@discretion/core 0.1.0

package/dist/src/detect/detectors/secrets/genericSecret.js

@@ -0,0 +1,77 @@
+/**
+ * GENERIC_SECRET — high-entropy strings.
+ *
+ * SPEC.md is emphatic and specific: "Require a Shannon entropy threshold AND
+ * an assignment-context signal (see Stage 3) so that 'your-api-key-here',
+ * 'xxxxxxxxxxxx', UUIDs, git SHAs, and base64 image data do not trigger."
+ *
+ * Stage 3 does not exist in M2. So this detector is built in its FINAL shape
+ * but declares `requiresContext: true`, which the runner honours by capping
+ * it at CONFIDENCE.LOW until a context signal is supplied. It therefore
+ * never "fires on entropy alone" — the structural guarantee SPEC.md wants.
+ * The entropy computation and the known-non-secret suppressions are fully
+ * implemented and tested now; only the confidence ceiling is deferred.
+ *
+ * The threshold below is provisional. SPEC.md requires it be "tuned
+ * empirically against the eval corpus" with the precision/recall curve
+ * documented — that is M3 work. Until then it is deliberately conservative
+ * (high), because at LOW confidence a miss is cheap and a false positive is
+ * the thing SPEC.md warns hardest against.
+ */
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, GLOBAL_REGION, invalid, valid } from '../../types.js';
+import { shannonEntropy, distinctChars, isKnownNonSecret } from '../../entropy.js';
+/**
+ * Provisional per-character entropy floor, in bits. A random base62 string
+ * approaches log2(62) ≈ 5.95; english prose sits near 3–4. 3.5 admits
+ * plausible keys while excluding words. Retuned against the corpus in M3.
+ */
+const ENTROPY_FLOOR = 3.5;
+/** A secret needs both length and character diversity, not just one. */
+const MIN_LENGTH = 20;
+const MIN_DISTINCT = 12;
+function validateGenericSecret(ctx) {
+    const value = ctx.match[0];
+    if (value.length < MIN_LENGTH)
+        return invalid('too short');
+    if (isKnownNonSecret(value))
+        return invalid('known non-secret shape');
+    if (distinctChars(value) < MIN_DISTINCT)
+        return invalid('too few distinct characters');
+    const entropy = shannonEntropy(value);
+    if (entropy < ENTROPY_FLOOR)
+        return invalid('entropy below threshold');
+    // A run of a single character class that is all letters is far more likely
+    // an identifier or a word-ish token than a key; require mixed classes.
+    const classes = [/[a-z]/, /[A-Z]/, /[0-9]/, /[^A-Za-z0-9]/].filter((re) => re.test(value)).length;
+    if (classes < 2)
+        return invalid('single character class');
+    // Return the natural confidence (baseConfidence, MEDIUM) and let the runner
+    // apply the requiresContext cap: no Stage 3 signal → capped at LOW, a signal
+    // present → allowed up to base. Hardcoding LOW here would defeat the cap by
+    // pinning it even when context arrives, which the test below pins.
+    return valid({
+        // No canonicalization: a secret is matched verbatim.
+        metadata: {
+            entropyBitsPerChar: Number(entropy.toFixed(3)),
+            distinct: distinctChars(value),
+            // Flags for Stage 3 fusion to combine with an assignment signal.
+            awaitingContext: true,
+        },
+        validator: 'shannon-entropy',
+    });
+}
+registerDetector({
+    id: 'generic-secret',
+    entityType: 'GENERIC_SECRET',
+    regions: [GLOBAL_REGION],
+    // Long token-shaped runs: letters, digits, and the punctuation common in
+    // keys. Deliberately broad; the validator and the context requirement do
+    // the discriminating.
+    pattern: /\b[A-Za-z0-9+/_=-]{20,120}\b/g,
+    baseConfidence: CONFIDENCE.MEDIUM,
+    requiresContext: true,
+    description: 'High-entropy secrets: entropy gate now, Stage 3 assignment context required for confidence.',
+    validate: validateGenericSecret,
+});
+//# sourceMappingURL=genericSecret.js.map

