@nodatachat/mcp 1.3.12 → 1.3.15

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/README.md +10 -5
  2. package/dist/gate.js +19 -19
  3. package/dist/index.js +121 -114
  4. package/dist/status.js +1 -1
  5. package/package.json +1 -1
package/README.md CHANGED
@@ -7,13 +7,18 @@ The MCP door to **NoData, the Information Access Processor**.
7
7
  One line connects any MCP client (Claude Code, an agent runtime) to NoData's governed‑access layer. Your agent asks *"may I reach this?"* and only ever sees the columns you granted. Denied columns are **never decrypted on the server** — there is nothing to leak — and every access leaves a signed, verifiable receipt.
8
8
 
9
9
  ```bash
10
- claude mcp add nodata -- npx @nodatachat/mcp
10
+ claude mcp add -s user nodata -- npx -y @nodatachat/mcp@latest # macOS / Linux
11
+ claude mcp add -s user nodata -- cmd /c npx -y @nodatachat/mcp@latest # Windows
12
+ npx -y @nodatachat/mcp install-gate # the read gate, the reminder and the status line
11
13
  ```
12
14
 
15
+ `-s user` makes it available in every folder, not only the one you ran it in; `-y …@latest` keeps npx
16
+ from reusing an old cached version. Restart Claude Code after both.
17
+
13
18
  Any other MCP client (Codex, Cursor, VS Code, Windsurf, Cline) runs the same server from its config:
14
19
 
15
20
  ```json
16
- { "mcpServers": { "nodata": { "command": "npx", "args": ["-y", "@nodatachat/mcp"] } } }
21
+ { "mcpServers": { "nodata": { "command": "npx", "args": ["-y", "@nodatachat/mcp@latest"] } } }
17
22
  ```
18
23
 
19
24
  That's it — **no flags**. Self‑serve: registering opens an instant free **sandbox key** (no approval wall) and a **12‑word recovery phrase only you hold**. No card. **10,000 governed decisions per month free**, then $0.25 per 1,000.
@@ -88,18 +93,18 @@ No terminal? Same idea in the browser, zero install: **https://www.nodatacapsule
88
93
  **Agent mode (`--grant-token ndca-…`)** — *permission management for language models.* Hand an AI agent a grant token; the server exposes only tools hard‑scoped to that grant. The agent may request **only** the columns its grant allows — denied columns never decrypt server‑side, and every action emits a receipt. Point any MCP client at it and it **physically cannot exceed its claims**.
89
94
 
90
95
  ```bash
91
- claude mcp add nodata -- npx @nodatachat/mcp --grant-token ndca-YOUR_GRANT
96
+ claude mcp add nodata -- npx -y @nodatachat/mcp@latest --grant-token ndca-YOUR_GRANT
92
97
  ```
93
98
 
94
99
  **Admin mode (`--api-key ndp_… / sk_live_…`)** — the owner seat: register tables, issue and revoke grants, and use blind relay (encrypt / decrypt / deliver / evidence) from inside any MCP client.
95
100
 
96
101
  ```bash
97
- claude mcp add nodata -- npx @nodatachat/mcp --api-key YOUR_API_KEY
102
+ claude mcp add -s user nodata -- npx -y @nodatachat/mcp@latest --api-key YOUR_API_KEY
98
103
  ```
99
104
 
100
105
  Credential precedence: `--api-key` / `--grant-token` › `NODATA_API_KEY` / `NODATA_GRANT_TOKEN` › the saved `~/.nodata` file. An explicit flag or env always wins.
101
106
 
102
- On **Windows**, native (non‑WSL) `npx` needs the `cmd /c` wrapper: `claude mcp add nodata -- cmd /c npx @nodatachat/mcp …`. After changing the credential, **restart** — the running server keeps its old arguments.
107
+ On **Windows**, native (non‑WSL) `npx` needs the `cmd /c` wrapper: `claude mcp add -s user nodata -- cmd /c npx -y @nodatachat/mcp@latest …`. After changing the credential, **restart** — the running server keeps its old arguments.
103
108
 
104
109
  ## The local workspace — scan, lock, work, release
105
110
 
package/dist/gate.js CHANGED
@@ -1,24 +1,24 @@
1
- /*! @nodatachat/mcp 1.3.12 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
2
- import{appendFileSync as Yt,copyFileSync as Ui,existsSync as Qt,mkdirSync as en,readFileSync as tn,statSync as ze,writeFileSync as Zi}from"node:fs";import{homedir as Me}from"node:os";import{basename as nn,extname as Oe,isAbsolute as rn,join as Ne,resolve as sn}from"node:path";var v={text:[],header:[],secrets:[],table:null};function Y(e){e.table&&(v.table=e.table);for(let t of e.text??[])v.text.some(n=>n.kind===t.kind)||v.text.push(t);e.header&&!v.header.includes(e.header)&&v.header.push(e.header);for(let t of e.secrets??[])v.secrets.some(n=>n.id===t.id)||v.secrets.push(t)}function Q(){return v.text}function ue(){return v.header}function A(){return v.table}var fe=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];var nt=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],it=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],rt=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i,st=/^שם[ _](?:ה)?(?:קובץ|מוצר|פריט|חברה|ארגון|עסק|פרויקט|גיליון|טבלה|שדה|קטגוריה|סניף|בנק|עיר|רחוב|ישוב|יישוב|מסמך|תוכנית|חבילה|קורס|מחלקה|אתר|דומיין|מותג|ספק|שירות|תפקיד)$|^(file|product|item|company|org|organization|project|sheet|table|field|category|branch|bank|city|street|document|plan|course|department|site|domain|brand|vendor|service|role)[ _-]?name$/i;function $(e){if(!e)return null;let t=e.trim();if(rt.test(t)||/^name$/i.test(t))return null;let n=t.replace(/[\s-]+/g,"_");for(let i of[...it,...nt])if(i.pattern.test(t)||i.pattern.test(n))return{type:i.type,label:i.label};if(st.test(t))return null;if(/^שם[ _][\u0590-\u05FF"'׳ ]{2,20}$/.test(t))return{type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"};if(/^(customer|client|employee|inspector|supervisor|contact|person|patient|user|owner|manager|agent|member|driver|tenant|student|parent|beneficiary|insured)_?(full_?)?name$/i.test(n))return{type:"name",label:"Person name"};for(let i of ue()){let r=i(t);if(r)return{type:r.type,label:r.label}}return null}function he(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let n=t.padStart(9,"0"),i=0;for(let r=0;r<9;r++){let s=parseInt(n[r]??"0",10)*(r%2+1);s>9&&(s-=9),i+=s}return i%10===0&&parseInt(n,10)>0}function ot(e){let t=String(e??"").replace(/\D/g,"");if(t.length<12||t.length>19)return!1;let n=0,i=!1;for(let r=t.length-1;r>=0;r-=1){let s=parseInt(t[r]??"0",10);i&&(s*=2,s>9&&(s-=9)),n+=s,i=!i}return n%10===0}function at(e){let t=String(e??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let n=t.slice(4)+t.slice(0,4),i=0;for(let r of n){let s=r>="A"&&r<="Z"?String(r.charCodeAt(0)-55):r;for(let o of s)i=(i*10+Number(o))%97}return i===1}var ee="(?<!\\d)(?<!\\d[.,])",te="(?!\\d)(?![.,]\\d)",me=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${ee}\\d{9}${te}`,"g"),validate:he,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${ee}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${te}`,"g"),validate:ot,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:at,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${ee}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${te}`,"g"),validate:e=>{let t=e.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(t)?!0:/^0[2-489]\d{7}$/.test(t)&&(/[- ]/.test(e)||e.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];function P(e,t){let n=[],i="",r=!1;for(let s=0;s<e.length;s++){let o=e[s];r?o==='"'&&e[s+1]==='"'?(i+='"',s++):o==='"'?r=!1:i+=o:o==='"'?r=!0:o===t?(n.push(i),i=""):i+=o}return n.push(i),n}import{inflateRawSync as yt}from"node:zlib";import{inflateSync as ct}from"node:zlib";var ne=new Set([".pdf"]),ge=8*1024*1024;function lt(e){let t=e.toString("latin1"),n=new Map,i=/(\d+)\s+(\d+)\s+obj\b/g,r;for(;(r=i.exec(t))!==null;){let s=Number(r[1]),o=i.lastIndex,a=t.indexOf("endobj",o);if(a<0)continue;let l=t.indexOf("stream",o),c,p=null;if(l>=0&&l<a){c=t.slice(o,l);let d=l+6;t[d]==="\r"&&(d+=1),t[d]===`
3
- `&&(d+=1);let f=t.indexOf("endstream",d);f>d&&(p=e.subarray(d,f))}else c=t.slice(o,a);n.set(s,{num:s,dict:c,stream:p})}return n}function dt(e){let t=e.toString("latin1").replace(/\s/g,"");t.startsWith("<~")&&(t=t.slice(2));let n=t.indexOf("~>");n>=0&&(t=t.slice(0,n));let i=[],r=0,s=0;for(let o of t){if(o==="z"&&s===0){i.push(0,0,0,0);continue}let a=o.charCodeAt(0)-33;if(a<0||a>84)return null;r=r*85+a,s+=1,s===5&&(i.push(r>>>24&255,r>>>16&255,r>>>8&255,r&255),r=0,s=0)}if(s>0){for(let a=s;a<5;a+=1)r=r*85+84;let o=[r>>>24&255,r>>>16&255,r>>>8&255,r&255];for(let a=0;a<s-1;a+=1)i.push(o[a]??0)}return Buffer.from(i)}function pt(e){let t=e.toString("latin1").replace(/\s/g,"").split(">")[0]??"",n=t.length%2?t+"0":t;return/^[0-9A-Fa-f]*$/.test(n)?Buffer.from(n,"hex"):null}function ut(e){let t=/\/Filter\s*(\[[^\]]*\]|\/\w+)/.exec(e);return!t||!t[1]?[]:[...t[1].matchAll(/\/(\w+)/g)].map(n=>n[1]??"")}function be(e){if(!e.stream)return null;let t=e.stream;for(let n of ut(e.dict)){let i=null;if(n==="FlateDecode")try{i=ct(t)}catch{return null}else if(n==="ASCII85Decode")i=dt(t);else if(n==="ASCIIHexDecode")i=pt(t);else return null;if(i===null)return null;t=i}return t.toString("latin1")}function ft(e){let t=new Map,n=1,i=/begincodespacerange([\s\S]*?)endcodespacerange/.exec(e);if(i&&i[1]){let l=/<([0-9A-Fa-f]+)>/.exec(i[1]);l&&l[1]&&l[1].length>=4&&(n=2)}let r=l=>{let c="";for(let p=0;p+3<l.length+1;p+=4){let d=parseInt(l.slice(p,p+4),16);Number.isFinite(d)&&d>0&&(c+=String.fromCharCode(d))}return c},s=/beginbfchar([\s\S]*?)endbfchar/g,o;for(;(o=s.exec(e))!==null;){let l=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,c;for(;(c=l.exec(o[1]??""))!==null;)t.set(parseInt(c[1]??"0",16),r(c[2]??""))}let a=/beginbfrange([\s\S]*?)endbfrange/g;for(;(o=a.exec(e))!==null;){let l=o[1]??"",c=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,p;for(;(p=c.exec(l))!==null;){let d=parseInt(p[1]??"0",16),f=parseInt(p[2]??"0",16),h=parseInt((p[3]??"0").slice(0,4)||"0",16);if(!(f-d>65535))for(let m=d;m<=f;m+=1)t.set(m,String.fromCharCode(h+(m-d)))}}return{map:t,bytes:n}}function ht(e){let t=new Map,n=new Map,i=[];for(let r of e.values()){let s=/\/Font\s*<<([\s\S]*?)>>/.exec(r.dict);s?.[1]&&i.push(s[1]);let o=/\/Font\s+(\d+)\s+\d+\s+R/.exec(r.dict);if(o){let a=e.get(Number(o[1]));a&&i.push(a.dict)}}for(let r of i){let s=/\/([^\s/<>[\]()]+)\s+(\d+)\s+\d+\s+R/g,o;for(;(o=s.exec(r))!==null;)n.set(o[1]??"",Number(o[2]))}for(let[r,s]of n){let o=e.get(s);if(!o)continue;let a=/\/ToUnicode\s+(\d+)\s+\d+\s+R/.exec(o.dict);if(!a)continue;let l=e.get(Number(a[1]));if(!l)continue;let c=be(l);c&&t.set(r,ft(c))}return t}function _e(e){let t=[];for(let n=0;n<e.length;n+=1){let i=e[n];if(i!=="\\"){t.push(i.charCodeAt(0)&255);continue}let r=e[n+1];if(r===void 0)break;if(r>="0"&&r<="7"){let o="",a=n+1;for(;a<e.length&&o.length<3&&e[a]>="0"&&e[a]<="7";)o+=e[a],a+=1;t.push(parseInt(o,8)&255),n=a-1;continue}let s={n:10,r:13,t:9,b:8,f:12};t.push(s[r]??r.charCodeAt(0)&255),n+=1}return t}function ve(e){if(e.length<2||e[0]!==254||e[1]!==255)return null;let t="";for(let n=2;n+1<e.length;n+=2)t+=String.fromCharCode((e[n]??0)<<8|(e[n+1]??0));return t}function ye(e,t){let n=ve(e);if(n!==null)return n;if(!t)return e.map(r=>String.fromCharCode(r)).join("");let i="";if(t.bytes===2)for(let r=0;r+1<e.length;r+=2){let s=(e[r]??0)<<8|(e[r+1]??0);i+=t.map.get(s)??""}else for(let r of e)i+=t.map.get(r)??String.fromCharCode(r);return i}function mt(e,t){let n="",i,r=/\/([^\s/<>[\]()]+)\s+[\d.]+\s+Tf|\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>|TJ|Tj|'|"/g,s,o="";for(;(s=r.exec(e))!==null;){let a=s[0];if(a.endsWith("Tf")){i=t.get(s[1]??"");continue}if(a==="TJ"||a==="Tj"||a==="'"||a==='"'){o&&(n+=o+`
