@guardbee/guard-core 0.1.0 → 0.2.0

package/dist/cjs/pii.js

@@ -3,15 +3,64 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.PII_PATTERNS = void 0;
 exports.maskPiiInText = maskPiiInText;
 exports.maskPiiInValue = maskPiiInValue;
+const secrets_js_1 = require("./secrets.js");
 const validators_js_1 = require("./validators.js");
+const REPLACEMENT_BY_SECRET = {
+    jwt: "[JWT-TOKEN]",
+    db_url_postgres: "[CONNECTION-STRING]",
+    db_url_mysql: "[CONNECTION-STRING]",
+    db_url_mongodb: "[CONNECTION-STRING]",
+    db_url_redis: "[CONNECTION-STRING]",
+};
+/**
+ * Masking must cover the whole secret, where detection only needs a prefix:
+ * the scanner's Slack rule stops at the first `-`, which would leave the rest
+ * of `xoxb-<team>-<bot>-<secret>` in the output.
+ */
+const MASK_PATTERN_BY_SECRET = {
+    slack_token: /xox[baprs]-[0-9A-Za-z-]{10,}/g,
+};
+/** Provider formats from the secret scanner, minus the broad ones; each keeps its allowlist. */
+const SECRET_PATTERNS = secrets_js_1.SECRET_RULES.filter((rule) => !rule.broad).map((rule) => ({
+    name: rule.id,
+    pattern: MASK_PATTERN_BY_SECRET[rule.id] ?? rule.pattern,
+    replacement: REPLACEMENT_BY_SECRET[rule.id] ?? "[API-KEY]",
+    ...(rule.allowlist ? { validate: (match) => !rule.allowlist.some((allow) => allow.test(match)) } : {}),
+}));
 // Order matters: earlier patterns mask first, so later ones never see their digits.
+// Secrets run first — a key or connection string holds digit runs that would
+// otherwise be half-masked as a phone or card number.
 exports.PII_PATTERNS = [
+    {
+        // The whole block, not just the BEGIN line the code scanner reports.
+        name: "private_key",
+        pattern: /-----BEGIN (?:[A-Z]+ )*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?-----END (?:[A-Z]+ )*PRIVATE KEY(?: BLOCK)?-----/g,
+        replacement: "[PRIVATE-KEY]",
+    },
+    ...SECRET_PATTERNS,
+    {
+        // Unknown providers: a key-like prefix, a separator, then a run with both letters and digits.
+        name: "api_key",
+        pattern: /\b(?:sk|pk|api|key|token|secret)[-_][A-Za-z0-9]{16,}\b/gi,
+        replacement: "[API-KEY]",
+        validate: (match) => {
+            const value = match.replace(/^[A-Za-z]+[-_]/, "");
+            return /[A-Za-z]/.test(value) && /\d/.test(value);
+        },
+    },
     {
         name: "tc_kimlik",
         pattern: /\b[1-9]\d{10}\b/g,
         replacement: "[TC-KİMLİK]",
         validate: validators_js_1.isValidTcKimlik,
     },
+    {
+        // A bare 10-digit number is too common to call a tax number; require the label.
+        name: "vkn",
+        pattern: /(?<=\b(?:VKN|V\.K\.N\.?|[Vv]ergi\s+(?:[Kk]imlik\s+)?[Nn](?:o|umaras[ıi])\.?)\s*[:#]?\s*)\d{10}(?!\d)/g,
+        replacement: "[VKN]",
+        validate: validators_js_1.isValidVkn,
+    },
     {
         name: "iban",
         pattern: /\bTR\d{2}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{2}\b/gi,
@@ -31,18 +80,12 @@ exports.PII_PATTERNS = [
     },
     {
         name: "phone_tr",
-        pattern: /\b(?:\+90|0090|0)?[\s-]?(?:\d{3})[\s-]?\d{3}[\s-]?\d{2}[\s-]?\d{2}\b/g,
+        // Not glued to letters, `/` or `-` (ids in URLs), and either written with a
+        // +90 / 0 prefix or grouped with spaces/dashes: a bare 10-digit run is more
+        // often an id or an integer IP (2130706433) than a phone number.
+        pattern: /(?<![\w+/.#-])(?:(?:\+90|0090|0)[\s-]?)?\d{3}[\s-]?\d{3}[\s-]?\d{2}[\s-]?\d{2}(?![\w/-])/g,
         replacement: "+90-***-***-**[TELEFON]",
-    },
-    {
-        name: "api_key",
-        pattern: /\b(?:sk|pk|api|key|token|secret)[-_]?[A-Za-z0-9]{16,}\b/gi,
-        replacement: "[API-KEY]",
-    },
-    {
-        name: "jwt",
-        pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g,
-        replacement: "[JWT-TOKEN]",
+        validate: (match) => (0, validators_js_1.isValidTrPhone)(match) && (/^(?:\+90|0)/.test(match) || /[\s-]/.test(match)),
     },
 ];
 function maskPiiInText(text, replace) {

