@event4u/agent-config 16.5.0 → 17.0.0

package/dist/cli-delegate/chunk-DSY6LLCQ.js

@@ -0,0 +1,127 @@
+import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
+
+// src/agent-src/scripts/roadmap_age.ts
+import { spawnSync } from "node:child_process";
+import * as path from "node:path";
+var STALL_DAYS = 21;
+var DONE_LINE_RE = /^[ \t]*[-*][ \t]+\[[xX]\][ \t]/;
+function parse_age_log(log) {
+  const landed = /* @__PURE__ */ new Map();
+  const ticked = /* @__PURE__ */ new Map();
+  let date = null;
+  let file = null;
+  let net = 0;
+  const flush = () => {
+    if (date !== null && file !== null && net > 0 && !ticked.has(file)) {
+      ticked.set(file, date);
+    }
+    net = 0;
+  };
+  for (const line of log.split("\n")) {
+    if (line.startsWith("@@C ")) {
+      flush();
+      date = line.slice(4).trim();
+      file = null;
+    } else if (line.startsWith("diff --git ")) {
+      flush();
+      const m = / b\/(.+)$/.exec(line);
+      file = m ? m[1] : null;
+    } else if (line.startsWith("new file mode") && file !== null && date !== null) {
+      if (!landed.has(file)) landed.set(file, date);
+    } else if (line.startsWith("+") && !line.startsWith("+++")) {
+      if (DONE_LINE_RE.test(line.slice(1))) net++;
+    } else if (line.startsWith("-") && !line.startsWith("---")) {
+      if (DONE_LINE_RE.test(line.slice(1))) net--;
+    }
+  }
+  flush();
+  const out = /* @__PURE__ */ new Map();
+  for (const f of /* @__PURE__ */ new Set([...landed.keys(), ...ticked.keys()])) {
+    out.set(f, { landed: landed.get(f) ?? null, last_tick: ticked.get(f) ?? null });
+  }
+  return out;
+}
+function collect_ages(repo_root, roadmap_paths) {
+  if (roadmap_paths.length === 0) return /* @__PURE__ */ new Map();
+  const shallow = spawnSync("git", ["rev-parse", "--is-shallow-repository"], { cwd: repo_root, encoding: "utf-8" });
+  if (shallow.status !== 0 || String(shallow.stdout).trim() !== "false") return /* @__PURE__ */ new Map();
+  const rels = roadmap_paths.map((p) => path.relative(repo_root, p).split(path.sep).join("/"));
+  const r = spawnSync("git", ["log", "-U0", "-p", "--no-renames", "--format=@@C %as", "--", ...rels], {
+    cwd: repo_root,
+    encoding: "utf-8",
+    maxBuffer: 256 * 1024 * 1024
+  });
+  if (r.status !== 0 || typeof r.stdout !== "string") return /* @__PURE__ */ new Map();
+  return parse_age_log(r.stdout);
+}
+function days_between(from, to) {
+  const t = Date.parse(`${from}T00:00:00Z`);
+  if (Number.isNaN(t)) return NaN;
+  const today = Date.UTC(to.getUTCFullYear(), to.getUTCMonth(), to.getUTCDate());
+  return Math.floor((today - t) / 864e5);
+}
+var RENEWED_RE = /^renewed:[ \t]*['"]?(\d{4}-\d{2}-\d{2})[ \t]*(?:—|–|-{1,2})[ \t]*(\S[^\n]*?)['"]?[ \t]*$/m;
+function renewal_date(frontmatter) {
+  const m = RENEWED_RE.exec(frontmatter);
+  return m ? m[1] : null;
+}
+function is_park_proposal(age, frontmatter, now) {
+  if (!age || age.landed === null) return false;
+  const since_landing = days_between(age.landed, now);
+  if (!(since_landing >= STALL_DAYS)) return false;
