@hoilab/ada-cli 0.85.0 → 0.85.3

package/dist/core/secretos/placeholder-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"placeholder-scan.js","sourceRoot":"","sources":["../../../src/core/secretos/placeholder-scan.ts"],"names":[],"mappings":"AACA,OAAO,EACN,8BAA8B,EAC9B,cAAc,EAGd,2CAA2C,GAC3C,MAAM,kBAAmB,CAAC;AAE3B,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,+EAA+E;AAC/E,mEAAmE;AACnE,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,+EAA+E;AAC/E,MAAM,UAAU,mCAAmC,CAClD,IAAY,EACZ,MAAc,EACd,qBAAuD,EACvD,SAAoC,EACpC,mBAAqD;IAErD,cAAc,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,SAAS,CAAC;QACT,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM;QAC1B,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,2CAA2C,CAAC,KAAK,CAAC,CAAC;YACnD,SAAS;QACV,CAAC;QACD,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,MAAM,IAAI,WAAW,CAAC;QACtB,YAAY,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,mBAAmB,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjF,MAAM,IAAI,SAAS,CAAC;QACpB,YAAY,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACzE,YAAY,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9C,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;IACrD,MAAM,IAAI,QAAQ,CAAC;IACnB,YAAY,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,wCAAwC,CACvD,IAAY,EACZ,yBAA2D;IAE3D,cAAc,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,SAAS,CAAC;QACT,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM;QAC1B,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,2CAA2C,CAAC,KAAK,CAAC,CAAC;YACnD,SAAS;QACV,CAAC;QACD,cAAc,GAAG,IAAI,CAAC;QACtB,YAAY,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9C,CAAC;IACD,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,qBAAqB,CACpC,IAAY,EACZ,MAAqD,EACrD,cAA2E;IAE3E,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,aAAa,GAAG,CACrB,KAAa,EACb,SAAiB,EACjB,OAAe,EACf,oBAA6B,EAC7B,SAAkB,EACjB,EAAE;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/B,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC;QAClC,QAAQ,IAAI,KAAK,CAAC;QAClB,QAAQ,CAAC,IAAI,CAAC;YACb,SAAS;YACT,OAAO,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM;YACjC,SAAS;YACT,OAAO;YACP,oBAAoB;YACpB,SAAS;SACT,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAClF,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,8BAA8B,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC5E,aAAa,CAAC,OAAO,EAAE,MAAM,IAAI,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,IAAI,KAAK,CAAC,CAAC;QACzG,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC;IACpB,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAErE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,QAAyC,EACzC,SAAiB,EACjB,OAAe;IAUf,MAAM,YAAY,GAAG,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,YAAY,CAAC,oBAAoB;QAC9C,CAAC,CAAC,YAAY,CAAC,SAAS;QACxB,CAAC,CAAC,YAAY,CAAC,SAAS,GAAG,CAAC,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,UAAU,CAAC,oBAAoB;QAC1C,CAAC,CAAC,UAAU,CAAC,OAAO;QACpB,CAAC,CAAC,UAAU,CAAC,SAAS,GAAG,CAAC,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3D,wEAAwE;IACxE,+EAA+E;IAC/E,gFAAgF;IAChF,6CAA6C;IAC7C,MAAM,qBAAqB,GAC1B,CAAC,YAAY,CAAC,oBAAoB,IAAI,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC;QACzE,CAAC,UAAU,CAAC,oBAAoB,IAAI,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnE,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,6BAA6B,GAAG,KAAK,CAAC;IAC1C,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,uEAAuE;IACvE,4EAA4E;IAC5E,mEAAmE;IACnE,IAAI,cAAc,GAAG,SAAS,CAAC;IAC/B,IAAI,yBAAyB,GAAG,CAAC,CAAC,CAAC;IACnC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,IAAI,OAAO,CAAC,OAAO,IAAI,SAAS;YAAE,SAAS;QAC3E,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC;QAChC,6BAA6B,KAAK,OAAO,CAAC,oBAAoB,CAAC;QAC/D,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAClC,IAAI,yBAAyB,KAAK,CAAC,CAAC;gBAAE,yBAAyB,GAAG,OAAO,CAAC,SAAS,CAAC;YACpF,IAAI,OAAO,CAAC,OAAO,GAAG,cAAc;gBAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;QACxE,CAAC;IACF,CAAC;IACD,OAAO;QACN,KAAK;QACL,GAAG;QACH,SAAS;QACT,6BAA6B;QAC7B,qBAAqB;QACrB,cAAc;QACd,yBAAyB;KACzB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,QAAyC,EAAE,SAAiB;IACpF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,SAAS,GAAG,OAAO,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC;IACnF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAAyC,EAAE,KAAa;IACtG,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,SAAS,CAAC;QACT,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,MAAM,IAAI,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC/G,IAAI,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QAC5B,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1B,CAAC;AACF,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,iEAAiE;AACjE,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,uEAAuE;AACvE,YAAY;AACZ,MAAM,UAAU,6CAA6C,CAC5D,IAAY,EACZ,MAAc,EACd,WAAmB,EACnB,yBAA2D;IAE3D,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,OAAO,mCAAmC,CACzC,IAAI,EACJ,MAAM,EACN,yBAAyB,EACzB,CAAC,KAAK,EAAE,EAAE;QACT,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,WAAW,CAAC;QACpB,CAAC;QACD,OAAO,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,CAAC,EACD,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAC5B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qCAAqC,CACpD,IAAY,EACZ,KAAa,EACb,GAAW,EACX,MAAqD,EACrD,cAA2E;IAE3E,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG;YAAE,SAAS;QACvD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5C,