@discretion/core 0.1.0

package/dist/src/detect/detectors/natid/tw.js

@@ -0,0 +1,40 @@
+/**
+ * Taiwan: National ID — a region letter, a gender digit (1/2; 8/9 for the
+ * new resident-certificate format), then eight digits. The letter maps to a
+ * two-digit code via the published table; tens digit ×1, ones ×9, then the
+ * eight payload digits weighted 8..1 (wait — 8,7,6,5,4,3,2,1) plus the
+ * check digit ×1 must sum ≡ 0 (mod 10).
+ */
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+/** The published letter→code table (not alphabetical for I, O, W–Z). */
+const LETTER_CODES = {
+    A: 10, B: 11, C: 12, D: 13, E: 14, F: 15, G: 16, H: 17, I: 34, J: 18,
+    K: 19, L: 20, M: 21, N: 22, O: 35, P: 23, Q: 24, R: 25, S: 26, T: 27,
+    U: 28, V: 29, W: 32, X: 30, Y: 31, Z: 33,
+};
+registerDetector({
+    id: 'national-id-tw',
+    entityType: 'NATIONAL_ID',
+    regions: ['TW'],
+    pattern: /\b([A-Z])([1289])(\d{7})(\d)\b/g,
+    baseConfidence: CONFIDENCE.HIGH,
+    description: 'Taiwanese National ID with the letter-code mod-10 check.',
+    validate(ctx) {
+        const code = LETTER_CODES[ctx.match[1]];
+        const digits = `${ctx.match[2]}${ctx.match[3]}`;
+        let sum = Math.floor(code / 10) + (code % 10) * 9;
+        const weights = [8, 7, 6, 5, 4, 3, 2, 1];
+        for (let i = 0; i < 8; i++)
+            sum += Number(digits[i]) * weights[i];
+        sum += Number(ctx.match[4]);
+        if (sum % 10 !== 0)
+            return invalid('mod-10 check failed');
+        return valid({
+            canonical: ctx.match[0],
+            metadata: { scheme: 'tw-id', country: 'TW' },
+            validator: 'tw-mod10',
+        });
+    },
+});
+//# sourceMappingURL=tw.js.map

package/dist/src/detect/detectors/natid/tw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tw.js","sourceRoot":"","sources":["../../../../../src/detect/detectors/natid/tw.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG5D,wEAAwE;AACxE,MAAM,YAAY,GAAqC;IACrD,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE;IACpE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE;IACpE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE;CACzC,CAAC;AAEF,gBAAgB,CAAC;IACf,EAAE,EAAE,gBAAgB;IACpB,UAAU,EAAE,aAAa;IACzB,OAAO,EAAE,CAAC,IAAI,CAAC;IACf,OAAO,EAAE,iCAAiC;IAC1C,cAAc,EAAE,UAAU,CAAC,IAAI;IAC/B,WAAW,EAAE,0DAA0D;IACvE,QAAQ,CAAC,GAAG;QACV,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QACnE,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,GAAG,GAAG,EAAE,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC;YACX,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YACvB,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;YAC5C,SAAS,EAAE,UAAU;SACtB,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC"}

package/dist/src/detect/detectors/natid/ua.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Ukraine: RNOKPP (РНОКПП, the individual tax number) — ten digits, weights
+ * −1,5,7,9,4,6,10,5,7 over the first nine, check = (sum mod 11) mod 10.
+ * The negative first weight is genuine, not a transcription error.
+ */
+export {};
+//# sourceMappingURL=ua.d.ts.map

package/dist/src/detect/detectors/natid/ua.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ua.d.ts","sourceRoot":"","sources":["../../../../../src/detect/detectors/natid/ua.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/src/detect/detectors/natid/ua.js

