# CLI Commands — validate, typegen, lint, dev

> Reference for @rep-protocol/cli commands. Validate manifests, generate TypeScript types from .rep.yaml, scan bundles for leaked secrets, and run a local dev server.

Source: https://rep-protocol.dev/reference/cli/

```bash
npm install -g @rep-protocol/cli
# or
npx @rep-protocol/cli [command]
```

## `rep validate`

Validate a `.rep.yaml` manifest against the JSON schema.

Structural check only: the gateway, not `rep validate`, checks each [default](/guides/manifest/#defaults) against its `type` and `pattern`.

```bash
rep validate [--manifest <path>]
```

| Flag | Default | Description |
|---|---|---|
| `-m, --manifest <path>` | `.rep.yaml` | Path to manifest file |

**Example:**
```bash
$ rep validate --manifest .rep.yaml
✓ Manifest is valid
  Version: 0.1.0
  Variables: 11 total
    - PUBLIC: 6
    - SENSITIVE: 3
    - SERVER: 2
  Settings configured: 6
```

## `rep typegen`

Generate TypeScript type definitions from a manifest. Creates strongly-typed overloads for `rep.get()` and `rep.getSecure()`.

```bash
rep typegen [--manifest <path>] [--output <path>]
```

| Flag | Default | Description |
|---|---|---|
| `-m, --manifest <path>` | `.rep.yaml` | Path to manifest file |
| `-o, --output <path>` | `src/rep.d.ts` | Output path for generated types |

**Generated output:**
```typescript
declare module "@rep-protocol/sdk" {
  export interface REP {
    // Overloaded: passing a defaultValue narrows the return type to string.
    get(key: "API_URL" | "FEATURE_FLAGS", defaultValue: string): string;
    get(key: "API_URL" | "FEATURE_FLAGS", defaultValue?: undefined): string | undefined;
    getSecure(key: "ANALYTICS_KEY"): Promise<string>;
    // ... other methods
  }
  export function get(key: "API_URL" | "FEATURE_FLAGS", defaultValue: string): string;
  export function get(key: "API_URL" | "FEATURE_FLAGS", defaultValue?: undefined): string | undefined;
  export function getSecure(key: "ANALYTICS_KEY"): Promise<string>;
  // ...
}
```

**Strict by design** — the key unions are closed. Calling `rep.get('UNDECLARED_KEY')` is a TypeScript error if that variable is not declared in `.rep.yaml`. This is intentional: it forces every variable the app reads to be explicitly declared in the manifest, keeping the manifest the single source of truth. The fix is always to add the missing variable to `.rep.yaml` and re-run `rep typegen`, not to widen the types.

If you don't want strict type enforcement, skip `rep typegen` and rely on the base SDK types (`key: string`).

## `rep lint`

Scan built JavaScript bundles for accidentally leaked secrets. Uses the same guardrail detection as the gateway (Shannon entropy, known secret formats).

```bash
rep lint [--dir <path>] [--pattern <glob>] [--exclude <patterns>] [--strict]
```

| Flag | Default | Description |
|---|---|---|
| `-d, --dir <path>` | `./dist` | Directory to scan |
| `--pattern <glob>` | `**/*.{js,mjs,cjs}` | File pattern to scan |
| `--exclude <patterns>` | — | Comma-separated glob patterns to exclude (e.g., `"*.min.js,vendor/**"`) |
| `--strict` | `false` | Exit with error code if warnings found |

### Minified code handling

The linter filters out false positives from minified/bundled code while still detecting real secrets embedded in your bundles.

**File-level skip:** Files with `.min.js` / `.min.mjs` / `.min.cjs` extensions are skipped entirely, as these are typically third-party vendor bundles. If your build pipeline produces application code with `.min.js` filenames, rename the output or run `rep lint` against the non-minified build.

**String-level filtering:** For all other files (including Vite, webpack, and Rollup bundles), extracted string values are checked for JavaScript language constructs (`function`, `return`, `if`, `=>`, `===`, `&&`, `.method()`, `key:value`, etc.) and skipped if they look like compiled code. This means real secrets accidentally embedded in a bundle are still detected, while minified code noise is filtered out.

If you still get false positives, use `--exclude` to skip specific files or directories.

**Example:**
```bash
$ rep lint --dir ./dist
⚠ dist/main.js
  high_entropy:42: value has high entropy (5.23 bits/char) — may be a secret
    const key = "sk_live_abc123..."

⚠ Found 1 potential secret(s) in 1 file(s)
```

```bash
# Exclude vendor bundles
$ rep lint --dir ./dist --exclude "vendor/**,*.chunk.js"
```

**Use cases:**
- CI/CD pipeline step before deployment
- Pre-commit hook
- Regular audits of production bundles

## `rep dev`

Run a local development server with the REP gateway. Loads env vars from a file and starts the gateway.

```bash
rep dev [options]
```

| Flag | Default | Description |
|---|---|---|
| `-e, --env <path>` | `.env.local` | Path to .env file |
| `-p, --port <number>` | `8080` | Gateway port |
| `--proxy <url>` | — | Upstream proxy URL (e.g., `http://localhost:5173`) |
| `--static <path>` | — | Serve static files (embedded mode) |
| `--hot-reload` | `false` | Enable hot reload |
| `--gateway-bin <path>` | auto | Path to gateway binary |

**Example workflows:**

```bash
# Proxy mode with Vite
rep dev --env .env.local --proxy http://localhost:5173

# Embedded mode with static files
rep dev --env .env.local --static ./dist --port 8080
```

## Binary resolution

The CLI looks for the gateway binary in this order:

1. Bundled binary (downloaded during `npm install`)
2. Custom path via `--gateway-bin`
3. `rep-gateway` in system `PATH`