@guardbee/guard-core 0.1.0 → 0.2.1

package/dist/secrets.js

@@ -0,0 +1,275 @@
+export const SECRET_RULES = [
+    // ── Cloud providers ────────────────────────────────────────────────────────
+    {
+        id: "aws_access_key",
+        name: "AWS Access Key ID",
+        pattern: /\b(AKIA|ABIA|ACCA|AIPA|AKIA|ANPA|ANVA|APKA)[0-9A-Z]{16}\b/g,
+        severity: "critical",
+    },
+    {
+        id: "aws_secret_key",
+        broad: true,
+        name: "AWS Secret Access Key",
+        pattern: /(?<![A-Za-z0-9/+])([A-Za-z0-9/+]{40})(?![A-Za-z0-9/+])/g,
+        severity: "critical",
+        allowlist: [/^[A-Za-z0-9+/]{40}={0,2}$/], // base64 payloads
+    },
+    {
+        id: "google_api_key",
+        name: "Google API Key",
+        pattern: /AIza[0-9A-Za-z\-_]{35}/g,
+        severity: "critical",
+    },
+    {
+        id: "google_oauth",
+        name: "Google OAuth Client Secret",
+        pattern: /GOCSPX-[0-9A-Za-z\-_]{28}/g,
+        severity: "critical",
+    },
+    // ── Version control & CI ───────────────────────────────────────────────────
+    {
+        id: "github_pat",
+        name: "GitHub Personal Access Token",
+        pattern: /ghp_[0-9A-Za-z]{36}/g,
+        severity: "critical",
+    },
+    {
+        id: "github_oauth",
+        name: "GitHub OAuth Token",
+        pattern: /gho_[0-9A-Za-z]{36}/g,
+        severity: "critical",
+    },
+    {
+        id: "github_app_token",
+        name: "GitHub App Token",
+        pattern: /ghs_[0-9A-Za-z]{36}/g,
+        severity: "critical",
+    },
+    {
+        id: "github_refresh_token",
+        name: "GitHub Refresh Token",
+        pattern: /ghr_[0-9A-Za-z]{36}/g,
+        severity: "high",
+    },
+    {
+        id: "gitlab_pat",
+        name: "GitLab Personal Access Token",
+        pattern: /glpat-[0-9A-Za-z\-_]{20}/g,
+        severity: "critical",
+    },
+    // ── Payment ────────────────────────────────────────────────────────────────
+    {
+        id: "stripe_secret",
+        name: "Stripe Secret Key (live)",
+        pattern: /sk_live_[0-9A-Za-z]{24,}/g,
+        severity: "critical",
+    },
+    {
+        id: "stripe_secret_test",
+        // Stripe'ın kendi dokümantasyonu test-mode key'lerini kod örneklerine
+        // gömmenin güvenli olduğunu belirtiyor — gerçek parasal etkisi yok,
+        // sadece sandbox hesabına erişim. Yine de görünürlük için raporlanıyor.
+        name: "Stripe Secret Key (test mode)",
+        pattern: /sk_test_[0-9A-Za-z]{24,}/g,
+        severity: "low",
+    },
+    {
+        id: "stripe_publishable",
+        broad: true,
+        name: "Stripe Publishable Key",
+        pattern: /pk_(live|test)_[0-9A-Za-z]{24,}/g,
+        severity: "medium",
+    },
+    {
+        id: "stripe_restricted",
+        name: "Stripe Restricted Key (live)",
+        pattern: /rk_live_[0-9A-Za-z]{24,}/g,
+        severity: "critical",
+    },
+    {
+        id: "stripe_restricted_test",
+        name: "Stripe Restricted Key (test mode)",
+        pattern: /rk_test_[0-9A-Za-z]{24,}/g,
+        severity: "low",
+    },
+    // ── AI / ML ────────────────────────────────────────────────────────────────
+    {
+        id: "openai_key",
+        name: "OpenAI API Key",
+        pattern: /sk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}/g,
+        severity: "critical",
+    },
+    {
+        id: "openai_key_v2",
+        name: "OpenAI API Key (v2)",
+        pattern: /sk-proj-[A-Za-z0-9\-_]{50,}/g,
+        severity: "critical",
+    },
+    {
+        id: "anthropic_key",
+        name: "Anthropic API Key",
+        pattern: /sk-ant-[A-Za-z0-9\-_]{32,}/g,
+        severity: "critical",
+    },
+    {
+        id: "huggingface_token",
+        name: "HuggingFace Token",
+        pattern: /hf_[A-Za-z0-9]{34}/g,
+        severity: "high",
+    },
+    // ── Communication ──────────────────────────────────────────────────────────
+    {
+        id: "slack_token",
