code-secret-handler 1.0.0

package/dist/rewriter/templates/generic.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewriteGeneric = rewriteGeneric;
+/**
+ * Generic fallback rewriter:
+ *  - Replaces the literal secret with `${KEY}` wherever it appears as a quoted string.
+ */
+function rewriteGeneric(ctx) {
+    const { finding, fileContent } = ctx;
+    const { rawValue, envKey } = finding;
+    let rewrittenContent = fileContent;
+    let replacements = 0;
+    const quoteStyles = ["'", '"', '`'];
+    for (const q of quoteStyles) {
+        const escaped = rawValue.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const re = new RegExp(`${q}${escaped}${q}`, 'g');
+        if (re.test(rewrittenContent)) {
+            rewrittenContent = rewrittenContent.replace(re, `"\${${envKey}}"`);
+            replacements++;
+            break;
+        }
+    }
+    // Fallback: unquoted occurrence
+    if (replacements === 0) {
+        const escaped = rawValue.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const re = new RegExp(escaped, 'g');
+        if (re.test(rewrittenContent)) {
+            rewrittenContent = rewrittenContent.replace(re, `\${${envKey}}`);
+            replacements++;
+        }
+    }
+    return {
+        filePath: finding.file,
+        originalContent: fileContent,
+        rewrittenContent,
+        replacements,
+        dotenvInjected: false,
+    };
+}
+//# sourceMappingURL=generic.js.map

package/dist/rewriter/templates/generic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic.js","sourceRoot":"","sources":["../../../src/rewriter/templates/generic.ts"],"names":[],"mappings":";;;AAEA;;;GAGG;AACH,wBAA+B,GAAmB;IAChD,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAErC,IAAI,gBAAgB,GAAG,WAAW,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC9B,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,MAAM,IAAI,CAAC,CAAC;YACnE,YAAY,EAAE,CAAC;YACf,MAAM;QACR,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACpC,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC9B,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,MAAM,GAAG,CAAC,CAAC;YACjE,YAAY,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,IAAI;QACtB,eAAe,EAAE,WAAW;QAC5B,gBAAgB;QAChB,YAAY;QACZ,cAAc,EAAE,KAAK;KACtB,CAAC;AACJ,CAAC"}

package/dist/rewriter/templates/go.d.ts

@@ -0,0 +1,8 @@
+import { RewriteContext, RewriteResult } from '../../types';
+/**
+ * Rewrites Go files:
+ *  - Replaces literal secret with `os.Getenv("KEY")`
+ *  - Injects `"os"` import if not already present
+ */
+export declare function rewriteGo(ctx: RewriteContext): RewriteResult;
+//# sourceMappingURL=go.d.ts.map

package/dist/rewriter/templates/go.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"go.d.ts","sourceRoot":"","sources":["../../../src/rewriter/templates/go.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,aAAa,CAuD5D"}

package/dist/rewriter/templates/go.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewriteGo = rewriteGo;
+/**
+ * Rewrites Go files:
+ *  - Replaces literal secret with `os.Getenv("KEY")`
+ *  - Injects `"os"` import if not already present
+ */
+function rewriteGo(ctx) {
+    const { finding, fileContent } = ctx;
+    const { rawValue, envKey } = finding;
+    let rewrittenContent = fileContent;
+    let replacements = 0;
+    let dotenvInjected = false;
+    const escaped = rawValue.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const re = new RegExp(`"${escaped}"`, 'g');
+    if (re.test(rewrittenContent)) {
+        rewrittenContent = rewrittenContent.replace(re, `os.Getenv("${envKey}")`);
+        replacements++;
+    }
+    if (replacements === 0) {
+        // Try backtick strings (raw string literals in Go)
+        const reBacktick = new RegExp('`' + escaped + '`', 'g');
+        if (reBacktick.test(rewrittenContent)) {
+            rewrittenContent = rewrittenContent.replace(reBacktick, `os.Getenv("${envKey}")`);
+            replacements++;
+        }
+    }
+    if (replacements === 0)
+        return { filePath: finding.file, originalContent: fileContent, rewrittenContent: fileContent, replacements: 0, dotenvInjected: false };
+    // Inject "os" import if not present
+    const hasOsImport = /import\s+(?:"os"|[\s\S]*?"os"[\s\S]*?\))/.test(rewrittenContent);
+    if (!hasOsImport) {
+        // Add to existing import block if present
+        if (/^import\s*\(/.test(rewrittenContent)) {
+            rewrittenContent = rewrittenContent.replace(/^(import\s*\()/, '$1\n\t"os"');
+        }
+        else if (/^import\s+"/.test(rewrittenContent)) {
+            // Single import — convert to block
+            rewrittenContent = rewrittenContent.replace(/^(import\s+"[^"]+")$/m, '$1\nimport "os"');
+        }
+        else {
+            // No import block yet — find package statement and insert after
+            rewrittenContent = rewrittenContent.replace(/^(package\s+\w+\s*\n)/m, '$1\nimport "os"\n');
+        }
+        dotenvInjected = true; // "os" counts as env-access injection
+    }
+    return {
+        filePath: finding.file,
+        originalContent: fileContent,
+        rewrittenContent,
+        replacements,
+        dotenvInjected,
+    };
+}
+//# sourceMappingURL=go.js.map

