@iris-code/core 0.1.2 → 0.3.0

package/dist/rust/lexer.js

@@ -0,0 +1,192 @@
+"use strict";
+/**
+ * The Rust lexical layer, in its own module because TWO callers need it: the
+ * Rust analyser (every structural rule) and `detectParseErrorReason` in
+ * guards.ts (the delimiter balance check that decides whether a file is
+ * analysed at all).
+ *
+ * That second caller is why this exists before any rule. C# shipped a defect
+ * where a verbatim string read as unterminated, every brace after it landed at
+ * the wrong depth, and the file came back a parse error with every finding
+ * zeroed - and a zeroed file is indistinguishable from a clean one.
+ *
+ * Both modes are LENGTH- and LINE-PRESERVING, so a finding's offset still maps
+ * to its native line with no remapping layer that could drift.
+ *
+ * THE LIFETIME IS THE RUST-SPECIFIC TRAP, and it is the exact shape that breaks
+ * a naive scanner. `&'a str` is a reference with a lifetime, not a char literal:
+ * a scanner that treats `'` as opening a character would run to the NEXT
+ * apostrophe somewhere further down the file, blanking real code in between.
+ * Lifetimes appear in most non-trivial Rust, so this is the common case rather
+ * than an edge one.
+ *
+ * Also handled, each with its own way of breaking a naive scan:
+ * - raw strings at any hash depth: `r"..."`, `r#"..."#`, `r##"..."##`, where a
+ *   `"` inside does NOT close the literal
+ * - raw identifiers: `r#type` is an identifier, not a raw string, so `r#` only
+ *   opens a literal when a quote follows the hashes
+ * - byte strings `b"..."` and byte chars `b'x'`, plus `br#"..."#`
+ * - NESTED block comments, which Rust allows and C does not. An inner block
+ *   comment's closer does NOT end the outer one, so a depth counter is the only
+ *   way to see where the comment really ends. (Writing that construct literally
+ *   in this very comment ended it early on the first build - the same class of
+ *   mistake the module exists to prevent.)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.transformRust = transformRust;
+exports.stripRustComments = stripRustComments;
+exports.rustCodeOnly = rustCodeOnly;
+/** True when the `'` at `index` opens a char literal rather than a lifetime. */
+function isCharLiteral(source, index) {
+    // `'\n'`, `'\''`, `'\u{1F600}'`: an escape always means a char literal.
+    if (source[index + 1] === '\\')
+        return true;
+    // `'a'` is a char; `'a` followed by anything else is a lifetime. A char
+    // literal's body is a single scalar, so the quote sits two positions along.
+    if (source[index + 2] === "'")
+        return true;
+    return false;
+}
+function transformRust(source, blankStrings) {
+    let result = '';
+    let i = 0;
+    const blank = (ch) => (ch === '\n' || ch === '\r' ? ch : ' ');
+    const emit = (ch) => { result += blankStrings ? blank(ch) : ch; };
+    while (i < source.length) {
+        const ch = source[i];
+        if (ch === '/' && source[i + 1] === '/') {
+            while (i < source.length && source[i] !== '\n') {
+                result += blank(source[i]);
+                i++;
+            }
+            continue;
+        }
+        // Nested block comments. A single `*/` does not necessarily end the comment.
+        if (ch === '/' && source[i + 1] === '*') {
+            let depth = 0;
+            while (i < source.length) {
+                if (source[i] === '/' && source[i + 1] === '*') {
+                    depth++;
+                    result += '  ';
+                    i += 2;
+                    continue;
+                }
+                if (source[i] === '*' && source[i + 1] === '/') {
+                    depth--;
+                    result += '  ';
+                    i += 2;
+                    if (depth === 0)
+                        break;
+                    continue;
+                }
+                result += blank(source[i]);
+                i++;
+            }
+            continue;
+        }
+        // Raw and byte string prefixes: r"..", r#".."#, b"..", br#".."#.
