@event4u/agent-config 16.5.0 → 17.0.0

package/dist/scripts/_lib/egress_rules.js

@@ -0,0 +1,766 @@
+// The one rule table for values that must not leave for a model provider in
+// plaintext (docs/contracts/egress-placeholders-v1.md). Every credential and
+// identifier pattern is defined here and nowhere else; consumers decide policy
+// (refuse, replace, report), this module only detects.
+//
+// Pure: no import, no I/O, no network. Every rule states why it is linear on a
+// hostile input; the parity test pins what the move from secret_detector kept.
+export function shannonEntropy(value) {
+    const freq = new Map();
+    for (const ch of value) {
+        freq.set(ch, (freq.get(ch) ?? 0) + 1);
+    }
+    const n = value.length;
+    let entropy = 0;
+    for (const count of freq.values()) {
+        const p = count / n;
+        entropy -= p * Math.log2(p);
+    }
+    return entropy;
+}
+// A keyword-shaped assignment of a low-entropy word (`secret: moderate`) or of a
+// code expression (`opts.apiKey`, `${API_KEY}`, `load()`) is not a credential.
+const GENERIC_MIN_LENGTH = 16;
+const GENERIC_MIN_ENTROPY = 3.3;
+const CODE_EXPR = /[()$`{}<>[\];,]|->|=>|\.\w/;
+export function looksLikeSecretValue(value) {
+    if (value.length < GENERIC_MIN_LENGTH || CODE_EXPR.test(value)) {
+        return false;
+    }
+    const hasDigit = /[0-9]/.test(value);
+    const mixedCase = /[a-z]/.test(value) && /[A-Z]/.test(value);
+    if (!hasDigit && !mixedCase) {
+        return false;
+    }
+    return shannonEntropy(value) >= GENERIC_MIN_ENTROPY;
+}
+/**
+ * The keyword names a credential assignment is spelled with (`password =`,
+ * `api_key:`). They carry no vendor literal, so each consumer reads the ones it
+ * always read, in its own order, and keeps its own threshold for the value.
+ */
+export const ASSIGNMENT_KEYWORDS = {
+    password: 'password',
+    passwd: 'passwd',
+    pwd: 'pwd',
+    secret: 'secret',
+    apiKey: 'api[_-]?key',
+    apikey: 'apikey',
+    accessToken: 'access[_-]?token',
+    authToken: 'auth[_-]?token',
+    clientSecret: 'client[_-]?secret',
+    privateKey: 'private[_-]?key',
+    token: 'token',
+    bearer: 'bearer',
+};
+/** Source of a keyword-assignment shape: keyword group, operator, then the consumer's value. */
+export function assignmentSource(shape) {
+    const alt = shape.keywords.map((k) => ASSIGNMENT_KEYWORDS[k]).join('|');
+    const group = shape.capture === true ? `(${alt})` : `(?:${alt})`;
+    const gap = shape.gap ?? '\\s*';
+    const head = `${shape.before ?? ''}${group}${shape.after ?? ''}${gap}[:=]`;
+    return shape.value === undefined ? head : `${head}${gap}${shape.value}`;
+}
+export function assignmentPattern(shape, flags) {
+    return new RegExp(assignmentSource(shape), flags);
+}
+/** An HTTP `Authorization` header name; everything after its colon is the credential. */
+export const AUTHORIZATION_HEADER = 'authorization';
+/**
+ * Raw-key prefix families spelled as a class, for a surface that keeps the
+ * prefix and drops the value: group 1 is the prefix stem. Wider than the rows on
+ * purpose (`pk-`, `rk-`); a test checks each family still covers the table
+ * prefixes it claims.
+ */
+export const CLASS_SPELLED_PREFIXES = {
+    dashKeys: { family: '(sk|pk|rk)-', covers: ['sk-'] },
+    tokens: {
+        family: '(gh[pousr]|github_pat|xox[baprs])[-_]',
+        covers: ['ghp_', 'gho_', 'ghu_', 'ghs_', 'ghr_', 'github_pat_', 'xoxb-', 'xoxp-', 'xoxa-', 'xoxr-', 'xoxs-'],
+    },
+};
+// The nearest key marker after the header decides: an END carrying the same
+// label as the header ends the block; another BEGIN, an END with a different
+// label, or no marker at all means the extent is unproven. One sticky scan from
+// the header to the nearest marker keeps this linear even over many headers.