package/dist/rewriter/templates/go.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"go.js","sourceRoot":"","sources":["../../../src/rewriter/templates/go.ts"],"names":[],"mappings":";;;AAEA;;;;GAIG;AACH,mBAA0B,GAAmB;IAC3C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAErC,IAAI,gBAAgB,GAAG,WAAW,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC9B,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,cAAc,MAAM,IAAI,CAAC,CAAC;QAC1E,YAAY,EAAE,CAAC;IACjB,CAAC;IAED,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,mDAAmD;QACnD,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,OAAO,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;QACxD,IAAI,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtC,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,MAAM,IAAI,CAAC,CAAC;YAClF,YAAY,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAED,IAAI,YAAY,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAE/J,oCAAoC;IACpC,MAAM,WAAW,GAAG,0CAA0C,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACtF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,0CAA0C;QAC1C,IAAI,cAAc,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC1C,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAC9E,CAAC;aAAM,IAAI,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAChD,mCAAmC;YACnC,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CACzC,uBAAuB,EACvB,iBAAiB,CAClB,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,gEAAgE;YAChE,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CACzC,wBAAwB,EACxB,mBAAmB,CACpB,CAAC;QACJ,CAAC;QACD,cAAc,GAAG,IAAI,CAAC,CAAC,sCAAsC;IAC/D,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,IAAI;QACtB,eAAe,EAAE,WAAW;QAC5B,gBAAgB;QAChB,YAAY;QACZ,cAAc;KACf,CAAC;AACJ,CAAC"}

package/dist/rewriter/templates/java.d.ts

@@ -0,0 +1,7 @@
+import { RewriteContext, RewriteResult } from '../../types';
+/**
+ * Rewrites Java/Kotlin/Scala files:
+ *  - Replaces literal secret with `System.getenv("KEY")`
+ */
+export declare function rewriteJava(ctx: RewriteContext): RewriteResult;
+//# sourceMappingURL=java.d.ts.map

package/dist/rewriter/templates/java.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"java.d.ts","sourceRoot":"","sources":["../../../src/rewriter/templates/java.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5D;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,aAAa,CAyB9D"}

package/dist/rewriter/templates/java.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewriteJava = rewriteJava;
+/**
+ * Rewrites Java/Kotlin/Scala files:
+ *  - Replaces literal secret with `System.getenv("KEY")`
+ */
+function rewriteJava(ctx) {
+    const { finding, fileContent } = ctx;
+    const { rawValue, envKey } = finding;
+    let rewrittenContent = fileContent;
+    let replacements = 0;
+    const quoteStyles = ['"', "'"];
+    for (const q of quoteStyles) {
+        const escaped = rawValue.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const re = new RegExp(`${q}${escaped}${q}`, 'g');
+        if (re.test(rewrittenContent)) {
+            rewrittenContent = rewrittenContent.replace(re, `System.getenv("${envKey}")`);
+            replacements++;
+            break;
+        }
+    }
+    return {
+        filePath: finding.file,
+        originalContent: fileContent,
+        rewrittenContent,
+        replacements,
+        dotenvInjected: false,
+    };
+}
+//# sourceMappingURL=java.js.map

