@medusasec/sensitive-spans 0.1.0

package/dist/medusa-engine.js

@@ -0,0 +1,720 @@
+// src/shared/text.ts
+function shannonEntropy(token) {
+  if (token.length === 0) return 0;
+  const counts = /* @__PURE__ */ new Map();
+  for (const ch of token) counts.set(ch, (counts.get(ch) ?? 0) + 1);
+  let h = 0;
+  for (const c of counts.values()) {
+    const p = c / token.length;
+    h -= p * Math.log2(p);
+  }
+  return h;
+}
+
+// src/tier0/validators.ts
+function luhnValid(digits) {
+  if (!/^\d{13,19}$/.test(digits)) return false;
+  let sum = 0;
+  let dbl = false;
+  for (let i = digits.length - 1; i >= 0; i--) {
+    let d = digits.charCodeAt(i) - 48;
+    if (dbl) {
+      d *= 2;
+      if (d > 9) d -= 9;
+    }
+    sum += d;
+    dbl = !dbl;
+  }
+  return sum % 10 === 0;
+}
+function ibanValid(iban) {
+  const s = iban.replace(/\s/g, "").toUpperCase();
+  if (!/^[A-Z]{2}\d{2}[A-Z0-9]{11,30}$/.test(s)) return false;
+  const rearranged = s.slice(4) + s.slice(0, 4);
+  let rem = 0;
+  for (const ch of rearranged) {
+    const v = ch >= "0" && ch <= "9" ? ch : (ch.charCodeAt(0) - 55).toString();
+    for (const digit of v) rem = (rem * 10 + (digit.charCodeAt(0) - 48)) % 97;
+  }
+  return rem === 1;
+}
+function ssnValid(ssn) {
+  const m = ssn.replace(/-/g, "");
+  if (!/^\d{9}$/.test(m)) return false;
+  const area = Number(m.slice(0, 3));
+  const group = Number(m.slice(3, 5));
+  const serial = Number(m.slice(5));
+  if (area === 0 || area === 666 || area >= 900) return false;
+  if (group === 0 || serial === 0) return false;
+  return true;
+}
+function abaRoutingValid(digits) {
+  if (!/^\d{9}$/.test(digits)) return false;
+  const d = [...digits].map(Number);
+  const sum = 3 * (d[0] + d[3] + d[6]) + 7 * (d[1] + d[4] + d[7]) + (d[2] + d[5] + d[8]);
+  return sum % 10 === 0 && sum > 0;
+}
+function jwtValid(token) {
+  const head = token.split(".")[0];
+  if (!head) return false;
+  try {
+    const b64 = head.replace(/-/g, "+").replace(/_/g, "/");
+    const json = JSON.parse(atob(b64.padEnd(Math.ceil(b64.length / 4) * 4, "=")));
+    return typeof json === "object" && json !== null && "alg" in json;
+  } catch {
+    return false;
+  }
+}
+
+// src/tier0/patterns.ts
+var CONTEXT_TERMS = /\b(password|passwd|pwd|passphrase|secret|key|token|credential|apikey|api[_-]?key|bearer|auth|ssn|social\s+security|card|cvv|cvc|iban|account|routing|wire|ach|swift|salary|dob|birth|policy|claim|coverage|deductible|premium|copay|insured|insurance|beneficiary|member|reimburs)\b/i;
+var LIVE_PAYMENT_CONTEXT = /\b(cvv|cvc|exp|expir\w*|pin|billing)\b/i;
+var CONTEXT_WINDOW = 40;
+var DUMMY_VALUES = [
+  /AKIAIOSFODNN7EXAMPLE/,
+  /wJalrXUtnFEMI\/K7MDENG\/bPxRfiCYEXAMPLEKEY/,
+  /^4111[ -]?1111[ -]?1111[ -]?1111$/,
+  /^4242[ -]?4242[ -]?4242[ -]?4242$/,
+  /^sk-x{4,}/i,
+  /^sk-\.{3,}/,
+  /^(123-45-6789|078-05-1120|219-09-9999)$/,
+  // canonical fake SSNs
+  /^xox[baprs]-(x{4,}|0{10,})/i
+];
+var PATTERNS = [
+  {
+    id: "AWS_ACCESS_KEY",
+    label: "AWS access key ID",
+    regex: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
+    baseScore: 0.95,
+    deterministicOnMatch: true
+  },
+  {
+    id: "AWS_SECRET",
+    label: "AWS secret access key (candidate)",
+    // 40-char base64-ish token; generic on purpose — precision comes from
+    // entropy + context, or Tier 1 arbitration.
