@discretion/core 0.1.0

package/dist/src/detect/detectors/contact/urlCredentials.js

@@ -0,0 +1,123 @@
+/**
+ * URL_WITH_CREDENTIALS — userinfo passwords and credential-bearing query
+ * parameters.
+ *
+ * SPEC.md: "URL_WITH_CREDENTIALS — userinfo components or tokens in query
+ * parameters."
+ *
+ * Two shapes, one detector:
+ *   • scheme://user:password@host…      (userinfo with a password)
+ *   • scheme://…?token=…&…              (a credential-named query parameter)
+ *
+ * The emitted span is the WHOLE URL, not just the secret. Masking only the
+ * password would leave "https://admin:…@internal.corp.com" — still leaking
+ * the username and the internal host — and M4's surrogate substitution can
+ * replace a whole URL with a same-shape fake, which it cannot do for a URL
+ * with a hole in it. The credential's location travels in metadata.
+ *
+ * A bare username without a password (git@github.com style) is NOT a
+ * credential; ubiquitous and public. Template placeholders (${VAR},
+ * YOUR_API_KEY) are detected but non-sensitive, mirroring test values.
+ */
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, GLOBAL_REGION, invalid, valid } from '../../types.js';
+/** Parameter names that are credentials whenever they carry a real value. */
+const STRONG_PARAMS = new Set([
+    'token', 'accesstoken', 'authtoken', 'idtoken', 'refreshtoken', 'apitoken', 'sastoken',
+    'apikey', 'secret', 'clientsecret', 'privatekey', 'password', 'passwd', 'pwd',
+    'authorization', 'bearer', 'credential', 'credentials',
+]);
+/**
+ * Names too generic to trust alone ("?key=north", "?sig=v2"): the value must
+ * itself look like key material — long and drawn from token alphabets.
+ */
+const WEAK_PARAMS = new Set(['key', 'auth', 'sig', 'signature', 'session', 'sessionid', 'code']);
+const WEAK_VALUE_SHAPE = /^[A-Za-z0-9+/_.=~%-]{16,}$/;
+/** Obvious template/placeholder values: detected, non-sensitive. */
+function isPlaceholder(value) {
+    if (/^\$\{[^}]*\}$/.test(value) || /^\{\{[^}]*\}\}$/.test(value))
+        return true;
+    if (/^<[^>]*>$/.test(value))
+        return true;
+    if (/^(?:x+|X+|\*+|\.+)$/.test(value))
+        return true;
+    if (/^YOUR[_-]/i.test(value) || /[_-]HERE$/i.test(value))
+        return true;
+    if (/^(?:changeme|placeholder|redacted|example|dummy|sample|test)$/i.test(value))
+        return true;
+    return false;
+}
+/** RFC 2606/6761 documentation hosts → the whole URL is a doc example. */
+function isReservedHost(host) {
+    const h = host.toLowerCase().replace(/:\d+$/, '');
+    if (h === 'localhost' || h.endsWith('.localhost'))
+        return true;
+    if (/(^|\.)example\.(com|net|org)$/.test(h))
+        return true;
+    return /\.(test|invalid|example)$/.test(h);
+}
+function validateUrlCredentials(ctx) {
+    const raw = ctx.match[0];
+    const schemeEnd = raw.indexOf('://');
+    if (schemeEnd < 0)
+        return invalid('no scheme');
+    const rest = raw.slice(schemeEnd + 3);
+    // Userinfo form: user:password@host…
+    const slash = rest.search(/[/?#]/);
+    const authority = slash < 0 ? rest : rest.slice(0, slash);
+    const at = authority.lastIndexOf('@');
+    if (at > 0) {
+        const userinfo = authority.slice(0, at);
+        const host = authority.slice(at + 1);
+        const colon = userinfo.indexOf(':');
+        if (colon <= 0 || colon === userinfo.length - 1) {
+            return invalid('userinfo has no password');
+        }
+        const password = userinfo.slice(colon + 1);
+        const placeholder = isPlaceholder(password) || isReservedHost(host);
+        return valid({
+            sensitive: !placeholder,
+            metadata: { kind: 'userinfo', host },
+            validator: 'url-credential-structural',
+        });
+    }
+    // Query-parameter form.
+    const paramPattern = /[?&]([A-Za-z0-9_-]+)=([^\s&"'<>]+)/g;
+    let m;
+    while ((m = paramPattern.exec(raw)) !== null) {
+        const name = m[1].toLowerCase().replace(/[_-]/g, '');
+        const value = m[2];
+        const strong = STRONG_PARAMS.has(name);
+        const weak = WEAK_PARAMS.has(name);
+        if (!strong && !weak)
+            continue;
+        if (strong && value.length < 6)
+            continue;
+        if (weak && !WEAK_VALUE_SHAPE.test(value))
+            continue;
+        const host = authority;
+        const placeholder = isPlaceholder(value) || isReservedHost(host);
+        return valid({
+            sensitive: !placeholder,
+            metadata: { kind: 'query', param: m[1], host },
+            validator: 'url-credential-structural',
+        });
+    }
+    return invalid('no credential-bearing component');
+}
+registerDetector({
+    id: 'url-with-credentials',
+    entityType: 'URL_WITH_CREDENTIALS',
+    regions: [GLOBAL_REGION],
+    // Commas and pipes terminate the URI. RFC 3986 permits a comma as a
+    // sub-delimiter, but in the shapes URIs actually appear in — CSV rows,
+    // pipe-delimited logs, markdown table cells — an unencoded one is a FIELD
+    // boundary, and swallowing it made this span eat the neighbouring cells.
+    // That is not merely a mislabelled span: masking OVERWRITES the span, so an
+    // over-long one destroys the user's adjacent data.
+    pattern: /\b[A-Za-z][A-Za-z0-9+.-]{1,15}:\/\/[^\s"'<>,|]{3,700}/g,
+    baseConfidence: CONFIDENCE.HIGH,
+    description: 'URLs carrying credentials in userinfo or query parameters; whole-URL span.',
+    validate: validateUrlCredentials,
+});
+//# sourceMappingURL=urlCredentials.js.map