+        if (ch === 'r' || ch === 'b') {
+            let j = i;
+            if (source[j] === 'b')
+                j++;
+            if (source[j] === 'r') {
+                j++;
+                let hashes = 0;
+                while (source[j] === '#') {
+                    hashes++;
+                    j++;
+                }
+                if (source[j] === '"') {
+                    // A raw string. Its terminator is a quote followed by exactly the
+                    // opening number of hashes, so an inner `"` cannot close it.
+                    const closer = '"' + '#'.repeat(hashes);
+                    for (let k = i; k <= j; k++)
+                        emit(source[k]);
+                    i = j + 1;
+                    while (i < source.length) {
+                        if (source.startsWith(closer, i)) {
+                            for (let k = 0; k < closer.length; k++)
+                                emit(source[i + k]);
+                            i += closer.length;
+                            break;
+                        }
+                        emit(source[i]);
+                        i++;
+                    }
+                    continue;
+                }
+                // `r#type`: a raw identifier, not a literal. Fall through as code.
+            }
+            else if (source[i] === 'b' && (source[j] === '"' || source[j] === "'")) {
+                // Byte string or byte char: emit the prefix, then handle as usual.
+                result += 'b';
+                i++;
+                continue;
+            }
+        }
+        if (ch === '"') {
+            emit(ch);
+            i++;
+            while (i < source.length) {
+                const current = source[i];
+                if (current === '\\') {
+                    emit(current);
+                    i++;
+                    if (i < source.length) {
+                        emit(source[i]);
+                        i++;
+                    }
+                    continue;
+                }
+                emit(current);
+                i++;
+                // Rust strings may span lines, so a newline does not terminate one.
+                if (current === '"')
+                    break;
+            }
+            continue;
+        }
+        if (ch === "'") {
+            if (!isCharLiteral(source, i)) {
+                // A lifetime. Emit the apostrophe as code and carry on; treating it as
+                // a literal would blank everything up to the next apostrophe.
+                result += ch;
+                i++;
+                continue;
+            }
+            emit(ch);
+            i++;
+            while (i < source.length) {
+                const current = source[i];
+                if (current === '\n')
+                    break;
+                if (current === '\\') {
+                    emit(current);
+                    i++;
+                    if (i < source.length) {
+                        emit(source[i]);
+                        i++;
+                    }
+                    continue;
+                }
+                emit(current);
+                i++;
+                if (current === "'")
+                    break;
+            }
+            continue;
+        }
+        result += ch;
+        i++;
+    }
+    return result;
+}
+/** Comments blanked, string contents intact. */
+function stripRustComments(source) {
+    return transformRust(source, false);
+}
+/** Comments AND string contents blanked: the input for anything structural. */
+function rustCodeOnly(source) {
+    return transformRust(source, true);
+}
+//# sourceMappingURL=lexer.js.map

package/dist/rust/lexer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lexer.js","sourceRoot":"","sources":["../../src/rust/lexer.