package/dist/src/detect/detectors/secrets/genericSecret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"genericSecret.js","sourceRoot":"","sources":["../../../../../src/detect/detectors/secrets/genericSecret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAE3E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEnF;;;;GAIG;AACH,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,wEAAwE;AACxE,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,SAAS,qBAAqB,CAAC,GAAsB;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE3B,IAAI,KAAK,CAAC,MAAM,GAAG,UAAU;QAAE,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3D,IAAI,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACtE,IAAI,aAAa,CAAC,KAAK,CAAC,GAAG,YAAY;QAAE,OAAO,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAEvF,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,GAAG,aAAa;QAAE,OAAO,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEvE,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAClG,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAE1D,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,mEAAmE;IACnE,OAAO,KAAK,CAAC;QACX,qDAAqD;QACrD,QAAQ,EAAE;YACR,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC9C,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC;YAC9B,iEAAiE;YACjE,eAAe,EAAE,IAAI;SACtB;QACD,SAAS,EAAE,iBAAiB;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,gBAAgB,CAAC;IACf,EAAE,EAAE,gBAAgB;IACpB,UAAU,EAAE,gBAAgB;IAC5B,OAAO,EAAE,CAAC,aAAa,CAAC;IACxB,yEAAyE;IACzE,yEAAyE;IACzE,sBAAsB;IACtB,OAAO,EAAE,+BAA+B;IACxC,cAAc,EAAE,UAAU,CAAC,MAAM;IACjC,eAAe,EAAE,IAAI;IACrB,WAAW,EAAE,6FAA6F;IAC1G,QAAQ,EAAE,qBAAqB;CAChC,CAAC,CAAC"}

package/dist/src/detect/detectors/secrets/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Secrets & credentials family. Side-effect imports only.
+ */
+import './apiKey.js';
+import './jwt.js';
+import './pemPrivateKey.js';
+import './connectionString.js';
+import './genericSecret.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/detect/detectors/secrets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/detect/detectors/secrets/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,aAAa,CAAC;AACrB,OAAO,UAAU,CAAC;AAClB,OAAO,oBAAoB,CAAC;AAC5B,OAAO,uBAAuB,CAAC;AAC/B,OAAO,oBAAoB,CAAC"}

package/dist/src/detect/detectors/secrets/index.js

@@ -0,0 +1,9 @@
+/**
+ * Secrets & credentials family. Side-effect imports only.
+ */
+import './apiKey.js';
+import './jwt.js';
+import './pemPrivateKey.js';
+import './connectionString.js';
+import './genericSecret.js';
+//# sourceMappingURL=index.js.map

package/dist/src/detect/detectors/secrets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/detect/detectors/secrets/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,aAAa,CAAC;AACrB,OAAO,UAAU,CAAC;AAClB,OAAO,oBAAoB,CAAC;AAC5B,OAAO,uBAAuB,CAAC;AAC/B,OAAO,oBAAoB,CAAC"}

package/dist/src/detect/detectors/secrets/jwt.d.ts

@@ -0,0 +1,11 @@
+/**
+ * JWT — structural validation.
+ *
+ * SPEC.md: "three base64url segments, header decodes to valid JSON with an
+ * alg field." That is exactly the bar: a JWT's signature cannot be verified
+ * without its key, so structure is all there is — but a well-formed header
+ * with a real `alg` is a strong and specific signal. base64url is decoded
+ * by hand (atob is a DOM global, banned in core).
+ */
+export {};
+//# sourceMappingURL=jwt.d.ts.map

package/dist/src/detect/detectors/secrets/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../../../src/detect/detectors/secrets/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/src/detect/detectors/secrets/jwt.js