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,8BAA8B,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC5E,MAAM,IAAI,OAAO,EAAE,MAAM,IAAI,WAAW,CAAC;QACzC,SAAS,KAAK,OAAO,EAAE,SAAS,IAAI,KAAK,CAAC;QAC1C,MAAM,GAAG,UAAU,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC;AAED,4EAA4E;AAC5E,+EAA+E;AAC/E,iFAAiF;AACjF,gFAAgF;AAChF,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CACnC,IAAY,EACZ,KAAa,EACb,GAAW,EACX,MAAqD,EACrD,cAA2E;IAE3E,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG;YAAE,SAAS;QACvD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,8BAA8B,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC5E,MAAM,IAAI,OAAO,EAAE,MAAM,IAAI,WAAW,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,6EAA6E;AAC7E,4EAA4E;AAC5E,MAAM,UAAU,4BAA4B,CAC3C,IAAY,EACZ,KAAa,EACb,GAAW,EACX,MAAqD;IAErD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG;YAAE,SAAS;QACvD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5C,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC3C,MAAM,GAAG,UAAU,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,8EAA8E;AAC9E,yEAAyE;AACzE,+EAA+E;AAC/E,0CAA0C;AAC1C,6EAA6E;AAC7E,4EAA4E;AAC5E,+EAA+E;AAC/E,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,sEAAsE;AACtE,iEAAiE;AACjE,0EAA0E;AAC1E,8EAA8E;AAC9E,2BAA2B;AAC3B,yEAAyE;AACzE,kEAAkE;AAClE,qEAAqE;AACrE,sBAAsB;AACtB,MAAM,UAAU,6CAA6C,CAC5D,IAAY,EACZ,QAAgB,EAChB,QAAyC,EACzC,KAAa,EACb,GAAW,EACX,MAAqD,EACrD,KAAa;IAEb,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,MAAM,WAAW,GAAG,CAAC,UAAkB,EAAE,QAAgB,EAAgC,EAAE;QAC1F,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,oBAAoB,IAAI,OAAO,CAAC,SAAS,GAAG,UAAU,IAAI,OAAO,CAAC,OAAO,GAAG,QAAQ;gBAAE,SAAS;YAC3G,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;YACrD,OAAO,CAAC,UAAU,GAAG,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,yBAAyB,GAAG,CAAC,UAAkB,EAAE,QAAgB,EAAW,EAAE;QACnF,IAAI,2BAA2B,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACnD,OAAO,QAAQ,KAAK,SAAS,IAAI,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzG,CAAC,CAAC;IACF,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG;YAAE,SAAS;QACvD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,MAAM,GAAG,YAAY,IAAI,yBAAyB,CAAC,MAAM,EAAE,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1F,MAAM,GAAG,UAAU,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,GAAG,GAAG,IAAI,yBAAyB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED,iFAAiF;AACjF,4EAA4E;AAC5E,2DAA2D;AAC3D,SAAS,2BAA2B,CAAC,IAAY,EAAE,UAAkB,EAAE,QAAgB,EAAE,KAAa;IACrG,KAAK,CAAC,SAAS,GAAG,UAAU,CAAC;IAC7B,SAAS,CAAC;QACT,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC/C,IAAI,QAAQ,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QACtC,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtE,CAAC;AACF,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC3C,KAAa,EACb,GAAW,EACX,MAAqD;IAErD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG;YAAE,SAAS;QACvD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,MAAM,GAAG,YAAY;YAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC;QACvE,MAAM,GAAG,UAAU,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC5C,KAAa,EACb,GAAW,EACX,MAAqD;IAErD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG;YAAE,SAAS;QACvD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,MAAM,GAAG,YAAY;YAAE,KAAK,EAAE,CAAC;QACnC,MAAM,GAAG,UAAU,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,GAAG,GAAG;QAAE,KAAK,EAAE,CAAC;IAC1B,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAa,EAAE,GAAW,EAAE,WAAmB;IACzF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,eAAe,CAAI,GAAM,EAAE,SAAgC;IAC1E,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC,GAAG,CAAiB,CAAC;IACvC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC/B,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACrD,IAAI,WAAW,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;YACzC,OAAO,WAAW,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAiB,CAAC;IACjD,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,KAAK,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAC;YACpD,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACtD,IAAI,WAAW,KAAK,KAAK;gBAAE,OAAO,GAAG,IAAI,CAAC;YAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC;QAC3B,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAM,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IACjC,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,UAA4B,EAAE,KAAgB;IAC1F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,IAAe,EAAQ,EAAE;QACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,KAAK,MAAM,WAAW,IAAI,UAAU,CAAC,sCAAsC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnF,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACzB,CAAC;YACD,OAAO;QACR,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,KAAK,IAAI,IAAI;gBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACzC,OAAO;QACR,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACzC,CAAC;QACF,CAAC;IACF,CAAC,CAAC;IACF,OAAO,CAAC,KAAK,CAAC,CAAC;IACf,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAgB,EAAE,EAAyB;IACzE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC9B,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;YAClC,OAAO,IAAI,CAAC;QACb,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9B,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,GAAG,GAAe,EAAE,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAS;YACjC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;YAClC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/core/secretos/placeholder.d.ts