+  if (age.last_tick !== null && age.last_tick >= age.landed) return false;
+  const renewed = renewal_date(frontmatter);
+  const since_renewal = renewed === null ? NaN : days_between(renewed, now);
+  if (since_renewal >= 0 && since_renewal < STALL_DAYS) return false;
+  return true;
+}
+function render_age_section(rows, now) {
+  if (rows.length === 0) return "";
+  const cell = (d) => d === null ? "\u2014" : String(days_between(d, now));
+  const lines = [];
+  lines.push("## Age\n");
+  lines.push(
+    "Days since each active roadmap landed at its path and since its last ticked step, read from `git log` (`\u2014` = unknown, or never ticked).\n"
+  );
+  lines.push("| Roadmap | Days since landing | Days since last tick |");
+  lines.push("|---|---:|---:|");
+  for (const r of rows) {
+    lines.push(`| [${r.rel}](roadmaps/${r.rel}) | ${cell(r.age?.landed ?? null)} | ${cell(r.age?.last_tick ?? null)} |`);
+  }
+  lines.push("");
+  const proposals = rows.filter((r) => is_park_proposal(r.age, r.frontmatter, now));
+  if (proposals.length > 0) {
+    lines.push("## Park proposals\n");
+    lines.push(
+      `No ticked step ${String(STALL_DAYS)}+ days after landing. A proposal, never an action: park it, or keep it and add \`renewed: <YYYY-MM-DD> \u2014 <reason>\` to its frontmatter, which clears the proposal for ${String(STALL_DAYS)} days.
+`
+    );
+    for (const r of proposals) {
+      lines.push(`- [${r.rel}](roadmaps/${r.rel}) \u2014 landed ${r.age?.landed ?? "?"}`);
+    }
+    lines.push("");
+  }
+  return lines.join("\n") + "\n";
+}
+function strip_age_section(text) {
+  const AGE_LINE = /^(## Age|## Park proposals|Days since each |No ticked step |\| Roadmap \||\|---\||\| \[|- \[|$)/;
+  const out = [];
+  let skipping = false;
+  for (const line of text.split("\n")) {
+    if (line === "## Age" || line === "## Park proposals") skipping = true;
+    else if (skipping && !AGE_LINE.test(line)) skipping = false;
+    if (!skipping) out.push(line);
+  }
+  return out.join("\n");
+}
+
+export {
+  STALL_DAYS,
+  parse_age_log,
+  collect_ages,
+  days_between,
+  renewal_date,
+  is_park_proposal,
+  render_age_section,
+  strip_age_section
+};

package/dist/cli-delegate/chunk-E6XNBVE4.js

@@ -0,0 +1,581 @@
+import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
+
+// src/scripts/_lib/egress_rules.ts
+function shannonEntropy(value) {
+  const freq = /* @__PURE__ */ new Map();
+  for (const ch of value) {
+    freq.set(ch, (freq.get(ch) ?? 0) + 1);
+  }
+  const n = value.length;
+  let entropy = 0;
+  for (const count of freq.values()) {
+    const p = count / n;
+    entropy -= p * Math.log2(p);
+  }
+  return entropy;
+}
+var GENERIC_MIN_LENGTH = 16;
+var GENERIC_MIN_ENTROPY = 3.3;
+var CODE_EXPR = /[()$`{}<>[\];,]|->|=>|\.\w/;
+function looksLikeSecretValue(value) {
+  if (value.length < GENERIC_MIN_LENGTH || CODE_EXPR.test(value)) {
+    return false;
+  }
+  const hasDigit = /[0-9]/.test(value);
+  const mixedCase = /[a-z]/.test(value) && /[A-Z]/.test(value);
+  if (!hasDigit && !mixedCase) {
+    return false;
+  }
