@cdot65/prisma-airs-cli 2.6.1 → 2.8.0

package/dist/dlp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dlp/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAiB,MAAM,YAAY,CAAC;AAEjE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5D;AAED,2EAA2E;AAC3E,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAmDpF"}

package/dist/dlp/index.js

@@ -0,0 +1,54 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { techniquesByFormat } from './embed/index.js';
+import { EXT, generators } from './generate/index.js';
+import { buildManifest, writeManifest } from './manifest.js';
+import { makePayload } from './payload.js';
+import { makeRng, subSeed } from './rng.js';
+/** Generate a clean/dirty DLP test corpus and a manifest describing it. */
+export async function generateCorpus(opts) {
+    const seed = opts.seed ?? Math.floor(Math.random() * 0x7fffffff);
+    const entries = [];
+    const byFormat = {};
+    let cleanCount = 0;
+    let typeIndex = 0;
+    for (const fmt of opts.types) {
+        const ext = EXT[fmt];
+        const cleanDir = join(opts.out, 'clean', fmt);
+        const dirtyDir = join(opts.out, 'dirty', fmt);
+        await mkdir(cleanDir, { recursive: true });
+        await mkdir(dirtyDir, { recursive: true });
+        byFormat[fmt] = { clean: 0, dirty: 0 };
+        const wanted = techniquesByFormat[fmt].filter((t) => opts.techniques === 'all' || opts.techniques.includes(t.id));
+        for (let i = 0; i < opts.count; i++) {
+            const fileSeed = subSeed(seed, typeIndex * 1000 + i);
+            const base = `${fmt}-${fileSeed.toString(16).padStart(8, '0')}`;
+            const cleanBuf = Buffer.from(await generators[fmt](makeRng(fileSeed)));
+            const cleanPath = join(cleanDir, `${base}.${ext}`);
+            await writeFile(cleanPath, cleanBuf);
+            cleanCount++;
+            byFormat[fmt].clean++;
+            let tIdx = 0;
+            for (const technique of wanted) {
+                const payload = makePayload(makeRng(subSeed(fileSeed, 7919 + tIdx)));
+                const dirtyBuf = Buffer.from(await technique.embed(cleanBuf, payload));
+                const dirtyPath = join(dirtyDir, `${base}__${technique.id}.${ext}`);
+                await writeFile(dirtyPath, dirtyBuf);
+                entries.push({
+                    format: fmt,
+                    technique: technique.id,
+                    clean: cleanPath,
+                    dirty: dirtyPath,
+                    values: payload,
+                });
+                byFormat[fmt].dirty++;
+                tIdx++;
+            }
+        }
+        typeIndex++;
+    }
+    const manifestPath = join(opts.out, 'manifest.json');
+    await writeManifest(manifestPath, buildManifest(entries));
+    return { clean: cleanCount, dirty: entries.length, out: opts.out, manifestPath, seed, byFormat };
+}
+//# sourceMappingURL=index.js.map

package/dist/dlp/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/dlp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAY5C,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAqB;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC;IACjE,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAqD,EAAE,CAAC;IACtE,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAEvC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,CAC3C,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CACnE,CAAC;QAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACvE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;YACnD,MAAM,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACrC,UAAU,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;YAEtB,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,KAAK,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBACvE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,KAAK,SAAS,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;gBACpE,MAAM,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC;oBACX,MAAM,EAAE,GAAG;oBACX,SAAS,EAAE,SAAS,CAAC,EAAE;oBACvB,KAAK,EAAE,SAAS;oBAChB,KAAK,EAAE,SAAS;oBAChB,MAAM,EAAE,OAAO;iBAChB,CAAC,CAAC;gBACH,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;gBACtB,IAAI,EAAE,CAAC;YACT,CAAC;QACH,CAAC;QACD,SAAS,EAAE,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACrD,MAAM,aAAa,CAAC,YAAY,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACnG,CAAC"}

package/dist/dlp/lorem.d.ts

@@ -0,0 +1,3 @@
+/** Generate `paragraphs` paragraphs of lorem ipsum, joined by blank lines. */
+export declare function lorem(rng: () => number, paragraphs: number): string;
+//# sourceMappingURL=lorem.d.ts.map

package/dist/dlp/lorem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lorem.d.ts","sourceRoot":"","sources":["../../src/dlp/lorem.ts"],"names":[],"mappings":"AA4DA,8EAA8E;AAC9E,wBAAgB,KAAK,CAAC,GAAG,EAAE,MAAM,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAKnE"}