package/dist/rewriter/templates/java.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"java.js","sourceRoot":"","sources":["../../../src/rewriter/templates/java.ts"],"names":[],"mappings":";;;AAEA;;;GAGG;AACH,qBAA4B,GAAmB;IAC7C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAErC,IAAI,gBAAgB,GAAG,WAAW,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC9B,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,kBAAkB,MAAM,IAAI,CAAC,CAAC;YAC9E,YAAY,EAAE,CAAC;YACf,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,IAAI;QACtB,eAAe,EAAE,WAAW;QAC5B,gBAAgB;QAChB,YAAY;QACZ,cAAc,EAAE,KAAK;KACtB,CAAC;AACJ,CAAC"}

package/dist/rewriter/templates/javascript.d.ts

@@ -0,0 +1,10 @@
+import { RewriteContext, RewriteResult } from '../../types';
+/**
+ * Rewrites JavaScript/TypeScript files:
+ *  - Replaces the literal secret value with `process.env.KEY`
+ *  - Injects `require('dotenv').config()` if not already present and the file
+ *    is a CommonJS module (no import/export keywords), OR
+ *    leaves an ESM hint comment if the file uses import/export.
+ */
+export declare function rewriteJavaScript(ctx: RewriteContext): RewriteResult;
+//# sourceMappingURL=javascript.d.ts.map

package/dist/rewriter/templates/javascript.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"javascript.d.ts","sourceRoot":"","sources":["../../../src/rewriter/templates/javascript.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,aAAa,CA8CpE"}

package/dist/rewriter/templates/javascript.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewriteJavaScript = rewriteJavaScript;
+/**
+ * Rewrites JavaScript/TypeScript files:
+ *  - Replaces the literal secret value with `process.env.KEY`
+ *  - Injects `require('dotenv').config()` if not already present and the file
+ *    is a CommonJS module (no import/export keywords), OR
+ *    leaves an ESM hint comment if the file uses import/export.
+ */
+function rewriteJavaScript(ctx) {
+    const { finding, fileContent } = ctx;
+    const { rawValue, envKey } = finding;
+    let rewrittenContent = fileContent;
+    let replacements = 0;
+    let dotenvInjected = false;
+    // Build the replacement string — replace the quoted secret with process.env.KEY
+    // We need to handle all quote styles: ', ", `
+    const quoteStyles = ["'", '"', '`'];
+    for (const q of quoteStyles) {
+        const escaped = rawValue.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const re = new RegExp(`${q}${escaped}${q}`, 'g');
+        if (re.test(rewrittenContent)) {
+            rewrittenContent = rewrittenContent.replace(re, `process.env.${envKey}`);
+            replacements++;
+            break;
+        }
+    }
+    if (replacements === 0)
+        return { filePath: finding.file, originalContent: fileContent, rewrittenContent: fileContent, replacements: 0, dotenvInjected: false };
+    // Detect module style
+    const isESM = /^import\s+|^export\s+/m.test(fileContent);
+    const hasDotenvRequire = /require\s*\(\s*['"`]dotenv['"`]\s*\)/i.test(rewrittenContent);
+    const hasDotenvImport = /import\s+.*['"`]dotenv['"`]/i.test(rewrittenContent);
+    if (!hasDotenvRequire && !hasDotenvImport) {
+        if (isESM) {
+            // For ESM, add a comment hint at the top (dotenv/config import)
+            rewrittenContent = `// TODO: Add \`import 'dotenv/config';\` at the top of your entry point.\n` + rewrittenContent;
+        }
+        else {
+            // CommonJS — inject require at top
+            rewrittenContent = `require('dotenv').config();\n` + rewrittenContent;
+        }
+        dotenvInjected = true;
+    }
+    return {
+        filePath: finding.file,
+        originalContent: fileContent,
+        rewrittenContent,
+        replacements,
+        dotenvInjected,
+    };
+}
+//# sourceMappingURL=javascript.js.map

