@mrciphersmith/keryx 0.3.77 → 0.3.78

package/dist/cli.js

@@ -1757,13 +1757,366 @@ function isValidIp(value) {
   }
   return false;
 }
-function countDigits(value) {
-  let n = 0;
-  for (const ch of value) {
-    if (ch >= "0" && ch <= "9")
-      n += 1;
+function isWordBoundary(flavour, content, index) {
+  return flavour.wordChar.test(wordCharBefore(content, index)) !== flavour.wordChar.test(wordCharAt(content, index));
+}
+function wordCharBefore(content, index) {
+  if (index <= 0) {
+    return "";
   }
-  return n;
+  const low = content.charCodeAt(index - 1);
+  if (low >= 56320 && low <= 57343 && index >= 2) {
+    const high = content.charCodeAt(index - 2);
+    if (high >= 55296 && high <= 56319) {
+      return content.slice(index - 2, index);
+    }
+  }
+  return content[index - 1];
+}
+function wordCharAt(content, index) {
+  const code = content.codePointAt(index);
+  return code === undefined ? "" : String.fromCodePoint(code);
+}
+function execEmail(flavour, content, from) {
+  let at = content.indexOf("@", from);
+  while (at !== -1) {
+    let start = at;
+    while (start > from && flavour.localChar.test(wordCharBefore(content, start))) {
+      start -= wordCharBefore(content, start).length;
+    }
+    while (start < at && !isWordBoundary(flavour, content, start)) {
+      start += wordCharAt(content, start).length;
+    }
+    if (start < at) {
+      flavour.from.lastIndex = start;
+      const m = flavour.from.exec(content);
+      if (m !== null) {
+        return m;
+      }
+    }
+    at = content.indexOf("@", at + 1);
+  }
+  return null;
+}
+function emailScannerFor(flavour) {
+  return {
+    lastIndex: 0,
+    exec(content) {
+      const m = execEmail(flavour, content, this.lastIndex);
+      this.lastIndex = m === null ? 0 : m.index + m[0].length;
+      return m;
+    }
+  };
+}
+function execPhone(content, from) {
+  let pos = from;
+  while (pos < content.length) {
+    const digitAt = content[pos] === "+" ? pos + 1 : pos;
+    if (!DIGIT.test(content[digitAt] ?? "") || pos > 0 && PHONE_START_BLOCKER.test(content[pos - 1])) {
+      pos += 1;
+      continue;
+    }
+    PHONE_FROM.lastIndex = pos;
+    const m = PHONE_FROM.exec(content);
+    if (m !== null) {
+      return m;
+    }
+    pos = digitAt + 1;
+    while (pos < content.length && PHONE_RUN_CHAR.test(content[pos])) {
+      pos += 1;
+    }
+  }
+  return null;
+}
+function phoneVerdict(content, start, end) {
+  let digits = 0;
+  for (let i = start;i < end && digits <= PHONE_MAX_DIGITS; i += 1) {
+    if (DIGIT.test(content[i])) {
+      digits += 1;
+    }
+  }
+  if (digits < PHONE_MIN_DIGITS || digits > PHONE_MAX_DIGITS) {
+    return false;
+  }
+  const value = content.slice(start, end);
+  return hasPhoneSeparatorShape(value) && !containsCalendarDate(value) && !isIdentifierFragment(content, start, end);
+}
+function hasPhoneEvidence(value, singleToken) {
+  return PHONE_SEPARATOR.test(value) || singleToken && value.includes(".") || PHONE_NANP_SPACED.test(value);
+}
+function phoneTokens(content, from, to) {
+  const tokens = [];
+  let i = from;
+  while (i < to) {
+    const gapStart = i;
+    while (i < to && WHITESPACE.test(content[i])) {
+      i += 1;
+    }
+    if (i >= to) {
+      break;
+    }
+    const breakBefore = tokens.length > 0 && (i - gapStart >= 2 || LINE_BREAK.test(content.slice(gapStart, i)));
+    const start = i;
+    let digits = 0;
+    let lastDigit = -1;
+    let coreStart = -1;
+    let leadDigits = 0;
+    while (i < to && !WHITESPACE.test(content[i])) {
+      const isDigit = DIGIT.test(content[i]);
+      if (coreStart < 0) {
+        const startsHere = (isDigit || content[i] === "+" && i + 1 < to && DIGIT.test(content[i + 1])) && (i === 0 || !PHONE_START_BLOCKER.test(content[i - 1]));
+        if (startsHere) {
+          coreStart = i;
+        } else if (isDigit) {
+          leadDigits += 1;
+        }
+      }
+      if (isDigit) {
+        digits += 1;
+        lastDigit = i;
+      }
+      i += 1;
+    }
+    const text = content.slice(start, i);
+    const groupable = (PHONE_DIAL_GROUP.test(text) || PHONE_FIRST_GROUP.test(text)) && !containsCalendarDate(text);
+    tokens.push({ start, end: i, coreStart, coreEnd: lastDigit + 1, leadDigits, digits, breakBefore, groupable });
+  }
+  return tokens;
+}
+function rescanPhoneRun(content, from, to) {
+  const tokens = phoneTokens(content, from, to);
+  const found = [];
+  const chainAfter = new Array(tokens.length).fill(0);
+  for (let i = tokens.length - 2;i >= 0; i -= 1) {
+    const next = tokens[i + 1];
+    chainAfter[i] = next.groupable && !next.breakBefore ? chainAfter[i + 1] + next.digits : 0;
+  }
+  let first = 0;
+  let resume = -1;
+  while (first < tokens.length) {
+    const head = tokens[first];
+    if (head.coreStart < 0 || head.coreEnd <= head.coreStart) {
+      first += 1;
+      continue;
+    }
+    const startsRun = first === 0 || first === resume || head.breakBefore || !tokens[first - 1].groupable;
+    let longest = -1;
+    let clean = -1;
+    const consider = (last) => {
+      const end = tokens[last].coreEnd;
+      if (hasPhoneEvidence(content.slice(head.coreStart, end), last === first) && phoneVerdict(content, head.coreStart, end)) {
+        longest = last;
+        const rest = chainAfter[last];
+        if (rest === 0 || rest >= PHONE_MIN_DIGITS) {
+          clean = last;
+        }
+      }
+    };
+    let digits = head.digits - head.leadDigits;
+    if (digits >= PHONE_MIN_DIGITS) {
+      consider(first);
+    }
+    const headGroup = content.slice(head.coreStart, head.end);
+    let extendable = startsRun && (PHONE_FIRST_GROUP.test(headGroup) || PHONE_DIAL_GROUP.test(headGroup));
+    for (let last = first + 1;last < tokens.length && extendable; last += 1) {
+      const tail = tokens[last];
+      digits += tail.digits;
+      if (digits > PHONE_MAX_DIGITS || tail.digits === 0 || tail.breakBefore) {
+        break;
+      }
+      if (digits >= PHONE_MIN_DIGITS && PHONE_DIAL_GROUP.test(content.slice(tail.start, tail.coreEnd))) {
+        consider(last);
+      }
+      extendable = PHONE_DIAL_GROUP.test(content.slice(tail.start, tail.end));
+    }
+    const best = clean >= 0 ? clean : longest;
+    if (best >= 0) {
+      const value = content.slice(head.coreStart, tokens[best].coreEnd);
+      found.push({ index: head.coreStart, 0: value, 1: value });
+      first = best + 1;
+      resume = first;
+    } else {
+      first += 1;
+    }
+  }
+  return found;
+}
+function joinedPhones(content, from, to) {
+  const found = [];
+  let i = from;
+  while (i < to) {
+    while (i < to && WHITESPACE.test(content[i])) {
+      i += 1;
+    }
+    let zoneEnd = i;
+    let total = 0;
+    while (zoneEnd < to && !WHITESPACE.test(content[zoneEnd])) {
+      if (DIGIT.test(content[zoneEnd])) {