+const KEY_MARKER = /-----(BEGIN|END) ([A-Z ]*)PRIVATE KEY-----/g;
+const BEGIN_LABEL = /^-----BEGIN ([A-Z ]*)PRIVATE KEY-----/;
+export function pemBlockEnd(text, span) {
+    const label = BEGIN_LABEL.exec(text.slice(span.start, span.end))?.[1];
+    if (label === undefined)
+        return null;
+    KEY_MARKER.lastIndex = span.end;
+    const m = KEY_MARKER.exec(text);
+    if (m === null || m[1] !== 'END' || m[2] !== label)
+        return null;
+    return m.index + m[0].length;
+}
+/**
+ * End of the first key-end marker of any label after the header, or null. For a
+ * masking surface that cannot refuse: when the block's extent is unproven it
+ * masks too much rather than leaving the key body behind.
+ */
+export function pemMaskEnd(text, span) {
+    KEY_MARKER.lastIndex = span.end;
+    for (let m = KEY_MARKER.exec(text); m !== null; m = KEY_MARKER.exec(text)) {
+        if (m[1] === 'END')
+            return m.index + m[0].length;
+    }
+    return null;
+}
+// Identifier validators. A shape alone is never enough to replace an identifier:
+// each row carries a checksum, a context word, or both, because a false positive
+// here damages ordinary code and review text.
+// IBAN length per country (ISO 13616 registry), packed as `CCnn` pairs. A country
+// missing here leaves its IBANs unmasked, so the table errs towards inclusion.
+const IBAN_LENGTHS = 'AD24AE23AL28AT20AZ28BA20BE16BG22BH22BI27BR29BY28CH21CR22CY28CZ24DE22DJ27DK18DO28EE20EG29ES24FI18FK18FO18FR27GB22GE22GI23GL18GR27GT28HN28HR21HU28IE22IL23IQ23IS26IT27JO30KW30KZ20LB28LC32LI21LT20LU20LV21LY25MC27MD24ME22MK19MN20MR27MT31MU30NI28NL18NO15OM23PK24PL28PS29PT25QA29RO24RS22RU33SA24SC31SD18SE24SI19SK24SM27SO23ST25SV28TL23TN24TR26UA29VA22VG24XK20YE30';
+export function isValidIban(value) {
+    const iban = value.replace(/ /g, '').toUpperCase();
+    const at = IBAN_LENGTHS.indexOf(iban.slice(0, 2));
+    if (at === -1 || at % 4 !== 0 || Number(IBAN_LENGTHS.slice(at + 2, at + 4)) !== iban.length)
+        return false;
+    if (!/^[A-Z]{2}[0-9]{2}[A-Z0-9]+$/.test(iban))
+        return false;
+    let rest = 0;
+    for (const ch of iban.slice(4) + iban.slice(0, 4)) {
+        const n = ch <= '9' ? ch.charCodeAt(0) - 48 : ch.charCodeAt(0) - 55;
+        rest = n > 9 ? (rest * 100 + n) % 97 : (rest * 10 + n) % 97;
+    }
+    return rest === 1;
+}
+export function passesLuhn(value) {
+    const digits = value.replace(/[ -]/g, '');
+    if (!/^[0-9]{13,19}$/.test(digits) || /^(.)\1+$/.test(digits))
+        return false;
+    let sum = 0;
+    for (let i = 0; i < digits.length; i += 1) {
+        let d = digits.charCodeAt(digits.length - 1 - i) - 48;
+        if (i % 2 === 1) {
+            d *= 2;
+            if (d > 9)
+                d -= 9;
+        }
+        sum += d;
+    }
+    return sum % 10 === 0;
+}
+/** E.164 bounds: a country code plus at most 15 digits in all; never a date after a diff marker. */
+function phoneDigits(min, max) {
+    return (value) => {
+        if (/^\+?[0-9]{4}-[0-9]{2}-[0-9]{2}/.test(value))
+            return false;
+        const n = value.replace(/[^0-9]/g, '').length;
+        return n >= min && n <= max;
+    };
+}
+/**
+ * German tax identification number: 11 digits, no leading zero, one digit of
+ * the first ten repeated two or three times and no other repeated, and an
+ * ISO 7064 MOD 11,10 check digit.
