB,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAe,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,KAAK,UAAU,UAAU;IACvB,IAAI,MAAiB,CAAC;IACtB,IAAI,CAAC;QACH,wEAAwE;QACxE,MAAM,GAAG,MAAM,UAAU,CAAC,iBAAiB,EAAE,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,mDAAmD,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,wBAAwB,EAAE,CAAC;IAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;IAEjF,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,YAAY,SAAS,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAEpG,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,KAAK,SAAS,CAAC;QACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAEnC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,wBAAwB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9F,SAAS;QACX,CAAC;QAED,sCAAsC;QACtC,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,QAAQ,CAAC,KAAK;YAAE,YAAY,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzF,IAAI,QAAQ,CAAC,OAAO;YAAE,YAAY,CAAC,IAAI,CAAC,iBAAiB,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;QAC1F,IAAI,QAAQ,CAAC,QAAQ;YAAE,YAAY,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClG,IAAI,QAAQ,CAAC,UAAU;YAAE,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,MAAM;YAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,GAAG,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,8CAA8C,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,oFAAoF,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACrH,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,2DAA2D;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAgB,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,KAAK,CACX,GAAG,CAAC,CAAC,GAAG,0BAA0B,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CACpE,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,MAAgB,CAAC;IAE7B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,kBAAkB,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAErD,IAAI,GAAG,KAAK,MAAM,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC1C,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,iDAAiD,CAAC,CAAC,KAAK,EAAE,CACjH,CAAC;QACF,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,CAAC,GAAG,uBAAuB,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,4CAA4C,CAAC,CAAC,KAAK,IAAI,CACzH,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,aAAa,CAC5B,oCAAoC,EACpC,MAAM,EACN,KAAK,CACN,CAAC;QACF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,kCAAkC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACjE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,sBAAsB,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,OAAO,KAAK,CAAC,UAAU,OAAO,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,KAAK,EAAE,CAC/I,CAAC;IAEF,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,gDAAgD,CAAC,CAAC,IAAI,qBAAqB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,KAAK,IAAI,CAC3K,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,GAAG,kEAAkE,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,IAAI,CACjI,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,CAAC,GAAG,oCAAoC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,uBAAuB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,KAAK,EAAE,CACtJ,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GACT,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9E,OAAO,CAAC,GAAG,CACT,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,QAAQ,KAAK,CAAC,UAAU,OAAO,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,KAAK,EAAE,CACrG,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM;IAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB;IACrD,+DAA+D;IAC/D,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,UAAU,EAAE,CAAC;IAC5C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,YAAY,EAAE,CAAC;IAChD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,aAAa,EAAE,CAAC;IAElD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEzC,IAAI,MAAM,GAAqC,EAAE,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAEzF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO,MAAM,CAAC,EAAE,CAAC;IACnB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAErD,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,gCAAgC,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,KAAK,mBAAmB,CACrG,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,sBAAsB,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,8BAA8B,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,CAAC;IACnB,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG;YACtB,CAAC,CAAC,UAAU;gBACV,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE;gBAClC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,EAAE;YACvC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,KAAK,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,oBAAoB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,0BAA0B,CAAC,CAAC,KAAK,EAAE,CACtG,CAAC;QACF,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,0BAA0B,CAAC,CAAC,KAAK,IAAI,CAClG,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,EAAE,CAAC;AACnB,CAAC"}

package/dist/commands/hooks.d.ts

@@ -0,0 +1 @@
+export declare function cmdHooks(): Promise<boolean>;