+    regex: /\b[A-Za-z0-9/+=]{40}\b/g,
+    baseScore: 0.35,
+    entropyCheck: true
+  },
+  {
+    id: "OPENAI_KEY",
+    label: "OpenAI API key",
+    regex: /\bsk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{20,}\b/g,
+    baseScore: 0.9,
+    // Legacy keys carry an unambiguous infix.
+    validator: (m) => m.includes("T3BlbkFJ")
+  },
+  {
+    id: "ANTHROPIC_KEY",
+    label: "Anthropic API key",
+    regex: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g,
+    baseScore: 0.95,
+    deterministicOnMatch: true
+  },
+  {
+    id: "GITHUB_TOKEN",
+    label: "GitHub token",
+    regex: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g,
+    baseScore: 0.95,
+    deterministicOnMatch: true
+  },
+  {
+    id: "SLACK_TOKEN",
+    label: "Slack token",
+    regex: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g,
+    baseScore: 0.95,
+    deterministicOnMatch: true
+  },
+  {
+    id: "PRIVATE_KEY_BLOCK",
+    label: "Private key material",
+    regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----/g,
+    baseScore: 1,
+    deterministicOnMatch: true
+  },
+  {
+    id: "JWT",
+    label: "JSON Web Token",
+    regex: /\beyJ[\w-]{10,}\.[\w-]{10,}\.[\w-]{5,}\b/g,
+    baseScore: 0.7,
+    validator: jwtValid,
+    dropOnInvalid: true
+  },
+  {
+    id: "CREDIT_CARD",
+    label: "Payment card number",
+    regex: /\b(?:\d[ -]?){12,18}\d\b/g,
+    baseScore: 0.3,
+    validator: (m) => luhnValid(m.replace(/[ -]/g, "")),
+    dropOnInvalid: true,
+    deterministicOnMatch: true
+    // deterministic *iff* validator passed
+  },
+  {
+    id: "SSN",
+    label: "US Social Security number",
+    regex: /\b\d{3}-\d{2}-\d{4}\b/g,
+    baseScore: 0.5,
+    validator: ssnValid,
+    dropOnInvalid: true
+  },
+  {
+    id: "SSN_LOOSE",
+    label: "US Social Security number (unformatted)",
+    regex: /\b\d{9}\b/g,
+    baseScore: 0.35,
+    validator: ssnValid,
+    dropOnInvalid: true,
+    requiresContext: true
+  },
+  {
+    id: "IBAN",
+    label: "IBAN bank account",
+    // Allows the conventional 4-char grouping with spaces; validator strips them.
+    regex: /\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]){11,32}\b/g,
+    baseScore: 0.4,
+    validator: ibanValid,
+    dropOnInvalid: true,
+    deterministicOnMatch: true
+  },
+  {
+    id: "STRIPE_KEY",
+    label: "Stripe API key",
+    regex: /\b[sr]k_(?:live|test)_[A-Za-z0-9]{16,}\b/g,
+    baseScore: 0.95,
+    deterministicOnMatch: true
+  },
+  {
+    id: "WEBHOOK_SECRET",
+    label: "Webhook signing secret",
+    regex: /\bwhsec_[A-Za-z0-9]{16,}\b/g,
+    baseScore: 0.95,
+    deterministicOnMatch: true
+  },
+  {
+    id: "GOOGLE_API_KEY",
+    label: "Google API key",
+    regex: /\bAIza[0-9A-Za-z_-]{30,}\b/g,
+    baseScore: 0.95,
+    deterministicOnMatch: true
+  },
+  {
+    id: "SENDGRID_KEY",
+    label: "SendGrid API key",
+    regex: /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g,
+    baseScore: 0.95,
+    deterministicOnMatch: true
+  },
+  {
+    id: "CONNECTION_STRING",
+    label: "Credentials in connection string",
+    // user:password@ inside a database/broker URL.