@@ -0,0 +1,95 @@
+import type { SecretEntry } from "./obfuscator\.ts";
+export declare const MIN_OBFUSCATE_SECRET_LEN = 8;
+export declare function defaultPlaceholderKey(): string;
+type PlaceholderCaseHint = "U" | "L" | "C" | "M";
+/** Normalize a friendly name into the model-visible placeholder prefix. */
+export declare function sanitizeSecretFriendlyName(name: string): string | undefined;
+/**
+ * Normalize a secret value into the same alnum-only, uppercased shape a
+ * friendly-name label or placeholder prefix is sanitized into, so comparing a
+ * raw (possibly lowercase/punctuated) secret value against already-sanitized,
+ * model-visible text does not miss a case- or separator-only variant. Unlike
+ * `sanitizeSecretFriendlyName` this never truncates and never signals "empty"
+ * via `undefined` — callers already guard on `.length > 0` before comparing.
+ */
+export declare function sanitizeForCollisionCheck(value: string): string;
+export declare function sanitizedLabelCollidesWithSecret(sanitizedLabel: string, sanitizedSecret: string): boolean;
+/**
+ * Whether an entry needs the persisted placeholder key: either because it can
+ * produce a reversible (keyed) obfuscate-mode placeholder, or because a default
+ * (no custom `replacement`) replace-mode regex can reach
+ * `#generateRegexReplacement`'s key-derived idempotent fallback marker (see
+ * `#generateReplacement`) when every same-length candidate re-matches a
+ * pathological match-everything config (e.g. `[\s\S]{8}`). That fallback depends
+ * on the persisted per-install key — not just length — to stay a fixed point
+ * across a process restart; without a persisted key, a fresh install falls back
+ * to a process-random key (`defaultPlaceholderKey()`), so the fallback marker
+ * would churn across restarts even though the algorithm itself is stable. A
+ * regex WITH a custom `replacement` never reaches that fallback (it always emits
+ * the literal configured string), and a plain replace secret's replacement is
+ * pure content-hash (`#generateSecretReplacement`), so neither needs the key.
+ * Short plain obfuscate entries are toned down (never placeheld), so they must
+ * NOT force key creation: otherwise a `secret-placeholder.key` file is written
+ * and persisted for a config that ends up with no active secrets, leaving the
+ * key readable via a tool and reusable for later placeholders.
+ */
+export declare function secretEntryNeedsPlaceholderKey(entry: SecretEntry): boolean;
+/**
+ * Whether a SET of entries needs the persisted placeholder key. `obfuscate()`
+ * applies plain replace-mode mappings before the plain-obfuscate pass, so a plain
+ * obfuscate entry only emits a reversible (keyed) placeholder when its content can
+ * still appear AFTER the replace phase. When no obfuscate entry can ever produce a
+ * placeholder, the persisted key must NOT be required/created — otherwise an
+ * effectively replace-only secret set still writes `secret-placeholder.key` and
+ * fails startup when the agent config dir is unwritable.
+ *
+ * The decision models the replace phase as the obfuscator actually runs it:
+ * replace mappings are content-keyed (later duplicate wins) and applied in
+ * descending content-length order; for a fresh probe (no prior placeholders) that
+ * phase is plain sequential substring replacement. A plain obfuscate entry needs
+ * the key when its content survives that simulated phase (direct typing) OR when
+ * any effective replacement can form the content via tiling — a substring,
+ * wholesale superstring, or prefix/suffix border that joins with surrounding
+ * passthrough bytes (see `replacementCanFormContent`). This covers direct
+ * shadowing (`SECRET -> safe`), reintroduction, duplicate ordering, transitive
+ * chains, and context-joined fragments uniformly. Default (omitted) replacements
+ * are deterministic, length-preserving, and distinct, so a same-content shadow
+ * with no other interacting replacement stays key-free.
+ * Replacement outputs are themselves rewritten by every later (shorter-content)
+ * replacement before the plain-obfuscate pass sees them, so a fragment that a
+ * subsequent replacement erases (`AA -> SEC` then `S -> X` turns every `SEC` into
+ * `XEC`) no longer forces the key. Surrounding bytes stay modeled as arbitrary
+ * passthrough, so testing the surviving fragment only drops false positives and
+ * never under-approximates a real key need.
+ */
+export declare function secretEntriesNeedPlaceholderKey(entries: SecretEntry[]): boolean;
+export declare function buildHashBase(key: string, value: string): string;
+export declare function buildKeyedReplacementRun(key: string, length: number): string;
+export declare function inferCaseHint(secret: string): PlaceholderCaseHint | undefined;
+export declare function buildPlaceholder(hint: PlaceholderCaseHint | undefined, base: string, friendlyName?: string): string;
+/** Regex matching `$$HASH$$`, `$$HASH:U$$`, and `$$FRIENDLY_HASH(:hint)$$` placeholders. */
+export declare const PLACEHOLDER_RE: RegExp;
+export declare function resumePlaceholderScanAfterRejectedCandidate(match: RegExpExecArray): void;
+export declare function placeholderWithoutFriendlyName(placeholder: string): string | undefined;
+export declare function lookupFriendlyPlaceholderAlias(deobfuscateMap: ReadonlyMap<string, {
+    secret: string;
+    recursive: boolean;
+}>, placeholder: string): {
+    secret: string;
+    recursive: boolean;
+} | undefined;
+export declare function stripPendingSecretPlaceholderSuffix(text: string): string;
+export interface RegexScanSegment {
+    scanStart: number;
+    scanEnd: number;
+    textStart: number;
+    textEnd: number;
+    generatedPlaceholder: boolean;
+    recursive: boolean;
+}
+export interface ReplaceRegexScan {
+    text: string;
+    segments: RegexScanSegment[];
+}
+export {};
+//# sourceMappingURL=placeholder.d.ts.map

