@mrciphersmith/keryx 0.3.77 → 0.3.79

package/dist/core.js

@@ -1969,13 +1969,367 @@ function isValidIp(value) {
   }
   return false;
 }
-function countDigits(value) {
-  let n = 0;
-  for (const ch of value) {
-    if (ch >= "0" && ch <= "9")
-      n += 1;
+function isWordBoundary(flavour, content, index) {
+  flavour.boundary.lastIndex = index;
+  return flavour.boundary.test(content);
+}
+function wordCharBefore(content, index) {
+  if (index <= 0) {
+    return "";
+  }
+  const low = content.charCodeAt(index - 1);
+  if (low >= 56320 && low <= 57343 && index >= 2) {
+    const high = content.charCodeAt(index - 2);
+    if (high >= 55296 && high <= 56319) {
+      return content.slice(index - 2, index);
+    }
+  }
+  return content[index - 1];
+}
+function wordCharAt(content, index) {
+  const code = content.codePointAt(index);
+  return code === undefined ? "" : String.fromCodePoint(code);
+}
+function execEmail(flavour, content, from) {
+  let at = content.indexOf("@", from);
+  while (at !== -1) {
+    let start = at;
+    while (start > from && flavour.localChar.test(wordCharBefore(content, start))) {
+      start -= wordCharBefore(content, start).length;
+    }
+    while (start < at && !isWordBoundary(flavour, content, start)) {
+      start += wordCharAt(content, start).length;
+    }
+    if (start < at) {
+      flavour.from.lastIndex = start;
+      const m = flavour.from.exec(content);
+      if (m !== null) {
+        return m;
+      }
+    }
+    at = content.indexOf("@", at + 1);
+  }
+  return null;
+}
+function emailScannerFor(flavour) {
+  return {
+    lastIndex: 0,
+    exec(content) {
+      const m = execEmail(flavour, content, this.lastIndex);
+      this.lastIndex = m === null ? 0 : m.index + m[0].length;
+      return m;
+    }
+  };
+}
+function execPhone(content, from) {
+  let pos = from;
+  while (pos < content.length) {
+    const digitAt = content[pos] === "+" ? pos + 1 : pos;
+    if (!DIGIT.test(content[digitAt] ?? "") || pos > 0 && PHONE_START_BLOCKER.test(content[pos - 1])) {
+      pos += 1;
+      continue;
+    }
+    PHONE_FROM.lastIndex = pos;
+    const m = PHONE_FROM.exec(content);
+    if (m !== null) {
+      return m;
+    }
+    pos = digitAt + 1;
+    while (pos < content.length && PHONE_RUN_CHAR.test(content[pos])) {
+      pos += 1;
+    }
+  }
+  return null;
+}
+function phoneVerdict(content, start, end) {
+  let digits = 0;
+  for (let i = start;i < end && digits <= PHONE_MAX_DIGITS; i += 1) {
+    if (DIGIT.test(content[i])) {
+      digits += 1;
+    }
+  }
+  if (digits < PHONE_MIN_DIGITS || digits > PHONE_MAX_DIGITS) {
+    return false;
+  }
+  const value = content.slice(start, end);
+  return hasPhoneSeparatorShape(value) && !containsCalendarDate(value) && !isIdentifierFragment(content, start, end);
+}
+function hasPhoneEvidence(value, singleToken) {
+  return PHONE_SEPARATOR.test(value) || singleToken && value.includes(".") || PHONE_NANP_SPACED.test(value);
+}
+function phoneTokens(content, from, to) {
+  const tokens = [];
+  let i = from;
+  while (i < to) {
+    const gapStart = i;
+    while (i < to && WHITESPACE.test(content[i])) {
+      i += 1;
+    }
+    if (i >= to) {
+      break;
+    }
+    const breakBefore = tokens.length > 0 && (i - gapStart >= 2 || LINE_BREAK.test(content.slice(gapStart, i)));
+    const start = i;
+    let digits = 0;
+    let lastDigit = -1;
+    let coreStart = -1;
+    let leadDigits = 0;
+    while (i < to && !WHITESPACE.test(content[i])) {
+      const isDigit = DIGIT.test(content[i]);
+      if (coreStart < 0) {
+        const startsHere = (isDigit || content[i] === "+" && i + 1 < to && DIGIT.test(content[i + 1])) && (i === 0 || !PHONE_START_BLOCKER.test(content[i - 1]));
+        if (startsHere) {
+          coreStart = i;
+        } else if (isDigit) {
+          leadDigits += 1;
+        }
+      }
+      if (isDigit) {
+        digits += 1;
+        lastDigit = i;
+      }
+      i += 1;
+    }
+    const text = content.slice(start, i);
+    const groupable = (PHONE_DIAL_GROUP.test(text) || PHONE_FIRST_GROUP.test(text)) && !containsCalendarDate(text);
+    tokens.push({ start, end: i, coreStart, coreEnd: lastDigit + 1, leadDigits, digits, breakBefore, groupable });
+  }
+  return tokens;
+}
+function rescanPhoneRun(content, from, to) {
+  const tokens = phoneTokens(content, from, to);
+  const found = [];
+  const chainAfter = new Array(tokens.length).fill(0);
+  for (let i = tokens.length - 2;i >= 0; i -= 1) {
+    const next = tokens[i + 1];
+    chainAfter[i] = next.groupable && !next.breakBefore ? chainAfter[i + 1] + next.digits : 0;
+  }
+  let first = 0;
+  let resume = -1;
+  while (first < tokens.length) {
+    const head = tokens[first];
+    if (head.coreStart < 0 || head.coreEnd <= head.coreStart) {