package/dist/cjs/pii.js.map

@@ -1 +1 @@
-{"version":3,"file":"pii.js","sourceRoot":"","sources":["../../src/pii.ts"],"names":[],"mappings":";;;AAuDA,sCAQC;AAED,wCAeC;AAhFD,mDAA4E;AAU5E,oFAAoF;AACvE,QAAA,YAAY,GAAiB;IACxC;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EAAE,aAAa;QAC1B,QAAQ,EAAE,+BAAe;KAC1B;IACD;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,iFAAiF;QAC1F,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,2BAAW;KACtB;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,uBAAuB;QACpC,QAAQ,EAAE,2BAAW;KACtB;IACD;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,sDAAsD;QAC/D,WAAW,EAAE,aAAa;KAC3B;IACD;QACE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,uEAAuE;QAChF,WAAW,EAAE,yBAAyB;KACvC;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,2DAA2D;QACpE,WAAW,EAAE,WAAW;KACzB;IACD;QACE,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,wDAAwD;QACjE,WAAW,EAAE,aAAa;KAC3B;CACF,CAAC;AAKF,SAAgB,aAAa,CAAC,IAAY,EAAE,OAAqB;IAC/D,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,oBAAY,EAAE,CAAC;QACpE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACzC,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,cAAc,CAAC,KAAc,EAAE,OAAqB;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"pii.js","sourceRoot":"","sources":["../../src/pii.ts"],"names":[],"mappings":";;;AAqGA,sCAQC;AAED,wCAeC;AA9HD,6CAA4C;AAC5C,mDAAwG;AAUxG,MAAM,qBAAqB,GAA2B;IACpD,GAAG,EAAE,aAAa;IAClB,eAAe,EAAE,qBAAqB;IACtC,YAAY,EAAE,qBAAqB;IACnC,cAAc,EAAE,qBAAqB;IACrC,YAAY,EAAE,qBAAqB;CACpC,CAAC;AAEF;;;;GAIG;AACH,MAAM,sBAAsB,GAA2B;IACrD,WAAW,EAAE,+BAA+B;CAC7C,CAAC;AAEF,gGAAgG;AAChG,MAAM,eAAe,GAAiB,yBAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9F,IAAI,EAAE,IAAI,CAAC,EAAE;IACb,OAAO,EAAE,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO;IACxD,WAAW,EAAE,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,WAAW;IAC1D,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAChH,CAAC,CAAC,CAAC;AAEJ,oFAAoF;AACpF,6EAA6E;AAC7E,sDAAsD;AACzC,QAAA,YAAY,GAAiB;IACxC;QACE,qEAAqE;QACrE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,6GAA6G;QACtH,WAAW,EAAE,eAAe;KAC7B;IACD,GAAG,eAAe;IAClB;QACE,8FAA8F;QAC9F,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,0DAA0D;QACnE,WAAW,EAAE,WAAW;QACxB,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;YAClD,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;KACF;IACD;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EAAE,aAAa;QAC1B,QAAQ,EAAE,+BAAe;KAC1B;IACD;QACE,gFAAgF;QAChF,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,uGAAuG;QAChH,WAAW,EAAE,OAAO;QACpB,QAAQ,EAAE,0BAAU;KACrB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,iFAAiF;QAC1F,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,2BAAW;KACtB;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,uBAAuB;QACpC,QAAQ,EAAE,2BAAW;KACtB;IACD;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,sDAAsD;QAC/D,WAAW,EAAE,aAAa;KAC3B;IACD;QACE,IAAI,EAAE,UAAU;QAChB,4EAA4E;QAC5E,4EAA4E;QAC5E,iEAAiE;QACjE,OAAO,EAAE,2FAA2F;QACpG,WAAW,EAAE,yBAAyB;QACtC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,8BAAc,EAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;KACjG;CACF,CAAC;AAKF,SAAgB,aAAa,CAAC,IAAY,EAAE,OAAqB;IAC/D,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,oBAAY,EAAE,CAAC;QACpE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACzC,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,cAAc,CAAC,KAAc,EAAE,OAAqB;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cjs/secrets.d.ts