package/dist/src/detect/detectors/contact/urlCredentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"urlCredentials.js","sourceRoot":"","sources":["../../../../../src/detect/detectors/contact/urlCredentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG3E,6EAA6E;AAC7E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU;IACtF,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK;IAC7E,eAAe,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa;CACvD,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjG,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAEtD,oEAAoE;AACpE,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,IAAI,gEAAgE,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0EAA0E;AAC1E,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAsB;IACpD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAEtC,qCAAqC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1D,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,OAAO,CAAC,0BAA0B,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;QACpE,OAAO,KAAK,CAAC;YACX,SAAS,EAAE,CAAC,WAAW;YACvB,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;YACpC,SAAS,EAAE,2BAA2B;SACvC,CAAC,CAAC;IACL,CAAC;IAED,wBAAwB;IACxB,MAAM,YAAY,GAAG,qCAAqC,CAAC;IAC3D,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACpB,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI;YAAE,SAAS;QAC/B,IAAI,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACzC,IAAI,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QAEpD,MAAM,IAAI,GAAG,SAAS,CAAC;QACvB,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC;YACX,SAAS,EAAE,CAAC,WAAW;YACvB,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE;YAC/C,SAAS,EAAE,2BAA2B;SACvC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC,iCAAiC,CAAC,CAAC;AACpD,CAAC;AAED,gBAAgB,CAAC;IACf,EAAE,EAAE,sBAAsB;IAC1B,UAAU,EAAE,sBAAsB;IAClC,OAAO,EAAE,CAAC,aAAa,CAAC;IACxB,oEAAoE;IACpE,uEAAuE;IACvE,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,mDAAmD;IACnD,OAAO,EAAE,wDAAwD;IACjE,cAAc,EAAE,UAAU,CAAC,IAAI;IAC/B,WAAW,EAAE,4EAA4E;IACzF,QAAQ,EAAE,sBAAsB;CACjC,CAAC,CAAC"}

package/dist/src/detect/detectors/crypto/ada.d.ts

@@ -0,0 +1,13 @@
+/**
+ * CRYPTO_WALLET: Cardano.
+ *
+ * Shelley addresses ('addr1…') are bech32 with a REAL checksum — verified
+ * here with the length limit raised past BIP-173's 90 characters, which
+ * Cardano exceeds by design — so they earn HIGH. Byron-era addresses
+ * ('Ae2…', 'DdzFF…') wrap their CRC in a CBOR envelope; verifying it would
+ * mean parsing CBOR for a legacy format, so Byron validates structurally
+ * (base58-decodable with the known prefix) at MEDIUM. The asymmetry is
+ * deliberate and stated here rather than hidden.
+ */
+export {};
+//# sourceMappingURL=ada.d.ts.map

package/dist/src/detect/detectors/crypto/ada.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ada.d.ts","sourceRoot":"","sources":["../../../../../src/detect/detectors/crypto/ada.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/src/detect/detectors/crypto/ada.js