+      first += 1;
+      continue;
+    }
+    const startsRun = first === 0 || first === resume || head.breakBefore || !tokens[first - 1].groupable;
+    let longest = -1;
+    let clean = -1;
+    const consider = (last) => {
+      const end = tokens[last].coreEnd;
+      if (hasPhoneEvidence(content.slice(head.coreStart, end), last === first) && phoneVerdict(content, head.coreStart, end)) {
+        longest = last;
+        const rest = chainAfter[last];
+        if (rest === 0 || rest >= PHONE_MIN_DIGITS) {
+          clean = last;
+        }
+      }
+    };
+    let digits = head.digits - head.leadDigits;
+    if (digits >= PHONE_MIN_DIGITS) {
+      consider(first);
+    }
+    const headGroup = content.slice(head.coreStart, head.end);
+    let extendable = startsRun && (PHONE_FIRST_GROUP.test(headGroup) || PHONE_DIAL_GROUP.test(headGroup));
+    for (let last = first + 1;last < tokens.length && extendable; last += 1) {
+      const tail = tokens[last];
+      digits += tail.digits;
+      if (digits > PHONE_MAX_DIGITS || tail.digits === 0 || tail.breakBefore) {
+        break;
+      }
+      if (digits >= PHONE_MIN_DIGITS && PHONE_DIAL_GROUP.test(content.slice(tail.start, tail.coreEnd))) {
+        consider(last);
+      }
+      extendable = PHONE_DIAL_GROUP.test(content.slice(tail.start, tail.end));
+    }
+    const best = clean >= 0 ? clean : longest;
+    if (best >= 0) {
+      const value = content.slice(head.coreStart, tokens[best].coreEnd);
+      found.push({ index: head.coreStart, 0: value, 1: value });
+      first = best + 1;
+      resume = first;
+    } else {
+      first += 1;
+    }
+  }
+  return found;
+}
+function joinedPhones(content, from, to) {
+  const found = [];
+  let i = from;
+  while (i < to) {
+    while (i < to && WHITESPACE.test(content[i])) {
+      i += 1;
+    }
+    let zoneEnd = i;
+    let total = 0;
+    while (zoneEnd < to && !WHITESPACE.test(content[zoneEnd])) {
+      if (DIGIT.test(content[zoneEnd])) {
+        total += 1;
+      }
+      zoneEnd += 1;
+    }
+    if (total > PHONE_MAX_DIGITS && !containsCalendarDate(content.slice(i, zoneEnd))) {
+      joinedZone(content, i, zoneEnd, total, found);
+    }
+    i = zoneEnd;
+  }
+  return found;
+}
+function isJoinerAt(content, k, to) {
+  const ch = content[k];
+  return (ch === "-" || ch === ".") && k > 0 && DIGIT.test(content[k - 1]) && k + 1 < to && DIGIT.test(content[k + 1]);
+}
+function joinedZone(content, zoneStart, zoneEnd, total, found) {
+  let s = zoneStart;
+  let before = 0;
+  for (;; ) {
+    while (s < zoneEnd && !DIGIT.test(content[s]) && !(content[s] === "+" && s + 1 < zoneEnd && DIGIT.test(content[s + 1]))) {
+      s += 1;
+    }
+    if (s >= zoneEnd) {
+      return;
+    }
+    let digits = 0;
+    let lastDigit = s;
+    let open = true;
+    const cuts = [];
+    for (let k = s;k < zoneEnd && open; k += 1) {
+      if (DIGIT.test(content[k])) {
+        digits += 1;
+        lastDigit = k;
+        open = digits <= PHONE_MAX_DIGITS;
+      } else if (digits >= PHONE_MIN_DIGITS && isJoinerAt(content, k, zoneEnd)) {
+        cuts.push({ end: k, digits });
+      }
+    }
+    if (open && digits >= PHONE_MIN_DIGITS) {
+      cuts.push({ end: lastDigit + 1, digits });
+    }
+    let pick = -1;
+    for (let c = cuts.length - 1;c >= 0; c -= 1) {
+      const cut = cuts[c];
+      const piece = content.slice(s, cut.end);
+      if (!PHONE_JOINED_PIECE.test(piece) || PHONE_CARD_SHAPE.test(piece) || !phoneVerdict(content, s, cut.end)) {
+        continue;
+      }
+      if (pick < 0) {
+        pick = c;
+      }
+      const rest = total - before - cut.digits;
+      if (rest === 0 || rest >= PHONE_MIN_DIGITS) {
+        pick = c;
+        break;
+      }
+    }
+    if (pick < 0) {
+      return;
+    }
+    const cut = cuts[pick];
+    const value = content.slice(s, cut.end);
+    found.push({ index: s, 0: value, 1: value });
+    before += cut.digits;
+    s = cut.end + 1;
+  }
+}
+function withJoined(joined, rescans) {
+  if (joined.length === 0) {
+    return rescans;
+  }
+  const merged = [];
+  let cursor = 0;
+  let pending = 0;
+  for (const rescan of rescans) {
+    const rescanEnd = rescan.index + (rescan[0] ?? "").length;
+    while (cursor < joined.length && joined[cursor].index + (joined[cursor][0] ?? "").length <= rescan.index) {
+      cursor += 1;
+    }
+    if (cursor < joined.length && joined[cursor].index < rescanEnd) {
+      continue;
+    }
+    while (pending < joined.length && joined[pending].index < rescan.index) {
+      merged.push(joined[pending]);
+      pending += 1;
+    }
+    merged.push(rescan);
+  }
+  while (pending < joined.length) {
+    merged.push(joined[pending]);
+    pending += 1;
+  }
+  return merged;
+}
+function phoneBaselineEnd(content, runEnd) {