@@ -0,0 +1,111 @@
+/**
+ * JWT — structural validation.
+ *
+ * SPEC.md: "three base64url segments, header decodes to valid JSON with an
+ * alg field." That is exactly the bar: a JWT's signature cannot be verified
+ * without its key, so structure is all there is — but a well-formed header
+ * with a real `alg` is a strong and specific signal. base64url is decoded
+ * by hand (atob is a DOM global, banned in core).
+ */
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, GLOBAL_REGION, invalid, valid } from '../../types.js';
+/** Registered JWS algorithms plus 'none'; a header alg must be one of these. */
+const JWT_ALGS = new Set([
+    'none',
+    'HS256', 'HS384', 'HS512',
+    'RS256', 'RS384', 'RS512',
+    'ES256', 'ES256K', 'ES384', 'ES512',
+    'PS256', 'PS384', 'PS512',
+    'EdDSA',
+]);
+function base64urlDecode(segment) {
+    if (!/^[A-Za-z0-9_-]+$/.test(segment))
+        return null;
+    const b64 = segment.replace(/-/g, '+').replace(/_/g, '/');
+    const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+    let bits = 0;
+    let acc = 0;
+    const bytes = [];
+    for (const ch of b64) {
+        const v = chars.indexOf(ch);
+        if (v < 0)
+            return null;
+        acc = (acc << 6) | v;
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            bytes.push((acc >> bits) & 0xff);
+        }
+    }
+    // Decode UTF-8 bytes to a string.
+    try {
+        let out = '';
+        let i = 0;
+        while (i < bytes.length) {
+            const b0 = bytes[i];
+            if (b0 < 0x80) {
+                out += String.fromCharCode(b0);
+                i += 1;
+            }
+            else if (b0 < 0xe0) {
+                out += String.fromCharCode(((b0 & 0x1f) << 6) | (bytes[i + 1] & 0x3f));
+                i += 2;
+            }
+            else if (b0 < 0xf0) {
+                out += String.fromCharCode(((b0 & 0x0f) << 12) | ((bytes[i + 1] & 0x3f) << 6) | (bytes[i + 2] & 0x3f));
+                i += 3;
+            }
+            else {
+                const cp = ((b0 & 0x07) << 18) | ((bytes[i + 1] & 0x3f) << 12) | ((bytes[i + 2] & 0x3f) << 6) | (bytes[i + 3] & 0x3f);
+                out += String.fromCodePoint(cp);
+                i += 4;
+            }
+        }
+        return out;
+    }
+    catch {
+        return null;
+    }
+}
+function validateJwt(ctx) {
+    const parts = ctx.match[0].split('.');
+    if (parts.length !== 3)
+        return invalid('not three segments');
+    const [headerSeg, payloadSeg, signatureSeg] = parts;
+    if (signatureSeg.length === 0)
+        return invalid('empty signature segment');
+    const headerJson = base64urlDecode(headerSeg);
+    if (headerJson === null)
+        return invalid('header is not base64url');
+    let header;
+    try {
+        header = JSON.parse(headerJson);
+    }
+    catch {
+        return invalid('header is not JSON');
+    }
+    if (typeof header !== 'object' || header === null)
+        return invalid('header is not a JSON object');
+    const alg = header['alg'];
+    if (typeof alg !== 'string' || !JWT_ALGS.has(alg))
+        return invalid('header has no valid alg');
+    // The payload must at least decode as base64url; it need not be JSON
+    // (though it usually is) — some tokens carry non-JSON claims sets.
+    if (base64urlDecode(payloadSeg) === null)
+        return invalid('payload is not base64url');
+    return valid({
+        canonical: ctx.match[0],
+        metadata: { alg },
+        validator: 'jwt-structural',
+    });
+}
+registerDetector({
+    id: 'jwt',
+    entityType: 'JWT',
+    regions: [GLOBAL_REGION],
+    pattern: /\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]{2,}\b/g,
+    baseConfidence: CONFIDENCE.HIGH,
+    description: 'JSON Web Tokens: three base64url segments, header JSON carrying a valid alg.',
+    validate: validateJwt,
+});
+//# sourceMappingURL=jwt.js.map