+  return shannonEntropy(value) >= GENERIC_MIN_ENTROPY;
+}
+var ASSIGNMENT_KEYWORDS = {
+  password: "password",
+  passwd: "passwd",
+  pwd: "pwd",
+  secret: "secret",
+  apiKey: "api[_-]?key",
+  apikey: "apikey",
+  accessToken: "access[_-]?token",
+  authToken: "auth[_-]?token",
+  clientSecret: "client[_-]?secret",
+  privateKey: "private[_-]?key",
+  token: "token",
+  bearer: "bearer"
+};
+function assignmentSource(shape) {
+  const alt = shape.keywords.map((k) => ASSIGNMENT_KEYWORDS[k]).join("|");
+  const group = shape.capture === true ? `(${alt})` : `(?:${alt})`;
+  const gap = shape.gap ?? "\\s*";
+  const head = `${shape.before ?? ""}${group}${shape.after ?? ""}${gap}[:=]`;
+  return shape.value === void 0 ? head : `${head}${gap}${shape.value}`;
+}
+function assignmentPattern(shape, flags) {
+  return new RegExp(assignmentSource(shape), flags);
+}
+var AUTHORIZATION_HEADER = "authorization";
+var KEY_MARKER = /-----(BEGIN|END) ([A-Z ]*)PRIVATE KEY-----/g;
+var BEGIN_LABEL = /^-----BEGIN ([A-Z ]*)PRIVATE KEY-----/;
+function pemBlockEnd(text, span) {
+  const label = BEGIN_LABEL.exec(text.slice(span.start, span.end))?.[1];
+  if (label === void 0) return null;
+  KEY_MARKER.lastIndex = span.end;
+  const m = KEY_MARKER.exec(text);
+  if (m === null || m[1] !== "END" || m[2] !== label) return null;
+  return m.index + m[0].length;
+}
+function pemMaskEnd(text, span) {
+  KEY_MARKER.lastIndex = span.end;
+  for (let m = KEY_MARKER.exec(text); m !== null; m = KEY_MARKER.exec(text)) {
+    if (m[1] === "END") return m.index + m[0].length;
+  }
+  return null;
+}
+var IBAN_LENGTHS = "AD24AE23AL28AT20AZ28BA20BE16BG22BH22BI27BR29BY28CH21CR22CY28CZ24DE22DJ27DK18DO28EE20EG29ES24FI18FK18FO18FR27GB22GE22GI23GL18GR27GT28HN28HR21HU28IE22IL23IQ23IS26IT27JO30KW30KZ20LB28LC32LI21LT20LU20LV21LY25MC27MD24ME22MK19MN20MR27MT31MU30NI28NL18NO15OM23PK24PL28PS29PT25QA29RO24RS22RU33SA24SC31SD18SE24SI19SK24SM27SO23ST25SV28TL23TN24TR26UA29VA22VG24XK20YE30";
+function isValidIban(value) {
+  const iban = value.replace(/ /g, "").toUpperCase();
+  const at = IBAN_LENGTHS.indexOf(iban.slice(0, 2));
+  if (at === -1 || at % 4 !== 0 || Number(IBAN_LENGTHS.slice(at + 2, at + 4)) !== iban.length) return false;
+  if (!/^[A-Z]{2}[0-9]{2}[A-Z0-9]+$/.test(iban)) return false;
+  let rest = 0;
+  for (const ch of iban.slice(4) + iban.slice(0, 4)) {
+    const n = ch <= "9" ? ch.charCodeAt(0) - 48 : ch.charCodeAt(0) - 55;
+    rest = n > 9 ? (rest * 100 + n) % 97 : (rest * 10 + n) % 97;
+  }
+  return rest === 1;
+}
+function passesLuhn(value) {
+  const digits = value.replace(/[ -]/g, "");
+  if (!/^[0-9]{13,19}$/.test(digits) || /^(.)\1+$/.test(digits)) return false;
+  let sum = 0;
+  for (let i = 0; i < digits.length; i += 1) {
+    let d = digits.charCodeAt(digits.length - 1 - i) - 48;
+    if (i % 2 === 1) {
+      d *= 2;
+      if (d > 9) d -= 9;
+    }
+    sum += d;
+  }
+  return sum % 10 === 0;
+}
+function phoneDigits(min, max) {
+  return (value) => {
+    if (/^\+?[0-9]{4}-[0-9]{2}-[0-9]{2}/.test(value)) return false;