+  for (let e = runEnd;e > 0; e -= 1) {
+    if (DIGIT.test(content[e - 1]) && (e >= content.length || !PHONE_START_BLOCKER.test(content[e]))) {
+      return e;
+    }
+  }
+  return -1;
+}
+function isIbanChar(code) {
+  return code >= 65 && code <= 90 || code >= 48 && code <= 57;
+}
+function isAsciiWordChar(code) {
+  return isIbanChar(code) || code >= 97 && code <= 122 || code === 95;
+}
+function ibanEnd(content, base, pos, groups) {
+  const key = (pos - base) * (IBAN_MAX_GROUPS + 1) + groups;
+  if (ibanFailed[key] === ibanStamp) {
+    return -1;
+  }
+  if (groups < IBAN_MAX_GROUPS) {
+    const from = content.charCodeAt(pos) === 32 ? pos + 1 : pos;
+    let run = 0;
+    while (run < 4 && isIbanChar(content.charCodeAt(from + run))) {
+      run += 1;
+    }
+    for (let length = run;length >= 1; length -= 1) {
+      const end = ibanEnd(content, base, from + length, groups + 1);
+      if (end >= 0) {
+        return end;
+      }
+    }
+  }
+  if (groups >= 2 && !isAsciiWordChar(content.charCodeAt(pos))) {
+    return pos;
+  }
+  ibanFailed[key] = ibanStamp;
+  return -1;
+}
+function isCardCandidate(value) {
+  const separators = value.match(CARD_GROUP_SEPARATOR) ?? [];
+  const first = separators[0];
+  if (first === undefined) {
+    return true;
+  }
+  if (!separators.every((separator) => separator === first)) {
+    return false;
+  }
+  const lengths = value.split(first).map((group) => group.length);
+  const last = lengths[lengths.length - 1];
+  if (lengths.length === 3 && lengths[0] === 4 && lengths[1] === 6 && (last === 5 || last === 4)) {
+    return true;
   }
-  return n;
+  return lengths.slice(0, -1).every((length) => length === 4) && last >= 1 && last <= 7;
+}
+function hasNonHexGlue(content, start, end) {
+  const before = GLUE_LETTER_BEFORE.exec(content.slice(Math.max(0, start - GLUE_FLANK), start))?.[0] ?? "";
+  const after = GLUE_LETTER_AFTER.exec(content.slice(end, end + GLUE_FLANK))?.[0] ?? "";
+  return before === "" && after === "" || NON_HEX_LETTER.test(before) || NON_HEX_LETTER.test(after);
+}
+function outsideUuid(content, start, end) {
+  const from = Math.max(0, start - UUID_REACH);
+  const window = content.slice(from, Math.min(content.length, end + UUID_REACH));
+  UUID_ANYWHERE.lastIndex = 0;
+  let m;
+  while ((m = UUID_ANYWHERE.exec(window)) !== null) {
+    if (from + m.index < end && from + m.index + m[0].length > start) {
+      return false;
+    }
+    UUID_ANYWHERE.lastIndex = m.index + 1;
+  }
+  return true;
 }
 function containsCalendarDate(value) {
   return CALENDAR_DATE.test(value);
@@ -2028,71 +2382,644 @@ function hasPhoneSeparatorShape(value) {
     return /^\(?\d{2,4}\)?(?:[-.]\d{2,4})*$/.test(group);
   });
 }
-function detectPii(content) {
+function scanWith(content, rule, scanner, validate, accept) {
   const matches = [];
-  for (const rule of RULES) {
-    rule.regex.lastIndex = 0;
-    let m;
-    while ((m = rule.regex.exec(content)) !== null) {
-      const group = rule.valueGroup ?? 0;
-      const value = m[group];
-      if (value === undefined || value.length === 0) {
+  scanner.reset?.();
+  scanner.lastIndex = 0;
+  let m;
+  while ((m = scanner.exec(content)) !== null) {
+    const group = rule.valueGroup ?? 0;
+    const value = m[group];
+    if (value === undefined || value.length === 0) {
+      continue;
+    }
+    if (validate && !validate(value)) {
+      continue;
+    }
+    const start = group === 0 ? m.index : m.index + m[0].indexOf(value);
+    const end = start + value.length;
+    if (rule.accept && !rule.accept(content, start, end) || accept && !accept(content, start, end)) {
+      if (m.index === scanner.lastIndex) {
+        scanner.lastIndex += 1;
+      }
+      continue;
+    }
+    const match = {
+      category: "pii",
+      policyId: rule.policyId,
+      severity: rule.severity,
+      confidence: rule.confidence,
+      start,
+      end,
+      value,
+      mask: rule.mask,
+      remediation: "Redact personal data before persisting or publishing."
+    };
+    if (rescanned.has(m)) {
+      rescanTag.add(match);
+    }
+    matches.push(match);
+    if (m.index === scanner.lastIndex) {
+      scanner.lastIndex += 1;
+    }
+  }
+  return matches;
+}
+function scanRule(content, rule) {
+  const matches = scanWith(content, rule, rule.regex, rule.validate, undefined);
+  if (rule.also === undefined) {
+    return matches;
+  }
+  let result = matches;
+  for (const extra of rule.also) {
+    const found = scanWith(content, rule, extra.regex, extra.validate ?? rule.validate, extra.accept);
+    const added = found.filter((match) => !containedIn(result, match.start, match.end));
+    if (added.length > 0) {
+      result = coalesce(content, [...result, ...added].sort((x, y) => x.start - y.start || y.end - x.end));