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;;AAYH,sCAwHC;AAGD,8CAEC;AAGD,oCAEC;AA5ID,gFAAgF;AAChF,SAAS,aAAa,CAAC,MAAc,EAAE,KAAa;IAClD,wEAAwE;IACxE,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC3C,wEAAwE;IACxE,4EAA4E;IAC5E,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAC1C,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAgB,aAAa,CAAC,MAAc,EAAE,YAAqB;IACjE,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,MAAM,KAAK,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IAC7E,MAAM,IAAI,GAAG,CAAC,EAAU,EAAQ,EAAE,GAAG,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA,CAAC,CAAC,CAAA;IAE9E,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;QAEpB,IAAI,EAAE,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC,EAAE,CAAA;YAAC,CAAC;YACnF,SAAQ;QACV,CAAC;QAED,6EAA6E;QAC7E,IAAI,EAAE,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,IAAI,KAAK,GAAG,CAAC,CAAA;YACb,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzB,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC/C,KAAK,EAAE,CAAA;oBACP,MAAM,IAAI,IAAI,CAAA;oBACd,CAAC,IAAI,CAAC,CAAA;oBACN,SAAQ;gBACV,CAAC;gBACD,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC/C,KAAK,EAAE,CAAA;oBACP,MAAM,IAAI,IAAI,CAAA;oBACd,CAAC,IAAI,CAAC,CAAA;oBACN,IAAI,KAAK,KAAK,CAAC;wBAAE,MAAK;oBACtB,SAAQ;gBACV,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;gBAC1B,CAAC,EAAE,CAAA;YACL,CAAC;YACD,SAAQ;QACV,CAAC;QAED,iEAAiE;QACjE,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,CAAA;YACT,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAA;YAC1B,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACtB,CAAC,EAAE,CAAA;gBACH,IAAI,MAAM,GAAG,CAAC,CAAA;gBACd,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAAC,MAAM,EAAE,CAAC;oBAAC,CAAC,EAAE,CAAA;gBAAC,CAAC;gBAC3C,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACtB,kEAAkE;oBAClE,6DAA6D;oBAC7D,MAAM,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;oBACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;wBAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;oBAC5C,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;oBACT,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;wBACzB,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;4BACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;gCAAE,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;4BAC3D,CAAC,IAAI,MAAM,CAAC,MAAM,CAAA;4BAClB,MAAK;wBACP,CAAC;wBACD,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;wBACf,CAAC,EAAE,CAAA;oBACL,CAAC;oBACD,SAAQ;gBACV,CAAC;gBACD,mEAAmE;YACrE,CAAC;iBAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBACzE,mEAAmE;gBACnE,MAAM,IAAI,GAAG,CAAA;gBACb,CAAC,EAAE,CAAA;gBACH,SAAQ;YACV,CAAC;QACH,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,CAAC,EAAE,CAAC,CAAA;YACR,CAAC,EAAE,CAAA;YACH,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;gBACzB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,IAAI,CAAC,OAAO,CAAC,CAAA;oBACb,CAAC,EAAE,CAAA;oBACH,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;wBAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;wBAAC,CAAC,EAAE,CAAA;oBAAC,CAAC;oBAC/C,SAAQ;gBACV,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,CAAA;gBACb,CAAC,EAAE,CAAA;gBACH,oEAAoE;gBACpE,IAAI,OAAO,KAAK,GAAG;oBAAE,MAAK;YAC5B,CAAC;YACD,SAAQ;QACV,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC9B,uEAAuE;gBACvE,8DAA8D;gBAC9D,MAAM,IAAI,EAAE,CAAA;gBACZ,CAAC,EAAE,CAAA;gBACH,SAAQ;YACV,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,CAAA;YACR,CAAC,EAAE,CAAA;YACH,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;gBACzB,IAAI,OAAO,KAAK,IAAI;oBAAE,MAAK;gBAC3B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,IAAI,CAAC,OAAO,CAAC,CAAA;oBACb,CAAC,EAAE,CAAA;oBACH,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;wBAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;wBAAC,CAAC,EAAE,CAAA;oBAAC,CAAC;oBAC/C,SAAQ;gBACV,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,CAAA;gBACb,CAAC,EAAE,CAAA;gBACH,IAAI,OAAO,KAAK,GAAG;oBAAE,MAAK;YAC5B,CAAC;YACD,SAAQ;QACV,CAAC;QAED,MAAM,IAAI,EAAE,CAAA;QACZ,CAAC,EAAE,CAAA;IACL,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,gDAAgD;AAChD,SAAgB,iBAAiB,CAAC,MAAc;IAC9C,OAAO,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;AACrC,CAAC;AAED,+EAA+E;AAC/E,SAAgB,YAAY,CAAC,MAAc;IACzC,OAAO,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;AACpC,CAAC"}

package/dist/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAMnD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAO1D;AAoND,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,SAAK,GACZ,eAAe,EAAE,CAsBnB"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAMnD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAO1D;AA8hBD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,SAAK,GACZ,eAAe,EAAE,CA6BnB"}

package/dist/secrets.js

@@ -53,6 +53,8 @@ function detectLayer1Ts(source) {
             continue;
         if (isPlaceholder(value, varName))