+        name: "Slack Token",
+        pattern: /xox[baprs]-([0-9a-zA-Z]{10,48})/g,
+        severity: "critical",
+    },
+    {
+        id: "slack_webhook",
+        name: "Slack Webhook URL",
+        pattern: /https:\/\/hooks\.slack\.com\/services\/T[0-9A-Z]{8}\/B[0-9A-Z]{8}\/[0-9a-zA-Z]{24}/g,
+        severity: "high",
+    },
+    {
+        id: "twilio_account_sid",
+        broad: true,
+        name: "Twilio Account SID",
+        pattern: /AC[0-9a-f]{32}/g,
+        severity: "high",
+    },
+    {
+        id: "twilio_auth_token",
+        name: "Twilio Auth Token",
+        pattern: /[Tt][Ww][Ii][Ll][Ii][Oo].{0,20}[0-9a-f]{32}/g,
+        severity: "critical",
+    },
+    {
+        id: "sendgrid_key",
+        name: "SendGrid API Key",
+        pattern: /SG\.[0-9A-Za-z\-_]{22}\.[0-9A-Za-z\-_]{43}/g,
+        severity: "critical",
+    },
+    // ── Database URLs ──────────────────────────────────────────────────────────
+    {
+        id: "db_url_postgres",
+        name: "PostgreSQL Connection String with credentials",
+        pattern: /postgres(?:ql)?:\/\/[^:]+:[^@\s]+@[^\s"']+/gi,
+        severity: "critical",
+        allowlist: [/localhost/, /127\.0\.0\.1/, /\$\{/, /<[^<>]{1,80}>/],
+        skipPlaceholderCheck: true,
+    },
+    {
+        id: "db_url_mysql",
+        name: "MySQL Connection String with credentials",
+        pattern: /mysql:\/\/[^:]+:[^@\s]+@[^\s"']+/gi,
+        severity: "critical",
+        allowlist: [/localhost/, /127\.0\.0\.1/, /\$\{/, /<[^<>]{1,80}>/],
+        skipPlaceholderCheck: true,
+    },
+    {
+        id: "db_url_mongodb",
+        name: "MongoDB Connection String with credentials",
+        pattern: /mongodb(?:\+srv)?:\/\/[^:]+:[^@\s]+@[^\s"']+/gi,
+        severity: "critical",
+        allowlist: [/localhost/, /127\.0\.0\.1/, /\$\{/, /<[^<>]{1,80}>/],
+        skipPlaceholderCheck: true,
+    },
+    {
+        id: "db_url_redis",
+        name: "Redis Connection String with credentials",
+        pattern: /redis:\/\/[^:]+:[^@\s]+@[^\s"']+/gi,
+        severity: "high",
+        allowlist: [/localhost/, /127\.0\.0\.1/, /\$\{/, /<[^<>]{1,80}>/],
+        skipPlaceholderCheck: true,
+    },
+    // ── Private keys ───────────────────────────────────────────────────────────
+    {
+        id: "private_key_rsa",
+        name: "RSA Private Key",
+        pattern: /-----BEGIN RSA PRIVATE KEY-----/g,
+        severity: "critical",
+    },
+    {
+        id: "private_key_ec",
+        name: "EC Private Key",
+        pattern: /-----BEGIN EC PRIVATE KEY-----/g,
+        severity: "critical",
+    },
+    {
+        id: "private_key_openssh",
+        name: "OpenSSH Private Key",
+        pattern: /-----BEGIN OPENSSH PRIVATE KEY-----/g,
+        severity: "critical",
+    },
+    {
+        id: "private_key_generic",
+        name: "Generic Private Key",
+        pattern: /-----BEGIN PRIVATE KEY-----/g,
+        severity: "critical",
+    },
+    {
+        id: "pgp_private_key",
+        name: "PGP Private Key Block",
+        pattern: /-----BEGIN PGP PRIVATE KEY BLOCK-----/g,
+        severity: "critical",
+    },
+    // ── Auth tokens & JWTs ─────────────────────────────────────────────────────
+    {
+        id: "jwt",
+        name: "JSON Web Token",
+        pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g,
+        severity: "high",
+    },
+    {
+        id: "bearer_token",
+        broad: true,
+        name: "Bearer Token in code",
+        // Gerçek bearer token'lar (JWT, OAuth2 opak token) neredeyse hiç 20
+        // karakterin altına inmez — testlerdeki "Bearer alpha"/"Bearer test-token"
+        // gibi kısa sahte değerleri eleyip gürültüyü büyük ölçüde azaltıyor.
+        pattern: /['"](Bearer\s+[A-Za-z0-9\-._~+/]{20,}=*)['"]/gi,
+        severity: "high",
+        lowerSeverityInTestFiles: true,
+    },
+    // ── DevOps & infra ─────────────────────────────────────────────────────────
+    {
+        id: "npm_token",