@@ -0,0 +1,51 @@
+/**
+ * CRYPTO_WALLET: Cardano.
+ *
+ * Shelley addresses ('addr1…') are bech32 with a REAL checksum — verified
+ * here with the length limit raised past BIP-173's 90 characters, which
+ * Cardano exceeds by design — so they earn HIGH. Byron-era addresses
+ * ('Ae2…', 'DdzFF…') wrap their CRC in a CBOR envelope; verifying it would
+ * mean parsing CBOR for a legacy format, so Byron validates structurally
+ * (base58-decodable with the known prefix) at MEDIUM. The asymmetry is
+ * deliberate and stated here rather than hidden.
+ */
+import { base58Decode } from '../../../encoding/base58.js';
+import { bech32Decode } from '../../../encoding/bech32.js';
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, GLOBAL_REGION, invalid, valid } from '../../types.js';
+function validateAda(ctx) {
+    const raw = ctx.match[0];
+    if (raw.toLowerCase().startsWith('addr1')) {
+        const decoded = bech32Decode(raw, 130);
+        if (decoded === null)
+            return invalid('bech32 checksum failed');
+        if (decoded.hrp !== 'addr')
+            return invalid('not the Cardano hrp');
+        return valid({
+            canonical: raw.toLowerCase(),
+            metadata: { chain: 'ada', era: 'shelley' },
+            validator: 'bech32',
+        });
+    }
+    const bytes = base58Decode(raw);
+    if (bytes === null)
+        return invalid('not base58');
+    if (bytes.length < 30)
+        return invalid('too short for a Byron address');
+    return valid({
+        canonical: raw,
+        confidence: CONFIDENCE.MEDIUM,
+        metadata: { chain: 'ada', era: 'byron' },
+        validator: 'byron-structural',
+    });
+}
+registerDetector({
+    id: 'crypto-ada',
+    entityType: 'CRYPTO_WALLET',
+    regions: [GLOBAL_REGION],
+    pattern: /\b(?:addr1[02-9ac-hj-np-z]{20,110}|(?:Ae2|DdzFF)[1-9A-HJ-NP-Za-km-z]{20,120})\b/g,
+    baseConfidence: CONFIDENCE.HIGH,
+    description: 'Cardano addresses: Shelley bech32 checksummed at HIGH, Byron structural at MEDIUM.',
+    validate: validateAda,
+});
+//# sourceMappingURL=ada.js.map

package/dist/src/detect/detectors/crypto/ada.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ada.js","sourceRoot":"","sources":["../../../../../src/detect/detectors/crypto/ada.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG3E,SAAS,WAAW,CAAC,GAAsB;IACzC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEzB,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM;YAAE,OAAO,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAClE,OAAO,KAAK,CAAC;YACX,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;YAC5B,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE;YAC1C,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC;QACX,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,UAAU,CAAC,MAAM;QAC7B,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;QACxC,SAAS,EAAE,kBAAkB;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,gBAAgB,CAAC;IACf,EAAE,EAAE,YAAY;IAChB,UAAU,EAAE,eAAe;IAC3B,OAAO,EAAE,CAAC,aAAa,CAAC;IACxB,OAAO,EAAE,kFAAkF;IAC3F,cAAc,EAAE,UAAU,CAAC,IAAI;IAC/B,WAAW,EAAE,oFAAoF;IACjG,QAAQ,EAAE,WAAW;CACtB,CAAC,CAAC"}

package/dist/src/detect/detectors/crypto/btc.d.ts

@@ -0,0 +1,15 @@
+/**
+ * CRYPTO_WALLET: Bitcoin.
+ *
+ * Three address families, all checksum-verified:
+ *   • base58check version 0x00 (P2PKH, '1…') and 0x05 (P2SH, '3…')
+ *   • bech32 'bc1q…' — segwit v0, program exactly 20 or 32 bytes
+ *   • bech32m 'bc1p…' — segwit v1+ (taproot), program 2–40 bytes
+ * The v0/v1 encoding split is BIP-350's rule: a v0 address closed with
+ * bech32m (or v1 with bech32) is INVALID, not merely unusual.
+ *
+ * The genesis address is treated like a documentation value: it appears in
+ * every Bitcoin tutorial and identifies no user.
+ */
+export {};
+//# sourceMappingURL=btc.d.ts.map

package/dist/src/detect/detectors/crypto/btc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"btc.d.ts","sourceRoot":"","sources":["../../../../../src/detect/detectors/crypto/btc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}