             continue;
+        if (valueIsNotACredential(value, varName))
+            continue;
         results.push({
             line: lineOf(source, m.index),
             variable: varName,
@@ -79,6 +81,8 @@ function detectLayer1Go(source) {
             continue;
         if (isPlaceholder(value, varName))
             continue;
+        if (valueIsNotACredential(value, varName))
+            continue;
         results.push({
             line: lineOf(source, m.index),
             variable: varName,
@@ -99,6 +103,8 @@ function detectLayer1Go(source) {
             continue;
         if (isPlaceholder(value, varName))
             continue;
+        if (valueIsNotACredential(value, varName))
+            continue;
         results.push({
             line: lineOf(source, m.index),
             variable: varName,
@@ -124,6 +130,8 @@ function detectLayer1Py(source) {
             continue;
         if (isPlaceholder(value, varName))
             continue;
+        if (valueIsNotACredential(value, varName))
+            continue;
         results.push({
             line: lineOf(source, m.index),
             variable: varName,
@@ -145,6 +153,8 @@ function detectLayer1Ruby(source) {
         const value = m[4] ?? m[5];
         if (!varName || !value || value.length < 8 || !hasSuspectKeyword(varName) || isPlaceholder(value, varName))
             continue;
+        if (valueIsNotACredential(value, varName))
+            continue;
         results.push({ line: lineOf(source, m.index), variable: varName, pattern: 'suspicious-name', message: `Possible hardcoded secret: ${varName} assigned directly to a string literal`, value, maskedValue: maskSecret(value) });
     }
     return results;
@@ -169,6 +179,8 @@ function detectLayer1CSharp(source) {
         const value = m[2] ?? m[3];
         if (!varName || !value || value.length < 8 || !hasSuspectKeyword(varName) || isPlaceholder(value, varName))
             continue;
+        if (valueIsNotACredential(value, varName))
+            continue;
         results.push({ line: lineOf(source, m.index), variable: varName, pattern: 'suspicious-name', message: `Possible hardcoded secret: ${varName} assigned directly to a string literal`, value, maskedValue: maskSecret(value) });
     }
     const xmlRe = /<([A-Za-z_][\w.-]*(?:Key|Token|Secret|Password|Credential|Private|Pwd)[\w.-]*)>([^<]{8,500})<\/\1>/gi;
@@ -177,6 +189,8 @@ function detectLayer1CSharp(source) {
         const value = m[2].trim();
         if (!value || CSHARP_XML_EXEMPT_PROPERTIES.has(varName.toLowerCase()) || isPlaceholder(value, varName))
             continue;
+        if (valueIsNotACredential(value, varName))
+            continue;
         // A value made only of MSBuild property/item references - $(ApiToken),
         // @(Items), %(Meta) - is injected at build time from CI or a secret store.
         // That is the FIX for this rule, so flagging it would punish it.
@@ -186,6 +200,342 @@ function detectLayer1CSharp(source) {
     }
     return results;
 }
+/**
+ * A value that NAMES a credential field rather than holding one.
+ *
+ * `private static final String PASSWORD_FIELD = "password"` and
+ * `API_KEY_HEADER = "X-API-Key"` are constants declaring a key name, and they
+ * are everywhere in Java config and HTTP code. Both halves carry a suspect
+ * keyword, so the variable-name heuristic alone reports every one of them.
+ *
+ * Three conditions together, and all three are needed. The suspect keyword alone
+ * is far too loose: `an0therPr0dSecret` is a plausible password that contains
+ * the segment "secret", and an earlier version of this check silently swallowed
+ * it - trading a false positive for a false NEGATIVE on the rule that matters
+ * most here.
+ *
+ * - NO DIGITS. A field name is `password` or `X-API-Key`; a credential almost
+ *   always carries at least one digit. This is the strongest of the three.
+ * - SHORT. Field names are 8 to 16 characters; credentials are longer.
+ * - The value is a single unspaced identifier or header token that is ITSELF a
+ *   suspect keyword.
+ *
+ * Accepted edge: a genuine credential that is short, digit-free AND contains a
+ * credential word - `secretpass` - is missed. A value that weak is a placeholder
+ * far more often than a live key, and Layer 2 still covers anything with a
+ * recognisable provider format.