@@ -0,0 +1,38 @@
+/**
+ * Ukraine: RNOKPP (РНОКПП, the individual tax number) — ten digits, weights
+ * −1,5,7,9,4,6,10,5,7 over the first nine, check = (sum mod 11) mod 10.
+ * The negative first weight is genuine, not a transcription error.
+ */
+import { toDigits } from '../../../checksums/index.js';
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+const RNOKPP_WEIGHTS = [-1, 5, 7, 9, 4, 6, 10, 5, 7];
+registerDetector({
+    id: 'national-id-ua-rnokpp',
+    entityType: 'TAX_ID',
+    regions: ['UA'],
+    pattern: /\b\d{10}\b/g,
+    baseConfidence: CONFIDENCE.HIGH,
+    description: 'Ukrainian RNOKPP with its negative-first-weight mod-11 check.',
+    validate(ctx) {
+        const before = ctx.start > 0 ? ctx.text[ctx.start - 1] : '';
+        if (/[\d-]/.test(before ?? ''))
+            return invalid('fragment of a longer number');
+        const after = ctx.text.slice(ctx.end, ctx.end + 2);
+        if (/^\d/.test(after) || /^-\d/.test(after))
+            return invalid('fragment of a longer number');
+        const d = toDigits(ctx.match[0]);
+        let sum = 0;
+        for (let i = 0; i < 9; i++)
+            sum += d[i] * RNOKPP_WEIGHTS[i];
+        const check = ((sum % 11) + 11) % 11 % 10;
+        if (check !== d[9])
+            return invalid('RNOKPP check failed');
+        return valid({
+            canonical: ctx.match[0],
+            metadata: { scheme: 'rnokpp', country: 'UA' },
+            validator: 'rnokpp-mod11',
+        });
+    },
+});
+//# sourceMappingURL=ua.js.map

package/dist/src/detect/detectors/natid/ua.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ua.js","sourceRoot":"","sources":["../../../../../src/detect/detectors/natid/ua.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG5D,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAErD,gBAAgB,CAAC;IACf,EAAE,EAAE,uBAAuB;IAC3B,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,CAAC,IAAI,CAAC;IACf,OAAO,EAAE,aAAa;IACtB,cAAc,EAAE,UAAU,CAAC,IAAI;IAC/B,WAAW,EAAE,+DAA+D;IAC5E,QAAQ,CAAC,GAAG;QACV,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YAAE,OAAO,OAAO,CAAC,6BAA6B,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACnD,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,6BAA6B,CAAC,CAAC;QAE3F,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC;QAClC,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,cAAc,CAAC,CAAC,CAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;QAC1C,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC;YACX,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YACvB,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;YAC7C,SAAS,EAAE,cAAc;SAC1B,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC"}

package/dist/src/detect/detectors/natid/us.d.ts

@@ -0,0 +1,15 @@
+/**
+ * United States: SSN, ITIN, EIN.
+ *
+ * None of the three carries a checksum, so per SPEC.md the validators are
+ * the published ISSUANCE RULES and confidence stays MEDIUM:
+ *  • SSN — area not 000/666/900–999, group not 00, serial not 0000. Only
+ *    the delimited 3-2-4 writing is matched: a bare nine-digit run is any
+ *    number in the world (and the ABA detector owns the checksummed ones).
+ *    The famous Woolworth wallet-card number 078-05-1120 and the
+ *    advertising range 987-65-432x are detected but non-sensitive.
+ *  • ITIN — SSN shape, area 900–999 with the IRS-assigned group ranges.
+ *  • EIN — XX-XXXXXXX with a real IRS campus/e-file prefix.
+ */
+export {};
+//# sourceMappingURL=us.d.ts.map

package/dist/src/detect/detectors/natid/us.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"us.d.ts","sourceRoot":"","sources":["../../../../../src/detect/detectors/natid/us.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}