package/dist/core/secretos/placeholder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"placeholder.d.ts","sourceRoot":"","sources":["../../../src/core/secretos/placeholder.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAgBpD,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAO1C,wBAAgB,qBAAqB,IAAI,MAAM,CAG9C;AAED,KAAK,mBAAmB,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;AAEjD,2EAA2E;AAC3E,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAM3E;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/D;AAKD,wBAAgB,gCAAgC,CAAC,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAIzG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAM1E;AA8BD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CA0C/E;AAMD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAWhE;AAQD,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAW5E;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CA6B7E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,mBAAmB,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAGnH;AAED,4FAA4F;AAC5F,eAAO,MAAM,cAAc,QAAqD,CAAC;AAEjF,wBAAgB,2CAA2C,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAIxF;AAED,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGtF;AAED,wBAAgB,8BAA8B,CAC7C,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC,EAC3E,WAAW,EAAE,MAAM,GACjB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,CAKpD;AAQD,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIxE;AAED,MAAM,WAAW,gBAAgB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,SAAS,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC7B"}

package/dist/core/secretos/placeholder.js

@@ -0,0 +1,283 @@
+import * as crypto from "node:crypto";
+import { ensureDistinctReplacement, generateDeterministicReplacement, REPLACEMENT_CHARS } from "./replacement.js";
+// ═══════════════════════════════════════════════════════════════════════════
+// Placeholder format
+// ═══════════════════════════════════════════════════════════════════════════
+const HASH_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+// Base length is sized for ~62 bits of entropy (64 bits of a keyed digest
+// rendered as 12 base36 chars) so unrelated secrets do not collide on a shared
+// base. A collision would let a persisted placeholder deobfuscate to the wrong
+// secret when the configured secret set or its ordering changes across sessions.
+const HASH_LEN = 12;
+const MAX_FRIENDLY_NAME_LEN = 32;
+// Plain/regex obfuscate matches shorter than this are toned down (never placed
+// behind a reversible placeholder) to avoid redacting small words/fragments.
+export const MIN_OBFUSCATE_SECRET_LEN = 8;
+// Per-process fallback key used when a caller does not supply a persisted
+// per-install key. It is random (never shipped in source), so model-visible
+// placeholders cannot be reversed by dictionary-hashing candidate secrets; it
+// only forgoes cross-session token stability, which the persisted key provides.
+let ephemeralPlaceholderKey;
+export function defaultPlaceholderKey() {
+    ephemeralPlaceholderKey ??= crypto.randomBytes(32).toString("base64url");
+    return ephemeralPlaceholderKey;
+}
+/** Normalize a friendly name into the model-visible placeholder prefix. */
+export function sanitizeSecretFriendlyName(name) {
+    const sanitized = name
+        .replace(/[^A-Za-z0-9]/g, "")
+        .toUpperCase()
+        .slice(0, MAX_FRIENDLY_NAME_LEN);
+    return sanitized.length > 0 ? sanitized : undefined;
+}
+/**
+ * Normalize a secret value into the same alnum-only, uppercased shape a
+ * friendly-name label or placeholder prefix is sanitized into, so comparing a
+ * raw (possibly lowercase/punctuated) secret value against already-sanitized,
+ * model-visible text does not miss a case- or separator-only variant. Unlike
+ * `sanitizeSecretFriendlyName` this never truncates and never signals "empty"
+ * via `undefined` — callers already guard on `.length > 0` before comparing.
+ */
+export function sanitizeForCollisionCheck(value) {
+    return value.replace(/[^A-Za-z0-9]/g, "").toUpperCase();
+}
+// A label leaks a secret either by containing the whole normalized secret or,
+// once it reaches the public display cap, by being the secret's visible prefix.
+// Shorter names like "TOKEN" can still be intentional generic labels.
+export function sanitizedLabelCollidesWithSecret(sanitizedLabel, sanitizedSecret) {
+    if (sanitizedSecret.length === 0)
+        return false;
+    if (sanitizedLabel.includes(sanitizedSecret))
+        return true;
+    return sanitizedLabel.length >= MAX_FRIENDLY_NAME_LEN && sanitizedSecret.startsWith(sanitizedLabel);
+}
+/**
+ * Whether an entry needs the persisted placeholder key: either because it can
+ * produce a reversible (keyed) obfuscate-mode placeholder, or because a default
+ * (no custom `replacement`) replace-mode regex can reach
+ * `#generateRegexReplacement`'s key-derived idempotent fallback marker (see
+ * `#generateReplacement`) when every same-length candidate re-matches a
+ * pathological match-everything config (e.g. `[\s\S]{8}`). That fallback depends
+ * on the persisted per-install key — not just length — to stay a fixed point
+ * across a process restart; without a persisted key, a fresh install falls back
+ * to a process-random key (`defaultPlaceholderKey()`), so the fallback marker
+ * would churn across restarts even though the algorithm itself is stable. A
+ * regex WITH a custom `replacement` never reaches that fallback (it always emits
+ * the literal configured string), and a plain replace secret's replacement is
+ * pure content-hash (`#generateSecretReplacement`), so neither needs the key.
+ * Short plain obfuscate entries are toned down (never placeheld), so they must
+ * NOT force key creation: otherwise a `secret-placeholder.key` file is written
+ * and persisted for a config that ends up with no active secrets, leaving the
+ * key readable via a tool and reusable for later placeholders.
+ */
+export function secretEntryNeedsPlaceholderKey(entry) {
+    if ((entry.mode ?? "obfuscate") === "obfuscate") {
+        if (entry.type === "regex")
+            return true;
+        return entry.content.length >= MIN_OBFUSCATE_SECRET_LEN;
+    }
+    return entry.type === "regex" && entry.replacement === undefined;
+}
+/**
+ * Whether a plain replace-mode replacement string can contribute a fragment that
+ * helps the replace phase reconstruct an obfuscate `content`. During obfuscate()'s
+ * replace phase the output is a tiling of passthrough bytes (adversary-controlled
+ * provider text) and whole replacement outputs; any contiguous occurrence of
+ * `content` in that output is covered by interior replacement tiles (each a
+ * substring of `content`) bordered by passthrough at the ends, where the border
+ * tile may be a suffix of a replacement (forming `content`'s prefix) or a prefix
+ * of a replacement (forming `content`'s suffix). An EMPTY replacement deletes its
+ * trigger entirely, joining the passthrough on both sides; with adversary-chosen
+ * surrounding bytes that can form any non-empty `content` across the deleted gap.
+ * So a replacement can help iff it is empty, is a substring of `content`,
+ * contains `content`, or shares such a border overlap.
+ */
+function replacementCanFormContent(replacement, content) {
+    if (replacement.length === 0)
+        return content.length > 0;
+    if (content.includes(replacement) || replacement.includes(content))
+        return true;
+    const maxOverlap = Math.min(replacement.length, content.length);
+    for (let k = 1; k <= maxOverlap; k++) {
+        // A suffix of the replacement forms the prefix of the content (left border),
+        // or a prefix of the replacement forms the suffix of the content (right border).
+        if (content.startsWith(replacement.slice(replacement.length - k)) || content.endsWith(replacement.slice(0, k))) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Whether a SET of entries needs the persisted placeholder key. `obfuscate()`
+ * applies plain replace-mode mappings before the plain-obfuscate pass, so a plain
+ * obfuscate entry only emits a reversible (keyed) placeholder when its content can
+ * still appear AFTER the replace phase. When no obfuscate entry can ever produce a
+ * placeholder, the persisted key must NOT be required/created — otherwise an
+ * effectively replace-only secret set still writes `secret-placeholder.key` and
+ * fails startup when the agent config dir is unwritable.