+        total += 1;
+      }
+      zoneEnd += 1;
+    }
+    if (total > PHONE_MAX_DIGITS && !containsCalendarDate(content.slice(i, zoneEnd))) {
+      joinedZone(content, i, zoneEnd, total, found);
+    }
+    i = zoneEnd;
+  }
+  return found;
+}
+function isJoinerAt(content, k, to) {
+  const ch = content[k];
+  return (ch === "-" || ch === ".") && k > 0 && DIGIT.test(content[k - 1]) && k + 1 < to && DIGIT.test(content[k + 1]);
+}
+function joinedZone(content, zoneStart, zoneEnd, total, found) {
+  let s = zoneStart;
+  let before = 0;
+  for (;; ) {
+    while (s < zoneEnd && !DIGIT.test(content[s]) && !(content[s] === "+" && s + 1 < zoneEnd && DIGIT.test(content[s + 1]))) {
+      s += 1;
+    }
+    if (s >= zoneEnd) {
+      return;
+    }
+    let digits = 0;
+    let lastDigit = s;
+    let open = true;
+    const cuts = [];
+    for (let k = s;k < zoneEnd && open; k += 1) {
+      if (DIGIT.test(content[k])) {
+        digits += 1;
+        lastDigit = k;
+        open = digits <= PHONE_MAX_DIGITS;
+      } else if (digits >= PHONE_MIN_DIGITS && isJoinerAt(content, k, zoneEnd)) {
+        cuts.push({ end: k, digits });
+      }
+    }
+    if (open && digits >= PHONE_MIN_DIGITS) {
+      cuts.push({ end: lastDigit + 1, digits });
+    }
+    let pick = -1;
+    for (let c = cuts.length - 1;c >= 0; c -= 1) {
+      const cut = cuts[c];
+      const piece = content.slice(s, cut.end);
+      if (!PHONE_JOINED_PIECE.test(piece) || PHONE_CARD_SHAPE.test(piece) || !phoneVerdict(content, s, cut.end)) {
+        continue;
+      }
+      if (pick < 0) {
+        pick = c;
+      }
+      const rest = total - before - cut.digits;
+      if (rest === 0 || rest >= PHONE_MIN_DIGITS) {
+        pick = c;
+        break;
+      }
+    }
+    if (pick < 0) {
+      return;
+    }
+    const cut = cuts[pick];
+    const value = content.slice(s, cut.end);
+    found.push({ index: s, 0: value, 1: value });
+    before += cut.digits;
+    s = cut.end + 1;
+  }
+}
+function withJoined(joined, rescans) {
+  if (joined.length === 0) {
+    return rescans;
+  }
+  const merged = [];
+  let cursor = 0;
+  let pending = 0;
+  for (const rescan of rescans) {
+    const rescanEnd = rescan.index + (rescan[0] ?? "").length;
+    while (cursor < joined.length && joined[cursor].index + (joined[cursor][0] ?? "").length <= rescan.index) {
+      cursor += 1;
+    }
+    if (cursor < joined.length && joined[cursor].index < rescanEnd) {
+      continue;
+    }
+    while (pending < joined.length && joined[pending].index < rescan.index) {
+      merged.push(joined[pending]);
+      pending += 1;
+    }
+    merged.push(rescan);
+  }
+  while (pending < joined.length) {
+    merged.push(joined[pending]);
+    pending += 1;
+  }
+  return merged;
+}
+function phoneBaselineEnd(content, runEnd) {
+  for (let e = runEnd;e > 0; e -= 1) {
+    if (DIGIT.test(content[e - 1]) && (e >= content.length || !PHONE_START_BLOCKER.test(content[e]))) {
+      return e;
+    }
+  }
+  return -1;
+}
+function isIbanChar(code) {
+  return code >= 65 && code <= 90 || code >= 48 && code <= 57;
+}
+function isAsciiWordChar(code) {
+  return isIbanChar(code) || code >= 97 && code <= 122 || code === 95;
+}
+function ibanEnd(content, base, pos, groups) {
+  const key = (pos - base) * (IBAN_MAX_GROUPS + 1) + groups;
+  if (ibanFailed[key] === ibanStamp) {
+    return -1;
+  }
+  if (groups < IBAN_MAX_GROUPS) {
+    const from = content.charCodeAt(pos) === 32 ? pos + 1 : pos;
+    let run = 0;
+    while (run < 4 && isIbanChar(content.charCodeAt(from + run))) {
+      run += 1;
+    }
+    for (let length = run;length >= 1; length -= 1) {
+      const end = ibanEnd(content, base, from + length, groups + 1);
+      if (end >= 0) {
+        return end;
+      }
+    }
+  }
+  if (groups >= 2 && !isAsciiWordChar(content.charCodeAt(pos))) {
+    return pos;
+  }
+  ibanFailed[key] = ibanStamp;
+  return -1;
+}
+function isCardCandidate(value) {
+  const separators = value.match(CARD_GROUP_SEPARATOR) ?? [];
+  const first = separators[0];
+  if (first === undefined) {
+    return true;
+  }
+  if (!separators.every((separator) => separator === first)) {
+    return false;
+  }
+  const lengths = value.split(first).map((group) => group.length);
+  const last = lengths[lengths.length - 1];
+  if (lengths.length === 3 && lengths[0] === 4 && lengths[1] === 6 && (last === 5 || last === 4)) {
+    return true;
+  }
+  return lengths.slice(0, -1).every((length) => length === 4) && last >= 1 && last <= 7;
+}
+function hasNonHexGlue(content, start, end) {
+  const before = GLUE_LETTER_BEFORE.exec(content.slice(Math.max(0, start - GLUE_FLANK), start))?.[0] ?? "";
+  const after = GLUE_LETTER_AFTER.exec(content.slice(end, end + GLUE_FLANK))?.[0] ?? "";
+  return before === "" && after === "" || NON_HEX_LETTER.test(before) || NON_HEX_LETTER.test(after);
+}
+function outsideUuid(content, start, end) {
+  const from = Math.max(0, start - UUID_REACH);
+  const window = content.slice(from, Math.min(content.length, end + UUID_REACH));
+  UUID_ANYWHERE.lastIndex = 0;
+  let m;
+  while ((m = UUID_ANYWHERE.exec(window)) !== null) {
+    if (from + m.index < end && from + m.index + m[0].length > start) {
+      return false;
+    }
+    UUID_ANYWHERE.lastIndex = m.index + 1;
+  }
+  return true;
 }
 function containsCalendarDate(value) {
   return CALENDAR_DATE.test(value);
@@ -1816,71 +2169,644 @@ function hasPhoneSeparatorShape(value) {
     return /^\(?\d{2,4}\)?(?:[-.]\d{2,4})*$/.test(group);
   });
 }
-function detectPii(content) {
+function scanWith(content, rule, scanner, validate, accept) {
   const matches = [];
-  for (const rule of RULES) {
-    rule.regex.lastIndex = 0;
-    let m;
-    while ((m = rule.regex.exec(content)) !== null) {
-      const group = rule.valueGroup ?? 0;
-      const value = m[group];
-      if (value === undefined || value.length === 0) {
+  scanner.reset?.();
+  scanner.lastIndex = 0;
+  let m;
+  while ((m = scanner.exec(content)) !== null) {
+    const group = rule.valueGroup ?? 0;
+    const value = m[group];
+    if (value === undefined || value.length === 0) {
+      continue;
+    }
+    if (validate && !validate(value)) {
+      continue;
+    }
+    const start = group === 0 ? m.index : m.index + m[0].indexOf(value);
+    const end = start + value.length;
+    if (rule.accept && !rule.accept(content, start, end) || accept && !accept(content, start, end)) {
+      if (m.index === scanner.lastIndex) {
+        scanner.lastIndex += 1;
+      }
+      continue;
+    }
+    const match = {
+      category: "pii",
+      policyId: rule.policyId,
+      severity: rule.severity,
+      confidence: rule.confidence,
+      start,
+      end,
+      value,
+      mask: rule.mask,
+      remediation: "Redact personal data before persisting or publishing."