+    }
+  }
+  return result;
+}
+function scanRules(content) {
+  return RULES.map((rule) => scanRule(content, rule));
+}
+function decimalDigitValue(codePoint) {
+  if (codePoint < 1632) {
+    return -1;
+  }
+  const cached = digitValues.get(codePoint);
+  if (cached !== undefined) {
+    return cached;
+  }
+  let value = -1;
+  if (DECIMAL_DIGIT.test(String.fromCodePoint(codePoint))) {
+    let runStart = codePoint;
+    while (runStart > 0 && DECIMAL_DIGIT.test(String.fromCodePoint(runStart - 1))) {
+      runStart -= 1;
+    }
+    value = (codePoint - runStart) % 10;
+  }
+  digitValues.set(codePoint, value);
+  return value;
+}
+function isHyphenLookalike(code) {
+  return code >= 8208 && code <= 8213 || code === 8722 || code === 8315 || code === 8331 || code === 65112 || code === 65123 || code === 65293 || code === 1418 || code === 1470 || code === 6150 || code === 8259 || code === 12540 || code === 12448 || code === 11834 || code === 11835;
+}
+function isInvisible(code) {
+  return code === 173 || code >= 8203 && code <= 8205 || code >= 8288 && code <= 8292 || code === 6158 || code === 847 || code === 8206 || code === 8207;
+}
+function foldNumberChar(code, options) {
+  if (isInvisible(code)) {
+    return code === 173 && options.shyHyphen ? "-" : "";
+  }
+  if (code === 160 || code === 5760 || code >= 8192 && code <= 8202 || code === 8232 || code === 8233 || code === 8239 || code === 8287 || code === 12288 || code === 65279) {
+    return " ";
+  }
+  if (isHyphenLookalike(code)) {
+    return "-";
+  }
+  if (code === 8228 || code === 65106 || code === 65294 || code === 12290 || code === 65377) {
+    return ".";
+  }
+  if (code === 65312 || code === 65131) {
+    return "@";
+  }
+  if (code === 65291 || code === 8314 || code === 8330 || code === 65122) {
+    return "+";
+  }
+  if (code === 65288 || code === 8317 || code === 8333 || code === 65113) {
+    return "(";
+  }
+  if (code === 65289 || code === 8318 || code === 8334 || code === 65114) {
+    return ")";
+  }
+  if (options.letters && code >= 65313 && code <= 65338) {
+    return String.fromCharCode(code - 65313 + 65);
+  }
+  const digit = decimalDigitValue(code);
+  return digit < 0 ? null : String(digit);
+}
+function isNumberBreak(content, from, to) {
+  const before = content[from - 1];
+  const after = content[to];
+  return from > 1 && (before === "-" || before === ".") && DIGIT.test(content[from - 2]) && DIGIT.test(after ?? "") || from > 0 && DIGIT.test(before ?? "") && (after === "-" || after === ".") && DIGIT.test(content[to + 1] ?? "");
+}
+function normalizeWindow(content, from, to, options) {
+  const origin = new Int32Array(to - from + 1);
+  const parts = [];
+  let length = 0;
+  let flushed = from;
+  let changed = false;
+  for (let i = from;i < to; ) {
+    const code = content.charCodeAt(i);
+    if (code < 128) {
+      if (options.breaks && (code === 9 || code === 10 || code === 13)) {
+        let j = i + 1;
+        while (j < to && BREAK_CHAR.test(content[j])) {
+          j += 1;
+        }
+        if (isNumberBreak(content, i, j)) {
+          changed = true;
+          parts.push(content.slice(flushed, i));
+          flushed = j;
+        } else {
+          for (let k = i;k < j; k += 1) {
+            origin[length++] = k;
+          }
+        }
+        i = j;
         continue;
       }
-      if (rule.policyId === "pii.phone") {
-        const digits = countDigits(value);
-        if (digits < 9 || digits > 15) {
-          continue;
+      origin[length++] = i;
+      i += 1;
+      continue;
+    }
+    const codePoint = content.codePointAt(i);
+    const width = codePoint > 65535 ? 2 : 1;
+    const folded = foldNumberChar(codePoint, options);
+    if (folded === null) {
+      for (let k = 0;k < width; k += 1) {
+        origin[length++] = i;
+      }
+    } else {
+      changed = true;
+      parts.push(content.slice(flushed, i));
+      flushed = i + width;
+      if (folded !== "") {
+        parts.push(folded);
+        origin[length++] = i;
+      }
+    }
+    i += width;
+  }
+  if (!changed) {
+    return null;
+  }
+  parts.push(content.slice(flushed, to));
+  origin[length] = to;
+  return { text: parts.join(""), origin: origin.subarray(0, length + 1) };
+}
+function toOriginal(window, content, start, end) {
+  const last = window.origin[end - 1];
+  const width = content.codePointAt(last) > 65535 ? 2 : 1;
+  return [window.origin[start], last + width];
+}
+function containedIn(spans, start, end) {
+  let low = 0;
+  let high = spans.length - 1;
+  while (low <= high) {
+    const mid = low + high >> 1;
+    if (spans[mid].start <= start) {
+      low = mid + 1;
+    } else {
+      high = mid - 1;
+    }
+  }
+  const candidate = spans[high];