package/dist/src/detect/detectors/crypto/btc.js

@@ -0,0 +1,78 @@
+/**
+ * CRYPTO_WALLET: Bitcoin.
+ *
+ * Three address families, all checksum-verified:
+ *   • base58check version 0x00 (P2PKH, '1…') and 0x05 (P2SH, '3…')
+ *   • bech32 'bc1q…' — segwit v0, program exactly 20 or 32 bytes
+ *   • bech32m 'bc1p…' — segwit v1+ (taproot), program 2–40 bytes
+ * The v0/v1 encoding split is BIP-350's rule: a v0 address closed with
+ * bech32m (or v1 with bech32) is INVALID, not merely unusual.
+ *
+ * The genesis address is treated like a documentation value: it appears in
+ * every Bitcoin tutorial and identifies no user.
+ */
+import { base58CheckDecode } from '../../../encoding/base58.js';
+import { bech32Decode, convertBits } from '../../../encoding/bech32.js';
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, GLOBAL_REGION, invalid, valid } from '../../types.js';
+const WELL_KNOWN = new Set([
+    '1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa', // genesis block coinbase
+]);
+function validateBtc(ctx) {
+    const raw = ctx.match[0];
+    if (raw[0] === '1' || raw[0] === '3') {
+        const decoded = base58CheckDecode(raw);
+        if (decoded === null)
+            return invalid('base58check checksum failed');
+        if (decoded.version !== 0x00 && decoded.version !== 0x05) {
+            return invalid('not a Bitcoin version byte');
+        }
+        if (decoded.payload.length !== 20)
+            return invalid('payload is not a hash160');
+        return valid({
+            canonical: raw,
+            sensitive: !WELL_KNOWN.has(raw),
+            metadata: { chain: 'btc', kind: decoded.version === 0x00 ? 'p2pkh' : 'p2sh' },
+            validator: 'base58check',
+        });
+    }
+    const decoded = bech32Decode(raw);
+    if (decoded === null)
+        return invalid('bech32 checksum failed');
+    if (decoded.hrp !== 'bc')
+        return invalid('not the Bitcoin hrp');
+    if (decoded.data.length === 0)
+        return invalid('empty witness data');
+    const version = decoded.data[0];
+    if (version > 16)
+        return invalid('witness version out of range');
+    const program = convertBits(decoded.data.slice(1), 5, 8, false);
+    if (program === null || program.length < 2 || program.length > 40) {
+        return invalid('malformed witness program');
+    }
+    if (version === 0) {
+        if (decoded.encoding !== 'bech32')
+            return invalid('segwit v0 requires bech32');
+        if (program.length !== 20 && program.length !== 32) {
+            return invalid('v0 program must be 20 or 32 bytes');
+        }
+    }
+    else if (decoded.encoding !== 'bech32m') {
+        return invalid('segwit v1+ requires bech32m');
+    }
+    return valid({
+        canonical: raw.toLowerCase(),
+        metadata: { chain: 'btc', kind: version === 0 ? 'segwit-v0' : `segwit-v${version}` },
+        validator: decoded.encoding,
+    });
+}
+registerDetector({
+    id: 'crypto-btc',
+    entityType: 'CRYPTO_WALLET',
+    regions: [GLOBAL_REGION],
+    pattern: /\b(?:[13][1-9A-HJ-NP-Za-km-z]{25,34}|(?:bc1|BC1)[0-9A-Za-z]{11,87})\b/g,
+    baseConfidence: CONFIDENCE.HIGH,
+    description: 'Bitcoin addresses: base58check P2PKH/P2SH and BIP-173/350 segwit, all checksummed.',
+    validate: validateBtc,
+});
+//# sourceMappingURL=btc.js.map

package/dist/src/detect/detectors/crypto/btc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"btc.js","sourceRoot":"","sources":["../../../../../src/detect/detectors/crypto/btc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG3E,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC;IAC9C,oCAAoC,EAAE,yBAAyB;CAChE,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,GAAsB;IACzC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEzB,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,6BAA6B,CAAC,CAAC;QACpE,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACzD,OAAO,OAAO,CAAC,4BAA4B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,OAAO,CAAC,0BAA0B,CAAC,CAAC;QAC9E,OAAO,KAAK,CAAC;YACX,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAC/B,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE;YAC7E,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;IACjC,IAAI,OAAO,GAAG,EAAE;QAAE,OAAO,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAChE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClE,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;QAC/E,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACnD,OAAO,OAAO,CAAC,mCAAmC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,KAAK,CAAC;QACX,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE,EAAE;QACpF,SAAS,EAAE,OAAO,CAAC,QAAQ;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,gBAAgB,CAAC;IACf,EAAE,EAAE,YAAY;IAChB,UAAU,EAAE,eAAe;IAC3B,OAAO,EAAE,CAAC,aAAa,CAAC;IACxB,OAAO,EAAE,wEAAwE;IACjF,cAAc,EAAE,UAAU,CAAC,IAAI;IAC/B,WAAW,EAAE,oFAAoF;IACjG,QAAQ,EAAE,WAAW;CACtB,CAAC,CAAC"}