+ *
+ * The decision models the replace phase as the obfuscator actually runs it:
+ * replace mappings are content-keyed (later duplicate wins) and applied in
+ * descending content-length order; for a fresh probe (no prior placeholders) that
+ * phase is plain sequential substring replacement. A plain obfuscate entry needs
+ * the key when its content survives that simulated phase (direct typing) OR when
+ * any effective replacement can form the content via tiling — a substring,
+ * wholesale superstring, or prefix/suffix border that joins with surrounding
+ * passthrough bytes (see `replacementCanFormContent`). This covers direct
+ * shadowing (`SECRET -> safe`), reintroduction, duplicate ordering, transitive
+ * chains, and context-joined fragments uniformly. Default (omitted) replacements
+ * are deterministic, length-preserving, and distinct, so a same-content shadow
+ * with no other interacting replacement stays key-free.
+ * Replacement outputs are themselves rewritten by every later (shorter-content)
+ * replacement before the plain-obfuscate pass sees them, so a fragment that a
+ * subsequent replacement erases (`AA -> SEC` then `S -> X` turns every `SEC` into
+ * `XEC`) no longer forces the key. Surrounding bytes stay modeled as arbitrary
+ * passthrough, so testing the surviving fragment only drops false positives and
+ * never under-approximates a real key need.
+ */
+export function secretEntriesNeedPlaceholderKey(entries) {
+    const replaceMap = new Map();
+    for (const entry of entries) {
+        if (entry.type !== "plain" || (entry.mode ?? "obfuscate") !== "replace")
+            continue;
+        replaceMap.set(entry.content, entry.replacement ?? ensureDistinctReplacement(generateDeterministicReplacement(entry.content), entry.content));
+    }
+    const replacePhase = [...replaceMap].sort((a, b) => b[0].length - a[0].length);
+    // Apply the replace phase from `start` onward. The phase runs in descending
+    // content-length order, so a replacement output emitted at index i is rewritten
+    // only by the later (shorter-content) replacements at i+1…; `start` 0 models a
+    // value typed directly into the input.
+    const applyReplacePhaseFrom = (text, start) => {
+        let result = text;
+        for (let i = start; i < replacePhase.length; i++) {
+            result = result.split(replacePhase[i][0]).join(replacePhase[i][1]);
+        }
+        return result;
+    };
+    return entries.some((entry) => {
+        if (!secretEntryNeedsPlaceholderKey(entry))
+            return false;
+        // Regex obfuscate entries match dynamically; conservatively require the key.
+        if (entry.type !== "plain")
+            return true;
+        const content = entry.content;
+        if (applyReplacePhaseFrom(content, 0).includes(content))
+            return true;
+        // Test each replacement output in the form it SURVIVES the rest of the phase,
+        // so a fragment a later replacement erases no longer forces the key. The
+        // content it tiles into must also survive those later replacements: if a
+        // shorter-content replacement rewrites the surrounding passthrough bytes
+        // (e.g. `AA -> SEC` forms `SEC`+`RET12`, then `R -> X` turns the freshly
+        // formed `SECRET12` into `SECXET12`), the content can never reach the
+        // obfuscate pass, so the key is not needed. Requiring content stability only
+        // drops such false positives — a formation that genuinely survives is still
+        // caught at the replacement index that produces it.
+        return replacePhase.some(([, replacement], i) => applyReplacePhaseFrom(content, i + 1) === content &&
+            replacementCanFormContent(applyReplacePhaseFrom(replacement, i + 1), content));
+    });
+}
+// Derive the model-visible base from a KEYED digest of the secret. xxHash is
+// fast and unkeyed, so a fixed-seed content hash of a low-entropy secret could
+// be dictionaried from the transcript; HMAC-SHA256 under a private per-install
+// key cannot, since the attacker lacks the key.
+export function buildHashBase(key, value) {
+    const digest = crypto.createHmac("sha256", key).update(value).digest();
+    let v = 0n;
+    for (let i = 0; i < 8; i++)
+        v = (v << 8n) | BigInt(digest[i]);
+    const radix = BigInt(HASH_CHARS.length);
+    let tag = "";
+    for (let i = 0; i < HASH_LEN; i++) {
+        tag += HASH_CHARS[Number(v % radix)];
+        v /= radix;
+    }
+    return tag;
+}
+// Build a deterministic, key-derived run of REPLACEMENT_CHARS of the given
+// length. Used to redact a per-chunk replace remainder to a marker that depends
+// only on the per-install key and the remainder length, so a fresh obfuscator
+// reproduces the identical marker (idempotent redaction across restarts) while
+// the run stays unpredictable without the key (raw sentinel-shaped bytes cannot
+// equal the marker, so they are still redacted rather than passed through).
+export function buildKeyedReplacementRun(key, length) {
+    if (length <= 0)
+        return "";
+    const radix = REPLACEMENT_CHARS.length;
+    let out = "";
+    for (let block = 0; out.length < length; block++) {
+        const digest = crypto.createHmac("sha256", key).update(`replace-chunk\0${length}\0${block}`).digest();
+        for (let i = 0; i < digest.length && out.length < length; i++) {
+            out += REPLACEMENT_CHARS[digest[i] % radix];
+        }
+    }
+    return out;
+}
+export function inferCaseHint(secret) {
+    let hasCased = false;
+    let hasUpper = false;
+    let hasLower = false;
+    let capitalized = true;
+    let seenFirstCased = false;
+    for (let i = 0; i < secret.length; i++) {
+        const code = secret.charCodeAt(i);
+        const isUpper = code >= 65 && code <= 90;
+        const isLower = code >= 97 && code <= 122;
+        if (!isUpper && !isLower)
+            continue;
+        hasCased = true;
+        if (isUpper) {
+            hasUpper = true;
+            if (seenFirstCased)
+                capitalized = false;
+        }
+        else {
+            hasLower = true;
+            if (!seenFirstCased)
+                capitalized = false;
+        }
+        seenFirstCased = true;
+    }
+    if (!hasCased)
+        return undefined;
+    if (hasUpper && !hasLower)
+        return "U";
+    if (hasLower && !hasUpper)
+        return "L";
+    if (capitalized)
+        return "C";
+    return "M";
+}
+export function buildPlaceholder(hint, base, friendlyName) {
+    const prefix = friendlyName ? `${friendlyName}_` : "";
+    return hint ? `$$${prefix}${base}:${hint}$$` : `$$${prefix}${base}$$`;
+}
+/** Regex matching `$$HASH$$`, `$$HASH:U$$`, and `$$FRIENDLY_HASH(:hint)$$` placeholders. */
+export const PLACEHOLDER_RE = /\$\$(?:[A-Z0-9]+_)?[A-Z0-9]{4,}(?::[ULCM])?\$\$/g;
+export function resumePlaceholderScanAfterRejectedCandidate(match) {
+    // RegExp#exec does not find overlapping matches. Restart at the rejected
+    // candidate's closing delimiter, which can open an immediately adjacent placeholder.
+    PLACEHOLDER_RE.lastIndex = match.index + match[0].length - 2;
+}
+export function placeholderWithoutFriendlyName(placeholder) {
+    const match = /^\$\$[A-Z0-9]+_([A-Z0-9]{4,}(?::[ULCM])?)\$\$$/.exec(placeholder);
+    return match ? `$$${match[1]}$$` : undefined;
+}
+export function lookupFriendlyPlaceholderAlias(deobfuscateMap, placeholder) {
+    const direct = deobfuscateMap.get(placeholder);
+    if (direct !== undefined)
+        return direct;
+    const unprefixed = placeholderWithoutFriendlyName(placeholder);
+    return unprefixed !== undefined ? deobfuscateMap.get(unprefixed) : undefined;
+}
+const PENDING_PLACEHOLDER_SUFFIX_RE = /(?:\$\$(?:[A-Z0-9]+_)?[A-Z0-9]*(?::[ULCM]?)?|\$)$/;
+// Withhold a trailing run that could be the start of a placeholder from streamed
+// deltas, so a partial token is never emitted before deobfuscation can replace
+// it. A lone trailing delimiter character is always buffered because it can open
+// a placeholder; the final non-streamed flush re-emits it when no token follows.
+export function stripPendingSecretPlaceholderSuffix(text) {
+    const pendingPlaceholderStart = text.match(PENDING_PLACEHOLDER_SUFFIX_RE);
+    if (pendingPlaceholderStart?.index === undefined)
+        return text;
+    return text.slice(0, pendingPlaceholderStart.index);
+}
+//# sourceMappingURL=placeholder.js.map