+    };
+    if (rescanned.has(m)) {
+      rescanTag.add(match);
+    }
+    matches.push(match);
+    if (m.index === scanner.lastIndex) {
+      scanner.lastIndex += 1;
+    }
+  }
+  return matches;
+}
+function scanRule(content, rule) {
+  const matches = scanWith(content, rule, rule.regex, rule.validate, undefined);
+  if (rule.also === undefined) {
+    return matches;
+  }
+  let result = matches;
+  for (const extra of rule.also) {
+    const found = scanWith(content, rule, extra.regex, extra.validate ?? rule.validate, extra.accept);
+    const added = found.filter((match) => !containedIn(result, match.start, match.end));
+    if (added.length > 0) {
+      result = coalesce(content, [...result, ...added].sort((x, y) => x.start - y.start || y.end - x.end));
+    }
+  }
+  return result;
+}
+function scanRules(content) {
+  return RULES.map((rule) => scanRule(content, rule));
+}
+function decimalDigitValue(codePoint) {
+  if (codePoint < 1632) {
+    return -1;
+  }
+  const cached = digitValues.get(codePoint);
+  if (cached !== undefined) {
+    return cached;
+  }
+  let value = -1;
+  if (DECIMAL_DIGIT.test(String.fromCodePoint(codePoint))) {
+    let runStart = codePoint;
+    while (runStart > 0 && DECIMAL_DIGIT.test(String.fromCodePoint(runStart - 1))) {
+      runStart -= 1;
+    }
+    value = (codePoint - runStart) % 10;
+  }
+  digitValues.set(codePoint, value);
+  return value;
+}
+function isHyphenLookalike(code) {
+  return code >= 8208 && code <= 8213 || code === 8722 || code === 8315 || code === 8331 || code === 65112 || code === 65123 || code === 65293 || code === 1418 || code === 1470 || code === 6150 || code === 8259 || code === 12540 || code === 12448 || code === 11834 || code === 11835;
+}
+function isInvisible(code) {
+  return code === 173 || code >= 8203 && code <= 8205 || code >= 8288 && code <= 8292 || code === 6158 || code === 847 || code === 8206 || code === 8207;
+}
+function foldNumberChar(code, options) {
+  if (isInvisible(code)) {
+    return code === 173 && options.shyHyphen ? "-" : "";
+  }
+  if (code === 160 || code === 5760 || code >= 8192 && code <= 8202 || code === 8232 || code === 8233 || code === 8239 || code === 8287 || code === 12288 || code === 65279) {
+    return " ";
+  }
+  if (isHyphenLookalike(code)) {
+    return "-";
+  }
+  if (code === 8228 || code === 65106 || code === 65294 || code === 12290 || code === 65377) {
+    return ".";
+  }
+  if (code === 65312 || code === 65131) {
+    return "@";
+  }
+  if (code === 65291 || code === 8314 || code === 8330 || code === 65122) {
+    return "+";
+  }
+  if (code === 65288 || code === 8317 || code === 8333 || code === 65113) {
+    return "(";
+  }
+  if (code === 65289 || code === 8318 || code === 8334 || code === 65114) {
+    return ")";
+  }
+  if (options.letters && code >= 65313 && code <= 65338) {
+    return String.fromCharCode(code - 65313 + 65);
+  }
+  const digit = decimalDigitValue(code);
+  return digit < 0 ? null : String(digit);
+}
+function isNumberBreak(content, from, to) {
+  const before = content[from - 1];
+  const after = content[to];
+  return from > 1 && (before === "-" || before === ".") && DIGIT.test(content[from - 2]) && DIGIT.test(after ?? "") || from > 0 && DIGIT.test(before ?? "") && (after === "-" || after === ".") && DIGIT.test(content[to + 1] ?? "");
+}
+function normalizeWindow(content, from, to, options) {
+  const origin = new Int32Array(to - from + 1);
+  const parts = [];
+  let length = 0;
+  let flushed = from;
+  let changed = false;
+  for (let i = from;i < to; ) {
+    const code = content.charCodeAt(i);
+    if (code < 128) {
+      if (options.breaks && (code === 9 || code === 10 || code === 13)) {
+        let j = i + 1;
+        while (j < to && BREAK_CHAR.test(content[j])) {
+          j += 1;
+        }
+        if (isNumberBreak(content, i, j)) {
+          changed = true;
+          parts.push(content.slice(flushed, i));
+          flushed = j;
+        } else {
+          for (let k = i;k < j; k += 1) {
+            origin[length++] = k;
+          }
+        }
+        i = j;
         continue;
       }
-      if (rule.policyId === "pii.phone") {
-        const digits = countDigits(value);
-        if (digits < 9 || digits > 15) {
+      origin[length++] = i;
+      i += 1;
+      continue;
+    }
+    const codePoint = content.codePointAt(i);
+    const width = codePoint > 65535 ? 2 : 1;
+    const folded = foldNumberChar(codePoint, options);
+    if (folded === null) {
+      for (let k = 0;k < width; k += 1) {
+        origin[length++] = i;
+      }
+    } else {
+      changed = true;
+      parts.push(content.slice(flushed, i));
+      flushed = i + width;
+      if (folded !== "") {
+        parts.push(folded);
+        origin[length++] = i;
+      }
+    }
+    i += width;
+  }
+  if (!changed) {
+    return null;
+  }
+  parts.push(content.slice(flushed, to));
+  origin[length] = to;
+  return { text: parts.join(""), origin: origin.subarray(0, length + 1) };
+}
+function toOriginal(window, content, start, end) {
+  const last = window.origin[end - 1];
+  const width = content.codePointAt(last) > 65535 ? 2 : 1;
+  return [window.origin[start], last + width];
+}
+function containedIn(spans, start, end) {
+  let low = 0;
+  let high = spans.length - 1;
+  while (low <= high) {
+    const mid = low + high >> 1;
+    if (spans[mid].start <= start) {
+      low = mid + 1;
+    } else {
+      high = mid - 1;
+    }
+  }
+  const candidate = spans[high];
+  return candidate !== undefined && candidate.start <= start && candidate.end >= end;
+}
+function coalesce(content, spans) {
+  const merged = [];
+  for (const span of spans) {
+    const last = merged[merged.length - 1];
+    if (last === undefined || span.start >= last.end) {
+      merged.push(span);
+      continue;
+    }
+    const end = Math.max(last.end, span.end);
+    const union = { ...last, end, value: content.slice(last.start, end) };
+    if (rescanTag.has(last) && rescanTag.has(span)) {
+      rescanTag.add(union);
+    }
+    merged[merged.length - 1] = union;
+  }
+  return merged;
+}
+function isUniformCard(card) {
+  const separators = new Set(card.value.replace(/\d/g, ""));
+  return separators.size <= 1;
+}
+function dropRescansInsideCards(spans, cards) {
+  if (cards.length === 0 || !spans.some((span) => rescanTag.has(span))) {
+    return spans;
+  }
+  const sorted = cards.filter(isUniformCard).sort((a, b) => a.start - b.start);
+  const reach = [];
+  let farthest = 0;
+  for (const card of sorted) {
+    farthest = Math.max(farthest, card.end);
+    reach.push(farthest);
+  }
+  return spans.filter((span) => {
+    if (!rescanTag.has(span)) {
+      return true;
+    }
+    let low = 0;
+    let high = sorted.length - 1;
+    while (low <= high) {
+      const mid = low + high >> 1;
+      if (sorted[mid].start < span.end) {
+        low = mid + 1;
+      } else {
+        high = mid - 1;
+      }
+    }
+    return high < 0 || reach[high] <= span.start;
+  });
+}
+function viewsOf(content, nonAscii) {
+  const views = [];
+  if (nonAscii) {
+    views.push({});
+    if (FULLWIDTH_CAPITAL.test(content)) {
+      views.push({ letters: true });
+    }
+    if (SOFT_HYPHEN.test(content)) {
+      views.push({ shyHyphen: true });
+    }
+  }
+  if (NUMBER_BREAK.test(content)) {
+    views.push({ breaks: true });
+  }
+  return views;
+}
+function detectPii(content) {
+  const perRule = scanRules(content);
+  const nonAscii = NON_ASCII.test(content);
+  if (nonAscii) {
+    const emailRule = RULES[0];
+    const ascii = scanRule(content, { ...emailRule, regex: asciiEmailScanner });
+    const unicode = perRule[0];
+    const extraEmails = ascii.filter((match) => !containedIn(unicode, match.start, match.end));
+    if (extraEmails.length > 0) {
+      perRule[0] = [...unicode, ...extraEmails].sort((x, y) => x.start - y.start || y.end - x.end);
+    }
+  }
+  const views = viewsOf(content, nonAscii);
+  for (const options of views) {
+    for (let from = 0;from < content.length; ) {
+      let start = from;
+      let to = Math.min(content.length, from + NORMALIZE_CHUNK);
+      if (start > 0 && (content.charCodeAt(start) & 64512) === 56320) {
+        start -= 1;
+      }
+      if (to < content.length && (content.charCodeAt(to - 1) & 64512) === 55296) {
+        to += 1;
+      }