4
- `,o="");continue}if(a.startsWith("("))o+=ye(_e(a.slice(1,-1)),i);else if(a.startsWith("<")){let l=a.slice(1,-1).replace(/\s+/g,""),c=[];for(let p=0;p+1<l.length;p+=2)c.push(parseInt(l.slice(p,p+2),16));o+=ye(c,i)}}return o&&(n+=o+`
5
- `),n}function gt(e,t){let n=e.toString("latin1"),i=/\/Info\s+(\d+)\s+\d+\s+R/.exec(n),r=i?t.get(Number(i[1]))?.dict:void 0;if(!r)return"";let s=[],o=/\/(Author|Title|Subject|Keywords|Creator|Producer)\s*(\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>)/g,a;for(;(a=o.exec(r))!==null;){let l=a[2]??"";if(l.startsWith("(")){let c=_e(l.slice(1,-1));s.push(ve(c)??c.map(p=>String.fromCharCode(p)).join(""))}else{let c=l.slice(1,-1).replace(/\s+/g,""),p="";if(c.toUpperCase().startsWith("FEFF"))for(let d=4;d+3<c.length+1;d+=4)p+=String.fromCharCode(parseInt(c.slice(d,d+4),16));else for(let d=0;d+1<c.length;d+=2)p+=String.fromCharCode(parseInt(c.slice(d,d+2),16));s.push(p)}}return s.join(`
6
- `)}function ke(e){if(!e.subarray(0,8).toString("latin1").startsWith("%PDF-")||e.toString("latin1",0,Math.min(e.length,4096)).includes("/Encrypt"))return null;let n=lt(e);if(n.size===0)return null;let i=ht(n),r=[];r.push(gt(e,n));let s=0,o=0,a=!1;for(let l of n.values()){if(!l.stream||/\/Subtype|\/Type\s*\/(XObject|Font|Metadata)|\/FontFile/.test(l.dict))continue;let c=be(l);if(c===null||!/(TJ|Tj)\b/.test(c))continue;let p=mt(c,i);if(p.trim().length!==0){if(o+=1,s+p.length>ge){r.push(p.slice(0,Math.max(0,ge-s))),a=!0;break}r.push(p),s+=p.length}}return o===0?null:{text:r.join(`
7
- `),truncated:a,streams:o}}var xe=new Set([".xlsx",".xlsm",".docx",".pptx"]),ie=8*1024*1024,bt=101010256,_t=33639248,vt=67324752;function L(e){let t=Math.min(e.length,67584),n=-1;for(let o=e.length-22;o>=e.length-t&&o>=0;o-=1)if(e.readUInt32LE(o)===bt){n=o;break}if(n<0)return null;let i=e.readUInt16LE(n+10),r=e.readUInt32LE(n+16);if(r>=e.length)return null;let s=[];for(let o=0;o<i&&!(r+46>e.length||e.readUInt32LE(r)!==_t);o+=1){let a=e.readUInt16LE(r+10),l=e.readUInt32LE(r+20),c=e.readUInt32LE(r+24),p=e.readUInt16LE(r+28),d=e.readUInt16LE(r+30),f=e.readUInt16LE(r+32),h=e.readUInt32LE(r+42),m=e.subarray(r+46,r+46+p).toString("utf8");s.push({name:m,method:a,compSize:l,uncompSize:c,localHeaderOffset:h}),r+=46+p+d+f}return s}function F(e,t){let n=t.localHeaderOffset;if(n+30>e.length||e.readUInt32LE(n)!==vt)return null;let i=e.readUInt16LE(n+26),r=e.readUInt16LE(n+28),s=n+30+i+r,o=s+t.compSize;if(o>e.length)return null;let a=e.subarray(s,o);try{if(t.method===0)return Buffer.from(a);if(t.method===8)return yt(a)}catch{return null}return null}function kt(e,t){return F(e,t)?.toString("utf8")??null}var xt={"&amp;":"&","&lt;":"<","&gt;":">","&quot;":'"',"&apos;":"'"};function x(e){return e.replace(/&(amp|lt|gt|quot|apos);/g,t=>xt[t]??t).replace(/&#(\d+);/g,(t,n)=>{let i=Number(n);return i>0&&i<1114112?String.fromCodePoint(i):""}).replace(/&#x([0-9a-fA-F]+);/g,(t,n)=>{let i=parseInt(n,16);return i>0&&i<1114112?String.fromCodePoint(i):""})}function St(e){return x(e.replace(/<[^>]*>/g,`
1
+ /*! @nodatachat/mcp 1.3.15 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
2
+ import{appendFileSync as tn,copyFileSync as as,existsSync as nn,mkdirSync as sn,readFileSync as rn,statSync as Me,writeFileSync as cs}from"node:fs";import{homedir as je}from"node:os";import{basename as on,extname as Be,isAbsolute as an,join as ze,resolve as cn}from"node:path";var v={text:[],header:[],secrets:[],table:null};function Q(e){e.table&&(v.table=e.table);for(let t of e.text??[])v.text.some(n=>n.kind===t.kind)||v.text.push(t);e.header&&!v.header.includes(e.header)&&v.header.push(e.header);for(let t of e.secrets??[])v.secrets.some(n=>n.id===t.id)||v.secrets.push(t)}function ee(){return v.text}function fe(){return v.header}function $(){return v.table}var me=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];var st=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],rt=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],ot=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i,at=/^שם[ _](?:ה)?(?:קובץ|מוצר|פריט|חברה|ארגון|עסק|פרויקט|גיליון|טבלה|שדה|קטגוריה|סניף|בנק|עיר|רחוב|ישוב|יישוב|מסמך|תוכנית|חבילה|קורס|מחלקה|אתר|דומיין|מותג|ספק|שירות|תפקיד)$|^(file|product|item|company|org|organization|project|sheet|table|field|category|branch|bank|city|street|document|plan|course|department|site|domain|brand|vendor|service|role)[ _-]?name$/i;function T(e){if(!e)return null;let t=e.trim();if(ot.test(t)||/^name$/i.test(t))return null;let n=t.replace(/[\s-]+/g,"_");for(let i of[...rt,...st])if(i.pattern.test(t)||i.pattern.test(n))return{type:i.type,label:i.label};if(at.test(t))return null;if(/^שם[ _][\u0590-\u05FF"'׳ ]{2,20}$/.test(t))return{type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"};if(/^(customer|client|employee|inspector|supervisor|contact|person|patient|user|owner|manager|agent|member|driver|tenant|student|parent|beneficiary|insured)_?(full_?)?name$/i.test(n))return{type:"name",label:"Person name"};for(let i of fe()){let s=i(t);if(s)return{type:s.type,label:s.label}}return null}function ge(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let n=t.padStart(9,"0"),i=0;for(let s=0;s<9;s++){let r=parseInt(n[s]??"0",10)*(s%2+1);r>9&&(r-=9),i+=r}return i%10===0&&parseInt(n,10)>0}function ct(e){let t=String(e??"").replace(/\D/g,"");if(t.length<12||t.length>19)return!1;let n=0,i=!1;for(let s=t.length-1;s>=0;s-=1){let r=parseInt(t[s]??"0",10);i&&(r*=2,r>9&&(r-=9)),n+=r,i=!i}return n%10===0}function lt(e){let t=String(e??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let n=t.slice(4)+t.slice(0,4),i=0;for(let s of n){let r=s>="A"&&s<="Z"?String(s.charCodeAt(0)-55):s;for(let o of r)i=(i*10+Number(o))%97}return i===1}var te="(?<!\\d)(?<!\\d[.,])",ne="(?!\\d)(?![.,]\\d)",ye=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${te}\\d{9}${ne}`,"g"),validate:ge,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${te}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${ne}`,"g"),validate:ct,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:lt,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${te}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${ne}`,"g"),validate:e=>{let t=e.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(t)?!0:/^0[2-489]\d{7}$/.test(t)&&(/[- ]/.test(e)||e.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];function L(e,t){let n=[],i="",s=!1;for(let r=0;r<e.length;r++){let o=e[r];s?o==='"'&&e[r+1]==='"'?(i+='"',r++):o==='"'?s=!1:i+=o:o==='"'?s=!0:o===t?(n.push(i),i=""):i+=o}return n.push(i),n}import{inflateRawSync as _t}from"node:zlib";import{inflateSync as dt}from"node:zlib";var ie=new Set([".pdf"]),be=8*1024*1024;function pt(e){let t=e.toString("latin1"),n=new Map,i=/(\d+)\s+(\d+)\s+obj\b/g,s;for(;(s=i.exec(t))!==null;){let r=Number(s[1]),o=i.lastIndex,a=t.indexOf("endobj",o);if(a<0)continue;let l=t.indexOf("stream",o),c,p=null;if(l>=0&&l<a){c=t.slice(o,l);let d=l+6;t[d]==="\r"&&(d+=1),t[d]===`
3
+ `&&(d+=1);let h=t.indexOf("endstream",d);h>d&&(p=e.subarray(d,h))}else c=t.slice(o,a);n.set(r,{num:r,dict:c,stream:p})}return n}function ut(e){let t=e.toString("latin1").replace(/\s/g,"");t.startsWith("<~")&&(t=t.slice(2));let n=t.indexOf("~>");n>=0&&(t=t.slice(0,n));let i=[],s=0,r=0;for(let o of t){if(o==="z"&&r===0){i.push(0,0,0,0);continue}let a=o.charCodeAt(0)-33;if(a<0||a>84)return null;s=s*85+a,r+=1,r===5&&(i.push(s>>>24&255,s>>>16&255,s>>>8&255,s&255),s=0,r=0)}if(r>0){for(let a=r;a<5;a+=1)s=s*85+84;let o=[s>>>24&255,s>>>16&255,s>>>8&255,s&255];for(let a=0;a<r-1;a+=1)i.push(o[a]??0)}return Buffer.from(i)}function ht(e){let t=e.toString("latin1").replace(/\s/g,"").split(">")[0]??"",n=t.length%2?t+"0":t;return/^[0-9A-Fa-f]*$/.test(n)?Buffer.from(n,"hex"):null}function ft(e){let t=/\/Filter\s*(\[[^\]]*\]|\/\w+)/.exec(e);return!t||!t[1]?[]:[...t[1].matchAll(/\/(\w+)/g)].map(n=>n[1]??"")}function ke(e){if(!e.stream)return null;let t=e.stream;for(let n of ft(e.dict)){let i=null;if(n==="FlateDecode")try{i=dt(t)}catch{return null}else if(n==="ASCII85Decode")i=ut(t);else if(n==="ASCIIHexDecode")i=ht(t);else return null;if(i===null)return null;t=i}return t.toString("latin1")}function mt(e){let t=new Map,n=1,i=/begincodespacerange([\s\S]*?)endcodespacerange/.exec(e);if(i&&i[1]){let l=/<([0-9A-Fa-f]+)>/.exec(i[1]);l&&l[1]&&l[1].length>=4&&(n=2)}let s=l=>{let c="";for(let p=0;p+3<l.length+1;p+=4){let d=parseInt(l.slice(p,p+4),16);Number.isFinite(d)&&d>0&&(c+=String.fromCharCode(d))}return c},r=/beginbfchar([\s\S]*?)endbfchar/g,o;for(;(o=r.exec(e))!==null;){let l=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,c;for(;(c=l.exec(o[1]??""))!==null;)t.set(parseInt(c[1]??"0",16),s(c[2]??""))}let a=/beginbfrange([\s\S]*?)endbfrange/g;for(;(o=a.exec(e))!