package/dist/src/detect/detectors/natid/us.js

@@ -0,0 +1,119 @@
+/**
+ * United States: SSN, ITIN, EIN.
+ *
+ * None of the three carries a checksum, so per SPEC.md the validators are
+ * the published ISSUANCE RULES and confidence stays MEDIUM:
+ *  • SSN — area not 000/666/900–999, group not 00, serial not 0000. Only
+ *    the delimited 3-2-4 writing is matched: a bare nine-digit run is any
+ *    number in the world (and the ABA detector owns the checksummed ones).
+ *    The famous Woolworth wallet-card number 078-05-1120 and the
+ *    advertising range 987-65-432x are detected but non-sensitive.
+ *  • ITIN — SSN shape, area 900–999 with the IRS-assigned group ranges.
+ *  • EIN — XX-XXXXXXX with a real IRS campus/e-file prefix.
+ */
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+const KNOWN_TEST_SSNS = new Set(['078051120', '219099999']);
+function fragmentGuard(ctx) {
+    const before = ctx.start > 0 ? ctx.text[ctx.start - 1] : '';
+    if (/[\d-]/.test(before ?? ''))
+        return 'fragment of a longer number';
+    const after = ctx.text.slice(ctx.end, ctx.end + 2);
+    if (/^\d/.test(after) || /^-\d/.test(after))
+        return 'fragment of a longer number';
+    return null;
+}
+registerDetector({
+    id: 'national-id-us-ssn',
+    entityType: 'NATIONAL_ID',
+    regions: ['US'],
+    pattern: /\b(\d{3})[- ](\d{2})[- ](\d{4})\b/g,
+    baseConfidence: CONFIDENCE.MEDIUM,
+    description: 'US Social Security Numbers (delimited form), issuance rules enforced.',
+    validate(ctx) {
+        const guard = fragmentGuard(ctx);
+        if (guard !== null)
+            return invalid(guard);
+        const area = Number(ctx.match[1]);
+        const group = Number(ctx.match[2]);
+        const serial = Number(ctx.match[3]);
+        const digits = `${ctx.match[1]}${ctx.match[2]}${ctx.match[3]}`;
+        // The famous non-issuable specimens LIVE in the excluded ranges (the
+        // SSA advertising block is area 987), so they are recognized before the
+        // issuance gates — detected, never masked.
+        const advertising = area === 987 && group === 65 && serial >= 4320 && serial <= 4329;
+        if (KNOWN_TEST_SSNS.has(digits) || advertising) {
+            return valid({
+                canonical: digits,
+                sensitive: false,
+                metadata: { scheme: 'ssn', country: 'US' },
+                validator: 'ssn-issuance-rules',
+            });
+        }
+        if (area === 0 || area === 666 || area >= 900)
+            return invalid('invalid area');
+        if (group === 0)
+            return invalid('invalid group');
+        if (serial === 0)
+            return invalid('invalid serial');
+        return valid({
+            canonical: digits,
+            metadata: { scheme: 'ssn', country: 'US' },
+            validator: 'ssn-issuance-rules',
+        });
+    },
+});
+/** IRS-assigned ITIN group ranges (the middle pair). */
+function itinGroupValid(group) {
+    return (group >= 70 && group <= 88) || (group >= 90 && group <= 92) || (group >= 94 && group <= 99);
+}
+registerDetector({
+    id: 'national-id-us-itin',
+    entityType: 'TAX_ID',
+    regions: ['US'],
+    pattern: /\b(9\d{2})[- ](\d{2})[- ](\d{4})\b/g,
+    baseConfidence: CONFIDENCE.MEDIUM,
+    description: 'US ITINs: area 9xx with IRS-assigned group ranges.',
+    validate(ctx) {
+        const guard = fragmentGuard(ctx);
+        if (guard !== null)
+            return invalid(guard);
+        if (!itinGroupValid(Number(ctx.match[2])))
+            return invalid('not an ITIN group range');
+        if (Number(ctx.match[3]) === 0)
+            return invalid('invalid serial');
+        return valid({
+            canonical: `${ctx.match[1]}${ctx.match[2]}${ctx.match[3]}`,
+            metadata: { scheme: 'itin', country: 'US' },
+            validator: 'itin-group-ranges',
+        });
+    },
+});
+/** Valid EIN campus/e-file prefixes. */
+const EIN_PREFIXES = new Set([
+    '01', '02', '03', '04', '05', '06', '10', '11', '12', '13', '14', '15', '16', '20', '21', '22', '23', '24', '25', '26', '27',
+    '30', '31', '32', '33', '34', '35', '36', '37', '38', '39', '40', '41', '42', '43', '44', '45', '46', '47', '48',
+    '50', '51', '52', '53', '54', '55', '56', '57', '58', '59', '60', '61', '62', '63', '64', '65', '66', '67', '68',
+    '71', '72', '73', '74', '75', '76', '77', '80', '81', '82', '83', '84', '85', '86', '87', '88', '90', '91', '92', '93', '94', '95', '98', '99',
+]);
+registerDetector({
+    id: 'national-id-us-ein',
+    entityType: 'TAX_ID',
+    regions: ['US'],
+    pattern: /\b(\d{2})-(\d{7})\b/g,
+    baseConfidence: CONFIDENCE.MEDIUM,
+    description: 'US Employer Identification Numbers with valid IRS prefixes.',
+    validate(ctx) {
+        const guard = fragmentGuard(ctx);
+        if (guard !== null)
+            return invalid(guard);
+        if (!EIN_PREFIXES.has(ctx.match[1]))
+            return invalid('not an IRS prefix');
+        return valid({
+            canonical: `${ctx.match[1]}${ctx.match[2]}`,
+            metadata: { scheme: 'ein', country: 'US' },
+            validator: 'ein-prefix-table',
+        });
+    },
+});
+//# sourceMappingURL=us.js.map

