code-secret-handler 1.0.0

package/dist/reporter/csv.js

@@ -0,0 +1,56 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeCsvReport = writeCsvReport;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+function escapeCsv(value) {
+    // If value contains comma, newline, or double quote, wrap in quotes
+    if (/[",\n\r]/.test(value)) {
+        return `"${value.replace(/"/g, '""')}"`;
+    }
+    return value;
+}
+function maskValue(value) {
+    if (value.length <= 8)
+        return '*'.repeat(value.length);
+    return value.slice(0, 4) + '*'.repeat(Math.min(value.length - 8, 20)) + value.slice(-4);
+}
+/**
+ * Writes a CSV report of the scan findings.
+ */
+function writeCsvReport(summary, outputPath) {
+    const headers = [
+        'File',
+        'Line',
+        'Column',
+        'Severity',
+        'Rule ID',
+        'Description',
+        'Env Key',
+        'Masked Value',
+        'Line Content',
+    ];
+    const rows = summary.findings.map(f => [
+        f.file,
+        String(f.line),
+        String(f.column),
+        f.rule.severity,
+        f.rule.id,
+        f.rule.description,
+        f.envKey,
+        maskValue(f.rawValue),
+        f.lineContent.trim(),
+    ]);
+    const csvLines = [
+        headers.map(escapeCsv).join(','),
+        ...rows.map(row => row.map(escapeCsv).join(',')),
+    ];
+    const dir = path_1.default.dirname(outputPath);
+    if (!fs_1.default.existsSync(dir))
+        fs_1.default.mkdirSync(dir, { recursive: true });
+    fs_1.default.writeFileSync(outputPath, csvLines.join('\n'), 'utf-8');
+}
+//# sourceMappingURL=csv.js.map

package/dist/reporter/csv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csv.js","sourceRoot":"","sources":["../../src/reporter/csv.ts"],"names":[],"mappings":";;;;;;AAAA,4CAAoB;AACpB,gDAAwB;AAGxB,SAAS,SAAS,CAAC,KAAa;IAC9B,oEAAoE;IACpE,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED;;GAEG;AACH,wBAA+B,OAAoB,EAAE,UAAkB;IACrE,MAAM,OAAO,GAAG;QACd,MAAM;QACN,MAAM;QACN,QAAQ;QACR,UAAU;QACV,SAAS;QACT,aAAa;QACb,SAAS;QACT,cAAc;QACd,cAAc;KACf,CAAC;IAEF,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,CAAC,CAAC,IAAI;QACN,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACd,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAChB,CAAC,CAAC,IAAI,CAAC,QAAQ;QACf,CAAC,CAAC,IAAI,CAAC,EAAE;QACT,CAAC,CAAC,IAAI,CAAC,WAAW;QAClB,CAAC,CAAC,MAAM;QACR,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QACrB,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE;KACrB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG;QACf,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAChC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KACjD,CAAC;IAEF,MAAM,GAAG,GAAG,cAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,YAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEhE,YAAE,CAAC,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC"}

package/dist/reporter/index.d.ts

@@ -0,0 +1,13 @@
+import { ReportFormat, ScanSummary } from '../types';
+/**
+ * Derives the default output file path for a given report format.
+ */
+export declare function defaultOutputPath(format: ReportFormat, targetDir: string): string;
+/**
+ * Runs the appropriate reporter(s) based on the chosen format.
+ * Always prints a console summary; file reporters write to outputPath.
+ *
+ * @returns The output file path (empty string for console-only).
+ */
+export declare function runReporter(format: ReportFormat, summary: ScanSummary, outputPath?: string): string;
+//# sourceMappingURL=index.d.ts.map

package/dist/reporter/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/reporter/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAYrD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAIjF;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,WAAW,EACpB,UAAU,CAAC,EAAE,MAAM,GAClB,MAAM,CAqBR"}