package/dist/src/detect/detectors/secrets/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../../../src/detect/detectors/secrets/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG3E,gFAAgF;AAChF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,MAAM;IACN,OAAO,EAAE,OAAO,EAAE,OAAO;IACzB,OAAO,EAAE,OAAO,EAAE,OAAO;IACzB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO;IACnC,OAAO,EAAE,OAAO,EAAE,OAAO;IACzB,OAAO;CACR,CAAC,CAAC;AAEH,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,kEAAkE,CAAC;IACjF,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACvB,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,kCAAkC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YACxB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACrB,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;gBAAC,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;iBACrD,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;gBAAC,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,CAAC,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;iBACnG,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;gBAAC,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,CAAC,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;iBACpI,CAAC;gBACJ,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,CAAC;gBACzH,GAAG,IAAI,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;gBAChC,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAsB;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC7D,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAiC,CAAC;IAChF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEzE,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEnE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACjG,MAAM,GAAG,GAAI,MAAkC,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAE7F,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,eAAe,CAAC,UAAU,CAAC,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAErF,OAAO,KAAK,CAAC;QACX,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACvB,QAAQ,EAAE,EAAE,GAAG,EAAE;QACjB,SAAS,EAAE,gBAAgB;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,gBAAgB,CAAC;IACf,EAAE,EAAE,KAAK;IACT,UAAU,EAAE,KAAK;IACjB,OAAO,EAAE,CAAC,aAAa,CAAC;IACxB,OAAO,EAAE,iEAAiE;IAC1E,cAAc,EAAE,UAAU,CAAC,IAAI;IAC/B,WAAW,EAAE,8EAA8E;IAC3F,QAAQ,EAAE,WAAW;CACtB,CAAC,CAAC"}

package/dist/src/detect/detectors/secrets/pemPrivateKey.d.ts

@@ -0,0 +1,16 @@
+/**
+ * PRIVATE_KEY — PEM private-key blocks.
+ *
+ * A whole armored block, header through footer, is matched and the span
+ * covers all of it: a private key with its header stripped is still a
+ * private key, and substitution must replace the entire block. The type is
+ * PRIVATE_KEY (its own EntityType, split from API_KEY in ARCHITECTURE.md D4)
+ * because a leaked private key's blast radius and its surrogate differ from
+ * a token's. Confidence is MAXIMUM: a well-formed PEM private-key block is
+ * essentially never a false positive.
+ *
+ * PUBLIC-key blocks and CERTIFICATE blocks are deliberately excluded — they
+ * are not secret.
+ */
+export {};
+//# sourceMappingURL=pemPrivateKey.d.ts.map

package/dist/src/detect/detectors/secrets/pemPrivateKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pemPrivateKey.d.ts","sourceRoot":"","sources":["../../../../../src/detect/detectors/secrets/pemPrivateKey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}

package/dist/src/detect/detectors/secrets/pemPrivateKey.js

@@ -0,0 +1,56 @@
+/**
+ * PRIVATE_KEY — PEM private-key blocks.
+ *
+ * A whole armored block, header through footer, is matched and the span
+ * covers all of it: a private key with its header stripped is still a
+ * private key, and substitution must replace the entire block. The type is
+ * PRIVATE_KEY (its own EntityType, split from API_KEY in ARCHITECTURE.md D4)
+ * because a leaked private key's blast radius and its surrogate differ from
+ * a token's. Confidence is MAXIMUM: a well-formed PEM private-key block is
+ * essentially never a false positive.
+ *
+ * PUBLIC-key blocks and CERTIFICATE blocks are deliberately excluded — they
+ * are not secret.
+ */
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, GLOBAL_REGION, invalid, valid } from '../../types.js';
+const KEY_LABELS = [
+    'PRIVATE KEY',
+    'RSA PRIVATE KEY',
+    'EC PRIVATE KEY',
+    'DSA PRIVATE KEY',
+    'OPENSSH PRIVATE KEY',
+    'PGP PRIVATE KEY BLOCK',
+    'ENCRYPTED PRIVATE KEY',
+];
+function validatePem(ctx) {
+    const label = ctx.match[1];
+    const footerLabel = ctx.match[3];
+    if (label === undefined || !KEY_LABELS.includes(label))
+        return invalid('not a private-key label');
+    if (label !== footerLabel)
+        return invalid('header and footer labels differ');
+    const body = ctx.match[2] ?? '';
+    // The body between the armor lines must contain real base64 content, not
+    // just whitespace — an empty pair of armor lines is a template, not a key.
+    if (!/[A-Za-z0-9+/]{16,}/.test(body))
+        return invalid('no key material between armor lines');
+    return valid({
+        canonical: ctx.match[0].trim(),
+        confidence: CONFIDENCE.MAXIMUM,
+        metadata: { keyType: label },
+        validator: 'pem-armor',
+    });
+}
+registerDetector({
+    id: 'pem-private-key',
+    entityType: 'PRIVATE_KEY',
+    regions: [GLOBAL_REGION],
+    // Header, body, footer. [\s\S] so the body can cross newlines; the label
+    // is captured twice so the validator can require they match.
+    pattern: /-----BEGIN ([A-Z0-9 ]+?)-----([\s\S]*?)-----END ([A-Z0-9 ]+?)-----/g,
+    baseConfidence: CONFIDENCE.MAXIMUM,
+    description: 'PEM private-key blocks (RSA/EC/DSA/OpenSSH/PGP/PKCS8), whole-block span.',
+    validate: validatePem,
+});
+//# sourceMappingURL=pemPrivateKey.js.map