package/dist/rewriter/templates/javascript.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"javascript.js","sourceRoot":"","sources":["../../../src/rewriter/templates/javascript.ts"],"names":[],"mappings":";;;AAEA;;;;;;GAMG;AACH,2BAAkC,GAAmB;IACnD,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAErC,IAAI,gBAAgB,GAAG,WAAW,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,gFAAgF;IAChF,8CAA8C;IAC9C,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC9B,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,eAAe,MAAM,EAAE,CAAC,CAAC;YACzE,YAAY,EAAE,CAAC;YACf,MAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,YAAY,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAE/J,sBAAsB;IACtB,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,gBAAgB,GAAG,uCAAuC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACxF,MAAM,eAAe,GAAG,8BAA8B,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAE9E,IAAI,CAAC,gBAAgB,IAAI,CAAC,eAAe,EAAE,CAAC;QAC1C,IAAI,KAAK,EAAE,CAAC;YACV,gEAAgE;YAChE,gBAAgB,GAAG,4EAA4E,GAAG,gBAAgB,CAAC;QACrH,CAAC;aAAM,CAAC;YACN,mCAAmC;YACnC,gBAAgB,GAAG,+BAA+B,GAAG,gBAAgB,CAAC;QACxE,CAAC;QACD,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,IAAI;QACtB,eAAe,EAAE,WAAW;QAC5B,gBAAgB;QAChB,YAAY;QACZ,cAAc;KACf,CAAC;AACJ,CAAC"}

package/dist/rewriter/templates/php.d.ts

@@ -0,0 +1,8 @@
+import { RewriteContext, RewriteResult } from '../../types';
+/**
+ * Rewrites PHP files:
+ *  - Replaces literal secret with `getenv('KEY')`
+ *  - Optionally adds a comment about vlucas/phpdotenv
+ */
+export declare function rewritePhp(ctx: RewriteContext): RewriteResult;
+//# sourceMappingURL=php.d.ts.map

package/dist/rewriter/templates/php.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"php.d.ts","sourceRoot":"","sources":["../../../src/rewriter/templates/php.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,aAAa,CAsC7D"}

package/dist/rewriter/templates/php.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewritePhp = rewritePhp;
+/**
+ * Rewrites PHP files:
+ *  - Replaces literal secret with `getenv('KEY')`
+ *  - Optionally adds a comment about vlucas/phpdotenv
+ */
+function rewritePhp(ctx) {
+    const { finding, fileContent } = ctx;
+    const { rawValue, envKey } = finding;
+    let rewrittenContent = fileContent;
+    let replacements = 0;
+    let dotenvInjected = false;
+    const quoteStyles = ["'", '"'];
+    for (const q of quoteStyles) {
+        const escaped = rawValue.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const re = new RegExp(`${q}${escaped}${q}`, 'g');
+        if (re.test(rewrittenContent)) {
+            rewrittenContent = rewrittenContent.replace(re, `getenv('${envKey}')`);
+            replacements++;
+            break;
+        }
+    }
+    if (replacements === 0)
+        return { filePath: finding.file, originalContent: fileContent, rewrittenContent: fileContent, replacements: 0, dotenvInjected: false };
+    const hasDotenv = /Dotenv\\Dotenv|vlucas\/phpdotenv|Dotenv::createImmutable/i.test(rewrittenContent);
+    if (!hasDotenv) {
+        // Insert after opening <?php tag
+        rewrittenContent = rewrittenContent.replace(/^<\?php\s*/, `<?php\n// TODO: Load .env via vlucas/phpdotenv: $dotenv = Dotenv\\Dotenv::createImmutable(__DIR__); $dotenv->load();\n`);
+        dotenvInjected = true;
+    }
+    return {
+        filePath: finding.file,
+        originalContent: fileContent,
+        rewrittenContent,
+        replacements,
+        dotenvInjected,
+    };
+}
+//# sourceMappingURL=php.js.map