package/dist/reporter/index.js

@@ -0,0 +1,52 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultOutputPath = defaultOutputPath;
+exports.runReporter = runReporter;
+const path_1 = __importDefault(require("path"));
+const console_1 = require("./console");
+const json_1 = require("./json");
+const csv_1 = require("./csv");
+const markdown_1 = require("./markdown");
+const EXT_MAP = {
+    json: 'json',
+    csv: 'csv',
+    markdown: 'md',
+};
+/**
+ * Derives the default output file path for a given report format.
+ */
+function defaultOutputPath(format, targetDir) {
+    if (format === 'console')
+        return '';
+    const ext = EXT_MAP[format];
+    return path_1.default.join(targetDir, `secret-scan-report.${ext}`);
+}
+/**
+ * Runs the appropriate reporter(s) based on the chosen format.
+ * Always prints a console summary; file reporters write to outputPath.
+ *
+ * @returns The output file path (empty string for console-only).
+ */
+function runReporter(format, summary, outputPath) {
+    // Always print the console report
+    (0, console_1.printConsoleReport)(summary);
+    if (format === 'console')
+        return '';
+    const filePath = outputPath || defaultOutputPath(format, summary.targetDir);
+    switch (format) {
+        case 'json':
+            (0, json_1.writeJsonReport)(summary, filePath);
+            break;
+        case 'csv':
+            (0, csv_1.writeCsvReport)(summary, filePath);
+            break;
+        case 'markdown':
+            (0, markdown_1.writeMarkdownReport)(summary, filePath);
+            break;
+    }
+    return filePath;
+}
+//# sourceMappingURL=index.js.map

package/dist/reporter/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/reporter/index.ts"],"names":[],"mappings":";;;;;;;AAAA,gDAAwB;AAExB,uCAA+C;AAC/C,iCAAyC;AACzC,+BAAuC;AACvC,yCAAiD;AAEjD,MAAM,OAAO,GAAqD;IAChE,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;IACV,QAAQ,EAAE,IAAI;CACf,CAAC;AAEF;;GAEG;AACH,2BAAkC,MAAoB,EAAE,SAAiB;IACvE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,sBAAsB,GAAG,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,qBACE,MAAoB,EACpB,OAAoB,EACpB,UAAmB;IAEnB,kCAAkC;IAClC,IAAA,4BAAkB,EAAC,OAAO,CAAC,CAAC;IAE5B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,QAAQ,GAAG,UAAU,IAAI,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAE5E,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,IAAA,sBAAe,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnC,MAAM;QACR,KAAK,KAAK;YACR,IAAA,oBAAc,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAClC,MAAM;QACR,KAAK,UAAU;YACb,IAAA,8BAAmB,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvC,MAAM;IACV,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/reporter/json.d.ts

@@ -0,0 +1,7 @@
+import { ScanSummary } from '../types';
+/**
+ * Writes a JSON report of the scan summary to disk.
+ * The raw secret values are masked in the report.
+ */
+export declare function writeJsonReport(summary: ScanSummary, outputPath: string): void;
+//# sourceMappingURL=json.d.ts.map

package/dist/reporter/json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../src/reporter/json.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvC;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAqB9E"}

package/dist/reporter/json.js

@@ -0,0 +1,39 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeJsonReport = writeJsonReport;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+/**
+ * Writes a JSON report of the scan summary to disk.
+ * The raw secret values are masked in the report.
+ */
+function writeJsonReport(summary, outputPath) {
+    const sanitized = {
+        ...summary,
+        findings: summary.findings.map(f => ({
+            file: f.file,
+            line: f.line,
+            column: f.column,
+            envKey: f.envKey,
+            ruleId: f.rule.id,
+            description: f.rule.description,
+            severity: f.rule.severity,
+            // Mask the value in the report
+            maskedValue: maskValue(f.rawValue),
+            lineContent: f.lineContent.trim(),
+        })),
+    };
+    const dir = path_1.default.dirname(outputPath);
+    if (!fs_1.default.existsSync(dir))
+        fs_1.default.mkdirSync(dir, { recursive: true });
+    fs_1.default.writeFileSync(outputPath, JSON.stringify(sanitized, null, 2), 'utf-8');
+}
+function maskValue(value) {
+    if (value.length <= 8)
+        return '*'.repeat(value.length);
+    return value.slice(0, 4) + '*'.repeat(Math.min(value.length - 8, 20)) + value.slice(-4);
+}
+//# sourceMappingURL=json.js.map

