Returns errors for secret leaf-names a non-secret field also uses. Secret
classification (deriveSecretKeys feeding the splitter and maskSecrets)
matches by bare leaf-name anywhere in the config tree, so a non-secret field
reusing a secret's name would be silently masked and relocated into
credentials.json. This gate keeps every secret leaf-name exclusive to secret
fields, failing the build the moment that 1:1 mapping is broken.
Returns string[]
One error per secret leaf-name reused by a non-secret field.
Returns errors for secret leaf-names a non-secret field also uses. Secret classification (
deriveSecretKeysfeeding the splitter andmaskSecrets) matches by bare leaf-name anywhere in the config tree, so a non-secret field reusing a secret's name would be silently masked and relocated into credentials.json. This gate keeps every secret leaf-name exclusive to secret fields, failing the build the moment that 1:1 mapping is broken.