==null;){let l=o[1]??"",c=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,p;for(;(p=c.exec(l))!==null;){let d=parseInt(p[1]??"0",16),h=parseInt(p[2]??"0",16),f=parseInt((p[3]??"0").slice(0,4)||"0",16);if(!(h-d>65535))for(let g=d;g<=h;g+=1)t.set(g,String.fromCharCode(f+(g-d)))}}return{map:t,bytes:n}}function gt(e){let t=new Map,n=new Map,i=[];for(let s of e.values()){let r=/\/Font\s*<<([\s\S]*?)>>/.exec(s.dict);r?.[1]&&i.push(r[1]);let o=/\/Font\s+(\d+)\s+\d+\s+R/.exec(s.dict);if(o){let a=e.get(Number(o[1]));a&&i.push(a.dict)}}for(let s of i){let r=/\/([^\s/<>[\]()]+)\s+(\d+)\s+\d+\s+R/g,o;for(;(o=r.exec(s))!==null;)n.set(o[1]??"",Number(o[2]))}for(let[s,r]of n){let o=e.get(r);if(!o)continue;let a=/\/ToUnicode\s+(\d+)\s+\d+\s+R/.exec(o.dict);if(!a)continue;let l=e.get(Number(a[1]));if(!l)continue;let c=ke(l);c&&t.set(s,mt(c))}return t}function ve(e){let t=[];for(let n=0;n<e.length;n+=1){let i=e[n];if(i!=="\\"){t.push(i.charCodeAt(0)&255);continue}let s=e[n+1];if(s===void 0)break;if(s>="0"&&s<="7"){let o="",a=n+1;for(;a<e.length&&o.length<3&&e[a]>="0"&&e[a]<="7";)o+=e[a],a+=1;t.push(parseInt(o,8)&255),n=a-1;continue}let r={n:10,r:13,t:9,b:8,f:12};t.push(r[s]??s.charCodeAt(0)&255),n+=1}return t}function xe(e){if(e.length<2||e[0]!==254||e[1]!==255)return null;let t="";for(let n=2;n+1<e.length;n+=2)t+=String.fromCharCode((e[n]??0)<<8|(e[n+1]??0));return t}function _e(e,t){let n=xe(e);if(n!==null)return n;if(!t)return e.map(s=>String.fromCharCode(s)).join("");let i="";if(t.bytes===2)for(let s=0;s+1<e.length;s+=2){let r=(e[s]??0)<<8|(e[s+1]??0);i+=t.map.get(r)??""}else for(let s of e)i+=t.map.get(s)??String.fromCharCode(s);return i}function yt(e,t){let n="",i,s=/\/([^\s/<>[\]()]+)\s+[\d.]+\s+Tf|\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>|TJ|Tj|'|"/g,r,o="";for(;(r=s.exec(e))!==null;){let a=r[0];if(a.endsWith("Tf")){i=t.get(r[1]??"");continue}if(a==="TJ"||a==="Tj"||a==="'"||a==='"'){o&&(n+=o+`
4
+ `,o="");continue}if(a.startsWith("("))o+=_e(ve(a.slice(1,-1)),i);else if(a.startsWith("<")){let l=a.slice(1,-1).replace(/\s+/g,""),c=[];for(let p=0;p+1<l.length;p+=2)c.push(parseInt(l.slice(p,p+2),16));o+=_e(c,i)}}return o&&(n+=o+`
5
+ `),n}function bt(e,t){let n=e.toString("latin1"),i=/\/Info\s+(\d+)\s+\d+\s+R/.exec(n),s=i?t.get(Number(i[1]))?.dict:void 0;if(!s)return"";let r=[],o=/\/(Author|Title|Subject|Keywords|Creator|Producer)\s*(\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>)/g,a;for(;(a=o.exec(s))!==null;){let l=a[2]??"";if(l.startsWith("(")){let c=ve(l.slice(1,-1));r.push(xe(c)??c.map(p=>String.fromCharCode(p)).join(""))}else{let c=l.slice(1,-1).replace(/\s+/g,""),p="";if(c.toUpperCase().startsWith("FEFF"))for(let d=4;d+3<c.length+1;d+=4)p+=String.fromCharCode(parseInt(c.slice(d,d+4),16));else for(let d=0;d+1<c.length;d+=2)p+=String.fromCharCode(parseInt(c.slice(d,d+2),16));r.push(p)}}return r.join(`
6
+ `)}function Se(e){if(!e.subarray(0,8).toString("latin1").startsWith("%PDF-")||e.toString("latin1",0,Math.min(e.length,4096)).includes("/Encrypt"))return null;let n=pt(e);if(n.size===0)return null;let i=gt(n),s=[];s.push(bt(e,n));let r=0,o=0,a=!1;for(let l of n.values()){if(!l.stream||/\/Subtype|\/Type\s*\/(XObject|Font|Metadata)|\/FontFile/.test(l.dict))continue;let c=ke(l);if(c===null||!/(TJ|Tj)\b/.test(c))continue;let p=yt(c,i);if(p.trim().length!==0){if(o+=1,r+p.length>be){s.push(p.slice(0,Math.max(0,be-r))),a=!0;break}s.push(p),r+=p.length}}return o===0?null:{text:s.join(`
7
+ `),truncated:a,streams:o}}var we=new Set([".xlsx",".xlsm",".docx",".pptx"]),se=8*1024*1024,kt=101010256,vt=33639248,xt=67324752;function F(e){let t=Math.min(e.length,67584),n=-1;for(let o=e.length-22;o>=e.length-t&&o>=0;o-=1)if(e.readUInt32LE(o)===kt){n=o;break}if(n<0)return null;let i=e.readUInt16LE(n+10),s=e.readUInt32LE(n+16);if(s>=e.length)return null;let r=[];for(let o=0;o<i&&!(s+46>e.length||e.readUInt32LE(s)!==vt);o+=1){let a=e.readUInt16LE(s+10),l=e.readUInt32LE(s+20),c=e.readUInt32LE(s+24),p=e.readUInt16LE(s+28),d=e.readUInt16LE(s+30),h=e.readUInt16LE(s+32),f=e.readUInt32LE(s+42),g=e.subarray(s+46,s+46+p).toString("utf8");r.push({name:g,method:a,compSize:l,uncompSize:c,localHeaderOffset:f}),s+=46+p+d+h}return r}function D(e,t){let n=t.localHeaderOffset;if(n+30>e.length||e.readUInt32LE(n)!==xt)return null;let i=e.readUInt16LE(n+26),s=e.readUInt16LE(n+28),r=n+30+i+s,o=r+t.compSize;if(o>e.length)return null;let a=e.subarray(r,o);try{if(t.method===0)return Buffer.from(a);if(t.method===8)return _t(a)}catch{return null}return null}function St(e,t){return D(e,t)?.toString("utf8")??null}var wt={"&amp;":"&","&lt;":"<","&gt;":">","&quot;":'"',"&apos;":"'"};function S(e){return e.replace(/&(amp|lt|gt|quot|apos);/g,t=>wt[t]??t).replace(/&#(\d+);/g,(t,n)=>{let i=Number(n);return i>0&&i<1114112?String.fromCodePoint(i):""}).replace(/&#x([0-9a-fA-F]+);/g,(t,n)=>{let i=parseInt(n,16);return i>0&&i<1114112?String.fromCodePoint(i):""})}function It(e){return S(e.replace(/<[^>]*>/g,`
8
8
  `)).replace(/\n{2,}/g,`
9
- `)}function wt(e,t,n){let i=new RegExp(`<${t}\\b[^>]*\\b${n}="([^"]*)"`,"g"),r=[],s;for(;(s=i.exec(e))!==null;)s[1]&&r.push(x(s[1]));return r}function It(e,t){let n=[];for(let i of t)(i==="docProps/core.xml"||i==="docProps/app.xml")&&n.push(i);if(e===".xlsx"||e===".xlsm")for(let i of t)(i==="xl/sharedStrings.xml"||i==="xl/workbook.xml"||/^xl\/worksheets\/sheet\d+\.xml$/.test(i)||/^xl\/comments\d*\.xml$/.test(i))&&n.push(i);else if(e===".docx")for(let i of t)(i==="word/document.xml"||/^word\/(header|footer|footnotes|endnotes|comments)\d*\.xml$/.test(i))&&n.push(i);else if(e===".pptx")for(let i of t)/^ppt\/(slides|notesSlides)\/(slide|notesSlide)\d+\.xml$/.test(i)&&n.push(i);return n}function Et(e,t){let n=L(e);if(!n||n.length===0)return null;let i=new Map(n.map(c=>[c.name,c])),r=It(t,n.map(c=>c.name));if(r.length===0)return null;let s=[],o=[],a=0,l=!1;for(let c of r){if(a>=ie){l=!0;break}let p=i.get(c);if(!p)continue;let d=kt(e,p);if(d===null)continue;let f=St(d);if(c==="xl/workbook.xml"){let h=wt(d,"sheet","name");h.length&&(f+=`
10
- `+h.join(`
11
- `))}a+f.length>ie&&(f=f.slice(0,Math.max(0,ie-a)),l=!0),f.trim().length!==0&&(s.push(f),o.push(c),a+=f.length)}return s.length===0?null:{text:s.join(`
12
- `),truncated:l,parts:o}}function H(e,t){if(xe.has(t))return Et(e,t);if(ne.has(t)){let n=ke(e);return n?{text:n.text,truncated:n.truncated,parts:[`pdf:${n.streams}-streams`]}:null}return null}var At=new Set([...xe,...ne]);import{deflateRawSync as Rt}from"node:zlib";var Se={israeli_id:"[ID]",credit_card:"[CARD]",iban:"[IBAN]",israeli_phone:"[PHONE]",email:"[EMAIL]"},$t=/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g,Tt=[...me].sort((e,t)=>+(t.subkind==="iban")-+(e.subkind==="iban"));function D(e,t,n=1){e[t]=(e[t]??0)+n}var we=null,N=e=>{let t=e.trim();we&&t&&we.add(t)};function k(e,t={}){let n=e;for(let i of Tt)i.pattern.lastIndex=0,n=n.replace(i.pattern,r=>i.validate(r)?(D(t,i.subkind),N(r),Se[i.subkind]??`[${i.subkind.toUpperCase()}]`):r);n=n.replace($t,i=>(D(t,"email"),N(i),Se.email));for(let i of Q()){let r=i.find(n).sort((s,o)=>o.start-s.start);for(let s of r)N(n.slice(s.start,s.end)),n=n.slice(0,s.start)+`[${i.kind.toUpperCase()}]`+n.slice(s.end),D(t,i.kind)}return{text:n,counts:t,columnsHidden:[]}}function re(){let e=new Map,t={};return(n,i)=>{N(i);let r=`${n}\0${i.trim()}`,s=e.get(r);return s===void 0&&(s=t[n]=(t[n]??0)+1,e.set(r,s)),`[${n.toUpperCase()}-${s}]`}}var Ee=/^\s*-?\d+(?:\.\d+)?\s*$/;function se(e){let t=new Set;for(let[n,i]of e){let r=i.filter(o=>Ee.test(o));if(r.length<3)continue;r.filter(o=>k(o).text!==o).length/r.length<.5&&t.add(n)}return t}function Ie(e,t){return e.includes(t)||e.includes('"')||e.includes(`
13
- `)?`"${e.replace(/"/g,'""')}"`:e}function Ct(e){let t=(e.match(/\t/g)??[]).length,n=(e.match(/;/g)??[]).length,i=(e.match(/,/g)??[]).length;return t>i&&t>=n?" ":n>i?";":","}function oe(e,t){let n=e.split(/\r?\n/),i=t??Ct(n[0]??""),r=P(n[0]??"",i),s=r.map(h=>$(h)),o={},a=re(),l=n.slice(1).map(h=>h===""?null:P(h,i)),c=new Map;for(let h of l)h?.forEach((m,u)=>c.set(u,[...c.get(u)??[],m]));let p=se(c),d=A();if(d){let h=l.filter(m=>m!==null).slice(0,200);for(let m of d({name:"table",headers:r,rows:h})){let u=r.indexOf(m.column);u>=0&&!(m.how==="header"&&p.has(u))&&(s[u]={type:m.type,label:m.category})}}let f=[r.map(h=>Ie(h,i)).join(i)];for(let h of l){if(h===null){f.push("");continue}let m=h.map((u,g)=>{let y=s[g];return y&&u.trim()!==""?(D(o,`column:${y.type}`),a(y.type,u)):p.has(g)&&Ee.test(u)?u:k(u,o).text});f.push(m.map(u=>Ie(u,i)).join(i))}return{text:f.join(`
14