+        name: "npm Access Token",
+        pattern: /npm_[A-Za-z0-9]{36}/g,
+        severity: "critical",
+    },
+    {
+        id: "docker_pat",
+        name: "Docker Hub Personal Access Token",
+        pattern: /dckr_pat_[A-Za-z0-9\-_]{27}/g,
+        severity: "high",
+    },
+    {
+        id: "vercel_token",
+        broad: true,
+        name: "Vercel API Token",
+        pattern: /vercel(?:[._-])?(?:token|api)['":\s=]+([A-Za-z0-9]{24})/gi,
+        severity: "high",
+    },
+    // ── Generic patterns ───────────────────────────────────────────────────────
+    {
+        id: "generic_secret_assignment",
+        broad: true,
+        name: "Hardcoded secret assignment",
+        pattern: /(?:password|passwd|secret|api[_-]?key|auth[_-]?token|access[_-]?token|private[_-]?key)\s*[:=]\s*['"][^'"]{8,}['"]/gi,
+        severity: "medium",
+        allowlist: [
+            /process\.env/,
+            /\$\{/,
+            /os\.environ/,
+            /getenv/,
+            /placeholder/i,
+            /example/i,
+            /your[-_]?/i,
+            /<[^<>]{1,80}>/,
+            /\*{3,}/,
+        ],
+        lowerSeverityInTestFiles: true,
+    },
+];
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AA2BA,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC,8EAA8E;IAC9E;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,4DAA4D;QACrE,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,yDAAyD;QAClE,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,2BAA2B,CAAC,EAAE,kBAAkB;KAC7D;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,UAAU;KACrB;IAED,8EAA8E;IAC9E;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,UAAU;KACrB;IAED,8EAA8E;IAC9E;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,sEAAsE;QACtE,oEAAoE;QACpE,wEAAwE;QACxE,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,mCAAmC;QACzC,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,KAAK;KAChB;IAED,8EAA8E;IAC9E;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,4CAA4C;QACrD,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,6BAA6B;QACtC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE,MAAM;KACjB;IAED,8EAA8E;IAC9E;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,qFAAqF;QAC9F,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,8CAA8C;QACvD,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,6CAA6C;QACtD,QAAQ,EAAE,UAAU;KACrB;IAED,8EAA8E;IAC9E;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,+CAA+C;QACrD,OAAO,EAAE,8CAA8C;QACvD,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,CAAC;QACjE,oBAAoB,EAAE,IAAI;KAC3B;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,0CAA0C;QAChD,OAAO,EAAE,oCAAoC;QAC7C,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,CAAC;QACjE,oBAAoB,EAAE,IAAI;KAC3B;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,4CAA4C;QAClD,OAAO,EAAE,gDAAgD;QACzD,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,CAAC;QACjE,oBAAoB,EAAE,IAAI;KAC3B;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,0CAA0C;QAChD,OAAO,EAAE,oCAAoC;QAC7C,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,CAAC;QACjE,oBAAoB,EAAE,IAAI;KAC3B;IAED,8EAA8E;IAC9E;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,iCAAiC;QAC1C,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,wCAAwC;QACjD,QAAQ,EAAE,UAAU;KACrB;IAED,8EAA8E;IAC9E;QACE,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,wDAAwD;QACjE,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,sBAAsB;QAC5B,oEAAoE;QACpE,2EAA2E;QAC3E,qEAAqE;QACrE,OAAO,EAAE,gDAAgD;QACzD,QAAQ,EAAE,MAAM;QAChB,wBAAwB,EAAE,IAAI;KAC/B;IAED,8EAA8E;IAC9E;QACE,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,2DAA2D;QACpE,QAAQ,EAAE,MAAM;KACjB;IAED,8EAA8E;IAC9E;QACE,EAAE,EAAE,2BAA2B;QAC/B,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,6BAA6B;QACnC,OAAO,EACL,qHAAqH;QACvH,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE;YACT,cAAc;YACd,MAAM;YACN,aAAa;YACb,QAAQ;YACR,cAAc;YACd,UAAU;YACV,YAAY;YACZ,eAAe;YACf,QAAQ;SACT;QACD,wBAAwB,EAAE,IAAI;KAC/B;CACF,CAAC"}