package/dist/dlp/lorem.js

@@ -0,0 +1,65 @@
+import { pick } from './rng.js';
+const WORDS = [
+    'lorem',
+    'ipsum',
+    'dolor',
+    'sit',
+    'amet',
+    'consectetur',
+    'adipiscing',
+    'elit',
+    'sed',
+    'do',
+    'eiusmod',
+    'tempor',
+    'incididunt',
+    'ut',
+    'labore',
+    'et',
+    'dolore',
+    'magna',
+    'aliqua',
+    'enim',
+    'ad',
+    'minim',
+    'veniam',
+    'quis',
+    'nostrud',
+    'exercitation',
+    'ullamco',
+    'laboris',
+    'nisi',
+    'aliquip',
+    'ex',
+    'ea',
+    'commodo',
+    'consequat',
+    'duis',
+    'aute',
+    'irure',
+    'in',
+    'reprehenderit',
+    'voluptate',
+    'velit',
+    'esse',
+    'cillum',
+    'fugiat',
+    'nulla',
+    'pariatur',
+    'excepteur',
+    'sint',
+];
+function sentence(rng) {
+    const len = 8 + Math.floor(rng() * 8);
+    const words = Array.from({ length: len }, () => pick(rng, WORDS));
+    const text = words.join(' ');
+    return `${text.charAt(0).toUpperCase()}${text.slice(1)}.`;
+}
+/** Generate `paragraphs` paragraphs of lorem ipsum, joined by blank lines. */
+export function lorem(rng, paragraphs) {
+    return Array.from({ length: paragraphs }, () => {
+        const sentences = 3 + Math.floor(rng() * 3);
+        return Array.from({ length: sentences }, () => sentence(rng)).join(' ');
+    }).join('\n\n');
+}
+//# sourceMappingURL=lorem.js.map

package/dist/dlp/lorem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lorem.js","sourceRoot":"","sources":["../../src/dlp/lorem.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,MAAM,KAAK,GAAG;IACZ,OAAO;IACP,OAAO;IACP,OAAO;IACP,KAAK;IACL,MAAM;IACN,aAAa;IACb,YAAY;IACZ,MAAM;IACN,KAAK;IACL,IAAI;IACJ,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,MAAM;IACN,SAAS;IACT,cAAc;IACd,SAAS;IACT,SAAS;IACT,MAAM;IACN,SAAS;IACT,IAAI;IACJ,IAAI;IACJ,SAAS;IACT,WAAW;IACX,MAAM;IACN,MAAM;IACN,OAAO;IACP,IAAI;IACJ,eAAe;IACf,WAAW;IACX,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,UAAU;IACV,WAAW;IACX,MAAM;CACP,CAAC;AAEF,SAAS,QAAQ,CAAC,GAAiB;IACjC,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,KAAK,CAAC,GAAiB,EAAE,UAAkB;IACzD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE;QAC7C,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAClB,CAAC"}

package/dist/dlp/manifest.d.ts

@@ -0,0 +1,11 @@
+import type { ManifestEntry } from './types.js';
+export interface Manifest {
+    generatedAt: string;
+    count: number;
+    entries: ManifestEntry[];
+}
+/** Assemble a manifest from dirty-file entries. */
+export declare function buildManifest(entries: ManifestEntry[]): Manifest;
+/** Write a manifest to disk as pretty JSON. */
+export declare function writeManifest(path: string, manifest: Manifest): Promise<void>;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/dlp/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/dlp/manifest.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,WAAW,QAAQ;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,mDAAmD;AACnD,wBAAgB,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,QAAQ,CAMhE;AAED,+CAA+C;AAC/C,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnF"}

package/dist/dlp/manifest.js

@@ -0,0 +1,14 @@
+import { writeFile } from 'node:fs/promises';
+/** Assemble a manifest from dirty-file entries. */
+export function buildManifest(entries) {
+    return {
+        generatedAt: new Date().toISOString(),
+        count: entries.length,
+        entries,
+    };
+}
+/** Write a manifest to disk as pretty JSON. */
+export async function writeManifest(path, manifest) {
+    await writeFile(path, `${JSON.stringify(manifest, null, 2)}\n`);
+}
+//# sourceMappingURL=manifest.js.map

package/dist/dlp/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/dlp/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAS7C,mDAAmD;AACnD,MAAM,UAAU,aAAa,CAAC,OAAwB;IACpD,OAAO;QACL,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,KAAK,EAAE,OAAO,CAAC,MAAM;QACrB,OAAO;KACR,CAAC;AACJ,CAAC;AAED,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,QAAkB;IAClE,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAClE,CAAC"}

package/dist/dlp/payload.d.ts

@@ -0,0 +1,6 @@
+import type { PayloadValue } from './types.js';
+/** Luhn checksum validation for a digit string. */
+export declare function luhnValid(pan: string): boolean;
+/** Generate a set of clearly-synthetic, format-valid sensitive markers. */
+export declare function makePayload(rng: () => number): PayloadValue[];
+//# sourceMappingURL=payload.d.ts.map

