@nodatachat/mcp 1.3.10 → 1.3.15

package/README.md

@@ -7,13 +7,18 @@ The MCP door to **NoData, the Information Access Processor**.
 One line connects any MCP client (Claude Code, an agent runtime) to NoData's governed‑access layer. Your agent asks *"may I reach this?"* and only ever sees the columns you granted. Denied columns are **never decrypted on the server** — there is nothing to leak — and every access leaves a signed, verifiable receipt.
 
 ```bash
-claude mcp add nodata -- npx @nodatachat/mcp
+claude mcp add -s user nodata -- npx -y @nodatachat/mcp@latest            # macOS / Linux
+claude mcp add -s user nodata -- cmd /c npx -y @nodatachat/mcp@latest     # Windows
+npx -y @nodatachat/mcp install-gate                                       # the read gate, the reminder and the status line
 ```
 
+`-s user` makes it available in every folder, not only the one you ran it in; `-y …@latest` keeps npx
+from reusing an old cached version. Restart Claude Code after both.
+
 Any other MCP client (Codex, Cursor, VS Code, Windsurf, Cline) runs the same server from its config:
 
 ```json
-{ "mcpServers": { "nodata": { "command": "npx", "args": ["-y", "@nodatachat/mcp"] } } }
+{ "mcpServers": { "nodata": { "command": "npx", "args": ["-y", "@nodatachat/mcp@latest"] } } }
 ```
 
 That's it — **no flags**. Self‑serve: registering opens an instant free **sandbox key** (no approval wall) and a **12‑word recovery phrase only you hold**. No card. **10,000 governed decisions per month free**, then $0.25 per 1,000.
@@ -88,18 +93,18 @@ No terminal? Same idea in the browser, zero install: **https://www.nodatacapsule
 **Agent mode (`--grant-token ndca-…`)** — *permission management for language models.* Hand an AI agent a grant token; the server exposes only tools hard‑scoped to that grant. The agent may request **only** the columns its grant allows — denied columns never decrypt server‑side, and every action emits a receipt. Point any MCP client at it and it **physically cannot exceed its claims**.
 
 ```bash
-claude mcp add nodata -- npx @nodatachat/mcp --grant-token ndca-YOUR_GRANT
+claude mcp add nodata -- npx -y @nodatachat/mcp@latest --grant-token ndca-YOUR_GRANT
 ```
 
 **Admin mode (`--api-key ndp_… / sk_live_…`)** — the owner seat: register tables, issue and revoke grants, and use blind relay (encrypt / decrypt / deliver / evidence) from inside any MCP client.
 
 ```bash
-claude mcp add nodata -- npx @nodatachat/mcp --api-key YOUR_API_KEY
+claude mcp add -s user nodata -- npx -y @nodatachat/mcp@latest --api-key YOUR_API_KEY
 ```
 
 Credential precedence: `--api-key` / `--grant-token` › `NODATA_API_KEY` / `NODATA_GRANT_TOKEN` › the saved `~/.nodata` file. An explicit flag or env always wins.
 
-On **Windows**, native (non‑WSL) `npx` needs the `cmd /c` wrapper: `claude mcp add nodata -- cmd /c npx @nodatachat/mcp …`. After changing the credential, **restart** — the running server keeps its old arguments.
+On **Windows**, native (non‑WSL) `npx` needs the `cmd /c` wrapper: `claude mcp add -s user nodata -- cmd /c npx -y @nodatachat/mcp@latest …`. After changing the credential, **restart** — the running server keeps its old arguments.
 
 ## The local workspace — scan, lock, work, release
 
@@ -168,6 +173,20 @@ npx @nodatachat/mcp secrets-logout
 
 **Honest limit:** a command that holds a secret can also leak it, for example by sending it out or printing it in an unknown form. Blanking protects the chat, not a hostile command, and that is why each command is approved as written.
 
+## Language — עברית or English, all the way
+
+Choose once; NoData keeps it everywhere it speaks. That covers the read gate's question, the
+status line and the reminder after a read. It also covers an instruction every agent on this
+machine receives to answer you in that language for the whole session. Until you choose, the
+machine's own locale decides.
+
+```bash
+npx @nodatachat/mcp lang he     # עברית
+npx @nodatachat/mcp lang en     # English
+```
+
+The agent also asks once, when you accept the terms (`nodata_terms`).
+
 ## The read gate — a scan before the assistant reads
 
 The MCP tools keep values out of the model only when the model uses them; Claude Code can also
@@ -183,8 +202,13 @@ Before Claude Code reads a data file (csv, xlsx, docx, pdf, .env …), the gate
 machine with the same detectors as `nodata_scan_folder`. Findings → you are asked (or the read is
 refused), with the counts and the safer step: `nodata_redact` for a clean copy, `nodata_protect`
 to lock it. Clean copies, sealed files and source code pass without a question. The gate catches
-a Read, a Grep on a file, and a Bash command that names the file; a program that builds the path
-at run time is not caught — `nodata_protect` (ciphertext at rest) is what makes a file unreadable.
+a Read, a Grep on a file, and a Bash or PowerShell command that names the file — also inside the
+script it runs (`python -c "…load_workbook('x.xlsx')…"`); a program that builds the path at run
+time is not caught — `nodata_protect` (ciphertext at rest) is what makes a file unreadable.
+
+After you approve a read, a second hook reminds the assistant, right before it answers, that the
+file holds personal data and your screen is not private: totals and counts, no names or numbers
+unless you ask for them.
 