package/dist/src/detect/detectors/secrets/pemPrivateKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pemPrivateKey.js","sourceRoot":"","sources":["../../../../../src/detect/detectors/secrets/pemPrivateKey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG3E,MAAM,UAAU,GAAG;IACjB,aAAa;IACb,iBAAiB;IACjB,gBAAgB;IAChB,iBAAiB;IACjB,qBAAqB;IACrB,uBAAuB;IACvB,uBAAuB;CACxB,CAAC;AAEF,SAAS,WAAW,CAAC,GAAsB;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAClG,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAE7E,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,yEAAyE;IACzE,2EAA2E;IAC3E,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,qCAAqC,CAAC,CAAC;IAE5F,OAAO,KAAK,CAAC;QACX,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC9B,UAAU,EAAE,UAAU,CAAC,OAAO;QAC9B,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC5B,SAAS,EAAE,WAAW;KACvB,CAAC,CAAC;AACL,CAAC;AAED,gBAAgB,CAAC;IACf,EAAE,EAAE,iBAAiB;IACrB,UAAU,EAAE,aAAa;IACzB,OAAO,EAAE,CAAC,aAAa,CAAC;IACxB,yEAAyE;IACzE,6DAA6D;IAC7D,OAAO,EAAE,qEAAqE;IAC9E,cAAc,EAAE,UAAU,CAAC,OAAO;IAClC,WAAW,EAAE,0EAA0E;IACvF,QAAQ,EAAE,WAAW;CACtB,CAAC,CAAC"}

package/dist/src/detect/detectors/vat/euVat.d.ts

@@ -0,0 +1,17 @@
+/**
+ * VAT_NUMBER — EU VAT identification numbers, all 27 member states.
+ *
+ * SPEC.md: "EU VAT numbers — per-country structure and checksum for all
+ * member states." A VAT number is quoted WITH its country prefix (Greece
+ * uses EL, not GR), which is what makes a single detector precise: the
+ * prefix selects the national rule, and every country that publishes a
+ * checksum has it verified here — many reusing the shared library (DE and
+ * HR are ISO 7064 MOD 11,10; EL is the AFM power-of-two rule; IT and SE
+ * close with Luhn; PL is the NIP weights; PT the NIF weights; IE the
+ * PPS-style mod-23 letter). Countries whose personal-number fallbacks are
+ * weaker (CZ 9-digit) accept those structurally, marked in metadata.
+ *
+ * Adding a member state (or successor scheme) is one entry in RULES.
+ */
+export {};
+//# sourceMappingURL=euVat.d.ts.map

package/dist/src/detect/detectors/vat/euVat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"euVat.d.ts","sourceRoot":"","sources":["../../../../../src/detect/detectors/vat/euVat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/src/detect/detectors/vat/euVat.js