+ */
+export function isValidGermanTaxId(value) {
+    const d = value.replace(/ /g, '');
+    if (!/^[1-9][0-9]{10}$/.test(d))
+        return false;
+    const counts = new Map();
+    for (const ch of d.slice(0, 10))
+        counts.set(ch, (counts.get(ch) ?? 0) + 1);
+    const repeated = [...counts.values()].filter((c) => c > 1);
+    if (repeated.length !== 1 || repeated[0] > 3)
+        return false;
+    let product = 10;
+    for (let i = 0; i < 10; i += 1) {
+        let sum = (d.charCodeAt(i) - 48 + product) % 10;
+        if (sum === 0)
+            sum = 10;
+        product = (sum * 2) % 11;
+    }
+    const check = (11 - product) % 10;
+    return check === d.charCodeAt(10) - 48;
+}
+/** US social security number: no 000, 666 or 9xx area, no 00 group, no 0000 serial. */
+export function isValidUsSsn(value) {
+    const m = /^([0-9]{3})-([0-9]{2})-([0-9]{4})$/.exec(value);
+    if (m === null)
+        return false;
+    const [area, group, serial] = [m[1], m[2], m[3]];
+    return area !== '000' && area !== '666' && !area.startsWith('9') && group !== '00' && serial !== '0000';
+}
+// Addresses that name no one: documentation and reserved domains (RFC 2606,
+// RFC 6761), no-reply senders, and image-density file names (`logo@2x.png`).
+const EMAIL_EXCLUSIONS = [
+    /^git@/i,
+    /@(?:[a-z0-9-]+\.)*(?:example\.(?:com|net|org)|example|test|invalid|localhost|local)$/i,
+    /^(?:no-?reply|do-?not-?reply|noreply\+[^@]*)@/i,
+    /@users\.noreply\.github\.com$/i,
+    /@[0-9]x\.[a-z]+$/i,
+    /\.(?:png|jpe?g|gif|svg|webp|ico|js|mjs|cjs|ts|tsx|css|json|ya?ml|lock)$/i,
+];
+/**
+ * The repository's own published identities (package author, copyright holder),
+ * held as keyed 64-bit FNV-1a digests of the lower-cased address so the list
+ * reads as noise. A digest hides an address from a reader, not from someone who
+ * guesses it; the list exists to keep the tree's own metadata out of a review's
+ * placeholder count.
+ */
+const EMAIL_ALLOWLIST_DIGESTS = new Set(['924acfa874365f8a', '8066a43fc18158bf']);
+export function emailAllowlistDigest(address) {
+    let h = 0xcbf29ce484222325n;
+    for (const ch of `egress-email-allowlist-v1\u0000${address.toLowerCase()}`) {
+        h ^= BigInt(ch.codePointAt(0));
+        h = (h * 0x100000001b3n) & 0xffffffffffffffffn;
+    }
+    return h.toString(16).padStart(16, '0');
+}
+function isReportableEmail(value) {
+    return !EMAIL_ALLOWLIST_DIGESTS.has(emailAllowlistDigest(value));
+}
+// Quantifiers are unbounded where the pattern is linear without a bound, so a
+// long value is matched whole and no suffix survives a replacement. Each rule's
+// argument for why it is linear lives in `egress_rules_linearity.ts`, kept out
+// of this module because no runtime path reads it; a test refuses a row without
+// one. A bound remains only where the unbounded form was quadratic, and what
+// that bound loses is published in DETECTION_CEILINGS.