+  return candidate !== undefined && candidate.start <= start && candidate.end >= end;
+}
+function coalesce(content, spans) {
+  const merged = [];
+  for (const span of spans) {
+    const last = merged[merged.length - 1];
+    if (last === undefined || span.start >= last.end) {
+      merged.push(span);
+      continue;
+    }
+    const end = Math.max(last.end, span.end);
+    const union = { ...last, end, value: content.slice(last.start, end) };
+    if (rescanTag.has(last) && rescanTag.has(span)) {
+      rescanTag.add(union);
+    }
+    merged[merged.length - 1] = union;
+  }
+  return merged;
+}
+function isUniformCard(card) {
+  const separators = new Set(card.value.replace(/\d/g, ""));
+  return separators.size <= 1;
+}
+function dropRescansInsideCards(spans, cards) {
+  if (cards.length === 0 || !spans.some((span) => rescanTag.has(span))) {
+    return spans;
+  }
+  const sorted = cards.filter(isUniformCard).sort((a, b) => a.start - b.start);
+  const reach = [];
+  let farthest = 0;
+  for (const card of sorted) {
+    farthest = Math.max(farthest, card.end);
+    reach.push(farthest);
+  }
+  return spans.filter((span) => {
+    if (!rescanTag.has(span)) {
+      return true;
+    }
+    let low = 0;
+    let high = sorted.length - 1;
+    while (low <= high) {
+      const mid = low + high >> 1;
+      if (sorted[mid].start < span.end) {
+        low = mid + 1;
+      } else {
+        high = mid - 1;
+      }
+    }
+    return high < 0 || reach[high] <= span.start;
+  });
+}
+function viewsOf(content, nonAscii) {
+  const views = [];
+  if (nonAscii) {
+    views.push({});
+    if (FULLWIDTH_CAPITAL.test(content)) {
+      views.push({ letters: true });
+    }
+    if (SOFT_HYPHEN.test(content)) {
+      views.push({ shyHyphen: true });
+    }
+  }
+  if (NUMBER_BREAK.test(content)) {
+    views.push({ breaks: true });
+  }
+  return views;
+}
+function detectPii(content) {
+  const perRule = scanRules(content);
+  const nonAscii = NON_ASCII.test(content);
+  if (nonAscii) {
+    const emailRule = RULES[0];
+    const ascii = scanRule(content, { ...emailRule, regex: asciiEmailScanner });
+    const unicode = perRule[0];
+    const extraEmails = ascii.filter((match) => !containedIn(unicode, match.start, match.end));
+    if (extraEmails.length > 0) {
+      perRule[0] = [...unicode, ...extraEmails].sort((x, y) => x.start - y.start || y.end - x.end);
+    }
+  }
+  const views = viewsOf(content, nonAscii);
+  for (const options of views) {
+    for (let from = 0;from < content.length; ) {
+      let start = from;
+      let to = Math.min(content.length, from + NORMALIZE_CHUNK);
+      if (start > 0 && (content.charCodeAt(start) & 64512) === 56320) {
+        start -= 1;
+      }
+      if (to < content.length && (content.charCodeAt(to - 1) & 64512) === 55296) {
+        to += 1;
+      }
+      const window = normalizeWindow(content, start, to, options);
+      if (window !== null) {
+        const extra = scanRules(window.text);
+        extra.forEach((found, index) => {
+          if (options.breaks && !NUMBER_RULES.has(index)) {
+            return;
+          }
+          const numbers = NUMBER_RULES.has(index);
+          const base = perRule[index];
+          const added = [];
+          for (const match of found) {
+            const [a, b] = toOriginal(window, content, match.start, match.end);
+            if (!numbers && b - a !== match.end - match.start) {
+              continue;
+            }
+            if (start > 0 && a < start + NORMALIZE_SKIP) {
+              continue;
+            }
+            if (!containedIn(base, a, b) && !containedIn(added, a, b)) {
+              const copy = { ...match, start: a, end: b, value: content.slice(a, b) };
+              if (rescanTag.has(match)) {
+                rescanTag.add(copy);
+              }
+              added.push(copy);
+            }
+          }
+          if (added.length > 0) {
+            perRule[index] = coalesce(content, [...base, ...added].sort((x, y) => x.start - y.start || y.end - x.end));
+          }
+        });
+      }
+      if (to >= content.length) {
+        break;
+      }
+      from = to - NORMALIZE_OVERLAP;
+    }
+  }
+  perRule[PHONE_RULE] = dropRescansInsideCards(perRule[PHONE_RULE], perRule[CARD_RULE]);
+  return perRule.flat();
+}