package/dist/src/detect/detectors/crypto/dot.d.ts

@@ -0,0 +1,13 @@
+/**
+ * CRYPTO_WALLET: Polkadot.
+ *
+ * SS58 closes with the first two bytes of blake2b-512("SS58PRE" ‖ payload).
+ * Blake2b is not among the bundled hash primitives, and Polkadot would be
+ * its only consumer, so per the recorded decision (ARCHITECTURE.md D9) this
+ * detector validates STRUCTURALLY at MEDIUM: base58 decodes to exactly 35
+ * bytes (1 network + 32 key + 2 checksum) with the Polkadot network byte
+ * 0x00 — which is also why the address always starts with '1'. The checksum
+ * bytes are present but unverified; the confidence cap says so.
+ */
+export {};
+//# sourceMappingURL=dot.d.ts.map

package/dist/src/detect/detectors/crypto/dot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dot.d.ts","sourceRoot":"","sources":["../../../../../src/detect/detectors/crypto/dot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/src/detect/detectors/crypto/dot.js

@@ -0,0 +1,41 @@
+/**
+ * CRYPTO_WALLET: Polkadot.
+ *
+ * SS58 closes with the first two bytes of blake2b-512("SS58PRE" ‖ payload).
+ * Blake2b is not among the bundled hash primitives, and Polkadot would be
+ * its only consumer, so per the recorded decision (ARCHITECTURE.md D9) this
+ * detector validates STRUCTURALLY at MEDIUM: base58 decodes to exactly 35
+ * bytes (1 network + 32 key + 2 checksum) with the Polkadot network byte
+ * 0x00 — which is also why the address always starts with '1'. The checksum
+ * bytes are present but unverified; the confidence cap says so.
+ */
+import { base58Decode } from '../../../encoding/base58.js';
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, GLOBAL_REGION, invalid, valid } from '../../types.js';
+function validateDot(ctx) {
+    const raw = ctx.match[0];
+    const bytes = base58Decode(raw);
+    if (bytes === null)
+        return invalid('not base58');
+    if (bytes.length !== 35)
+        return invalid('not an SS58 account envelope');
+    if (bytes[0] !== 0x00)
+        return invalid('not the Polkadot network prefix');
+    return valid({
+        canonical: raw,
+        metadata: { chain: 'dot', checksum: 'unverified' },
+        validator: 'ss58-structural',
+    });
+}
+registerDetector({
+    id: 'crypto-dot',
+    entityType: 'CRYPTO_WALLET',
+    regions: [GLOBAL_REGION],
+    // Network byte 0x00 → leading '1'; 35 bytes → 45–51 chars, disjoint from
+    // the Bitcoin P2PKH length range (26–35) that shares the prefix.
+    pattern: /\b1[1-9A-HJ-NP-Za-km-z]{44,50}\b/g,
+    baseConfidence: CONFIDENCE.MEDIUM,
+    description: 'Polkadot SS58 addresses, structural (blake2b checksum unverified - ARCHITECTURE.md D9).',
+    validate: validateDot,
+});
+//# sourceMappingURL=dot.js.map

package/dist/src/detect/detectors/crypto/dot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dot.js","sourceRoot":"","sources":["../../../../../src/detect/detectors/crypto/dot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG3E,SAAS,WAAW,CAAC,GAAsB;IACzC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAEzE,OAAO,KAAK,CAAC;QACX,SAAS,EAAE,GAAG;QACd,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE;QAClD,SAAS,EAAE,iBAAiB;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,gBAAgB,CAAC;IACf,EAAE,EAAE,YAAY;IAChB,UAAU,EAAE,eAAe;IAC3B,OAAO,EAAE,CAAC,aAAa,CAAC;IACxB,yEAAyE;IACzE,iEAAiE;IACjE,OAAO,EAAE,mCAAmC;IAC5C,cAAc,EAAE,UAAU,CAAC,MAAM;IACjC,WAAW,EAAE,yFAAyF;IACtG,QAAQ,EAAE,WAAW;CACtB,CAAC,CAAC"}