@@ -0,0 +1,18 @@
+export interface SecretRule {
+    id: string;
+    name: string;
+    pattern: RegExp;
+    severity: "critical" | "high" | "medium" | "low";
+    allowlist?: RegExp[];
+    skipPlaceholderCheck?: boolean;
+    lowerSeverityInTestFiles?: boolean;
+    /**
+     * Format-agnostic or not actually secret (a keyword + any quoted string, any
+     * 40-character base64 run, a publishable key). Fine for a code scanner that
+     * shows the finding to a person; the runtime proxy does not mask on these,
+     * because a false match would also mark the session as holding sensitive data.
+     */
+    broad?: boolean;
+}
+export declare const SECRET_RULES: SecretRule[];
+//# sourceMappingURL=secrets.d.ts.map

package/dist/cjs/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/secrets.ts"],"names":[],"mappings":"AACA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAMrB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAK/B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,eAAO,MAAM,YAAY,EAAE,UAAU,EA2RpC,CAAC"}

package/dist/cjs/secrets.js

@@ -0,0 +1,278 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECRET_RULES = void 0;
+exports.SECRET_RULES = [
+    // ── Cloud providers ────────────────────────────────────────────────────────
+    {
+        id: "aws_access_key",
+        name: "AWS Access Key ID",
+        pattern: /\b(AKIA|ABIA|ACCA|AIPA|AKIA|ANPA|ANVA|APKA)[0-9A-Z]{16}\b/g,
+        severity: "critical",
+    },
+    {
+        id: "aws_secret_key",
+        broad: true,
+        name: "AWS Secret Access Key",
+        pattern: /(?<![A-Za-z0-9/+])([A-Za-z0-9/+]{40})(?![A-Za-z0-9/+])/g,
+        severity: "critical",
+        allowlist: [/^[A-Za-z0-9+/]{40}={0,2}$/], // base64 payloads
+    },
+    {
+        id: "google_api_key",
+        name: "Google API Key",
+        pattern: /AIza[0-9A-Za-z\-_]{35}/g,
+        severity: "critical",
+    },
+    {
+        id: "google_oauth",
+        name: "Google OAuth Client Secret",
+        pattern: /GOCSPX-[0-9A-Za-z\-_]{28}/g,
+        severity: "critical",
+    },
+    // ── Version control & CI ───────────────────────────────────────────────────
+    {
+        id: "github_pat",
+        name: "GitHub Personal Access Token",
+        pattern: /ghp_[0-9A-Za-z]{36}/g,
+        severity: "critical",
+    },
+    {
+        id: "github_oauth",
+        name: "GitHub OAuth Token",
+        pattern: /gho_[0-9A-Za-z]{36}/g,
+        severity: "critical",
+    },
+    {
+        id: "github_app_token",
+        name: "GitHub App Token",
+        pattern: /ghs_[0-9A-Za-z]{36}/g,
+        severity: "critical",
+    },
+    {
+        id: "github_refresh_token",
+        name: "GitHub Refresh Token",
+        pattern: /ghr_[0-9A-Za-z]{36}/g,
+        severity: "high",
+    },
+    {
+        id: "gitlab_pat",
+        name: "GitLab Personal Access Token",
+        pattern: /glpat-[0-9A-Za-z\-_]{20}/g,
+        severity: "critical",
+    },
+    // ── Payment ────────────────────────────────────────────────────────────────
+    {
+        id: "stripe_secret",
+        name: "Stripe Secret Key (live)",
+        pattern: /sk_live_[0-9A-Za-z]{24,}/g,
+        severity: "critical",
+    },
+    {
+        id: "stripe_secret_test",
+        // Stripe'ın kendi dokümantasyonu test-mode key'lerini kod örneklerine
+        // gömmenin güvenli olduğunu belirtiyor — gerçek parasal etkisi yok,
+        // sadece sandbox hesabına erişim. Yine de görünürlük için raporlanıyor.
+        name: "Stripe Secret Key (test mode)",
+        pattern: /sk_test_[0-9A-Za-z]{24,}/g,
+        severity: "low",
+    },
+    {
+        id: "stripe_publishable",
+        broad: true,
+        name: "Stripe Publishable Key",
+        pattern: /pk_(live|test)_[0-9A-Za-z]{24,}/g,
+        severity: "medium",
+    },
+    {
+        id: "stripe_restricted",
+        name: "Stripe Restricted Key (live)",
+        pattern: /rk_live_[0-9A-Za-z]{24,}/g,
+        severity: "critical",
+    },
+    {
+        id: "stripe_restricted_test",
+        name: "Stripe Restricted Key (test mode)",
+        pattern: /rk_test_[0-9A-Za-z]{24,}/g,
+        severity: "low",
+    },
+    // ── AI / ML ────────────────────────────────────────────────────────────────
+    {
+        id: "openai_key",
+        name: "OpenAI API Key",
+        pattern: /sk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}/g,
+        severity: "critical",
+    },
+    {
+        id: "openai_key_v2",
+        name: "OpenAI API Key (v2)",
+        pattern: /sk-proj-[A-Za-z0-9\-_]{50,}/g,
+        severity: "critical",
+    },
+    {
+        id: "anthropic_key",
+        name: "Anthropic API Key",
+        pattern: /sk-ant-[A-Za-z0-9\-_]{32,}/g,
+        severity: "critical",
+    },
+    {
+        id: "huggingface_token",
+        name: "HuggingFace Token",
+        pattern: /hf_[A-Za-z0-9]{34}/g,
+        severity: "high",
+    },
+    // ── Communication ──────────────────────────────────────────────────────────
+    {
+        id: "slack_token",
+        name: "Slack Token",
+        pattern: /xox[baprs]-([0-9a-zA-Z]{10,48})/g,