@@ -0,0 +1,293 @@
+/**
+ * VAT_NUMBER — EU VAT identification numbers, all 27 member states.
+ *
+ * SPEC.md: "EU VAT numbers — per-country structure and checksum for all
+ * member states." A VAT number is quoted WITH its country prefix (Greece
+ * uses EL, not GR), which is what makes a single detector precise: the
+ * prefix selects the national rule, and every country that publishes a
+ * checksum has it verified here — many reusing the shared library (DE and
+ * HR are ISO 7064 MOD 11,10; EL is the AFM power-of-two rule; IT and SE
+ * close with Luhn; PL is the NIP weights; PT the NIF weights; IE the
+ * PPS-style mod-23 letter). Countries whose personal-number fallbacks are
+ * weaker (CZ 9-digit) accept those structurally, marked in metadata.
+ *
+ * Adding a member state (or successor scheme) is one entry in RULES.
+ */
+import { toDigits, isAllDigits, weightedSum, weightedMod, weightedModBy, cyclicWeightedMod, luhnValid, mod11_10Valid, modString, } from '../../../checksums/index.js';
+import { registerDetector } from '../../registry.js';
+import { CONFIDENCE, invalid, valid } from '../../types.js';
+const DNI_LETTERS = 'TRWAGMYFPDXBNJZSQVHLCKE';
+const MOD23 = 'WABCDEFGHIJKLMNOPQRSTUV';
+/** Spanish NIF/NIE/CIF check, shared by the ES entry. */
+function esVatValid(body) {
+    if (/^\d{8}[A-Z]$/.test(body)) {
+        return body[8] === DNI_LETTERS[Number(body.slice(0, 8)) % 23];
+    }
+    if (/^[XYZ]\d{7}[A-Z]$/.test(body)) {
+        const prefix = { X: '0', Y: '1', Z: '2' }[body[0]];
+        return body[8] === DNI_LETTERS[Number(`${prefix}${body.slice(1, 8)}`) % 23];
+    }
+    if (/^[A-HJ-NP-SUVW]\d{7}[0-9A-J]$/.test(body)) {
+        let sum = 0;
+        for (let i = 1; i <= 7; i++) {
+            let v = Number(body[i]);
+            if (i % 2 === 1) {
+                v *= 2;
+                if (v > 9)
+                    v -= 9;
+            }
+            sum += v;
+        }
+        const value = (10 - (sum % 10)) % 10;
+        return body[8] === String(value) || body[8] === 'JABCDEFGHI'[value];
+    }
+    return false;
+}
+const RULES = {
+    AT: (b) => {
+        // 'U' + 8 digits; c = (10 − (s + 4) mod 10) mod 10 with alternating
+        // 1,2 weights and digit-sum folding. Verified against ATU13585627.
+        if (!/^U\d{8}$/.test(b))
+            return false;
+        const d = toDigits(b.slice(1));
+        let s = 0;
+        for (let i = 0; i < 7; i++) {
+            const product = d[i] * (i % 2 === 0 ? 1 : 2);
+            s += product > 9 ? product - 9 : product;
+        }
+        return (10 - ((s + 4) % 10)) % 10 === d[7];
+    },
+    BE: (b) => {
+        if (!/^[01]\d{9}$/.test(b))
+            return false;
+        return Number(b.slice(8)) === 97 - (Number(b.slice(0, 8)) % 97);
+    },
+    BG: (b) => {
+        if (/^\d{9}$/.test(b)) {
+            const d = toDigits(b);
+            let r = weightedModBy(d.slice(0, 8), (i) => i + 1, 11);
+            if (r === 10) {
+                r = weightedModBy(d.slice(0, 8), (i) => i + 3, 11);
+                if (r === 10)
+                    r = 0;
+            }
+            return r === d[8];
+        }
+        if (/^\d{10}$/.test(b)) {
+            const d = toDigits(b);
+            // Personal numbers: the PNF weight vector closes most; EGN-style
+            // numbers are also legal — accept either closing rule.
+            const pnf = weightedMod(d.slice(0, 9), [21, 19, 17, 13, 11, 9, 7, 3, 1], 10);
+            if (pnf === d[9])
+                return true;
+            let egn = weightedMod(d.slice(0, 9), [2, 4, 8, 5, 10, 9, 7, 3, 6], 11);
+            if (egn === 10)
+                egn = 0;
+            return egn === d[9];
+        }
+        return false;
+    },
+    CY: (b) => {