package/dist/reporter/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../src/reporter/json.ts"],"names":[],"mappings":";;;;;;AAAA,4CAAoB;AACpB,gDAAwB;AAGxB;;;GAGG;AACH,yBAAgC,OAAoB,EAAE,UAAkB;IACtE,MAAM,SAAS,GAAG;QAChB,GAAG,OAAO;QACV,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE;YACjB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;YAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ;YACzB,+BAA+B;YAC/B,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;YAClC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE;SAClC,CAAC,CAAC;KACJ,CAAC;IAEF,MAAM,GAAG,GAAG,cAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,YAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEhE,YAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC"}

package/dist/reporter/markdown.d.ts

@@ -0,0 +1,6 @@
+import { ScanSummary } from '../types';
+/**
+ * Writes a Markdown report suitable for GitHub/GitLab issue or PR comments.
+ */
+export declare function writeMarkdownReport(summary: ScanSummary, outputPath: string): void;
+//# sourceMappingURL=markdown.d.ts.map

package/dist/reporter/markdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/reporter/markdown.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAqB,MAAM,UAAU,CAAC;AA+B1D;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CA0ElF"}

package/dist/reporter/markdown.js

@@ -0,0 +1,106 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeMarkdownReport = writeMarkdownReport;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const SEVERITY_BADGE = {
+    critical: '![critical](https://img.shields.io/badge/severity-CRITICAL-red)',
+    high: '![high](https://img.shields.io/badge/severity-HIGH-orange)',
+    medium: '![medium](https://img.shields.io/badge/severity-MEDIUM-yellow)',
+    low: '![low](https://img.shields.io/badge/severity-LOW-blue)',
+};
+const SEVERITY_EMOJI = {
+    critical: '🚨',
+    high: '🔴',
+    medium: '🟡',
+    low: '🔵',
+};
+function maskValue(value) {
+    if (value.length <= 8)
+        return '`' + '*'.repeat(value.length) + '`';
+    const masked = value.slice(0, 4) + '*'.repeat(Math.min(value.length - 8, 20)) + value.slice(-4);
+    return '`' + masked + '`';
+}
+function groupByFile(findings) {
+    const map = new Map();
+    for (const f of findings) {
+        if (!map.has(f.file))
+            map.set(f.file, []);
+        map.get(f.file).push(f);
+    }
+    return map;
+}
+/**
+ * Writes a Markdown report suitable for GitHub/GitLab issue or PR comments.
+ */
+function writeMarkdownReport(summary, outputPath) {
+    const { findings, filesScanned, filesWithSecrets, totalFindings, dryRun, envFile, scannedAt, targetDir } = summary;
+    const lines = [];
+    lines.push('# 🔐 Code Secret Handler — Scan Report\n');
+    lines.push(`> Generated: \`${scannedAt}\`\n`);
+    lines.push(`- **Target directory:** \`${targetDir}\`  `);
+    lines.push(`- **Files scanned:** ${filesScanned}  `);
+    lines.push(`- **Files with secrets:** ${filesWithSecrets}  `);
+    lines.push(`- **Total secrets found:** **${totalFindings}**  `);
+    lines.push(`- **Env file:** \`${envFile}\`  `);
+    if (dryRun)
+        lines.push(`- ⚠️ **DRY RUN** — no files were modified`);
+    lines.push('');
+    if (totalFindings === 0) {
+        lines.push('## ✅ No hardcoded secrets detected!\n');
+        lines.push('Great job keeping your codebase clean.\n');
+    }
+    else {
+        // Severity summary table
+        const bySeverity = { critical: 0, high: 0, medium: 0, low: 0 };
+        for (const f of findings)
+            bySeverity[f.rule.severity]++;
+        lines.push('## Summary\n');
+        lines.push('| Severity | Count |');
+        lines.push('|----------|-------|');
+        for (const [sev, count] of Object.entries(bySeverity)) {
+            if (count === 0)
+                continue;
+            lines.push(`| ${SEVERITY_EMOJI[sev]} ${sev.toUpperCase()} | ${count} |`);
+        }
+        lines.push('');
+        // Findings by file
+        lines.push('## Findings\n');
+        const byFile = groupByFile(findings);
+        for (const [filePath, fileFindings] of byFile) {
+            const relPath = path_1.default.relative(targetDir, filePath);
+            lines.push(`### 📄 \`${relPath}\`\n`);
+            lines.push('| Line | Col | Severity | Rule | Description | Env Key | Masked Value |');
+            lines.push('|------|-----|----------|------|-------------|---------|--------------|');
+            for (const f of fileFindings) {
+                lines.push(`| ${f.line} | ${f.column} | ${SEVERITY_EMOJI[f.rule.severity]} ${f.rule.severity.toUpperCase()} | \`${f.rule.id}\` | ${f.rule.description} | \`${f.envKey}\` | ${maskValue(f.rawValue)} |`);
+            }
+            lines.push('');
+            // Code snippet for each finding
+            for (const f of fileFindings) {
+                lines.push('<details>');
+                lines.push(`<summary>Line ${f.line} — <code>${f.rule.id}</code></summary>\n`);
+                lines.push('```');
+                lines.push(f.lineContent);
+                lines.push('```\n');
+                lines.push('</details>\n');
+            }
+        }
+        // Recommendations
+        lines.push('## 🛡️ Recommendations\n');
+        lines.push('1. Verify the changes made to your source files.');
+        lines.push('2. Ensure `.env` is listed in `.gitignore`.');
+        lines.push('3. Rotate any secrets that may have been exposed in git history.');
+        lines.push('4. Consider using a secrets manager (AWS Secrets Manager, HashiCorp Vault, etc.).');
+        lines.push('5. Set up a pre-commit hook to prevent future secret leaks.');
+        lines.push('');
+    }
+    const dir = path_1.default.dirname(outputPath);
+    if (!fs_1.default.existsSync(dir))
+        fs_1.default.mkdirSync(dir, { recursive: true });
+    fs_1.default.writeFileSync(outputPath, lines.join('\n'), 'utf-8');
+}
+//# sourceMappingURL=markdown.js.map