+    regex: /\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis|amqps?|mssql):\/\/[^\s/@:]+:[^\s@]+@/gi,
+    baseScore: 0.95,
+    deterministicOnMatch: true
+  },
+  {
+    id: "ROUTING_NUMBER",
+    label: "US bank routing number",
+    regex: /\b\d{9}\b/g,
+    baseScore: 0.45,
+    validator: abaRoutingValid,
+    dropOnInvalid: true,
+    requiresContext: true
+    // "routing", "account", "wire", "ACH" nearby
+  },
+  {
+    id: "INSURANCE_ID",
+    label: "Insurance policy / claim / member ID",
+    // Prefixed identifier (POL-, CLM-, HMO-, SF-2025-…). Requires insurance
+    // vocabulary nearby so ordinary "AB-1234"-shaped tokens don't fire.
+    regex: /\b[A-Z]{2,4}-\d{3,}[A-Z0-9-]*\b/g,
+    baseScore: 0.6,
+    requiresContext: true
+  },
+  {
+    id: "HEX_SECRET",
+    label: "Hex-encoded secret token",
+    regex: /\b[a-f0-9]{32,64}\b/g,
+    baseScore: 0.4,
+    entropyCheck: true,
+    requiresContext: true
+    // only counts near "token"/"secret"/"auth"/"key"
+  },
+  // ---- prompt-injection / jailbreak (destination is an AI tool) ----
+  // Object nouns are deliberately narrow so ordinary revision requests
+  // ("ignore the typo", "forget the previous outline") never fire.
+  {
+    id: "INJECTION_OVERRIDE",
+    label: "Prompt-injection: instruction override",
+    // "ignore/disregard/forget the previous/all instructions", plus
+    // "new instructions supersede/override prior ones".
+    regex: /\b(?:ignore|disregard|forget|drop)\b[^.\n]{0,50}\b(?:previous|prior|above|earlier|all|any|your)\s+(?:\w+\s+){0,2}?(?:instructions?|rules?|guidelines?|prompts?|polic(?:y|ies)|restrictions?|safety|filters?)\b|\bnew\s+instructions?\b[^.\n]{0,40}\b(?:supersede|override|replace|ignore)\b|\bsystem\s+override\b/gi,
+    baseScore: 0.8
+  },
+  {
+    id: "INJECTION_EXFIL",
+    label: "Prompt-injection: system-prompt exfiltration",
+    regex: /\b(?:print|reveal|repeat|output|show|display|prefix|leak|tell|respond\s+only\s+with)\b[^.\n]{0,60}\b(?:system|hidden|initial|developer|restricted|your)\s+(?:\w+\s+){0,2}?(?:prompt|message|instructions?|configuration|<system>|tags)\b|\brepeat\s+everything\s+above\b/gi,
+    baseScore: 0.8
+  },
+  {
+    id: "INJECTION_SUSPEND",
+    label: "Prompt-injection: rules-no-longer-apply",
+    // "the rules ... don't apply anymore", "guidelines no longer matter" — the
+    // AI's constraints, asserted void. Allows words between (oblique phrasings).
+    // Scored in the warn band (not a hard block) since it's fuzzier; the
+    // arbiter adjudicates.
+    regex: /\b(?:rules?|guidelines?|restrictions?|instructions?|constraints?|limits?|filters?|guardrails?|polic(?:y|ies))\b[^.\n]{0,40}\b(?:no\s+longer|don'?t|do\s+not|doesn'?t|does\s+not)\s+(?:apply|exist|matter|count|hold)\b/gi,
+    baseScore: 0.65
+  },
+  {
+    id: "INJECTION_BYPASS",
+    label: "Prompt-injection: bypass safeguards",
+    // "without the usual checks", "answer freely", "do what I say" — freedom /
+    // safeguard-bypass assertions directed at the assistant.