+      const window = normalizeWindow(content, start, to, options);
+      if (window !== null) {
+        const extra = scanRules(window.text);
+        extra.forEach((found, index) => {
+          if (options.breaks && !NUMBER_RULES.has(index)) {
+            return;
+          }
+          const numbers = NUMBER_RULES.has(index);
+          const base = perRule[index];
+          const added = [];
+          for (const match of found) {
+            const [a, b] = toOriginal(window, content, match.start, match.end);
+            if (!numbers && b - a !== match.end - match.start) {
+              continue;
+            }
+            if (start > 0 && a < start + NORMALIZE_SKIP) {
+              continue;
+            }
+            if (!containedIn(base, a, b) && !containedIn(added, a, b)) {
+              const copy = { ...match, start: a, end: b, value: content.slice(a, b) };
+              if (rescanTag.has(match)) {
+                rescanTag.add(copy);
+              }
+              added.push(copy);
+            }
+          }
+          if (added.length > 0) {
+            perRule[index] = coalesce(content, [...base, ...added].sort((x, y) => x.start - y.start || y.end - x.end));
+          }
+        });
+      }
+      if (to >= content.length) {
+        break;
+      }
+      from = to - NORMALIZE_OVERLAP;
+    }
+  }
+  perRule[PHONE_RULE] = dropRescansInsideCards(perRule[PHONE_RULE], perRule[CARD_RULE]);
+  return perRule.flat();
+}
+var UNICODE_EMAIL, ASCII_EMAIL, emailScanner, asciiEmailScanner, PHONE_FROM, PHONE_RUN_CHAR, PHONE_START_BLOCKER, DIGIT, PHONE_DIAL_GROUP, PHONE_FIRST_GROUP, PHONE_SEPARATOR, PHONE_NANP_SPACED, WHITESPACE, LINE_BREAK, PHONE_MAX_DIGITS = 15, PHONE_MIN_DIGITS = 9, rescanned, PHONE_JOINED_PIECE, PHONE_CARD_SHAPE, PHONE_GLUE, PHONE_GLUE_LETTER, PHONE_GLUE_EVIDENCE, phoneGlueScanner, phoneScanner, IBAN_START, IBAN_MAX_GROUPS = 8, IBAN_STATES, ibanFailed, ibanStamp = 0, ibanScanner, IBAN_LENGTHS, IBAN_GLUE_START, ibanGluedScanner, CARD_SEPARATOR = "[ \\t\\r\\n._/-]", CARD_EXTRA, CARD_GROUP_SEPARATOR, GLUE_LETTER_BEFORE, GLUE_LETTER_AFTER, NON_HEX_LETTER, GLUE_FLANK = 8, UUID_ANYWHERE, UUID_REACH = 36, SSN_BREAK_EXTRA, IPV4_EXTRA, RULES, CALENDAR_DATE, IDENTIFIER_CHAR, TOKEN_SCAN_LIMIT = 64, UUID_TOKEN, rescanTag, NORMALIZE_CHUNK, NORMALIZE_OVERLAP = 512, NORMALIZE_SKIP = 256, NON_ASCII, DECIMAL_DIGIT, digitValues, BREAK_CHAR, PHONE_RULE, CARD_RULE, NUMBER_RULES, FULLWIDTH_CAPITAL, SOFT_HYPHEN, NUMBER_BREAK;
+var init_pii = __esm(() => {
+  UNICODE_EMAIL = {
+    from: /(?:(?<=[\p{L}\p{N}\p{M}_])(?![\p{L}\p{N}\p{M}_])|(?<![\p{L}\p{N}\p{M}_])(?=[\p{L}\p{N}\p{M}_]))[\p{L}\p{N}\p{M}._%+-]+@[\p{L}\p{N}\p{M}.-]+\.[\p{L}\p{M}]{2,}(?![\p{L}\p{N}\p{M}_])/uy,
+    localChar: /[\p{L}\p{N}\p{M}._%+-]/u,
+    wordChar: /[\p{L}\p{N}\p{M}_]/u
+  };
+  ASCII_EMAIL = {
+    from: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/y,
+    localChar: /[A-Za-z0-9._%+-]/,
+    wordChar: /\w/
+  };
+  emailScanner = emailScannerFor(UNICODE_EMAIL);
+  asciiEmailScanner = emailScannerFor(ASCII_EMAIL);
+  PHONE_FROM = /(?<![\w.])(\+?\d[\d\s().-]{7,}\d)(?!\w|\.\w)/y;
+  PHONE_RUN_CHAR = /[\d\s().-]/;
+  PHONE_START_BLOCKER = /[\w.]/;
+  DIGIT = /\d/;
+  PHONE_DIAL_GROUP = /^\(?\d{2,4}\)?(?:[-.]\d{2,4})*$/;
+  PHONE_FIRST_GROUP = /^\+?\d{1,4}$/;
+  PHONE_SEPARATOR = /[+()-]/;
+  PHONE_NANP_SPACED = /^(?:\d{1,3} )?\d{3} \d{3} \d{4}$/;
+  WHITESPACE = /\s/;
+  LINE_BREAK = /[\n\r\u2028\u2029]/;
+  rescanned = new WeakSet;
+  PHONE_JOINED_PIECE = /^\+?\d{1,4}(?:[-.]\d{1,4})+$/;
+  PHONE_CARD_SHAPE = /^\d{4}(?:[-.]\d{4})+$/;
+  PHONE_GLUE = /(?<![\d.])\+?\d[\d().-]{7,}\d/g;
+  PHONE_GLUE_LETTER = /[A-Za-z_]/;
+  PHONE_GLUE_EVIDENCE = /[+()-]|\./;
+  phoneGlueScanner = {
+    lastIndex: 0,
+    exec(content) {
+      PHONE_GLUE.lastIndex = this.lastIndex;
+      let m;
+      while ((m = PHONE_GLUE.exec(content)) !== null) {
+        const start = m.index;
+        const end = start + m[0].length;
+        const glued = start > 0 && PHONE_GLUE_LETTER.test(content[start - 1]) || end < content.length && PHONE_GLUE_LETTER.test(content[end]);
+        if (glued && PHONE_GLUE_EVIDENCE.test(m[0]) && phoneVerdict(content, start, end)) {
+          this.lastIndex = end;
+          return { index: start, 0: m[0], 1: m[0] };
+        }
+      }
+      this.lastIndex = 0;
+      return null;
+    }
+  };
+  phoneScanner = {
+    lastIndex: 0,
+    pending: [],
+    cursor: 0,
+    runEnd: -1,
+    runBaseline: -1,
+    tailEnd: 0,
+    reset() {
+      this.lastIndex = 0;
+      this.pending = [];
+      this.cursor = 0;
+      this.runEnd = -1;
+      this.runBaseline = -1;
+      this.tailEnd = 0;
+    },
+    tail(content) {
+      for (let pos = this.lastIndex;pos < this.tailEnd; pos += 1) {
+        if (!DIGIT.test(content[pos]) || PHONE_START_BLOCKER.test(content[pos - 1])) {
           continue;
         }
-        if (!hasPhoneSeparatorShape(value)) {
-          continue;
+        if (this.tailEnd - pos < 9) {
+          break;
         }
-        if (containsCalendarDate(value)) {
-          continue;
+        const value = content.slice(pos, this.tailEnd);
+        return { index: pos, 0: value, 1: value };
+      }
+      this.lastIndex = this.tailEnd;
+      this.tailEnd = 0;
+      return null;
+    },
+    prefix(content, start, end) {
+      if (this.runEnd !== end) {
+        this.runEnd = end;
+        this.runBaseline = phoneBaselineEnd(content, end);
+      }
+      let digits = 0;
+      let limit = end;
+      const ends = [];
+      for (let i = start;i < end; i += 1) {
+        const ch = content[i];
+        if (DIGIT.test(ch)) {
+          digits += 1;
+          if (digits > PHONE_MAX_DIGITS) {
+            limit = i;
+            break;
+          }
+        } else if (WHITESPACE.test(ch) && DIGIT.test(content[i - 1]) && digits >= PHONE_MIN_DIGITS) {
+          ends.push(i);
         }
-        if (isIdentifierFragment(content, m.index, m.index + m[0].length)) {
-          continue;
+      }
+      const baseline = this.runBaseline;
+      if (baseline < end && baseline >= start + 9 && baseline <= limit && phoneVerdict(content, start, baseline)) {
+        return { end: baseline, baseline: true };
+      }
+      for (let k = ends.length - 1;k >= 0; k -= 1) {
+        const e = ends[k];
+        const value = content.slice(start, e);
+        if (e !== baseline && hasPhoneEvidence(value, !WHITESPACE.test(value)) && phoneVerdict(content, start, e)) {
+          return { end: e, baseline: false };
         }
       }
-      if (rule.validate && !rule.validate(value)) {
-        continue;
+      return null;
+    },
+    exec(content) {
+      for (;; ) {
+        if (this.cursor < this.pending.length) {
+          return this.pending[this.cursor++];
+        }
+        this.pending = [];
+        this.cursor = 0;
+        let m;
+        if (this.tailEnd > this.lastIndex) {
+          m = this.tail(content);
+          if (m === null) {
+            continue;
+          }
+        } else {
+          m = execPhone(content, this.lastIndex);
+          if (m === null) {
+            this.lastIndex = 0;
+            return null;
+          }
+        }
+        const end = m.index + (m[0] ?? "").length;
+        this.lastIndex = end;
+        this.tailEnd = 0;
+        if (phoneVerdict(content, m.index, end)) {
+          return m;
+        }
+        const prefix = this.prefix(content, m.index, end);
+        if (prefix !== null) {
+          const value = content.slice(m.index, prefix.end);
+          const found = { index: m.index, 0: value, 1: value };
+          if (!prefix.baseline) {
+            rescanned.add(found);
+          }
+          this.lastIndex = prefix.end;
+          this.tailEnd = end;
+          return found;
+        }
+        this.pending = withJoined(joinedPhones(content, m.index, end), rescanPhoneRun(content, m.index, end));
+        for (const found of this.pending) {
+          rescanned.add(found);
+        }
       }
-      const start = group === 0 ? m.index : m.index + m[0].indexOf(value);
-      matches.push({
-        category: "pii",
-        policyId: rule.policyId,
-        severity: rule.severity,
-        confidence: rule.confidence,
-        start,
-        end: start + value.length,
-        value,
-        mask: rule.mask,
-        remediation: "Redact personal data before persisting or publishing."