 ## Available tools
 

package/dist/gate.js

@@ -1,18 +1,24 @@
-/*! @nodatachat/mcp 1.3.10 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
-import{appendFileSync as Dt,copyFileSync as hi,existsSync as Nt,mkdirSync as zt,readFileSync as Mt,statSync as Ce,writeFileSync as mi}from"node:fs";import{homedir as Re}from"node:os";import{basename as Ot,extname as Pe,isAbsolute as jt,join as Te,resolve as Bt}from"node:path";var b={text:[],header:[],secrets:[],table:null};function W(t){t.table&&(b.table=t.table);for(let e of t.text??[])b.text.some(n=>n.kind===e.kind)||b.text.push(e);t.header&&!b.header.includes(t.header)&&b.header.push(t.header);for(let e of t.secrets??[])b.secrets.some(n=>n.id===e.id)||b.secrets.push(e)}function V(){return b.text}function ce(){return b.header}function A(){return b.table}var le=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];var Ke=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],Ge=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],Xe=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i,Je=/^שם[ _](?:ה)?(?:קובץ|מוצר|פריט|חברה|ארגון|עסק|פרויקט|גיליון|טבלה|שדה|קטגוריה|סניף|בנק|עיר|רחוב|ישוב|יישוב|מסמך|תוכנית|חבילה|קורס|מחלקה|אתר|דומיין|מותג|ספק|שירות|תפקיד)$|^(file|product|item|company|org|organization|project|sheet|table|field|category|branch|bank|city|street|document|plan|course|department|site|domain|brand|vendor|service|role)[ _-]?name$/i;function $(t){if(!t)return null;let e=t.trim();if(Xe.test(e)||/^name$/i.test(e))return null;let n=e.replace(/[\s-]+/g,"_");for(let i of[...Ge,...Ke])if(i.pattern.test(e)||i.pattern.test(n))return{type:i.type,label:i.label};if(Je.test(e))return null;if(/^שם[ _][\u0590-\u05FF"'׳ ]{2,20}$/.test(e))return{type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"};if(/^(customer|client|employee|inspector|supervisor|contact|person|patient|user|owner|manager|agent|member|driver|tenant|student|parent|beneficiary|insured)_?(full_?)?name$/i.test(n))return{type:"name",label:"Person name"};for(let i of ce()){let r=i(e);if(r)return{type:r.type,label:r.label}}return null}function de(t){let e=String(t??"").replace(/\D/g,"");if(e.length===0||e.length>9)return!1;let n=e.padStart(9,"0"),i=0;for(let r=0;r<9;r++){let s=parseInt(n[r]??"0",10)*(r%2+1);s>9&&(s-=9),i+=s}return i%10===0&&parseInt(n,10)>0}function qe(t){let e=String(t??"").replace(/\D/g,"");if(e.length<12||e.length>19)return!1;let n=0,i=!1;for(let r=e.length-1;r>=0;r-=1){let s=parseInt(e[r]??"0",10);i&&(s*=2,s>9&&(s-=9)),n+=s,i=!i}return n%10===0}function Ye(t){let e=String(t??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(e))return!1;let n=e.slice(4)+e.slice(0,4),i=0;for(let r of n){let s=r>="A"&&r<="Z"?String(r.charCodeAt(0)-55):r;for(let a of s)i=(i*10+Number(a))%97}return i===1}var K="(?<!\\d)(?<!\\d[.,])",G="(?!\\d)(?![.,]\\d)",pe=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${K}\\d{9}${G}`,"g"),validate:de,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${K}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${G}`,"g"),validate:qe,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:Ye,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${K}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${G}`,"g"),validate:t=>{let e=t.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(e)?!0:/^0[2-489]\d{7}$/.test(e)&&(/[- ]/.test(t)||t.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];function R(t,e){let n=[],i="",r=!1;for(let s=0;s<t.length;s++){let a=t[s];r?a==='"'&&t[s+1]==='"'?(i+='"',s++):a==='"'?r=!1:i+=a:a==='"'?r=!0:a===e?(n.push(i),i=""):i+=a}return n.push(i),n}import{inflateRawSync as ct}from"node:zlib";import{inflateSync as Qe}from"node:zlib";var X=new Set([".pdf"]),ue=8*1024*1024;function et(t){let e=t.toString("latin1"),n=new Map,i=/(\d+)\s+(\d+)\s+obj\b/g,r;for(;(r=i.exec(e))!==null;){let s=Number(r[1]),a=i.lastIndex,o=e.indexOf("endobj",a);if(o<0)continue;let c=e.indexOf("stream",a),l,u=null;if(c>=0&&c<o){l=e.slice(a,c);let d=c+6;e[d]==="\r"&&(d+=1),e[d]===`
-`&&(d+=1);let f=e.indexOf("endstream",d);f>d&&(u=t.subarray(d,f))}else l=e.slice(a,o);n.set(s,{num:s,dict:l,stream:u})}return n}function tt(t){let e=t.toString("latin1").replace(/\s/g,"");e.startsWith("<~")&&(e=e.slice(2));let n=e.indexOf("~>");n>=0&&(e=e.slice(0,n));let i=[],r=0,s=0;for(let a of e){if(a==="z"&&s===0){i.push(0,0,0,0);continue}let o=a.charCodeAt(0)-33;if(o<0||o>84)return null;r=r*85+o,s+=1,s===5&&(i.push(r>>>24&255,r>>>16&255,r>>>8&255,r&255),r=0,s=0)}if(s>0){for(let o=s;o<5;o+=1)r=r*85+84;let a=[r>>>24&255,r>>>16&255,r>>>8&255,r&255];for(let o=0;o<s-1;o+=1)i.push(a[o]??0)}return Buffer.from(i)}function nt(t){let e=t.toString("latin1").replace(/\s/g,"").split(">")[0]??"",n=e.length%2?e+"0":e;return/^[0-9A-Fa-f]*$/.test(n)?Buffer.from(n,"hex"):null}function it(t){let e=/\/Filter\s*(\[[^\]]*\]|\/\w+)/.exec(t);return!e||!e[1]?[]:[...e[1].matchAll(/\/(\w+)/g)].map(n=>n[1]??"")}function he(t){if(!t.stream)return null;let e=t.stream;for(let n of it(t.dict)){let i=null;if(n==="FlateDecode")try{i=Qe(e)}catch{return null}else if(n==="ASCII85Decode")i=tt(e);else if(n==="ASCIIHexDecode")i=nt(e);else return null;if(i===null)return null;e=i}return e.toString("latin1")}function rt(t){let e=new Map,n=1,i=/begincodespacerange([\s\S]*?)endcodespacerange/.exec(t);if(i&&i[1]){let c=/<([0-9A-Fa-f]+)>/.exec(i[1]);c&&c[1]&&c[1].length>=4&&(n=2)}let r=c=>{let l="";for(let u=0;u+3<c.length+1;u+=4){let d=parseInt(c.slice(u,u+4),16);Number.isFinite(d)&&d>0&&(l+=String.fromCharCode(d))}return l},s=/beginbfchar([\s\S]*?)endbfchar/g,a;for(;(a=s.exec(t))!==null;){let c=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,l;for(;(l=c.exec(a[1]??""))!==null;)e.set(parseInt(l[1]??"0",16),r(l[2]??""))}let o=/beginbfrange([\s\S]*?)endbfrange/g;for(;(a=o.exec(t))!==null;){let c=a[1]??"",l=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,u;for(;(u=l.exec(c))!==null;){let d=parseInt(u[1]??"0",16),f=parseInt(u[2]??"0",16),p=parseInt((u[3]??"0").slice(0,4)||"0",16);if(!(f-d>65535))for(let h=d;h<=f;h+=1)e.set(h,String.fromCharCode(p+(h-d)))}}return{map:e,bytes:n}}function st(t){let e=new Map,n=new Map,i=[];for(let r of t.values()){let s=/\/Font\s*<<([\s\S]*?)>>/.exec(r.dict);s?.[1]&&i.push(s[1]);let a=/\/Font\s+(\d+)\s+\d+\s+R/.exec(r.dict);if(a){let o=t.get(Number(a[1]));o&&i.push(o.dict)}}for(let r of i){let s=/\/([^\s/<>[\]()]+)\s+(\d+)\s+\d+\s+R/g,a;for(;(a=s.exec(r))!==null;)n.set(a[1]??"",Number(a[2]))}for(let[r,s]of n){let a=t.get(s);if(!a)continue;let o=/\/ToUnicode\s+(\d+)\s+\d+\s+R/.exec(a.dict);if(!o)continue;let c=t.get(Number(o[1]));if(!c)continue;let l=he(c);l&&e.set(r,rt(l))}return e}function me(t){let e=[];for(let n=0;n<t.length;n+=1){let i=t[n];if(i!=="\\"){e.push(i.charCodeAt(0)&255);continue}let r=t[n+1];if(r===void 0)break;if(r>="0"&&r<="7"){let a="",o=n+1;for(;o<t.length&&a.length<3&&t[o]>="0"&&t[o]<="7";)a+=t[o],o+=1;e.push(parseInt(a,8)&255),n=o-1;continue}let s={n:10,r:13,t:9,b:8,f:12};e.push(s[r]??r.charCodeAt(0)&255),n+=1}return e}function ge(t){if(t.length<2||t[0]!==254||t[1]!==255)return null;let e="";for(let n=2;n+1<t.length;n+=2)e+=String.fromCharCode((t[n]??0)<<8|(t[n+1]??0));return e}function fe(t,e){let n=ge(t);if(n!==null)return n;if(!e)return t.map(r=>String.fromCharCode(r)).join("");let i="";if(e.bytes===2)for(let r=0;r+1<t.length;r+=2){let s=(t[r]??0)<<8|(t[r+1]??0);i+=e.map.get(s)??""}else for(let r of t)i+=e.map.get(r)??String.fromCharCode(r);return i}function at(t,e){let n="",i,r=/\/([^\s/<>[\]()]+)\s+[\d.]+\s+Tf|\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>|TJ|Tj|'|"/g,s,a="";for(;(s=r.exec(t))!==null;){let o=s[0];if(o.endsWith("Tf")){i=e.get(s[1]??"");continue}if(o==="TJ"||o==="Tj"||o==="'"||o==='"'){a&&(n+=a+`
-`,a="");continue}if(o.startsWith("("))a+=fe(me(o.slice(1,-1)),i);else if(o.startsWith("<")){let c=o.slice(1,-1).replace(/\s+/g,""),l=[];for(let u=0;u+1<c.length;u+=2)l.push(parseInt(c.slice(u,u+2),16));a+=fe(l,i)}}return a&&(n+=a+`
-`),n}function ot(t,e){let n=t.toString("latin1"),i=/\/Info\s+(\d+)\s+\d+\s+R/.exec(n),r=i?e.get(Number(i[1]))?.dict:void 0;if(!r)return"";let s=[],a=/\/(Author|Title|Subject|Keywords|Creator|Producer)\s*(\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>)/g,o;for(;(o=a.exec(r))!==null;){let c=o[2]??"";if(c.startsWith("(")){let l=me(c.slice(1,-1));s.push(ge(l)??l.map(u=>String.fromCharCode(u)).join(""))}else{let l=c.slice(1,-1).replace(/\s+/g,""),u="";if(l.toUpperCase().startsWith("FEFF"))for(let d=4;d+3<l.length+1;d+=4)u+=String.fromCharCode(parseInt(l.slice(d,d+4),16));else for(let d=0;d+1<l.length;d+=2)u+=String.fromCharCode(parseInt(l.slice(d,d+2),16));s.push(u)}}return s.join(`
-`)}function ye(t){if(!t.subarray(0,8).toString("latin1").startsWith("%PDF-")||t.toString("latin1",0,Math.min(t.length,4096)).includes("/Encrypt"))return null;let n=et(t);if(n.size===0)return null;let i=st(n),r=[];r.push(ot(t,n));let s=0,a=0,o=!1;for(let c of n.values()){if(!c.stream||/\/Subtype|\/Type\s*\/(XObject|Font|Metadata)|\/FontFile/.test(c.dict))continue;let l=he(c);if(l===null||!/(TJ|Tj)\b/.test(l))continue;let u=at(l,i);if(u.trim().length!==0){if(a+=1,s+u.length>ue){r.push(u.slice(0,Math.max(0,ue-s))),o=!0;break}r.push(u),s+=u.length}}return a===0?null:{text:r.join(`
-`),truncated:o,streams:a}}var be=new Set([".xlsx",".xlsm",".docx",".pptx"]),J=8*1024*1024,lt=101010256,dt=33639248,pt=67324752;function q(t){let e=Math.min(t.length,67584),n=-1;for(let a=t.length-22;a>=t.length-e&&a>=0;a-=1)if(t.readUInt32LE(a)===lt){n=a;break}if(n<0)return null;let i=t.readUInt16LE(n+10),r=t.readUInt32LE(n+16);if(r>=t.length)return null;let s=[];for(let a=0;a<i&&!(r+46>t.length||t.readUInt32LE(r)!==dt);a+=1){let o=t.readUInt16LE(r+10),c=t.readUInt32LE(r+20),l=t.readUInt32LE(r+24),u=t.readUInt16LE(r+28),d=t.readUInt16LE(r+30),f=t.readUInt16LE(r+32),p=t.readUInt32LE(r+42),h=t.subarray(r+46,r+46+u).toString("utf8");s.push({name:h,method:o,compSize:c,uncompSize:l,localHeaderOffset:p}),r+=46+u+d+f}return s}function Y(t,e){let n=e.localHeaderOffset;if(n+30>t.length||t.readUInt32LE(n)!==pt)return null;let i=t.readUInt16LE(n+26),r=t.readUInt16LE(n+28),s=n+30+i+r,a=s+e.compSize;if(a>t.length)return null;let o=t.subarray(s,a);try{if(e.method===0)return Buffer.from(o);if(e.method===8)return ct(o)}catch{return null}return null}function ut(t,e){return Y(t,e)?.toString("utf8")??null}var ft={"&amp;":"&","&lt;":"<","&gt;":">","&quot;":'"',"&apos;":"'"};function x(t){return t.replace(/&(amp|lt|gt|quot|apos);/g,e=>ft[e]??e).replace(/&#(\d+);/g,(e,n)=>{let i=Number(n);return i>0&&i<1114112?String.fromCodePoint(i):""}).replace(/&#x([0-9a-fA-F]+);/g,(e,n)=>{let i=parseInt(n,16);return i>0&&i<1114112?String.fromCodePoint(i):""})}function ht(t){return x(t.replace(/<[^>]*>/g,`
+/*! @nodatachat/mcp 1.3.15 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
+import{appendFileSync as tn,copyFileSync as as,existsSync as nn,mkdirSync as sn,readFileSync as rn,statSync as Me,writeFileSync as cs}from"node:fs";import{homedir as je}from"node:os";import{basename as on,extname as Be,isAbsolute as an,join as ze,resolve as cn}from"node:path";var v={text:[],header:[],secrets:[],table:null};function Q(e){e.table&&(v.table=e.table);for(let t of e.text??[])v.text.some(n=>n.kind===t.kind)||v.text.push(t);e.header&&!v.header.includes(e.header)&&v.header.push(e.header);for(let t of e.secrets??[])v.secrets.some(n=>n.id===t.id)||v.secrets.push(t)}function ee(){return v.text}function fe(){return v.header}function $(){return v.table}var me=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];var st=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],rt=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],ot=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i,at=/^שם[ _](?:ה)?(?:קובץ|מוצר|פריט|חברה|ארגון|עסק|פרויקט|גיליון|טבלה|שדה|קטגוריה|סניף|בנק|עיר|רחוב|ישוב|יישוב|מסמך|תוכנית|חבילה|קורס|מחלקה|אתר|דומיין|מותג|ספק|שירות|תפקיד)$|^(file|product|item|company|org|organization|project|sheet|table|field|category|branch|bank|city|street|document|plan|course|department|site|domain|brand|vendor|service|role)[ _-]?name$/i;function T(e){if(!e)return null;let t=e.trim();if(ot.test(t)||/^name$/i.test(t))return null;let n=t.replace(/[\s-]+/g,"_");for(let i of[...rt,...st])if(i.pattern.test(t)||i.pattern.test(n))return{type:i.type,label:i.label};if(at.test(t))return null;if(/^שם[ _][\u0590-\u05FF"'׳ ]{2,20}$/.test(t))return{type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"};if(/^(customer|client|employee|inspector|supervisor|contact|person|patient|user|owner|manager|agent|member|driver|tenant|student|parent|beneficiary|insured)_?(full_?)?name$/i.test(n))return{type:"name",label:"Person name"};for(let i of fe()){let s=i(t);if(s)return{type:s.type,label:s.label}}return null}function ge(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let n=t.padStart(9,"0"),i=0;for(let s=0;s<9;s++){let r=parseInt(n[s]??"0",10)*(s%2+1);r>9&&(r-=9),i+=r}return i%10===0&&parseInt(n,10)>0}function ct(e){let t=String(e??"").replace(/\D/g,"");if(t.length<12||t.length>19)return!1;let n=0,i=!1;for(let s=t.length-1;s>=0;s-=1){let r=parseInt(t[s]??"0",10);i&&(r*=2,r>9&&(r-=9)),n+=r,i=!i}return n%10===0}function lt(e){let t=String(e??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let n=t.slice(4)+t.slice(0,4),i=0;for(let s of n){let r=s>="A"&&s<="Z"?String(s.charCodeAt(0)-55):s;for(let o of r)i=(i*10+Number(o))%97}return i===1}var te="(?<!\\d)(?<!\\d[.,])",ne="(?!\\d)(?![.,]\\d)",ye=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${te}\\d{9}${ne}`,"g"),validate:ge,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${te}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${ne}`,"g"),validate:ct,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:lt,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${te}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${ne}`,"g"),validate:e=>{let t=e.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(t)?!0:/^0[2-489]\d{7}$/.test(t)&&(/[- ]/.test(e)||e.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];function L(e,t){let n=[],i="",s=!1;for(let r=0;r<e.length;r++){let o=e[r];s?o==='"'&&e[r+1]==='"'?(i+='"',r++):o==='"'?s=!1:i+=o:o==='"'?s=!0:o===t?(n.push(i),i=""):i+=o}return n.push(i),n}import{inflateRawSync as _t}from"node:zlib";import{inflateSync as dt}from"node:zlib";var ie=new Set([".pdf"]),be=8*1024*1024;function pt(e){let t=e.toString("latin1"),n=new Map,i=/(\d+)\s+(\d+)\s+obj\b/g,s;for(;(s=i.exec(t))!==null;){let r=Number(s[1]),o=i.lastIndex,a=t.indexOf("endobj",o);if(a<0)continue;let l=t.indexOf("stream",o),c,p=null;if(l>=0&&l<a){c=t.slice(o,l);let d=l+6;t[d]==="\r"&&(d+=1),t[d]===`