+        severity: "critical",
+    },
+    {
+        id: "slack_webhook",
+        name: "Slack Webhook URL",
+        pattern: /https:\/\/hooks\.slack\.com\/services\/T[0-9A-Z]{8}\/B[0-9A-Z]{8}\/[0-9a-zA-Z]{24}/g,
+        severity: "high",
+    },
+    {
+        id: "twilio_account_sid",
+        broad: true,
+        name: "Twilio Account SID",
+        pattern: /AC[0-9a-f]{32}/g,
+        severity: "high",
+    },
+    {
+        id: "twilio_auth_token",
+        name: "Twilio Auth Token",
+        pattern: /[Tt][Ww][Ii][Ll][Ii][Oo].{0,20}[0-9a-f]{32}/g,
+        severity: "critical",
+    },
+    {
+        id: "sendgrid_key",
+        name: "SendGrid API Key",
+        pattern: /SG\.[0-9A-Za-z\-_]{22}\.[0-9A-Za-z\-_]{43}/g,
+        severity: "critical",
+    },
+    // ── Database URLs ──────────────────────────────────────────────────────────
+    {
+        id: "db_url_postgres",
+        name: "PostgreSQL Connection String with credentials",
+        pattern: /postgres(?:ql)?:\/\/[^:]+:[^@\s]+@[^\s"']+/gi,
+        severity: "critical",
+        allowlist: [/localhost/, /127\.0\.0\.1/, /\$\{/, /<[^<>]{1,80}>/],
+        skipPlaceholderCheck: true,
+    },
+    {
+        id: "db_url_mysql",
+        name: "MySQL Connection String with credentials",
+        pattern: /mysql:\/\/[^:]+:[^@\s]+@[^\s"']+/gi,
+        severity: "critical",
+        allowlist: [/localhost/, /127\.0\.0\.1/, /\$\{/, /<[^<>]{1,80}>/],
+        skipPlaceholderCheck: true,
+    },
+    {
+        id: "db_url_mongodb",
+        name: "MongoDB Connection String with credentials",
+        pattern: /mongodb(?:\+srv)?:\/\/[^:]+:[^@\s]+@[^\s"']+/gi,
+        severity: "critical",
+        allowlist: [/localhost/, /127\.0\.0\.1/, /\$\{/, /<[^<>]{1,80}>/],
+        skipPlaceholderCheck: true,
+    },
+    {
+        id: "db_url_redis",
+        name: "Redis Connection String with credentials",
+        pattern: /redis:\/\/[^:]+:[^@\s]+@[^\s"']+/gi,
+        severity: "high",
+        allowlist: [/localhost/, /127\.0\.0\.1/, /\$\{/, /<[^<>]{1,80}>/],
+        skipPlaceholderCheck: true,
+    },
+    // ── Private keys ───────────────────────────────────────────────────────────
+    {
+        id: "private_key_rsa",
+        name: "RSA Private Key",
+        pattern: /-----BEGIN RSA PRIVATE KEY-----/g,
+        severity: "critical",
+    },
+    {
+        id: "private_key_ec",
+        name: "EC Private Key",
+        pattern: /-----BEGIN EC PRIVATE KEY-----/g,
+        severity: "critical",
+    },
+    {
+        id: "private_key_openssh",
+        name: "OpenSSH Private Key",
+        pattern: /-----BEGIN OPENSSH PRIVATE KEY-----/g,
+        severity: "critical",
+    },
+    {
+        id: "private_key_generic",
+        name: "Generic Private Key",
+        pattern: /-----BEGIN PRIVATE KEY-----/g,
+        severity: "critical",
+    },
+    {
+        id: "pgp_private_key",
+        name: "PGP Private Key Block",
+        pattern: /-----BEGIN PGP PRIVATE KEY BLOCK-----/g,
+        severity: "critical",
+    },
+    // ── Auth tokens & JWTs ─────────────────────────────────────────────────────
+    {
+        id: "jwt",
+        name: "JSON Web Token",
+        pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g,
+        severity: "high",
+    },
+    {
+        id: "bearer_token",
+        broad: true,
+        name: "Bearer Token in code",
+        // Gerçek bearer token'lar (JWT, OAuth2 opak token) neredeyse hiç 20
+        // karakterin altına inmez — testlerdeki "Bearer alpha"/"Bearer test-token"
+        // gibi kısa sahte değerleri eleyip gürültüyü büyük ölçüde azaltıyor.
+        pattern: /['"](Bearer\s+[A-Za-z0-9\-._~+/]{20,}=*)['"]/gi,
+        severity: "high",
+        lowerSeverityInTestFiles: true,
+    },
+    // ── DevOps & infra ─────────────────────────────────────────────────────────
+    {
+        id: "npm_token",
+        name: "npm Access Token",
+        pattern: /npm_[A-Za-z0-9]{36}/g,
+        severity: "critical",
+    },
+    {
+        id: "docker_pat",
+        name: "Docker Hub Personal Access Token",
+        pattern: /dckr_pat_[A-Za-z0-9\-_]{27}/g,
+        severity: "high",
+    },
+    {
+        id: "vercel_token",
+        broad: true,
+        name: "Vercel API Token",
+        pattern: /vercel(?:[._-])?(?:token|api)['":\s=]+([A-Za-z0-9]{24})/gi,
+        severity: "high",
+    },
+    // ── Generic patterns ───────────────────────────────────────────────────────
+    {
+        id: "generic_secret_assignment",
+        broad: true,
+        name: "Hardcoded secret assignment",
+        pattern: /(?:password|passwd|secret|api[_-]?key|auth[_-]?token|access[_-]?token|private[_-]?key)\s*[:=]\s*['"][^'"]{8,}['"]/gi,
+        severity: "medium",
+        allowlist: [
+            /process\.env/,
+            /\$\{/,
+            /os\.environ/,
+            /getenv/,
+            /placeholder/i,
+            /example/i,
+            /your[-_]?/i,
+            /<[^<>]{1,80}>/,
+            /\*{3,}/,
+        ],
+        lowerSeverityInTestFiles: true,
+    },
+];
+//# sourceMappingURL=secrets.js.map