package/dist/commands/hooks.js

@@ -0,0 +1,146 @@
+// `kit hooks` commands (git hook install/check/add) — extracted from cli.ts (split step 6).
+import { loadConfig } from "../config.js";
+import { resolveConfigPath, KIT_FILE } from "../cli-shared.js";
+import { isGitRepository, checkHooks } from "../check-hooks.js";
+import { installHooks } from "../hooks.js";
+import { isNonInteractive } from "../environment.js";
+import { promptConfirm } from "../utils/prompt.js";
+import { c } from "../utils/colors.js";
+const BUILTIN_HOOKS = {
+    "secret-scan": {
+        hookName: "pre-commit",
+        commands: ["kit security scan-staged"],
+        description: "Block commits that stage known credential patterns (Stripe, AWS, JWT, etc).",
+    },
+    "post-pull-audit": {
+        hookName: "post-merge",
+        commands: ["kit security verify-pull"],
+        description: "After git pull/merge, audit new deps, gitignore drops, and introduced secrets.",
+    },
+};
+export async function cmdHooks() {
+    const subcommand = process.argv[3];
+    // Built-in hooks bypass the .kit.toml config path so they're available
+    // on any repo, including ones that haven't run `kit init` yet.
+    if (subcommand === "add") {
+        return cmdHooksAdd();
+    }
+    const config = await loadConfig(resolveConfigPath());
+    if (!config.hooks || Object.keys(config.hooks).length === 0) {
+        console.log(`${c.dim}No hooks configured in ${KIT_FILE}${c.reset}`);
+        return true;
+    }
+    if (!isGitRepository()) {
+        console.log(`${c.red}Not a git repository${c.reset}`);
+        return false;
+    }
+    if (subcommand === "install" || !subcommand) {
+        console.log(`${c.bold}${c.cyan}Installing git hooks...${c.reset}\n`);
+        const results = await installHooks(config.hooks);
+        let allOk = true;
+        for (const r of results) {
+            const icon = r.action === "failed"
+                ? `${c.red}✗${c.reset}`
+                : `${c.green}✓${c.reset}`;
+            const label = r.action === "installed"
+                ? `${c.green}installed${c.reset}`
+                : r.action === "updated"
+                    ? `${c.green}updated${c.reset}`
+                    : r.action === "skipped"
+                        ? `${c.dim}skipped${c.reset}`
+                        : `${c.red}failed${c.reset}`;
+            console.log(`  ${icon} ${r.hookName}  ${label}  ${c.dim}${r.detail}${c.reset}`);
+            if (r.action === "failed")
+                allOk = false;
+        }
+        console.log();
+        return allOk;
+    }
+    else if (subcommand === "check") {
+        console.log(`${c.bold}${c.cyan}Git Hooks${c.reset}\n`);
+        const results = await checkHooks(config.hooks);
+        let allOk = true;
+        for (const r of results) {
+            const icon = !r.installed
+                ? `${c.red}✗${c.reset}`
+                : !r.upToDate
+                    ? `${c.yellow}!${c.reset}`
+                    : `${c.green}✓${c.reset}`;
+            const status = !r.installed
+                ? `${c.red}not installed${c.reset}`
+                : !r.upToDate
+                    ? `${c.yellow}outdated${c.reset}`
+                    : `${c.green}up-to-date${c.reset}`;
+            console.log(`  ${icon} ${r.hookName}  ${status}  ${c.dim}${r.detail}${c.reset}`);
+            if (!r.installed || !r.upToDate)
+                allOk = false;
+        }
+        if (!allOk) {
+            console.log(`\n${c.dim}Run ${c.reset}${c.bold}kit hooks install${c.reset}${c.dim} to install/update hooks${c.reset}`);
+        }
+        console.log();
+        return allOk;
+    }
+    else {
+        console.error(`Unknown hooks subcommand: ${subcommand}`);
+        console.error(`Usage: kit hooks [install|check|add <name>]`);
+        return false;
+    }
+}
+async function cmdHooksAdd() {
+    const name = process.argv[4];
+    if (!name) {
+        console.error(`${c.red}Usage: kit hooks add <name>${c.reset}\n${c.dim}Available built-in hooks:${c.reset}`);
+        for (const [k, v] of Object.entries(BUILTIN_HOOKS)) {
+            console.error(`  ${c.bold}${k}${c.reset} (git ${v.hookName}) — ${v.description}`);
+        }
+        return false;
+    }
+    const builtin = BUILTIN_HOOKS[name];
+    if (!builtin) {
+        console.error(`${c.red}No built-in hook named "${name}"${c.reset}`);
+        console.error(`${c.dim}Available: ${Object.keys(BUILTIN_HOOKS).join(", ")}${c.reset}`);
+        return false;
+    }
+    if (!isGitRepository()) {
+        console.error(`${c.red}Not a git repository${c.reset}`);
+        return false;
+    }
+    console.log(`${c.bold}${c.cyan}kit hooks add ${name}${c.reset}  ${c.dim}(git ${builtin.hookName})${c.reset}`);
+    console.log(`${c.dim}${"─".repeat(50)}${c.reset}\n`);
+    // Check whether the target hook is already present and contains a kit-
+    // managed step. If so, just confirm without re-writing.
+    const { hooksDir } = await ensureHooksDir();
+    const hookPath = `${hooksDir}/${builtin.hookName}`;
+    const { existsSync, readFileSync } = await import("node:fs");
+    if (existsSync(hookPath)) {
+        const existing = readFileSync(hookPath, "utf-8");
+        if (existing.includes(builtin.commands[0])) {
+            console.log(`  ${c.green}✓${c.reset} ${builtin.hookName} already has ${c.bold}${builtin.commands[0]}${c.reset}\n`);
+            return true;
+        }
+        console.log(`${c.yellow}⚠ ${builtin.hookName} already exists at ${hookPath}.${c.reset}`);
+        console.log(`${c.dim}kit will overwrite it with a managed version that calls back into kit.${c.reset}\n`);
+        if (!isNonInteractive()) {
+            const ok = await promptConfirm(`Overwrite? [Y/n] (auto-yes in 8s): `, 8000);
+            if (!ok) {
+                console.log(`${c.dim}Aborted.${c.reset}`);
+                return false;
+            }
+        }
+    }
+    const results = await installHooks({ [builtin.hookName]: builtin.commands });
+    const r = results[0];
+    if (r.action === "failed") {
+        console.error(`${c.red}✗ install failed: ${r.detail}${c.reset}`);
+        return false;
+    }
+    console.log(`  ${c.green}✓${c.reset} ${builtin.hookName}  ${c.green}${r.action}${c.reset}  ${c.dim}${r.detail}${c.reset}`);
+    console.log(`\n${c.dim}Test by staging a file with a fake credential (e.g. ${c.bold}sk_${"test"}_${"A".repeat(20)}${c.reset}${c.dim}) and running ${c.bold}git commit${c.reset}${c.dim} — the commit should be blocked.${c.reset}\n`);
+    return true;
+}
+async function ensureHooksDir() {
+    const { resolve } = await import("node:path");
+    return { hooksDir: resolve(process.cwd(), ".git", "hooks") };
+}
+//# sourceMappingURL=hooks.js.map