package/dist/dlp/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../src/dlp/payload.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI/C,mDAAmD;AACnD,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAkB9C;AAgCD,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,MAAM,GAAG,YAAY,EAAE,CAW7D"}

package/dist/dlp/payload.js

@@ -0,0 +1,62 @@
+import { digits, pick } from './rng.js';
+const BASE32 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+/** Luhn checksum validation for a digit string. */
+export function luhnValid(pan) {
+    if (pan.length === 0) {
+        return false;
+    }
+    let sum = 0;
+    let alt = false;
+    for (let i = pan.length - 1; i >= 0; i--) {
+        let d = pan.charCodeAt(i) - 48;
+        if (alt) {
+            d *= 2;
+            if (d > 9) {
+                d -= 9;
+            }
+        }
+        sum += d;
+        alt = !alt;
+    }
+    return sum % 10 === 0;
+}
+/** A 16-digit, Luhn-valid PAN from the Visa-family test BIN (starts with 4). */
+function testPan(rng) {
+    const body = `4${digits(rng, 14)}`;
+    for (let c = 0; c < 10; c++) {
+        const candidate = `${body}${c}`;
+        if (luhnValid(candidate)) {
+            return candidate;
+        }
+    }
+    return `${body}0`;
+}
+// SSNs in area 900-999 are never issued by the SSA, so these are synthetic-safe.
+const ssn = (rng) => `9${digits(rng, 2)}-${digits(rng, 2)}-${digits(rng, 4)}`;
+const phone = (rng) => `555-01${digits(rng, 2)}`;
+const email = (rng) => `${pick(rng, ['john.public', 'jane.doe', 'sam.roe'])}.${digits(rng, 3)}@${pick(rng, [
+    'example.com',
+    'example.org',
+    'example.net',
+])}`;
+const awsKey = (rng) => `AKIA${Array.from({ length: 9 }, () => pick(rng, [...BASE32])).join('')}EXAMPLE`;
+const dob = (rng) => {
+    const year = 1960 + Math.floor(rng() * 40);
+    const month = String(1 + Math.floor(rng() * 12)).padStart(2, '0');
+    const day = String(1 + Math.floor(rng() * 28)).padStart(2, '0');
+    return `${year}-${month}-${day}`;
+};
+/** Generate a set of clearly-synthetic, format-valid sensitive markers. */
+export function makePayload(rng) {
+    const pan = testPan(rng);
+    return [
+        { category: 'ssn', value: ssn(rng) },
+        { category: 'credit_card', value: pan.replace(/(\d{4})(?=\d)/g, '$1 ').trim() },
+        { category: 'email', value: email(rng) },
+        { category: 'phone', value: phone(rng) },
+        { category: 'aws_key', value: awsKey(rng) },
+        { category: 'passport', value: `X${digits(rng, 8)}` },
+        { category: 'dob', value: dob(rng) },
+    ];
+}
+//# sourceMappingURL=payload.js.map

package/dist/dlp/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../src/dlp/payload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAGxC,MAAM,MAAM,GAAG,kCAAkC,CAAC;AAElD,mDAAmD;AACnD,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC/B,IAAI,GAAG,EAAE,CAAC;YACR,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACV,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;QACH,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;QACT,GAAG,GAAG,CAAC,GAAG,CAAC;IACb,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,gFAAgF;AAChF,SAAS,OAAO,CAAC,GAAiB;IAChC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;QAChC,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,IAAI,GAAG,CAAC;AACpB,CAAC;AAED,iFAAiF;AACjF,MAAM,GAAG,GAAG,CAAC,GAAiB,EAAU,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;AACpG,MAAM,KAAK,GAAG,CAAC,GAAiB,EAAU,EAAE,CAAC,SAAS,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;AACvE,MAAM,KAAK,GAAG,CAAC,GAAiB,EAAU,EAAE,CAC1C,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;IAClF,aAAa;IACb,aAAa;IACb,aAAa;CACd,CAAC,EAAE,CAAC;AACP,MAAM,MAAM,GAAG,CAAC,GAAiB,EAAU,EAAE,CAC3C,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC;AACnF,MAAM,GAAG,GAAG,CAAC,GAAiB,EAAU,EAAE;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChE,OAAO,GAAG,IAAI,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;AACnC,CAAC,CAAC;AAEF,2EAA2E;AAC3E,MAAM,UAAU,WAAW,CAAC,GAAiB;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO;QACL,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;QACpC,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/E,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;QACxC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;QACxC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;QAC3C,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;QACrD,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;KACrC,CAAC;AACJ,CAAC"}