- `),counts:o,columnsHidden:r.filter((h,m)=>s[m])}}var Pt=/^xl\/(pivotCache|charts|externalLinks)\//,Te=10;function Lt(e,t,n=1){e[t]=(e[t]??0)+n}function Ce(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function Re(e){let t=e.replace(/<rPh\b[\s\S]*?<\/rPh>/g,""),n="";for(let i of t.matchAll(/<t(?:\s[^>]*)?>([\s\S]*?)<\/t>/g))n+=i[1];return x(n)}function Ft(e){return e?[...e.matchAll(/<si\b[^>]*>([\s\S]*?)<\/si>|<si\b[^>]*\/>/g)].map(t=>Re(t[1]??"")):[]}var Pe=/<c\b([^>]*?)(?:\/>|>([\s\S]*?)<\/c>)/g;function z(e,t){let n=new RegExp(`\\b${t}="([^"]*)"`).exec(e);return n?n[1]:null}function S(e,t){if(e.type==="s"){let i=/<v>([^<]*)<\/v>/.exec(e.inner);return i?t[Number(i[1])]??null:null}if(e.type==="inlineStr"){let i=/<is>([\s\S]*?)<\/is>/.exec(e.inner);return i?Re(i[1]):null}if(e.type==="b"||e.type==="e")return null;let n=/<v>([^<]*)<\/v>/.exec(e.inner);return n?x(n[1]):null}function Ht(e){let t=[];for(let n of e.matchAll(Pe)){let i=z(n[1],"r"),r=i?/^([A-Z]+)(\d+)$/.exec(i):null;if(!r)return null;t.push({full:n[0],attrs:n[1],inner:n[2]??"",col:r[1],row:Number(r[2]),type:z(n[1],"t")??"n"})}return t}function Dt(e,t){let n=[...new Set(e.map(i=>i.row))].sort((i,r)=>i-r).slice(0,Te);for(let i of n){let r=new Map;for(let s of e.filter(o=>o.row===i)){let o=S(s,t),a=o?$(o):null;a&&r.set(s.col,{type:a.type,header:o.trim()})}if(r.size>0)return{row:i,cols:r}}return{row:-1,cols:new Map}}var Nt=/^xl\/worksheets\/sheet\d+\.xml$/,zt=200;function Mt(e){let t=e.trim();return/^[\d.,\-+/:%$₪€\s]+$/.test(t)||t.length>60}function Ot(e,t){let n=[...new Set(e.map(s=>s.row))].sort((s,o)=>s-o).slice(0,Te),i=-1,r=-1/0;for(let s of n){let o=e.filter(c=>c.row===s).map(c=>(S(c,t)??"").trim()).filter(Boolean);if(o.length<2)continue;let a=o.filter(c=>!Mt(c)).length,l=a*2-(o.length-a);l>r&&(r=l,i=s)}return i}function jt(e,t,n){let i=Dt(t,n),r=A();if(!r)return i;let s=i.row>=0?i.row:Ot(t,n);if(s<0)return i;let o=t.filter(d=>d.row===s).map(d=>({col:d.col,text:(S(d,n)??"").trim()})).filter(d=>d.text),a=new Map(o.map((d,f)=>[d.col,f])),l=new Map;for(let d of t){if(d.row<=s)continue;let f=a.get(d.col);if(f!==void 0){if(!l.has(d.row)){if(l.size>=zt)continue;l.set(d.row,o.map(()=>""))}l.get(d.row)[f]=S(d,n)??""}}let c=new Map(s===i.row?i.cols:[]),p=o.map(d=>d.text);for(let d of r({name:e,headers:p,rows:[...l.values()]})){let f=p.indexOf(d.column);f<0||c.set(o[f].col,{type:d.type,header:d.column,category:d.category,severity:d.severity,how:d.how})}return{row:s,cols:c}}function Ae(e,t){return`<c${e.replace(/\s*\bt="[^"]*"/,"")} t="inlineStr"><is><t xml:space="preserve">${Ce(t)}</t></is></c>`}var Bt=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t+=1){let n=t;for(let i=0;i<8;i+=1)n=n&1?3988292384^n>>>1:n>>>1;e[t]=n>>>0}return e})();function Ut(e){let t=4294967295;for(let n=0;n<e.length;n+=1)t=Bt[(t^e[n])&255]^t>>>8;return(t^4294967295)>>>0}var $e=33;function Le(e){let t=[],n=[],i=0;for(let o of e){let a=Buffer.from(o.name,"utf8"),l=o.name.endsWith("/"),c=l?Buffer.alloc(0):Rt(o.data),p=l?0:8,d=l?0:Ut(o.data),f=Buffer.alloc(30);f.writeUInt32LE(67324752,0),f.writeUInt16LE(20,4),f.writeUInt16LE(2048,6),f.writeUInt16LE(p,8),f.writeUInt16LE($e,12),f.writeUInt32LE(d,14),f.writeUInt32LE(c.length,18),f.writeUInt32LE(o.data.length,22),f.writeUInt16LE(a.length,26),t.push(f,a,c);let h=Buffer.alloc(46);h.writeUInt32LE(33639248,0),h.writeUInt16LE(20,4),h.writeUInt16LE(20,6),h.writeUInt16LE(2048,8),h.writeUInt16LE(p,10),h.writeUInt16LE($e,14),h.writeUInt32LE(d,16),h.writeUInt32LE(c.length,20),h.writeUInt32LE(o.data.length,24),h.writeUInt16LE(a.length,28),h.writeUInt32LE(i,42),n.push(h,a),i+=f.length+a.length+c.length}let r=Buffer.concat(n),s=Buffer.alloc(22);return s.writeUInt32LE(101010256,0),s.writeUInt16LE(e.length,8),s.writeUInt16LE(e.length,10),s.writeUInt32LE(r.length,12),s.writeUInt32LE(i,16),Buffer.concat([...t,r,s])}function ae(e){let t=L(e);if(!t||t.length===0||t.some(u=>Pt.test(u.name)))return null;let n=new Map;for(let u of t){if(u.name.endsWith("/")){n.set(u.name,Buffer.alloc(0));continue}let g=F(e,u);if(!g)return null;n.set(u.name,g)}let i=[...n.keys()].filter(u=>Nt.test(u));if(i.length===0)return null;let r=n.get("xl/sharedStrings.xml")?.toString("utf8")??null,s=Ft(r),o=new Set,a={},l=new Set,c=re();for(let u of i){let g=n.get(u).toString("utf8"),y=Ht(g);if(!y)return null;let V=jt(u.replace(/^xl\/worksheets\//,"").replace(/\.xml$/,""),y,s),T=V.row,w=new Map;for(let b of y){if(b.type!=="n"||b.row<=T)continue;let _=S(b,s);_!==null&&w.set(b.col,[...w.get(b.col)??[],_])}let C=se(w),R=new Map;for(let[b,{type:_,header:K,how:G}]of V.cols)G==="header"&&C.has(b)||(R.set(b,_),l.add(K));let et=g.replace(Pe,(b,_,K)=>{let G=z(_,"r"),[,X,tt]=/^([A-Z]+)(\d+)$/.exec(G),I={full:b,attrs:_,inner:K??"",col:X,row:Number(tt),type:z(_,"t")??"n"},E=S(I,s),J=()=>{if(I.type==="s"){let pe=/<v>([^<]*)<\/v>/.exec(I.inner);pe&&o.add(Number(pe[1]))}return b};if(E===null||E.trim()==="")return J();let q=R.get(X);if(q&&I.row>T)return Lt(a,`column:${q}`),Ae(_,c(q,E));if(I.type==="n"&&C.has(X))return J();let de=k(E,a);return de.text===E?J():Ae(_,de.text)});n.set(u,Buffer.from(et,"utf8"))}if(r){let u=-1,g=r.replace(/<si\b[^>]*>[\s\S]*?<\/si>|<si\b[^>]*\/>/g,y=>(u+=1,o.has(u)?y:"<si><t></t></si>"));n.set("xl/sharedStrings.xml",Buffer.from(g,"utf8"))}for(let u of[...n.keys()].filter(g=>/^xl\/comments\d*\.xml$/.test(g))){let y=n.get(u).toString("utf8").replace(/(<t(?:\s[^>]*)?>)([\s\S]*?)(<\/t>)/g,(V,T,w,C)=>{let R=k(x(w),a);return`${T}${Ce(R.text)}${C}`});n.set(u,Buffer.from(y,"utf8"))}let p=n.get("docProps/core.xml");if(p){let u=p.toString("utf8").replace(/(<dc:creator>)[\s\S]*?(<\/dc:creator>)/,"$1$2").replace(/(<cp:lastModifiedBy>)[\s\S]*?(<\/cp:lastModifiedBy>)/,"$1$2");n.set("docProps/core.xml",Buffer.from(u,"utf8"))}let d=n.get("xl/workbook.xml");if(d){let u=d.toString("utf8").replace(/<(\w+:)?absPath\b[^>]*\/>|<(\w+:)?absPath\b[^>]*>[\s\S]*?<\/(\w+:)?absPath>/g,"");n.set("xl/workbook.xml",Buffer.from(u,"utf8"))}let f=n.get("docProps/app.xml");if(f){let u=f.toString("utf8").replace(/(<Company>)[\s\S]*?(<\/Company>)/,"$1$2").replace(/(<Manager>)[\s\S]*?(<\/Manager>)/,"$1$2");n.set("docProps/app.xml",Buffer.from(u,"utf8"))}let h=n.has("xl/calcChain.xml"),m=t.map(u=>u.name).filter(u=>!(h&&u==="xl/calcChain.xml"));if(h)for(let u of["[Content_Types].xml","xl/_rels/workbook.xml.rels"]){let g=n.get(u);g&&n.set(u,Buffer.from(g.toString("utf8").replace(/<(Override|Relationship)\b[^>]*calcChain[^>]*\/>/g,""),"utf8"))}return{bytes:Le(m.map(u=>({name:u,data:n.get(u)}))),counts:a,columnsHidden:[...l]}}var ci=64*1024*1024,li=32*1024;function Fe(e){return/\.ndc$/i.test(e)||/\.clean\.[A-Za-z0-9]+$/.test(e)}import{existsSync as Vt,mkdirSync as Ni,readFileSync as Kt,writeFileSync as zi}from"node:fs";import{homedir as Gt}from"node:os";import{join as Xt}from"node:path";var He=()=>Xt(Gt(),".nodata","prefs.json");function Jt(){try{let e=Vt(He())?JSON.parse(Kt(He(),"utf8")).lang:null;return e==="he"||e==="en"?e:null}catch{return null}}function qt(){let t=process.env.LC_ALL||process.env.LC_MESSAGES||process.env.LANG||"";try{t||=Intl.DateTimeFormat().resolvedOptions().locale}catch{}return/^(he|iw)(?:[-_.@]|$)/i.test(t)?"he":"en"}function M(){return Jt()??qt()}function De(e,t,n=M()){return n==="he"?e:t}var on=new Set([".csv",".tsv",".txt",".md",".json",".log",".xml",".sql",".yaml",".yml",".xlsx",".xlsm",".docx",".pptx",".pdf"]),an=50*1024*1024,cn=8,ln={israeli_id:"Israeli ID",credit_card:"card",iban:"IBAN",israeli_phone:"phone",email:"email",secret:"secret"};function je(e){let t=nn(e).toLowerCase();return on.has(Oe(t))||t===".env"||t.startsWith(".env.")}function dn(e){let t=Oe(e).toLowerCase(),n=tn(e),i,r;if(t===".csv"||t===".tsv")r=n.toString("utf8"),i=oe(r,t===".tsv"?" ":void 0).counts;else if(t===".xlsx"||t===".xlsm"||t===".docx"||t===".pptx"||t===".pdf"){let o=t===".xlsx"||t===".xlsm"?ae(n):null;r=H(n,t)?.text??"",i=o?o.counts:k(r).counts}else r=n.toString("utf8"),i=k(r).counts;let s=fe.filter(o=>o.pattern.test(r)).length;return s&&(i.secret=(i.secret??0)+s),i}var pn={israeli_id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",credit_card:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9",iban:"IBAN",israeli_phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",email:'\u05D3\u05D5\u05D0"\u05DC',secret:"\u05E1\u05D5\u05D3",name:"\u05E9\u05DD",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",financial:"\u05DE\u05D9\u05D3\u05E2 \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",bank_account:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7",plate:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"};function un(e){let t=M()==="he",n=i=>(t?pn[i]:ln[i])??i;return Object.entries(e).sort((i,r)=>r[1]-i[1]).map(([i,r])=>`${r} ${i.startsWith("column:")?`${n(i.slice(7))} (${t?"\u05E2\u05DE\u05D5\u05D3\u05D4":"column"})`:n(i)}`).join(", ")}function fn(e,t,n){let i=s=>rn(s)?s:sn(n,s),r=s=>{try{return ze(s).isFile()}catch{return!1}};if(e==="Read"&&typeof t.file_path=="string")return[i(t.file_path)];if(e==="Grep"&&typeof t.path=="string"&&r(i(t.path)))return[i(t.path)];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"){let s=t.command,o=[...[...s.matchAll(/"([^"]*)"/g)].map(l=>l[1]),...[...s.matchAll(/'([^']*)'/g)].map(l=>l[1]),...s.split(/[\s|;&<>(),=`]+/)],a=[];for(let l of o){let c=l.trim().replace(/^['"]|['"]$/g,"").replace(/\\\\/g,"\\").replace(/^~(?=[\\/])/,Me()).replace(/^\/([a-zA-Z])\//,(d,f)=>process.platform==="win32"?`${f}:/`:d);if(!c||!je(c))continue;let p=i(c);if(r(p)&&!a.includes(p)&&a.push(p),a.length>=cn)break}return a}return[]}function ce(e){return e.replace(/\\+/g,"/")}function Be(e,t,n){let i=[];for(let r of fn(e,t,n)){if(!je(r)||Fe(r)||!Qt(r))continue;let s;try{if(ze(r).size>an)s=`${ce(r)}: too large to check here (over 50 MB)`;else{let o=dn(r);if(Object.keys(o).length===0)continue;s=`${ce(r)}: ${un(o)}`}}catch{s=`${ce(r)}: could not be checked`}i.push(s)}return i}function hn(e,t,n,i){let r=Be(e,t,n);if(r.length===0)return{decision:"allow"};let s=De(`NoData \u05E1\u05E8\u05E7 \u05D0\u05EA \u05D6\u05D4 \u05D1\u05DE\u05D7\u05E9\u05D1 \u05E9\u05DC\u05DA \u05DC\u05E4\u05E0\u05D9 \u05E9\u05D4\u05E2\u05D5\u05D6\u05E8 \u05E7\u05D5\u05E8\u05D0:
15
- ${r.join(`
9
+ `)}function Et(e,t,n){let i=new RegExp(`<${t}\\b[^>]*\\b${n}="([^"]*)"`,"g"),s=[],r;for(;(r=i.exec(e))!==null;)r[1]&&s.push(S(r[1]));return s}function At(e,t){let n=[];for(let i of t)(i==="docProps/core.xml"||i==="docProps/app.xml")&&n.push(i);if(e===".xlsx"||e===".xlsm")for(let i of t)(i==="xl/sharedStrings.xml"||i==="xl/workbook.xml"||/^xl\/worksheets\/sheet\d+\.xml$/.test(i)||/^xl\/comments\d*\.xml$/.test(i))&&n.push(i);else if(e===".docx")for(let i of t)(i==="word/document.xml"||/^word\/(header|footer|footnotes|endnotes|comments)\d*\.xml$/.test(i))&&n.push(i);else if(e===".pptx")for(let i of t)/^ppt\/(slides|notesSlides)\/(slide|notesSlide)\d+\.xml$/.test(i)&&n.push(i);return n}function $t(e,t){let n=F(e);if(!n||n.length===0)return null;let i=new Map(n.map(c=>[c.name,c])),s=At(t,n.map(c=>c.name));if(s.length===0)return null;let r=[],o=[],a=0,l=!1;for(let c of s){if(a>=se){l=!0;break}let p=i.get(c);if(!p)continue;let d=St(e,p);if(d===null)continue;let h=It(d);if(c==="xl/workbook.xml"){let f=Et(d,"sheet","name");f.length&&(h+=`
10
+ `+f.join(`
11
+ `))}a+h.length>se&&(h=h.slice(0,Math.max(0,se-a)),l=!0),h.trim().length!==0&&(r.push(h),o.push(c),a+=h.length)}return r.length===0?null:{text:r.join(`
12