+`&&(d+=1);let h=t.indexOf("endstream",d);h>d&&(p=e.subarray(d,h))}else c=t.slice(o,a);n.set(r,{num:r,dict:c,stream:p})}return n}function ut(e){let t=e.toString("latin1").replace(/\s/g,"");t.startsWith("<~")&&(t=t.slice(2));let n=t.indexOf("~>");n>=0&&(t=t.slice(0,n));let i=[],s=0,r=0;for(let o of t){if(o==="z"&&r===0){i.push(0,0,0,0);continue}let a=o.charCodeAt(0)-33;if(a<0||a>84)return null;s=s*85+a,r+=1,r===5&&(i.push(s>>>24&255,s>>>16&255,s>>>8&255,s&255),s=0,r=0)}if(r>0){for(let a=r;a<5;a+=1)s=s*85+84;let o=[s>>>24&255,s>>>16&255,s>>>8&255,s&255];for(let a=0;a<r-1;a+=1)i.push(o[a]??0)}return Buffer.from(i)}function ht(e){let t=e.toString("latin1").replace(/\s/g,"").split(">")[0]??"",n=t.length%2?t+"0":t;return/^[0-9A-Fa-f]*$/.test(n)?Buffer.from(n,"hex"):null}function ft(e){let t=/\/Filter\s*(\[[^\]]*\]|\/\w+)/.exec(e);return!t||!t[1]?[]:[...t[1].matchAll(/\/(\w+)/g)].map(n=>n[1]??"")}function ke(e){if(!e.stream)return null;let t=e.stream;for(let n of ft(e.dict)){let i=null;if(n==="FlateDecode")try{i=dt(t)}catch{return null}else if(n==="ASCII85Decode")i=ut(t);else if(n==="ASCIIHexDecode")i=ht(t);else return null;if(i===null)return null;t=i}return t.toString("latin1")}function mt(e){let t=new Map,n=1,i=/begincodespacerange([\s\S]*?)endcodespacerange/.exec(e);if(i&&i[1]){let l=/<([0-9A-Fa-f]+)>/.exec(i[1]);l&&l[1]&&l[1].length>=4&&(n=2)}let s=l=>{let c="";for(let p=0;p+3<l.length+1;p+=4){let d=parseInt(l.slice(p,p+4),16);Number.isFinite(d)&&d>0&&(c+=String.fromCharCode(d))}return c},r=/beginbfchar([\s\S]*?)endbfchar/g,o;for(;(o=r.exec(e))!==null;){let l=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,c;for(;(c=l.exec(o[1]??""))!==null;)t.set(parseInt(c[1]??"0",16),s(c[2]??""))}let a=/beginbfrange([\s\S]*?)endbfrange/g;for(;(o=a.exec(e))!==null;){let l=o[1]??"",c=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,p;for(;(p=c.exec(l))!==null;){let d=parseInt(p[1]??"0",16),h=parseInt(p[2]??"0",16),f=parseInt((p[3]??"0").slice(0,4)||"0",16);if(!(h-d>65535))for(let g=d;g<=h;g+=1)t.set(g,String.fromCharCode(f+(g-d)))}}return{map:t,bytes:n}}function gt(e){let t=new Map,n=new Map,i=[];for(let s of e.values()){let r=/\/Font\s*<<([\s\S]*?)>>/.exec(s.dict);r?.[1]&&i.push(r[1]);let o=/\/Font\s+(\d+)\s+\d+\s+R/.exec(s.dict);if(o){let a=e.get(Number(o[1]));a&&i.push(a.dict)}}for(let s of i){let r=/\/([^\s/<>[\]()]+)\s+(\d+)\s+\d+\s+R/g,o;for(;(o=r.exec(s))!==null;)n.set(o[1]??"",Number(o[2]))}for(let[s,r]of n){let o=e.get(r);if(!o)continue;let a=/\/ToUnicode\s+(\d+)\s+\d+\s+R/.exec(o.dict);if(!a)continue;let l=e.get(Number(a[1]));if(!l)continue;let c=ke(l);c&&t.set(s,mt(c))}return t}function ve(e){let t=[];for(let n=0;n<e.length;n+=1){let i=e[n];if(i!=="\\"){t.push(i.charCodeAt(0)&255);continue}let s=e[n+1];if(s===void 0)break;if(s>="0"&&s<="7"){let o="",a=n+1;for(;a<e.length&&o.length<3&&e[a]>="0"&&e[a]<="7";)o+=e[a],a+=1;t.push(parseInt(o,8)&255),n=a-1;continue}let r={n:10,r:13,t:9,b:8,f:12};t.push(r[s]??s.charCodeAt(0)&255),n+=1}return t}function xe(e){if(e.length<2||e[0]!==254||e[1]!==255)return null;let t="";for(let n=2;n+1<e.length;n+=2)t+=String.fromCharCode((e[n]??0)<<8|(e[n+1]??0));return t}function _e(e,t){let n=xe(e);if(n!==null)return n;if(!t)return e.map(s=>String.fromCharCode(s)).join("");let i="";if(t.bytes===2)for(let s=0;s+1<e.length;s+=2){let r=(e[s]??0)<<8|(e[s+1]??0);i+=t.map.get(r)??""}else for(let s of e)i+=t.map.get(s)??String.fromCharCode(s);return i}function yt(e,t){let n="",i,s=/\/([^\s/<>[\]()]+)\s+[\d.]+\s+Tf|\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>|TJ|Tj|'|"/g,r,o="";for(;(r=s.exec(e))!==null;){let a=r[0];if(a.endsWith("Tf")){i=t.get(r[1]??"");continue}if(a==="TJ"||a==="Tj"||a==="'"||a==='"'){o&&(n+=o+`
+`,o="");continue}if(a.startsWith("("))o+=_e(ve(a.slice(1,-1)),i);else if(a.startsWith("<")){let l=a.slice(1,-1).replace(/\s+/g,""),c=[];for(let p=0;p+1<l.length;p+=2)c.push(parseInt(l.slice(p,p+2),16));o+=_e(c,i)}}return o&&(n+=o+`
+`),n}function bt(e,t){let n=e.toString("latin1"),i=/\/Info\s+(\d+)\s+\d+\s+R/.exec(n),s=i?t.get(Number(i[1]))?.dict:void 0;if(!s)return"";let r=[],o=/\/(Author|Title|Subject|Keywords|Creator|Producer)\s*(\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>)/g,a;for(;(a=o.exec(s))!==null;){let l=a[2]??"";if(l.startsWith("(")){let c=ve(l.slice(1,-1));r.push(xe(c)??c.map(p=>String.fromCharCode(p)).join(""))}else{let c=l.slice(1,-1).replace(/\s+/g,""),p="";if(c.toUpperCase().startsWith("FEFF"))for(let d=4;d+3<c.length+1;d+=4)p+=String.fromCharCode(parseInt(c.slice(d,d+4),16));else for(let d=0;d+1<c.length;d+=2)p+=String.fromCharCode(parseInt(c.slice(d,d+2),16));r.push(p)}}return r.join(`
+`)}function Se(e){if(!e.subarray(0,8).toString("latin1").startsWith("%PDF-")||e.toString("latin1",0,Math.min(e.length,4096)).includes("/Encrypt"))return null;let n=pt(e);if(n.size===0)return null;let i=gt(n),s=[];s.push(bt(e,n));let r=0,o=0,a=!1;for(let l of n.values()){if(!l.stream||/\/Subtype|\/Type\s*\/(XObject|Font|Metadata)|\/FontFile/.test(l.dict))continue;let c=ke(l);if(c===null||!/(TJ|Tj)\b/.test(c))continue;let p=yt(c,i);if(p.trim().length!==0){if(o+=1,r+p.length>be){s.push(p.slice(0,Math.max(0,be-r))),a=!0;break}s.push(p),r+=p.length}}return o===0?null:{text:s.join(`
+`),truncated:a,streams:o}}var we=new Set([".xlsx",".xlsm",".docx",".pptx"]),se=8*1024*1024,kt=101010256,vt=33639248,xt=67324752;function F(e){let t=Math.min(e.length,67584),n=-1;for(let o=e.length-22;o>=e.length-t&&o>=0;o-=1)if(e.readUInt32LE(o)===kt){n=o;break}if(n<0)return null;let i=e.readUInt16LE(n+10),s=e.readUInt32LE(n+16);if(s>=e.length)return null;let r=[];for(let o=0;o<i&&!(s+46>e.length||e.readUInt32LE(s)!==vt);o+=1){let a=e.readUInt16LE(s+10),l=e.readUInt32LE(s+20),c=e.readUInt32LE(s+24),p=e.readUInt16LE(s+28),d=e.readUInt16LE(s+30),h=e.readUInt16LE(s+32),f=e.readUInt32LE(s+42),g=e.subarray(s+46,s+46+p).toString("utf8");r.push({name:g,method:a,compSize:l,uncompSize:c,localHeaderOffset:f}),s+=46+p+d+h}return r}function D(e,t){let n=t.localHeaderOffset;if(n+30>e.length||e.readUInt32LE(n)!==xt)return null;let i=e.readUInt16LE(n+26),s=e.readUInt16LE(n+28),r=n+30+i+s,o=r+t.compSize;if(o>e.length)return null;let a=e.subarray(r,o);try{if(t.method===0)return Buffer.from(a);if(t.method===8)return _t(a)}catch{return null}return null}function St(e,t){return D(e,t)?.toString("utf8")??null}var wt={"&amp;":"&","&lt;":"<","&gt;":">","&quot;":'"',"&apos;":"'"};function S(e){return e.replace(/&(amp|lt|gt|quot|apos);/g,t=>wt[t]??t).replace(/&#(\d+);/g,(t,n)=>{let i=Number(n);return i>0&&i<1114112?String.fromCodePoint(i):""}).replace(/&#x([0-9a-fA-F]+);/g,(t,n)=>{let i=parseInt(n,16);return i>0&&i<1114112?String.fromCodePoint(i):""})}function It(e){return S(e.replace(/<[^>]*>/g,`
 `)).replace(/\n{2,}/g,`
-`)}function mt(t,e,n){let i=new RegExp(`<${e}\\b[^>]*\\b${n}="([^"]*)"`,"g"),r=[],s;for(;(s=i.exec(t))!==null;)s[1]&&r.push(x(s[1]));return r}function gt(t,e){let n=[];for(let i of e)(i==="docProps/core.xml"||i==="docProps/app.xml")&&n.push(i);if(t===".xlsx"||t===".xlsm")for(let i of e)(i==="xl/sharedStrings.xml"||i==="xl/workbook.xml"||/^xl\/worksheets\/sheet\d+\.xml$/.test(i)||/^xl\/comments\d*\.xml$/.test(i))&&n.push(i);else if(t===".docx")for(let i of e)(i==="word/document.xml"||/^word\/(header|footer|footnotes|endnotes|comments)\d*\.xml$/.test(i))&&n.push(i);else if(t===".pptx")for(let i of e)/^ppt\/(slides|notesSlides)\/(slide|notesSlide)\d+\.xml$/.test(i)&&n.push(i);return n}function yt(t,e){let n=q(t);if(!n||n.length===0)return null;let i=new Map(n.map(l=>[l.name,l])),r=gt(e,n.map(l=>l.name));if(r.length===0)return null;let s=[],a=[],o=0,c=!1;for(let l of r){if(o>=J){c=!0;break}let u=i.get(l);if(!u)continue;let d=ut(t,u);if(d===null)continue;let f=ht(d);if(l==="xl/workbook.xml"){let p=mt(d,"sheet","name");p.length&&(f+=`
-`+p.join(`
-`))}o+f.length>J&&(f=f.slice(0,Math.max(0,J-o)),c=!0),f.trim().length!==0&&(s.push(f),a.push(l),o+=f.length)}return s.length===0?null:{text:s.join(`
-`),truncated:c,parts:a}}function Q(t,e){if(be.has(e))return yt(t,e);if(X.has(e)){let n=ye(t);return n?{text:n.text,truncated:n.truncated,parts:[`pdf:${n.streams}-streams`]}:null}return null}var bt=new Set([...be,...X]);import{deflateRawSync as xt}from"node:zlib";var _e={israeli_id:"[ID]",credit_card:"[CARD]",iban:"[IBAN]",israeli_phone:"[PHONE]",email:"[EMAIL]"},_t=/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g,vt=[...pe].sort((t,e)=>+(e.subkind==="iban")-+(t.subkind==="iban"));function P(t,e,n=1){t[e]=(t[e]??0)+n}function _(t,e={}){let n=t;for(let i of vt)i.pattern.lastIndex=0,n=n.replace(i.pattern,r=>i.validate(r)?(P(e,i.subkind),_e[i.subkind]??`[${i.subkind.toUpperCase()}]`):r);n=n.replace(_t,()=>(P(e,"email"),_e.email));for(let i of V()){let r=i.find(n).sort((s,a)=>a.start-s.start);for(let s of r)n=n.slice(0,s.start)+`[${i.kind.toUpperCase()}]`+n.slice(s.end),P(e,i.kind)}return{text:n,counts:e,columnsHidden:[]}}function ee(){let t=new Map,e={};return(n,i)=>{let r=`${n}\0${i.trim()}`,s=t.get(r);return s===void 0&&(s=e[n]=(e[n]??0)+1,t.set(r,s)),`[${n.toUpperCase()}-${s}]`}}var ke=/^\s*-?\d+(?:\.\d+)?\s*$/;function te(t){let e=new Set;for(let[n,i]of t){let r=i.filter(a=>ke.test(a));if(r.length<3)continue;r.filter(a=>_(a).text!==a).length/r.length<.5&&e.add(n)}return e}function ve(t,e){return t.includes(e)||t.includes('"')||t.includes(`
-`)?`"${t.replace(/"/g,'""')}"`:t}function kt(t){let e=(t.match(/\t/g)??[]).length,n=(t.match(/;/g)??[]).length,i=(t.match(/,/g)??[]).length;return e>i&&e>=n?"	":n>i?";":","}function ne(t,e){let n=t.split(/\r?\n/),i=e??kt(n[0]??""),r=R(n[0]??"",i),s=r.map(p=>$(p)),a={},o=ee(),c=n.slice(1).map(p=>p===""?null:R(p,i)),l=new Map;for(let p of c)p?.forEach((h,m)=>l.set(m,[...l.get(m)??[],h]));let u=te(l),d=A();if(d){let p=c.filter(h=>h!==null).slice(0,200);for(let h of d({name:"table",headers:r,rows:p})){let m=r.indexOf(h.column);m>=0&&!(h.how==="header"&&u.has(m))&&(s[m]={type:h.type,label:h.category})}}let f=[r.map(p=>ve(p,i)).join(i)];for(let p of c){if(p===null){f.push("");continue}let h=p.map((m,k)=>{let v=s[k];return v&&m.trim()!==""?(P(a,`column:${v.type}`),o(v.type,m)):u.has(k)&&ke.test(m)?m:_(m,a).text});f.push(h.map(m=>ve(m,i)).join(i))}return{text:f.join(`
-`),counts:a,columnsHidden:r.filter((p,h)=>s[h])}}var St=/^xl\/(pivotCache|charts|externalLinks)\//,Se=10;function wt(t,e,n=1){t[e]=(t[e]??0)+n}function we(t){return t.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function Ie(t){let e=t.replace(/<rPh\b[\s\S]*?<\/rPh>/g,""),n="";for(let i of e.matchAll(/<t(?:\s[^>]*)?>([\s\S]*?)<\/t>/g))n+=i[1];return x(n)}function It(t){return t?[...t.matchAll(/<si\b[^>]*>([\s\S]*?)<\/si>|<si\b[^>]*\/>/g)].map(e=>Ie(e[1]??"")):[]}var Ee=/<c\b([^>]*?)(?:\/>|>([\s\S]*?)<\/c>)/g;function F(t,e){let n=new RegExp(`\\b${e}="([^"]*)"`).exec(t);return n?n[1]:null}function S(t,e){if(t.type==="s"){let i=/<v>([^<]*)<\/v>/.exec(t.inner);return i?e[Number(i[1])]??null:null}if(t.type==="inlineStr"){let i=/<is>([\s\S]*?)<\/is>/.exec(t.inner);return i?Ie(i[1]):null}if(t.type==="b"||t.type==="e")return null;let n=/<v>([^<]*)<\/v>/.exec(t.inner);return n?x(n[1]):null}function Et(t){let e=[];for(let n of t.matchAll(Ee)){let i=F(n[1],"r"),r=i?/^([A-Z]+)(\d+)$/.exec(i):null;if(!r)return null;e.push({full:n[0],attrs:n[1],inner:n[2]??"",col:r[1],row:Number(r[2]),type:F(n[1],"t")??"n"})}return e}function At(t,e){let n=[...new Set(t.map(i=>i.row))].sort((i,r)=>i-r).slice(0,Se);for(let i of n){let r=new Map;for(let s of t.filter(a=>a.row===i)){let a=S(s,e),o=a?$(a):null;o&&r.set(s.col,{type:o.type,header:a.trim()})}if(r.size>0)return{row:i,cols:r}}return{row:-1,cols:new Map}}var $t=/^xl\/worksheets\/sheet\d+\.xml$/,Tt=200;function Ct(t){let e=t.trim();return/^[\d.,\-+/:%$₪€\s]+$/.test(e)||e.length>60}function Rt(t,e){let n=[...new Set(t.map(s=>s.row))].sort((s,a)=>s-a).slice(0,Se),i=-1,r=-1/0;for(let s of n){let a=t.filter(l=>l.row===s).map(l=>(S(l,e)??"").trim()).filter(Boolean);if(a.length<2)continue;let o=a.filter(l=>!Ct(l)).length,c=o*2-(a.length-o);c>r&&(r=c,i=s)}return i}function Pt(t,e,n){let i=At(e,n),r=A();if(!r)return i;let s=i.row>=0?i.row:Rt(e,n);if(s<0)return i;let a=e.filter(d=>d.row===s).map(d=>({col:d.col,text:(S(d,n)??"").trim()})).filter(d=>d.text),o=new Map(a.map((d,f)=>[d.col,f])),c=new Map;for(let d of e){if(d.row<=s)continue;let f=o.get(d.col);if(f!==void 0){if(!c.has(d.row)){if(c.size>=Tt)continue;c.set(d.row,a.map(()=>""))}c.get(d.row)[f]=S(d,n)??""