+    regex: /\b(?:without|bypass\w*|skip\w*|ignoring|no)\s+(?:the\s+)?(?:usual\s+)?(?:checks?|rules?|restrictions?|filters?|guardrails?|limits?|safeguards?|constraints?|safety)\b|\b(?:answer|respond|reply|comply)\s+(?:freely|without\s+(?:any\s+)?restrictions?)\b|\bdo\s+(?:whatever|what)\s+I\s+say\b/gi,
+    baseScore: 0.65
+  },
+  {
+    id: "INJECTION_PERSONA",
+    label: "Prompt-injection: jailbreak persona",
+    // Object nouns kept specific so "explain prompt injection to defend my bot"
+    // never matches.
+    regex: /\b(?:jailbr(?:eak|oken)|you\s+are\s+now\s+(?:DAN|an?\s+\w+\s+(?:with\s+no|without))|(?:developer|god|dan)\s+mode|no\s+(?:ethical\s+)?(?:restrictions?|filters?|rules|guidelines)|unfiltered\s+(?:model|ai|version)|(?:guidelines|rules|restrictions|content\s+polic\w+)\s+(?:do(?:n'?t| not)\s+(?:exist|apply)|doesn'?t\s+exist)|roleplay\s+as\s+an?\s+ai\s+with\s+no|bypass\b[^.\n]{0,40}\b(?:safety|filter|restriction|guardrail)\w*)/gi,
+    baseScore: 0.75
+  },
+  {
+    id: "GENERIC_SECRET",
+    label: "Credential assignment",
+    // No leading \b: must also match prefixed names like db_password, ACCOUNT_KEY.
+    regex: /(?:secret|passwd|password|passphrase|token|api[_-]?key|account[_-]?key|signing[_-]?key)\s*[:=]\s*["']?[^\s"']{8,}/gi,
+    baseScore: 0.75
+  }
+];
+var EMAIL_REGEX = /\b[\w.+-]+@[\w-]+\.[A-Za-z]{2,}\b/g;
+var EMAIL_BULK_THRESHOLD = 10;
+var EMAIL_BULK_SCORE = 0.5;
+
+// src/tier0/health.ts
+var SIGNALS = [
+  // Drug names by distinctive pharmacological suffix + common exact names.
+  {
+    name: "drug",
+    re: /\b(?:\w+(?:cillin|mycin|micin|floxacin|pril|sartan|statin|parin|azole|prazole|olol|tidine|dipine|codone|morphine|barbital)|metformin|insulin|gabapentin|pregabalin|levetiracetam|lithium|sertraline|escitalopram|fluoxetine|methotrexate|levothyroxine|atorvastatin|lisinopril|carvedilol|albuterol|oxycodone|paxlovid|warfarin|prednisone|amoxicillin)\b/i
+  },
+  // Clinical abbreviations / dosing / record markers.
+  {
+    name: "clinical",
+    re: /\b(?:MRN|Dx|Rx|Hx|Tx|BID|TID|QID|PRN|A1c|LDL|HDL|TSH|EF|PCR|MRI|CT scan|ICD-?10|NYHA|ER\+|stage\s+(?:I|II|III|IV)\b|\d+\s?(?:mg|mcg|mL|units?)\b)/
+  },
+  // Diagnoses / conditions / procedures.
+  {
+    name: "condition",
+    re: /\b(?:diabet\w+|cancer|carcinoma|adenocarcinoma|melanoma|leukemia|lymphoma|tumou?r|HIV|hepatitis|asthma|epilep\w+|seizure|hypertens\w+|hypothyroid\w*|depress\w+|anxiety|schizophren\w+|psychosis|herniation|arthritis|dialysis|chemotherapy|biopsy|anaphylaxis|gestational|appendectomy|antiretroviral|metastat\w+)\b/i
+  },
+  // Care context.