package/dist/src/detect/detectors/natid/us.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"us.js","sourceRoot":"","sources":["../../../../../src/detect/detectors/natid/us.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG5D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAE5D,SAAS,aAAa,CAAC,GAAsB;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QAAE,OAAO,6BAA6B,CAAC;IACrE,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,6BAA6B,CAAC;IAClF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gBAAgB,CAAC;IACf,EAAE,EAAE,oBAAoB;IACxB,UAAU,EAAE,aAAa;IACzB,OAAO,EAAE,CAAC,IAAI,CAAC;IACf,OAAO,EAAE,oCAAoC;IAC7C,cAAc,EAAE,UAAU,CAAC,MAAM;IACjC,WAAW,EAAE,uEAAuE;IACpF,QAAQ,CAAC,GAAG;QACV,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAE/D,qEAAqE;QACrE,wEAAwE;QACxE,2CAA2C;QAC3C,MAAM,WAAW,GAAG,IAAI,KAAK,GAAG,IAAI,KAAK,KAAK,EAAE,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,CAAC;QACrF,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC/C,OAAO,KAAK,CAAC;gBACX,SAAS,EAAE,MAAM;gBACjB,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;gBAC1C,SAAS,EAAE,oBAAoB;aAChC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,IAAI,GAAG;YAAE,OAAO,OAAO,CAAC,cAAc,CAAC,CAAC;QAC9E,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,eAAe,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnD,OAAO,KAAK,CAAC;YACX,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;YAC1C,SAAS,EAAE,oBAAoB;SAChC,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AAEH,wDAAwD;AACxD,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,CAAC,KAAK,IAAI,EAAE,IAAI,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,IAAI,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC;AACtG,CAAC;AAED,gBAAgB,CAAC;IACf,EAAE,EAAE,qBAAqB;IACzB,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,CAAC,IAAI,CAAC;IACf,OAAO,EAAE,qCAAqC;IAC9C,cAAc,EAAE,UAAU,CAAC,MAAM;IACjC,WAAW,EAAE,oDAAoD;IACjE,QAAQ,CAAC,GAAG;QACV,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC,yBAAyB,CAAC,CAAC;QACrF,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC;YACX,SAAS,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YAC1D,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;YAC3C,SAAS,EAAE,mBAAmB;SAC/B,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AAEH,wCAAwC;AACxC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI;IACxG,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI;IAC9F,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI;IAC9F,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI;CACxH,CAAC,CAAC;AAEH,gBAAgB,CAAC;IACf,EAAE,EAAE,oBAAoB;IACxB,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,CAAC,IAAI,CAAC;IACf,OAAO,EAAE,sBAAsB;IAC/B,cAAc,EAAE,UAAU,CAAC,MAAM;IACjC,WAAW,EAAE,6DAA6D;IAC1E,QAAQ,CAAC,GAAG;QACV,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;YAAE,OAAO,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC1E,OAAO,KAAK,CAAC;YACX,SAAS,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YAC3C,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;YAC1C,SAAS,EAAE,kBAAkB;SAC9B,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC"}

package/dist/src/detect/detectors/natid/za.d.ts

@@ -0,0 +1,9 @@
+/**
+ * South Africa: ID number — thirteen digits: YYMMDD SSSS C A Z, validated
+ * as SPEC.md specifies ("Luhn + date validity"): a real calendar date, the
+ * citizenship digit 0/1/2, and Luhn over all thirteen digits. Bijective →
+ * hard mutation property (a date-field mutation may fail either gate;
+ * both are rejections).
+ */
+export {};
+//# sourceMappingURL=za.d.ts.map

package/dist/src/detect/detectors/natid/za.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"za.d.ts","sourceRoot":"","sources":["../../../../../src/detect/detectors/natid/za.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/src/detect/detectors/natid/za.js