package/dist/cjs/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/secrets.ts"],"names":[],"mappings":";;;AA2Ba,QAAA,YAAY,GAAiB;IACxC,8EAA8E;IAC9E;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,4DAA4D;QACrE,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,yDAAyD;QAClE,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,2BAA2B,CAAC,EAAE,kBAAkB;KAC7D;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,UAAU;KACrB;IAED,8EAA8E;IAC9E;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,UAAU;KACrB;IAED,8EAA8E;IAC9E;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,sEAAsE;QACtE,oEAAoE;QACpE,wEAAwE;QACxE,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,mCAAmC;QACzC,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,KAAK;KAChB;IAED,8EAA8E;IAC9E;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,4CAA4C;QACrD,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,6BAA6B;QACtC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE,MAAM;KACjB;IAED,8EAA8E;IAC9E;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,qFAAqF;QAC9F,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,8CAA8C;QACvD,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,6CAA6C;QACtD,QAAQ,EAAE,UAAU;KACrB;IAED,8EAA8E;IAC9E;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,+CAA+C;QACrD,OAAO,EAAE,8CAA8C;QACvD,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,CAAC;QACjE,oBAAoB,EAAE,IAAI;KAC3B;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,0CAA0C;QAChD,OAAO,EAAE,oCAAoC;QAC7C,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,CAAC;QACjE,oBAAoB,EAAE,IAAI;KAC3B;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,4CAA4C;QAClD,OAAO,EAAE,gDAAgD;QACzD,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,CAAC;QACjE,oBAAoB,EAAE,IAAI;KAC3B;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,0CAA0C;QAChD,OAAO,EAAE,oCAAoC;QAC7C,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,CAAC;QACjE,oBAAoB,EAAE,IAAI;KAC3B;IAED,8EAA8E;IAC9E;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,iCAAiC;QAC1C,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,wCAAwC;QACjD,QAAQ,EAAE,UAAU;KACrB;IAED,8EAA8E;IAC9E;QACE,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,wDAAwD;QACjE,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,sBAAsB;QAC5B,oEAAoE;QACpE,2EAA2E;QAC3E,qEAAqE;QACrE,OAAO,EAAE,gDAAgD;QACzD,QAAQ,EAAE,MAAM;QAChB,wBAAwB,EAAE,IAAI;KAC/B;IAED,8EAA8E;IAC9E;QACE,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,2DAA2D;QACpE,QAAQ,EAAE,MAAM;KACjB;IAED,8EAA8E;IAC9E;QACE,EAAE,EAAE,2BAA2B;QAC/B,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,6BAA6B;QACnC,OAAO,EACL,qHAAqH;QACvH,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE;YACT,cAAc;YACd,MAAM;YACN,aAAa;YACb,QAAQ;YACR,cAAc;YACd,UAAU;YACV,YAAY;YACZ,eAAe;YACf,QAAQ;SACT;QACD,wBAAwB,EAAE,IAAI;KAC/B;CACF,CAAC"}