-      });
-      if (m.index === rule.regex.lastIndex) {
-        rule.regex.lastIndex += 1;
+    }
+  };
+  IBAN_START = /(?<!\w)[A-Z]{2}\d{2}/g;
+  IBAN_STATES = (4 + IBAN_MAX_GROUPS * 5 + 1) * (IBAN_MAX_GROUPS + 1);
+  ibanFailed = new Uint32Array(IBAN_STATES);
+  ibanScanner = {
+    lastIndex: 0,
+    exec(content) {
+      IBAN_START.lastIndex = this.lastIndex;
+      let m;
+      while ((m = IBAN_START.exec(content)) !== null) {
+        ibanStamp += 1;
+        if (ibanStamp === 4294967295) {
+          ibanFailed.fill(0);
+          ibanStamp = 1;
+        }
+        const end = ibanEnd(content, m.index, m.index + 4, 0);
+        if (end >= 0) {
+          this.lastIndex = end;
+          return { index: m.index, 0: content.slice(m.index, end) };
+        }
+        IBAN_START.lastIndex = m.index + 1;
+      }
+      this.lastIndex = 0;
+      return null;
+    }
+  };
+  IBAN_LENGTHS = {
+    AD: 24,
+    AE: 23,
+    AL: 28,
+    AT: 20,
+    AZ: 28,
+    BA: 20,
+    BE: 16,
+    BG: 22,
+    BH: 22,
+    BR: 29,
+    BY: 28,
+    CH: 21,
+    CR: 22,
+    CY: 28,
+    CZ: 24,
+    DE: 22,
+    DK: 18,
+    DO: 28,
+    EE: 20,
+    EG: 29,
+    ES: 24,
+    FI: 18,
+    FO: 18,
+    FR: 27,
+    GB: 22,
+    GE: 22,
+    GI: 23,
+    GL: 18,
+    GR: 27,
+    GT: 28,
+    HR: 21,
+    HU: 28,
+    IE: 22,
+    IL: 23,
+    IQ: 23,
+    IS: 26,
+    IT: 27,
+    JO: 30,
+    KW: 30,
+    KZ: 20,
+    LB: 28,
+    LC: 32,
+    LI: 21,
+    LT: 20,
+    LU: 20,
+    LV: 21,
+    MC: 27,
+    MD: 24,
+    ME: 22,
+    MK: 19,
+    MR: 27,
+    MT: 31,
+    MU: 30,
+    NL: 18,
+    NO: 15,
+    PK: 24,
+    PL: 28,
+    PS: 29,
+    PT: 25,
+    QA: 29,
+    RO: 24,
+    RS: 22,
+    SA: 24,
+    SC: 31,
+    SE: 24,
+    SI: 19,
+    SK: 24,
+    SM: 27,
+    ST: 25,
+    SV: 28,
+    TL: 23,
+    TN: 24,
+    TR: 26,
+    UA: 29,
+    VA: 22,
+    VG: 24,
+    XK: 20
+  };
+  IBAN_GLUE_START = /[A-Z]{2}\d{2}/g;
+  ibanGluedScanner = {
+    lastIndex: 0,
+    exec(content) {
+      IBAN_GLUE_START.lastIndex = this.lastIndex;
+      let m;
+      while ((m = IBAN_GLUE_START.exec(content)) !== null) {
+        const length = IBAN_LENGTHS[m[0].slice(0, 2)];
+        if (length !== undefined) {
+          let count = 0;
+          let i = m.index;
+          while (i < content.length && count < length) {
+            const code = content.charCodeAt(i);
+            if (isIbanChar(code)) {
+              count += 1;
+            } else if (!(code === 32 && count >= 4 && isIbanChar(content.charCodeAt(i + 1)))) {
+              break;
+            }
+            i += 1;
+          }
+          if (count === length) {
+            this.lastIndex = i;
+            return { index: m.index, 0: content.slice(m.index, i) };
+          }
+        }
+        IBAN_GLUE_START.lastIndex = m.index + 1;
       }
+      this.lastIndex = 0;
+      return null;
     }
-  }
-  return matches;
-}
-var RULES, CALENDAR_DATE, IDENTIFIER_CHAR, TOKEN_SCAN_LIMIT = 64, UUID_TOKEN;
-var init_pii = __esm(() => {
+  };
+  CARD_EXTRA = new RegExp(`(?<!\\d${CARD_SEPARATOR}{0,2})[2-6](?:${CARD_SEPARATOR}{0,2}\\d){12,18}(?!\\d)(?!${CARD_SEPARATOR}{1,2}\\d)`, "g");
+  CARD_GROUP_SEPARATOR = /[^\d]+/g;
+  GLUE_LETTER_BEFORE = /[A-Za-z_]+$/;
+  GLUE_LETTER_AFTER = /^[A-Za-z_]+/;
+  NON_HEX_LETTER = /[G-Zg-z_]/;
+  UUID_ANYWHERE = /[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}/g;
+  SSN_BREAK_EXTRA = /(?<![0-9])\d{3}(?:\r\n|[\t\r\n])\d{2}(?:\r\n|[\t\r\n])\d{4}(?![0-9])/g;
+  IPV4_EXTRA = /(?<![0-9.])(?<!\b[vV])\d{1,3}(?:[\t\r\n]{0,2}\.[\t\r\n]{0,2}\d{1,3}){3}(?![0-9])/g;
   RULES = [
     {
       policyId: "pii.email",
       mask: "email",
-      regex: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g,
+      regex: emailScanner,
       severity: "medium",
       confidence: 0.85
     },
     {
       policyId: "pii.phone",
       mask: "phone",
-      regex: /(?<![\w.])(\+?\d[\d\s().-]{7,}\d)(?![\w.])/g,
+      regex: phoneScanner,
       severity: "medium",
       confidence: 0.7,
-      valueGroup: 1
+      valueGroup: 1,
+      also: [{ regex: phoneGlueScanner }]
     },
     {
       policyId: "pii.address",
@@ -1892,7 +2818,7 @@ var init_pii = __esm(() => {
     {
       policyId: "pii.person-name",
       mask: "name",
-      regex: /\b(?:name\s+is|customer|client|user|patient|employee)\s*:?\s+([A-Z][a-z]+\s+[A-Z][a-z]+)\b/g,
+      regex: /\b(?:name\s+is|customer|client|user|patient|employee)(?:\s*:)?\s+([A-Z][a-z]+\s+[A-Z][a-z]+)\b/g,
       severity: "low",
       confidence: 0.45,
       valueGroup: 1
@@ -1900,10 +2826,11 @@ var init_pii = __esm(() => {
     {
       policyId: "pii.iban",
       mask: "iban",
-      regex: /\b[A-Z]{2}\d{2}(?:[ ]?[A-Z0-9]{1,4}){2,8}\b/g,
+      regex: ibanScanner,
       severity: "high",
       confidence: 0.9,
-      validate: isValidIban
+      validate: isValidIban,
+      also: [{ regex: ibanGluedScanner }]
     },
     {
       policyId: "pii.credit-card",
@@ -1911,15 +2838,24 @@ var init_pii = __esm(() => {
       regex: /\b\d(?:[ -]?\d){12,18}\b/g,
       severity: "high",
       confidence: 0.9,
-      validate: isValidCreditCard
+      validate: isValidCreditCard,
+      accept: outsideUuid,
+      also: [
+        {
+          regex: CARD_EXTRA,
+          validate: (value) => isCardCandidate(value) && isValidCreditCard(value.replace(/\D/g, "")),
+          accept: hasNonHexGlue
+        }
+      ]
     },
     {
       policyId: "pii.ssn",
       mask: "ssn",
-      regex: /\b\d{3}-\d{2}-\d{4}\b/g,
+      regex: /(?<![0-9])\d{3}-\d{2}-\d{4}(?![0-9])/g,
       severity: "high",
       confidence: 0.85,
-      validate: isValidSsn
+      validate: isValidSsn,
+      also: [{ regex: SSN_BREAK_EXTRA, validate: (value) => isValidSsn(value.replace(/\r\n|[\t\r\n]/g, "-")) }]
     },
     {
       policyId: "pii.ip",
@@ -1927,12 +2863,25 @@ var init_pii = __esm(() => {
       regex: /\b(?:(?:\d{1,3}\.){3}\d{1,3}|(?:[0-9A-Fa-f]{1,4}:){2,7}[0-9A-Fa-f]{1,4}|::1)\b/g,
       severity: "low",
       confidence: 0.6,
-      validate: isValidIp
+      validate: isValidIp,
+      also: [{ regex: IPV4_EXTRA, validate: (value) => isValidIp(value.replace(/[\t\r\n]/g, "")) }]
     }
   ];
   CALENDAR_DATE = /(?:19|20)\d{2}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])/;
   IDENTIFIER_CHAR = /[0-9A-Za-z_-]/;
   UUID_TOKEN = /^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$/;
+  rescanTag = new WeakSet;
+  NORMALIZE_CHUNK = 1 << 21;
+  NON_ASCII = /[\u0080-\uffff]/;
+  DECIMAL_DIGIT = /\p{Nd}/u;
+  digitValues = new Map;
+  BREAK_CHAR = /[\t\r\n]/;
+  PHONE_RULE = RULES.findIndex((rule) => rule.policyId === "pii.phone");
+  CARD_RULE = RULES.findIndex((rule) => rule.policyId === "pii.credit-card");
+  NUMBER_RULES = new Set(RULES.flatMap((rule, index) => ["pii.phone", "pii.iban", "pii.credit-card", "pii.ssn", "pii.ip"].includes(rule.policyId) ? [index] : []));
+  FULLWIDTH_CAPITAL = /[\uff21-\uff3a]/;
+  SOFT_HYPHEN = /\u00ad/;
+  NUMBER_BREAK = /[-.][\t\r\n]|[\t\r\n][-.]/;
 });
 
 // src/security/detect/secrets.ts
@@ -4348,17 +5297,20 @@ function locationFor(content, match) {
   };
 }
 function applyRedaction(content, matches) {
-  const redactable = matches.filter((m) => m.mask !== undefined).sort((a, b) => a.start - b.start);
+  const redactable = matches.filter((m) => m.mask !== undefined).sort((a, b) => a.start - b.start || b.end - a.end);
   let out = "";
   let cursor = 0;
   for (const match of redactable) {
-    const start = Math.max(match.start, cursor);
-    if (start >= match.end) {
+    if (match.end <= cursor) {
+      continue;
+    }
+    if (match.start < cursor) {
+      cursor = match.end;
       continue;
     }
-    out += content.slice(cursor, start);
+    out += content.slice(cursor, match.start);
     out += maskFor(match);
-    cursor = Math.max(cursor, match.end);
+    cursor = match.end;
   }
   out += content.slice(cursor);
   return out;
@@ -20145,7 +21097,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@mrciphersmith/keryx",
-    version: "0.3.77",
+    version: "0.3.78",
     description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