@@ -0,0 +1,44 @@
+/**
+ * South Africa: ID number — thirteen digits: YYMMDD SSSS C A Z, validated
+ * as SPEC.md specifies ("Luhn + date validity"): a real calendar date, the
+ * citizenship digit 0/1/2, and Luhn over all thirteen digits. Bijective →
+ * hard mutation property (a date-field mutation may fail either gate;
+ * both are rejections).
+ */
+import { luhnValid } from '../../../checksums/index.js';
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+registerDetector({
+    id: 'national-id-za',
+    entityType: 'NATIONAL_ID',
+    regions: ['ZA'],
+    pattern: /\b(\d{2})(\d{2})(\d{2})(\d{4})(\d)(\d)(\d)\b/g,
+    baseConfidence: CONFIDENCE.HIGH,
+    description: 'South African ID numbers: date validity, citizenship digit, Luhn.',
+    validate(ctx) {
+        const before = ctx.start > 0 ? ctx.text[ctx.start - 1] : '';
+        if (/[\d-]/.test(before ?? ''))
+            return invalid('fragment of a longer number');
+        const after = ctx.text.slice(ctx.end, ctx.end + 2);
+        if (/^\d/.test(after) || /^-\d/.test(after))
+            return invalid('fragment of a longer number');
+        const month = Number(ctx.match[2]);
+        if (month < 1 || month > 12)
+            return invalid('month out of range');
+        const day = Number(ctx.match[3]);
+        if (day < 1 || day > 31)
+            return invalid('day out of range');
+        const citizenship = Number(ctx.match[5]);
+        if (citizenship > 2)
+            return invalid('citizenship digit out of range');
+        const digits = ctx.match[0];
+        if (!luhnValid(digits))
+            return invalid('Luhn checksum failed');
+        return valid({
+            canonical: digits,
+            metadata: { scheme: 'za-id', country: 'ZA', citizen: citizenship === 0 },
+            validator: 'luhn-date',
+        });
+    },
+});
+//# sourceMappingURL=za.js.map

package/dist/src/detect/detectors/natid/za.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"za.js","sourceRoot":"","sources":["../../../../../src/detect/detectors/natid/za.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG5D,gBAAgB,CAAC;IACf,EAAE,EAAE,gBAAgB;IACpB,UAAU,EAAE,aAAa;IACzB,OAAO,EAAE,CAAC,IAAI,CAAC;IACf,OAAO,EAAE,+CAA+C;IACxD,cAAc,EAAE,UAAU,CAAC,IAAI;IAC/B,WAAW,EAAE,mEAAmE;IAChF,QAAQ,CAAC,GAAG;QACV,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YAAE,OAAO,OAAO,CAAC,6BAA6B,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACnD,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,6BAA6B,CAAC,CAAC;QAE3F,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE;YAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,EAAE;YAAE,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,WAAW,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC,gCAAgC,CAAC,CAAC;QAEtE,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAC/D,OAAO,KAAK,CAAC;YACX,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,KAAK,CAAC,EAAE;YACxE,SAAS,EAAE,WAAW;SACvB,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC"}

package/dist/src/detect/detectors/secrets/apiKey.d.ts

@@ -0,0 +1,14 @@
+/**
+ * API_KEY — known-prefix provider tokens, driven by the data-file table.
+ *
+ * SPEC.md wants providers addable "without code changes", so this single
+ * detector reads @discretion/data's SECRET_PROVIDERS. The pattern is the
+ * alternation of every prefix; the validator resolves the longest matching
+ * prefix, checks the body charset and length, and runs the provider's
+ * checksum where one exists (GitHub's base62 CRC32).
+ *
+ * Stripe TEST keys (sk_test_, pk_test_) are handled as a non-sensitive
+ * sibling of the live prefixes: detected so eval sees them, never masked.
+ */
+export {};
+//# sourceMappingURL=apiKey.d.ts.map

package/dist/src/detect/detectors/secrets/apiKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../../../../../src/detect/detectors/secrets/apiKey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}