package/dist/rewriter/templates/php.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"php.js","sourceRoot":"","sources":["../../../src/rewriter/templates/php.ts"],"names":[],"mappings":";;;AAEA;;;;GAIG;AACH,oBAA2B,GAAmB;IAC5C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAErC,IAAI,gBAAgB,GAAG,WAAW,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC9B,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,MAAM,IAAI,CAAC,CAAC;YACvE,YAAY,EAAE,CAAC;YACf,MAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,YAAY,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAE/J,MAAM,SAAS,GAAG,2DAA2D,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACrG,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,iCAAiC;QACjC,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CACzC,YAAY,EACZ,wHAAwH,CACzH,CAAC;QACF,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,IAAI;QACtB,eAAe,EAAE,WAAW;QAC5B,gBAAgB;QAChB,YAAY;QACZ,cAAc;KACf,CAAC;AACJ,CAAC"}

package/dist/rewriter/templates/properties.d.ts

@@ -0,0 +1,9 @@
+import { RewriteContext, RewriteResult } from '../../types';
+/**
+ * Rewrites .properties / .ini / .conf / .env files:
+ *  - If the file IS the .env file, we skip rewriting (it is the target).
+ *  - Otherwise replaces the literal value with `${KEY}` interpolation syntax
+ *    (supported by Spring Boot, dotenv-expand, etc.).
+ */
+export declare function rewriteProperties(ctx: RewriteContext): RewriteResult;
+//# sourceMappingURL=properties.d.ts.map

package/dist/rewriter/templates/properties.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"properties.d.ts","sourceRoot":"","sources":["../../../src/rewriter/templates/properties.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,aAAa,CAgCpE"}

package/dist/rewriter/templates/properties.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewriteProperties = rewriteProperties;
+/**
+ * Rewrites .properties / .ini / .conf / .env files:
+ *  - If the file IS the .env file, we skip rewriting (it is the target).
+ *  - Otherwise replaces the literal value with `${KEY}` interpolation syntax
+ *    (supported by Spring Boot, dotenv-expand, etc.).
+ */
+function rewriteProperties(ctx) {
+    const { finding, fileContent } = ctx;
+    const { rawValue, envKey, file } = finding;
+    // Skip if this is the .env file itself
+    if (file.endsWith('.env') || file.endsWith('.envrc')) {
+        return {
+            filePath: file,
+            originalContent: fileContent,
+            rewrittenContent: fileContent,
+            replacements: 0,
+            dotenvInjected: false,
+        };
+    }
+    let rewrittenContent = fileContent;
+    let replacements = 0;
+    const escaped = rawValue.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const re = new RegExp(escaped, 'g');
+    if (re.test(rewrittenContent)) {
+        rewrittenContent = rewrittenContent.replace(re, `\${${envKey}}`);
+        replacements++;
+    }
+    return {
+        filePath: file,
+        originalContent: fileContent,
+        rewrittenContent,
+        replacements,
+        dotenvInjected: false,
+    };
+}
+//# sourceMappingURL=properties.js.map

package/dist/rewriter/templates/properties.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"properties.js","sourceRoot":"","sources":["../../../src/rewriter/templates/properties.ts"],"names":[],"mappings":";;;AAEA;;;;;GAKG;AACH,2BAAkC,GAAmB;IACnD,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IAE3C,uCAAuC;IACvC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,eAAe,EAAE,WAAW;YAC5B,gBAAgB,EAAE,WAAW;YAC7B,YAAY,EAAE,CAAC;YACf,cAAc,EAAE,KAAK;SACtB,CAAC;IACJ,CAAC;IAED,IAAI,gBAAgB,GAAG,WAAW,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACpC,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC9B,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,MAAM,GAAG,CAAC,CAAC;QACjE,YAAY,EAAE,CAAC;IACjB,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,eAAe,EAAE,WAAW;QAC5B,gBAAgB;QAChB,YAAY;QACZ,cAAc,EAAE,KAAK;KACtB,CAAC;AACJ,CAAC"}

package/dist/rewriter/templates/python.d.ts

@@ -0,0 +1,8 @@
+import { RewriteContext, RewriteResult } from '../../types';
+/**
+ * Rewrites Python files:
+ *  - Replaces literal secret with `os.environ.get('KEY')`
+ *  - Injects `import os` and optionally `from dotenv import load_dotenv; load_dotenv()`
+ */
+export declare function rewritePython(ctx: RewriteContext): RewriteResult;
+//# sourceMappingURL=python.d.ts.map