+export const EGRESS_RULES = [
+    {
+        rule: 'anthropic-api-key',
+        type: 'APIKEY',
+        prefixes: ['sk-ant-'],
+        class: 'credential',
+        replacement: 'detection',
+        kind: 'anthropic-api-key',
+        pattern: /sk-ant-[A-Za-z0-9_-]{20,}/g,
+    },
+    {
+        rule: 'anthropic-project-key',
+        type: 'APIKEY',
+        prefixes: ['sk-proj-'],
+        class: 'credential',
+        replacement: 'detection',
+        kind: 'anthropic-api-key',
+        pattern: /sk-proj-[A-Za-z0-9_-]{20,}/g,
+    },
+    {
+        rule: 'aws-access-key',
+        type: 'APIKEY',
+        prefixes: ['AKIA'],
+        class: 'credential',
+        replacement: 'detection',
+        pattern: /AKIA[0-9A-Z]{16}/g,
+    },
+    {
+        rule: 'google-api-key',
+        type: 'APIKEY',
+        prefixes: ['AIza'],
+        class: 'credential',
+        replacement: 'detection',
+        pattern: /AIza[0-9A-Za-z_-]{35}/g,
+    },
+    {
+        rule: 'github-pat',
+        type: 'TOKEN',
+        prefixes: ['ghp_'],
+        class: 'credential',
+        replacement: 'detection',
+        pattern: /ghp_[0-9A-Za-z]{36}/g,
+    },
+    {
+        rule: 'github-fine-grained-pat',
+        type: 'TOKEN',
+        prefixes: ['github_pat_'],
+        class: 'credential',
+        replacement: 'detection',
+        kind: 'github-pat',
+        pattern: /github_pat_[0-9A-Za-z_]{22,}/g,
+    },
+    {
+        rule: 'openai-api-key',
+        type: 'APIKEY',
+        prefixes: ['sk-'],
+        class: 'credential',
+        replacement: 'detection',
+        tokenStart: true,
+        pattern: /(?<![A-Za-z0-9])sk-[A-Za-z0-9]{20,}/g,
+    },
+    {
+        rule: 'google-oauth-token',
+        type: 'TOKEN',
+        prefixes: ['ya29.'],
+        class: 'credential',
+        replacement: 'detection',
+        tokenStart: true,
+        pattern: /(?<![A-Za-z0-9])ya29\.[0-9A-Za-z_-]{20,}/g,
+    },
+    {
+        rule: 'github-app-token',
+        type: 'TOKEN',
+        prefixes: ['gho_', 'ghu_', 'ghs_', 'ghr_'],
+        class: 'credential',
+        replacement: 'detection',
+        pattern: /gh[ousr]_[A-Za-z0-9]{36,}/g,
+    },
+    {
+        rule: 'xai-api-key',
+        type: 'APIKEY',
+        prefixes: ['xai-'],
+        class: 'credential',
+        replacement: 'detection',
+        tokenStart: true,
+        pattern: /(?<![A-Za-z0-9])xai-[A-Za-z0-9]{20,}/g,
+    },
+    {
+        rule: 'perplexity-api-key',
+        type: 'APIKEY',
+        prefixes: ['pplx-'],
+        class: 'credential',
+        replacement: 'detection',
+        pattern: /pplx-[A-Za-z0-9]{20,}/g,
+    },
+    {
+        rule: 'groq-api-key',
+        type: 'APIKEY',
+        prefixes: ['gsk_'],
+        class: 'credential',
+        replacement: 'detection',
+        tokenStart: true,
+        pattern: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{20,}/g,
+    },
+    {
+        rule: 'huggingface-token',
+        type: 'TOKEN',
+        prefixes: ['hf_'],
+        class: 'credential',
+        replacement: 'detection',
+        tokenStart: true,
+        pattern: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{30,}/g,
+    },
+    {
+        rule: 'nvidia-api-key',
+        type: 'APIKEY',
+        prefixes: ['nvapi-'],
+        class: 'credential',
+        replacement: 'detection',
+        tokenStart: true,
+        pattern: /(?<![A-Za-z0-9])nvapi-[A-Za-z0-9_-]{40,}/g,
+    },
+    {
+        rule: 'replicate-api-token',
+        type: 'TOKEN',
+        prefixes: ['r8_'],
+        class: 'credential',
+        replacement: 'detection',
+        tokenStart: true,
+        pattern: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{30,}/g,
+    },
+    {
+        rule: 'jwt',
+        type: 'TOKEN',
+        class: 'credential',
+        replacement: 'detection',
+        pattern: /(?<![A-Za-z0-9_-])(?=((?:(?!eyJ)[A-Za-z0-9_-])*))\1(eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,})/dg,
+        valueGroup: 2,
+    },
+    {
+        rule: 'stripe-secret-key',
+        type: 'APIKEY',
+        prefixes: ['sk_live_', 'sk_test_'],
+        class: 'credential',
+        replacement: 'detection',