+ *
+ * Scoped to the detectors added with it rather than folded into `isPlaceholder`,
+ * so the existing per-language benchmark baselines cannot shift underneath a
+ * change that was about Java. Worth promoting once it has a baseline of its own.
+ */
+function namesAFieldRatherThanHoldingOne(value) {
+    if (value.length > 16)
+        return false;
+    if (!/^[A-Za-z][A-Za-z._-]*$/.test(value))
+        return false;
+    return hasSuspectKeyword(value);
+}
+/** Longest unbroken run of letters and digits. */
+function longestAlphanumericRun(value) {
+    let best = '';
+    let run = '';
+    for (const ch of value) {
+        if (/[A-Za-z0-9]/.test(ch)) {
+            run += ch;
+            if (run.length > best.length)
+                best = run;
+        }
+        else
+            run = '';
+    }
+    return best;
+}
+/**
+ * True when the value contains a run that looks like a generated credential.
+ *
+ * Length alone is not the signal, which the first version of this got wrong: it
+ * treated any 12-character run as credential-shaped, and `authentication` is 14
+ * letters of ordinary English. That single mistake kept `ACKNOWLEDGED_KEY =
+ * "acknowledged"` and a log message containing the word "authentication" in the
+ * results, because the gate refused to let any other rule exempt them.
+ *
+ * A generated credential MIXES letters and digits, or is long enough that no
+ * English word explains it. Both forms are checked against the longest run rather
+ * than the whole value, so separators cannot dilute the signal.
+ */
+function looksCredentialShaped(value) {
+    const run = longestAlphanumericRun(value);
+    if (run.length < 12)
+        return false;
+    return (/[0-9]/.test(run) && /[A-Za-z]/.test(run)) || run.length >= 20;
+}
+/** Letters and digits only, lowercased, so two spellings of one name compare equal. */
+function alphanumericLower(value) {
+    return value.toLowerCase().replace(/[^a-z0-9]/g, '');
+}
+/**
+ * True when the value is the variable's OWN NAME rather than a credential.
+ *
+ * This is the single most common false positive on real Java, and the shape is
+ * unmistakable once seen: a constant that declares a settings key or a JSON field
+ * has a value that mirrors its own identifier.
+ *
+ *     static final String PATTERNS_KEY = "patterns";
+ *     static final String CLUSTER_UUID_KEY = "cluster_uuid";
+ *     static final String HIDDEN_FIELD_KEY = "hidden_field";
+ *     static final String SERVICE_ACCOUNT_TOKEN_DOC_TYPE = "service_account_token";
+ *
+ * Compared after stripping separators and case, and after removing the credential
+ * nouns from the NAME - which is what makes `PATTERNS_KEY` reduce to `patterns`.
+ * `isPlaceholder` already covers exact equality; this covers the suffixed forms.
+ *
+ * Crucially it does NOT fire on a real credential, because a password does not
+ * spell out its own variable name: `PASSWORD = "secret-test-password"` reduces to
+ * `""` vs `secrettestpassword` and still reports.
+ */
+function valueMirrorsItsOwnName(value, varName) {
+    const name = alphanumericLower(varName);
+    const val = alphanumericLower(value);
+    if (val.length < 4 || name.length < 4)
+        return false;
+    if (val === name)
+        return true;
+    // The name minus its credential nouns: PATTERNS_KEY -> patterns.
+    const stripped = [...CREDENTIAL_NOUNS, 'auth', 'api'].reduce((acc, noun) => acc.split(noun).join(''), name);
+    if (stripped.length >= 4 && stripped === val)
+        return true;
+    // The value is the name minus a trailing descriptor:
+    // SERVICE_ACCOUNT_TOKEN_DOC_TYPE -> service_account_token.
+    return val.length >= 6 && name.startsWith(val);
+}
+/**
+ * True when the value is provably not a credential, whatever its variable is
+ * called. Applies to EVERY language's Layer 1, not just the newest ones.
+ *
+ * Found 2026-08-17 by scanning the real Elasticsearch repository: 59 findings in
+ * production source, almost all of them constants whose name carries a credential
+ * word and whose value is a settings key, a path, an algorithm, or a log message.