package/dist/dlp/rng.d.ts

@@ -0,0 +1,9 @@
+/** Deterministic PRNG (mulberry32). Returns a function yielding floats in [0, 1). */
+export declare function makeRng(seed: number): () => number;
+/** Pick a deterministic element from a non-empty array. */
+export declare function pick<T>(rng: () => number, xs: readonly T[]): T;
+/** Build a string of `n` random decimal digits. */
+export declare function digits(rng: () => number, n: number): string;
+/** Derive a stable sub-seed from a base seed and an index. */
+export declare function subSeed(seed: number, index: number): number;
+//# sourceMappingURL=rng.d.ts.map

package/dist/dlp/rng.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rng.d.ts","sourceRoot":"","sources":["../../src/dlp/rng.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,MAAM,CASlD;AAED,2DAA2D;AAC3D,wBAAgB,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAE9D;AAED,mDAAmD;AACnD,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAM3D;AAED,8DAA8D;AAC9D,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3D"}

package/dist/dlp/rng.js

@@ -0,0 +1,28 @@
+/** Deterministic PRNG (mulberry32). Returns a function yielding floats in [0, 1). */
+export function makeRng(seed) {
+    let a = seed >>> 0;
+    return () => {
+        a |= 0;
+        a = (a + 0x6d2b79f5) | 0;
+        let t = Math.imul(a ^ (a >>> 15), 1 | a);
+        t = (t + Math.imul(t ^ (t >>> 7), 61 | t)) ^ t;
+        return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+    };
+}
+/** Pick a deterministic element from a non-empty array. */
+export function pick(rng, xs) {
+    return xs[Math.floor(rng() * xs.length)];
+}
+/** Build a string of `n` random decimal digits. */
+export function digits(rng, n) {
+    let out = '';
+    for (let i = 0; i < n; i++) {
+        out += Math.floor(rng() * 10).toString();
+    }
+    return out;
+}
+/** Derive a stable sub-seed from a base seed and an index. */
+export function subSeed(seed, index) {
+    return (Math.imul(seed ^ 0x9e3779b9, 0x85ebca6b) + index * 0x27d4eb2f) >>> 0;
+}
+//# sourceMappingURL=rng.js.map

package/dist/dlp/rng.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rng.js","sourceRoot":"","sources":["../../src/dlp/rng.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC;IACnB,OAAO,GAAG,EAAE;QACV,CAAC,IAAI,CAAC,CAAC;QACP,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,UAAU,CAAC;IAC/C,CAAC,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,IAAI,CAAI,GAAiB,EAAE,EAAgB;IACzD,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,MAAM,CAAC,GAAiB,EAAE,CAAS;IACjD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,KAAa;IACjD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,UAAU,EAAE,UAAU,CAAC,GAAG,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;AAC/E,CAAC"}

package/dist/dlp/types.d.ts

@@ -0,0 +1,26 @@
+export type Format = 'pdf' | 'png' | 'jpeg' | 'svg' | 'docx';
+export interface PayloadValue {
+    category: string;
+    value: string;
+}
+export interface Technique {
+    id: string;
+    format: Format;
+    label: string;
+    embed: (clean: Buffer, payload: PayloadValue[]) => Promise<Buffer> | Buffer;
+}
+export interface ManifestEntry {
+    format: Format;
+    technique: string;
+    clean: string;
+    dirty: string;
+    values: PayloadValue[];
+}
+export interface GenerateOptions {
+    types: Format[];
+    count: number;
+    out: string;
+    techniques: 'all' | string[];
+    seed?: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/dlp/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/dlp/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;AAE7D,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CAC7E;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,YAAY,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf"}

package/dist/dlp/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/dlp/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/dlp/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cdot65/prisma-airs-cli",
   "packageManager": "pnpm@10.6.5",
-  "version": "2.6.1",
+  "version": "2.8.0",
   "description": "CLI and library for Palo Alto Prisma AIRS — guardrail refinement, AI red teaming, model security scanning, profile audits",
   "type": "module",
   "main": "dist/index.js",
@@ -40,7 +40,7 @@
   "license": "MIT",
   "dependencies": {
     "@anthropic-ai/vertex-sdk": "^0.14.4",
-    "@cdot65/prisma-airs-sdk": "^0.8.1",
+    "@cdot65/prisma-airs-sdk": "^0.8.3",
     "@inquirer/prompts": "^8.3.0",
     "@langchain/anthropic": "^1.3.25",
     "@langchain/aws": "^1.3.3",
@@ -49,10 +49,14 @@
     "@langchain/google-vertexai": "^2.1.26",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
+    "docx": "^9.6.1",
     "dotenv": "^17.3.1",
     "js-yaml": "^4.1.1",
     "nanoid": "^5.0.0",
     "p-limit": "^6.0.0",
+    "pdf-lib": "^1.17.1",
+    "piexifjs": "^1.0.6",
+    "sharp": "^0.34.5",
     "zod": "^3.24.0"
   },
   "devDependencies": {