package/dist/reporter/markdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.js","sourceRoot":"","sources":["../../src/reporter/markdown.ts"],"names":[],"mappings":";;;;;;AAAA,4CAAoB;AACpB,gDAAwB;AAGxB,MAAM,cAAc,GAA6B;IAC/C,QAAQ,EAAE,iEAAiE;IAC3E,IAAI,EAAE,4DAA4D;IAClE,MAAM,EAAE,gEAAgE;IACxE,GAAG,EAAE,wDAAwD;CAC9D,CAAC;AAEF,MAAM,cAAc,GAA6B;IAC/C,QAAQ,EAAE,IAAI;IACd,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,IAAI;IACZ,GAAG,EAAE,IAAI;CACV,CAAC;AAEF,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC;IACnE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,OAAO,GAAG,GAAG,MAAM,GAAG,GAAG,CAAC;AAC5B,CAAC;AAED,SAAS,WAAW,CAAC,QAAmB;IACtC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAqB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,6BAAoC,OAAoB,EAAE,UAAkB;IAC1E,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAEnH,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACvD,KAAK,CAAC,IAAI,CAAC,kBAAkB,SAAS,MAAM,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,CAAC,6BAA6B,SAAS,MAAM,CAAC,CAAC;IACzD,KAAK,CAAC,IAAI,CAAC,wBAAwB,YAAY,IAAI,CAAC,CAAC;IACrD,KAAK,CAAC,IAAI,CAAC,6BAA6B,gBAAgB,IAAI,CAAC,CAAC;IAC9D,KAAK,CAAC,IAAI,CAAC,gCAAgC,aAAa,MAAM,CAAC,CAAC;IAChE,KAAK,CAAC,IAAI,CAAC,qBAAqB,OAAO,MAAM,CAAC,CAAC;IAC/C,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IACpE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACpD,KAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,yBAAyB;QACzB,MAAM,UAAU,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAExD,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,IAAI,KAAK,KAAK,CAAC;gBAAE,SAAS;YAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,cAAc,CAAC,GAAe,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC;QACvF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,mBAAmB;QACnB,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QAErC,KAAK,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,MAAM,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,cAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,MAAM,CAAC,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;YACtF,KAAK,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;YAEtF,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;gBAC7B,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,MAAM,MAAM,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,CAAC,MAAM,QAAQ,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAC5L,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAEf,gCAAgC;YAChC,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;gBAC7B,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC,CAAC;gBAC9E,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,kBAAkB;QAClB,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QAC/E,KAAK,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;QAChG,KAAK,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;QAC1E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,GAAG,GAAG,cAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,YAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEhE,YAAE,CAAC,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC"}