+ * At 10 points each that buries the real findings, which is worse than missing
+ * them - a rule nobody trusts gets switched off.
+ *
+ * THE GATE COMES FIRST and it is what makes the rest safe: anything containing a
+ * long unbroken alphanumeric run is treated as a credential and never exempted, so
+ * a base64 blob or a 64-character hex token cannot be talked away by the shapes
+ * below. Deliberately NOT included is any "looks random enough" requirement -
+ * that would drop weak-but-real passwords like `secret-test-password`, trading a
+ * visible false positive for an invisible false negative on the highest-value rule
+ * in the product. Noise is annoying; a missed credential is the actual danger.
+ */
+function valueIsNotACredential(value, varName) {
+    const v = value.trim();
+    // Checked BEFORE the gate, because both are unambiguous whatever they contain: a
+    // credential is never a URL, and never a command-line flag. `--validElastic
+    // LicenseKeyConfirmed=` is a 31-character run and would otherwise be held back
+    // by the gate below.
+    if (v.includes('://') || v.startsWith('--'))
+        return true;
+    // Anything credential-shaped is never exempted, whatever else it resembles. This
+    // is what makes every rule below safe to apply.
+    if (looksCredentialShaped(v))
+        return false;
+    if (valueMirrorsItsOwnName(v, varName))
+        return true;
+    // A LOG MESSAGE, not prose in general - and the distinction is the whole point.
+    //
+    // The first version of this read "four or more words is a sentence, so it is not
+    // a password", and the accuracy benchmark rejected it within a minute:
+    // `@password = "correct horse battery staple"` is four words and is a real
+    // passphrase, the XKCD form that security guidance actively recommends. Missing
+    // it would have been the exact trade this function's header refuses to make.
+    //
+    // So a log message has to prove itself: five or more words AND a mark that prose
+    // carries and a passphrase does not - a capitalised opening, punctuation, or a
+    // digit. "Internal cloud API key minted for cross-project datafeed" qualifies;
+    // "correct horse battery staple" does not, and neither does its capitalised form,
+    // because four words is under the floor either way.
+    const words = v.split(/\s+/).filter(Boolean);
+    if (words.length >= 5 && (/^[A-Z]/.test(v) || /[.,;:!?()[\]{}]/.test(v) || /\d/.test(v)))
+        return true;
+    // A path, with or without a leading slash: data/rows.ndjson,
+    // /api/v1/monitor/dep-graph, computeMetadata/v1/instance/service-accounts
+    if (/^\/?[\w.-]+(?:\/[\w.-]+)+\/?$/.test(v))
+        return true;
+    // A namespaced setting key: index.store.snapshot.partial
+    if ((v.match(/\./g) ?? []).length >= 2 && /^[\w.-]+$/.test(v))
+        return true;
+    return false;
+}
+/**
+ * Layer 1: Java fields, locals, and setter calls.
+ *
+ * Java has NO `const`/`let`/`var`-style opener on a field, which is why routing
+ * it to the TypeScript detector left it detecting nothing at all. The everyday
+ * shape - `private static final String apiKey = "..."` - matched no pattern in
+ * this file, so the only Java secrets ever reported were the ones Layer 2 caught
+ * by token FORMAT. A committed database password has no recognisable format, so
+ * it was invisible.
+ *
+ * `var` is included because Java 10+ allows it for locals, and setter calls are
+ * included because `.setPassword("literal")` is as common in Java config code as
+ * a field assignment and is the same mistake.
+ */
+function detectLayer1Java(source) {
+    const results = [];
+    const push = (index, varName, value) => {
+        if (!varName || !value || value.length < 8)
+            return;
+        if (!hasSuspectKeyword(varName) || isPlaceholder(value, varName))
+            return;
+        if (namesAFieldRatherThanHoldingOne(value))
+            return;
+        if (valueIsNotACredential(value, varName))
+            return;
+        results.push({
+            line: lineOf(source, index),
+            variable: varName,
+            pattern: 'suspicious-name',
+            message: `Possible hardcoded secret: ${varName} assigned directly to a string literal`,
+            value,
+            maskedValue: maskSecret(value),
+        });
+    };
+    // Field or local declaration. The modifier list is optional and unordered, so
+    // it is matched as a repeated group rather than a fixed sequence.