}}let l=new Map(s===i.row?i.cols:[]),u=a.map(d=>d.text);for(let d of r({name:t,headers:u,rows:[...c.values()]})){let f=u.indexOf(d.column);f<0||l.set(a[f].col,{type:d.type,header:d.column,category:d.category,severity:d.severity,how:d.how})}return{row:s,cols:l}}function xe(t,e){return`<c${t.replace(/\s*\bt="[^"]*"/,"")} t="inlineStr"><is><t xml:space="preserve">${we(e)}</t></is></c>`}var Ft=(()=>{let t=new Uint32Array(256);for(let e=0;e<256;e+=1){let n=e;for(let i=0;i<8;i+=1)n=n&1?3988292384^n>>>1:n>>>1;t[e]=n>>>0}return t})();function Ht(t){let e=4294967295;for(let n=0;n<t.length;n+=1)e=Ft[(e^t[n])&255]^e>>>8;return(e^4294967295)>>>0}function Ae(t){let e=[],n=[],i=0;for(let a of t){let o=Buffer.from(a.name,"utf8"),c=a.name.endsWith("/"),l=c?Buffer.alloc(0):xt(a.data),u=c?0:8,d=c?0:Ht(a.data),f=Buffer.alloc(30);f.writeUInt32LE(67324752,0),f.writeUInt16LE(20,4),f.writeUInt16LE(2048,6),f.writeUInt16LE(u,8),f.writeUInt32LE(d,14),f.writeUInt32LE(l.length,18),f.writeUInt32LE(a.data.length,22),f.writeUInt16LE(o.length,26),e.push(f,o,l);let p=Buffer.alloc(46);p.writeUInt32LE(33639248,0),p.writeUInt16LE(20,4),p.writeUInt16LE(20,6),p.writeUInt16LE(2048,8),p.writeUInt16LE(u,10),p.writeUInt32LE(d,16),p.writeUInt32LE(l.length,20),p.writeUInt32LE(a.data.length,24),p.writeUInt16LE(o.length,28),p.writeUInt32LE(i,42),n.push(p,o),i+=f.length+o.length+l.length}let r=Buffer.concat(n),s=Buffer.alloc(22);return s.writeUInt32LE(101010256,0),s.writeUInt16LE(t.length,8),s.writeUInt16LE(t.length,10),s.writeUInt32LE(r.length,12),s.writeUInt32LE(i,16),Buffer.concat([...e,r,s])}function ie(t){let e=q(t);if(!e||e.length===0||e.some(p=>St.test(p.name)))return null;let n=new Map;for(let p of e){if(p.name.endsWith("/")){n.set(p.name,Buffer.alloc(0));continue}let h=Y(t,p);if(!h)return null;n.set(p.name,h)}let i=[...n.keys()].filter(p=>$t.test(p));if(i.length===0)return null;let r=n.get("xl/sharedStrings.xml")?.toString("utf8")??null,s=It(r),a=new Set,o={},c=new Set,l=ee();for(let p of i){let h=n.get(p).toString("utf8"),m=Et(h);if(!m)return null;let k=Pt(p.replace(/^xl\/worksheets\//,"").replace(/\.xml$/,""),m,s),v=k.row,w=new Map;for(let g of m){if(g.type!=="n"||g.row<=v)continue;let y=S(g,s);y!==null&&w.set(g.col,[...w.get(g.col)??[],y])}let T=te(w),C=new Map;for(let[g,{type:y,header:O,how:j}]of k.cols)j==="header"&&T.has(g)||(C.set(g,y),c.add(O));let We=h.replace(Ee,(g,y,O)=>{let j=F(y,"r"),[,B,Ve]=/^([A-Z]+)(\d+)$/.exec(j),I={full:g,attrs:y,inner:O??"",col:B,row:Number(Ve),type:F(y,"t")??"n"},E=S(I,s),U=()=>{if(I.type==="s"){let oe=/<v>([^<]*)<\/v>/.exec(I.inner);oe&&a.add(Number(oe[1]))}return g};if(E===null||E.trim()==="")return U();let Z=C.get(B);if(Z&&I.row>v)return wt(o,`column:${Z}`),xe(y,l(Z,E));if(I.type==="n"&&T.has(B))return U();let ae=_(E,o);return ae.text===E?U():xe(y,ae.text)});n.set(p,Buffer.from(We,"utf8"))}if(r){let p=-1,h=r.replace(/<si\b[^>]*>[\s\S]*?<\/si>|<si\b[^>]*\/>/g,m=>(p+=1,a.has(p)?m:"<si><t></t></si>"));n.set("xl/sharedStrings.xml",Buffer.from(h,"utf8"))}for(let p of[...n.keys()].filter(h=>/^xl\/comments\d*\.xml$/.test(h))){let m=n.get(p).toString("utf8").replace(/(<t(?:\s[^>]*)?>)([\s\S]*?)(<\/t>)/g,(k,v,w,T)=>{let C=_(x(w),o);return`${v}${we(C.text)}${T}`});n.set(p,Buffer.from(m,"utf8"))}let u=n.get("docProps/core.xml");if(u){let p=u.toString("utf8").replace(/(<dc:creator>)[\s\S]*?(<\/dc:creator>)/,"$1$2").replace(/(<cp:lastModifiedBy>)[\s\S]*?(<\/cp:lastModifiedBy>)/,"$1$2");n.set("docProps/core.xml",Buffer.from(p,"utf8"))}let d=n.has("xl/calcChain.xml"),f=e.map(p=>p.name).filter(p=>!(d&&p==="xl/calcChain.xml"));if(d)for(let p of["[Content_Types].xml","xl/_rels/workbook.xml.rels"]){let h=n.get(p);h&&n.set(p,Buffer.from(h.toString("utf8").replace(/<(Override|Relationship)\b[^>]*calcChain[^>]*\/>/g,""),"utf8"))}return{bytes:Ae(f.map(p=>({name:p,data:n.get(p)}))),counts:o,columnsHidden:[...c]}}var Wn=64*1024*1024,Vn=32*1024;function $e(t){return/\.ndc$/i.test(t)||/\.clean\.[A-Za-z0-9]+$/.test(t)}var Ut=new Set([".csv",".tsv",".txt",".md",".json",".log",".xml",".sql",".yaml",".yml",".xlsx",".xlsm",".docx",".pptx",".pdf"]),Zt=50*1024*1024,Wt=8,Vt={israeli_id:"Israeli ID",credit_card:"card",iban:"IBAN",israeli_phone:"phone",email:"email",secret:"secret"};function Fe(t){let e=Ot(t).toLowerCase();return Ut.has(Pe(e))||e===".env"||e.startsWith(".env.")}function Kt(t){let e=Pe(t).toLowerCase(),n=Mt(t),i,r;if(e===".csv"||e===".tsv")r=n.toString("utf8"),i=ne(r,e===".tsv"?"	":void 0).counts;else if(e===".xlsx"||e===".xlsm"||e===".docx"||e===".pptx"||e===".pdf"){let a=e===".xlsx"||e===".xlsm"?ie(n):null;r=Q(n,e)?.text??"",i=a?a.counts:_(r).counts}else r=n.toString("utf8"),i=_(r).counts;let s=le.filter(a=>a.pattern.test(r)).length;return s&&(i.secret=(i.secret??0)+s),i}function Gt(t){return Object.entries(t).sort((e,n)=>n[1]-e[1]).map(([e,n])=>`${n} ${e.startsWith("column:")?`${e.slice(7)} (column)`:Vt[e]??e}`).join(", ")}function Xt(t,e,n){let i=s=>jt(s)?s:Bt(n,s),r=s=>{try{return Ce(s).isFile()}catch{return!1}};if(t==="Read"&&typeof e.file_path=="string")return[i(e.file_path)];if(t==="Grep"&&typeof e.path=="string"&&r(i(e.path)))return[i(e.path)];if(t==="Bash"&&typeof e.command=="string"){let s=e.command.match(/"[^"]*"|'[^']*'|[^\s|;&<>()]+/g)??[],a=[];for(let o of s){let c=i(o.replace(/^['"]|['"]$/g,"").replace(/^~(?=\/)/,Re()));if(Fe(c)&&r(c)&&!a.includes(c)&&a.push(c),a.length>=Wt)break}return a}return[]}function re(t){return t.replace(/\\+/g,"/")}function Jt(t,e,n,i){let r=[];for(let a of Xt(t,e,n)){if(!Fe(a)||$e(a)||!Nt(a))continue;let o;try{if(Ce(a).size>Zt)o=`${re(a)}: too large to check here (over 50 MB)`;else{let c=Kt(a);if(Object.keys(c).length===0)continue;o=`${re(a)}: ${Gt(c)}`}}catch{o=`${re(a)}: could not be checked`}r.push(o)}if(r.length===0)return{decision:"allow"};let s=`NoData scanned this on your machine before the assistant reads it:
-  ${r.join(`
+`)}function Et(e,t,n){let i=new RegExp(`<${t}\\b[^>]*\\b${n}="([^"]*)"`,"g"),s=[],r;for(;(r=i.exec(e))!==null;)r[1]&&s.push(S(r[1]));return s}function At(e,t){let n=[];for(let i of t)(i==="docProps/core.xml"||i==="docProps/app.xml")&&n.push(i);if(e===".xlsx"||e===".xlsm")for(let i of t)(i==="xl/sharedStrings.xml"||i==="xl/workbook.xml"||/^xl\/worksheets\/sheet\d+\.xml$/.test(i)||/^xl\/comments\d*\.xml$/.test(i))&&n.push(i);else if(e===".docx")for(let i of t)(i==="word/document.xml"||/^word\/(header|footer|footnotes|endnotes|comments)\d*\.xml$/.test(i))&&n.push(i);else if(e===".pptx")for(let i of t)/^ppt\/(slides|notesSlides)\/(slide|notesSlide)\d+\.xml$/.test(i)&&n.push(i);return n}function $t(e,t){let n=F(e);if(!n||n.length===0)return null;let i=new Map(n.map(c=>[c.name,c])),s=At(t,n.map(c=>c.name));if(s.length===0)return null;let r=[],o=[],a=0,l=!1;for(let c of s){if(a>=se){l=!0;break}let p=i.get(c);if(!p)continue;let d=St(e,p);if(d===null)continue;let h=It(d);if(c==="xl/workbook.xml"){let f=Et(d,"sheet","name");f.length&&(h+=`
+`+f.join(`
+`))}a+h.length>se&&(h=h.slice(0,Math.max(0,se-a)),l=!0),h.trim().length!==0&&(r.push(h),o.push(c),a+=h.length)}return r.length===0?null:{text:r.join(`
+`),truncated:l,parts:o}}function H(e,t){if(we.has(t))return $t(e,t);if(ie.has(t)){let n=Se(e);return n?{text:n.text,truncated:n.truncated,parts:[`pdf:${n.streams}-streams`]}:null}return null}var Tt=new Set([...we,...ie]);import{deflateRawSync as Lt}from"node:zlib";var Ie={israeli_id:"[ID]",credit_card:"[CARD]",iban:"[IBAN]",israeli_phone:"[PHONE]",email:"[EMAIL]"},Ct=/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g,Rt=[...ye].sort((e,t)=>+(t.subkind==="iban")-+(e.subkind==="iban"));function N(e,t,n=1){e[t]=(e[t]??0)+n}var Ee=null,O=e=>{let t=e.trim();Ee&&t&&Ee.add(t)};function x(e,t={}){let n=e;for(let i of Rt)i.pattern.lastIndex=0,n=n.replace(i.pattern,s=>i.validate(s)?(N(t,i.subkind),O(s),Ie[i.subkind]??`[${i.subkind.toUpperCase()}]`):s);n=n.replace(Ct,i=>(N(t,"email"),O(i),Ie.email));for(let i of ee()){let s=i.find(n).sort((r,o)=>o.start-r.start);for(let r of s)O(n.slice(r.start,r.end)),n=n.slice(0,r.start)+`[${i.kind.toUpperCase()}]`+n.slice(r.end),N(t,i.kind)}return{text:n,counts:t,columnsHidden:[]}}function re(){let e=new Map,t={};return(n,i)=>{O(i);let s=`${n}\0${i.trim()}`,r=e.get(s);return r===void 0&&(r=t[n]=(t[n]??0)+1,e.set(s,r)),`[${n.toUpperCase()}-${r}]`}}function oe(e){let t=e.trim();return/^\[[A-Z_]+(?:-\d+)?\]$/.test(t)||/^[\d]{0,4}[*•xX]{3,}[\d]{0,4}$/.test(t)}var $e=/^\s*-?\d+(?:\.\d+)?\s*$/;function ae(e){let t=new Set;for(let[n,i]of e){let s=i.filter(o=>$e.test(o));if(s.length<3)continue;s.filter(o=>x(o).text!==o).length/s.length<.5&&t.add(n)}return t}function Ae(e,t){return e.includes(t)||e.includes('"')||e.includes(`
+`)?`"${e.replace(/"/g,'""')}"`:e}function Pt(e){let t=(e.match(/\t/g)??[]).length,n=(e.match(/;/g)??[]).length,i=(e.match(/,/g)??[]).length;return t>i&&t>=n?"	":n>i?";":","}function ce(e,t){let n=e.split(/\r?\n/),i=t??Pt(n[0]??""),s=L(n[0]??"",i),r=s.map(f=>T(f)),o={},a=re(),l=n.slice(1).map(f=>f===""?null:L(f,i)),c=new Map;for(let f of l)f?.forEach((g,u)=>c.set(u,[...c.get(u)??[],g]));let p=ae(c),d=$();if(d){let f=l.filter(g=>g!==null).slice(0,200);for(let g of d({name:"table",headers:s,rows:f})){let u=s.indexOf(g.column);u>=0&&!(g.how==="header"&&p.has(u))&&(r[u]={type:g.type,label:g.category})}}let h=[s.map(f=>Ae(f,i)).join(i)];for(let f of l){if(f===null){h.push("");continue}let g=f.map((u,y)=>{let b=r[y];return b&&u.trim()!==""&&!oe(u)?(N(o,`column:${b.type}`),a(b.type,u)):p.has(y)&&$e.test(u)?u:x(u,o).text});h.push(g.map(u=>Ae(u,i)).join(i))}return{text:h.join(`
+`),counts:o,columnsHidden:s.filter((f,g)=>r[g])}}var Ft=/^xl\/(pivotCache|charts|externalLinks)\//,Re=10;function Dt(e,t,n=1){e[t]=(e[t]??0)+n}function Pe(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function Le(e){let t=e.replace(/<rPh\b[\s\S]*?<\/rPh>/g,""),n="";for(let i of t.matchAll(/<t(?:\s[^>]*)?>([\s\S]*?)<\/t>/g))n+=i[1];return S(n)}function Ht(e){return e?[...e.matchAll(/<si\b[^>]*>([\s\S]*?)<\/si>|<si\b[^>]*\/>/g)].map(t=>Le(t[1]??"")):[]}var Fe=/<c\b([^>]*?)(?:\/>|>([\s\S]*?)<\/c>)/g;function z(e,t){let n=new RegExp(`\\b${t}="([^"]*)"`).exec(e);return n?n[1]:null}function I(e,t){if(e.type==="s"){let i=/<v>([^<]*)<\/v>/.exec(e.inner);return i?t[Number(i[1])]??null:null}if(e.type==="inlineStr"){let i=/<is>([\s\S]*?)<\/is>/.exec(e.inner);return i?Le(i[1]):null}if(e.type==="b"||e.type==="e")return null;let n=/<v>([^<]*)<\/v>/.exec(e.inner);return n?S(n[1]):null}function Nt(e){let t=[];for(let n of e.matchAll(Fe)){let i=z(n[1],"r"),s=i?/^([A-Z]+)(\d+)$/.exec(i):null;if(!s)return null;t.push({full:n[0],attrs:n[1],inner:n[2]??"",col:s[1],row:Number(s[2]),type:z(n[1],"t")??"n"})}return t}function Ot(e,t){let n=[...new Set(e.map(i=>i.row))].sort((i,s)=>i-s).slice(0,Re);for(let i of n){let s=new Map;for(let r of e.filter(o=>o.row===i)){let o=I(r,t),a=o?T(o):null;a&&s.set(r.col,{type:a.type,header:o.trim()})}if(s.size>0)return{row:i,cols:s}}return{row:-1,cols:new Map}}var zt=/^xl\/worksheets\/sheet\d+\.xml$/,Mt=200;function jt(e){let t=e.trim();return/^[\d.,\-+/:%$₪€\s]+$/.test(t)||t.length>60}function Bt(e,t){let n=[...new Set(e.map(r=>r.row))].sort((r,o)=>r-o).slice(0,Re),i=-1,s=-1/0;for(let r of n){let o=e.filter(c=>c.row===r).map(c=>(I(c,t)??"").trim()).filter(Boolean);if(o.length<2)continue;let a=o.filter(c=>!jt(c)).length,l=a*2-(o.length-a);l>s&&(s=l,i=r)}return i}function Ut(e,t,n){let i=Ot(t,n),s=$();if(!s)return i;let r=i.row>=0?i.row:Bt(t,n);if(r<0)return i;let o=t.filter(d=>d.row===r).map(d=>({col:d.col,text:(I(d,n)??"").trim()})).filter(d=>d.text),a=new Map(o.map((d,h)=>[d.col,h])),l=new Map;for(let d of t){if(d.row<=r)continue;let h=a.get(d.col);if(h!==void 0){if(!l.has(d.row)){if(l.size>=Mt)continue;l.set(d.row,o.map(()=>""))}l.get(d.row)[h]=I(d,n)??""}}let c=new Map(r===i.row?i.cols:[]),p=o.map(d=>d.text);for(let d of s({name:e,headers:p,rows:[...l.values()]})){let h=p.indexOf(d.column);h<0||c.set(o[h].col,{type:d.type,header:d.column,category:d.category,severity:d.severity,how:d.how})}return{row:r,cols:c}}function Te(e,t){return`<c${e.replace(/\s*\bt="[^"]*"/,"")} t="inlineStr"><is><t xml:space="preserve">${Pe(t)}</t></is></c>`}var Wt=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t+=1){let n=t;for(let i=0;i<8;i+=1)n=n&1?3988292384^n>>>1:n>>>1;e[t]=n>>>0}return e})();function Zt(e){let t=4294967295;for(let n=0;n<e.length;n+=1)t=Wt[(t^e[n])&255]^t>>>8;return(t^4294967295)>>>0}var Ce=33;function De(e){let t=[],n=[],i=0;for(let o of e){let a=Buffer.from(o.name,"utf8"),l=o.name.endsWith("/"),c=l?Buffer.alloc(0):Lt(o.data),p=l?0:8,d=l?0:Zt(o.data),h=Buffer.alloc(30);h.writeUInt32LE(67324752,0),h.writeUInt16LE(20,4),h.writeUInt16LE(2048,6),h.writeUInt16LE(p,8),h.writeUInt16LE(Ce,12),h.writeUInt32LE(d,14),h.writeUInt32LE(c.length,18),h.writeUInt32LE(o.data.length,22),h.writeUInt16LE(a.length,26),t.push(h,a,c);let f=Buffer.alloc(46);f.writeUInt32LE(33639248,0),f.writeUInt16LE(20,4),f.writeUInt16LE(20,6),f.writeUInt16LE(2048,8),f.writeUInt16LE(p,10),f.writeUInt16LE(Ce,14),f.writeUInt32LE(d,16),f.writeUInt32LE(c.length,20),f.writeUInt32LE(o.data.length,24),f.writeUInt16LE(a.length,28),f.writeUInt32LE(i,42),n.push(f,a),i+=h.length+a.length+c.length}let s=Buffer.concat(n),r=Buffer.alloc(22);return r.writeUInt32LE(101010256,0),r.writeUInt16LE(e.length,8),r.writeUInt16LE(e.length,10),r.writeUInt32LE(s.length,12),r.writeUInt32LE(i,16),Buffer.concat([...t,s,r])}function le(e){let t=F(e);if(!t||t.length===0||t.some(u=>Ft.test(u.name)))return null;let n=new Map;for(let u of t){if(u.name.endsWith("/")){n.set(u.name,Buffer.alloc(0));continue}let y=D(e,u);if(!y)return null;n.set(u.name,y)}let i=[...n.keys()].filter(u=>zt.test(u));if(i.length===0)return null;let s=n.get("xl/sharedStrings.xml")?.toString("utf8")??null,r=Ht(s),o=new Set,a={},l=new Set,c=re();for(let u of i){let y=n.get(u).toString("utf8"),b=Nt(y);if(!b)return null;let V=Ut(u.replace(/^xl\/worksheets\//,"").replace(/\.xml$/,""),b,r),C=V.row,E=new Map;for(let _ of b){if(_.type!