     private: false,
     publishConfig: {
@@ -20223,10 +21175,10 @@ var init_package = __esm(() => {
       qs: "^6.16.0",
       "@hono/node-server": "^1.19.15",
       protobufjs: "7.6.6",
-      sharp: "0.35.4"
+      sharp: "0.35.5"
     },
     optionalDependencies: {
-      "@modelcontextprotocol/sdk": "^1.30.0",
+      "@modelcontextprotocol/sdk": "^1.32.1",
       "@opentui/core": "^0.4.5",
       "web-tree-sitter": "^0.22.6"
     },
@@ -24868,6 +25820,7 @@ var init_service2 = __esm(() => {
   init_path_scan();
   init_read_source();
   init_redact();
+  init_pii();
   init_secrets();
   init_entropy();
   init_incidents();
@@ -111336,6 +112289,22 @@ async function attemptJevRequest(fetchFn, apiKey, body, timeoutMs, external) {
     }
   }
 }
+async function cancellableJevSleep(sleep, ms, signal, timeoutMs) {
+  if (signal === undefined)
+    return sleep(ms);
+  if (signal.aborted)
+    throw new JevTimeoutError(timeoutMs);
+  let onAbort = () => {};
+  const aborted = new Promise((_, reject) => {
+    onAbort = () => reject(new JevTimeoutError(timeoutMs));
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+  try {
+    await Promise.race([sleep(ms), aborted]);
+  } finally {
+    signal.removeEventListener("abort", onAbort);
+  }
+}
 async function callJevSystemOne(fetchFn = globalThis.fetch, input, opts) {
   const externalSetting = await resolveExternalSetting({ cwd: opts?.cwd ?? process.cwd(), ...opts?.dir !== undefined ? { dir: opts.dir } : {} });
   if (externalSetting.value === "off") {
@@ -111361,6 +112330,8 @@ async function callJevSystemOne(fetchFn = globalThis.fetch, input, opts) {
   let text;
   let attempt = 0;
   for (;; ) {
+    if (external?.aborted)
+      throw new JevTimeoutError(timeoutMs);
     attempt += 1;
     const outcome = await attemptJevRequest(fetchFn, apiKey, body, timeoutMs, external);
     if (outcome.kind === "timeout") {
@@ -111370,7 +112341,7 @@ async function callJevSystemOne(fetchFn = globalThis.fetch, input, opts) {
       if (attempt >= JEV_MAX_ATTEMPTS) {
         throw new JevNetworkError(attempt, outcome.cause);
       }
-      await sleepFn(jevBackoffMs(attempt));
+      await cancellableJevSleep(sleepFn, jevBackoffMs(attempt), external, timeoutMs);
       continue;
     }
     if (outcome.ok) {
@@ -111381,7 +112352,7 @@ async function callJevSystemOne(fetchFn = globalThis.fetch, input, opts) {
     text = outcome.text;
     if (JEV_RETRYABLE_STATUSES.has(status) && attempt < JEV_MAX_ATTEMPTS) {
       const retryAfterMs = retryAfterMsFromHeader(outcome.retryAfterHeader);
-      await sleepFn(retryAfterMs ?? jevBackoffMs(attempt));
+      await cancellableJevSleep(sleepFn, retryAfterMs ?? jevBackoffMs(attempt), external, timeoutMs);
       continue;
     }
     if (status === 401) {
@@ -144312,52 +145283,77 @@ class NullClassifier {
 }
 
 // src/harness/decision/classify-turn.ts
-async function withTimeout4(source, run, timeoutMs) {
+async function withTimeout4(source, run, timeoutMs, external) {
+  const cancelled = () => ({ ok: false, reason: "classification cancelled" });
+  if (external?.aborted)
+    return cancelled();
+  if (timeoutMs <= 0)
+    return { ok: false, reason: "classification deadline exceeded" };
   const controller = new AbortController;
+  const onExternalAbort = () => controller.abort();
+  external?.addEventListener("abort", onExternalAbort, { once: true });
   const timer = setTimeout(() => controller.abort(), timeoutMs);
+  let onAbort = () => {};
   try {
-    return await Promise.race([
-      run(controller.signal),
-      new Promise((resolve) => {
-        controller.signal.addEventListener("abort", () => resolve({ ok: false, reason: `${source} classifier timed out after ${timeoutMs}ms` }));
-      })
-    ]);
+    const aborted = new Promise((resolve) => {
+      onAbort = () => resolve(external?.aborted ? cancelled() : { ok: false, reason: `${source} classifier timed out after ${timeoutMs}ms` });
+      controller.signal.addEventListener("abort", onAbort, { once: true });
+    });
+    return await Promise.race([run(controller.signal), aborted]);
   } catch (error) {
     return { ok: false, reason: `${source} classifier errored: ${error instanceof Error ? error.message : String(error)}` };
   } finally {
     clearTimeout(timer);
+    external?.removeEventListener("abort", onExternalAbort);
+    controller.signal.removeEventListener("abort", onAbort);
+    controller.abort();
   }
 }
 async function classifyTurn(line, categories, opts = {}) {
   if (isSlashCommandLine(line) || categories.length === 0)
     return;
+  if (opts.signal?.aborted)
+    return { result: { ok: false, reason: "classification cancelled" }, trace: [] };
   const deterministic = classifyDeterministic(line);
   if (deterministic !== undefined && categories.includes(deterministic)) {
     const result = { ok: true, category: deterministic, confidence: 1, source: "deterministic" };
     return { result, trace: [{ source: "deterministic", result }] };
   }
   const timeoutMs = opts.timeoutMs ?? CLASSIFY_TURN_TIMEOUT_MS;
+  const deadline = performance.now() + Math.max(0, timeoutMs);
+  const remaining = () => Math.max(0, deadline - performance.now());
+  const fallback = opts.fallbackModel !== undefined ? opts.fallbackModel : opts.sessionProvider !== undefined && opts.sessionModel !== undefined ? { providerId: opts.sessionProvider, modelId: opts.sessionModel } : undefined;
   const trace = [];
+  const stopped = () => opts.signal?.aborted ? { result: { ok: false, reason: "classification cancelled" }, trace } : remaining() <= 0 ? { result: { ok: false, reason: "classification deadline exceeded" }, trace } : undefined;
+  const initialStop = stopped();
+  if (initialStop)
+    return initialStop;
   if (opts.jevEnabled === true) {
     const credential = resolveJevClassifierCredential(opts.env, opts.dir);
     if (credential.key !== undefined) {
       const jev = new JevTaskClassifier({ ...opts.fetch !== undefined ? { fetch: opts.fetch } : {}, ...opts.env !== undefined ? { env: opts.env } : {}, ...opts.dir !== undefined ? { dir: opts.dir } : {}, timeoutMs });
-      const jevResult = await withTimeout4("jev", (signal) => jev.classify(line, categories, { signal }), timeoutMs);
+      const jevResult = await withTimeout4("jev", (signal) => jev.classify(line, categories, { signal }), Math.min(remaining(), fallback != null ? timeoutMs / 2 : timeoutMs), opts.signal);
       trace.push({ source: "jev", result: jevResult });
+      const jevStop = stopped();
+      if (jevStop)
+        return jevStop;
       if (jevResult.ok)
         return { result: jevResult, trace };
     }
   }
-  if (opts.sessionProvider !== undefined && opts.sessionModel !== undefined) {
+  if (fallback != null) {
     const mainModel = new MainModelTaskClassifier({
-      provider: opts.sessionProvider,
-      model: opts.sessionModel,
+      provider: fallback.providerId,
+      model: fallback.modelId,
       ...opts.env !== undefined ? { env: opts.env } : {},
       ...opts.fetch !== undefined ? { fetch: opts.fetch } : {},
       ...opts.providerFactory !== undefined ? { providerFactory: opts.providerFactory } : {}
     });
-    const mainModelResult = await withTimeout4("main-model", (signal) => mainModel.classify(line, categories, { signal }), timeoutMs);
+    const mainModelResult = await withTimeout4("main-model", (signal) => mainModel.classify(line, categories, { signal }), remaining(), opts.signal);
     trace.push({ source: "main-model", result: mainModelResult });
+    const mainStop = stopped();
+    if (mainStop)
+      return mainStop;
     if (mainModelResult.ok)
       return { result: mainModelResult, trace };
   }
@@ -144371,42 +145367,123 @@ var init_classify_turn = __esm(() => {
   init_main_model_classifier();
 });
 
+// src/harness/routing/classifier-model.ts
+function selectClassifierModel(detected, profiles, allowed) {
+  const candidates = [];
+  for (const provider of detected) {
+    for (const modelId of provider.models ?? []) {
+      const profile = profiles[profileKey(provider.name, modelId)];
+      if (!profile?.available || !isModelDerivable(profile))
+        continue;