package/dist/rewriter/templates/python.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"python.d.ts","sourceRoot":"","sources":["../../../src/rewriter/templates/python.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,aAAa,CA8ChE"}

package/dist/rewriter/templates/python.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewritePython = rewritePython;
+/**
+ * Rewrites Python files:
+ *  - Replaces literal secret with `os.environ.get('KEY')`
+ *  - Injects `import os` and optionally `from dotenv import load_dotenv; load_dotenv()`
+ */
+function rewritePython(ctx) {
+    const { finding, fileContent } = ctx;
+    const { rawValue, envKey } = finding;
+    let rewrittenContent = fileContent;
+    let replacements = 0;
+    let dotenvInjected = false;
+    const quoteStyles = ["'", '"', '"""', "'''"];
+    for (const q of quoteStyles) {
+        const escaped = rawValue.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const re = new RegExp(`${q}${escaped}${q}`, 'g');
+        if (re.test(rewrittenContent)) {
+            rewrittenContent = rewrittenContent.replace(re, `os.environ.get('${envKey}')`);
+            replacements++;
+            break;
+        }
+    }
+    if (replacements === 0)
+        return { filePath: finding.file, originalContent: fileContent, rewrittenContent: fileContent, replacements: 0, dotenvInjected: false };
+    const hasOsImport = /^import os$/m.test(rewrittenContent) || /^import os\b/m.test(rewrittenContent);
+    const hasDotenvImport = /from dotenv import/i.test(rewrittenContent) || /import dotenv/i.test(rewrittenContent);
+    let preamble = '';
+    if (!hasOsImport) {
+        preamble += 'import os\n';
+    }
+    if (!hasDotenvImport) {
+        preamble += 'from dotenv import load_dotenv\nload_dotenv()\n';
+        dotenvInjected = true;
+    }
+    if (preamble) {
+        rewrittenContent = preamble + rewrittenContent;
+    }
+    return {
+        filePath: finding.file,
+        originalContent: fileContent,
+        rewrittenContent,
+        replacements,
+        dotenvInjected,
+    };
+}
+//# sourceMappingURL=python.js.map

package/dist/rewriter/templates/python.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"python.js","sourceRoot":"","sources":["../../../src/rewriter/templates/python.ts"],"names":[],"mappings":";;;AAEA;;;;GAIG;AACH,uBAA8B,GAAmB;IAC/C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAErC,IAAI,gBAAgB,GAAG,WAAW,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC9B,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,mBAAmB,MAAM,IAAI,CAAC,CAAC;YAC/E,YAAY,EAAE,CAAC;YACf,MAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,YAAY,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAE/J,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpG,MAAM,eAAe,GAAG,qBAAqB,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAEhH,IAAI,QAAQ,GAAG,EAAE,CAAC;IAElB,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,QAAQ,IAAI,aAAa,CAAC;IAC5B,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,QAAQ,IAAI,iDAAiD,CAAC;QAC9D,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,gBAAgB,GAAG,QAAQ,GAAG,gBAAgB,CAAC;IACjD,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,IAAI;QACtB,eAAe,EAAE,WAAW;QAC5B,gBAAgB;QAChB,YAAY;QACZ,cAAc;KACf,CAAC;AACJ,CAAC"}

package/dist/rewriter/templates/ruby.d.ts

@@ -0,0 +1,8 @@
+import { RewriteContext, RewriteResult } from '../../types';
+/**
+ * Rewrites Ruby files:
+ *  - Replaces literal secret with `ENV['KEY']`
+ *  - Injects `require 'dotenv/load'` if not present (when dotenv gem is used)
+ */
+export declare function rewriteRuby(ctx: RewriteContext): RewriteResult;
+//# sourceMappingURL=ruby.d.ts.map

package/dist/rewriter/templates/ruby.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruby.d.ts","sourceRoot":"","sources":["../../../src/rewriter/templates/ruby.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,aAAa,CAkC9D"}