+ `),truncated:l,parts:o}}function H(e,t){if(we.has(t))return $t(e,t);if(ie.has(t)){let n=Se(e);return n?{text:n.text,truncated:n.truncated,parts:[`pdf:${n.streams}-streams`]}:null}return null}var Tt=new Set([...we,...ie]);import{deflateRawSync as Lt}from"node:zlib";var Ie={israeli_id:"[ID]",credit_card:"[CARD]",iban:"[IBAN]",israeli_phone:"[PHONE]",email:"[EMAIL]"},Ct=/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g,Rt=[...ye].sort((e,t)=>+(t.subkind==="iban")-+(e.subkind==="iban"));function N(e,t,n=1){e[t]=(e[t]??0)+n}var Ee=null,O=e=>{let t=e.trim();Ee&&t&&Ee.add(t)};function x(e,t={}){let n=e;for(let i of Rt)i.pattern.lastIndex=0,n=n.replace(i.pattern,s=>i.validate(s)?(N(t,i.subkind),O(s),Ie[i.subkind]??`[${i.subkind.toUpperCase()}]`):s);n=n.replace(Ct,i=>(N(t,"email"),O(i),Ie.email));for(let i of ee()){let s=i.find(n).sort((r,o)=>o.start-r.start);for(let r of s)O(n.slice(r.start,r.end)),n=n.slice(0,r.start)+`[${i.kind.toUpperCase()}]`+n.slice(r.end),N(t,i.kind)}return{text:n,counts:t,columnsHidden:[]}}function re(){let e=new Map,t={};return(n,i)=>{O(i);let s=`${n}\0${i.trim()}`,r=e.get(s);return r===void 0&&(r=t[n]=(t[n]??0)+1,e.set(s,r)),`[${n.toUpperCase()}-${r}]`}}function oe(e){let t=e.trim();return/^\[[A-Z_]+(?:-\d+)?\]$/.test(t)||/^[\d]{0,4}[*•xX]{3,}[\d]{0,4}$/.test(t)}var $e=/^\s*-?\d+(?:\.\d+)?\s*$/;function ae(e){let t=new Set;for(let[n,i]of e){let s=i.filter(o=>$e.test(o));if(s.length<3)continue;s.filter(o=>x(o).text!==o).length/s.length<.5&&t.add(n)}return t}function Ae(e,t){return e.includes(t)||e.includes('"')||e.includes(`
13
+ `)?`"${e.replace(/"/g,'""')}"`:e}function Pt(e){let t=(e.match(/\t/g)??[]).length,n=(e.match(/;/g)??[]).length,i=(e.match(/,/g)??[]).length;return t>i&&t>=n?" ":n>i?";":","}function ce(e,t){let n=e.split(/\r?\n/),i=t??Pt(n[0]??""),s=L(n[0]??"",i),r=s.map(f=>T(f)),o={},a=re(),l=n.slice(1).map(f=>f===""?null:L(f,i)),c=new Map;for(let f of l)f?.forEach((g,u)=>c.set(u,[...c.get(u)??[],g]));let p=ae(c),d=$();if(d){let f=l.filter(g=>g!==null).slice(0,200);for(let g of d({name:"table",headers:s,rows:f})){let u=s.indexOf(g.column);u>=0&&!(g.how==="header"&&p.has(u))&&(r[u]={type:g.type,label:g.category})}}let h=[s.map(f=>Ae(f,i)).join(i)];for(let f of l){if(f===null){h.push("");continue}let g=f.map((u,y)=>{let b=r[y];return b&&u.trim()!==""&&!oe(u)?(N(o,`column:${b.type}`),a(b.type,u)):p.has(y)&&$e.test(u)?u:x(u,o).text});h.push(g.map(u=>Ae(u,i)).join(i))}return{text:h.join(`
14
+ `),counts:o,columnsHidden:s.filter((f,g)=>r[g])}}var Ft=/^xl\/(pivotCache|charts|externalLinks)\//,Re=10;function Dt(e,t,n=1){e[t]=(e[t]??0)+n}function Pe(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function Le(e){let t=e.replace(/<rPh\b[\s\S]*?<\/rPh>/g,""),n="";for(let i of t.matchAll(/<t(?:\s[^>]*)?>([\s\S]*?)<\/t>/g))n+=i[1];return S(n)}function Ht(e){return e?[...e.matchAll(/<si\b[^>]*>([\s\S]*?)<\/si>|<si\b[^>]*\/>/g)].map(t=>Le(t[1]??"")):[]}var Fe=/<c\b([^>]*?)(?:\/>|>([\s\S]*?)<\/c>)/g;function z(e,t){let n=new RegExp(`\\b${t}="([^"]*)"`).exec(e);return n?n[1]:null}function I(e,t){if(e.type==="s"){let i=/<v>([^<]*)<\/v>/.exec(e.inner);return i?t[Number(i[1])]??null:null}if(e.type==="inlineStr"){let i=/<is>([\s\S]*?)<\/is>/.exec(e.inner);return i?Le(i[1]):null}if(e.type==="b"||e.type==="e")return null;let n=/<v>([^<]*)<\/v>/.exec(e.inner);return n?S(n[1]):null}function Nt(e){let t=[];for(let n of e.matchAll(Fe)){let i=z(n[1],"r"),s=i?/^([A-Z]+)(\d+)$/.exec(i):null;if(!s)return null;t.push({full:n[0],attrs:n[1],inner:n[2]??"",col:s[1],row:Number(s[2]),type:z(n[1],"t")??"n"})}return t}function Ot(e,t){let n=[...new Set(e.map(i=>i.row))].sort((i,s)=>i-s).slice(0,Re);for(let i of n){let s=new Map;for(let r of e.filter(o=>o.row===i)){let o=I(r,t),a=o?T(o):null;a&&s.set(r.col,{type:a.type,header:o.trim()})}if(s.size>0)return{row:i,cols:s}}return{row:-1,cols:new Map}}var zt=/^xl\/worksheets\/sheet\d+\.xml$/,Mt=200;function jt(e){let t=e.trim();return/^[\d.,\-+/:%$₪€\s]+$/.test(t)||t.length>60}function Bt(e,t){let n=[...new Set(e.map(r=>r.row))].sort((r,o)=>r-o).slice(0,Re),i=-1,s=-1/0;for(let r of n){let o=e.filter(c=>c.row===r).map(c=>(I(c,t)??"").trim()).filter(Boolean);if(o.length<2)continue;let a=o.filter(c=>!jt(c)).length,l=a*2-(o.length-a);l>s&&(s=l,i=r)}return i}function Ut(e,t,n){let i=Ot(t,n),s=$();if(!s)return i;let r=i.row>=0?i.row:Bt(t,n);if(r<0)return i;let o=t.filter(d=>d.row===r).map(d=>({col:d.col,text:(I(d,n)??"").trim()})).filter(d=>d.text),a=new Map(o.map((d,h)=>[d.col,h])),l=new Map;for(let d of t){if(d.row<=r)continue;let h=a.get(d.col);if(h!==void 0){if(!l.has(d.row)){if(l.size>=Mt)continue;l.set(d.row,o.map(()=>""))}l.get(d.row)[h]=I(d,n)??""}}let c=new Map(r===i.row?i.cols:[]),p=o.map(d=>d.text);for(let d of s({name:e,headers:p,rows:[...l.values()]})){let h=p.indexOf(d.column);h<0||c.set(o[h].col,{type:d.type,header:d.column,category:d.category,severity:d.severity,how:d.how})}return{row:r,cols:c}}function Te(e,t){return`<c${e.replace(/\s*\bt="[^"]*"/,"")} t="inlineStr"><is><t xml:space="preserve">${Pe(t)}</t></is></c>`}var Wt=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t+=1){let n=t;for(let i=0;i<8;i+=1)n=n&1?3988292384^n>>>1:n>>>1;e[t]=n>>>0}return e})();function Zt(e){let t=4294967295;for(let n=0;n<e.length;n+=1)t=Wt[(t^e[n])&255]^t>>>8;return(t^4294967295)>>>0}var Ce=33;function De(e){let t=[],n=[],i=0;for(let o of e){let a=Buffer.from(o.name,"utf8"),l=o.name.endsWith("/"),c=l?Buffer.alloc(0):Lt(o.data),p=l?0:8,d=l?0:Zt(o.data),h=Buffer.alloc(30);h.writeUInt32LE(67324752,0),h.writeUInt16LE(20,4),h.writeUInt16LE(2048,6),h.writeUInt16LE(p,8),h.writeUInt16LE(Ce,12),h.writeUInt32LE(d,14),h.writeUInt32LE(c.length,18),h.writeUInt32LE(o.data.length,22),h.writeUInt16LE(a.length,26),t.push(h,a,c);let f=Buffer.alloc(46);f.writeUInt32LE(33639248,0),f.writeUInt16LE(20,4),f.writeUInt16LE(20,6),f.writeUInt16LE(2048,8),f.writeUInt16LE(p,10),f.writeUInt16LE(Ce,14),f.writeUInt32LE(d,16),f.writeUInt32LE(c.length,20),f.writeUInt32LE(o.data.length,24),f.writeUInt16LE(a.length,28),f.writeUInt32LE(i,42),n.push(f,a),i+=h.length+a.length+c.length}let s=Buffer.concat(n),r=Buffer.alloc(22);return r.writeUInt32LE(101010256,0),r.writeUInt16LE(e.length,8),r.writeUInt16LE(e.length,10),r.writeUInt32LE(s.length,12),r.writeUInt32LE(i,16),Buffer.concat([...t,s,r])}function le(e){let t=F(e);if(!t||t.length===0||t.some(u=>Ft.test(u.name)))return null;let n=new Map;for(let u of t){if(u.name.endsWith("/")){n.set(u.name,Buffer.alloc(0));continue}let y=D(e,u);if(!y)return null;n.set(u.name,y)}let i=[...n.keys()].filter(u=>zt.test(u));if(i.length===0)return null;let s=n.get("xl/sharedStrings.xml")?.toString("utf8")??null,r=Ht(s),o=new Set,a={},l=new Set,c=re();for(let u of i){let y=n.get(u).toString("utf8"),b=Nt(y);if(!b)return null;let V=Ut(u.replace(/^xl\/worksheets\//,"").replace(/\.xml$/,""),b,r),C=V.row,E=new Map;for(let _ of b){if(_.type!=="n"||_.row<=C)continue;let k=I(_,r);k!==null&&E.set(_.col,[...E.get(_.col)??[],k])}let R=ae(E),P=new Map;for(let[_,{type:k,header:G,how:X}]of V.cols)X==="header"&&R.has(_)||(P.set(_,k),l.add(G));let nt=y.replace(Fe,(_,k,G)=>{let X=z(k,"r"),[,J,it]=/^([A-Z]+)(\d+)$/.exec(X),A={full:_,attrs:k,inner:G??"",col:J,row:Number(it),type:z(k,"t")??"n"},w=I(A,r),q=()=>{if(A.type==="s"){let he=/<v>([^<]*)<\/v>/.exec(A.inner);he&&o.add(Number(he[1]))}return _};if(w===null||w.trim()==="")return q();let Y=P.get(J);if(Y&&A.row>C&&!oe(w))return Dt(a,`column:${Y}`),Te(k,c(Y,w));if(A.type==="n"&&R.has(J))return q();let ue=x(w,a);return ue.text===w?q():Te(k,ue.text)});n.set(u,Buffer.from(nt,"utf8"))}if(s){let u=-1,y=s.replace(/<si\b[^>]*>[\s\S]*?<\/si>|<si\b[^>]*\/>/g,b=>(u+=1,o.has(u)?b:"<si><t></t></si>"));n.set("xl/sharedStrings.xml",Buffer.from(y,"utf8"))}for(let u of[...n.keys()].filter(y=>/^xl\/comments\d*\.xml$/.test(y))){let b=n.get(u).toString("utf8").replace(/(<t(?:\s[^>]*)?>)([\s\S]*?)(<\/t>)/g,(V,C,E,R)=>{let P=x(S(E),a);return`${C}${Pe(P.text)}${R}`});n.set(u,Buffer.from(b,"utf8"))}let p=n.get("docProps/core.xml");if(p){let u=p.toString("utf8").replace(/(<dc:creator>)[\s\S]*?(<\/dc:creator>)/,"$1$2").replace(/(<cp:lastModifiedBy>)[\s\S]*?(<\/cp:lastModifiedBy>)/,"$1$2");n.set("docProps/core.xml",Buffer.from(u,"utf8"))}let d=n.get("xl/workbook.xml");if(d){let u=d.toString("utf8").replace(/<(\w+:)?absPath\b[^>]*\/>|<(\w+:)?absPath\b[^>]*>[\s\S]*?<\/(\w+:)?absPath>/g,"");n.set("xl/workbook.xml",Buffer.from(u,"utf8"))}let h=n.get("docProps/app.xml");if(h){let u=h.toString("utf8").replace(/(<Company>)[\s\S]*?(<\/Company>)/,"$1$2").replace(/(<Manager>)[\s\S]*?(<\/Manager>)/,"$1$2");n.set("docProps/app.xml",Buffer.from(u,"utf8"))}let f=n.has("xl/calcChain.xml"),g=t.map(u=>u.name).filter(u=>!