package/dist/core/secretos/placeholder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"placeholder.js","sourceRoot":"","sources":["../../../src/core/secretos/placeholder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,iBAAiB,EAAE,MAAM,kBAAmB,CAAC;AAEnH,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,UAAU,GAAG,sCAAsC,CAAC;AAC1D,0EAA0E;AAC1E,+EAA+E;AAC/E,+EAA+E;AAC/E,iFAAiF;AACjF,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,+EAA+E;AAC/E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C,0EAA0E;AAC1E,4EAA4E;AAC5E,8EAA8E;AAC9E,gFAAgF;AAChF,IAAI,uBAA2C,CAAC;AAChD,MAAM,UAAU,qBAAqB;IACpC,uBAAuB,KAAK,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACzE,OAAO,uBAAuB,CAAC;AAChC,CAAC;AAID,2EAA2E;AAC3E,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACtD,MAAM,SAAS,GAAG,IAAI;SACpB,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;SAC5B,WAAW,EAAE;SACb,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAClC,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACtD,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,8EAA8E;AAC9E,gFAAgF;AAChF,sEAAsE;AACtE,MAAM,UAAU,gCAAgC,CAAC,cAAsB,EAAE,eAAuB;IAC/F,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,cAAc,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,cAAc,CAAC,MAAM,IAAI,qBAAqB,IAAI,eAAe,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACrG,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAkB;IAChE,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,WAAW,CAAC,KAAK,WAAW,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,wBAAwB,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,yBAAyB,CAAC,WAAmB,EAAE,OAAe;IACtE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAChE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,6EAA6E;QAC7E,iFAAiF;QACjF,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChH,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAAsB;IACrE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,WAAW,CAAC,KAAK,SAAS;YAAE,SAAS;QAClF,UAAU,CAAC,GAAG,CACb,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,WAAW,IAAI,yBAAyB,CAAC,gCAAgC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAC9G,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/E,4EAA4E;IAC5E,gFAAgF;IAChF,+EAA+E;IAC/E,uCAAuC;IACvC,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE;QACrE,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC,CAAC;IACF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7B,IAAI,CAAC,8BAA8B,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACzD,6EAA6E;QAC7E,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,IAAI,qBAAqB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACrE,8EAA8E;QAC9E,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,6EAA6E;QAC7E,4EAA4E;QAC5E,oDAAoD;QACpD,OAAO,YAAY,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,CACtB,qBAAqB,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,OAAO;YACjD,yBAAyB,CAAC,qBAAqB,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAC9E,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,gDAAgD;AAChD,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,KAAa;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;IACvE,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;QACrC,CAAC,IAAI,KAAK,CAAC;IACZ,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,2EAA2E;AAC3E,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,4EAA4E;AAC5E,MAAM,UAAU,wBAAwB,CAAC,GAAW,EAAE,MAAc;IACnE,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC;IACvC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,kBAAkB,MAAM,KAAK,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACtG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/D,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC7C,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc;IAC3C,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,WAAW,GAAG,IAAI,CAAC;IACvB,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,GAAG,CAAC;QAC1C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO;YAAE,SAAS;QAEnC,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,OAAO,EAAE,CAAC;YACb,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,cAAc;gBAAE,WAAW,GAAG,KAAK,CAAC;QACzC,CAAC;aAAM,CAAC;YACP,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC,cAAc;gBAAE,WAAW,GAAG,KAAK,CAAC;QAC1C,CAAC;QACD,cAAc,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC;IACtC,IAAI,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC;IACtC,IAAI,WAAW;QAAE,OAAO,GAAG,CAAC;IAC5B,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAqC,EAAE,IAAY,EAAE,YAAqB;IAC1G,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC;AACvE,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,cAAc,GAAG,kDAAkD,CAAC;AAEjF,MAAM,UAAU,2CAA2C,CAAC,KAAsB;IACjF,yEAAyE;IACzE,qFAAqF;IACrF,cAAc,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,WAAmB;IACjE,MAAM,KAAK,GAAG,gDAAgD,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC7C,cAA2E,EAC3E,WAAmB;IAEnB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,UAAU,GAAG,8BAA8B,CAAC,WAAW,CAAC,CAAC;IAC/D,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,MAAM,6BAA6B,GAAG,mDAAmD,CAAC;AAE1F,iFAAiF;AACjF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,MAAM,UAAU,mCAAmC,CAAC,IAAY;IAC/D,MAAM,uBAAuB,GAAG,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1E,IAAI,uBAAuB,EAAE,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,KAAK,CAAC,CAAC;AACrD,CAAC"}