package/dist/rewriter/templates/ruby.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewriteRuby = rewriteRuby;
+/**
+ * Rewrites Ruby files:
+ *  - Replaces literal secret with `ENV['KEY']`
+ *  - Injects `require 'dotenv/load'` if not present (when dotenv gem is used)
+ */
+function rewriteRuby(ctx) {
+    const { finding, fileContent } = ctx;
+    const { rawValue, envKey } = finding;
+    let rewrittenContent = fileContent;
+    let replacements = 0;
+    let dotenvInjected = false;
+    const quoteStyles = ["'", '"'];
+    for (const q of quoteStyles) {
+        const escaped = rawValue.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const re = new RegExp(`${q}${escaped}${q}`, 'g');
+        if (re.test(rewrittenContent)) {
+            rewrittenContent = rewrittenContent.replace(re, `ENV['${envKey}']`);
+            replacements++;
+            break;
+        }
+    }
+    if (replacements === 0)
+        return { filePath: finding.file, originalContent: fileContent, rewrittenContent: fileContent, replacements: 0, dotenvInjected: false };
+    const hasDotenv = /require\s+['"]dotenv/.test(rewrittenContent);
+    if (!hasDotenv) {
+        rewrittenContent = `require 'dotenv/load'\n` + rewrittenContent;
+        dotenvInjected = true;
+    }
+    return {
+        filePath: finding.file,
+        originalContent: fileContent,
+        rewrittenContent,
+        replacements,
+        dotenvInjected,
+    };
+}
+//# sourceMappingURL=ruby.js.map

package/dist/rewriter/templates/ruby.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruby.js","sourceRoot":"","sources":["../../../src/rewriter/templates/ruby.ts"],"names":[],"mappings":";;;AAEA;;;;GAIG;AACH,qBAA4B,GAAmB;IAC7C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAErC,IAAI,gBAAgB,GAAG,WAAW,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC9B,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,MAAM,IAAI,CAAC,CAAC;YACpE,YAAY,EAAE,CAAC;YACf,MAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,YAAY,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAE/J,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAChE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,gBAAgB,GAAG,yBAAyB,GAAG,gBAAgB,CAAC;QAChE,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,IAAI;QACtB,eAAe,EAAE,WAAW;QAC5B,gBAAgB;QAChB,YAAY;QACZ,cAAc;KACf,CAAC;AACJ,CAAC"}

package/dist/rewriter/templates/rust.d.ts

@@ -0,0 +1,7 @@
+import { RewriteContext, RewriteResult } from '../../types';
+/**
+ * Rewrites Rust files:
+ *  - Replaces literal secret with `std::env::var("KEY").expect("KEY not set")`
+ */
+export declare function rewriteRust(ctx: RewriteContext): RewriteResult;
+//# sourceMappingURL=rust.d.ts.map

package/dist/rewriter/templates/rust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rust.d.ts","sourceRoot":"","sources":["../../../src/rewriter/templates/rust.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5D;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,aAAa,CAwB9D"}

package/dist/rewriter/templates/rust.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewriteRust = rewriteRust;
+/**
+ * Rewrites Rust files:
+ *  - Replaces literal secret with `std::env::var("KEY").expect("KEY not set")`
+ */
+function rewriteRust(ctx) {
+    const { finding, fileContent } = ctx;
+    const { rawValue, envKey } = finding;
+    let rewrittenContent = fileContent;
+    let replacements = 0;
+    const escaped = rawValue.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const re = new RegExp(`"${escaped}"`, 'g');
+    if (re.test(rewrittenContent)) {
+        rewrittenContent = rewrittenContent.replace(re, `std::env::var("${envKey}").expect("${envKey} not set")`);
+        replacements++;
+    }
+    return {
+        filePath: finding.file,
+        originalContent: fileContent,
+        rewrittenContent,
+        replacements,
+        dotenvInjected: false,
+    };
+}
+//# sourceMappingURL=rust.js.map