package/dist/src/detect/detectors/crypto/eth.d.ts

@@ -0,0 +1,15 @@
+/**
+ * CRYPTO_WALLET: Ethereum (and every EVM chain sharing its format).
+ *
+ * 0x + 40 hex characters. When the hex is MIXED-case, EIP-55 applies: the
+ * i-th letter is uppercase iff the i-th nibble of keccak256(lowercase hex
+ * of the address) is ≥ 8 — a real checksum, verified here, HIGH on pass and
+ * a hard rejection on failure. An all-lowercase or all-uppercase address
+ * carries no checksum at all (that writing predates EIP-55 and is still
+ * common), so it validates structurally at MEDIUM.
+ *
+ * The zero address is the conventional burn target and identifies nobody.
+ */
+/** EIP-55: the correctly-checksummed writing of a lowercase hex address. */
+export declare function toEip55(hexLower: string): string;
+//# sourceMappingURL=eth.d.ts.map

package/dist/src/detect/detectors/crypto/eth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eth.d.ts","sourceRoot":"","sources":["../../../../../src/detect/detectors/crypto/eth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAUH,4EAA4E;AAC5E,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQhD"}

package/dist/src/detect/detectors/crypto/eth.js

@@ -0,0 +1,63 @@
+/**
+ * CRYPTO_WALLET: Ethereum (and every EVM chain sharing its format).
+ *
+ * 0x + 40 hex characters. When the hex is MIXED-case, EIP-55 applies: the
+ * i-th letter is uppercase iff the i-th nibble of keccak256(lowercase hex
+ * of the address) is ≥ 8 — a real checksum, verified here, HIGH on pass and
+ * a hard rejection on failure. An all-lowercase or all-uppercase address
+ * carries no checksum at all (that writing predates EIP-55 and is still
+ * common), so it validates structurally at MEDIUM.
+ *
+ * The zero address is the conventional burn target and identifies nobody.
+ */
+import { keccak256 } from '../../../crypto/keccak256.js';
+import { utf8ToBytes, bytesToHex } from '../../../encoding/bytes.js';
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, GLOBAL_REGION, invalid, valid } from '../../types.js';
+const ZERO_ADDRESS = '0x0000000000000000000000000000000000000000';
+/** EIP-55: the correctly-checksummed writing of a lowercase hex address. */
+export function toEip55(hexLower) {
+    const hash = bytesToHex(keccak256(utf8ToBytes(hexLower)));
+    let out = '';
+    for (let i = 0; i < 40; i++) {
+        const ch = hexLower[i];
+        out += /[a-f]/.test(ch) && parseInt(hash[i], 16) >= 8 ? ch.toUpperCase() : ch;
+    }
+    return out;
+}
+function validateEth(ctx) {
+    const hex = ctx.match[0].slice(2);
+    const lower = hex.toLowerCase();
+    const hasLower = /[a-f]/.test(hex);
+    const hasUpper = /[A-F]/.test(hex);
+    const canonical = `0x${lower}`;
+    const sensitive = canonical !== ZERO_ADDRESS;
+    if (hasLower && hasUpper) {
+        if (toEip55(lower) !== hex)
+            return invalid('EIP-55 checksum failed');
+        return valid({
+            canonical,
+            sensitive,
+            metadata: { chain: 'eth', checksum: 'eip55' },
+            validator: 'eip55',
+        });
+    }
+    // Single-case writing: no checksum exists to verify.
+    return valid({
+        canonical,
+        sensitive,
+        confidence: CONFIDENCE.MEDIUM,
+        metadata: { chain: 'eth', checksum: 'none' },
+        validator: 'eth-structural',
+    });
+}
+registerDetector({
+    id: 'crypto-eth',
+    entityType: 'CRYPTO_WALLET',
+    regions: [GLOBAL_REGION],
+    pattern: /\b0x[0-9a-fA-F]{40}\b/g,
+    baseConfidence: CONFIDENCE.HIGH,
+    description: 'Ethereum addresses; EIP-55 verified where mixed-case, MEDIUM where uncased.',
+    validate: validateEth,
+});
+//# sourceMappingURL=eth.js.map