package/dist/core/secretos/regex.d.ts

@@ -0,0 +1,3 @@
+/** Compile a secret regex entry with global scanning enabled by default. */
+export declare function compileSecretRegex(pattern: string, flags?: string): RegExp;
+//# sourceMappingURL=regex.d.ts.map

package/dist/core/secretos/regex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"regex.d.ts","sourceRoot":"","sources":["../../../src/core/secretos/regex.ts"],"names":[],"mappings":"AAKA,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAc1E"}

package/dist/core/secretos/regex.js

@@ -0,0 +1,19 @@
+/** Add global flag while preserving user-provided flags. */
+function enforceGlobalFlag(flags) {
+    return flags.includes("g") ? flags : `${flags}g`;
+}
+/** Compile a secret regex entry with global scanning enabled by default. */
+export function compileSecretRegex(pattern, flags) {
+    let resolvedPattern = pattern;
+    let resolvedFlags = flags ?? "";
+    // Detect regex literal syntax: /pattern/flags
+    const literalMatch = /^\/((?:[^\\/]|\\.)*)\/([ gimsuy]*)$/.exec(pattern);
+    if (literalMatch) {
+        resolvedPattern = literalMatch[1];
+        // Merge flags from literal with explicit flags param (deduplicate)
+        const combined = new Set([...resolvedFlags, ...literalMatch[2]]);
+        resolvedFlags = [...combined].join("");
+    }
+    return new RegExp(resolvedPattern, enforceGlobalFlag(resolvedFlags));
+}
+//# sourceMappingURL=regex.js.map

package/dist/core/secretos/regex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regex.js","sourceRoot":"","sources":["../../../src/core/secretos/regex.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,SAAS,iBAAiB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC;AAClD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,KAAc;IACjE,IAAI,eAAe,GAAG,OAAO,CAAC;IAC9B,IAAI,aAAa,GAAG,KAAK,IAAI,EAAE,CAAC;IAEhC,8CAA8C;IAC9C,MAAM,YAAY,GAAG,qCAAqC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,YAAY,EAAE,CAAC;QAClB,eAAe,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAClC,mEAAmE;QACnE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,aAAa,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,IAAI,MAAM,CAAC,eAAe,EAAE,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC;AACtE,CAAC"}