package/dist/rewriter/index.d.ts

@@ -0,0 +1,9 @@
+import { Finding, RewriteResult } from '../types';
+/**
+ * Groups findings by file, applies the correct language rewriter to each file,
+ * and writes the updated content back to disk.
+ *
+ * @returns Array of RewriteResult, one per modified file.
+ */
+export declare function rewriteFiles(findings: Finding[], dryRun?: boolean): RewriteResult[];
+//# sourceMappingURL=index.d.ts.map

package/dist/rewriter/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rewriter/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAA4B,aAAa,EAAE,MAAM,UAAU,CAAC;AAmC5E;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,UAAQ,GAAG,aAAa,EAAE,CAyDjF"}

package/dist/rewriter/index.js

@@ -0,0 +1,95 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewriteFiles = rewriteFiles;
+const fs_1 = __importDefault(require("fs"));
+const langDetector_1 = require("./langDetector");
+const javascript_1 = require("./templates/javascript");
+const python_1 = require("./templates/python");
+const java_1 = require("./templates/java");
+const go_1 = require("./templates/go");
+const ruby_1 = require("./templates/ruby");
+const php_1 = require("./templates/php");
+const csharp_1 = require("./templates/csharp");
+const rust_1 = require("./templates/rust");
+const shell_1 = require("./templates/shell");
+const yaml_1 = require("./templates/yaml");
+const properties_1 = require("./templates/properties");
+const toml_1 = require("./templates/toml");
+const generic_1 = require("./templates/generic");
+const REWRITERS = {
+    javascript: javascript_1.rewriteJavaScript,
+    typescript: javascript_1.rewriteJavaScript, // TS uses same accessor as JS
+    python: python_1.rewritePython,
+    java: java_1.rewriteJava,
+    go: go_1.rewriteGo,
+    ruby: ruby_1.rewriteRuby,
+    php: php_1.rewritePhp,
+    csharp: csharp_1.rewriteCSharp,
+    rust: rust_1.rewriteRust,
+    shell: shell_1.rewriteShell,
+    yaml: yaml_1.rewriteYaml,
+    toml: toml_1.rewriteToml,
+    properties: properties_1.rewriteProperties,
+    generic: generic_1.rewriteGeneric,
+};
+/**
+ * Groups findings by file, applies the correct language rewriter to each file,
+ * and writes the updated content back to disk.
+ *
+ * @returns Array of RewriteResult, one per modified file.
+ */
+function rewriteFiles(findings, dryRun = false) {
+    // Group findings by file
+    const byFile = new Map();
+    for (const finding of findings) {
+        if (!byFile.has(finding.file))
+            byFile.set(finding.file, []);
+        byFile.get(finding.file).push(finding);
+    }
+    const results = [];
+    for (const [filePath, fileFindings] of byFile) {
+        let fileContent;
+        try {
+            fileContent = fs_1.default.readFileSync(filePath, 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        const language = (0, langDetector_1.detectLanguage)(filePath);
+        const rewriterFn = REWRITERS[language];
+        // Apply each finding's rewrite sequentially on the evolving content
+        let currentContent = fileContent;
+        let totalReplacements = 0;
+        let dotenvInjected = false;
+        for (const finding of fileFindings) {
+            const ctx = {
+                finding,
+                language,
+                fileContent: currentContent,
+            };
+            const result = rewriterFn(ctx);
+            if (result.replacements > 0) {
+                currentContent = result.rewrittenContent;
+                totalReplacements += result.replacements;
+                if (result.dotenvInjected)
+                    dotenvInjected = true;
+            }
+        }
+        const finalResult = {
+            filePath,
+            originalContent: fileContent,
+            rewrittenContent: currentContent,
+            replacements: totalReplacements,
+            dotenvInjected,
+        };
+        results.push(finalResult);
+        if (!dryRun && totalReplacements > 0) {
+            fs_1.default.writeFileSync(filePath, currentContent, 'utf-8');
+        }
+    }
+    return results;
+}
+//# sourceMappingURL=index.js.map