+        pattern: /sk_(?:live|test)_[0-9A-Za-z]{16,}/g,
+    },
+    {
+        rule: 'slack-token',
+        type: 'TOKEN',
+        prefixes: ['xoxb-', 'xoxp-', 'xoxa-', 'xoxr-', 'xoxs-'],
+        class: 'credential',
+        replacement: 'detection',
+        pattern: /xox[baprs]-[0-9A-Za-z-]{10,}/g,
+    },
+    {
+        rule: 'pem-private-key',
+        type: 'PRIVATEKEY',
+        class: 'credential',
+        pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g,
+        replacement: { through: pemBlockEnd },
+    },
+    {
+        rule: 'db-connection-uri',
+        type: 'DBURI',
+        class: 'credential',
+        replacement: 'detection',
+        pattern: /(?<![a-z0-9+.-])(?=((?:(?!\b[a-z])[a-z0-9+.-])*))\1(\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s:/@]+@)/dg,
+        valueGroup: 2,
+    },
+    {
+        rule: 'generic-assignment',
+        type: 'SECRET',
+        class: 'credential',
+        replacement: 'detection',
+        pattern: assignmentPattern({
+            keywords: ['password', 'passwd', 'pwd', 'secret', 'apiKey', 'accessToken', 'authToken'],
+            value: `['"]?([^'"\\s]{8,})['"]?`,
+        }, 'dgi'),
+        valueGroup: 1,
+        validator: looksLikeSecretValue,
+    },
+    {
+        rule: 'iban',
+        type: 'IBAN',
+        class: 'identifier',
+        replacement: 'detection',
+        pattern: /(?<![A-Za-z0-9])[A-Z]{2}[0-9]{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,3})?(?![A-Za-z0-9])/g,
+        validator: isValidIban,
+    },
+    {
+        rule: 'payment-card',
+        type: 'CARD',
+        class: 'identifier',
+        replacement: 'detection',
+        pattern: /(?<![0-9])[0-9](?:[ -]?[0-9]){12,18}(?![0-9])/g,
+        validator: passesLuhn,
+        context: {
+            words: /\b(?:card|credit|debit|visa|mastercard|amex|maestro|kreditkarte|karte|kartennummer|payment|zahlung)\b/i,
+            window: 48,
+        },
+    },
+    {
+        rule: 'email',
+        type: 'EMAIL',
+        class: 'identifier',
+        replacement: 'detection',
+        pattern: /(?<![A-Za-z0-9._%+\\-])[A-Za-z0-9][A-Za-z0-9._%+-]{0,63}@(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.){1,8}[A-Za-z]{2,24}(?![A-Za-z0-9-])/g,
+        exclusions: EMAIL_EXCLUSIONS,
+        validator: isReportableEmail,
+    },
+    {
+        rule: 'phone-international',
+        type: 'PHONE',
+        class: 'identifier',
+        replacement: 'detection',
+        pattern: /(?<![A-Za-z0-9+])\+[1-9][0-9]{0,2}(?:[ ./-]?(?:\([0-9]{1,6}\)|(?=([0-9]{1,6}))\1)){1,5}(?![0-9])/g,
+        validator: phoneDigits(8, 15),
+    },
+    {
+        rule: 'phone-national',
+        type: 'PHONE',
+        class: 'identifier',
+        replacement: 'detection',
+        pattern: /(?<![A-Za-z0-9+(])(?:\(0[1-9][0-9]{1,4}\)|0[1-9][0-9]{1,4})(?:[ ./-]?(?=([0-9]{2,8}))\1){1,3}(?![0-9])/g,
+        validator: phoneDigits(7, 13),
+        context: { words: /\b(?:tel|telefon|telephone|phone|mobil|mobile|cell|fax|handy|call|ruf)\b/i, window: 32 },
+    },
+    {
+        rule: 'phone-nanp',
+        type: 'PHONE',
+        class: 'identifier',
+        replacement: 'detection',
+        pattern: /(?<![A-Za-z0-9+(-])(?:\+?1[ .-]?)?(?:\([2-9][0-9]{2}\) ?|[2-9][0-9]{2}[ .-]?)[2-9][0-9]{2}[ .-]?[0-9]{4}(?![0-9-])/g,
+        context: { words: /\b(?:tel|telephone|phone|mobile|cell|fax|call)\b/i, window: 32 },
+    },
+    {
+        rule: 'de-tax-id',
+        type: 'TAXID',
+        class: 'identifier',
+        replacement: 'detection',
+        pattern: /(?<![0-9])[1-9](?: ?[0-9]){10}(?![0-9])/g,
+        validator: isValidGermanTaxId,
+        context: {
+            words: /\b(?:steuer-?id|steuer-?identifikationsnummer|identifikationsnummer|idnr|tax[ -]?id|tin)\b/i,
+            window: 48,
+        },
+    },
+    {
+        rule: 'us-ssn',
+        type: 'SSN',
+        class: 'identifier',
+        replacement: 'detection',
+        pattern: /(?<![0-9-])[0-9]{3}-[0-9]{2}-[0-9]{4}(?![0-9-])/g,
+        validator: isValidUsSsn,
+    },
+];
+// A value that is a type word, a literal, a language keyword or a credential
+// keyword itself (`password: 'password'`) is code, not a secret, whatever its key.