+    const n = value.replace(/[^0-9]/g, "").length;
+    return n >= min && n <= max;
+  };
+}
+function isValidGermanTaxId(value) {
+  const d = value.replace(/ /g, "");
+  if (!/^[1-9][0-9]{10}$/.test(d)) return false;
+  const counts = /* @__PURE__ */ new Map();
+  for (const ch of d.slice(0, 10)) counts.set(ch, (counts.get(ch) ?? 0) + 1);
+  const repeated = [...counts.values()].filter((c) => c > 1);
+  if (repeated.length !== 1 || repeated[0] > 3) return false;
+  let product = 10;
+  for (let i = 0; i < 10; i += 1) {
+    let sum = (d.charCodeAt(i) - 48 + product) % 10;
+    if (sum === 0) sum = 10;
+    product = sum * 2 % 11;
+  }
+  const check = (11 - product) % 10;
+  return check === d.charCodeAt(10) - 48;
+}
+function isValidUsSsn(value) {
+  const m = /^([0-9]{3})-([0-9]{2})-([0-9]{4})$/.exec(value);
+  if (m === null) return false;
+  const [area, group, serial] = [m[1], m[2], m[3]];
+  return area !== "000" && area !== "666" && !area.startsWith("9") && group !== "00" && serial !== "0000";
+}
+var EMAIL_EXCLUSIONS = [
+  /^git@/i,
+  /@(?:[a-z0-9-]+\.)*(?:example\.(?:com|net|org)|example|test|invalid|localhost|local)$/i,
+  /^(?:no-?reply|do-?not-?reply|noreply\+[^@]*)@/i,
+  /@users\.noreply\.github\.com$/i,
+  /@[0-9]x\.[a-z]+$/i,
+  /\.(?:png|jpe?g|gif|svg|webp|ico|js|mjs|cjs|ts|tsx|css|json|ya?ml|lock)$/i
+];
+var EMAIL_ALLOWLIST_DIGESTS = /* @__PURE__ */ new Set(["924acfa874365f8a", "8066a43fc18158bf"]);
+function emailAllowlistDigest(address) {
+  let h = 0xcbf29ce484222325n;
+  for (const ch of `egress-email-allowlist-v1\0${address.toLowerCase()}`) {
+    h ^= BigInt(ch.codePointAt(0));
+    h = h * 0x100000001b3n & 0xffffffffffffffffn;
+  }
+  return h.toString(16).padStart(16, "0");
+}
+function isReportableEmail(value) {
+  return !EMAIL_ALLOWLIST_DIGESTS.has(emailAllowlistDigest(value));
+}
+var EGRESS_RULES = [
+  {
+    rule: "anthropic-api-key",
+    type: "APIKEY",
+    prefixes: ["sk-ant-"],
+    class: "credential",
+    replacement: "detection",
+    kind: "anthropic-api-key",
+    pattern: /sk-ant-[A-Za-z0-9_-]{20,}/g
+  },
+  {
+    rule: "anthropic-project-key",
+    type: "APIKEY",
+    prefixes: ["sk-proj-"],
+    class: "credential",
+    replacement: "detection",
+    kind: "anthropic-api-key",
+    pattern: /sk-proj-[A-Za-z0-9_-]{20,}/g
+  },
+  {
+    rule: "aws-access-key",
+    type: "APIKEY",
+    prefixes: ["AKIA"],
+    class: "credential",
+    replacement: "detection",
+    pattern: /AKIA[0-9A-Z]{16}/g
+  },
+  {
+    rule: "google-api-key",
+    type: "APIKEY",
+    prefixes: ["AIza"],
+    class: "credential",
+    replacement: "detection",
+    pattern: /AIza[0-9A-Za-z_-]{35}/g
+  },
+  {
+    rule: "github-pat",
+    type: "TOKEN",
+    prefixes: ["ghp_"],
+    class: "credential",
+    replacement: "detection",
+    pattern: /ghp_[0-9A-Za-z]{36}/g
+  },
+  {
+    rule: "github-fine-grained-pat",
+    type: "TOKEN",
+    prefixes: ["github_pat_"],
+    class: "credential",
+    replacement: "detection",
+    kind: "github-pat",
+    pattern: /github_pat_[0-9A-Za-z_]{22,}/g
+  },
+  {