package/dist/validators.d.ts

@@ -4,4 +4,12 @@ export declare function isValidTcKimlik(raw: string): boolean;
 export declare function isValidLuhn(raw: string): boolean;
 /** IBAN mod-97 checksum (ISO 7064 MOD97-10), computed in chunks to avoid precision loss. */
 export declare function isValidIban(raw: string): boolean;
+/** Turkish tax number (Vergi Kimlik No, 10 digits) — the Gelir İdaresi check-digit algorithm. */
+export declare function isValidVkn(raw: string): boolean;
+/**
+ * Turkish phone number: after an optional +90 / 0090 / 0 prefix, 10 digits
+ * starting with a mobile (5xx), landline (2xx–4xx) or 850 code. Any other
+ * 10-digit run (an order number) is not a phone number.
+ */
+export declare function isValidTrPhone(raw: string): boolean;
 //# sourceMappingURL=validators.d.ts.map

package/dist/validators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../src/validators.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAUpD;AAED,6CAA6C;AAC7C,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAehD;AAED,4FAA4F;AAC5F,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAUhD"}
+{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../src/validators.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAUpD;AAED,6CAA6C;AAC7C,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAehD;AAED,4FAA4F;AAC5F,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAUhD;AAED,iGAAiG;AACjG,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAU/C;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMnD"}

package/dist/validators.js

@@ -44,4 +44,32 @@ export function isValidIban(raw) {
     }
     return Number(remainder) === 1;
 }
+/** Turkish tax number (Vergi Kimlik No, 10 digits) — the Gelir İdaresi check-digit algorithm. */
+export function isValidVkn(raw) {
+    const d = raw.replace(/\D/g, "");
+    if (d.length !== 10)
+        return false;
+    const digits = d.split("").map(Number);
+    let sum = 0;
+    for (let i = 0; i < 9; i++) {
+        const tmp = (digits[i] + 10 - (i + 1)) % 10;
+        sum += tmp === 9 ? 9 : (tmp * 2 ** (10 - (i + 1))) % 9;
+    }
+    return (10 - (sum % 10)) % 10 === digits[9];
+}
+/**
+ * Turkish phone number: after an optional +90 / 0090 / 0 prefix, 10 digits
+ * starting with a mobile (5xx), landline (2xx–4xx) or 850 code. Any other
+ * 10-digit run (an order number) is not a phone number.
+ */
+export function isValidTrPhone(raw) {
+    let d = raw.replace(/\D/g, "");
+    if (d.startsWith("0090"))
+        d = d.slice(4);
+    else if (d.startsWith("90") && d.length === 12)
+        d = d.slice(2);
+    else if (d.startsWith("0") && d.length === 11)
+        d = d.slice(1);
+    return d.length === 10 && /^(?:5\d|[234][1-9]|850)/.test(d);
+}
 //# sourceMappingURL=validators.js.map

package/dist/validators.js.map

@@ -1 +1 @@
-{"version":3,"file":"validators.js","sourceRoot":"","sources":["../src/validators.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAE7E,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,UAAU,GAAG,EAAE,CAAC;IAC5B,OAAO,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,GAAG,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,GAAG,IAAI,KAAK,CAAC;QACb,MAAM,GAAG,CAAC,MAAM,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAClF,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,SAAS,GAAG,CAAC,MAAM,CAAC,SAAS,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC"}
+{"version":3,"file":"validators.js","sourceRoot":"","sources":["../src/validators.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAE7E,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,UAAU,GAAG,EAAE,CAAC;IAC5B,OAAO,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,GAAG,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,GAAG,IAAI,KAAK,CAAC;QACb,MAAM,GAAG,CAAC,MAAM,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAClF,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,SAAS,GAAG,CAAC,MAAM,CAAC,SAAS,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC5C,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACpC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC1D,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guardbee/guard-core",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Shared detectors for GuardBee MCP packages — checksum-validated PII masking, prompt injection patterns, and lethal-trifecta tool classification",
   "type": "module",
   "main": "./dist/index.js",
@@ -19,7 +19,9 @@
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "TR.md",
+    "ZH.md"
   ],
   "keywords": [
     "mcp",