package/dist/cjs/validators.d.ts

@@ -4,4 +4,12 @@ export declare function isValidTcKimlik(raw: string): boolean;
 export declare function isValidLuhn(raw: string): boolean;
 /** IBAN mod-97 checksum (ISO 7064 MOD97-10), computed in chunks to avoid precision loss. */
 export declare function isValidIban(raw: string): boolean;
+/** Turkish tax number (Vergi Kimlik No, 10 digits) — the Gelir İdaresi check-digit algorithm. */
+export declare function isValidVkn(raw: string): boolean;
+/**
+ * Turkish phone number: after an optional +90 / 0090 / 0 prefix, 10 digits
+ * starting with a mobile (5xx), landline (2xx–4xx) or 850 code. Any other
+ * 10-digit run (an order number) is not a phone number.
+ */
+export declare function isValidTrPhone(raw: string): boolean;
 //# sourceMappingURL=validators.d.ts.map

package/dist/cjs/validators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../../src/validators.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAUpD;AAED,6CAA6C;AAC7C,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAehD;AAED,4FAA4F;AAC5F,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAUhD"}
+{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../../src/validators.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAUpD;AAED,6CAA6C;AAC7C,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAehD;AAED,4FAA4F;AAC5F,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAUhD;AAED,iGAAiG;AACjG,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAU/C;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMnD"}