+      if (profile.strengthTier.value === "light" || profile.strengthTier.source === "unknown" || profile.strengthTier.source === "guessed")
+        continue;
+      if (allowed(provider.name, modelId))
+        candidates.push(profile);
+    }
+  }
+  candidates.sort((a, b) => Number(a.strengthTier.value === "deep") - Number(b.strengthTier.value === "deep") || b.priority.value - a.priority.value || profileKey(a.providerId, a.modelId).localeCompare(profileKey(b.providerId, b.modelId)));
+  const selected = candidates[0];
+  return selected === undefined ? undefined : { providerId: selected.providerId, modelId: selected.modelId };
+}
+var init_classifier_model = __esm(() => {
+  init_model_profile();
+});
+
 // src/tui/routing-classifier-source.ts
 async function runRoutingClassifierForTurn(line, opts) {
+  if (opts.signal?.aborted)
+    return;
   if (!opts.enabled)
     return;
+  const profiles = loadModelProfiles(opts.userConfigDir);
+  const env = envWithSavedApiKeys(opts.env ?? process.env);
+  const external = await resolveExternalSetting({ cwd: opts.cwd, ...opts.userConfigDir !== undefined ? { dir: opts.userConfigDir } : {} });
+  if (opts.signal?.aborted)
+    return;
+  const externalAllowed = externalAllowedConnectedPredicate(connectedPredicateFrom(opts.detected), external.value === "on", loadExternalProvidersConfig(opts.userConfigDir).config);
+  const fallbackModel = selectClassifierModel(opts.detected, profiles, (providerId, modelId) => externalAllowed(providerId, modelId) && (opts.classifierAllowed?.(providerId, modelId) ?? true) && (opts.providerFactory !== undefined || hasCredential(providerId, env)));
   const classification = await classifyTurn(line, TURN_CLASSIFIER_CATEGORIES, {
-    jevEnabled: opts.jevEnabled,
-    sessionProvider: opts.sessionProvider,
-    sessionModel: opts.sessionModel,
+    jevEnabled: opts.jevEnabled && opts.jevAllowed !== false,
+    ...opts.signal !== undefined ? { signal: opts.signal } : {},
+    fallbackModel: fallbackModel ?? null,
+    ...opts.providerFactory !== undefined ? { providerFactory: opts.providerFactory } : {},
     ...opts.env !== undefined ? { env: opts.env } : {},
     ...opts.fetch !== undefined ? { fetch: opts.fetch } : {},
     timeoutMs: opts.timeoutMs ?? CLASSIFY_TURN_TIMEOUT_MS
   });
-  if (classification === undefined || !classification.result.ok)
+  if (opts.signal?.aborted)
+    return;
+  if (classification === undefined)
     return;
+  const baseline = { providerId: opts.sessionProvider, modelId: opts.sessionModel };
+  const skippedJev = opts.jevEnabled && opts.jevAllowed === false ? "jev: caller policy denied" : opts.jevEnabled && resolveJevClassifierCredential(opts.env).key === undefined ? "jev: credentials unavailable" : undefined;
+  if (!classification.result.ok) {
+    const failures = classification.trace.flatMap((stage) => stage.result.ok ? [] : [`${stage.source}: ${stage.result.reason}`]);
+    return {
+      classification,
+      baseline,
+      assignment: { kind: "session-default" },
+      fallbackReason: redactSensitiveText([
+        skippedJev,
+        ...failures,
+        fallbackModel === undefined ? "no available authorized sufficient classifier" : undefined,
+        classification.result.reason
+      ].filter(Boolean).join("; "))
+    };
+  }
   const category = classification.result.category;
   const location = { cwd: opts.cwd, ...opts.userConfigDir !== undefined ? { userConfigDir: opts.userConfigDir } : {} };
   const [project, user] = await Promise.all([loadRoutingConfig("project", location), loadRoutingConfig("user", location)]);
+  if (opts.signal?.aborted)
+    return;
   const connected = connectedPredicateFrom(opts.detected);
-  const profiles = loadModelProfiles(opts.userConfigDir);
   const available = availablePredicateFromProfiles(profiles);
+  let fallbackReason;
+  const connectedForTurn = (providerId, modelId) => {
+    if (modelId !== undefined) {
+      const reason = !connected(providerId, modelId) ? "model not connected" : !available(providerId, modelId) ? "model unavailable" : !(opts.executorAllowed?.(providerId, modelId) ?? true) ? "executor policy denied" : undefined;
+      if (reason !== undefined) {
+        fallbackReason ??= `${providerId}/${modelId}: ${reason}`;
+        return false;
+      }
+      return true;
+    }
+    const defaultId = resolveProviderDefaultModelId(providerId);
+    const reason = !connected(providerId) ? "provider not connected" : defaultId === undefined ? "no documented provider default" : !connected(providerId, defaultId) ? "default model not connected" : !available(providerId, defaultId) ? "default model unavailable" : !(opts.executorAllowed?.(providerId, defaultId) ?? true) ? "executor policy denied" : opts.providerFactory === undefined && !hasCredential(providerId, env) ? "credentials unavailable" : undefined;
+    if (reason !== undefined) {
+      fallbackReason ??= `${providerId} (provider default): ${reason}`;
+      return false;
+    }
+    return true;
+  };
   const sessionProvider = opts.detected.find((p) => p.name === opts.sessionProvider);
   const models = sessionProvider?.models ?? [opts.sessionModel];
   const derived = deriveDefaultTable(opts.sessionProvider, models, profiles, opts.sessionModel);
-  const resolved = resolveCategoryDetailed(category, { project: project.table, user: user.table, derived }, connected, available);
-  if (resolved.assignment.kind === "session-default") {
-    return { classification, category, assignment: resolved.assignment };
-  }
+  const resolved = resolveCategoryDetailed(category, { project: project.table, user: user.table, derived }, connectedForTurn, available);
+  fallbackReason ??= resolved.rejected === undefined ? skippedJev : describeRejectionNotice(resolved.rejected, resolved.assignment);
+  const stageFailures = classification.trace.flatMap((stage) => stage.result.ok ? [] : [`${stage.source}: ${stage.result.reason}`]);
+  const reasons = [...new Set([skippedJev, ...stageFailures, fallbackReason].filter((reason) => reason !== undefined))];
+  fallbackReason = reasons.length === 0 ? undefined : redactSensitiveText(reasons.join("; "));
+  const result = {
+    classification,
+    category,
+    baseline,
+    assignment: resolved.assignment,
+    ...fallbackReason !== undefined ? { fallbackReason: redactSensitiveText(fallbackReason) } : {}
+  };
+  if (resolved.assignment.kind === "session-default")
+    return result;
   if (resolved.assignment.kind === "model") {
-    return { classification, category, assignment: resolved.assignment, routed: { providerId: resolved.assignment.providerId, modelId: resolved.assignment.modelId } };
+    return { ...result, routed: { providerId: resolved.assignment.providerId, modelId: resolved.assignment.modelId } };
   }
-  return { classification, category, assignment: resolved.assignment };
+  const modelId = resolveProviderDefaultModelId(resolved.assignment.providerId);
+  return modelId === undefined ? result : { ...result, routed: { providerId: resolved.assignment.providerId, modelId } };
 }
 function renderRoutingFallbackLine(result) {
   if (result === undefined)
     return "[route fallback: no classifier category; using session model]";
-  return `[route fallback: ${result.category} -> ${describeAssignment(result.assignment)}; using session model]`;
+  const target = result.baseline === undefined ? "session model" : `${result.baseline.providerId}/${result.baseline.modelId}`;
+  return redactSensitiveText(`[route fallback: ${result.category ?? "no classifier category"} -> ${describeAssignment(result.assignment)}${result.fallbackReason !== undefined ? `; ${result.fallbackReason}` : ""}; using ${target}]`);
 }
 function pct6(n) {
   return `${Math.round(n * 100)}%`;
@@ -144416,7 +145493,7 @@ function renderRoutingTagLine(result) {
     return;
   const source = result.classification.result.ok ? result.classification.result.source : "none";
   const confidence = result.classification.result.ok ? ` ${pct6(result.classification.result.confidence)}` : "";
-  return `[${result.category} -> ${result.routed.providerId}/${result.routed.modelId}] (${source}${confidence})`;