package/dist/commands/hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/commands/hooks.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAEvC,MAAM,aAAa,GAAkF;IACnG,aAAa,EAAE;QACb,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,CAAC,0BAA0B,CAAC;QACtC,WAAW,EAAE,6EAA6E;KAC3F;IACD,iBAAiB,EAAE;QACjB,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,CAAC,0BAA0B,CAAC;QACtC,WAAW,EAAE,gFAAgF;KAC9F;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAEnC,uEAAuE;IACvE,+DAA+D;IAC/D,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO,WAAW,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAErD,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,0BAA0B,QAAQ,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,uBAAuB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,0BAA0B,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAErE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,KAAK,GAAG,IAAI,CAAC;QAEjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,GACR,CAAC,CAAC,MAAM,KAAK,QAAQ;gBACnB,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE;gBACvB,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,KAAK,GACT,CAAC,CAAC,MAAM,KAAK,WAAW;gBACtB,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,KAAK,EAAE;gBACjC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS;oBACtB,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,KAAK,EAAE;oBAC/B,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS;wBACtB,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,KAAK,EAAE;wBAC7B,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,KAAK,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAChF,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;gBAAE,KAAK,GAAG,KAAK,CAAC;QAC3C,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;SAAM,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,KAAK,GAAG,IAAI,CAAC;QAEjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,GACR,CAAC,CAAC,CAAC,SAAS;gBACV,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE;gBACvB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ;oBACX,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE;oBAC1B,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YAChC,MAAM,MAAM,GACV,CAAC,CAAC,CAAC,SAAS;gBACV,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,KAAK,EAAE;gBACnC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ;oBACX,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,KAAK,EAAE;oBACjC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,KAAK,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACjF,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,QAAQ;gBAAE,KAAK,GAAG,KAAK,CAAC;QACjD,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,oBAAoB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,2BAA2B,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACxH,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,6BAA6B,UAAU,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE7B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CACX,GAAG,CAAC,CAAC,GAAG,8BAA8B,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,4BAA4B,CAAC,CAAC,KAAK,EAAE,CAC7F,CAAC;QACF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YACnD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,2BAA2B,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,cAAc,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACvF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,uBAAuB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,iBAAiB,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,QAAQ,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,CACjG,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAErD,uEAAuE;IACvE,wDAAwD;IACxD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAEnD,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,QAAQ,gBAAgB,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CACtG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,QAAQ,sBAAsB,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,CAC5E,CAAC;QACF,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,CAAC,GAAG,yEAAyE,CAAC,CAAC,KAAK,IAAI,CAC7F,CAAC;QACF,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACxB,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,qCAAqC,EAAE,IAAI,CAAC,CAAC;YAC5E,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC1C,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7E,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,qBAAqB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,CAC9G,CAAC;IACF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,GAAG,uDAAuD,CAAC,CAAC,IAAI,MAAM,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,mCAAmC,CAAC,CAAC,KAAK,IAAI,CACzN,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,cAAc;IAC3B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9C,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;AAC/D,CAAC"}

package/dist/commands/mcp.d.ts

@@ -0,0 +1 @@
+export declare function cmdMcp(): Promise<boolean>;