package/dist/src/detect/detectors/crypto/eth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eth.js","sourceRoot":"","sources":["../../../../../src/detect/detectors/crypto/eth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG3E,MAAM,YAAY,GAAG,4CAA4C,CAAC;AAElE,4EAA4E;AAC5E,MAAM,UAAU,OAAO,CAAC,QAAgB;IACtC,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QACxB,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,GAAsB;IACzC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,SAAS,GAAG,KAAK,KAAK,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,SAAS,KAAK,YAAY,CAAC;IAE7C,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG;YAAE,OAAO,OAAO,CAAC,wBAAwB,CAAC,CAAC;QACrE,OAAO,KAAK,CAAC;YACX,SAAS;YACT,SAAS;YACT,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE;YAC7C,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;IACL,CAAC;IAED,qDAAqD;IACrD,OAAO,KAAK,CAAC;QACX,SAAS;QACT,SAAS;QACT,UAAU,EAAE,UAAU,CAAC,MAAM;QAC7B,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE;QAC5C,SAAS,EAAE,gBAAgB;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,gBAAgB,CAAC;IACf,EAAE,EAAE,YAAY;IAChB,UAAU,EAAE,eAAe;IAC3B,OAAO,EAAE,CAAC,aAAa,CAAC;IACxB,OAAO,EAAE,wBAAwB;IACjC,cAAc,EAAE,UAAU,CAAC,IAAI;IAC/B,WAAW,EAAE,6EAA6E;IAC1F,QAAQ,EAAE,WAAW;CACtB,CAAC,CAAC"}

package/dist/src/detect/detectors/crypto/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Crypto wallet family. Side-effect imports only.
+ */
+import './btc.js';
+import './eth.js';
+import './ltc.js';
+import './xmr.js';
+import './sol.js';
+import './trx.js';
+import './ada.js';
+import './dot.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/detect/detectors/crypto/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/detect/detectors/crypto/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,UAAU,CAAC;AAClB,OAAO,UAAU,CAAC;AAClB,OAAO,UAAU,CAAC;AAClB,OAAO,UAAU,CAAC;AAClB,OAAO,UAAU,CAAC;AAClB,OAAO,UAAU,CAAC;AAClB,OAAO,UAAU,CAAC;AAClB,OAAO,UAAU,CAAC"}

package/dist/src/detect/detectors/crypto/index.js

@@ -0,0 +1,12 @@
+/**
+ * Crypto wallet family. Side-effect imports only.
+ */
+import './btc.js';
+import './eth.js';
+import './ltc.js';
+import './xmr.js';
+import './sol.js';
+import './trx.js';
+import './ada.js';
+import './dot.js';
+//# sourceMappingURL=index.js.map

package/dist/src/detect/detectors/crypto/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/detect/detectors/crypto/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,UAAU,CAAC;AAClB,OAAO,UAAU,CAAC;AAClB,OAAO,UAAU,CAAC;AAClB,OAAO,UAAU,CAAC;AAClB,OAAO,UAAU,CAAC;AAClB,OAAO,UAAU,CAAC;AAClB,OAAO,UAAU,CAAC;AAClB,OAAO,UAAU,CAAC"}

package/dist/src/detect/detectors/crypto/ltc.d.ts

@@ -0,0 +1,12 @@
+/**
+ * CRYPTO_WALLET: Litecoin.
+ *
+ * base58check versions 0x30 ('L…', P2PKH) and 0x32 ('M…', P2SH), plus
+ * bech32 'ltc1…' segwit under the same BIP-173 rules as Bitcoin. Litecoin's
+ * legacy '3…' P2SH form is deliberately NOT claimed here — it is
+ * indistinguishable from Bitcoin P2SH (same version byte), and the BTC
+ * detector already reports it; chain attribution for that shared prefix is
+ * genuinely ambiguous and pretending otherwise would be false metadata.
+ */
+export {};
+//# sourceMappingURL=ltc.d.ts.map

package/dist/src/detect/detectors/crypto/ltc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ltc.d.ts","sourceRoot":"","sources":["../../../../../src/detect/detectors/crypto/ltc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/src/detect/detectors/crypto/ltc.js