+    const declRe = /(?:(?:public|private|protected|static|final|transient|volatile|synchronized)\s+)*\b(?:String|CharSequence|var)\s+([A-Za-z_$][\w$]*)\s*=\s*"([^"\n]{4,500})"/g;
+    let m;
+    while ((m = declRe.exec(source)) !== null)
+        push(m.index, m[1], m[2]);
+    // `.setPassword("...")` / `.setApiKey("...")`: the method name carries the
+    // suspect word, so it plays the part the variable name plays above.
+    const setterRe = /\.\s*(set[A-Z][\w$]*)\s*\(\s*"([^"\n]{4,500})"\s*\)/g;
+    while ((m = setterRe.exec(source)) !== null)
+        push(m.index, m[1].slice(3), m[2]);
+    // `props.put("spring.datasource.password", "...")` and `setProperty(...)`:
+    // here the KEY literal is the name, not the method.
+    const keyedRe = /\b(?:put|setProperty|addProperty|set)\s*\(\s*"([\w.\-]+)"\s*,\s*"([^"\n]{4,500})"\s*\)/g;
+    while ((m = keyedRe.exec(source)) !== null)
+        push(m.index, m[1], m[2]);
+    return results;
+}
+/**
+ * Nouns that NAME a secret, as opposed to describing a mechanism.
+ *
+ * A `.properties` file is mostly settings, and a settings key mentioning
+ * authentication somewhere in its path is not announcing a credential. The JDK's
+ * own `conf/net.properties` ships `jdk.http.ntlm.transparentAuth=disabled`,
+ * which the general suspect-keyword test reports: the key contains `auth` and
+ * the value is eight characters long. `auth` is the weakest word in the set for
+ * exactly this reason - it qualifies a mechanism - so a properties key must end
+ * in a word that names the secret itself.
+ *
+ * `spring.datasource.password` ends in `password` and still fires;
+ * `jdk.http.auth.tunneling.disabledSchemes` ends in `disabledSchemes` and does
+ * not. Found 2026-08-16 by scanning a real JDK installation, not a fixture.
+ */
+const CREDENTIAL_NOUNS = new Set([
+    'key', 'token', 'secret', 'password', 'passwd', 'pwd', 'credential',
+    'credentials', 'apikey', 'accesskey', 'privatekey',
+]);
+/** The final dotted-or-camelCase segment of a properties key. */
+function finalKeySegment(key) {
+    const segments = key
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .replace(/[^A-Za-z0-9]+/g, ' ')
+        .toLowerCase()
+        .split(/\s+/)
+        .filter(Boolean);
+    return segments[segments.length - 1] ?? '';
+}
+/**
+ * Layer 1: `.properties` config files.
+ *
+ * These are the reason `.properties` is a registered Java extension at all: a
+ * `spring.datasource.password` is the most commonly committed Java credential.
+ * They are key/value pairs with no quotes and no declaration keyword, so nothing
+ * else in this file could ever have matched one.
+ */
+function detectLayer1Properties(source) {
+    const results = [];
+    const lines = source.split('\n');
+    lines.forEach((rawLine, index) => {
+        const line = rawLine.trim();
+        // `#` and `!` both start a comment in the .properties format.
+        if (line === '' || line.startsWith('#') || line.startsWith('!'))
+            return;
+        const match = /^([\w.\-/]+)[ \t]*[=:][ \t]*(.*)$/.exec(line);
+        if (!match)
+            return;
+        const key = match[1];
+        const value = match[2].trim();
+        // The key must END in a word that names a secret, not merely contain one
+        // somewhere - see CREDENTIAL_NOUNS.
+        if (!CREDENTIAL_NOUNS.has(finalKeySegment(key)))
+            return;
+        if (value.length < 8 || isPlaceholder(value, key))
+            return;
+        if (namesAFieldRatherThanHoldingOne(value))
+            return;
+        if (valueIsNotACredential(value, key))
+            return;
+        // A value that is only a `${...}` placeholder is resolved at runtime from
+        // the environment or a secret store. That is the FIX for this rule, so
+        // flagging it would punish the correct pattern - the same exemption the
+        // .csproj reader gives `$(MSBuildProperty)` references.