=="n"||_.row<=C)continue;let k=I(_,r);k!==null&&E.set(_.col,[...E.get(_.col)??[],k])}let R=ae(E),P=new Map;for(let[_,{type:k,header:G,how:X}]of V.cols)X==="header"&&R.has(_)||(P.set(_,k),l.add(G));let nt=y.replace(Fe,(_,k,G)=>{let X=z(k,"r"),[,J,it]=/^([A-Z]+)(\d+)$/.exec(X),A={full:_,attrs:k,inner:G??"",col:J,row:Number(it),type:z(k,"t")??"n"},w=I(A,r),q=()=>{if(A.type==="s"){let he=/<v>([^<]*)<\/v>/.exec(A.inner);he&&o.add(Number(he[1]))}return _};if(w===null||w.trim()==="")return q();let Y=P.get(J);if(Y&&A.row>C&&!oe(w))return Dt(a,`column:${Y}`),Te(k,c(Y,w));if(A.type==="n"&&R.has(J))return q();let ue=x(w,a);return ue.text===w?q():Te(k,ue.text)});n.set(u,Buffer.from(nt,"utf8"))}if(s){let u=-1,y=s.replace(/<si\b[^>]*>[\s\S]*?<\/si>|<si\b[^>]*\/>/g,b=>(u+=1,o.has(u)?b:"<si><t></t></si>"));n.set("xl/sharedStrings.xml",Buffer.from(y,"utf8"))}for(let u of[...n.keys()].filter(y=>/^xl\/comments\d*\.xml$/.test(y))){let b=n.get(u).toString("utf8").replace(/(<t(?:\s[^>]*)?>)([\s\S]*?)(<\/t>)/g,(V,C,E,R)=>{let P=x(S(E),a);return`${C}${Pe(P.text)}${R}`});n.set(u,Buffer.from(b,"utf8"))}let p=n.get("docProps/core.xml");if(p){let u=p.toString("utf8").replace(/(<dc:creator>)[\s\S]*?(<\/dc:creator>)/,"$1$2").replace(/(<cp:lastModifiedBy>)[\s\S]*?(<\/cp:lastModifiedBy>)/,"$1$2");n.set("docProps/core.xml",Buffer.from(u,"utf8"))}let d=n.get("xl/workbook.xml");if(d){let u=d.toString("utf8").replace(/<(\w+:)?absPath\b[^>]*\/>|<(\w+:)?absPath\b[^>]*>[\s\S]*?<\/(\w+:)?absPath>/g,"");n.set("xl/workbook.xml",Buffer.from(u,"utf8"))}let h=n.get("docProps/app.xml");if(h){let u=h.toString("utf8").replace(/(<Company>)[\s\S]*?(<\/Company>)/,"$1$2").replace(/(<Manager>)[\s\S]*?(<\/Manager>)/,"$1$2");n.set("docProps/app.xml",Buffer.from(u,"utf8"))}let f=n.has("xl/calcChain.xml"),g=t.map(u=>u.name).filter(u=>!(f&&u==="xl/calcChain.xml"));if(f)for(let u of["[Content_Types].xml","xl/_rels/workbook.xml.rels"]){let y=n.get(u);y&&n.set(u,Buffer.from(y.toString("utf8").replace(/<(Override|Relationship)\b[^>]*calcChain[^>]*\/>/g,""),"utf8"))}return{bytes:De(g.map(u=>({name:u,data:n.get(u)}))),counts:a,columnsHidden:[...l]}}var _i=64*1024*1024,ki=32*1024;var vi=new Set([".cache",".cargo",".rustup",".npm",".pnpm-store",".yarn",".gradle",".m2",".nuget",".conda",".pyenv",".rbenv",".nvm",".volta",".bun",".deno",".docker",".android",".vscode-server",".agents",".agent",".codeium",".continue","antigravity",".antigravity","__pycache__",".venv","venv","site-packages",".next",".turbo",".expo",".nx",".parcel-cache",".svelte-kit","appdata",".trash","$recycle.bin"].map(e=>e.toLowerCase()));var Gt=["Put the new key where the app reads it (for a developer machine: the NoData vault + nodata_run, not a .env file).","Check that the app still works with the new key.","Only then delete / revoke the OLD key \u2014 until you do, whoever copied it can still use it."],m=(e,t,n)=>({provider:e,url:t,steps:[...n,...Gt]}),Ti={"aws-access-key":m("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault)."]),"aws-secret-key":m("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault).","Mark the old key Inactive before deleting it."]),"gcp-api-key":m("Google Cloud","https://console.cloud.google.com/apis/credentials",["Open APIs & Services \u2192 Credentials.","Pick the key \u2192 Regenerate key (or create a new one and restrict it to the APIs you use)."]),"gcp-service-account":m("Google Cloud (service account)","https://console.cloud.google.com/iam-admin/serviceaccounts",["Open IAM & Admin \u2192 Service accounts \u2192 the account \u2192 Keys.","Add key \u2192 Create new key (JSON). Keep the file out of Git and out of shared folders."]),"firebase-key":m("Firebase / Google Cloud","https://console.cloud.google.com/apis/credentials",["A Firebase web key is meant to be public \u2014 restrict it instead: Credentials \u2192 the key \u2192 Application restrictions (your domains only).","If it is not a web key, regenerate it."]),"github-token":m("GitHub","https://github.com/settings/tokens",["Open Settings \u2192 Developer settings \u2192 Personal access tokens.","Generate a new token with only the scopes you need."]),"github-fine-grained":m("GitHub","https://github.com/settings/tokens?type=beta",["Open Fine-grained tokens.","Regenerate the token (or create a new one for only the repositories you need)."]),"gitlab-token":m("GitLab","https://gitlab.com/-/user_settings/personal_access_tokens",["Open Access tokens.","Create a new token with only the scopes you need."]),"stripe-secret":m("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys.","Roll the secret key (Stripe can keep the old one alive for a short overlap)."]),"stripe-restricted":m("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys \u2192 Restricted keys.","Roll the key, or create a new restricted key."]),"slack-token":m("Slack","https://api.slack.com/apps",["Open your app \u2192 OAuth & Permissions.","Rotate / reinstall to get a new token."]),"slack-webhook":m("Slack","https://api.slack.com/apps",["Open your app \u2192 Incoming Webhooks.","Add a new webhook URL for the channel."]),"twilio-api-key":m("Twilio","https://console.twilio.com/us1/account/keys-credentials/api-keys",["Open Account \u2192 API keys & tokens.","Create a new API key."]),"sendgrid-api-key":m("SendGrid","https://app.sendgrid.com/settings/api_keys",["Open Settings \u2192 API Keys.","Create a new key with only the permissions you need."]),"openai-key":m("OpenAI","https://platform.openai.com/api-keys",["Open API keys.","Create a new secret key."]),"anthropic-key":m("Anthropic","https://console.anthropic.com/settings/keys",["Open Settings \u2192 API keys.","Create a new key."]),"supabase-key":m("Supabase","https://supabase.com/dashboard/project/_/settings/api-keys",["Open the project \u2192 Project Settings \u2192 API Keys.","Create a new SECRET key (a service_role / secret key bypasses every database rule \u2014 treat it like a root password).","Older projects with JWT keys: rotating the JWT secret replaces every key and signs everyone out \u2014 plan it."]),"postgres-uri":m("PostgreSQL (the password in the connection string)","https://supabase.com/dashboard/project/_/settings/database",["Change the database user's password: in Supabase \u2192 Project Settings \u2192 Database \u2192 Reset password; elsewhere, your host's console or ALTER USER \u2026 WITH PASSWORD.","Update the connection string with the new password."]),"mongodb-uri":m("MongoDB","https://cloud.mongodb.com/",["Open Atlas \u2192 Database Access \u2192 the user \u2192 Edit \u2192 Edit password.","Update the connection string."]),"redis-uri":m("Redis","",["Reset the password in your Redis host's console (or CONFIG SET requirepass on your own server).","Update the connection string."]),"private-key":m("Private key (SSH / TLS / signing)","",["Generate a new key pair.","Register the new PUBLIC key where the old one was trusted (server authorized_keys, certificate, service settings)."]),"jwt-secret":m("Your app's JWT secret","",["Set a new long random secret in the app's configuration.","Every signed-in user will be signed out \u2014 plan the moment."]),"password-in-code":m("A password in code","",["Change the password in the system it belongs to."]),"bearer-token":m("An access token","",["Revoke the token in the service that issued it and issue a new one."])},Ci=m("A credential","",["Find the service it belongs to and issue a new credential there."]);function He(e){return/\.ndc$/i.test(e)||/\.clean\.[A-Za-z0-9]+$/.test(e)}import{existsSync as Xt,mkdirSync as ts,readFileSync as Jt,writeFileSync as ns}from"node:fs";import{homedir as qt}from"node:os";import{join as Yt}from"node:path";var Ne=()=>Yt(qt(),".nodata","prefs.json");function Qt(){try{let e=Xt(Ne())?JSON.parse(Jt(Ne(),"utf8")).lang:null;return e==="he"||e==="en"?e:null}catch{return null}}function en(){let t=process.env.LC_ALL||process.env.LC_MESSAGES||process.env.LANG||"";try{t||=Intl.DateTimeFormat().resolvedOptions().locale}catch{}return/^(he|iw)(?:[-_.@]|$)/i.test(t)?"he":"en"}function M(){return Qt()??en()}function Oe(e,t,n=M()){return n==="he"?e:t}var ln=new Set([".csv",".tsv",".txt",".md",".json",".log",".xml",".sql",".yaml",".yml",".xlsx",".xlsm",".docx",".pptx",".pdf"]),dn=50*1024*1024,pn=8,un={israeli_id:"Israeli ID",credit_card:"card",iban:"IBAN",israeli_phone:"phone",email:"email",secret:"secret"};function Ue(e){let t=on(e).toLowerCase();return ln.has(Be(t))||t===".env"||t.startsWith(".env.")}function hn(e){let t=Be(e).toLowerCase(),n=rn(e),i,s;if(t===".csv"||t===".tsv")s=n.toString("utf8"),i=ce(s,t===".tsv"?"	":void 0).counts;else if(t===".xlsx"||t===".xlsm"||t===".docx"||t===".pptx"||t===".pdf"){let o=t===".xlsx"||t===".xlsm"?le(n):null;s=H(n,t)?.text??"",i=o?o.counts:x(s).counts}else s=n.toString("utf8"),i=x(s).counts;let r=me.filter(o=>o.pattern.test(s)).length;return r&&(i.secret=(i.secret??0)+r),i}var fn={israeli_id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",credit_card:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9",iban:"IBAN",israeli_phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",email:'\u05D3\u05D5\u05D0"\u05DC',secret:"\u05E1\u05D5\u05D3",name:"\u05E9\u05DD",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",financial:"\u05DE\u05D9\u05D3\u05E2 \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",bank_account:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7",plate:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"};function mn(e){let t=M()==="he",n=i=>(t?fn[i]:un[i])??i;return Object.entries(e).sort((i,s)=>s[1]-i[1]).map(([i,s])=>`${s} ${i.startsWith("column:")?`${n(i.slice(7))} (${t?"\u05E2\u05DE\u05D5\u05D3\u05D4":"column"})`:n(i)}`).join(", ")}function gn(e,t,n){let i=r=>an(r)?r:cn(n,r),s=r=>{try{return Me(r).isFile()}catch{return!1}};if(e==="Read"&&typeof t.file_path=="string")return[i(t.file_path)];if(e==="Grep"&&typeof t.path=="string"&&s(i(t.path)))return[i(t.path)];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"){let r=t.command,o=[...[...r.matchAll(/"([^"]*)"/g)].map(l=>l[1]),...[...r.matchAll(/'([^']*)'/g)].map(l=>l[1]),...r.split(/[\s|;&<>(),=`]+/)],a=[];for(let l of o){let c=l.trim().replace(/^['"]|['"]$/g,"").replace(/\\\\/g,"\\").replace(/^~(?=[\\/])/,je()).replace(/^\/([a-zA-Z])\//,(d,h)=>process.platform==="win32"?`${h}:/`:d);if(!c||!Ue(c))continue;let p=i(c);if(s(p)&&!a.includes(p)&&a.push(p),a.length>=pn)break}return a}return[]}function de(e){return e.replace(/\\+/g,"/")}function yn(e){let t=e.trim();return/[;|&\n]|`|\$\(/.test(t.replace(/^cmd(?:\.exe)?\s+\/c\s+/i,""))?!1:/^(?:cmd(?:\.exe)?\s+\/c\s+)?(?:explorer(?:\.exe)?|start|invoke-item|ii|start-process|open|xdg-open)\b/i.test(t)}function We(e,t,n){let i=[];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"&&yn(t.command))return i;for(let s of gn(e,t,n)){if(!Ue(s)||He(s)||!nn(s))continue;let r;try{if(Me(s).size>dn)r=`${de(s)}: too large to check here (over 50 MB)`;else{let o=hn(s);if(Object.keys(o).length===0)continue;r=`${de(s)}: ${mn(o)}`}}catch{r=`${de(s)}: could not be checked`}i.push(r)}return i}function bn(e,t,n,i){let s=We(e,t,n);if(s.length===0)return{decision:"allow"};let r=Oe(`NoData \u05E1\u05E8\u05E7 \u05D0\u05EA \u05D4\u05E7\u05D5\u05D1\u05E5 \u05D1\u05DE\u05D7\u05E9\u05D1 \u05E9\u05DC\u05DA \u2014 \u05E9\u05D5\u05DD \u05D3\u05D1\u05E8 \u05DC\u05D0 \u05D9\u05E6\u05D0:
+  ${s.join(`
   `)}
-Reading it puts these values in front of the AI. Safer: nodata_redact (a clean copy to work on) or nodata_protect (lock it).`+(i?"":" Allow this read anyway?");return{decision:i?"deny":"ask",reason:s}}function qt(t){try{let e=Te(Re(),".nodata");zt(e,{recursive:!0}),Dt(Te(e,"gate.log"),JSON.stringify({at:new Date().toISOString(),...t})+`