package/dist/core/secretos/replacement.d.ts

@@ -0,0 +1,83 @@
+export declare const REPLACEMENT_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+/** Generate a deterministic same-length replacement string from a secret value. */
+export declare function generateDeterministicReplacement(secret: string): string;
+/**
+ * Force a length-preserving deterministic replacement to differ from the secret
+ * it stands in for. `generateDeterministicReplacement` seeds its first 1–2 chars
+ * with the `Z`/`ZZ` sentinel, so a whole configured value that is exactly `Z` or
+ * `ZZ` (or an astronomically unlikely longer hash collision) would otherwise be
+ * emitted unchanged and ship the raw secret to the provider. Flip the first char
+ * to a fixed different glyph: same length, still deterministic, guaranteed != the
+ * secret. Only safe for a whole CONFIGURED value (a plain secret matches its own
+ * literal, so the perturbed output is no longer matched and stays a fixed point);
+ * per-chunk remainders must keep the sentinel to remain idempotent across restart.
+ */
+export declare function ensureDistinctReplacement(replacement: string, secret: string): string;
+export interface RegexMatchContext {
+    /** Full text the match was found in (positions are offsets into it). */
+    text: string;
+    /** Start/end of the matched span being replaced. */
+    start: number;
+    end: number;
+}
+/**
+ * Whether `candidate`, substituted for the matched span in its surrounding text,
+ * is re-matched by `regex` at its own position. A replace-mode regex that depends
+ * on context (lookbehind/lookahead/`\b`) can match a candidate that does NOT match
+ * in isolation: e.g. `(?<=api=)[AZ]` never matches a bare `A`, but `api=A` does, so
+ * a candidate `A` chosen by an isolation test is re-redacted on the next obfuscate()
+ * pass and can oscillate back to the raw matched value. The probe substitutes the
+ * candidate into the FULL text — not a truncated window — so a wide lookbehind or
+ * lookahead (e.g. `(?<=A{600})`) still evaluates against the context that makes it
+ * match. Truncating that context dropped the assertion's reach and falsely
+ * accepted an oscillating, leaky candidate. The scan starts a bounded distance
+ * left of the span and stops once a match begins at/after the span's end (matches
+ * arrive in order), keeping per-candidate cost independent of total text length.
+ */
+export declare function regexRematchesInContext(candidate: string, regex: RegExp, ctx: RegexMatchContext): boolean;
+/**
+ * Search same-length replacements for one the regex does NOT match, so a default
+ * regex secret whose deterministic replacement collides with its own value (the
+ * `Z`/`ZZ` sentinel, or an astronomical hash collision) is still redacted to a
+ * STABLE nonmatching value instead of shipping the raw secret. A nonmatching
+ * candidate is a fixed point under re-obfuscation — the regex never re-matches it,
+ * so it cannot re-leak on a later pass. The search stays bounded to O(length *
+ * alphabet) regardless of value length: first exhaust every single-position
+ * substitution against a deterministic baseline (`AAAA…`, then `!AAA…`, `A!AA…`,
+ * …) so any regex that only needs one out-of-class byte — regardless of position —
+ * is found in a handful of probes rather than enumerating every combination (which
+ * for a 3-byte match-everything config, e.g. `[\s\S]{3}`, would otherwise run
+ * 90**3 = 729000 candidates through the regex on every single match, stalling
+ * provider requests). Candidates are enumerated deterministically over a stable
+ * ASCII alphabet: alphanumerics first (usually enough), then punctuation fallback
+ * bytes when the regex covers every alphanumeric candidate. When the regex still
+ * matches around a lone perturbed byte (for example `[A-Za-z0-9].*` matching the
+ * unperturbed tail), full-width same-byte candidates (`!!!!!`, `_____`, …) are
+ * tried next. When the regex covers every non-whitespace candidate (e.g. `\S{n}`),
+ * whitespace markers (a full space/tab run, then a single whitespace byte among
+ * non-whitespace filler) are tried as a last resort. A genuine match-everything
+ * regex (`.`/`[\s\S]`, which also matches space and tab) still exhausts this bounded
+ * sweep and returns undefined, letting the caller keep its own fixed-point fallback
+ * — bounded search can in principle miss an escape that depends jointly on
+ * multiple positions in a way no single-position swap reaches, but no realistic
+ * secret-redaction regex (character classes, literal matches, anchored/bounded
+ * repeats) has that shape.
+ */
+export declare function findNonMatchingReplacement(value: string, regex: RegExp, context: RegexMatchContext): string | undefined;
+/**
+ * Whether a default (no custom `replacement`) replace-mode regex can never
+ * safely redact a 1-2 char match: `findNonMatchingReplacement`'s bounded
+ * search — the same search `#generateRegexReplacement` runs at match time —
+ * finds no candidate the regex fails to re-match. This holds independent of
+ * any actual per-install key: the search already exhausts every character in
+ * `REPLACEMENT_CHARS` (the alphabet `buildKeyedReplacementRun` draws its
+ * fallback marker from) plus punctuation and whitespace, so if none of those
+ * escape the regex, no key-derived marker drawn from the same alphabet can
+ * either — the marker is guaranteed to re-match too, making every such match
+ * unresolvable: the fallback could only ever emit the raw matched text
+ * unchanged. Probed with a value (`"\0".repeat(length)`) the bounded search
+ * never treats as a real candidate, so the result depends only on the
+ * regex's own matching behavior, not on this specific probe.
+ */
+export declare function regexHasUnresolvableShortMatchFallback(regex: RegExp): boolean;
+//# sourceMappingURL=replacement.d.ts.map

package/dist/core/secretos/replacement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replacement.d.ts","sourceRoot":"","sources":["../../../src/core/secretos/replacement.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,iBAAiB,mEAAmE,CAAC;AASlG,mFAAmF;AACnF,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAkBvE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAIrF;AAaD,MAAM,WAAW,iBAAiB;IACjC,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAkBzG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,0BAA0B,CACzC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,iBAAiB,GACxB,MAAM,GAAG,SAAS,CAuBpB;AAkCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sCAAsC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAU7E"}