+        if (/^\$\{[^}]*\}$/.test(value))
+            return;
+        results.push({
+            line: index + 1,
+            variable: key,
+            pattern: 'suspicious-name',
+            message: `Possible hardcoded secret: ${key} set directly in a properties file`,
+            value,
+            maskedValue: maskSecret(value),
+        });
+    });
+    return results;
+}
+/**
+ * Layer 1: Rust bindings, constants, statics, and struct-literal fields.
+ *
+ * `let` and `const` happened to work through the TypeScript detector, since it
+ * matches those keywords - but `static API_KEY: &str` did not, and neither did
+ * a struct literal, which is how configuration is usually written in Rust.
+ */
+function detectLayer1Rust(source) {
+    const results = [];
+    const push = (index, varName, value) => {
+        if (!varName || !value || value.length < 8)
+            return;
+        if (!hasSuspectKeyword(varName) || isPlaceholder(value, varName))
+            return;
+        if (namesAFieldRatherThanHoldingOne(value))
+            return;
+        if (valueIsNotACredential(value, varName))
+            return;
+        results.push({
+            line: lineOf(source, index),
+            variable: varName,
+            pattern: 'suspicious-name',
+            message: `Possible hardcoded secret: ${varName} assigned directly to a string literal`,
+            value,
+            maskedValue: maskSecret(value),
+        });
+    };
+    // The type annotation is optional on `let` and required on `const`/`static`,
+    // so it is matched loosely up to the `=`.
+    const bindingRe = /\b(?:let(?:\s+mut)?|const|static(?:\s+mut)?)\s+([A-Za-z_]\w*)\s*(?::\s*[^=\n]+)?=\s*"([^"\n]{4,500})"/g;
+    let m;
+    while ((m = bindingRe.exec(source)) !== null)
+        push(m.index, m[1], m[2]);
+    // Struct literal or map entry: `Config { api_key: "..." }`. Gated on the
+    // suspect-keyword check like everything else, which is what keeps a match arm
+    // or a type position from producing noise.
+    const fieldRe = /(?:^|[{,])\s*([a-z_]\w*)\s*:\s*"([^"\n]{4,500})"/gm;
+    while ((m = fieldRe.exec(source)) !== null)
+        push(m.index, m[1], m[2]);
+    return results;
+}
 // Layer 2: Known secret format patterns — language-agnostic, scan full source
 const KNOWN_PATTERNS = [
     { re: /sk-[a-zA-Z0-9]{10,}/g, name: 'OpenAI/Stripe secret key (sk-)' },
@@ -229,13 +579,19 @@ function detectHardcodedSecrets(source, config, language, filePath = '') {
     // and not real. Skip the suspicious-name heuristic (Layer 1) there, but keep
     // Layer 2 so a genuinely leaked provider token (AWS/Stripe/GitHub/...) is still
     // flagged even when it appears in a test.
+    // A `.properties` file is key/value config, not Java source, so it gets its
+    // own reader rather than the Java one. It is matched on the PATH because the
+    // registry maps the extension to the `java` language key.
+    const isPropertiesFile = /\.properties$/i.test(filePath);
     const layer1 = (0, guards_1.isTestFile)(filePath)
         ? []
         : language === 'go' ? detectLayer1Go(source) :
             language === 'python' ? detectLayer1Py(source) :
                 language === 'ruby' ? detectLayer1Ruby(source) :
                     language === 'csharp' ? detectLayer1CSharp(source) :
-                        detectLayer1Ts(source);
+                        language === 'java' ? (isPropertiesFile ? detectLayer1Properties(source) : detectLayer1Java(source)) :
+                            language === 'rust' ? detectLayer1Rust(source) :
+                                detectLayer1Ts(source);
     const layer2 = detectLayer2(source);
     // Suppress Layer 2 hits on lines already flagged by Layer 1 (avoid duplicate Problems entries)
     const layer1Lines = new Set(layer1.map(s => s.line));