CLI Commands — validate, typegen, lint, dev

npm install -g @rep-protocol/cli
# or
npx @rep-protocol/cli [command]

rep validate

Validate a .rep.yaml manifest against the JSON schema.

Structural check only: the gateway, not rep validate, checks each default against its type and pattern.

rep validate [--manifest <path>]

Flag	Default	Description
-m, --manifest <path>	.rep.yaml	Path to manifest file

Example:

$ rep validate --manifest .rep.yaml
✓ Manifest is valid
  Version: 0.1.0
  Variables: 11 total
    - PUBLIC: 6
    - SENSITIVE: 3
    - SERVER: 2
  Settings configured: 6

rep typegen

Generate TypeScript type definitions from a manifest. Creates strongly-typed overloads for rep.get() and rep.getSecure().

rep typegen [--manifest <path>] [--output <path>]

Flag	Default	Description
-m, --manifest <path>	.rep.yaml	Path to manifest file
-o, --output <path>	src/rep.d.ts	Output path for generated types

Generated output:

declare module "@rep-protocol/sdk" {
  export interface REP {
    // Overloaded: passing a defaultValue narrows the return type to string.
    get(key: "API_URL" | "FEATURE_FLAGS", defaultValue: string): string;
    get(key: "API_URL" | "FEATURE_FLAGS", defaultValue?: undefined): string | undefined;
    getSecure(key: "ANALYTICS_KEY"): Promise<string>;
    // ... other methods
  }
  export function get(key: "API_URL" | "FEATURE_FLAGS", defaultValue: string): string;
  export function get(key: "API_URL" | "FEATURE_FLAGS", defaultValue?: undefined): string | undefined;
  export function getSecure(key: "ANALYTICS_KEY"): Promise<string>;
  // ...
}

Strict by design — the key unions are closed. Calling rep.get('UNDECLARED_KEY') is a TypeScript error if that variable is not declared in .rep.yaml. This is intentional: it forces every variable the app reads to be explicitly declared in the manifest, keeping the manifest the single source of truth. The fix is always to add the missing variable to .rep.yaml and re-run rep typegen, not to widen the types.

If you don’t want strict type enforcement, skip rep typegen and rely on the base SDK types (key: string).

rep lint

Scan built JavaScript bundles for accidentally leaked secrets. Uses the same guardrail detection as the gateway (Shannon entropy, known secret formats).

rep lint [--dir <path>] [--pattern <glob>] [--exclude <patterns>] [--strict]

Flag	Default	Description
-d, --dir <path>	./dist	Directory to scan
--pattern <glob>	**/*.{js,mjs,cjs}	File pattern to scan
--exclude <patterns>	—	Comma-separated glob patterns to exclude (e.g., "*.min.js,vendor/**")
--strict	false	Exit with error code if warnings found

Minified code handling

The linter filters out false positives from minified/bundled code while still detecting real secrets embedded in your bundles.

File-level skip: Files with .min.js / .min.mjs / .min.cjs extensions are skipped entirely, as these are typically third-party vendor bundles. If your build pipeline produces application code with .min.js filenames, rename the output or run rep lint against the non-minified build.

String-level filtering: For all other files (including Vite, webpack, and Rollup bundles), extracted string values are checked for JavaScript language constructs (function, return, if, =>, ===, &&, .method(), key:value, etc.) and skipped if they look like compiled code. This means real secrets accidentally embedded in a bundle are still detected, while minified code noise is filtered out.

If you still get false positives, use --exclude to skip specific files or directories.

Example:

$ rep lint --dir ./dist
⚠ dist/main.js
  high_entropy:42: value has high entropy (5.23 bits/char) — may be a secret
    const key = "sk_live_abc123..."

⚠ Found 1 potential secret(s) in 1 file(s)

# Exclude vendor bundles
$ rep lint --dir ./dist --exclude "vendor/**,*.chunk.js"

Use cases:

• CI/CD pipeline step before deployment
• Pre-commit hook
• Regular audits of production bundles

rep dev

Run a local development server with the REP gateway. Loads env vars from a file and starts the gateway.

rep dev [options]

Flag	Default	Description
-e, --env <path>	.env.local	Path to .env file
-p, --port <number>	8080	Gateway port
--proxy <url>	—	Upstream proxy URL (e.g., http://localhost:5173)
--static <path>	—	Serve static files (embedded mode)
--hot-reload	false	Enable hot reload
--gateway-bin <path>	auto	Path to gateway binary

Example workflows:

# Proxy mode with Vite
rep dev --env .env.local --proxy http://localhost:5173

# Embedded mode with static files
rep dev --env .env.local --static ./dist --port 8080

Binary resolution

The CLI looks for the gateway binary in this order:

1. Bundled binary (downloaded during npm install)
2. Custom path via --gateway-bin
3. rep-gateway in system PATH