+const TYPE_WORD = /^(?:string|number|boolean|bigint|unknown|any|never|void|undefined|null|true|false|none|nil|new|typeof|keyof|await|async|function|const|let|var|return|this|self|class|import|require|readonly|export|default|yield|password|passwd|pwd|secret|token|bearer|api[_-]?key|apikey)$/i;
+/**
+ * A credential keyword is a key, not a suffix: `mytoken=` and `notsecret=` are
+ * other words that happen to end in one. A separator is not a letter, so
+ * `client_secret` and `api-key` still read as the keyword they contain.
+ */
+const KEY_START = '(?<![A-Za-z0-9])';
+/**
+ * One value, whichever delimiter bounds it, as four alternatives read in order
+ * by `valueGroup: [2, 3, 4, 5]`. The shape it replaces — an optional quote
+ * around a capture that forbade whitespace — matched `"correct` of
+ * `password = "correct horse battery staple"` and left the rest of the
+ * credential in the outbound body (council, 2026-10-21, both seats).
+ *
+ * A complete quoted value is captured without its quotes, so the validator
+ * still reads `password: 'password'` as the type word it is. An UNTERMINATED
+ * quote takes the rest of the line: its extent is unprovable, and the house
+ * rule for an unprovable extent is to cover too much rather than leave the
+ * value behind (`pemMaskEnd`). Each alternative is anchored at the same
+ * position and none can backtrack into another, so the shape stays linear.
+ */
+const QUOTED_OR_BARE_VALUE = `(?:"([^"\\n]*)"|'([^'\\n]*)'|["']([^\\n]+)|([^\\s'"]+))`;
+/**
+ * Credential shapes at a reviewer's threshold, for a surface that REPLACES a
+ * value it would otherwise have masked with its whole line (the council
+ * bundle, step 3.3). Not in EGRESS_RULES: a refusing surface or the commit
+ * scanner would refuse ordinary code on them. Any value after a credential
+ * keyword that is not a code expression or a type word, on the same line, and
+ * every byte after the colon of a line that opens with an `Authorization`
+ * header.
+ *
+ * The header row being HERE and not in EGRESS_RULES is a stated gap of the
+ * main table: an `Authorization: Bearer <opaque token>` with no vendor prefix
+ * and no JWT shape passes the replacing and refusing surfaces unchanged, and
+ * so does any value under the `token`, `bearer`, `clientSecret` or
+ * `privateKey` keywords, which no EGRESS_RULES row reads.
+ */
+export const REVIEW_CREDENTIAL_ROWS = [
+    {
+        rule: 'review-assignment',
+        type: 'SECRET',
+        class: 'credential',
+        replacement: 'detection',
+        pattern: assignmentPattern({
+            keywords: ['apiKey', 'secret', 'token', 'password'],
+            before: KEY_START,
+            capture: true,
+            gap: '[ \\t]*',
+            value: QUOTED_OR_BARE_VALUE,
+        }, 'dgi'),
+        valueGroup: [2, 3, 4, 5],
+        // Group 5 is the bare value. A quoted one is a literal, where `,` `$`
+        // or `.` is password punctuation rather than code, so only a bare value
+        // is read as a code expression.