package/dist/src/detect/detectors/secrets/apiKey.js

@@ -0,0 +1,103 @@
+/**
+ * API_KEY — known-prefix provider tokens, driven by the data-file table.
+ *
+ * SPEC.md wants providers addable "without code changes", so this single
+ * detector reads @discretion/data's SECRET_PROVIDERS. The pattern is the
+ * alternation of every prefix; the validator resolves the longest matching
+ * prefix, checks the body charset and length, and runs the provider's
+ * checksum where one exists (GitHub's base62 CRC32).
+ *
+ * Stripe TEST keys (sk_test_, pk_test_) are handled as a non-sensitive
+ * sibling of the live prefixes: detected so eval sees them, never masked.
+ */
+import { SECRET_PROVIDERS, SECRET_CHARSET_PATTERN } from '@discretion/data';
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, GLOBAL_REGION, invalid, valid } from '../../types.js';
+/** GitHub token CRC32 over the 30-char random body → 6-char base62 check. */
+const BASE62 = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
+function crc32(s) {
+    let crc = 0xffffffff;
+    for (let i = 0; i < s.length; i++) {
+        crc ^= s.charCodeAt(i);
+        for (let b = 0; b < 8; b++) {
+            crc = crc & 1 ? (crc >>> 1) ^ 0xedb88320 : crc >>> 1;
+        }
+    }
+    return (crc ^ 0xffffffff) >>> 0;
+}
+/** GitHub's check: last 6 base62 chars encode crc32 of the preceding body. */
+function githubChecksumValid(body) {
+    if (body.length < 7)
+        return false;
+    const random = body.slice(0, body.length - 6);
+    const check = body.slice(body.length - 6);
+    let value = crc32(random);
+    let encoded = '';
+    for (let i = 0; i < 6; i++) {
+        encoded = BASE62[value % 62] + encoded;
+        value = Math.floor(value / 62);
+    }
+    return encoded === check;
+}
+/** All prefixes, longest first, each paired with its provider. */
+const PREFIX_INDEX = SECRET_PROVIDERS.flatMap((p) => p.prefixes.map((prefix) => [prefix, p])).sort((a, b) => b[0].length - a[0].length);
+/** Stripe test-key prefixes: detected, non-sensitive. */
+const STRIPE_TEST_PREFIXES = ['sk_test_', 'pk_test_', 'rk_test_'];
+function validateApiKey(ctx) {
+    const raw = ctx.match[0];
+    for (const testPrefix of STRIPE_TEST_PREFIXES) {
+        if (raw.startsWith(testPrefix)) {
+            return valid({
+                canonical: raw,
+                sensitive: false,
+                metadata: { provider: 'stripe', test: true },
+                validator: 'provider-prefix',
+            });
+        }
+    }
+    for (const [prefix, provider] of PREFIX_INDEX) {
+        if (!raw.startsWith(prefix))
+            continue;
+        const body = raw.slice(prefix.length);
+        const [min, max] = provider.bodyLength;
+        if (body.length < min || body.length > max)
+            return invalid('body length outside provider window');
+        if (!SECRET_CHARSET_PATTERN[provider.bodyCharset].test(body.replace(/[.]/g, ''))) {
+            return invalid('body charset mismatch');
+        }
+        if (provider.checksum === 'github' && !githubChecksumValid(body)) {
+            return invalid('GitHub token checksum failed');
+        }
+        return valid({
+            canonical: raw,
+            metadata: { provider: provider.id, ...(provider.checksum !== undefined ? { checksum: provider.checksum } : {}) },
+            validator: provider.checksum !== undefined ? `${provider.id}-checksum` : 'provider-prefix',
+        });
+    }
+    return invalid('no known provider prefix');
+}
+/** Build one alternation of every prefix, longest first, regex-escaped. */
+const PREFIX_ALTERNATION = PREFIX_INDEX.map(([prefix]) => prefix.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))
+    .concat(STRIPE_TEST_PREFIXES)
+    .join('|');
+registerDetector({
+    id: 'api-key',
+    entityType: 'API_KEY',
+    regions: [GLOBAL_REGION],
+    // The body charset must include `.` - plenty of provider tokens contain one
+    // - but the match may not END with one, or a key at the end of a sentence
+    // swallows the full stop. Found at M12 while running a README example:
+    // `sk_live_...tY6.` matched WITH the period, so the masked text lost the
+    // punctuation and, worse, the vault keyed on a value that differs from the
+    // same key written mid-sentence - which quietly breaks the guarantee that a
+    // value seen twice gets the same surrogate.
+    //
+    // Only `.` is excluded. Trailing `-` and `_` are also unlikely to be part of
+    // a real token, but they were not what this found, and tightening them here
+    // would be an unmeasured change riding on a measured one.
+    pattern: new RegExp(`(?:${PREFIX_ALTERNATION})[A-Za-z0-9._-]{9,129}[A-Za-z0-9_-]`, 'g'),
+    baseConfidence: CONFIDENCE.HIGH,
+    description: 'Provider API tokens from the bundled prefix table; GitHub checksums verified.',
+    validate: validateApiKey,
+});
+//# sourceMappingURL=apiKey.js.map