+var UNICODE_EMAIL, ASCII_EMAIL, emailScanner, asciiEmailScanner, PHONE_FROM, PHONE_RUN_CHAR, PHONE_START_BLOCKER, DIGIT, PHONE_DIAL_GROUP, PHONE_FIRST_GROUP, PHONE_SEPARATOR, PHONE_NANP_SPACED, WHITESPACE, LINE_BREAK, PHONE_MAX_DIGITS = 15, PHONE_MIN_DIGITS = 9, rescanned, PHONE_JOINED_PIECE, PHONE_CARD_SHAPE, PHONE_GLUE, PHONE_GLUE_LETTER, PHONE_GLUE_EVIDENCE, phoneGlueScanner, phoneScanner, IBAN_START, IBAN_MAX_GROUPS = 8, IBAN_STATES, ibanFailed, ibanStamp = 0, ibanScanner, IBAN_LENGTHS, IBAN_GLUE_START, ibanGluedScanner, CARD_SEPARATOR = "[ \\t\\r\\n._/-]", CARD_EXTRA, CARD_GROUP_SEPARATOR, GLUE_LETTER_BEFORE, GLUE_LETTER_AFTER, NON_HEX_LETTER, GLUE_FLANK = 8, UUID_ANYWHERE, UUID_REACH = 36, SSN_BREAK_EXTRA, IPV4_EXTRA, RULES, CALENDAR_DATE, IDENTIFIER_CHAR, TOKEN_SCAN_LIMIT = 64, UUID_TOKEN, rescanTag, NORMALIZE_CHUNK, NORMALIZE_OVERLAP = 512, NORMALIZE_SKIP = 256, NON_ASCII, DECIMAL_DIGIT, digitValues, BREAK_CHAR, PHONE_RULE, CARD_RULE, NUMBER_RULES, FULLWIDTH_CAPITAL, SOFT_HYPHEN, NUMBER_BREAK;
+var init_pii = __esm(() => {
+  UNICODE_EMAIL = {
+    from: /(?:(?<=[\p{L}\p{N}\p{M}_])(?![\p{L}\p{N}\p{M}_])|(?<![\p{L}\p{N}\p{M}_])(?=[\p{L}\p{N}\p{M}_]))[\p{L}\p{N}\p{M}._%+-]+@[\p{L}\p{N}\p{M}.-]+\.[\p{L}\p{M}]{2,}(?![\p{L}\p{N}\p{M}_])/uy,
+    localChar: /[\p{L}\p{N}\p{M}._%+-]/u,
+    boundary: /(?:(?<=[\p{L}\p{N}\p{M}_])(?![\p{L}\p{N}\p{M}_])|(?<![\p{L}\p{N}\p{M}_])(?=[\p{L}\p{N}\p{M}_]))/uy
+  };
+  ASCII_EMAIL = {
+    from: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/y,
+    localChar: /[A-Za-z0-9._%+-]/,
+    boundary: /\b/y
+  };
+  emailScanner = emailScannerFor(UNICODE_EMAIL);
+  asciiEmailScanner = emailScannerFor(ASCII_EMAIL);
+  PHONE_FROM = /(?<![\w.])(\+?\d[\d\s().-]{7,}\d)(?!\w|\.\w)/y;
+  PHONE_RUN_CHAR = /[\d\s().-]/;
+  PHONE_START_BLOCKER = /[\w.]/;
+  DIGIT = /\d/;
+  PHONE_DIAL_GROUP = /^\(?\d{2,4}\)?(?:[-.]\d{2,4})*$/;
+  PHONE_FIRST_GROUP = /^\+?\d{1,4}$/;
+  PHONE_SEPARATOR = /[+()-]/;
+  PHONE_NANP_SPACED = /^(?:\d{1,3} )?\d{3} \d{3} \d{4}$/;
+  WHITESPACE = /\s/;
+  LINE_BREAK = /[\n\r\u2028\u2029]/;
+  rescanned = new WeakSet;
+  PHONE_JOINED_PIECE = /^\+?\d{1,4}(?:[-.]\d{1,4})+$/;
+  PHONE_CARD_SHAPE = /^\d{4}(?:[-.]\d{4})+$/;
+  PHONE_GLUE = /(?<![\d.])\+?\d[\d().-]{7,}\d/g;
+  PHONE_GLUE_LETTER = /[A-Za-z_]/;
+  PHONE_GLUE_EVIDENCE = /[+()-]|\./;
+  phoneGlueScanner = {
+    lastIndex: 0,
+    exec(content) {
+      PHONE_GLUE.lastIndex = this.lastIndex;
+      let m;
+      while ((m = PHONE_GLUE.exec(content)) !== null) {
+        const start = m.index;
+        const end = start + m[0].length;
+        const glued = start > 0 && PHONE_GLUE_LETTER.test(content[start - 1]) || end < content.length && PHONE_GLUE_LETTER.test(content[end]);
+        if (glued && PHONE_GLUE_EVIDENCE.test(m[0]) && phoneVerdict(content, start, end)) {
+          this.lastIndex = end;
+          return { index: start, 0: m[0], 1: m[0] };
         }
-        if (!hasPhoneSeparatorShape(value)) {
+      }
+      this.lastIndex = 0;
+      return null;
+    }
+  };
+  phoneScanner = {
+    lastIndex: 0,
+    pending: [],
+    cursor: 0,
+    runEnd: -1,
+    runBaseline: -1,
+    tailEnd: 0,
+    reset() {
+      this.lastIndex = 0;
+      this.pending = [];
+      this.cursor = 0;
+      this.runEnd = -1;
+      this.runBaseline = -1;
+      this.tailEnd = 0;
+    },
+    tail(content) {
+      for (let pos = this.lastIndex;pos < this.tailEnd; pos += 1) {
+        if (!DIGIT.test(content[pos]) || PHONE_START_BLOCKER.test(content[pos - 1])) {
           continue;
         }
-        if (containsCalendarDate(value)) {
-          continue;
+        if (this.tailEnd - pos < 9) {
+          break;
         }
-        if (isIdentifierFragment(content, m.index, m.index + m[0].length)) {
-          continue;
+        const value = content.slice(pos, this.tailEnd);
+        return { index: pos, 0: value, 1: value };
+      }
+      this.lastIndex = this.tailEnd;
+      this.tailEnd = 0;
+      return null;
+    },
+    prefix(content, start, end) {
+      if (this.runEnd !== end) {
+        this.runEnd = end;
+        this.runBaseline = phoneBaselineEnd(content, end);
+      }
+      let digits = 0;
+      let limit = end;
+      const ends = [];
+      for (let i = start;i < end; i += 1) {
+        const ch = content[i];
+        if (DIGIT.test(ch)) {
+          digits += 1;
+          if (digits > PHONE_MAX_DIGITS) {
+            limit = i;
+            break;
+          }
+        } else if (WHITESPACE.test(ch) && DIGIT.test(content[i - 1]) && digits >= PHONE_MIN_DIGITS) {
+          ends.push(i);
         }
       }
-      if (rule.validate && !rule.validate(value)) {
-        continue;
+      const baseline = this.runBaseline;
+      if (baseline < end && baseline >= start + 9 && baseline <= limit && phoneVerdict(content, start, baseline)) {
+        return { end: baseline, baseline: true };
       }
-      const start = group === 0 ? m.index : m.index + m[0].indexOf(value);
-      matches.push({
-        category: "pii",
-        policyId: rule.policyId,
-        severity: rule.severity,
-        confidence: rule.confidence,
-        start,
-        end: start + value.length,
-        value,
-        mask: rule.mask,
-        remediation: "Redact personal data before persisting or publishing."