+    rule: "openai-api-key",
+    type: "APIKEY",
+    prefixes: ["sk-"],
+    class: "credential",
+    replacement: "detection",
+    tokenStart: true,
+    pattern: /(?<![A-Za-z0-9])sk-[A-Za-z0-9]{20,}/g
+  },
+  {
+    rule: "google-oauth-token",
+    type: "TOKEN",
+    prefixes: ["ya29."],
+    class: "credential",
+    replacement: "detection",
+    tokenStart: true,
+    pattern: /(?<![A-Za-z0-9])ya29\.[0-9A-Za-z_-]{20,}/g
+  },
+  {
+    rule: "github-app-token",
+    type: "TOKEN",
+    prefixes: ["gho_", "ghu_", "ghs_", "ghr_"],
+    class: "credential",
+    replacement: "detection",
+    pattern: /gh[ousr]_[A-Za-z0-9]{36,}/g
+  },
+  {
+    rule: "xai-api-key",
+    type: "APIKEY",
+    prefixes: ["xai-"],
+    class: "credential",
+    replacement: "detection",
+    tokenStart: true,
+    pattern: /(?<![A-Za-z0-9])xai-[A-Za-z0-9]{20,}/g
+  },
+  {
+    rule: "perplexity-api-key",
+    type: "APIKEY",
+    prefixes: ["pplx-"],
+    class: "credential",
+    replacement: "detection",
+    pattern: /pplx-[A-Za-z0-9]{20,}/g
+  },
+  {
+    rule: "groq-api-key",
+    type: "APIKEY",
+    prefixes: ["gsk_"],
+    class: "credential",
+    replacement: "detection",
+    tokenStart: true,
+    pattern: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{20,}/g
+  },
+  {
+    rule: "huggingface-token",
+    type: "TOKEN",
+    prefixes: ["hf_"],
+    class: "credential",
+    replacement: "detection",
+    tokenStart: true,
+    pattern: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{30,}/g
+  },
+  {
+    rule: "nvidia-api-key",
+    type: "APIKEY",
+    prefixes: ["nvapi-"],
+    class: "credential",
+    replacement: "detection",
+    tokenStart: true,
+    pattern: /(?<![A-Za-z0-9])nvapi-[A-Za-z0-9_-]{40,}/g
+  },
+  {
+    rule: "replicate-api-token",
+    type: "TOKEN",
+    prefixes: ["r8_"],
+    class: "credential",
+    replacement: "detection",
+    tokenStart: true,
+    pattern: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{30,}/g
+  },
+  {
+    rule: "jwt",
+    type: "TOKEN",
+    class: "credential",
+    replacement: "detection",
+    pattern: /(?<![A-Za-z0-9_-])(?=((?:(?!eyJ)[A-Za-z0-9_-])*))\1(eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,})/dg,
+    valueGroup: 2
+  },
+  {
+    rule: "stripe-secret-key",
+    type: "APIKEY",
+    prefixes: ["sk_live_", "sk_test_"],
+    class: "credential",
+    replacement: "detection",
+    pattern: /sk_(?:live|test)_[0-9A-Za-z]{16,}/g
+  },
+  {
+    rule: "slack-token",
+    type: "TOKEN",
+    prefixes: ["xoxb-", "xoxp-", "xoxa-", "xoxr-", "xoxs-"],
+    class: "credential",
+    replacement: "detection",
+    pattern: /xox[baprs]-[0-9A-Za-z-]{10,}/g
+  },
+  {
+    rule: "pem-private-key",
+    type: "PRIVATEKEY",
+    class: "credential",
+    pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g,
+    replacement: { through: pemBlockEnd }
+  },
+  {
+    rule: "db-connection-uri",
+    type: "DBURI",
+    class: "credential",
+    replacement: "detection",
+    pattern: /(?<![a-z0-9+.-])(?=((?:(?!\b[a-z])[a-z0-9+.-])*))\1(\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s:/@]+@)/dg,