+        validator: (v, g) => (g !== 5 || !CODE_EXPR.test(v)) && !TYPE_WORD.test(v),
+    },
+    {
+        rule: 'review-authorization-header',
+        type: 'TOKEN',
+        class: 'credential',
+        replacement: 'detection',
+        pattern: new RegExp(`^[ \\t]*${AUTHORIZATION_HEADER}:[ \\t]*(\\S[^\\n]*)`, 'dgim'),
+        valueGroup: 1,
+    },
+];
+/** The credential rows alone, for consumers whose verdict reads credentials only. */
+export const CREDENTIAL_RULES = EGRESS_RULES.filter((r) => r.class === 'credential');
+export const IDENTIFIER_RULES = EGRESS_RULES.filter((r) => r.class === 'identifier');
+/** Every raw-key prefix the table declares, longest first. */
+export const CREDENTIAL_PREFIXES = EGRESS_RULES.flatMap((r) => r.prefixes ?? []).sort((a, b) => b.length - a.length);
+/** The prefixes one row declares; throws on an unknown rule so a rename cannot go silent. */
+export function prefixesOf(rule) {
+    const row = EGRESS_RULES.find((r) => r.rule === rule);
+    if (row === undefined)
+        throw new Error(`egress rule ${rule}: no such row`);
+    return row.prefixes ?? [];
+}
+/** A row's first declared prefix — the shape a key file of that vendor starts with. */
+export function vendorPrefix(rule) {
+    const first = prefixesOf(rule)[0];
+    if (first === undefined)
+        throw new Error(`egress rule ${rule}: declares no prefix`);
+    return first;
+}
+const TOKEN_START_PREFIXES = new Set(EGRESS_RULES.filter((r) => r.tokenStart === true).flatMap((r) => r.prefixes ?? []));
+/**
+ * A raw-key prefix followed by at least `minTail` key characters. Coarser than
+ * the rows on purpose: it is for surfaces that refuse or mask on shape alone,
+ * where a short or truncated key must still be caught.
+ *
+ * `boundary: 'row'` (the default) holds a prefix to a token start exactly where
+ * its own row declares `tokenStart`, so the pattern never misses what the row
+ * would catch and a short prefix (`sk-`) does not fire inside a word.
+ * `boundary: 'never'` drops the token start for every prefix: it is for a
+ * consumer whose own pre-table reading matched mid-word, and dropping it there
+ * is what keeps that consumer from narrowing. `tail` narrows the key class.
+ */
+export function rawKeyPrefixPattern(minTail, prefixes = CREDENTIAL_PREFIXES, opts = {}) {
+    const alt = [...prefixes]
+        .sort((a, b) => b.length - a.length)
+        .map((p) => {
+        const lit = p.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        return opts.boundary !== 'never' && TOKEN_START_PREFIXES.has(p) ? `(?<![A-Za-z0-9])${lit}` : lit;
+    })
+        .join('|');
+    return new RegExp(`(?:${alt})[${opts.tail ?? 'A-Za-z0-9_-'}]{${minTail},}`, 'g');
+}
+/**
+ * End of the bytes a replacement of `span` must remove, or null when the row
+ * cannot prove it (the caller then decides: a refusing surface refuses, a
+ * masking surface masks the detection span).
+ */
+export function replacementEnd(text, span) {
+    const row = EGRESS_RULES.find((r) => r.rule === span.rule);
+    if (row === undefined)
+        return null;
+    if (row.replacement === 'detection')
+        return span.end;
+    const end = row.replacement.through(text, span);
+    return end === null || end < span.end ? null : end;
+}
+/**
+ * End of the bytes a MASKING surface removes for `span`. A surface that cannot
+ * refuse must not leave key material behind when the row cannot prove the extent:
+ * an unproven key block is masked through the nearest END marker of any label,
+ * and only a span with nothing better falls back to its detection span. Every
+ * masking consumer reads this, so the fallback is decided once.
+ */
+export function maskingEnd(text, span) {
+    return replacementEnd(text, span) ?? (span.rule === 'pem-private-key' ? pemMaskEnd(text, span) : null) ?? span.end;
+}
+/**
+ * Returns a description of the first unbounded quantifier (`+`, `*`, `{n,}`)
+ * outside a character class, or null. Escapes and classes are skipped.
+ */
+export function findUnboundedQuantifier(pattern) {
+    const src = pattern.source;
+    let inClass = false;
+    for (let i = 0; i < src.length; i++) {
+        const ch = src[i];
+        if (ch === '\\') {
+            i++;
+            continue;
+        }
+        if (inClass) {
+            if (ch === ']')
+                inClass = false;
+            continue;
+        }
+        if (ch === '[') {
+            inClass = true;
+            continue;
+        }
+        if (ch === '+' || ch === '*') {
+            return `'${ch}' at ${i}`;
+        }
+        if (ch === '{') {
+            const m = /^\{\d+,\}/.exec(src.slice(i));
+            if (m)
+                return `'${m[0]}' at ${i}`;
+        }
+    }
+    return null;
+}
+const CLASS_RANK = {
+    credential: 1,
+    identifier: 0,
+};
+/** A global or sticky regex keeps lastIndex between calls; reset it so every call tests the whole value. */
+function testWholeValue(re, value) {
+    re.lastIndex = 0;
+    return re.test(value);
+}
+/**
+ * Applies every field of a row to one regex match: value extraction from the
+ * engine's capture offsets, exclusions, the context window and the validator.