package/dist/cjs/validators.js

@@ -4,6 +4,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.isValidTcKimlik = isValidTcKimlik;
 exports.isValidLuhn = isValidLuhn;
 exports.isValidIban = isValidIban;
+exports.isValidVkn = isValidVkn;
+exports.isValidTrPhone = isValidTrPhone;
 /** Turkish national ID (TC Kimlik No) checksum — the standard 11-digit algorithm. */
 function isValidTcKimlik(raw) {
     const d = raw.replace(/\D/g, "");
@@ -49,4 +51,32 @@ function isValidIban(raw) {
     }
     return Number(remainder) === 1;
 }
+/** Turkish tax number (Vergi Kimlik No, 10 digits) — the Gelir İdaresi check-digit algorithm. */
+function isValidVkn(raw) {
+    const d = raw.replace(/\D/g, "");
+    if (d.length !== 10)
+        return false;
+    const digits = d.split("").map(Number);
+    let sum = 0;
+    for (let i = 0; i < 9; i++) {
+        const tmp = (digits[i] + 10 - (i + 1)) % 10;
+        sum += tmp === 9 ? 9 : (tmp * 2 ** (10 - (i + 1))) % 9;
+    }
+    return (10 - (sum % 10)) % 10 === digits[9];
+}
+/**
+ * Turkish phone number: after an optional +90 / 0090 / 0 prefix, 10 digits
+ * starting with a mobile (5xx), landline (2xx–4xx) or 850 code. Any other
+ * 10-digit run (an order number) is not a phone number.
+ */
+function isValidTrPhone(raw) {
+    let d = raw.replace(/\D/g, "");
+    if (d.startsWith("0090"))
+        d = d.slice(4);
+    else if (d.startsWith("90") && d.length === 12)
+        d = d.slice(2);
+    else if (d.startsWith("0") && d.length === 11)
+        d = d.slice(1);
+    return d.length === 10 && /^(?:5\d|[234][1-9]|850)/.test(d);
+}
 //# sourceMappingURL=validators.js.map

package/dist/cjs/validators.js.map

@@ -1 +1 @@
-{"version":3,"file":"validators.js","sourceRoot":"","sources":["../../src/validators.ts"],"names":[],"mappings":";AAAA,6EAA6E;;AAG7E,0CAUC;AAGD,kCAeC;AAGD,kCAUC;AA1CD,qFAAqF;AACrF,SAAgB,eAAe,CAAC,GAAW;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,UAAU,GAAG,EAAE,CAAC;IAC5B,OAAO,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,6CAA6C;AAC7C,SAAgB,WAAW,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,GAAG,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,GAAG,IAAI,KAAK,CAAC;QACb,MAAM,GAAG,CAAC,MAAM,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,4FAA4F;AAC5F,SAAgB,WAAW,CAAC,GAAW;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAClF,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,SAAS,GAAG,CAAC,MAAM,CAAC,SAAS,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC"}
+{"version":3,"file":"validators.js","sourceRoot":"","sources":["../../src/validators.ts"],"names":[],"mappings":";AAAA,6EAA6E;;AAG7E,0CAUC;AAGD,kCAeC;AAGD,kCAUC;AAGD,gCAUC;AAOD,wCAMC;AApED,qFAAqF;AACrF,SAAgB,eAAe,CAAC,GAAW;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,UAAU,GAAG,EAAE,CAAC;IAC5B,OAAO,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,6CAA6C;AAC7C,SAAgB,WAAW,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,GAAG,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,GAAG,IAAI,KAAK,CAAC;QACb,MAAM,GAAG,CAAC,MAAM,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,4FAA4F;AAC5F,SAAgB,WAAW,CAAC,GAAW;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAClF,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,SAAS,GAAG,CAAC,MAAM,CAAC,SAAS,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,iGAAiG;AACjG,SAAgB,UAAU,CAAC,GAAW;IACpC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC5C,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACpC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC1D,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/index.d.ts

@@ -1,8 +1,10 @@
-export { isValidTcKimlik, isValidLuhn, isValidIban } from "./validators.js";
+export { isValidTcKimlik, isValidLuhn, isValidIban, isValidVkn, isValidTrPhone } from "./validators.js";
 export { PII_PATTERNS, maskPiiInText, maskPiiInValue } from "./pii.js";
 export type { PiiPattern, PiiReplacer } from "./pii.js";
-export { INJECTION_PATTERNS, scanForPromptInjection, scanToolResult } from "./injection.js";
-export type { ScanResult } from "./injection.js";
+export { SECRET_RULES } from "./secrets.js";
+export type { SecretRule } from "./secrets.js";
+export { INJECTION_RULES, INJECTION_PATTERNS, findInjections, scanForPromptInjection, scanToolResult, } from "./injection.js";
+export type { ScanResult, InjectionRule, InjectionCategory, InjectionFinding } from "./injection.js";
 export { CAPABILITY_RULES, classifyTool, textOf } from "./classify.js";
 export type { Capability, FlowCategory, ToolRecord } from "./classify.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5F,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -1,5 +1,6 @@
-export { isValidTcKimlik, isValidLuhn, isValidIban } from "./validators.js";
+export { isValidTcKimlik, isValidLuhn, isValidIban, isValidVkn, isValidTrPhone } from "./validators.js";
 export { PII_PATTERNS, maskPiiInText, maskPiiInValue } from "./pii.js";
-export { INJECTION_PATTERNS, scanForPromptInjection, scanToolResult } from "./injection.js";
+export { SECRET_RULES } from "./secrets.js";
+export { INJECTION_RULES, INJECTION_PATTERNS, findInjections, scanForPromptInjection, scanToolResult, } from "./injection.js";
 export { CAPABILITY_RULES, classifyTool, textOf } from "./classify.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAEvE,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAE5F,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAEvE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC"}