-`,{mode:384})}catch{}}async function He(t){let e=t.includes("--block"),n="";for await(let a of process.stdin)n+=a;let i;try{i=JSON.parse(n)}catch{return}let r=i.tool_name??"",s=Jt(r,i.tool_input??{},i.cwd??process.cwd(),e);s.decision!=="allow"&&(qt({tool:r,decision:s.decision}),process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:s.decision,permissionDecisionReason:s.reason}})))}var Yt=[{type:"id_number",patterns:[/\b\d{9}\b/g,/ת\.?ז\.?\s*:?\s*(\d{9})/g,/זהות\s*:?\s*(\d{9})/g],confidence:.9,replacement:()=>"[\u05EA.\u05D6. \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"phone",patterns:[/\b0[2-9]\d[\s\-]?\d{7}\b/g,/\b05[0-9][\s\-]?\d{7}\b/g,/\+972[\s\-]?[2-9]\d[\s\-]?\d{7}\b/g],confidence:.95,replacement:()=>"[\u05D8\u05DC\u05E4\u05D5\u05DF \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"email",patterns:[/[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}/g],confidence:.99,replacement:t=>{let[,e]=t.split("@");return`[\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC: ***@${e}]`}},{type:"full_name",patterns:[/(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק)[:\s]+([א-ת][א-ת"'\-\s]{2,30}?)(?=[,\n\d]|ת\.ז)/g,/(?:עו"ד|ד"ר|פרופ'|מר|גברת)\s+([א-ת][א-ת"'\-\s]{2,25}?)(?=[,\n])/g],confidence:.75,replacement:()=>"[\u05E9\u05DD \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"bank_account",patterns:[/\b\d{2}[\-]\d{5,9}[\-]\d{2,3}\b/g,/(?:חשבון|ח-ן)\s*:?\s*(\d[\d\-]{8,15})/g],confidence:.88,replacement:()=>"[\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"medical",patterns:[/(?<![א-ת])[בהוכלמש]{0,2}(?:סוכרת|יתר לחץ דם|אסתמה|דיכאון|חרדה|סרטן|אי ספיקת לב|אפילפסיה)(?![א-ת])/g,/\b(?:Metformin|Lisinopril|Atorvastatin|Amlodipine|Sertraline|Fluoxetine|Omeprazole|Warfarin|Aspirin|Insulin)\b/gi,/\bHbA1c\s*:?\s*[\d.]+%?/g,/\bBMI\s*:?\s*[\d.]+/g,/(?<![א-ת])[בהוכלמש]{0,2}אבחנ[הות]\s*:?\s*[^,\n.]{2,40}/g],confidence:.85,replacement:()=>"[\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"financial_amount",patterns:[/[\d,]+(?:\.\d{2})?\s*(?:₪|ש"ח|NIS|שקל(?:ים)?)/g,/(?:₪|NIS)\s*[\d,]+(?:\.\d{2})?/g],confidence:.92,replacement:()=>"[\u05E1\u05DB\u05D5\u05DD \u05DB\u05E1\u05E4\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"birth_date",patterns:[/(?:תאריך לידה|נולד|נולדה|ד\.ל\.)\s*:?\s*\d{1,2}[\/\.\-]\d{1,2}[\/\.\-]\d{2,4}/g,/(?<![א-ת])[בהוכלמש]{0,2}גיל\s*:?\s*\d{1,3}\b/g],confidence:.88,replacement:()=>"[\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"address",patterns:[/רחוב\s+[א-ת][א-ת\s"'\-]{2,30}\s+\d{1,5}/g,/(?:רח'|רח\.)\s+[א-ת][א-ת\s"'\-]{2,30}\d{1,5}/g],confidence:.72,replacement:()=>"[\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"},{type:"license_plate",patterns:[/\b\d{2,3}[\-]\d{2,3}[\-]\d{2,3}\b/g],confidence:.8,replacement:()=>"[\u05DC\u05D5\u05D7\u05D9\u05EA \u05E8\u05D9\u05E9\u05D5\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"}];function Qt(t){if(t.length!==9)return!1;let e=t.split("").map(Number),n=0;for(let i=0;i<9;i++){let r=e[i]*(i%2===0?1:2);r>9&&(r-=9),n+=r}return n%10===0}var H=class{constructor(e){this.enabledTypes=new Set(e)}detect(e){let n=[],i=new Set;for(let s of Yt)if(this.enabledTypes.has(s.type))for(let a of s.patterns){let o=new RegExp(a.source,a.flags),c;for(;(c=o.exec(e))!==null;){let l=c[0],u=`${s.type}:${c.index}`;if(!i.has(u)){if(i.add(u),s.type==="id_number"){let d=l.replace(/\D/g,"");if(/^\d{9}$/.test(l)&&d.length===9&&!Qt(d))continue}n.push({type:s.type,value:l,startIndex:c.index,endIndex:c.index+l.length,confidence:s.confidence,replacement:s.replacement(l,s.type)})}}}n.sort((s,a)=>s.startIndex-a.startIndex||a.confidence-s.confidence);let r=[];for(let s of n)r.some(o=>s.startIndex<o.endIndex&&s.endIndex>o.startIndex)||r.push(s);return r}};var en=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם_אדם|שם הלקוח|שם_הלקוח|שם בן זוג|שם בן_זוג|שם המבוטח|שם_המבוטח|שם המוטב|שם_המוטב|שם מבוטח|שם_מבוטח|שם מוטב|שם_מוטב|שם הילד|שם_הילד|שם הקטין|שם_הקטין|firstname_he|lastname_he|shem|shem_mishpacha|shem_prati)$/i,type:"name",label:"Person name (Hebrew)",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מספר_זהות|מס' זהות|מס_זהות|מס' ת"ז|teudat_zehut|tz|t_z|israeli_id|il_id)$/i,type:"id",label:"Israeli ID",labelHe:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|מס דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה|מס רישיון|דרכון_מספר)$/i,type:"id",label:"Passport / DL (Hebrew)",labelHe:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|דואר_אלקטרוני|אימייל|כתובת מייל|כתובת_מייל|כתובת דואר|כתובת_דואר)$/i,type:"email",label:"Email (Hebrew)",labelHe:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|מספר_טלפון|טלפון נייד|טלפון_נייד|מס נייד|מס_נייד|מס' טל)$/i,type:"phone",label:"Phone (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|כתובת_מגורים|רחוב|מס בית|מספר בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|כתובת_מלאה|מען)$/i,type:"address",label:"Address (Hebrew)",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|תאריך_לידה|ת לידה|תאריך הולדת|תאריך_הולדת|יום הולדת|יום_הולדת|גיל)$/i,type:"dob",label:"Date of birth (Hebrew)",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|חשבון_בנק|מספר חשבון|מספר_חשבון|מס חשבון|מס' חשבון|בנק|סניף|מס סניף|iban|iban_il)$/i,type:"financial",label:"Bank account (Hebrew)",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|כרטיס_אשראי|מספר אשראי|מס אשראי|מס' אשראי|cvv|אשראי|מס כרטיס|מס_כרטיס)$/i,type:"financial",label:"Credit card (Hebrew)",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר_ברוטו|שכר נטו|שכר_נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"Salary / income (Hebrew)",labelHe:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|בדיקה_רפואית|מצב רפואי|מצב_רפואי|חיסון|תוצאת בדיקה|תוצאת_בדיקה|רופא|רגישות|אלרגיה|סוג דם|סוג_דם)$/i,type:"medical",label:"Medical (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מספר_פוליסה|מס פוליסה|מס' פוליסה|פוליסה|מספר חבר|מספר_חבר|מס חבר|מספר ביטוח|מספר_ביטוח|policy_?number|policy_?no|policy_?id)$/i,type:"policy",label:"Insurance policy number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"},{pattern:/^(?:מספר סוכן|מספר_סוכן|מס סוכן|מס' סוכן|מס_סוכן|קוד סוכן|קוד_סוכן|מספר משווק|מספר_משווק|מספר יצרן|סוכן ביטוח|agent_?number|agent_?no|agent_?id|agent_?code|broker_?id|broker_?number)$/i,type:"agent_id",label:"Insurance agent / broker number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"},{pattern:/^(?:שם הילד|שם_הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|מספר_ילדים|תעודת לידה|ת לידה ילד)$/i,type:"minor_data",label:"Minor data (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|נטייה_מינית|השקפה פוליטית|השקפה_פוליטית|מצב משפחתי|מצב_משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"Sensitive personal (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מספר_רכב|מס רכב|מס' רכב|לוחית רישוי|לוחית_רישוי|מספר רישוי|מספר_רישוי)$/i,type:"tracking",label:"Vehicle ID (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}];function se(t){let e=String(t??"").replace(/\D/g,"");if(e.length===0||e.length>9)return!1;let n=e.padStart(9,"0"),i=0;for(let r=0;r<9;r++){let s=parseInt(n[r]??"0",10)*(r%2+1);s>9&&(s-=9),i+=s}return i%10===0&&parseInt(n,10)>0}var L=/(?:\+972[\s-]?|0)(?:5[0-9]|[2-4]|[89])(?:[\s-]?\d){7}/g,D=/[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}/gi,N=/\bIL\d{2}\s?(?:\d{4}\s?){4}\d{3}\b/g;function Le(t){let e=String(t??"").replace(/\D/g,"");if(e.length<13||e.length>19)return!1;let n=0,i=!1;for(let r=e.length-1;r>=0;r--){let s=e.charCodeAt(r)-48;if(s<0||s>9)return!1;i&&(s*=2,s>9&&(s-=9)),n+=s,i=!i}return n%10===0}function De(t){if(!t)return null;let e=t.trim();for(let n of en)if(n.pattern.test(e))return{type:n.type,label:n.label,labelHe:n.labelHe};return null}var tn=[{type:"biometric",tokens:["biometric","fingerprint","\u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"],phrases:["face id","\u05D8\u05D1\u05D9\u05E2\u05EA \u05D0\u05E6\u05D1\u05E2"]},{type:"medical",tokens:["diagnosis","medical","disease","medication","prescription","allergy","vaccine","\u05D0\u05D1\u05D7\u05D5\u05DF","\u05D0\u05D1\u05D7\u05E0\u05D4","\u05DE\u05D7\u05DC\u05D4","\u05EA\u05E8\u05D5\u05E4\u05D4","\u05DE\u05E8\u05E9\u05DD","\u05D7\u05D9\u05E1\u05D5\u05DF","\u05D0\u05DC\u05E8\u05D2\u05D9\u05D4"],phrases:["medical record","blood type","\u05DE\u05E6\u05D1 \u05E8\u05E4\u05D5\u05D0\u05D9","\u05E1\u05D5\u05D2 \u05D3\u05DD"]},{type:"sensitive_personal",tokens:["religion","ethnicity","nationality","\u05D3\u05EA","\u05DC\u05D0\u05D5\u05DD","\u05E2\u05D3\u05D4","\u05DE\u05D5\u05E6\u05D0"],phrases:["sexual orientation","marital status","\u05DE\u05E6\u05D1 \u05DE\u05E9\u05E4\u05D7\u05EA\u05D9","\u05E0\u05D8\u05D9\u05D9\u05D4 \u05DE\u05D9\u05E0\u05D9\u05EA"]},{type:"minor_data",tokens:["minor","\u05E7\u05D8\u05D9\u05DF"],phrases:["child name","\u05E9\u05DD \u05D4\u05D9\u05DC\u05D3","\u05E9\u05DD \u05D4\u05E7\u05D8\u05D9\u05DF"]},{type:"id",tokens:["ssn","passport","\u05D6\u05D4\u05D5\u05EA","\u05D3\u05E8\u05DB\u05D5\u05DF"],phrases:["national id","id number","identity number","social security","driver license","driving license","drivers license","passport number","tax id","\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA","\u05DE\u05E1\u05E4\u05E8 \u05D6\u05D4\u05D5\u05EA","\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"]},{type:"financial",tokens:["iban","swift","bic","salary","income","wage","\u05D0\u05E9\u05E8\u05D0\u05D9","\u05E9\u05DB\u05E8","\u05DE\u05E9\u05DB\u05D5\u05E8\u05EA","\u05D4\u05DB\u05E0\u05E1\u05D4"],phrases:["bank account","account number","credit card","card number","routing number","sort code","\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7","\u05DE\u05E1\u05E4\u05E8 \u05D7\u05E9\u05D1\u05D5\u05DF","\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"]},{type:"policy",tokens:["policy","\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"],phrases:["policy number","member number","\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"]},{type:"agent_id",tokens:["\u05DE\u05E9\u05D5\u05D5\u05E7"],phrases:["agent number","agent code","broker id","\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"]},{type:"dob",tokens:["dob","birthdate","birthday","\u05DC\u05D9\u05D3\u05D4","\u05D4\u05D5\u05DC\u05D3\u05EA","\u05D2\u05D9\u05DC"],phrases:["date of birth","birth date","\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"]},{type:"phone",tokens:["phone","tel","mobile","cell","fax","\u05D8\u05DC\u05E4\u05D5\u05DF","\u05E0\u05D9\u05D9\u05D3","\u05E4\u05DC\u05D0\u05E4\u05D5\u05DF","\u05E1\u05DC\u05D5\u05DC\u05E8\u05D9"],phrases:["phone number","mobile number","cell phone","\u05D8\u05DC\u05E4\u05D5\u05DF \u05E0\u05D9\u05D9\u05D3"]},{type:"email",tokens:["email","mail","\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC","\u05DE\u05D9\u05D9\u05DC","\u05D3\u05D5\u05D0\u05DC"],phrases:["email address","e mail","\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D9\u05D9\u05DC"]},{type:"address",tokens:["address","street","city","zipcode","zip","postcode","\u05DB\u05EA\u05D5\u05D1\u05EA","\u05E8\u05D7\u05D5\u05D1","\u05E2\u05D9\u05E8","\u05D9\u05E9\u05D5\u05D1","\u05D9\u05D9\u05E9\u05D5\u05D1","\u05DE\u05D9\u05E7\u05D5\u05D3","\u05DE\u05E2\u05DF"],phrases:["home address","postal code","street address","zip code","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D2\u05D5\u05E8\u05D9\u05DD"]},{type:"location",tokens:["gps","latitude","longitude","geolocation","\u05DE\u05D9\u05E7\u05D5\u05DD"],phrases:["gps coordinates"]},{type:"tracking",tokens:["plate","vehicle","\u05E8\u05DB\u05D1","\u05E8\u05D9\u05E9\u05D5\u05D9"],phrases:["license plate","vehicle number","plate number","\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"]},{type:"name",tokens:["name","\u05E9\u05DD"],phrases:["first name","last name","full name","family name","given name","surname","\u05E9\u05DD \u05E4\u05E8\u05D8\u05D9","\u05E9\u05DD \u05DE\u05E9\u05E4\u05D7\u05D4","\u05E9\u05DD \u05DE\u05DC\u05D0"]}];function z(t){if(!t)return null;let e=t.trim().toLowerCase().replace(/["'`׳״]/g,"").replace(/[_\-.]+/g," ").replace(/\s+/g," ").trim();if(!e)return null;let n=new Set(e.match(/[\p{L}\p{N}]+/gu)??[]);for(let i of tn)if(i.phrases?.some(s=>e.includes(s))||i.tokens?.some(s=>n.has(s)))return{type:i.type,label:i.type,labelHe:M(i.type)};return null}function M(t){return{id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",name:"\u05E9\u05DD \u05D0\u05D3\u05DD",email:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9",phone:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",financial:"\u05E4\u05E8\u05D8\u05D9\u05DD \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9\u05D9\u05DD",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",minor_data:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF",sensitive_personal:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9",biometric:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9",auth:"\u05E1\u05D9\u05E1\u05DE\u05D0\u05D5\u05EA/\u05E1\u05D5\u05D3\u05D5\u05EA",tracking:"\u05DE\u05D6\u05D4\u05D9 \u05DE\u05E2\u05E7\u05D1",location:"\u05DE\u05D9\u05E7\u05D5\u05DD"}[t]??"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9"}function Ne(t){let e=0,n=0,i=0,r=0,s=0;for(let o of t)typeof o=="string"&&(se(o)&&e++,L.lastIndex=0,L.test(o)&&n++,D.lastIndex=0,D.test(o)&&i++,N.lastIndex=0,N.test(o)&&r++,Le(o)&&s++);let a=t.length||1;return e/a>=.3?{type:"id",label:"Israeli ID (sniffed)",matchedSample:e}:r/a>=.3?{type:"financial",label:"IBAN-IL (sniffed)",matchedSample:r}:n/a>=.3?{type:"phone",label:"IL phone (sniffed)",matchedSample:n}:i/a>=.3?{type:"email",label:"Email (sniffed)",matchedSample:i}:s/a>=.3?