+    valueGroup: 2
+  },
+  {
+    rule: "generic-assignment",
+    type: "SECRET",
+    class: "credential",
+    replacement: "detection",
+    pattern: assignmentPattern(
+      {
+        keywords: ["password", "passwd", "pwd", "secret", "apiKey", "accessToken", "authToken"],
+        value: `['"]?([^'"\\s]{8,})['"]?`
+      },
+      "dgi"
+    ),
+    valueGroup: 1,
+    validator: looksLikeSecretValue
+  },
+  {
+    rule: "iban",
+    type: "IBAN",
+    class: "identifier",
+    replacement: "detection",
+    pattern: /(?<![A-Za-z0-9])[A-Z]{2}[0-9]{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,3})?(?![A-Za-z0-9])/g,
+    validator: isValidIban
+  },
+  {
+    rule: "payment-card",
+    type: "CARD",
+    class: "identifier",
+    replacement: "detection",
+    pattern: /(?<![0-9])[0-9](?:[ -]?[0-9]){12,18}(?![0-9])/g,
+    validator: passesLuhn,
+    context: {
+      words: /\b(?:card|credit|debit|visa|mastercard|amex|maestro|kreditkarte|karte|kartennummer|payment|zahlung)\b/i,
+      window: 48
+    }
+  },
+  {
+    rule: "email",
+    type: "EMAIL",
+    class: "identifier",
+    replacement: "detection",
+    pattern: /(?<![A-Za-z0-9._%+\\-])[A-Za-z0-9][A-Za-z0-9._%+-]{0,63}@(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.){1,8}[A-Za-z]{2,24}(?![A-Za-z0-9-])/g,
+    exclusions: EMAIL_EXCLUSIONS,
+    validator: isReportableEmail
+  },
+  {
+    rule: "phone-international",
+    type: "PHONE",
+    class: "identifier",
+    replacement: "detection",
+    pattern: /(?<![A-Za-z0-9+])\+[1-9][0-9]{0,2}(?:[ ./-]?(?:\([0-9]{1,6}\)|(?=([0-9]{1,6}))\1)){1,5}(?![0-9])/g,
+    validator: phoneDigits(8, 15)
+  },
+  {
+    rule: "phone-national",
+    type: "PHONE",
+    class: "identifier",
+    replacement: "detection",
+    pattern: /(?<![A-Za-z0-9+(])(?:\(0[1-9][0-9]{1,4}\)|0[1-9][0-9]{1,4})(?:[ ./-]?(?=([0-9]{2,8}))\1){1,3}(?![0-9])/g,
+    validator: phoneDigits(7, 13),
+    context: { words: /\b(?:tel|telefon|telephone|phone|mobil|mobile|cell|fax|handy|call|ruf)\b/i, window: 32 }
+  },
+  {
+    rule: "phone-nanp",
+    type: "PHONE",
+    class: "identifier",
+    replacement: "detection",
+    pattern: /(?<![A-Za-z0-9+(-])(?:\+?1[ .-]?)?(?:\([2-9][0-9]{2}\) ?|[2-9][0-9]{2}[ .-]?)[2-9][0-9]{2}[ .-]?[0-9]{4}(?![0-9-])/g,
+    context: { words: /\b(?:tel|telephone|phone|mobile|cell|fax|call)\b/i, window: 32 }
+  },
+  {
+    rule: "de-tax-id",
+    type: "TAXID",
+    class: "identifier",
+    replacement: "detection",
+    pattern: /(?<![0-9])[1-9](?: ?[0-9]){10}(?![0-9])/g,
+    validator: isValidGermanTaxId,
+    context: {
+      words: /\b(?:steuer-?id|steuer-?identifikationsnummer|identifikationsnummer|idnr|tax[ -]?id|tin)\b/i,
+      window: 48
+    }
+  },
+  {
+    rule: "us-ssn",
+    type: "SSN",
+    class: "identifier",
+    replacement: "detection",
+    pattern: /(?<![0-9-])[0-9]{3}-[0-9]{2}-[0-9]{4}(?![0-9-])/g,
+    validator: isValidUsSsn
+  }
+];