@@ -0,0 +1,71 @@
+/**
+ * CRYPTO_WALLET: Litecoin.
+ *
+ * base58check versions 0x30 ('L…', P2PKH) and 0x32 ('M…', P2SH), plus
+ * bech32 'ltc1…' segwit under the same BIP-173 rules as Bitcoin. Litecoin's
+ * legacy '3…' P2SH form is deliberately NOT claimed here — it is
+ * indistinguishable from Bitcoin P2SH (same version byte), and the BTC
+ * detector already reports it; chain attribution for that shared prefix is
+ * genuinely ambiguous and pretending otherwise would be false metadata.
+ */
+import { base58CheckDecode } from '../../../encoding/base58.js';
+import { bech32Decode, convertBits } from '../../../encoding/bech32.js';
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, GLOBAL_REGION, invalid, valid } from '../../types.js';
+function validateLtc(ctx) {
+    const raw = ctx.match[0];
+    if (raw[0] === 'L' || raw[0] === 'M') {
+        const decoded = base58CheckDecode(raw);
+        if (decoded === null)
+            return invalid('base58check checksum failed');
+        if (decoded.version !== 0x30 && decoded.version !== 0x32) {
+            return invalid('not a Litecoin version byte');
+        }
+        if (decoded.payload.length !== 20)
+            return invalid('payload is not a hash160');
+        return valid({
+            canonical: raw,
+            metadata: { chain: 'ltc', kind: decoded.version === 0x30 ? 'p2pkh' : 'p2sh' },
+            validator: 'base58check',
+        });
+    }
+    const decoded = bech32Decode(raw);
+    if (decoded === null)
+        return invalid('bech32 checksum failed');
+    if (decoded.hrp !== 'ltc')
+        return invalid('not the Litecoin hrp');
+    if (decoded.data.length === 0)
+        return invalid('empty witness data');
+    const version = decoded.data[0];
+    if (version > 16)
+        return invalid('witness version out of range');
+    const program = convertBits(decoded.data.slice(1), 5, 8, false);
+    if (program === null || program.length < 2 || program.length > 40) {
+        return invalid('malformed witness program');
+    }
+    if (version === 0) {
+        if (decoded.encoding !== 'bech32')
+            return invalid('segwit v0 requires bech32');
+        if (program.length !== 20 && program.length !== 32) {
+            return invalid('v0 program must be 20 or 32 bytes');
+        }
+    }
+    else if (decoded.encoding !== 'bech32m') {
+        return invalid('segwit v1+ requires bech32m');
+    }
+    return valid({
+        canonical: raw.toLowerCase(),
+        metadata: { chain: 'ltc', kind: version === 0 ? 'segwit-v0' : `segwit-v${version}` },
+        validator: decoded.encoding,
+    });
+}
+registerDetector({
+    id: 'crypto-ltc',
+    entityType: 'CRYPTO_WALLET',
+    regions: [GLOBAL_REGION],
+    pattern: /\b(?:[LM][1-9A-HJ-NP-Za-km-z]{25,34}|(?:ltc1|LTC1)[0-9A-Za-z]{11,87})\b/g,
+    baseConfidence: CONFIDENCE.HIGH,
+    description: 'Litecoin addresses: base58check L/M forms and ltc1 segwit, all checksummed.',
+    validate: validateLtc,
+});
+//# sourceMappingURL=ltc.js.map

package/dist/src/detect/detectors/crypto/ltc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ltc.js","sourceRoot":"","sources":["../../../../../src/detect/detectors/crypto/ltc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG3E,SAAS,WAAW,CAAC,GAAsB;IACzC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEzB,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,6BAA6B,CAAC,CAAC;QACpE,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACzD,OAAO,OAAO,CAAC,6BAA6B,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,OAAO,CAAC,0BAA0B,CAAC,CAAC;QAC9E,OAAO,KAAK,CAAC;YACX,SAAS,EAAE,GAAG;YACd,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE;YAC7E,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;IACjC,IAAI,OAAO,GAAG,EAAE;QAAE,OAAO,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAChE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClE,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;QAC/E,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACnD,OAAO,OAAO,CAAC,mCAAmC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,KAAK,CAAC;QACX,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE,EAAE;QACpF,SAAS,EAAE,OAAO,CAAC,QAAQ;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,gBAAgB,CAAC;IACf,EAAE,EAAE,YAAY;IAChB,UAAU,EAAE,eAAe;IAC3B,OAAO,EAAE,CAAC,aAAa,CAAC;IACxB,OAAO,EAAE,0EAA0E;IACnF,cAAc,EAAE,UAAU,CAAC,IAAI;IAC/B,WAAW,EAAE,6EAA6E;IAC1F,QAAQ,EAAE,WAAW;CACtB,CAAC,CAAC"}

package/dist/src/detect/detectors/crypto/sol.d.ts

@@ -0,0 +1,13 @@
+/**
+ * CRYPTO_WALLET: Solana.
+ *
+ * A Solana address is a bare ed25519 public key in Bitcoin-alphabet base58 —
+ * there is NO checksum, so this is structural validation: the string must
+ * decode to EXACTLY 32 bytes, which rejects most base58-looking words (a
+ * 40-character run decodes to ~29 bytes, a Bitcoin address to 25). MEDIUM
+ * by the no-checksum rule.
+ *
+ * The system program (32 '1's, the all-zero key) is a well-known constant.
+ */
+export {};
+//# sourceMappingURL=sol.d.ts.map

package/dist/src/detect/detectors/crypto/sol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sol.d.ts","sourceRoot":"","sources":["../../../../../src/detect/detectors/crypto/sol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}