package/dist/rewriter/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rewriter/index.ts"],"names":[],"mappings":";;;;;;AAAA,4CAAoB;AAEpB,iDAAgD;AAChD,uDAA2D;AAC3D,+CAAmD;AACnD,2CAA+C;AAC/C,uCAA2C;AAC3C,2CAA+C;AAC/C,yCAA6C;AAC7C,+CAAmD;AACnD,2CAA+C;AAC/C,6CAAiD;AACjD,2CAA+C;AAC/C,uDAA2D;AAC3D,2CAA+C;AAC/C,iDAAqD;AAIrD,MAAM,SAAS,GAAiC;IAC9C,UAAU,EAAE,8BAAiB;IAC7B,UAAU,EAAE,8BAAiB,EAAG,8BAA8B;IAC9D,MAAM,EAAE,sBAAa;IACrB,IAAI,EAAE,kBAAW;IACjB,EAAE,EAAE,cAAS;IACb,IAAI,EAAE,kBAAW;IACjB,GAAG,EAAE,gBAAU;IACf,MAAM,EAAE,sBAAa;IACrB,IAAI,EAAE,kBAAW;IACjB,KAAK,EAAE,oBAAY;IACnB,IAAI,EAAE,kBAAW;IACjB,IAAI,EAAE,kBAAW;IACjB,UAAU,EAAE,8BAAiB;IAC7B,OAAO,EAAE,wBAAc;CACxB,CAAC;AAEF;;;;;GAKG;AACH,sBAA6B,QAAmB,EAAE,MAAM,GAAG,KAAK;IAC9D,yBAAyB;IACzB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,KAAK,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,MAAM,EAAE,CAAC;QAC9C,IAAI,WAAmB,CAAC;QACxB,IAAI,CAAC;YACH,WAAW,GAAG,YAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,6BAAc,EAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAEvC,oEAAoE;QACpE,IAAI,cAAc,GAAG,WAAW,CAAC;QACjC,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;QAE3B,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,MAAM,GAAG,GAAmB;gBAC1B,OAAO;gBACP,QAAQ;gBACR,WAAW,EAAE,cAAc;aAC5B,CAAC;YAEF,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;gBAC5B,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC;gBACzC,iBAAiB,IAAI,MAAM,CAAC,YAAY,CAAC;gBACzC,IAAI,MAAM,CAAC,cAAc;oBAAE,cAAc,GAAG,IAAI,CAAC;YACnD,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAkB;YACjC,QAAQ;YACR,eAAe,EAAE,WAAW;YAC5B,gBAAgB,EAAE,cAAc;YAChC,YAAY,EAAE,iBAAiB;YAC/B,cAAc;SACf,CAAC;QAEF,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAE1B,IAAI,CAAC,MAAM,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;YACrC,YAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/rewriter/langDetector.d.ts

@@ -0,0 +1,7 @@
+import { Language } from '../types';
+/**
+ * Detects the programming language of a file by its path.
+ * Falls back to 'generic' if unknown.
+ */
+export declare function detectLanguage(filePath: string): Language;
+//# sourceMappingURL=langDetector.d.ts.map

package/dist/rewriter/langDetector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"langDetector.d.ts","sourceRoot":"","sources":["../../src/rewriter/langDetector.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AA6EpC;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAWzD"}