+var TYPE_WORD = /^(?:string|number|boolean|bigint|unknown|any|never|void|undefined|null|true|false|none|nil|new|typeof|keyof|await|async|function|const|let|var|return|this|self|class|import|require|readonly|export|default|yield|password|passwd|pwd|secret|token|bearer|api[_-]?key|apikey)$/i;
+var KEY_START = "(?<![A-Za-z0-9])";
+var QUOTED_OR_BARE_VALUE = `(?:"([^"\\n]*)"|'([^'\\n]*)'|["']([^\\n]+)|([^\\s'"]+))`;
+var REVIEW_CREDENTIAL_ROWS = [
+  {
+    rule: "review-assignment",
+    type: "SECRET",
+    class: "credential",
+    replacement: "detection",
+    pattern: assignmentPattern(
+      {
+        keywords: ["apiKey", "secret", "token", "password"],
+        before: KEY_START,
+        capture: true,
+        gap: "[ \\t]*",
+        value: QUOTED_OR_BARE_VALUE
+      },
+      "dgi"
+    ),
+    valueGroup: [2, 3, 4, 5],
+    // Group 5 is the bare value. A quoted one is a literal, where `,` `$`
+    // or `.` is password punctuation rather than code, so only a bare value
+    // is read as a code expression.
+    validator: (v, g) => (g !== 5 || !CODE_EXPR.test(v)) && !TYPE_WORD.test(v)
+  },
+  {
+    rule: "review-authorization-header",
+    type: "TOKEN",
+    class: "credential",
+    replacement: "detection",
+    pattern: new RegExp(`^[ \\t]*${AUTHORIZATION_HEADER}:[ \\t]*(\\S[^\\n]*)`, "dgim"),
+    valueGroup: 1
+  }
+];
+var CREDENTIAL_RULES = EGRESS_RULES.filter((r) => r.class === "credential");
+var IDENTIFIER_RULES = EGRESS_RULES.filter((r) => r.class === "identifier");
+var CREDENTIAL_PREFIXES = EGRESS_RULES.flatMap((r) => r.prefixes ?? []).sort(
+  (a, b) => b.length - a.length
+);
+function prefixesOf(rule) {
+  const row = EGRESS_RULES.find((r) => r.rule === rule);
+  if (row === void 0) throw new Error(`egress rule ${rule}: no such row`);
+  return row.prefixes ?? [];
+}
+function vendorPrefix(rule) {
+  const first = prefixesOf(rule)[0];
+  if (first === void 0) throw new Error(`egress rule ${rule}: declares no prefix`);
+  return first;
+}
+var TOKEN_START_PREFIXES = new Set(
+  EGRESS_RULES.filter((r) => r.tokenStart === true).flatMap((r) => r.prefixes ?? [])
+);
+function rawKeyPrefixPattern(minTail, prefixes = CREDENTIAL_PREFIXES, opts = {}) {
+  const alt = [...prefixes].sort((a, b) => b.length - a.length).map((p) => {
+    const lit = p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return opts.boundary !== "never" && TOKEN_START_PREFIXES.has(p) ? `(?<![A-Za-z0-9])${lit}` : lit;
+  }).join("|");
+  return new RegExp(`(?:${alt})[${opts.tail ?? "A-Za-z0-9_-"}]{${minTail},}`, "g");
+}
+function replacementEnd(text, span) {
+  const row = EGRESS_RULES.find((r) => r.rule === span.rule);
+  if (row === void 0) return null;
+  if (row.replacement === "detection") return span.end;
+  const end = row.replacement.through(text, span);
+  return end === null || end < span.end ? null : end;
+}
+function maskingEnd(text, span) {
+  return replacementEnd(text, span) ?? (span.rule === "pem-private-key" ? pemMaskEnd(text, span) : null) ?? span.end;
+}
+var CLASS_RANK = {
+  credential: 1,
+  identifier: 0
+};
+function testWholeValue(re, value) {
+  re.lastIndex = 0;
+  return re.test(value);