package/dist/rewriter/templates/rust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rust.js","sourceRoot":"","sources":["../../../src/rewriter/templates/rust.ts"],"names":[],"mappings":";;;AAEA;;;GAGG;AACH,qBAA4B,GAAmB;IAC7C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAErC,IAAI,gBAAgB,GAAG,WAAW,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC9B,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CACzC,EAAE,EACF,kBAAkB,MAAM,cAAc,MAAM,YAAY,CACzD,CAAC;QACF,YAAY,EAAE,CAAC;IACjB,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,IAAI;QACtB,eAAe,EAAE,WAAW;QAC5B,gBAAgB;QAChB,YAAY;QACZ,cAAc,EAAE,KAAK;KACtB,CAAC;AACJ,CAAC"}

package/dist/rewriter/templates/shell.d.ts

@@ -0,0 +1,7 @@
+import { RewriteContext, RewriteResult } from '../../types';
+/**
+ * Rewrites Shell / Bash / PowerShell files:
+ *  - Replaces literal secret with `$KEY` (bash) or `$env:KEY` (PowerShell .ps1)
+ */
+export declare function rewriteShell(ctx: RewriteContext): RewriteResult;
+//# sourceMappingURL=shell.d.ts.map

package/dist/rewriter/templates/shell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../../src/rewriter/templates/shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5D;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,cAAc,GAAG,aAAa,CAsC/D"}

package/dist/rewriter/templates/shell.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewriteShell = rewriteShell;
+/**
+ * Rewrites Shell / Bash / PowerShell files:
+ *  - Replaces literal secret with `$KEY` (bash) or `$env:KEY` (PowerShell .ps1)
+ */
+function rewriteShell(ctx) {
+    const { finding, fileContent } = ctx;
+    const { rawValue, envKey } = finding;
+    const isPowerShell = finding.file.endsWith('.ps1') || finding.file.endsWith('.psm1');
+    const replacement = isPowerShell ? `$env:${envKey}` : `$${envKey}`;
+    let rewrittenContent = fileContent;
+    let replacements = 0;
+    const quoteStyles = ["'", '"'];
+    for (const q of quoteStyles) {
+        const escaped = rawValue.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const re = new RegExp(`${q}${escaped}${q}`, 'g');
+        if (re.test(rewrittenContent)) {
+            rewrittenContent = rewrittenContent.replace(re, replacement);
+            replacements++;
+            break;
+        }
+    }
+    // Also try unquoted (direct assignment VALUE)
+    if (replacements === 0) {
+        const escapedRaw = rawValue.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const reRaw = new RegExp(`(?<==)${escapedRaw}(?=\\s|$)`, 'gm');
+        if (reRaw.test(rewrittenContent)) {
+            rewrittenContent = rewrittenContent.replace(reRaw, replacement);
+            replacements++;
+        }
+    }
+    return {
+        filePath: finding.file,
+        originalContent: fileContent,
+        rewrittenContent,
+        replacements,
+        dotenvInjected: false,
+    };
+}
+//# sourceMappingURL=shell.js.map

package/dist/rewriter/templates/shell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../../src/rewriter/templates/shell.ts"],"names":[],"mappings":";;;AAEA;;;GAGG;AACH,sBAA6B,GAAmB;IAC9C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAErC,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrF,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;IAEnE,IAAI,gBAAgB,GAAG,WAAW,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC9B,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;YAC7D,YAAY,EAAE,CAAC;YACf,MAAM;QACR,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,SAAS,UAAU,WAAW,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACjC,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAChE,YAAY,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,IAAI;QACtB,eAAe,EAAE,WAAW;QAC5B,gBAAgB;QAChB,YAAY;QACZ,cAAc,EAAE,KAAK;KACtB,CAAC;AACJ,CAAC"}

package/dist/rewriter/templates/toml.d.ts

@@ -0,0 +1,9 @@
+import { RewriteContext, RewriteResult } from '../../types';
+/**
+ * Rewrites TOML files:
+ *  - Replaces literal secret with a reference comment and env var placeholder.
+ *  - TOML does not support env var interpolation natively, so we replace
+ *    the value with "${KEY}" and add a guidance comment.
+ */
+export declare function rewriteToml(ctx: RewriteContext): RewriteResult;
+//# sourceMappingURL=toml.d.ts.map

package/dist/rewriter/templates/toml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toml.d.ts","sourceRoot":"","sources":["../../../src/rewriter/templates/toml.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,aAAa,CA0B9D"}