+  {
+    name: "care",
+    re: /\b(?:patient|diagnos\w+|prescrib\w+|discharge summary|oncolog\w+|cardiolog\w+|pathology|inpatient|outpatient|prognos\w+|symptom\w*|admitted|referral|transplant|surgical)\b/i
+  }
+];
+var HEALTH_BASE_SCORE = 0.75;
+function scanHealth(text) {
+  let hitClasses = 0;
+  let minStart = Infinity;
+  let maxEnd = -1;
+  for (const sig of SIGNALS) {
+    sig.re.lastIndex = 0;
+    const m = sig.re.exec(text);
+    if (m) {
+      hitClasses++;
+      minStart = Math.min(minStart, m.index);
+      maxEnd = Math.max(maxEnd, m.index + m[0].length);
+      const all = [...text.matchAll(new RegExp(sig.re.source, sig.re.flags.replace("g", "") + "g"))];
+      for (const a of all) {
+        minStart = Math.min(minStart, a.index ?? minStart);
+        maxEnd = Math.max(maxEnd, (a.index ?? 0) + a[0].length);
+      }
+    }
+  }
+  if (hitClasses < 2) return null;
+  return {
+    start: Math.max(0, minStart),
+    end: Math.min(text.length, maxEnd),
+    label: "HEALTH_CLINICAL",
+    score: HEALTH_BASE_SCORE,
+    tier: 0,
+    deterministic: false
+  };
+}
+
+// src/tier0/code.ts
+var SIGNATURES = [
+  /\b(?:def|func|function|fn|sub)\s+\w+\s*\(/,
+  // function definition
+  /\b(?:public|private|protected|static)\s+[\w<>[\]]+\s+\w+\s*\([^)]*\)\s*\{/,
+  // typed method
+  /\b(?:const|let|var)\s+\w+\s*=\s*[^;\n]+[;({]/,
+  // assignment to call/expr
+  /=>\s*[{(]/,
+  // arrow function body
+  /\)\s*=>/,
+  // arrow params
+  /\)\s*\{\s*$/m,
+  // block-opening line
+  /\b(?:SELECT|INSERT|UPDATE|DELETE|CREATE(?:\s+OR\s+REPLACE)?|WITH|DROP|ALTER)\b[\s\S]{0,80}\b(?:FROM|INTO|SET|TABLE|WHERE|VALUES|FUNCTION|AS|USING)\b/i,
+  // SQL
+  /^#!\/\S+/m,
+  // shebang
+  /\bresource\s+"[^"]+"\s+"[^"]+"\s*\{/,
+  // terraform/HCL
+  /@\w+(?:\.\w+)?\s*\([^)]*\)\s*$/m,
+  // decorator/route line
+  /\b(?:import|from)\s+[\w.]+\s+import\b/,
+  // python import
+  /\bdb\.(?:execute|query|drop_all|transfer|debit|credit)\s*\(/
+  // db call idioms
+];
+var MIN_SIGNATURES = 1;
+function scanCode(text) {
+  let matches = 0;
+  let minStart = Infinity;
+  let maxEnd = -1;
+  for (const re of SIGNATURES) {
+    const m = re.exec(text);
+    if (m) {
+      matches++;
+      minStart = Math.min(minStart, m.index);
+      maxEnd = Math.max(maxEnd, m.index + m[0].length);
+    }
+  }
+  if (matches < MIN_SIGNATURES) return null;
+  return {
+    start: Math.max(0, minStart),
+    end: Math.min(text.length, maxEnd),
+    label: "SOURCE_CODE",
+    score: 0.7,
+    tier: 0,
+    deterministic: false
+  };
+}
+
+// src/tier0/deobfuscate.ts
+var BASE64_BLOB = /\b[A-Za-z0-9+/]{16,}={0,2}\b/g;
+function decodeBase64(blob) {
+  const stripped = blob.replace(/=+$/, "");
+  if (stripped.length < 16) return null;
+  try {
+    const bin = atob(blob);
+    if (bin.length < 6) return null;
+    let printable = 0;
+    for (let i = 0; i < bin.length; i++) {
+      const c = bin.charCodeAt(i);
+      if (c >= 32 && c < 127) printable++;
+    }
+    if (printable / bin.length < 0.85) return null;
+    return bin;
+  } catch {
+    return null;
+  }
+}
+function decodeRegions(text, max = 8) {
+  const out = [];
+  BASE64_BLOB.lastIndex = 0;
+  for (const m of text.matchAll(BASE64_BLOB)) {
+    const decoded = decodeBase64(m[0]);
+    if (decoded && decoded !== m[0]) {
+      out.push({ start: m.index ?? 0, end: (m.index ?? 0) + m[0].length, decoded });
+      if (out.length >= max) break;
+    }
+  }
+  return out;
+}
+
+// src/tier0/engine.ts
+var clamp01 = (x) => Math.max(0, Math.min(1, x));
+function windowAround(text, start, end) {
+  const lo = Math.max(0, start - CONTEXT_WINDOW);
+  const hi = Math.min(text.length, end + CONTEXT_WINDOW);