{type:"financial",label:"Credit card (sniffed)",matchedSample:s}:null}var ze={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var sn=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA \u05D0\u05D9\u05DE\u05D9\u05D9\u05DC"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05D6\u05D4\u05D4"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Financial data",labelHe:"\u05E0\u05EA\u05D5\u05DF \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(ip_?address)$/i,type:"tracking",label:"IP address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA IP"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D3\u05E8\u05DB\u05D5\u05DF"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license",labelHe:"\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"},{pattern:/^(iban|swift_?code|bic)$/i,type:"financial",label:"Banking code",labelHe:"\u05E7\u05D5\u05D3 \u05D1\u05E0\u05E7\u05D0\u05D9"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05E1"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Member ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D1\u05D9\u05D8\u05D5\u05D7/\u05D7\u05D1\u05E8"},{pattern:/^(blood_?type|allergy|allergies|prescription)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation",labelHe:"\u05DE\u05D9\u05E7\u05D5\u05DD \u05D2\u05D9\u05D0\u05D5\u05D2\u05E8\u05E4\u05D9"},{pattern:/^(mac_?address|device_?fingerprint|imei|serial_?number)$/i,type:"tracking",label:"Device identifier",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05DE\u05DB\u05E9\u05D9\u05E8"},{pattern:/^(ethnicity|race|religion|political_?affiliation|sexual_?orientation)$/i,type:"sensitive_personal",label:"Sensitive personal",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(minor|child_?name|child_?age|dependent)$/i,type:"minor_data",label:"Minor data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05E0\u05D9\u05DD"},{pattern:/^(signature|digital_?signature)$/i,type:"id",label:"Signature",labelHe:"\u05D7\u05EA\u05D9\u05DE\u05D4"},{pattern:/^(vehicle_?number|license_?plate|plate_?number)$/i,type:"tracking",label:"Vehicle ID",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05E8\u05DB\u05D1"}],an=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|sort_?order|position|enabled|active|public|version|metadata|config|settings|options|data|content|body|raw|json|text|note|comment|label|color|icon|image|avatar|logo|thumbnail|preview|template|schema|format|mode|level|priority|severity|source|target|parent|child|owner|creator|modifier|assignee|project|workspace|organization|team|group|channel|thread|room|session|device|platform|browser|locale|timezone|currency|country|region|city|zip|postal|state|province|name|display_?name|user_?agent|password_?hash|secret|token|private_?key|auth_?token|constraint|index|sequence|trigger|function|procedure|database|namespace|migration|revision)$/i,on=/^(beacon_?registr|device_?config|hardware|sensor|firmware|telemetry|metric|analytic|log_?event|audit_?log|system_?config|cache|queue|job|migration|schema_?version|spatial_?ref)/i,cn=/^(minor|major|uuid|rssi|tx_?power|beacon_?id|device_?type|firmware_?version|batch_?id|zone_?id)$/i;function Me(t,e){if(an.test(t)||/^name$/i.test(t)||e&&on.test(e)||cn.test(t))return null;for(let i of sn)if(i.pattern.test(t))return i.type;let n=De(t);return n?n.type:null}var Ei=ze.rules.map(t=>({id:t.id,name:t.name,pattern:new RegExp(t.pattern),severity:t.severity}));var Ai=512*1024,$i=50*1024*1024;var ln={id:"high",agent_id:"high",policy:"high",financial:"high",medical:"critical",sensitive_personal:"critical",minor_data:"critical",biometric:"critical",auth:"critical",name:"medium",email:"high",phone:"high",address:"high",dob:"high",location:"high",tracking:"low"};function dn(t){return ln[t]??"low"}function je(t,e){let n=[];for(let i of e){let r=i.rows.length;for(let s=0;s<i.headers.length;s++){let a=i.headers[s]??"",o=a?Me(a.trim().replace(/["'`׳״:]/g,"").replace(/\s+/g,"_"),i.name)??z(a)?.type??null:null,c=[];for(let u of i.rows){let d=u[s];typeof d=="string"&&d.length>0&&c.push(d)}let l=c.length>0?Ne(c):null;l?n.push(Oe(t,i.name,a,l.type,l.label,"value",l.matchedSample,r)):o&&n.push(Oe(t,i.name,a,o,M(o),"header",0,r))}}return n}function Oe(t,e,n,i,r,s,a,o){return{file:t,location:e,column:n,type:i,label:r,category:M(i),severity:dn(i),matchKind:s,hits:a,sampleSize:o}}var Be={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var un=[{type:"full_name",kind:"name",severity:"medium",hint:`A person's name in free text (after a role word such as \u05DC\u05E7\u05D5\u05D7 / \u05DE\u05E8 / \u05E2\u05D5"\u05D3).`},{type:"bank_account",kind:"bank_account",severity:"high",hint:"An Israeli bank account number (branch-account-check form) in plaintext."},{type:"medical",kind:"medical",severity:"high",hint:"Medical information (diagnosis, medication, lab value) in plaintext."},{type:"birth_date",kind:"dob",severity:"medium",hint:"A date of birth in plaintext."},{type:"address",kind:"address",severity:"medium",hint:"A street address in plaintext."},{type:"license_plate",kind:"plate",severity:"low",hint:"A vehicle licence plate in plaintext."}],fn=/^(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק|עו"ד|ד"ר|פרופ'|מר|גברת|חשבון|ח-ן|[בהוכלמש]{0,2}אבחנ[הות]|תאריך לידה|נולד|נולדה|ד\.ל\.|[בהוכלמש]{0,2}גיל)\s*:?\s*/;function hn(t,e,n,i){if(i==="address")return{start:e,end:n};let r=fn.exec(t.slice(e,n));return r&&e+r[0].length<n?{start:e+r[0].length,end:n}:{start:e,end:n}}var mn=new Set(["hex-secret-32","base64-secret"]),Ue=!1;function Ze(){if(Ue)return;Ue=!0;let t=un.map(({type:n,kind:i,severity:r,hint:s})=>{let a=new H([n]);return{kind:i,severity:r,hint:s,find:o=>a.detect(o).map(c=>hn(o,c.startIndex,c.endIndex,i))}}),e=Be.rules.filter(n=>!mn.has(n.id)).map(n=>({id:n.id,name:n.name,severity:n.severity,pattern:new RegExp(n.pattern)}));W({text:t,header:n=>{let i=z(n);return i?{type:i.type,label:i.labelHe||i.label}:null},secrets:e,table:n=>je("",[n]).filter(i=>i.column).map(i=>({column:i.column,type:i.type,category:i.category,severity:i.severity,hits:i.hits,how:i.matchKind==="value"?"value":"header"}))})}Ze();He(process.argv.slice(2)).catch(()=>{process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"ask",permissionDecisionReason:"NoData could not check this file before it is read. Allow anyway?"}}))});
+`+(i?"\u05D4\u05E7\u05E8\u05D9\u05D0\u05D4 \u05E0\u05D7\u05E1\u05DE\u05D4: Claude \u05DC\u05D0 \u05D9\u05E7\u05E8\u05D0 \u05D0\u05EA \u05D4\u05DE\u05E7\u05D5\u05E8. \u05D1\u05DE\u05E7\u05D5\u05DD \u05D6\u05D4: nodata_redact (\u05E2\u05D5\u05EA\u05E7 \u05E0\u05E7\u05D9 \u05DC\u05E2\u05D1\u05D5\u05D3\u05D4) \u05D0\u05D5 nodata_protect (\u05E0\u05E2\u05D9\u05DC\u05D4).":"\u05D0\u05DD \u05EA\u05D0\u05E9\u05E8, Claude \u05D9\u05E7\u05E8\u05D0 \u05D0\u05EA \u05D4\u05E7\u05D5\u05D1\u05E5 \u05E2\u05E6\u05DE\u05D5 \u05D5\u05D4\u05EA\u05D5\u05DB\u05DF \u05D9\u05D9\u05E9\u05DC\u05D7 \u05DC\u05DE\u05D5\u05D3\u05DC \u05D4\u05D1\u05D9\u05E0\u05D4 \u05D4\u05DE\u05DC\u05D0\u05DB\u05D5\u05EA\u05D9\u05EA. \u05D1\u05DE\u05E7\u05D5\u05DD \u05D6\u05D4: nodata_redact (\u05E2\u05D5\u05EA\u05E7 \u05E0\u05E7\u05D9 \u05DC\u05E2\u05D1\u05D5\u05D3\u05D4) \u05D0\u05D5 nodata_protect (\u05E0\u05E2\u05D9\u05DC\u05D4). \u05DC\u05D0\u05E9\u05E8 \u05D1\u05DB\u05DC \u05D6\u05D0\u05EA?"),`NoData scanned this file on your machine \u2014 nothing left it:
+  ${s.join(`
+  `)}
+`+(i?"Read refused: Claude will not read the original. Instead: nodata_redact (a clean copy to work on) or nodata_protect (lock it).":"If you allow it, Claude reads the file itself and its content goes to the AI model. Instead: nodata_redact (a clean copy to work on) or nodata_protect (lock it). Allow anyway?"));return{decision:i?"deny":"ask",reason:r}}function _n(e,t,n){let i=We(e,t,n);return i.length===0?null:`NoData \xB7 ON SCREEN rule. What you just read holds personal data:
+  ${i.join(`
+  `)}
+The user's screen is not private \u2014 someone may be beside them. Answer with totals, counts, groupings and trends. Do not print names, ID / policy / account numbers, addresses, phones, or amounts tied to a person \u2014 not in a table, not as an "example" \u2014 unless the user explicitly asks to see those values. For a clean, anonymised or shareable version use nodata_redact \u2014 never your own script: it verifies the copy and records a proof.`+(M()==="he"?" Answer the user in Hebrew.":"")}function kn(e){try{let t=ze(je(),".nodata");sn(t,{recursive:!0}),tn(ze(t,"gate.log"),JSON.stringify({at:new Date().toISOString(),...e})+`
+`,{mode:384})}catch{}}async function Ze(e){let t=e.includes("--block"),n=e.includes("--post"),i="";for await(let a of process.stdin)i+=a;let s;try{s=JSON.parse(i)}catch{return}let r=s.tool_name??"";if(n){let a=_n(r,s.tool_input??{},s.cwd??process.cwd());a&&process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PostToolUse",additionalContext:a}}));return}let o=bn(r,s.tool_input??{},s.cwd??process.cwd(),t);o.decision!=="allow"&&(kn({tool:r,decision:o.decision}),process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:o.decision,permissionDecisionReason:o.reason}})))}var vn=[{type:"id_number",patterns:[/\b\d{9}\b/g,/ת\.?ז\.?\s*:?\s*(\d{9})/g,/זהות\s*:?\s*(\d{9})/g],confidence:.9,replacement:()=>"[\u05EA.\u05D6. \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"phone",patterns:[/\b0[2-9]\d[\s\-]?\d{7}\b/g,/\b05[0-9][\s\-]?\d{7}\b/g,/\+972[\s\-]?[2-9]\d[\s\-]?\d{7}\b/g],confidence:.95,replacement:()=>"[\u05D8\u05DC\u05E4\u05D5\u05DF \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"email",patterns:[/[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}/g],confidence:.99,replacement:e=>{let[,t]=e.split("@");return`[\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC: ***@${t}]`}},{type:"full_name",patterns:[/(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק)[:\s]+([א-ת][א-ת"'\-\s]{2,30}?)(?=[,\n\d]|ת\.ז)/g,/(?:עו"ד|ד"ר|פרופ'|מר|גברת)\s+([א-ת][א-ת"'\-\s]{2,25}?)(?=[,\n])/g],confidence:.75,replacement:()=>"[\u05E9\u05DD \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"bank_account",patterns:[/\b\d{2}[\-]\d{5,9}[\-]\d{2,3}\b/g,/(?:חשבון|ח-ן)\s*:?\s*(\d[\d\-]{8,15})/g],confidence:.88,replacement:()=>"[\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"medical",patterns:[/(?<![א-ת])[בהוכלמש]{0,2}(?:סוכרת|יתר לחץ דם|אסתמה|דיכאון|חרדה|סרטן|אי ספיקת לב|אפילפסיה)(?![א-ת])/g,/\b(?:Metformin|Lisinopril|Atorvastatin|Amlodipine|Sertraline|Fluoxetine|Omeprazole|Warfarin|Aspirin|Insulin)\b/gi,/\bHbA1c\s*:?\s*[\d.]+%?/g,/\bBMI\s*:?\s*[\d.]+/g,/(?<![א-ת])[בהוכלמש]{0,2}אבחנ[הות]\s*:?\s*[^,\n.]{2,40}/g],confidence:.85,replacement:()=>"[\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"financial_amount",patterns:[/[\d,]+(?:\.\d{2})?\s*(?:₪|ש"ח|NIS|שקל(?:ים)?)/g,/(?:₪|NIS)\s*[\d,]+(?:\.\d{2})?/g],confidence:.92,replacement:()=>"[\u05E1\u05DB\u05D5\u05DD \u05DB\u05E1\u05E4\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"birth_date",patterns:[/(?:תאריך לידה|נולד|נולדה|ד\.ל\.)\s*:?\s*\d{1,2}[\/\.\-]\d{1,2}[\/\.\-]\d{2,4}/g,/(?<![א-ת])[בהוכלמש]{0,2}גיל\s*:?\s*\d{1,3}\b/g],confidence:.88,replacement:()=>"[\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"address",patterns:[/רחוב\s+[א-ת][א-ת\s"'\-]{2,30}\s+\d{1,5}/g,/(?:רח'|רח\.)\s+[א-ת][א-ת\s"'\-]{2,30}\d{1,5}/g],confidence:.72,replacement:()=>"[\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"},{type:"license_plate",patterns:[/\b\d{2,3}[\-]\d{2,3}[\-]\d{2,3}\b/g],confidence:.8,replacement:()=>"[\u05DC\u05D5\u05D7\u05D9\u05EA \u05E8\u05D9\u05E9\u05D5\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"}];function xn(e){if(e.length!==9)return!1;let t=e.split("").map(Number),n=0;for(let i=0;i<9;i++){let s=t[i]*(i%2===0?1:2);s>9&&(s-=9),n+=s}return n%10===0}var j=class{constructor(t){this.enabledTypes=new Set(t)}detect(t){let n=[],i=new Set;for(let r of vn)if(this.enabledTypes.has(r.type))for(let o of r.patterns){let a=new RegExp(o.source,o.flags),l;for(;(l=a.exec(t))!==null;){let c=l[0],p=`${r.type}:${l.index}`;if(!i.has(p)){if(i.add(p),r.type==="id_number"){let d=c.replace(/\D/g,"");if(/^\d{9}$/.test(c)&&d.length===9&&!xn(d))continue}n.push({type:r.type,value:c,startIndex:l.index,endIndex:l.index+c.length,confidence:r.confidence,replacement:r.replacement(c,r.type)})}}}n.sort((r,o)=>r.startIndex-o.startIndex||o.confidence-r.confidence);let s=[];for(let r of n)s.some(a=>r.startIndex<a.endIndex&&r.endIndex>a.startIndex)||s.push(r);return s}};var Sn=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם_אדם|שם הלקוח|שם_הלקוח|שם בן זוג|שם בן_זוג|שם המבוטח|שם_המבוטח|שם המוטב|שם_המוטב|שם מבוטח|שם_מבוטח|שם מוטב|שם_מוטב|שם הילד|שם_הילד|שם הקטין|שם_הקטין|firstname_he|lastname_he|shem|shem_mishpacha|shem_prati)$/i,type:"name",label:"Person name (Hebrew)",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מספר_זהות|מס' זהות|מס_זהות|מס' ת"ז|teudat_zehut|tz|t_z|israeli_id|il_id)$/i,type:"id",label:"Israeli ID",labelHe:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|מס דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה|מס רישיון|דרכון_מספר)$/i,type:"id",label:"Passport / DL (Hebrew)",labelHe:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|דואר_אלקטרוני|אימייל|כתובת מייל|כתובת_מייל|כתובת דואר|כתובת_דואר)$/i,type:"email",label:"Email (Hebrew)",labelHe:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|מספר_טלפון|טלפון נייד|טלפון_נייד|מס נייד|מס_נייד|מס' טל)$/i,type:"phone",label:"Phone (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|כתובת_מגורים|רחוב|מס בית|מספר בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|כתובת_מלאה|מען)$/i,type:"address",label:"Address (Hebrew)",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|תאריך_לידה|ת לידה|תאריך הולדת|תאריך_הולדת|יום הולדת|יום_הולדת|גיל)$/i,type:"dob",label:"Date of birth (Hebrew)",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|חשבון_בנק|מספר חשבון|מספר_חשבון|מס חשבון|מס' חשבון|בנק|סניף|מס סניף|iban|iban_il)$/i,type:"financial",label:"Bank account (Hebrew)",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|כרטיס_אשראי|מספר אשראי|מס אשראי|מס' אשראי|cvv|אשראי|מס כרטיס|מס_כרטיס)$/i,type:"financial",label:"Credit card (Hebrew)",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר_ברוטו|שכר נטו|שכר_נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"Salary / income (Hebrew)",labelHe:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|בדיקה_רפואית|מצב רפואי|מצב_רפואי|חיסון|תוצאת בדיקה|תוצאת_בדיקה|רופא|רגישות|אלרגיה|סוג דם|סוג_דם)$/i,type:"medical",label:"Medical (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מספר_פוליסה|מס פוליסה|מס' פוליסה|פוליסה|מספר חבר|מספר_חבר|מס חבר|מספר ביטוח|מספר_ביטוח|policy_?number|policy_?no|policy_?id)$/i,type:"policy",label:"Insurance policy number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"},{pattern:/^(?:מספר סוכן|מספר_סוכן|מס סוכן|מס' סוכן|מס_סוכן|קוד סוכן|קוד_סוכן|מספר משווק|מספר_משווק|מספר יצרן|סוכן ביטוח|agent_?number|agent_?no|agent_?id|agent_?code|broker_?id|broker_?number)$/i,type:"agent_id",label:"Insurance agent / broker number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"},{pattern:/^(?:שם הילד|שם_הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|מספר_ילדים|תעודת לידה|ת לידה ילד)$/i,type:"minor_data",label:"Minor data (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|נטייה_מינית|השקפה פוליטית|השקפה_פוליטית|מצב משפחתי|מצב_משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"Sensitive personal (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מספר_רכב|מס רכב|מס' רכב|לוחית רישוי|לוחית_רישוי|מספר רישוי|מספר_רישוי)$/i,type:"tracking",label:"Vehicle ID (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}];function pe(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let n=t.padStart(9,"0"),i=0;for(let s=0;s<9;s++){let r=parseInt(n[s]??"0",10)*(s%2+1);r>9&&(r-=9),i+=r}return i%10===0&&parseInt(n,10)>0}var B=/(?:\+972[\s-]?