+  return `[${result.category} -> ${result.routed.providerId}/${result.routed.modelId}] (${source}${confidence}${result.fallbackReason !== undefined ? `; fallback: ${result.fallbackReason}` : ""})`;
 }
 function renderRoutingSidebarValue(enabled, routedCount, lastCategory) {
   if (!enabled)
@@ -144429,6 +145506,14 @@ var init_routing_classifier_source = __esm(() => {
   init_table();
   init_config2();
   init_derive_default_table();
+  init_provider_default();
+  init_classifier_model();
+  init_single_turn();
+  init_shell_config();
+  init_service2();
+  init_jev_classifier();
+  init_external_switch();
+  init_external_providers();
   init_model_profile();
   TURN_CLASSIFIER_CATEGORIES = ROUTING_CATEGORIES.filter((c) => c !== "default");
 });
@@ -155518,6 +156603,15 @@ var init_digest_summary = __esm(() => {
 import { randomUUID as randomUUID41 } from "crypto";
 import { mkdir as mkdir68, mkdtemp as mkdtemp10, rm as rm26, writeFile as writeFile44 } from "fs/promises";
 import path303 from "path";
+function scrubDigestReportLocator(locator, env) {
+  const scrubbed = scrubGrantedOutput(locator, env);
+  const basename = path303.basename(locator);
+  if (!/^dig-\d{8}T\d{6}-[a-f0-9]{8}\.md$/.test(basename))
+    return scrubbed;
+  const from = locator.length - basename.length;
+  const phones = detectPii(locator).filter((m) => m.mask === "phone" && m.start >= from);
+  return scrubbed === applyRedaction(locator, phones) ? locator : scrubbed;
+}
 function capForDelivery(text, reportPath) {
   if (text.length <= DELIVERY_TEXT_MAX)
     return text;
@@ -155691,8 +156785,8 @@ async function runLocked2(projectRoot, entry, action, deps, runId, now) {
   const statusReason = stopReason ?? (crashed !== undefined ? `the run threw: ${crashed}` : everySourceFailed ? "no source could be read" : undefined);
   const statusDetail = everySourceFailed && stopReason === undefined && crashed === undefined ? partial.slice(0, 6).map((f) => `
 - ${f.source}: ${f.detail}`).join("") : "";
-  const message = statusReason !== undefined ? scrubGrantedOutput(`Digest ${entry.name} stopped \u2014 ${statusReason}${statusDetail}${reportPath !== undefined ? `
-Report: ${reportPath}` : ""}`, env) : capForDelivery(scrubGrantedOutput(summaryText !== undefined ? `Summary (written by the model)
+  const message = statusReason !== undefined ? `${scrubGrantedOutput(`Digest ${entry.name} stopped \u2014 ${statusReason}${statusDetail}`, env)}${reportPath !== undefined ? `
+Report: ${scrubDigestReportLocator(reportPath, env)}` : ""}` : capForDelivery(scrubGrantedOutput(summaryText !== undefined ? `Summary (written by the model)
 ${summaryText}
 
 ${body}` : body, env), reportPath);
@@ -155769,6 +156863,7 @@ var init_digest_run = __esm(() => {
   init_trigger_dispatch();
   init_fs();
   init_maintenance_lock();
+  init_service2();
   init_digest_config();
   init_granted_tools();
   init_schedule_verify();
@@ -160059,7 +161154,6 @@ async function launchTuiAgentShell(opts) {
     let routingEnabled = loadShellConfig().routingClassifier?.enabled === true;
     let routingRoutedCount = 0;
     let routingLastCategory;
-    let sessionModelExplicit = false;
     const refreshRoutingSidebar = () => {
       clearTranscriptChildren(sbRoute);
       if (!routingEnabled)
@@ -161950,7 +163044,6 @@ ${formatThemeList(getThemeId())}`);
     };
     const switchTo = async (ns) => {
       currentSel = ns;
-      sessionModelExplicit = true;
       deps = {
         ...await opts.makeAgentDeps(ns, liveSlateSession, busClientRef),
         onContextCompaction,
@@ -163438,15 +164531,13 @@ ${formatThemeList(getThemeId())}`);
       const sessionDeps = deps;
       (async () => {
         let deps = sessionDeps;
+        const turnSignal = foregroundOperation.signal;
         let routingOutcome;
-        if (routingEnabled && sessionModelExplicit && origin === "operator") {
-          io.onSystem?.(`[route skipped: manual /model selection pins this session]
-`);
-        }
-        if (routingEnabled && !sessionModelExplicit && origin === "operator" && line.trim().length > 0) {
+        if (routingEnabled && origin === "operator" && line.trim().length > 0) {
           try {
             routingOutcome = await runRoutingClassifierForTurn(line, {
               enabled: routingEnabled,
+              signal: turnSignal,
               jevEnabled: routingEnabled,
               cwd: opts.session?.cwd ?? process.cwd(),
               detected: opts.detected ?? [],
@@ -163454,7 +164545,7 @@ ${formatThemeList(getThemeId())}`);
               sessionModel: currentSel.model
             });
           } catch {}
-          if (routingOutcome?.routed !== undefined) {
+          if (!turnSignal.aborted && routingOutcome?.routed !== undefined) {
             try {
               deps = {
                 ...await opts.makeAgentDeps({ provider: routingOutcome.routed.providerId, model: routingOutcome.routed.modelId }, liveSlateSession, busClientRef),
@@ -163463,19 +164554,22 @@ ${formatThemeList(getThemeId())}`);
                 ...sessionDeps.busAck !== undefined ? { busAck: sessionDeps.busAck } : {},
                 ...sessionDeps.busLeases !== undefined ? { busLeases: sessionDeps.busLeases } : {}
               };
-              routingRoutedCount += 1;
-              routingLastCategory = routingOutcome.category;
-              refreshRoutingSidebar();
-              const tag = renderRoutingTagLine(routingOutcome);
-              if (tag !== undefined)
-                io.onSystem?.(`${tag}
+              if (!turnSignal.aborted) {
+                routingRoutedCount += 1;
+                routingLastCategory = routingOutcome.category;
+                refreshRoutingSidebar();
+                const tag = renderRoutingTagLine(routingOutcome);
+                if (tag !== undefined)
+                  io.onSystem?.(`${tag}
 `);
+              }
             } catch {
               deps = sessionDeps;
-              io.onSystem?.(`[route fallback: selected model could not be prepared; check availability and external policy; using session model]
+              if (!turnSignal.aborted)
+                io.onSystem?.(`[route fallback: selected model could not be prepared; check availability and external policy; using session model]
 `);
             }
-          } else {
+          } else if (!turnSignal.aborted) {
             io.onSystem?.(`${renderRoutingFallbackLine(routingOutcome)}
 `);
           }
@@ -163485,12 +164579,11 @@ ${formatThemeList(getThemeId())}`);
         syncArchive();
         rewindRecorder.beginTurn({ archiveIndex: archive.length, prompt: line });
         const foregroundIo = createForegroundAgentIoFacade(foregroundOperation, operation, io, telegramTurn ? telegramTurnIo : {});
-        const turnSignal = foregroundOperation.signal;
-        runAgentTurn(foregroundIo, deps, history, line, {
+        (turnSignal.aborted ? Promise.resolve() : runAgentTurn(foregroundIo, deps, history, line, {
           signal: turnSignal,
           ...origin === "operator" ? {} : { origin },
           ...slateSession !== undefined ? { slateSession, pruneArchive: true } : {}
-        }).finally(() => {
+        })).finally(() => {
           foregroundOperation.settle(operation);
           remoteQueue.turnSettled({ failed: turnFailed, aborted: turnSignal.aborted });
           if (foregroundOperation.isDisposed)
@@ -201678,7 +202771,22 @@ async function startServeListener(input) {
         } catch (error) {
           console.error(`keryx serve: remote surface did not close cleanly: ${error instanceof Error ? error.message : String(error)}`);
         }
-        await server.stop(true);
+        if (input.remote === undefined) {
+          await server.stop(true);
+        } else {
+          let timer;
+          try {
+            await Promise.race([
+              server.stop(false),
+              new Promise((resolve) => {
+                timer = setTimeout(resolve, 250);
+              })
+            ]);
+            await server.stop(true);
+          } finally {
+            clearTimeout(timer);
+          }
+        }
         state = "stopped";
       }
     }