+  return text.slice(lo, start) + " " + text.slice(end, hi);
+}
+function isDummy(match) {
+  return DUMMY_VALUES.some((re) => re.test(match));
+}
+function activePatterns(policy) {
+  const disabled = new Set(policy.disabledPatterns);
+  const custom = policy.customPatterns.map((c) => ({
+    id: c.id,
+    label: c.id,
+    regex: new RegExp(c.pattern, "g"),
+    baseScore: c.baseScore,
+    deterministicOnMatch: c.deterministic
+  }));
+  return [...PATTERNS.filter((p) => !disabled.has(p.id)), ...custom];
+}
+function runPatterns(text, patterns, state) {
+  for (const spec of patterns) {
+    spec.regex.lastIndex = 0;
+    for (const m of text.matchAll(spec.regex)) {
+      const value = m[0];
+      const start = m.index ?? 0;
+      const end = start + value.length;
+      const around = windowAround(text, start, end);
+      if (isDummy(value) && !LIVE_PAYMENT_CONTEXT.test(around)) continue;
+      const contextNearby = CONTEXT_TERMS.test(around);
+      if (spec.requiresContext && !contextNearby) continue;
+      const validated = spec.validator ? spec.validator(value) : void 0;
+      if (validated === false && spec.dropOnInvalid) continue;
+      let score = spec.baseScore;
+      let deterministic = false;
+      if (validated === true) {
+        deterministic = spec.deterministicOnMatch !== false;
+        score = Math.max(score, 0.95);
+      } else if (spec.deterministicOnMatch && !spec.validator) {
+        deterministic = true;
+      }
+      if (contextNearby) score += 0.25;
+      if (spec.entropyCheck) {
+        const h = shannonEntropy(value.slice(0, 64));
+        if (h > 4.2 && value.length >= 20) score += 0.3;
+        else if (h < 3) score -= 0.3;
+        if (h > 4.2 !== contextNearby) state.conflicted = true;
+      }
+      score = clamp01(score);
+      if (score <= 0) continue;
+      state.hits.push({ start, end, label: spec.id, score, tier: 0, deterministic });
+    }
+  }
+}
+function scanTier0(text, policy) {
+  const state = { hits: [], conflicted: false };
+  const patterns = activePatterns(policy);
+  runPatterns(text, patterns, state);
+  for (const region of decodeRegions(text)) {
+    const sub = { hits: [], conflicted: false };
+    runPatterns(region.decoded, patterns, sub);
+    const injectionInside = /INJECTION_/.test(sub.hits.map((h) => h.label).join(",")) || scanHealth(region.decoded);
+    if (sub.hits.length > 0 || injectionInside) {
+      const best = Math.max(0.85, ...sub.hits.map((h) => h.score));
+      state.hits.push({
+        start: region.start,
+        end: region.end,
+        label: "ENCODED_PAYLOAD",
+        score: best,
+        tier: 0,
+        deterministic: false
+      });
+    }
+  }
+  const health = scanHealth(text);
+  if (health) state.hits.push(health);
+  const code = scanCode(text);
+  if (code) state.hits.push(code);
+  const hits = state.hits;
+  let conflicted = state.conflicted;
+  EMAIL_REGEX.lastIndex = 0;
+  const emails = /* @__PURE__ */ new Set();
+  for (const m of text.matchAll(EMAIL_REGEX)) emails.add(m[0].toLowerCase());
+  if (emails.size >= EMAIL_BULK_THRESHOLD) {
+    hits.push({
+      start: 0,
+      end: text.length,
+      label: "EMAIL_BULK",
+      score: EMAIL_BULK_SCORE,
+      tier: 0,
+      deterministic: false
+    });
+  }
+  const score = hits.reduce((mx, h) => Math.max(mx, h.score), 0);
+  const deterministic = hits.some((h) => h.deterministic);
+  return { score, deterministic, hits, conflicted };
+}
+
+// src/transplant/adapter.ts
+var LABEL_MAP = {
+  // secret
+  AWS_ACCESS_KEY: { category: "SECRET" },
+  AWS_SECRET: { category: "SECRET" },
+  OPENAI_KEY: { category: "SECRET" },
+  ANTHROPIC_KEY: { category: "SECRET" },