(f&&u==="xl/calcChain.xml"));if(f)for(let u of["[Content_Types].xml","xl/_rels/workbook.xml.rels"]){let y=n.get(u);y&&n.set(u,Buffer.from(y.toString("utf8").replace(/<(Override|Relationship)\b[^>]*calcChain[^>]*\/>/g,""),"utf8"))}return{bytes:De(g.map(u=>({name:u,data:n.get(u)}))),counts:a,columnsHidden:[...l]}}var _i=64*1024*1024,ki=32*1024;var vi=new Set([".cache",".cargo",".rustup",".npm",".pnpm-store",".yarn",".gradle",".m2",".nuget",".conda",".pyenv",".rbenv",".nvm",".volta",".bun",".deno",".docker",".android",".vscode-server",".agents",".agent",".codeium",".continue","antigravity",".antigravity","__pycache__",".venv","venv","site-packages",".next",".turbo",".expo",".nx",".parcel-cache",".svelte-kit","appdata",".trash","$recycle.bin"].map(e=>e.toLowerCase()));var Gt=["Put the new key where the app reads it (for a developer machine: the NoData vault + nodata_run, not a .env file).","Check that the app still works with the new key.","Only then delete / revoke the OLD key \u2014 until you do, whoever copied it can still use it."],m=(e,t,n)=>({provider:e,url:t,steps:[...n,...Gt]}),Ti={"aws-access-key":m("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault)."]),"aws-secret-key":m("AWS","https://console.aws.amazon.com/iam/home#/security_credentials",["Open IAM \u2192 your user \u2192 Security credentials.","Create a NEW access key (you see its secret once \u2014 keep it only in the vault).","Mark the old key Inactive before deleting it."]),"gcp-api-key":m("Google Cloud","https://console.cloud.google.com/apis/credentials",["Open APIs & Services \u2192 Credentials.","Pick the key \u2192 Regenerate key (or create a new one and restrict it to the APIs you use)."]),"gcp-service-account":m("Google Cloud (service account)","https://console.cloud.google.com/iam-admin/serviceaccounts",["Open IAM & Admin \u2192 Service accounts \u2192 the account \u2192 Keys.","Add key \u2192 Create new key (JSON). Keep the file out of Git and out of shared folders."]),"firebase-key":m("Firebase / Google Cloud","https://console.cloud.google.com/apis/credentials",["A Firebase web key is meant to be public \u2014 restrict it instead: Credentials \u2192 the key \u2192 Application restrictions (your domains only).","If it is not a web key, regenerate it."]),"github-token":m("GitHub","https://github.com/settings/tokens",["Open Settings \u2192 Developer settings \u2192 Personal access tokens.","Generate a new token with only the scopes you need."]),"github-fine-grained":m("GitHub","https://github.com/settings/tokens?type=beta",["Open Fine-grained tokens.","Regenerate the token (or create a new one for only the repositories you need)."]),"gitlab-token":m("GitLab","https://gitlab.com/-/user_settings/personal_access_tokens",["Open Access tokens.","Create a new token with only the scopes you need."]),"stripe-secret":m("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys.","Roll the secret key (Stripe can keep the old one alive for a short overlap)."]),"stripe-restricted":m("Stripe","https://dashboard.stripe.com/apikeys",["Open Developers \u2192 API keys \u2192 Restricted keys.","Roll the key, or create a new restricted key."]),"slack-token":m("Slack","https://api.slack.com/apps",["Open your app \u2192 OAuth & Permissions.","Rotate / reinstall to get a new token."]),"slack-webhook":m("Slack","https://api.slack.com/apps",["Open your app \u2192 Incoming Webhooks.","Add a new webhook URL for the channel."]),"twilio-api-key":m("Twilio","https://console.twilio.com/us1/account/keys-credentials/api-keys",["Open Account \u2192 API keys & tokens.","Create a new API key."]),"sendgrid-api-key":m("SendGrid","https://app.sendgrid.com/settings/api_keys",["Open Settings \u2192 API Keys.","Create a new key with only the permissions you need."]),"openai-key":m("OpenAI","https://platform.openai.com/api-keys",["Open API keys.","Create a new secret key."]),"anthropic-key":m("Anthropic","https://console.anthropic.com/settings/keys",["Open Settings \u2192 API keys.","Create a new key."]),"supabase-key":m("Supabase","https://supabase.com/dashboard/project/_/settings/api-keys",["Open the project \u2192 Project Settings \u2192 API Keys.","Create a new SECRET key (a service_role / secret key bypasses every database rule \u2014 treat it like a root password).","Older projects with JWT keys: rotating the JWT secret replaces every key and signs everyone out \u2014 plan it."]),"postgres-uri":m("PostgreSQL (the password in the connection string)","https://supabase.com/dashboard/project/_/settings/database",["Change the database user's password: in Supabase \u2192 Project Settings \u2192 Database \u2192 Reset password; elsewhere, your host's console or ALTER USER \u2026 WITH PASSWORD.","Update the connection string with the new password."]),"mongodb-uri":m("MongoDB","https://cloud.mongodb.com/",["Open Atlas \u2192 Database Access \u2192 the user \u2192 Edit \u2192 Edit password.","Update the connection string."]),"redis-uri":m("Redis","",["Reset the password in your Redis host's console (or CONFIG SET requirepass on your own server).","Update the connection string."]),"private-key":m("Private key (SSH / TLS / signing)","",["Generate a new key pair.","Register the new PUBLIC key where the old one was trusted (server authorized_keys, certificate, service settings)."]),"jwt-secret":m("Your app's JWT secret","",["Set a new long random secret in the app's configuration.","Every signed-in user will be signed out \u2014 plan the moment."]),"password-in-code":m("A password in code","",["Change the password in the system it belongs to."]),"bearer-token":m("An access token","",["Revoke the token in the service that issued it and issue a new one."])},Ci=m("A credential","",["Find the service it belongs to and issue a new credential there."]);function He(e){return/\.ndc$/i.test(e)||/\.clean\.[A-Za-z0-9]+$/.test(e)}import{existsSync as Xt,mkdirSync as ts,readFileSync as Jt,writeFileSync as ns}from"node:fs";import{homedir as qt}from"node:os";import{join as Yt}from"node:path";var Ne=()=>Yt(qt(),".nodata","prefs.json");function Qt(){try{let e=Xt(Ne())?JSON.parse(Jt(Ne(),"utf8")).lang:null;return e==="he"||e==="en"?e:null}catch{return null}}function en(){let t=process.env.LC_ALL||process.env.LC_MESSAGES||process.env.LANG||"";try{t||=Intl.DateTimeFormat().resolvedOptions().locale}catch{}return/^(he|iw)(?:[-_.@]|$)/i.test(t)?"he":"en"}function M(){return Qt()??en()}function Oe(e,t,n=M()){return n==="he"?e:t}var ln=new Set([".csv",".tsv",".txt",".md",".json",".log",".xml",".sql",".yaml",".yml",".xlsx",".xlsm",".docx",".pptx",".pdf"]),dn=50*1024*1024,pn=8,un={israeli_id:"Israeli ID",credit_card:"card",iban:"IBAN",israeli_phone:"phone",email:"email",secret:"secret"};function Ue(e){let t=on(e).toLowerCase();return ln.has(Be(t))||t===".env"||t.startsWith(".env.")}function hn(e){let t=Be(e).toLowerCase(),n=rn(e),i,s;if(t===".csv"||t===".tsv")s=n.toString("utf8"),i=ce(s,t===".tsv"?" ":void 0).counts;else if(t===".xlsx"||t===".xlsm"||t===".docx"||t===".pptx"||t===".pdf"){let o=t===".xlsx"||t===".xlsm"?le(n):null;s=H(n,t)?.text??"",i=o?o.counts:x(s).counts}else s=n.toString("utf8"),i=x(s).counts;let r=me.filter(o=>o.pattern.test(s)).length;return r&&(i.secret=(i.secret??0)+r),i}var fn={israeli_id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",credit_card:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9",iban:"IBAN",israeli_phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",phone:"\u05D8\u05DC\u05E4\u05D5\u05DF",email:'\u05D3\u05D5\u05D0"\u05DC',secret:"\u05E1\u05D5\u05D3",name:"\u05E9\u05DD",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",financial:"\u05DE\u05D9\u05D3\u05E2 \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",bank_account:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7",plate:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"};function mn(e){let t=M()==="he",n=i=>(t?fn[i]:un[i])??i;return Object.entries(e).sort((i,s)=>s[1]-i[1]).map(([i,s])=>`${s} ${i.startsWith("column:")?`${n(i.slice(7))} (${t?"\u05E2\u05DE\u05D5\u05D3\u05D4":"column"})`:n(i)}`).join(", ")}function gn(e,t,n){let i=r=>an(r)?r:cn(n,r),s=r=>{try{return Me(r).isFile()}catch{return!1}};if(e==="Read"&&typeof t.file_path=="string")return[i(t.file_path)];if(e==="Grep"&&typeof t.path=="string"&&s(i(t.path)))return[i(t.path)];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"){let r=t.command,o=[...[...r.matchAll(/"([^"]*)"/g)].map(l=>l[1]),...[...r.matchAll(/'([^']*)'/g)].map(l=>l[1]),...r.split(/[\s|;&<>(),=`]+/)],a=[];for(let l of o){let c=l.trim().replace(/^['"]|['"]$/g,"").replace(/\\\\/g,"\\").replace(/^~(?=[\\/])/,je()).replace(/^\/([a-zA-Z])\//,(d,h)=>process.platform==="win32"?`${h}:/`:d);if(!c||!Ue(c))continue;let p=i(c);if(s(p)&&!a.includes(p)&&a.push(p),a.length>=pn)break}return a}return[]}function de(e){return e.replace(/\\+/g,"/")}function yn(e){let t=e.trim();return/[;|&\n]|`|\$\(/.test(t.replace(/^cmd(?:\.exe)?\s+\/c\s+/i,""))?!1:/^(?:cmd(?:\.exe)?\s+\/c\s+)?(?:explorer(?:\.exe)?|start|invoke-item|ii|start-process|open|xdg-open)\b/i.test(t)}function We(e,t,n){let i=[];if((e==="Bash"||e==="PowerShell")&&typeof t.command=="string"&&yn(t.command))return i;for(let s of gn(e,t,n)){if(!Ue(s)||He(s)||!nn(s))continue;let r;try{if(Me(s).size>dn)r=`${de(s)}: too large to check here (over 50 MB)`;else{let o=hn(s);if(Object.keys(o).length===0)continue;r=`${de(s)}: ${mn(o)}`}}catch{r=`${de(s)}: could not be checked`}i.push(r)}return i}function bn(e,t,n,i){let s=We(e,t,n);if(s.length===0)return{decision:"allow"};let r=Oe(`NoData \u05E1\u05E8\u05E7 \u05D0\u05EA \u05D4\u05E7\u05D5\u05D1\u05E5 \u05D1\u05DE\u05D7\u05E9\u05D1 \u05E9\u05DC\u05DA \u2014 \u05E9\u05D5\u05DD \u05D3\u05D1\u05E8 \u05DC\u05D0 \u05D9\u05E6\u05D0:
15
+ ${s.join(`
16
16
  `)}
17
- \u05E7\u05E8\u05D9\u05D0\u05D4 \u05EA\u05E6\u05D9\u05D2 \u05D0\u05EA \u05D4\u05E2\u05E8\u05DB\u05D9\u05DD \u05D4\u05D0\u05DC\u05D4 \u05DC\u05D1\u05D9\u05E0\u05D4 \u05D4\u05DE\u05DC\u05D0\u05DB\u05D5\u05EA\u05D9\u05EA. \u05D1\u05D8\u05D5\u05D7 \u05D9\u05D5\u05EA\u05E8: nodata_redact (\u05E2\u05D5\u05EA\u05E7 \u05E0\u05E7\u05D9 \u05DC\u05E2\u05D1\u05D5\u05D3\u05D4) \u05D0\u05D5 nodata_protect (\u05E0\u05E2\u05D9\u05DC\u05D4).`+(i?"":" \u05DC\u05D0\u05E9\u05E8 \u05D0\u05EA \u05D4\u05E7\u05E8\u05D9\u05D0\u05D4 \u05D1\u05DB\u05DC \u05D6\u05D0\u05EA?"),`NoData scanned this on your machine before the assistant reads it:
18
- ${r.join(`
17
+ `+(i?"\u05D4\u05E7\u05E8\u05D9\u05D0\u05D4 \u05E0\u05D7\u05E1\u05DE\u05D4: Claude \u05DC\u05D0 \u05D9\u05E7\u05E8\u05D0 \u05D0\u05EA \u05D4\u05DE\u05E7\u05D5\u05E8. \u05D1\u05DE\u05E7\u05D5\u05DD \u05D6\u05D4: nodata_redact (\u05E2\u05D5\u05EA\u05E7 \u05E0\u05E7\u05D9 \u05DC\u05E2\u05D1\u05D5\u05D3\u05D4) \u05D0\u05D5 nodata_protect (\u05E0\u05E2\u05D9\u05DC\u05D4).":"\u05D0\u05DD \u05EA\u05D0\u05E9\u05E8, Claude \u05D9\u05E7\u05E8\u05D0 \u05D0\u05EA \u05D4\u05E7\u05D5\u05D1\u05E5 \u05E2\u05E6\u05DE\u05D5 \u05D5\u05D4\u05EA\u05D5\u05DB\u05DF \u05D9\u05D9\u05E9\u05DC\u05D7 \u05DC\u05DE\u05D5\u05D3\u05DC \u05D4\u05D1\u05D9\u05E0\u05D4 \u05D4\u05DE\u05DC\u05D0\u05DB\u05D5\u05EA\u05D9\u05EA. \u05D1\u05DE\u05E7\u05D5\u05DD \u05D6\u05D4: nodata_redact (\u05E2\u05D5\u05EA\u05E7 \u05E0\u05E7\u05D9 \u05DC\u05E2\u05D1\u05D5\u05D3\u05D4) \u05D0\u05D5 nodata_protect (\u05E0\u05E2\u05D9\u05DC\u05D4). \u05DC\u05D0\u05E9\u05E8 \u05D1\u05DB\u05DC \u05D6\u05D0\u05EA?"),`NoData scanned this file on your machine \u2014 nothing left it:
18
+ ${s.join(`
19
19
  `)}
20
- Reading it puts these values in front of the AI. Safer: nodata_redact (a clean copy to work on) or nodata_protect (lock it).`+(i?"":" Allow this read anyway?"));return{decision:i?"deny":"ask",reason:s}}function mn(e,t,n){let i=Be(e,t,n);return i.length===0?null:`NoData \xB7 ON SCREEN rule. What you just read holds personal data:
20
+ `+(i?"Read refused: Claude will not read the original. Instead: nodata_redact (a clean copy to work on) or nodata_protect (lock it).":"If you allow it, Claude reads the file itself and its content goes to the AI model. Instead: nodata_redact (a clean copy to work on) or nodata_protect (lock it). Allow anyway?"));return{decision:i?"deny":"ask",reason:r}}function _n(e,t,n){let i=We(e,t,n);return i.length===0?null:`NoData \xB7 ON SCREEN rule. What you just read holds personal data:
21
21
  ${i.join(`
22
22
  `)}
23
- The user's screen is not private \u2014 someone may be beside them. Answer with totals, counts, groupings and trends. Do not print names, ID / policy / account numbers, addresses, phones, or amounts tied to a person \u2014 not in a table, not as an "example" \u2014 unless the user explicitly asks to see those values. To work on the values safely, offer nodata_redact (a clean copy).`+(M()==="he"?" Answer the user in Hebrew.":"")}function gn(e){try{let t=Ne(Me(),".nodata");en(t,{recursive:!0}),Yt(Ne(t,"gate.log"),JSON.stringify({at:new Date().toISOString(),...e})+`
24
- `,{mode:384})}catch{}}async function Ue(e){let t=e.includes("--block"),n=e.includes("--post"),i="";for await(let a of process.stdin)i+=a;let r;try{r=JSON.parse(i)}catch{return}let s=r.tool_name??"";if(n){let a=mn(s,r.tool_input??{},r.cwd??process.cwd());a&&process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PostToolUse",additionalContext:a}}));return}let o=hn(s,r.tool_input??{},r.cwd??process.cwd(),t);o.decision!=="allow"&&(gn({tool:s,decision:o.decision}),process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:o.decision,permissionDecisionReason:o.reason}})))}var yn=[{type:"id_number",patterns:[/\b\d{9}\b/g,/ת\.?ז\.?\s*:?\s*(\d{9})/g,/זהות\s*:?\s*(\d{9})/g],confidence:.9,replacement:()=>"[\u05EA.\u05D6. \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"phone",patterns:[/\b0[2-9]\d[\s\-]?\d{7}\b/g,/\b05[0-9][\s\-]?\d{7}\b/g,/\+972[\s\-]?[2-9]\d[\s\-]?\d{7}\b/g],confidence:.95,replacement:()=>"[\u05D8\u05DC\u05E4\u05D5\u05DF \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"email",patterns:[/[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}/g],confidence:.99,replacement:e=>{let[,t]=e.split("@");return`[\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC: ***@${t}]`}},{type:"full_name",patterns:[/(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק)[:\s]+([א-ת][א-ת"'\-\s]{2,30}?)(?=[,\n\d]|ת\.ז)/g,/(?:עו"ד|ד"ר|פרופ'|מר|גברת)\s+([א-ת][א-ת"'\-\s]{2,25}?)(?=[,\n])/g],confidence:.75,replacement:()=>"[\u05E9\u05DD \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"bank_account",patterns:[/\b\d{2}[\-]\d{5,9}[\-]\d{2,3}\b/g,/(?:חשבון|ח-ן)\s*:?\s*(\d[\d\-]{8,15})/g],confidence:.88,replacement:()=>"[\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"medical",patterns:[/(?<![א-ת])[בהוכלמש]{0,2}(?:סוכרת|יתר לחץ דם|אסתמה|דיכאון|חרדה|סרטן|אי ספיקת לב|אפילפסיה)(?![א-ת])/g,/\b(?:Metformin|Lisinopril|Atorvastatin|Amlodipine|Sertraline|Fluoxetine|Omeprazole|Warfarin|Aspirin|Insulin)\b/gi,/\bHbA1c\s*:?\s*[\d.]+%?/g,/\bBMI\s*:?\s*[\d.]+/g,/(?<![א-ת])[בהוכלמש]{0,2}אבחנ[הות]\s*:?\s*[^,\n.]{2,40}/g],confidence:.85,replacement:()=>"[\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"financial_amount",patterns:[/[\d,]+(?:\.\d{2})?\s*(?:₪|ש"ח|NIS|שקל(?:ים)?)/g,/(?:₪|NIS)\s*[\d,]+(?:\.\d{2})?/g],confidence:.92,replacement:()=>"[\u05E1\u05DB\u05D5\u05DD \u05DB\u05E1\u05E4\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"birth_date",patterns:[/(?:תאריך לידה|נולד|נולדה|ד\.ל\.)\s*:?\s*\d{1,2}[\/\.\-]\d{1,2}[\/\.\-]\d{2,4}/g,/(?<![א-ת])[בהוכלמש]{0,2}גיל\s*:?\s*\d{1,3}\b/g],confidence:.88,replacement:()=>"[\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"address",patterns:[/רחוב\s+[א-ת][א-ת\s"'\-]{2,30}\s+\d{1,5}/g,/(?:רח'|רח\.)\s+[א-ת][א-ת\s"'\-]{2,30}\d{1,5}/g],confidence:.72,replacement:()=>"[\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"},{type:"license_plate",patterns:[/\b\d{2,3}[\-]\d{2,3}[\-]\d{2,3}\b/g],confidence:.8,replacement:()=>"[\u05DC\u05D5\u05D7\u05D9\u05EA \u05E8\u05D9\u05E9\u05D5\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"}];function bn(e){if(e.length!==9)return!1;let t=e.split("").map(Number),n=0;for(let i=0;i<9;i++){let r=t[i]*(i%2===0?1:2);r>9&&(r-=9),n+=r}return n%10===0}var O=class{constructor(t){this.enabledTypes=new Set(t)}detect(t){let n=[],i=new Set;for(let s of yn)if(this.enabledTypes.has(s.type))for(let o of s.patterns){let a=new RegExp(o.source,o.flags),l;for(;(l=a.exec(t))!==null;){let c=l[0],p=`${s.type}:${l.index}`;if(!i.has(p)){if(i.add(p),s.type==="id_number"){let d=c.replace(/\D/g,"");if(/^\d{9}$/.test(c)&&d.length===9&&!bn(d))continue}n.push({type:s.type,value:c,startIndex:l.index,endIndex:l.index+c.length,confidence:s.confidence,replacement:s.replacement(c,s.type)})}}}n.sort((s,o)=>s.startIndex-o.startIndex||o.confidence-s.confidence);let r=[];for(let s of n)r.some(a=>s.startIndex<a.endIndex&&s.endIndex>a.startIndex)||r.push(s);return r}};var _n=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם_אדם|שם הלקוח|שם_הלקוח|שם בן זוג|שם בן_זוג|שם המבוטח|שם_המבוטח|שם המוטב|שם_המוטב|שם מבוטח|שם_מבוטח|שם מוטב|שם_מוטב|שם הילד|שם_הילד|שם הקטין|שם_הקטין|firstname_he|lastname_he|shem|shem_mishpacha|shem_prati)$/i,type:"name",label:"Person name (Hebrew)",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מספר_זהות|מס' זהות|מס_זהות|מס' ת"ז|teudat_zehut|tz|t_z|israeli_id|il_id)$/i,type:"id",label:"Israeli ID",labelHe:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|מס דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה|מס רישיון|דרכון_מספר)$/i,type:"id",label:"Passport / DL (Hebrew)",labelHe:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|דואר_אלקטרוני|אימייל|כתובת מייל|כתובת_מייל|כתובת דואר|כתובת_דואר)$/i,type:"email",label:"Email (Hebrew)",labelHe:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|מספר_טלפון|טלפון נייד|טלפון_נייד|מס נייד|מס_נייד|מס' טל)$/i,type:"phone",label:"Phone (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|כתובת_מגורים|רחוב|מס בית|מספר בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|כתובת_מלאה|מען)$/i,type:"address",label:"Address (Hebrew)",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|תאריך_לידה|ת לידה|תאריך הולדת|תאריך_הולדת|יום הולדת|יום_הולדת|גיל)$/i,type:"dob",label:"Date of birth (Hebrew)",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|חשבון_בנק|מספר חשבון|מספר_חשבון|מס חשבון|מס' חשבון|בנק|סניף|מס סניף|iban|iban_il)$/i,type:"financial",label:"Bank account (Hebrew)",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|כרטיס_אשראי|מספר אשראי|מס אשראי|מס' אשראי|cvv|אשראי|מס כרטיס|מס_כרטיס)$/i,type:"financial",label:"Credit card (Hebrew)",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר_ברוטו|שכר נטו|שכר_נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"Salary / income (Hebrew)",labelHe:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|בדיקה_רפואית|מצב רפואי|מצב_רפואי|חיסון|תוצאת בדיקה|תוצאת_בדיקה|רופא|רגישות|אלרגיה|סוג דם|סוג_דם)$/i,type:"medical",label:"Medical (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מספר_פוליסה|מס פוליסה|מס' פוליסה|פוליסה|מספר חבר|מספר_חבר|מס חבר|מספר ביטוח|מספר_ביטוח|policy_?number|policy_?no|policy_?id)$/i,type:"policy",label:"Insurance policy number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"},{pattern:/^(?:מספר סוכן|מספר_סוכן|מס סוכן|מס' סוכן|מס_סוכן|קוד סוכן|קוד_סוכן|מספר משווק|מספר_משווק|מספר יצרן|סוכן ביטוח|agent_?number|agent_?no|agent_?id|agent_?code|broker_?id|broker_?number)$/i,type:"agent_id",label:"Insurance agent / broker number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"},{pattern:/^(?:שם הילד|שם_הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|מספר_ילדים|תעודת לידה|ת לידה ילד)$/i,type:"minor_data",label:"Minor data (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|נטייה_מינית|השקפה פוליטית|השקפה_פוליטית|מצב משפחתי|מצב_משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"Sensitive personal (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מספר_רכב|מס רכב|מס' רכב|לוחית רישוי|לוחית_רישוי|מספר רישוי|מספר_רישוי)$/i,type:"tracking",label:"Vehicle ID (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}];function le(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let n=t.padStart(9,"0"),i=0;for(let r=0;r<9;r++){let s=parseInt(n[r]??"0",10)*(r%2+1);s>9&&(s-=9),i+=s}return i%10===0&&parseInt(n,10)>0}var j=/(?:\+972[\s-]?|0)(?:5[0-9]|[2-4]|[89])(?:[\s-]?\d){7}/g,B=/[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}/gi,U=/\bIL\d{2}\s?