+}
+function valueGroupOf(r, m) {
+  if (r.valueGroup === void 0) return "whole-match";
+  if (typeof r.valueGroup === "number") return r.valueGroup;
+  return r.valueGroup.find((g) => m[g] !== void 0) ?? null;
+}
+function evaluateMatch(r, text, m) {
+  const group = valueGroupOf(r, m);
+  if (group === null) return null;
+  const value = group === "whole-match" ? m[0] : m[group];
+  if (value === void 0 || value.length === 0) return null;
+  const start = group === "whole-match" ? m.index : m.indices?.[group]?.[0] ?? -1;
+  if (start < 0) {
+    throw new Error(`egress rule ${r.rule}: a valueGroup rule needs the d flag for capture offsets`);
+  }
+  const end = start + value.length;
+  if (r.exclusions?.some((x) => testWholeValue(x, value))) return null;
+  if (r.context) {
+    const lo = Math.max(0, start - r.context.window);
+    const hi = Math.min(text.length, end + r.context.window);
+    const around = text.slice(lo, start) + " " + text.slice(end, hi);
+    r.context.words.lastIndex = 0;
+    if (!r.context.words.test(around)) return null;
+  }
+  if (r.validator) {
+    return r.validator(value, group) ? { start, end, validated: true } : null;
+  }
+  return { start, end, validated: false };
+}
+function findSpans(text, rules = EGRESS_RULES) {
+  const out = [];
+  for (const r of rules) {
+    r.pattern.lastIndex = 0;
+    let m;
+    while ((m = r.pattern.exec(text)) !== null) {
+      if (m[0].length === 0) {
+        r.pattern.lastIndex += 1;
+        continue;
+      }
+      const c = evaluateMatch(r, text, m);
+      if (c === null) continue;
+      const { start, end, validated } = c;
+      out.push({
+        rule: r.rule,
+        type: r.type,
+        class: r.class,
+        start,
+        end,
+        validated
+      });
+    }
+  }
+  return out;
+}
+function resolveOverlaps(spans) {
+  const ranked = [...spans].sort(
+    (a, b) => CLASS_RANK[b.class] - CLASS_RANK[a.class] || Number(b.validated) - Number(a.validated) || b.end - b.start - (a.end - a.start) || a.start - b.start
+  );
+  const kept = [];
+  for (const s of ranked) {
+    if (!kept.some((k) => s.start < k.end && k.start < s.end)) kept.push(s);
+  }
+  return kept.sort((a, b) => a.start - b.start);
+}
+function detect(text, rules = EGRESS_RULES) {
+  return resolveOverlaps(findSpans(text, rules));
+}
+function replaceSpans(text, spans, replacement) {
+  const ordered = [...spans].sort((a, b) => a.start - b.start);
+  for (let i = 1; i < ordered.length; i++) {
+    if (ordered[i].start < ordered[i - 1].end) {
+      throw new Error("replaceSpans: spans overlap; resolve them first");
+    }
+  }
+  let out = text;
+  for (let i = ordered.length - 1; i >= 0; i--) {
+    const s = ordered[i];
+    out = out.slice(0, s.start) + replacement(s, i) + out.slice(s.end);
+  }
+  return out;
+}
+
+export {
+  shannonEntropy,
+  assignmentPattern,
+  EGRESS_RULES,
+  REVIEW_CREDENTIAL_ROWS,
+  prefixesOf,
+  vendorPrefix,
+  rawKeyPrefixPattern,
+  maskingEnd,
+  evaluateMatch,
+  findSpans,
+  resolveOverlaps,
+  detect,
+  replaceSpans
+};