+  GITHUB_TOKEN: { category: "SECRET" },
+  SLACK_TOKEN: { category: "SECRET" },
+  PRIVATE_KEY_BLOCK: { category: "SECRET" },
+  JWT: { category: "SECRET" },
+  GENERIC_SECRET: { category: "SECRET" },
+  STRIPE_KEY: { category: "SECRET" },
+  WEBHOOK_SECRET: { category: "SECRET" },
+  GOOGLE_API_KEY: { category: "SECRET" },
+  SENDGRID_KEY: { category: "SECRET" },
+  CONNECTION_STRING: { category: "SECRET" },
+  HEX_SECRET: { category: "SECRET" },
+  "api key or secret token": { category: "SECRET" },
+  password: { category: "SECRET" },
+  // financial
+  CREDIT_CARD: { category: "FINANCIAL" },
+  IBAN: { category: "FINANCIAL" },
+  ROUTING_NUMBER: { category: "FINANCIAL" },
+  "credit card number": { category: "FINANCIAL" },
+  "bank account number": { category: "FINANCIAL" },
+  // pii
+  SSN: { category: "PII" },
+  SSN_LOOSE: { category: "PII" },
+  EMAIL_BULK: { category: "PII", intent: true },
+  "social security number": { category: "PII" },
+  "home address": { category: "PII" },
+  "date of birth": { category: "PII" },
+  "passport or license number": { category: "PII" },
+  "person name": { category: "PII" },
+  "email address": { category: "PII" },
+  "phone number": { category: "PII" },
+  // health
+  HEALTH_CLINICAL: { category: "HEALTH" },
+  "medical condition or diagnosis": { category: "HEALTH" },
+  medication: { category: "HEALTH" },
+  // insurance
+  INSURANCE_ID: { category: "INSURANCE" },
+  "insurance policy or claim number": { category: "INSURANCE" },
+  // code (whole-text intent)
+  SOURCE_CODE: { category: "CODE", intent: true },
+  "source code": { category: "CODE", intent: true },
+  // injection (whole-text intent)
+  INJECTION_OVERRIDE: { category: "INJECTION", intent: true },
+  INJECTION_EXFIL: { category: "INJECTION", intent: true },
+  INJECTION_PERSONA: { category: "INJECTION", intent: true },
+  INJECTION_SUSPEND: { category: "INJECTION", intent: true },
+  INJECTION_BYPASS: { category: "INJECTION", intent: true },
+  ENCODED_PAYLOAD: { category: "INJECTION", intent: true },
+  // multi-turn
+  MULTITURN_SPLIT_SECRET: { category: "SECRET", intent: true },
+  MULTITURN_BULK_PII: { category: "PII", intent: true }
+};
+function mapSpan(span, sourceText) {
+  const m = LABEL_MAP[span.label];
+  if (!m) return null;
+  const start = Math.max(0, span.start);
+  const end = Math.min(sourceText.length, span.end);
+  return {
+    category: m.category,
+    text: sourceText.slice(start, end),
+    start,
+    end,
+    confidence: Math.max(0, Math.min(1, span.score)),
+    ...m.intent ? { kind: "intent" } : {},
+    detector: "medusa2"
+  };
+}
+function dedupe(spans) {
+  const out = [];
+  for (const s of spans.sort((a, b) => a.start - b.start || b.confidence - a.confidence)) {
+    const prev = out.find(
+      (p) => p.category === s.category && s.start < p.end && s.end > p.start
+    );
+    if (prev) {
+      prev.start = Math.min(prev.start, s.start);
+      prev.end = Math.max(prev.end, s.end);
+      prev.confidence = Math.max(prev.confidence, s.confidence);
+      prev.kind = prev.kind ?? s.kind;
+    } else out.push(s);
+  }
+  return out;
+}
+function detectSpans(text, policy, tier1Spans = []) {
+  const t0 = scanTier0(text, policy).hits;
+  const mapped = [...t0, ...tier1Spans].map((s) => mapSpan(s, text)).filter((s) => s !== null);
+  return dedupe(mapped);
+}
+var PRODUCTION_CATEGORIES = ["SECRET", "PII", "FINANCIAL", "HEALTH", "INSURANCE", "CODE", "INJECTION"];
+
+// src/shared/policy.ts
+var DEFAULT_POLICY = {
+  disabledPatterns: [],
+  customPatterns: [],
+  // Concrete, disclosure-shaped phrasings: small NLI models spuriously entail
+  // abstract labels ("salary information") from any work-related sentence.