-      });
-      if (m.index === rule.regex.lastIndex) {
-        rule.regex.lastIndex += 1;
+      for (let k = ends.length - 1;k >= 0; k -= 1) {
+        const e = ends[k];
+        const value = content.slice(start, e);
+        if (e !== baseline && hasPhoneEvidence(value, !WHITESPACE.test(value)) && phoneVerdict(content, start, e)) {
+          return { end: e, baseline: false };
+        }
+      }
+      return null;
+    },
+    exec(content) {
+      for (;; ) {
+        if (this.cursor < this.pending.length) {
+          return this.pending[this.cursor++];
+        }
+        this.pending = [];
+        this.cursor = 0;
+        let m;
+        if (this.tailEnd > this.lastIndex) {
+          m = this.tail(content);
+          if (m === null) {
+            continue;
+          }
+        } else {
+          m = execPhone(content, this.lastIndex);
+          if (m === null) {
+            this.lastIndex = 0;
+            return null;
+          }
+        }
+        const end = m.index + (m[0] ?? "").length;
+        this.lastIndex = end;
+        this.tailEnd = 0;
+        if (phoneVerdict(content, m.index, end)) {
+          return m;
+        }
+        const prefix = this.prefix(content, m.index, end);
+        if (prefix !== null) {
+          const value = content.slice(m.index, prefix.end);
+          const found = { index: m.index, 0: value, 1: value };
+          if (!prefix.baseline) {
+            rescanned.add(found);
+          }
+          this.lastIndex = prefix.end;
+          this.tailEnd = end;
+          return found;
+        }
+        this.pending = withJoined(joinedPhones(content, m.index, end), rescanPhoneRun(content, m.index, end));
+        for (const found of this.pending) {
+          rescanned.add(found);
+        }
       }
     }
-  }
-  return matches;
-}
-var RULES, CALENDAR_DATE, IDENTIFIER_CHAR, TOKEN_SCAN_LIMIT = 64, UUID_TOKEN;
-var init_pii = __esm(() => {
+  };
+  IBAN_START = /(?<!\w)[A-Z]{2}\d{2}/g;
+  IBAN_STATES = (4 + IBAN_MAX_GROUPS * 5 + 1) * (IBAN_MAX_GROUPS + 1);
+  ibanFailed = new Uint32Array(IBAN_STATES);
+  ibanScanner = {
+    lastIndex: 0,
+    exec(content) {
+      IBAN_START.lastIndex = this.lastIndex;
+      let m;
+      while ((m = IBAN_START.exec(content)) !== null) {
+        ibanStamp += 1;
+        if (ibanStamp === 4294967295) {
+          ibanFailed.fill(0);
+          ibanStamp = 1;
+        }
+        const end = ibanEnd(content, m.index, m.index + 4, 0);
+        if (end >= 0) {
+          this.lastIndex = end;
+          return { index: m.index, 0: content.slice(m.index, end) };
+        }
+        IBAN_START.lastIndex = m.index + 1;
+      }
+      this.lastIndex = 0;
+      return null;
+    }
+  };
+  IBAN_LENGTHS = {
+    AD: 24,
+    AE: 23,
+    AL: 28,
+    AT: 20,
+    AZ: 28,
+    BA: 20,
+    BE: 16,
+    BG: 22,
+    BH: 22,
+    BR: 29,
+    BY: 28,
+    CH: 21,
+    CR: 22,
+    CY: 28,
+    CZ: 24,
+    DE: 22,
+    DK: 18,
+    DO: 28,
+    EE: 20,
+    EG: 29,
+    ES: 24,
+    FI: 18,
+    FO: 18,
+    FR: 27,
+    GB: 22,
+    GE: 22,
+    GI: 23,
+    GL: 18,
+    GR: 27,
+    GT: 28,
+    HR: 21,
+    HU: 28,
+    IE: 22,
+    IL: 23,
+    IQ: 23,
+    IS: 26,
+    IT: 27,
+    JO: 30,
+    KW: 30,
+    KZ: 20,
+    LB: 28,
+    LC: 32,
+    LI: 21,
+    LT: 20,
+    LU: 20,
+    LV: 21,
+    MC: 27,
+    MD: 24,
+    ME: 22,
+    MK: 19,
+    MR: 27,
+    MT: 31,
+    MU: 30,
+    NL: 18,
+    NO: 15,
+    PK: 24,
+    PL: 28,
+    PS: 29,
+    PT: 25,
+    QA: 29,
+    RO: 24,
+    RS: 22,
+    SA: 24,
+    SC: 31,
+    SE: 24,
+    SI: 19,
+    SK: 24,
+    SM: 27,
+    ST: 25,
+    SV: 28,
+    TL: 23,
+    TN: 24,
+    TR: 26,
+    UA: 29,
+    VA: 22,
+    VG: 24,
+    XK: 20
+  };
+  IBAN_GLUE_START = /[A-Z]{2}\d{2}/g;
+  ibanGluedScanner = {
+    lastIndex: 0,
+    exec(content) {
+      IBAN_GLUE_START.lastIndex = this.lastIndex;
+      let m;
+      while ((m = IBAN_GLUE_START.exec(content)) !== null) {
+        const length = IBAN_LENGTHS[m[0].slice(0, 2)];
+        if (length !== undefined) {
+          let count = 0;
+          let i = m.index;
+          while (i < content.length && count < length) {
+            const code = content.charCodeAt(i);
+            if (isIbanChar(code)) {
+              count += 1;
+            } else if (!(code === 32 && count >= 4 && isIbanChar(content.charCodeAt(i + 1)))) {
+              break;
+            }
+            i += 1;
+          }
+          if (count === length) {
+            this.lastIndex = i;
+            return { index: m.index, 0: content.slice(m.index, i) };
+          }
+        }
+        IBAN_GLUE_START.lastIndex = m.index + 1;
+      }
+      this.lastIndex = 0;
+      return null;
+    }
+  };
+  CARD_EXTRA = new RegExp(`(?<!\\d${CARD_SEPARATOR}{0,2})[2-6](?:${CARD_SEPARATOR}{0,2}\\d){12,18}(?!\\d)(?!${CARD_SEPARATOR}{1,2}\\d)`, "g");
+  CARD_GROUP_SEPARATOR = /[^\d]+/g;
+  GLUE_LETTER_BEFORE = /[A-Za-z_]+$/;
+  GLUE_LETTER_AFTER = /^[A-Za-z_]+/;
+  NON_HEX_LETTER = /[G-Zg-z_]/;
+  UUID_ANYWHERE = /[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}/g;
+  SSN_BREAK_EXTRA = /(?<![0-9])\d{3}(?:\r\n|[\t\r\n])\d{2}(?:\r\n|[\t\r\n])\d{4}(?![0-9])/g;