package/dist/rewriter/langDetector.js

@@ -0,0 +1,96 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectLanguage = detectLanguage;
+const path_1 = __importDefault(require("path"));
+/**
+ * Maps file extensions to language identifiers.
+ */
+const EXT_MAP = {
+    // JavaScript / TypeScript
+    '.js': 'javascript',
+    '.jsx': 'javascript',
+    '.mjs': 'javascript',
+    '.cjs': 'javascript',
+    '.ts': 'typescript',
+    '.tsx': 'typescript',
+    '.vue': 'javascript', // Vue SFCs use JS/TS — use JS accessor
+    '.svelte': 'javascript', // Svelte uses JS
+    // Python
+    '.py': 'python',
+    '.pyw': 'python',
+    // Java / Kotlin / Scala
+    '.java': 'java',
+    '.kt': 'java',
+    '.kts': 'java',
+    '.scala': 'java',
+    '.groovy': 'java',
+    // Go
+    '.go': 'go',
+    // Ruby
+    '.rb': 'ruby',
+    '.rake': 'ruby',
+    '.gemspec': 'ruby',
+    // PHP
+    '.php': 'php',
+    '.php3': 'php',
+    '.php4': 'php',
+    '.php5': 'php',
+    '.phtml': 'php',
+    // C# / .NET
+    '.cs': 'csharp',
+    '.vb': 'csharp',
+    '.fs': 'csharp',
+    '.fsx': 'csharp',
+    // Rust
+    '.rs': 'rust',
+    // Shell
+    '.sh': 'shell',
+    '.bash': 'shell',
+    '.zsh': 'shell',
+    '.fish': 'shell',
+    '.ps1': 'shell',
+    '.psm1': 'shell',
+    '.bat': 'shell',
+    '.cmd': 'shell',
+    // Config formats (YAML, TOML, properties)
+    '.yaml': 'yaml',
+    '.yml': 'yaml',
+    '.toml': 'toml',
+    '.ini': 'properties',
+    '.properties': 'properties',
+    '.conf': 'properties',
+    '.env': 'properties',
+};
+/**
+ * Exact filename mappings (no extension or special names).
+ */
+const FILENAME_MAP = {
+    Dockerfile: 'shell',
+    Makefile: 'shell',
+    '.env': 'properties',
+    '.envrc': 'shell',
+    '.bashrc': 'shell',
+    '.zshrc': 'shell',
+    '.profile': 'shell',
+    Gemfile: 'ruby',
+    Rakefile: 'ruby',
+};
+/**
+ * Detects the programming language of a file by its path.
+ * Falls back to 'generic' if unknown.
+ */
+function detectLanguage(filePath) {
+    const basename = path_1.default.basename(filePath);
+    const ext = path_1.default.extname(filePath).toLowerCase();
+    // Check exact filename first
+    if (FILENAME_MAP[basename])
+        return FILENAME_MAP[basename];
+    // Check extension
+    if (ext && EXT_MAP[ext])
+        return EXT_MAP[ext];
+    return 'generic';
+}
+//# sourceMappingURL=langDetector.js.map

package/dist/rewriter/langDetector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"langDetector.js","sourceRoot":"","sources":["../../src/rewriter/langDetector.ts"],"names":[],"mappings":";;;;;;AAAA,gDAAwB;AAGxB;;GAEG;AACH,MAAM,OAAO,GAA6B;IACxC,0BAA0B;IAC1B,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY,EAAM,uCAAuC;IACjE,SAAS,EAAE,YAAY,EAAG,iBAAiB;IAC3C,SAAS;IACT,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,QAAQ;IAChB,wBAAwB;IACxB,OAAO,EAAE,MAAM;IACf,KAAK,EAAE,MAAM;IACb,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,MAAM;IACjB,KAAK;IACL,KAAK,EAAE,IAAI;IACX,OAAO;IACP,KAAK,EAAE,MAAM;IACb,OAAO,EAAE,MAAM;IACf,UAAU,EAAE,MAAM;IAClB,MAAM;IACN,MAAM,EAAE,KAAK;IACb,OAAO,EAAE,KAAK;IACd,OAAO,EAAE,KAAK;IACd,OAAO,EAAE,KAAK;IACd,QAAQ,EAAE,KAAK;IACf,YAAY;IACZ,KAAK,EAAE,QAAQ;IACf,KAAK,EAAE,QAAQ;IACf,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,QAAQ;IAChB,OAAO;IACP,KAAK,EAAE,MAAM;IACb,QAAQ;IACR,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,OAAO;IAChB,MAAM,EAAE,OAAO;IACf,OAAO,EAAE,OAAO;IAChB,MAAM,EAAE,OAAO;IACf,OAAO,EAAE,OAAO;IAChB,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,OAAO;IACf,0CAA0C;IAC1C,OAAO,EAAE,MAAM;IACf,MAAM,EAAE,MAAM;IACd,OAAO,EAAE,MAAM;IACf,MAAM,EAAE,YAAY;IACpB,aAAa,EAAE,YAAY;IAC3B,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,YAAY;CACrB,CAAC;AAEF;;GAEG;AACH,MAAM,YAAY,GAA6B;IAC7C,UAAU,EAAE,OAAO;IACnB,QAAQ,EAAE,OAAO;IACjB,MAAM,EAAE,YAAY;IACpB,QAAQ,EAAE,OAAO;IACjB,SAAS,EAAE,OAAO;IAClB,QAAQ,EAAE,OAAO;IACjB,UAAU,EAAE,OAAO;IACnB,OAAO,EAAE,MAAM;IACf,QAAQ,EAAE,MAAM;CACjB,CAAC;AAEF;;;GAGG;AACH,wBAA+B,QAAgB;IAC7C,MAAM,QAAQ,GAAG,cAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,cAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAEjD,6BAA6B;IAC7B,IAAI,YAAY,CAAC,QAAQ,CAAC;QAAE,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAE1D,kBAAkB;IAClB,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IAE7C,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/rewriter/templates/csharp.d.ts