package/dist/injection.d.ts

@@ -7,8 +7,53 @@ export type ScanResult = {
     action: "warn";
     reason: string;
 };
+export type InjectionCategory = "instruction-override" | "role-spoofing" | "hidden-text" | "direct-address" | "exfiltration";
+export interface InjectionRule {
+    id: string;
+    name: string;
+    category: InjectionCategory;
+    /** Always global (`g`): callers iterate matches. */
+    pattern: RegExp;
+    severity: "critical" | "high" | "medium" | "low";
+    /** Why it is risky and what to do — shown with a finding. */
+    recommendation: string;
+    /**
+     * A generic phrase that also shows up in ordinary text ("act as", "developer
+     * mode"). Never blocks a call, only warns; the static scanner skips it.
+     */
+    broad?: boolean;
+}
+/**
+ * Content that will reach a model: a tool result, a RAG chunk, a scraped page.
+ * Regexes are heuristics that aim for few false positives, not an intent model.
+ * The precise rules come from prompt-injection-scanner; the broad ones are the
+ * phrases security-proxy 0.x blocked on.
+ */
+export declare const INJECTION_RULES: InjectionRule[];
+/** @deprecated The bare regexes of INJECTION_RULES; use INJECTION_RULES. */
 export declare const INJECTION_PATTERNS: RegExp[];
+export interface InjectionFinding {
+    ruleId: string;
+    name: string;
+    category: InjectionCategory;
+    severity: InjectionRule["severity"];
+    broad: boolean;
+    match: string;
+    index: number;
+    /** Set when the phrase was found inside a decoded base64 run. */
+    encoding?: "base64";
+}
+/**
+ * Every rule match in the text, plus precise-rule matches inside base64 runs
+ * that decode to text (an instruction hidden from both the reader and a plain
+ * pattern scan).
+ */
+export declare function findInjections(text: string): InjectionFinding[];
+/**
+ * A precise high/critical rule → `mode` (block or warn). A broad or medium
+ * rule alone → warn, never block.
+ */
 export declare function scanForPromptInjection(input: unknown, mode?: "block" | "warn"): ScanResult;
-/** Same patterns as request scanning, applied to a tool result the model will read. */
+/** Same rules as request scanning, applied to a tool result the model will read. */
 export declare function scanToolResult(content: unknown, mode?: "block" | "warn"): ScanResult;
 //# sourceMappingURL=injection.d.ts.map

package/dist/injection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"injection.d.ts","sourceRoot":"","sources":["../src/injection.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAClB;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAGvC,eAAO,MAAM,kBAAkB,EAAE,MAAM,EAiBtC,CAAC;AAUF,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,OAAO,GAAG,MAAgB,GAC/B,UAAU,CAaZ;AAED,uFAAuF;AACvF,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,GAAE,OAAO,GAAG,MAAgB,GAAG,UAAU,CAO7F"}
+{"version":3,"file":"injection.d.ts","sourceRoot":"","sources":["../src/injection.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAClB;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,MAAM,MAAM,iBAAiB,GACzB,sBAAsB,GACtB,eAAe,GACf,aAAa,GACb,gBAAgB,GAChB,cAAc,CAAC;AAEnB,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,6DAA6D;IAC7D,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAiQ1C,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,EAAE,MAAM,EAAgD,CAAC;AAExF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAsCD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAK/D;AAiBD;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,OAAO,GAAG,MAAgB,GAC/B,UAAU,CASZ;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,GAAE,OAAO,GAAG,MAAgB,GAAG,UAAU,CAO7F"}