+        if (!/^\d{8}[A-Z]$/.test(b))
+            return false;
+        const TRANSFORM = [1, 0, 5, 7, 9, 13, 15, 17, 19, 21];
+        let sum = 0;
+        for (let i = 0; i < 8; i++) {
+            const d = Number(b[i]);
+            sum += i % 2 === 0 ? TRANSFORM[d] : d;
+        }
+        return b[8] === String.fromCharCode(65 + (sum % 26));
+    },
+    CZ: (b) => {
+        if (/^\d{8}$/.test(b)) {
+            const d = toDigits(b);
+            const r = weightedModBy(d.slice(0, 7), (i) => 8 - i, 11);
+            const c = r === 0 ? 1 : r === 1 ? 0 : 11 - r;
+            return c === d[7];
+        }
+        if (/^\d{10}$/.test(b))
+            return Number(b) % 11 === 0; // rodné číslo form
+        if (/^\d{9}$/.test(b))
+            return 'structural'; // pre-1954 personal, no check
+        return false;
+    },
+    DE: (b) => /^\d{9}$/.test(b) && mod11_10Valid(b.slice(0, 8), b[8]),
+    DK: (b) => {
+        if (!/^\d{8}$/.test(b))
+            return false;
+        return weightedMod(toDigits(b), [2, 7, 6, 5, 4, 3, 2, 1], 11) === 0;
+    },
+    EE: (b) => {
+        if (!/^\d{9}$/.test(b))
+            return false;
+        const d = toDigits(b);
+        const sum = cyclicWeightedMod(d.slice(0, 8), [3, 7, 1], 10);
+        return (10 - sum) % 10 === d[8];
+    },
+    EL: (b) => {
+        if (!/^\d{9}$/.test(b) || /^0+$/.test(b))
+            return false;
+        const d = toDigits(b);
+        return weightedModBy(d.slice(0, 8), (i) => 2 ** (8 - i), 11) % 10 === d[8];
+    },
+    ES: esVatValid,
+    FI: (b) => {
+        if (!/^\d{8}$/.test(b))
+            return false;
+        const d = toDigits(b);
+        const r = weightedMod(d.slice(0, 7), [7, 9, 10, 5, 8, 4, 2], 11);
+        if (r === 1)
+            return false;
+        return (r === 0 ? 0 : 11 - r) === d[7];
+    },
+    FR: (b) => {
+        if (!/^[0-9A-Z]{2}\d{9}$/.test(b))
+            return false;
+        const siren = b.slice(2);
+        if (!luhnValid(siren))
+            return false;
+        if (isAllDigits(b.slice(0, 2))) {
+            return Number(b.slice(0, 2)) === (12 + 3 * (Number(siren) % 97)) % 97;
+        }
+        return 'structural'; // letter keys: no published arithmetic
+    },
+    HR: (b) => /^\d{11}$/.test(b) && mod11_10Valid(b.slice(0, 10), b[10]),
+    HU: (b) => {
+        if (!/^\d{8}$/.test(b))
+            return false;
+        const d = toDigits(b);
+        const sum = weightedMod(d.slice(0, 7), [9, 7, 3, 1, 9, 7, 3], 10);
+        return (10 - sum) % 10 === d[7];
+    },
+    IE: (b) => {
+        const m = /^(\d{7})([A-W])([AH])?$/.exec(b);
+        if (m === null)
+            return false;
+        let sum = weightedSum(toDigits(m[1]), [8, 7, 6, 5, 4, 3, 2]);
+        if (m[3] !== undefined)
+            sum += 9 * (m[3].charCodeAt(0) - 64);
+        return m[2] === MOD23[sum % 23];
+    },
+    IT: (b) => /^\d{11}$/.test(b) && !/^0{7}/.test(b) && luhnValid(b),
+    LT: (b) => {
+        const twoPhase = (d, n) => {
+            let r = weightedModBy(d.slice(0, n), (i) => (i % 9) + 1, 11);
+            if (r === 10) {
+                r = weightedModBy(d.slice(0, n), (i) => ((i + 2) % 9) + 1, 11);
+                if (r === 10)
+                    r = 0;
+            }
+            return r;
+        };
+        if (/^\d{9}$/.test(b)) {
+            const d = toDigits(b);
+            return twoPhase(d, 8) === d[8];
+        }
+        if (/^\d{12}$/.test(b)) {
+            const d = toDigits(b);
+            return twoPhase(d, 11) === d[11];
+        }
+        return false;
+    },
+    LU: (b) => /^\d{8}$/.test(b) && Number(b.slice(0, 6)) % 89 === Number(b.slice(6)),
+    LV: (b) => {
+        if (!/^\d{11}$/.test(b))
+            return false;