+ * The single place both readers of the table evaluate a candidate.
+ */
+/**
+ * The capture group this match put the value in. `'whole-match'` is a rule that
+ * declares none. `null` is a rule that declares alternatives and matched none
+ * of them — the match is then discarded, never silently read as the whole
+ * match, which would hand a replacer the keyword along with the value.
+ */
+function valueGroupOf(r, m) {
+    if (r.valueGroup === undefined)
+        return 'whole-match';
+    if (typeof r.valueGroup === 'number')
+        return r.valueGroup;
+    return r.valueGroup.find((g) => m[g] !== undefined) ?? null;
+}
+export function evaluateMatch(r, text, m) {
+    const group = valueGroupOf(r, m);
+    if (group === null)
+        return null;
+    const value = group === 'whole-match' ? m[0] : m[group];
+    if (value === undefined || value.length === 0)
+        return null;
+    const start = group === 'whole-match' ? m.index : (m.indices?.[group]?.[0] ?? -1);
+    if (start < 0) {
+        throw new Error(`egress rule ${r.rule}: a valueGroup rule needs the d flag for capture offsets`);
+    }
+    const end = start + value.length;
+    if (r.exclusions?.some((x) => testWholeValue(x, value)))
+        return null;
+    if (r.context) {
+        const lo = Math.max(0, start - r.context.window);
+        const hi = Math.min(text.length, end + r.context.window);
+        const around = text.slice(lo, start) + ' ' + text.slice(end, hi);
+        r.context.words.lastIndex = 0;
+        if (!r.context.words.test(around))
+            return null;
+    }
+    if (r.validator) {
+        return r.validator(value, group) ? { start, end, validated: true } : null;
+    }
+    return { start, end, validated: false };
+}
+/** Candidate spans per rule, before overlap resolution. */
+export function findSpans(text, rules = EGRESS_RULES) {
+    const out = [];
+    for (const r of rules) {
+        r.pattern.lastIndex = 0;
+        let m;
+        while ((m = r.pattern.exec(text)) !== null) {
+            if (m[0].length === 0) {
+                r.pattern.lastIndex += 1;
+                continue;
+            }
+            const c = evaluateMatch(r, text, m);
+            if (c === null)
+                continue;
+            const { start, end, validated } = c;
+            out.push({
+                rule: r.rule,
+                type: r.type,
+                class: r.class,
+                start,
+                end,
+                validated,
+            });
+        }
+    }
+    return out;
+}
+/**
+ * Resolves overlaps: the more sensitive class wins, then the validated span,
+ * then the longer one, then the earlier one. Result is ordered by start.
+ */
+export function resolveOverlaps(spans) {
+    const ranked = [...spans].sort((a, b) => CLASS_RANK[b.class] - CLASS_RANK[a.class] ||
+        Number(b.validated) - Number(a.validated) ||
+        b.end - b.start - (a.end - a.start) ||
+        a.start - b.start);
+    const kept = [];
+    for (const s of ranked) {
+        if (!kept.some((k) => s.start < k.end && k.start < s.end))
+            kept.push(s);
+    }
+    return kept.sort((a, b) => a.start - b.start);
+}
+export function detect(text, rules = EGRESS_RULES) {
+    return resolveOverlaps(findSpans(text, rules));
+}
+/**
+ * Replaces non-overlapping spans right to left, so every offset still refers
+ * to the original text. `index` is the span's position in start order.
+ */
+export function replaceSpans(text, spans, replacement) {
+    const ordered = [...spans].sort((a, b) => a.start - b.start);
+    for (let i = 1; i < ordered.length; i++) {
+        if (ordered[i].start < ordered[i - 1].end) {
+            throw new Error('replaceSpans: spans overlap; resolve them first');
+        }
+    }
+    let out = text;
+    for (let i = ordered.length - 1; i >= 0; i--) {
+        const s = ordered[i];
+        out = out.slice(0, s.start) + replacement(s, i) + out.slice(s.end);
+    }
+    return out;
+}
+export const DETECTION_CEILINGS = [];
+//# sourceMappingURL=egress_rules.js.map