package/dist/src/detect/detectors/secrets/apiKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKey.js","sourceRoot":"","sources":["../../../../../src/detect/detectors/secrets/apiKey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG3E,6EAA6E;AAC7E,MAAM,MAAM,GAAG,gEAAgE,CAAC;AAEhF,SAAS,KAAK,CAAC,CAAS;IACtB,IAAI,GAAG,GAAG,UAAU,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,8EAA8E;AAC9E,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1C,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,OAAO,GAAG,MAAM,CAAC,KAAK,GAAG,EAAE,CAAE,GAAG,OAAO,CAAC;QACxC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,OAAO,KAAK,KAAK,CAAC;AAC3B,CAAC;AAED,kEAAkE;AAClE,MAAM,YAAY,GAAmD,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAClG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAU,CAAC,CACjD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5C,yDAAyD;AACzD,MAAM,oBAAoB,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AAElE,SAAS,cAAc,CAAC,GAAsB;IAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEzB,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE,CAAC;QAC9C,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;gBACX,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE;gBAC5C,SAAS,EAAE,iBAAiB;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC;QAC9C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC;QACvC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,OAAO,CAAC,qCAAqC,CAAC,CAAC;QAClG,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;YACjF,OAAO,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,OAAO,OAAO,CAAC,8BAA8B,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,KAAK,CAAC;YACX,SAAS,EAAE,GAAG;YACd,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAChH,SAAS,EAAE,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,iBAAiB;SAC3F,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAC7C,CAAC;AAED,2EAA2E;AAC3E,MAAM,kBAAkB,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;KACrG,MAAM,CAAC,oBAAoB,CAAC;KAC5B,IAAI,CAAC,GAAG,CAAC,CAAC;AAEb,gBAAgB,CAAC;IACf,EAAE,EAAE,SAAS;IACb,UAAU,EAAE,SAAS;IACrB,OAAO,EAAE,CAAC,aAAa,CAAC;IACxB,4EAA4E;IAC5E,0EAA0E;IAC1E,uEAAuE;IACvE,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,4CAA4C;IAC5C,EAAE;IACF,6EAA6E;IAC7E,4EAA4E;IAC5E,0DAA0D;IAC1D,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,kBAAkB,qCAAqC,EAAE,GAAG,CAAC;IACvF,cAAc,EAAE,UAAU,CAAC,IAAI;IAC/B,WAAW,EAAE,+EAA+E;IAC5F,QAAQ,EAAE,cAAc;CACzB,CAAC,CAAC"}

package/dist/src/detect/detectors/secrets/connectionString.d.ts

@@ -0,0 +1,12 @@
+/**
+ * CONNECTION_STRING — database URIs with embedded credentials.
+ *
+ * SPEC.md: "database URIs with embedded credentials." The signal is a
+ * database scheme plus a password in the userinfo. A scheme with only a
+ * username (or none) is a connection string but not a SECRET — it leaks no
+ * credential — so it is not emitted here; a bare host:port DSN is likewise
+ * out of scope for a credential detector. The whole URI is the span, for the
+ * same reason as URL_WITH_CREDENTIALS: a partial mask still leaks the host.
+ */
+export {};
+//# sourceMappingURL=connectionString.d.ts.map

package/dist/src/detect/detectors/secrets/connectionString.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectionString.d.ts","sourceRoot":"","sources":["../../../../../src/detect/detectors/secrets/connectionString.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/src/detect/detectors/secrets/connectionString.js