+        const d = toDigits(b);
+        let sum = 0;
+        const weights = [9, 1, 4, 8, 3, 10, 2, 5, 7, 6];
+        for (let i = 0; i < 10; i++)
+            sum += d[i] * weights[i];
+        const c = (((3 - sum) % 11) + 11) % 11;
+        if (c === 10)
+            return false;
+        return c === d[10];
+    },
+    MT: (b) => {
+        if (!/^\d{8}$/.test(b))
+            return false;
+        const d = toDigits(b);
+        const r = weightedMod(d.slice(0, 6), [3, 4, 6, 7, 8, 9], 37);
+        const expected = 37 - r === 0 ? 37 : 37 - r;
+        return expected === Number(b.slice(6));
+    },
+    NL: (b) => {
+        if (!/^\d{9}B\d{2}$/.test(b))
+            return false;
+        const d = toDigits(b.slice(0, 9));
+        const r = weightedModBy(d.slice(0, 8), (i) => 9 - i, 11);
+        if (r !== 10 && r === d[8])
+            return true;
+        // Post-2020 sole traders: base-36 mod-97 over "NL" + the full body.
+        const numeric = [...`NL${b}`]
+            .map((ch) => (/\d/.test(ch) ? ch : String(ch.charCodeAt(0) - 55)))
+            .join('');
+        return modString(numeric, 97) === 1;
+    },
+    PL: (b) => {
+        if (!/^\d{10}$/.test(b))
+            return false;
+        const d = toDigits(b);
+        const r = weightedMod(d.slice(0, 9), [6, 5, 7, 2, 3, 4, 5, 6, 7], 11);
+        return r !== 10 && r === d[9];
+    },
+    PT: (b) => {
+        if (!/^\d{9}$/.test(b))
+            return false;
+        const d = toDigits(b);
+        const r = weightedModBy(d.slice(0, 8), (i) => 9 - i, 11);
+        return (r < 2 ? 0 : 11 - r) === d[8];
+    },
+    RO: (b) => {
+        if (!/^\d{2,10}$/.test(b) || b[0] === '0')
+            return false;
+        const padded = b.padStart(10, '0');
+        const d = toDigits(padded);
+        const sum = weightedMod(d.slice(0, 9), [7, 5, 3, 2, 1, 7, 5, 3, 2], 11);
+        return ((sum * 10) % 11) % 10 === d[9];
+    },
+    SE: (b) => /^\d{10}01$/.test(b) && luhnValid(b.slice(0, 10)),
+    SI: (b) => {
+        if (!/^[1-9]\d{7}$/.test(b))
+            return false;
+        const d = toDigits(b);
+        const r = weightedModBy(d.slice(0, 7), (i) => 8 - i, 11);
+        const c = 11 - r;
+        if (c === 10)
+            return false;
+        return (c === 11 ? 0 : c) === d[7];
+    },
+    SK: (b) => /^[1-9]\d[234789]\d{7}$/.test(b) && Number(b) % 11 === 0,
+};
+const PREFIXES = Object.keys(RULES).join('|');
+registerDetector({
+    id: 'eu-vat',
+    entityType: 'VAT_NUMBER',
+    regions: [
+        'AT', 'BE', 'BG', 'CY', 'CZ', 'DE', 'DK', 'EE', 'GR', 'ES', 'FI', 'FR', 'HR',
+        'HU', 'IE', 'IT', 'LT', 'LU', 'LV', 'MT', 'NL', 'PL', 'PT', 'RO', 'SE', 'SI', 'SK',
+    ],
+    pattern: new RegExp(`\\b(${PREFIXES})[ ]?([0-9A-Z]{2,13})\\b`, 'g'),
+    baseConfidence: CONFIDENCE.HIGH,
+    description: 'EU VAT numbers: per-country structure and checksum for all 27 member states.',
+    validate(ctx) {
+        const country = ctx.match[1];
+        const body = ctx.match[2];
+        const rule = RULES[country];
+        if (rule === undefined)
+            return invalid('not a member-state prefix');
+        const result = rule(body);
+        if (result === false)
+            return invalid('national VAT rule failed');
+        return valid({
+            canonical: `${country}${body}`,
+            ...(result === 'structural' ? { confidence: CONFIDENCE.MEDIUM } : {}),
+            metadata: {
+                country: country === 'EL' ? 'GR' : country,
+                ...(result === 'structural' ? { checksum: 'structural-only' } : {}),
+            },
+            validator: result === 'structural' ? 'vat-structure' : 'vat-checksum',
+        });
+    },
+});
+//# sourceMappingURL=euVat.js.map