+  IPV4_EXTRA = /(?<![0-9.])(?<!\b[vV])\d{1,3}(?:[\t\r\n]{0,2}\.[\t\r\n]{0,2}\d{1,3}){3}(?![0-9])/g;
   RULES = [
     {
       policyId: "pii.email",
       mask: "email",
-      regex: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g,
+      regex: emailScanner,
       severity: "medium",
       confidence: 0.85
     },
     {
       policyId: "pii.phone",
       mask: "phone",
-      regex: /(?<![\w.])(\+?\d[\d\s().-]{7,}\d)(?![\w.])/g,
+      regex: phoneScanner,
       severity: "medium",
       confidence: 0.7,
-      valueGroup: 1
+      valueGroup: 1,
+      also: [{ regex: phoneGlueScanner }]
     },
     {
       policyId: "pii.address",
@@ -2104,7 +3031,7 @@ var init_pii = __esm(() => {
     {
       policyId: "pii.person-name",
       mask: "name",
-      regex: /\b(?:name\s+is|customer|client|user|patient|employee)\s*:?\s+([A-Z][a-z]+\s+[A-Z][a-z]+)\b/g,
+      regex: /\b(?:name\s+is|customer|client|user|patient|employee)(?:\s*:)?\s+([A-Z][a-z]+\s+[A-Z][a-z]+)\b/g,
       severity: "low",
       confidence: 0.45,
       valueGroup: 1
@@ -2112,10 +3039,11 @@ var init_pii = __esm(() => {
     {
       policyId: "pii.iban",
       mask: "iban",
-      regex: /\b[A-Z]{2}\d{2}(?:[ ]?[A-Z0-9]{1,4}){2,8}\b/g,
+      regex: ibanScanner,
       severity: "high",
       confidence: 0.9,
-      validate: isValidIban
+      validate: isValidIban,
+      also: [{ regex: ibanGluedScanner }]
     },
     {
       policyId: "pii.credit-card",
@@ -2123,15 +3051,24 @@ var init_pii = __esm(() => {
       regex: /\b\d(?:[ -]?\d){12,18}\b/g,
       severity: "high",
       confidence: 0.9,
-      validate: isValidCreditCard
+      validate: isValidCreditCard,
+      accept: outsideUuid,
+      also: [
+        {
+          regex: CARD_EXTRA,
+          validate: (value) => isCardCandidate(value) && isValidCreditCard(value.replace(/\D/g, "")),
+          accept: hasNonHexGlue
+        }
+      ]
     },
     {
       policyId: "pii.ssn",
       mask: "ssn",
-      regex: /\b\d{3}-\d{2}-\d{4}\b/g,
+      regex: /(?<![0-9])\d{3}-\d{2}-\d{4}(?![0-9])/g,
       severity: "high",
       confidence: 0.85,
-      validate: isValidSsn
+      validate: isValidSsn,
+      also: [{ regex: SSN_BREAK_EXTRA, validate: (value) => isValidSsn(value.replace(/\r\n|[\t\r\n]/g, "-")) }]
     },
     {
       policyId: "pii.ip",
@@ -2139,12 +3076,25 @@ var init_pii = __esm(() => {
       regex: /\b(?:(?:\d{1,3}\.){3}\d{1,3}|(?:[0-9A-Fa-f]{1,4}:){2,7}[0-9A-Fa-f]{1,4}|::1)\b/g,
       severity: "low",
       confidence: 0.6,
-      validate: isValidIp
+      validate: isValidIp,
+      also: [{ regex: IPV4_EXTRA, validate: (value) => isValidIp(value.replace(/[\t\r\n]/g, "")) }]
     }
   ];
   CALENDAR_DATE = /(?:19|20)\d{2}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])/;
   IDENTIFIER_CHAR = /[0-9A-Za-z_-]/;
   UUID_TOKEN = /^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$/;
+  rescanTag = new WeakSet;
+  NORMALIZE_CHUNK = 1 << 21;
+  NON_ASCII = /[\u0080-\uffff]/;
+  DECIMAL_DIGIT = /\p{Nd}/u;
+  digitValues = new Map;
+  BREAK_CHAR = /[\t\r\n]/;
+  PHONE_RULE = RULES.findIndex((rule) => rule.policyId === "pii.phone");
+  CARD_RULE = RULES.findIndex((rule) => rule.policyId === "pii.credit-card");
+  NUMBER_RULES = new Set(RULES.flatMap((rule, index) => ["pii.phone", "pii.iban", "pii.credit-card", "pii.ssn", "pii.ip"].includes(rule.policyId) ? [index] : []));
+  FULLWIDTH_CAPITAL = /[\uff21-\uff3a]/;
+  SOFT_HYPHEN = /\u00ad/;
+  NUMBER_BREAK = /[-.][\t\r\n]|[\t\r\n][-.]/;
 });
 
 // src/security/detect/secrets.ts
@@ -4430,17 +5380,20 @@ function locationFor(content, match) {
   };
 }
 function applyRedaction(content, matches) {
-  const redactable = matches.filter((m) => m.mask !== undefined).sort((a, b) => a.start - b.start);
+  const redactable = matches.filter((m) => m.mask !== undefined).sort((a, b) => a.start - b.start || b.end - a.end);
   let out = "";
   let cursor = 0;
   for (const match of redactable) {
-    const start = Math.max(match.start, cursor);
-    if (start >= match.end) {
+    if (match.end <= cursor) {
+      continue;
+    }
+    if (match.start < cursor) {
+      cursor = match.end;
       continue;
     }
-    out += content.slice(cursor, start);
+    out += content.slice(cursor, match.start);
     out += maskFor(match);
-    cursor = Math.max(cursor, match.end);
+    cursor = match.end;
   }
   out += content.slice(cursor);
   return out;
@@ -15840,10 +16793,12 @@ __export(exports_service, {
   analyze: () => analyze,
   appendIncident: () => appendIncident,
   applyAuditProposal: () => applyAuditProposal,
+  applyRedaction: () => applyRedaction,
   auditGate: () => auditGate,
   createSecurityService: () => createSecurityService,
   defaultBaselinePath: () => defaultBaselinePath,
   detectEntropy: () => detectEntropy,
+  detectPii: () => detectPii,
   detectSecrets: () => detectSecrets,
   isDeniedForMcpChild: () => isDeniedForMcpChild,
   isEntropyBackendEnabled: () => isEntropyBackendEnabled,
@@ -16109,6 +17064,7 @@ var init_service2 = __esm(() => {
   init_path_scan();
   init_read_source();
   init_redact();
+  init_pii();
   init_secrets();
   init_entropy();
   init_incidents();