@@ -0,0 +1,70 @@
+/**
+ * CONNECTION_STRING — database URIs with embedded credentials.
+ *
+ * SPEC.md: "database URIs with embedded credentials." The signal is a
+ * database scheme plus a password in the userinfo. A scheme with only a
+ * username (or none) is a connection string but not a SECRET — it leaks no
+ * credential — so it is not emitted here; a bare host:port DSN is likewise
+ * out of scope for a credential detector. The whole URI is the span, for the
+ * same reason as URL_WITH_CREDENTIALS: a partial mask still leaks the host.
+ */
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, GLOBAL_REGION, invalid, valid } from '../../types.js';
+const DB_SCHEMES = new Set([
+    'postgres', 'postgresql', 'mysql', 'mariadb', 'mongodb', 'mongodb+srv',
+    'redis', 'rediss', 'amqp', 'amqps', 'mssql', 'sqlserver', 'jdbc',
+    'cassandra', 'couchbase', 'clickhouse', 'cockroachdb', 'db2', 'oracle',
+]);
+function isPlaceholder(value) {
+    if (/^\$\{[^}]*\}$/.test(value) || /^\{\{[^}]*\}\}$/.test(value) || /^<[^>]*>$/.test(value))
+        return true;
+    if (/^(?:x+|\*+|password|passwd|pass|changeme|placeholder)$/i.test(value))
+        return true;
+    if (/^YOUR[_-]/i.test(value))
+        return true;
+    return false;
+}
+function validateConnectionString(ctx) {
+    const raw = ctx.match[0];
+    const schemeEnd = raw.indexOf('://');
+    if (schemeEnd < 0)
+        return invalid('no scheme');
+    const scheme = raw.slice(0, schemeEnd).toLowerCase();
+    if (!DB_SCHEMES.has(scheme))
+        return invalid('not a database scheme');
+    const rest = raw.slice(schemeEnd + 3);
+    const authorityEnd = rest.search(/[/?#]/);
+    const authority = authorityEnd < 0 ? rest : rest.slice(0, authorityEnd);
+    const at = authority.lastIndexOf('@');
+    if (at <= 0)
+        return invalid('no userinfo credential');
+    const userinfo = authority.slice(0, at);
+    const colon = userinfo.indexOf(':');
+    if (colon <= 0 || colon === userinfo.length - 1)
+        return invalid('userinfo carries no password');
+    const password = userinfo.slice(colon + 1);
+    const host = authority.slice(at + 1);
+    const placeholder = isPlaceholder(password);
+    return valid({
+        canonical: raw,
+        sensitive: !placeholder,
+        metadata: { scheme, host },
+        validator: 'connection-string',
+    });
+}
+registerDetector({
+    id: 'connection-string',
+    entityType: 'CONNECTION_STRING',
+    regions: [GLOBAL_REGION],
+    // Commas and pipes terminate the URI, for the reason recorded on the
+    // credentialled-URL detector: in CSV rows and pipe-delimited logs they are
+    // field boundaries, and an over-long span makes masking overwrite the
+    // user's adjacent cells. `;` is deliberately NOT excluded — a JDBC
+    // connection string carries its properties after one, and cutting there
+    // would truncate the credential this detector exists to find.
+    pattern: /\b[a-zA-Z][a-zA-Z0-9+]*:\/\/[^\s"'<>,|]*:[^\s"'<>,|@]*@[^\s"'<>,|]{2,300}/g,
+    baseConfidence: CONFIDENCE.HIGH,
+    description: 'Database connection URIs carrying a password in userinfo; whole-URI span.',
+    validate: validateConnectionString,
+});
+//# sourceMappingURL=connectionString.js.map

package/dist/src/detect/detectors/secrets/connectionString.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectionString.js","sourceRoot":"","sources":["../../../../../src/detect/detectors/secrets/connectionString.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG3E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa;IACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM;IAChE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ;CACvE,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzG,IAAI,yDAAyD,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvF,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAsB;IACtD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAErE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACxE,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAEhG,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAE5C,OAAO,KAAK,CAAC;QACX,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,CAAC,WAAW;QACvB,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QAC1B,SAAS,EAAE,mBAAmB;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,gBAAgB,CAAC;IACf,EAAE,EAAE,mBAAmB;IACvB,UAAU,EAAE,mBAAmB;IAC/B,OAAO,EAAE,CAAC,aAAa,CAAC;IACxB,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,mEAAmE;IACnE,wEAAwE;IACxE,8DAA8D;IAC9D,OAAO,EAAE,4EAA4E;IACrF,cAAc,EAAE,UAAU,CAAC,IAAI;IAC/B,WAAW,EAAE,2EAA2E;IACxF,QAAQ,EAAE,wBAAwB;CACnC,CAAC,CAAC"}

package/dist/src/detect/detectors/secrets/genericSecret.d.ts

@@ -0,0 +1,22 @@
+/**
+ * GENERIC_SECRET — high-entropy strings.
+ *
+ * SPEC.md is emphatic and specific: "Require a Shannon entropy threshold AND
+ * an assignment-context signal (see Stage 3) so that 'your-api-key-here',
+ * 'xxxxxxxxxxxx', UUIDs, git SHAs, and base64 image data do not trigger."
+ *
+ * Stage 3 does not exist in M2. So this detector is built in its FINAL shape
+ * but declares `requiresContext: true`, which the runner honours by capping
+ * it at CONFIDENCE.LOW until a context signal is supplied. It therefore
+ * never "fires on entropy alone" — the structural guarantee SPEC.md wants.
+ * The entropy computation and the known-non-secret suppressions are fully
+ * implemented and tested now; only the confidence ceiling is deferred.
+ *
+ * The threshold below is provisional. SPEC.md requires it be "tuned
+ * empirically against the eval corpus" with the precision/recall curve
+ * documented — that is M3 work. Until then it is deliberately conservative
+ * (high), because at LOW confidence a miss is cheap and a false positive is
+ * the thing SPEC.md warns hardest against.
+ */
+export {};
+//# sourceMappingURL=genericSecret.d.ts.map

package/dist/src/detect/detectors/secrets/genericSecret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"genericSecret.d.ts","sourceRoot":"","sources":["../../../../../src/detect/detectors/secrets/genericSecret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG"}