+  tier1Labels: {
+    "a secret api key or access token": 0.5,
+    "a password being shared": 0.5,
+    "a social security number": 0.55,
+    "a written-out credit card number": 0.6,
+    "private medical details about a person": 0.6,
+    "a specific salary amount or pay figure": 0.6,
+    "a person's home address": 0.6,
+    "a person's date of birth": 0.6,
+    "a passport, driver license, or national ID number": 0.6
+  },
+  nonVetoableLabels: [
+    "private medical details about a person",
+    "a passport, driver license, or national ID number",
+    "a person's home address",
+    "a person's date of birth"
+  ],
+  tier2Rules: [
+    "Credentials, API keys, tokens, or passwords must never be shared.",
+    "Personally identifiable information (SSN, DOB + full name, home address) must not be sent to external services.",
+    "Financial data (card numbers, bank accounts, payroll) must not be shared.",
+    "Internal project codenames, unreleased product details, and confidential strategy documents must not be pasted into public AI chatbots or webmail."
+  ],
+  contextProfiles: {
+    "chatgpt.com": "strict",
+    "chat.openai.com": "strict",
+    "claude.ai": "strict",
+    "gemini.google.com": "strict",
+    "mail.google.com": "strict"
+  },
+  defaultStrictness: "standard",
+  allowlistedOrigins: [],
+  thresholds: {
+    warn: 0.6,
+    block: 0.9,
+    gateTier1Low: 0.35,
+    gateTier1High: 0.9,
+    gateTier2Low: 0.55,
+    gateTier2High: 0.85,
+    submitSweepMinChars: 200
+  },
+  fusionWeights: { tier0: 0.4, tier1: 0.45, tier2: 0.15 },
+  ui: { maskFirst: true }
+};
+function resolvePolicy(managedJson) {
+  if (!managedJson) return DEFAULT_POLICY;
+  try {
+    const partial = JSON.parse(managedJson);
+    return {
+      ...DEFAULT_POLICY,
+      ...partial,
+      thresholds: { ...DEFAULT_POLICY.thresholds, ...partial.thresholds ?? {} },
+      fusionWeights: { ...DEFAULT_POLICY.fusionWeights, ...partial.fusionWeights ?? {} },
+      ui: { ...DEFAULT_POLICY.ui, ...partial.ui ?? {} }
+    };
+  } catch {
+    console.warn("[medusa] invalid managed policyJson; using defaults");
+    return DEFAULT_POLICY;
+  }
+}
+
+// src/transplant/entry.ts
+var GLINER_LABELS = {
+  "api key or secret token": 0.5,
+  "password": 0.5,
+  "social security number": 0.55,
+  "credit card number": 0.6,
+  "bank account number": 0.55,
+  "medical condition or diagnosis": 0.6,
+  "medication": 0.6,
+  "home address": 0.6,
+  "date of birth": 0.6,
+  "passport or license number": 0.6,
+  "source code": 0.6,
+  "insurance policy or claim number": 0.6
+};
+export {
+  DEFAULT_POLICY,
+  GLINER_LABELS,
+  PRODUCTION_CATEGORIES,
+  detectSpans,
+  mapSpan,
+  resolvePolicy
+};