@@ -0,0 +1,8 @@
+import { RewriteContext, RewriteResult } from '../../types';
+/**
+ * Rewrites C# / .NET files:
+ *  - Replaces literal secret with `Environment.GetEnvironmentVariable("KEY")`
+ *  - Adds `using System;` if not present
+ */
+export declare function rewriteCSharp(ctx: RewriteContext): RewriteResult;
+//# sourceMappingURL=csharp.d.ts.map

package/dist/rewriter/templates/csharp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csharp.d.ts","sourceRoot":"","sources":["../../../src/rewriter/templates/csharp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,aAAa,CA8BhE"}

package/dist/rewriter/templates/csharp.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewriteCSharp = rewriteCSharp;
+/**
+ * Rewrites C# / .NET files:
+ *  - Replaces literal secret with `Environment.GetEnvironmentVariable("KEY")`
+ *  - Adds `using System;` if not present
+ */
+function rewriteCSharp(ctx) {
+    const { finding, fileContent } = ctx;
+    const { rawValue, envKey } = finding;
+    let rewrittenContent = fileContent;
+    let replacements = 0;
+    let dotenvInjected = false;
+    const escaped = rawValue.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const re = new RegExp(`"${escaped}"`, 'g');
+    if (re.test(rewrittenContent)) {
+        rewrittenContent = rewrittenContent.replace(re, `Environment.GetEnvironmentVariable("${envKey}")`);
+        replacements++;
+    }
+    if (replacements === 0)
+        return { filePath: finding.file, originalContent: fileContent, rewrittenContent: fileContent, replacements: 0, dotenvInjected: false };
+    const hasSystemUsing = /^using System;/m.test(rewrittenContent);
+    if (!hasSystemUsing) {
+        rewrittenContent = `using System;\n` + rewrittenContent;
+        dotenvInjected = true;
+    }
+    return {
+        filePath: finding.file,
+        originalContent: fileContent,
+        rewrittenContent,
+        replacements,
+        dotenvInjected,
+    };
+}
+//# sourceMappingURL=csharp.js.map

package/dist/rewriter/templates/csharp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csharp.js","sourceRoot":"","sources":["../../../src/rewriter/templates/csharp.ts"],"names":[],"mappings":";;;AAEA;;;;GAIG;AACH,uBAA8B,GAAmB;IAC/C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAErC,IAAI,gBAAgB,GAAG,WAAW,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC9B,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,uCAAuC,MAAM,IAAI,CAAC,CAAC;QACnG,YAAY,EAAE,CAAC;IACjB,CAAC;IAED,IAAI,YAAY,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAE/J,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAChE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,gBAAgB,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;QACxD,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,IAAI;QACtB,eAAe,EAAE,WAAW;QAC5B,gBAAgB;QAChB,YAAY;QACZ,cAAc;KACf,CAAC;AACJ,CAAC"}

package/dist/rewriter/templates/generic.d.ts

@@ -0,0 +1,7 @@
+import { RewriteContext, RewriteResult } from '../../types';
+/**
+ * Generic fallback rewriter:
+ *  - Replaces the literal secret with `${KEY}` wherever it appears as a quoted string.
+ */
+export declare function rewriteGeneric(ctx: RewriteContext): RewriteResult;
+//# sourceMappingURL=generic.d.ts.map

package/dist/rewriter/templates/generic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic.d.ts","sourceRoot":"","sources":["../../../src/rewriter/templates/generic.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5D;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,aAAa,CAmCjE"}