|0)(?:5[0-9]|[2-4]|[89])(?:[\s-]?\d){7}/g,U=/[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}/gi,W=/\bIL\d{2}\s?(?:\d{4}\s?){4}\d{3}\b/g;function Ke(e){let t=String(e??"").replace(/\D/g,"");if(t.length<13||t.length>19)return!1;let n=0,i=!1;for(let s=t.length-1;s>=0;s--){let r=t.charCodeAt(s)-48;if(r<0||r>9)return!1;i&&(r*=2,r>9&&(r-=9)),n+=r,i=!i}return n%10===0}function Ve(e){if(!e)return null;let t=e.trim();for(let n of Sn)if(n.pattern.test(t))return{type:n.type,label:n.label,labelHe:n.labelHe};return null}var wn=[{type:"biometric",tokens:["biometric","fingerprint","\u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"],phrases:["face id","\u05D8\u05D1\u05D9\u05E2\u05EA \u05D0\u05E6\u05D1\u05E2"]},{type:"medical",tokens:["diagnosis","medical","disease","medication","prescription","allergy","vaccine","\u05D0\u05D1\u05D7\u05D5\u05DF","\u05D0\u05D1\u05D7\u05E0\u05D4","\u05DE\u05D7\u05DC\u05D4","\u05EA\u05E8\u05D5\u05E4\u05D4","\u05DE\u05E8\u05E9\u05DD","\u05D7\u05D9\u05E1\u05D5\u05DF","\u05D0\u05DC\u05E8\u05D2\u05D9\u05D4"],phrases:["medical record","blood type","\u05DE\u05E6\u05D1 \u05E8\u05E4\u05D5\u05D0\u05D9","\u05E1\u05D5\u05D2 \u05D3\u05DD"]},{type:"sensitive_personal",tokens:["religion","ethnicity","nationality","\u05D3\u05EA","\u05DC\u05D0\u05D5\u05DD","\u05E2\u05D3\u05D4","\u05DE\u05D5\u05E6\u05D0"],phrases:["sexual orientation","marital status","\u05DE\u05E6\u05D1 \u05DE\u05E9\u05E4\u05D7\u05EA\u05D9","\u05E0\u05D8\u05D9\u05D9\u05D4 \u05DE\u05D9\u05E0\u05D9\u05EA"]},{type:"minor_data",tokens:["minor","\u05E7\u05D8\u05D9\u05DF"],phrases:["child name","\u05E9\u05DD \u05D4\u05D9\u05DC\u05D3","\u05E9\u05DD \u05D4\u05E7\u05D8\u05D9\u05DF"]},{type:"id",tokens:["ssn","passport","\u05D6\u05D4\u05D5\u05EA","\u05D3\u05E8\u05DB\u05D5\u05DF"],phrases:["national id","id number","identity number","social security","driver license","driving license","drivers license","passport number","tax id","\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA","\u05DE\u05E1\u05E4\u05E8 \u05D6\u05D4\u05D5\u05EA","\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"]},{type:"financial",tokens:["iban","swift","bic","salary","income","wage","\u05D0\u05E9\u05E8\u05D0\u05D9","\u05E9\u05DB\u05E8","\u05DE\u05E9\u05DB\u05D5\u05E8\u05EA","\u05D4\u05DB\u05E0\u05E1\u05D4"],phrases:["bank account","account number","credit card","card number","routing number","sort code","\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7","\u05DE\u05E1\u05E4\u05E8 \u05D7\u05E9\u05D1\u05D5\u05DF","\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"]},{type:"policy",tokens:["policy","\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"],phrases:["policy number","member number","\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"]},{type:"agent_id",tokens:["\u05DE\u05E9\u05D5\u05D5\u05E7"],phrases:["agent number","agent code","broker id","\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"]},{type:"dob",tokens:["dob","birthdate","birthday","\u05DC\u05D9\u05D3\u05D4","\u05D4\u05D5\u05DC\u05D3\u05EA","\u05D2\u05D9\u05DC"],phrases:["date of birth","birth date","\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"]},{type:"phone",tokens:["phone","tel","mobile","cell","fax","\u05D8\u05DC\u05E4\u05D5\u05DF","\u05E0\u05D9\u05D9\u05D3","\u05E4\u05DC\u05D0\u05E4\u05D5\u05DF","\u05E1\u05DC\u05D5\u05DC\u05E8\u05D9"],phrases:["phone number","mobile number","cell phone","\u05D8\u05DC\u05E4\u05D5\u05DF \u05E0\u05D9\u05D9\u05D3"]},{type:"email",tokens:["email","mail","\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC","\u05DE\u05D9\u05D9\u05DC","\u05D3\u05D5\u05D0\u05DC"],phrases:["email address","e mail","\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D9\u05D9\u05DC"]},{type:"address",tokens:["address","street","city","zipcode","zip","postcode","\u05DB\u05EA\u05D5\u05D1\u05EA","\u05E8\u05D7\u05D5\u05D1","\u05E2\u05D9\u05E8","\u05D9\u05E9\u05D5\u05D1","\u05D9\u05D9\u05E9\u05D5\u05D1","\u05DE\u05D9\u05E7\u05D5\u05D3","\u05DE\u05E2\u05DF"],phrases:["home address","postal code","street address","zip code","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D2\u05D5\u05E8\u05D9\u05DD"]},{type:"location",tokens:["gps","latitude","longitude","geolocation","\u05DE\u05D9\u05E7\u05D5\u05DD"],phrases:["gps coordinates"]},{type:"tracking",tokens:["plate","vehicle","\u05E8\u05DB\u05D1","\u05E8\u05D9\u05E9\u05D5\u05D9"],phrases:["license plate","vehicle number","plate number","\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"]},{type:"name",tokens:["name","\u05E9\u05DD"],phrases:["first name","last name","full name","family name","given name","surname","\u05E9\u05DD \u05E4\u05E8\u05D8\u05D9","\u05E9\u05DD \u05DE\u05E9\u05E4\u05D7\u05D4","\u05E9\u05DD \u05DE\u05DC\u05D0"]}];function Z(e){if(!e)return null;let t=e.trim().toLowerCase().replace(/["'`׳״]/g,"").replace(/[_\-.]+/g," ").replace(/\s+/g," ").trim();if(!t)return null;let n=new Set(t.match(/[\p{L}\p{N}]+/gu)??[]);for(let i of wn)if(i.phrases?.some(r=>t.includes(r))||i.tokens?.some(r=>n.has(r)))return{type:i.type,label:i.type,labelHe:K(i.type)};return null}function K(e){return{id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",name:"\u05E9\u05DD \u05D0\u05D3\u05DD",email:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9",phone:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",financial:"\u05E4\u05E8\u05D8\u05D9\u05DD \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9\u05D9\u05DD",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",minor_data:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF",sensitive_personal:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9",biometric:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9",auth:"\u05E1\u05D9\u05E1\u05DE\u05D0\u05D5\u05EA/\u05E1\u05D5\u05D3\u05D5\u05EA",tracking:"\u05DE\u05D6\u05D4\u05D9 \u05DE\u05E2\u05E7\u05D1",location:"\u05DE\u05D9\u05E7\u05D5\u05DD"}[e]??"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9"}function Ge(e){let t=0,n=0,i=0,s=0,r=0;for(let a of e)typeof a=="string"&&(pe(a)&&t++,B.lastIndex=0,B.test(a)&&n++,U.lastIndex=0,U.test(a)&&i++,W.lastIndex=0,W.test(a)&&s++,Ke(a)&&r++);let o=e.length||1;return t/o>=.3?{type:"id",label:"Israeli ID (sniffed)",matchedSample:t}:s/o>=.3?{type:"financial",label:"IBAN-IL (sniffed)",matchedSample:s}:n/o>=.3?{type:"phone",label:"IL phone (sniffed)",matchedSample:n}:i/o>=.3?{type:"email",label:"Email (sniffed)",matchedSample:i}:r/o>=.3?{type:"financial",label:"Credit card (sniffed)",matchedSample:r}:null}var Xe={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var An=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA \u05D0\u05D9\u05DE\u05D9\u05D9\u05DC"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05D6\u05D4\u05D4"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Financial data",labelHe:"\u05E0\u05EA\u05D5\u05DF \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(ip_?address)$/i,type:"tracking",label:"IP address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA IP"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D3\u05E8\u05DB\u05D5\u05DF"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license",labelHe:"\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"},{pattern:/^(iban|swift_?code|bic)$/i,type:"financial",label:"Banking code",labelHe:"\u05E7\u05D5\u05D3 \u05D1\u05E0\u05E7\u05D0\u05D9"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05E1"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Member ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D1\u05D9\u05D8\u05D5\u05D7/\u05D7\u05D1\u05E8"},{pattern:/^(blood_?type|allergy|allergies|prescription)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation",labelHe:"\u05DE\u05D9\u05E7\u05D5\u05DD \u05D2\u05D9\u05D0\u05D5\u05D2\u05E8\u05E4\u05D9"},{pattern:/^(mac_?address|device_?fingerprint|imei|serial_?number)$/i,type:"tracking",label:"Device identifier",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05DE\u05DB\u05E9\u05D9\u05E8"},{pattern:/^(ethnicity|race|religion|political_?affiliation|sexual_?orientation)$/i,type:"sensitive_personal",label:"Sensitive personal",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(minor|child_?name|child_?age|dependent)$/i,type:"minor_data",label:"Minor data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05E0\u05D9\u05DD"},{pattern:/^(signature|digital_?signature)$/i,type:"id",label:"Signature",labelHe:"\u05D7\u05EA\u05D9\u05DE\u05D4"},{pattern:/^(vehicle_?number|license_?plate|plate_?number)$/i,type:"tracking",label:"Vehicle ID",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05E8\u05DB\u05D1"}],$n=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|sort_?order|position|enabled|active|public|version|metadata|config|settings|options|data|content|body|raw|json|text|note|comment|label|color|icon|image|avatar|logo|thumbnail|preview|template|schema|format|mode|level|priority|severity|source|target|parent|child|owner|creator|modifier|assignee|project|workspace|organization|team|group|channel|thread|room|session|device|platform|browser|locale|timezone|currency|country|region|city|zip|postal|state|province|name|display_?name|user_?agent|password_?hash|secret|token|private_?key|auth_?token|constraint|index|sequence|trigger|function|procedure|database|namespace|migration|revision)$/i,Tn=/^(beacon_?registr|device_?config|hardware|sensor|firmware|telemetry|metric|analytic|log_?event|audit_?log|system_?config|cache|queue|job|migration|schema_?version|spatial_?ref)/i,Cn=/^(minor|major|uuid|rssi|tx_?power|beacon_?id|device_?type|firmware_?version|batch_?id|zone_?id)$/i;function Je(e,t){if($n.test(e)||/^name$/i.test(e)||t&&Tn.test(t)||Cn.test(e))return null;for(let i of An)if(i.pattern.test(e))return i.type;let n=Ve(e);return n?n.type:null}var ks=Xe.rules.map(e=>({id:e.id,name:e.name,pattern:new RegExp(e.pattern),severity:e.severity}));var vs=512*1024,xs=50*1024*1024;var Rn={id:"high",agent_id:"high",policy:"high",financial:"high",medical:"critical",sensitive_personal:"critical",minor_data:"critical",biometric:"critical",auth:"critical",name:"medium",email:"high",phone:"high",address:"high",dob:"high",location:"high",tracking:"low"};function Pn(e){return Rn[e]??"low"}function Ye(e,t){let n=[];for(let i of t){let s=i.rows.length;for(let r=0;r<i.headers.length;r++){let o=i.headers[r]??"",a=o?Je(o.trim().replace(/["'`׳״:]/g,"").replace(/\s+/g,"_"),i.name)??Z(o)?.type??null:null,l=[];for(let p of i.rows){let d=p[r];typeof d=="string"&&d.length>0&&l.push(d)}let c=l.length>0?Ge(l):null;c?n.push(qe(e,i.name,o,c.type,c.label,"value",c.matchedSample,s)):a&&n.push(qe(e,i.name,o,a,K(a),"header",0,s))}}return n}function qe(e,t,n,i,s,r,o,a){return{file:e,location:t,column:n,type:i,label:s,category:K(i),severity:Pn(i),matchKind:r,hits:o,sampleSize:a}}var Qe={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var Fn=[{type:"full_name",kind:"name",severity:"medium",hint:`A person's name in free text (after a role word such as \u05DC\u05E7\u05D5\u05D7 / \u05DE\u05E8 / \u05E2\u05D5"\u05D3).`},{type:"bank_account",kind:"bank_account",severity:"high",hint:"An Israeli bank account number (branch-account-check form) in plaintext."},{type:"medical",kind:"medical",severity:"high",hint:"Medical information (diagnosis, medication, lab value) in plaintext."},{type:"birth_date",kind:"dob",severity:"medium",hint:"A date of birth in plaintext."},{type:"address",kind:"address",severity:"medium",hint:"A street address in plaintext."},{type:"license_plate",kind:"plate",severity:"low",hint:"A vehicle licence plate in plaintext."}],Dn=/^(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק|עו"ד|ד"ר|פרופ'|מר|גברת|חשבון|ח-ן|[בהוכלמש]{0,2}אבחנ[הות]|תאריך לידה|נולד|נולדה|ד\.ל\.|[בהוכלמש]{0,2}גיל)\s*:?\s*/;function Hn(e,t,n,i){if(i==="address")return{start:t,end:n};let s=Dn.exec(e.slice(t,n));return s&&t+s[0].length<n?{start:t+s[0].length,end:n}:{start:t,end:n}}var Nn=new Set(["hex-secret-32","base64-secret"]),et=!1;function tt(){if(et)return;et=!0;let e=Fn.map(({type:n,kind:i,severity:s,hint:r})=>{let o=new j([n]);return{kind:i,severity:s,hint:r,find:a=>o.detect(a).map(l=>Hn(a,l.startIndex,l.endIndex,i))}}),t=Qe.rules.filter(n=>!Nn.has(n.id)).map(n=>({id:n.id,name:n.name,severity:n.severity,pattern:new RegExp(n.pattern)}));Q({text:e,header:n=>{let i=Z(n);return i?{type:i.type,label:i.labelHe||i.label}:null},secrets:t,table:n=>Ye("",[n]).filter(i=>i.column).map(i=>({column:i.column,type:i.type,category:i.category,severity:i.severity,hits:i.hits,how:i.matchKind==="value"?"value":"header"}))})}tt();Ze(process.argv.slice(2)).catch(()=>{process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"ask",permissionDecisionReason:"NoData could not check this file before it is read. Allow anyway?"}}))});