(?:\d{4}\s?){4}\d{3}\b/g;function Ze(e){let t=String(e??"").replace(/\D/g,"");if(t.length<13||t.length>19)return!1;let n=0,i=!1;for(let r=t.length-1;r>=0;r--){let s=t.charCodeAt(r)-48;if(s<0||s>9)return!1;i&&(s*=2,s>9&&(s-=9)),n+=s,i=!i}return n%10===0}function We(e){if(!e)return null;let t=e.trim();for(let n of _n)if(n.pattern.test(t))return{type:n.type,label:n.label,labelHe:n.labelHe};return null}var vn=[{type:"biometric",tokens:["biometric","fingerprint","\u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"],phrases:["face id","\u05D8\u05D1\u05D9\u05E2\u05EA \u05D0\u05E6\u05D1\u05E2"]},{type:"medical",tokens:["diagnosis","medical","disease","medication","prescription","allergy","vaccine","\u05D0\u05D1\u05D7\u05D5\u05DF","\u05D0\u05D1\u05D7\u05E0\u05D4","\u05DE\u05D7\u05DC\u05D4","\u05EA\u05E8\u05D5\u05E4\u05D4","\u05DE\u05E8\u05E9\u05DD","\u05D7\u05D9\u05E1\u05D5\u05DF","\u05D0\u05DC\u05E8\u05D2\u05D9\u05D4"],phrases:["medical record","blood type","\u05DE\u05E6\u05D1 \u05E8\u05E4\u05D5\u05D0\u05D9","\u05E1\u05D5\u05D2 \u05D3\u05DD"]},{type:"sensitive_personal",tokens:["religion","ethnicity","nationality","\u05D3\u05EA","\u05DC\u05D0\u05D5\u05DD","\u05E2\u05D3\u05D4","\u05DE\u05D5\u05E6\u05D0"],phrases:["sexual orientation","marital status","\u05DE\u05E6\u05D1 \u05DE\u05E9\u05E4\u05D7\u05EA\u05D9","\u05E0\u05D8\u05D9\u05D9\u05D4 \u05DE\u05D9\u05E0\u05D9\u05EA"]},{type:"minor_data",tokens:["minor","\u05E7\u05D8\u05D9\u05DF"],phrases:["child name","\u05E9\u05DD \u05D4\u05D9\u05DC\u05D3","\u05E9\u05DD \u05D4\u05E7\u05D8\u05D9\u05DF"]},{type:"id",tokens:["ssn","passport","\u05D6\u05D4\u05D5\u05EA","\u05D3\u05E8\u05DB\u05D5\u05DF"],phrases:["national id","id number","identity number","social security","driver license","driving license","drivers license","passport number","tax id","\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA","\u05DE\u05E1\u05E4\u05E8 \u05D6\u05D4\u05D5\u05EA","\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"]},{type:"financial",tokens:["iban","swift","bic","salary","income","wage","\u05D0\u05E9\u05E8\u05D0\u05D9","\u05E9\u05DB\u05E8","\u05DE\u05E9\u05DB\u05D5\u05E8\u05EA","\u05D4\u05DB\u05E0\u05E1\u05D4"],phrases:["bank account","account number","credit card","card number","routing number","sort code","\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7","\u05DE\u05E1\u05E4\u05E8 \u05D7\u05E9\u05D1\u05D5\u05DF","\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"]},{type:"policy",tokens:["policy","\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"],phrases:["policy number","member number","\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"]},{type:"agent_id",tokens:["\u05DE\u05E9\u05D5\u05D5\u05E7"],phrases:["agent number","agent code","broker id","\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"]},{type:"dob",tokens:["dob","birthdate","birthday","\u05DC\u05D9\u05D3\u05D4","\u05D4\u05D5\u05DC\u05D3\u05EA","\u05D2\u05D9\u05DC"],phrases:["date of birth","birth date","\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"]},{type:"phone",tokens:["phone","tel","mobile","cell","fax","\u05D8\u05DC\u05E4\u05D5\u05DF","\u05E0\u05D9\u05D9\u05D3","\u05E4\u05DC\u05D0\u05E4\u05D5\u05DF","\u05E1\u05DC\u05D5\u05DC\u05E8\u05D9"],phrases:["phone number","mobile number","cell phone","\u05D8\u05DC\u05E4\u05D5\u05DF \u05E0\u05D9\u05D9\u05D3"]},{type:"email",tokens:["email","mail","\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC","\u05DE\u05D9\u05D9\u05DC","\u05D3\u05D5\u05D0\u05DC"],phrases:["email address","e mail","\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D9\u05D9\u05DC"]},{type:"address",tokens:["address","street","city","zipcode","zip","postcode","\u05DB\u05EA\u05D5\u05D1\u05EA","\u05E8\u05D7\u05D5\u05D1","\u05E2\u05D9\u05E8","\u05D9\u05E9\u05D5\u05D1","\u05D9\u05D9\u05E9\u05D5\u05D1","\u05DE\u05D9\u05E7\u05D5\u05D3","\u05DE\u05E2\u05DF"],phrases:["home address","postal code","street address","zip code","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D2\u05D5\u05E8\u05D9\u05DD"]},{type:"location",tokens:["gps","latitude","longitude","geolocation","\u05DE\u05D9\u05E7\u05D5\u05DD"],phrases:["gps coordinates"]},{type:"tracking",tokens:["plate","vehicle","\u05E8\u05DB\u05D1","\u05E8\u05D9\u05E9\u05D5\u05D9"],phrases:["license plate","vehicle number","plate number","\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"]},{type:"name",tokens:["name","\u05E9\u05DD"],phrases:["first name","last name","full name","family name","given name","surname","\u05E9\u05DD \u05E4\u05E8\u05D8\u05D9","\u05E9\u05DD \u05DE\u05E9\u05E4\u05D7\u05D4","\u05E9\u05DD \u05DE\u05DC\u05D0"]}];function Z(e){if(!e)return null;let t=e.trim().toLowerCase().replace(/["'`׳״]/g,"").replace(/[_\-.]+/g," ").replace(/\s+/g," ").trim();if(!t)return null;let n=new Set(t.match(/[\p{L}\p{N}]+/gu)??[]);for(let i of vn)if(i.phrases?.some(s=>t.includes(s))||i.tokens?.some(s=>n.has(s)))return{type:i.type,label:i.type,labelHe:W(i.type)};return null}function W(e){return{id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",name:"\u05E9\u05DD \u05D0\u05D3\u05DD",email:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9",phone:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",financial:"\u05E4\u05E8\u05D8\u05D9\u05DD \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9\u05D9\u05DD",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",minor_data:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF",sensitive_personal:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9",biometric:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9",auth:"\u05E1\u05D9\u05E1\u05DE\u05D0\u05D5\u05EA/\u05E1\u05D5\u05D3\u05D5\u05EA",tracking:"\u05DE\u05D6\u05D4\u05D9 \u05DE\u05E2\u05E7\u05D1",location:"\u05DE\u05D9\u05E7\u05D5\u05DD"}[e]??"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9"}function Ve(e){let t=0,n=0,i=0,r=0,s=0;for(let a of e)typeof a=="string"&&(le(a)&&t++,j.lastIndex=0,j.test(a)&&n++,B.lastIndex=0,B.test(a)&&i++,U.lastIndex=0,U.test(a)&&r++,Ze(a)&&s++);let o=e.length||1;return t/o>=.3?{type:"id",label:"Israeli ID (sniffed)",matchedSample:t}:r/o>=.3?{type:"financial",label:"IBAN-IL (sniffed)",matchedSample:r}:n/o>=.3?{type:"phone",label:"IL phone (sniffed)",matchedSample:n}:i/o>=.3?{type:"email",label:"Email (sniffed)",matchedSample:i}:s/o>=.3?{type:"financial",label:"Credit card (sniffed)",matchedSample:s}:null}var Ke={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var Sn=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA \u05D0\u05D9\u05DE\u05D9\u05D9\u05DC"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05D6\u05D4\u05D4"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Financial data",labelHe:"\u05E0\u05EA\u05D5\u05DF \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(ip_?address)$/i,type:"tracking",label:"IP address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA IP"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D3\u05E8\u05DB\u05D5\u05DF"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license",labelHe:"\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"},{pattern:/^(iban|swift_?code|bic)$/i,type:"financial",label:"Banking code",labelHe:"\u05E7\u05D5\u05D3 \u05D1\u05E0\u05E7\u05D0\u05D9"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05E1"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Member ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D1\u05D9\u05D8\u05D5\u05D7/\u05D7\u05D1\u05E8"},{pattern:/^(blood_?type|allergy|allergies|prescription)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation",labelHe:"\u05DE\u05D9\u05E7\u05D5\u05DD \u05D2\u05D9\u05D0\u05D5\u05D2\u05E8\u05E4\u05D9"},{pattern:/^(mac_?address|device_?fingerprint|imei|serial_?number)$/i,type:"tracking",label:"Device identifier",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05DE\u05DB\u05E9\u05D9\u05E8"},{pattern:/^(ethnicity|race|religion|political_?affiliation|sexual_?orientation)$/i,type:"sensitive_personal",label:"Sensitive personal",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(minor|child_?name|child_?age|dependent)$/i,type:"minor_data",label:"Minor data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05E0\u05D9\u05DD"},{pattern:/^(signature|digital_?signature)$/i,type:"id",label:"Signature",labelHe:"\u05D7\u05EA\u05D9\u05DE\u05D4"},{pattern:/^(vehicle_?number|license_?plate|plate_?number)$/i,type:"tracking",label:"Vehicle ID",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05E8\u05DB\u05D1"}],wn=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|sort_?order|position|enabled|active|public|version|metadata|config|settings|options|data|content|body|raw|json|text|note|comment|label|color|icon|image|avatar|logo|thumbnail|preview|template|schema|format|mode|level|priority|severity|source|target|parent|child|owner|creator|modifier|assignee|project|workspace|organization|team|group|channel|thread|room|session|device|platform|browser|locale|timezone|currency|country|region|city|zip|postal|state|province|name|display_?name|user_?agent|password_?hash|secret|token|private_?key|auth_?token|constraint|index|sequence|trigger|function|procedure|database|namespace|migration|revision)$/i,In=/^(beacon_?registr|device_?config|hardware|sensor|firmware|telemetry|metric|analytic|log_?event|audit_?log|system_?config|cache|queue|job|migration|schema_?version|spatial_?ref)/i,En=/^(minor|major|uuid|rssi|tx_?power|beacon_?id|device_?type|firmware_?version|batch_?id|zone_?id)$/i;function Ge(e,t){if(wn.test(e)||/^name$/i.test(e)||t&&In.test(t)||En.test(e))return null;for(let i of Sn)if(i.pattern.test(e))return i.type;let n=We(e);return n?n.type:null}var nr=Ke.rules.map(e=>({id:e.id,name:e.name,pattern:new RegExp(e.pattern),severity:e.severity}));var ir=512*1024,rr=50*1024*1024;var An={id:"high",agent_id:"high",policy:"high",financial:"high",medical:"critical",sensitive_personal:"critical",minor_data:"critical",biometric:"critical",auth:"critical",name:"medium",email:"high",phone:"high",address:"high",dob:"high",location:"high",tracking:"low"};function $n(e){return An[e]??"low"}function Je(e,t){let n=[];for(let i of t){let r=i.rows.length;for(let s=0;s<i.headers.length;s++){let o=i.headers[s]??"",a=o?Ge(o.trim().replace(/["'`׳״:]/g,"").replace(/\s+/g,"_"),i.name)??Z(o)?.type??null:null,l=[];for(let p of i.rows){let d=p[s];typeof d=="string"&&d.length>0&&l.push(d)}let c=l.length>0?Ve(l):null;c?n.push(Xe(e,i.name,o,c.type,c.label,"value",c.matchedSample,r)):a&&n.push(Xe(e,i.name,o,a,W(a),"header",0,r))}}return n}function Xe(e,t,n,i,r,s,o,a){return{file:e,location:t,column:n,type:i,label:r,category:W(i),severity:$n(i),matchKind:s,hits:o,sampleSize:a}}var qe={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var Cn=[{type:"full_name",kind:"name",severity:"medium",hint:`A person's name in free text (after a role word such as \u05DC\u05E7\u05D5\u05D7 / \u05DE\u05E8 / \u05E2\u05D5"\u05D3).`},{type:"bank_account",kind:"bank_account",severity:"high",hint:"An Israeli bank account number (branch-account-check form) in plaintext."},{type:"medical",kind:"medical",severity:"high",hint:"Medical information (diagnosis, medication, lab value) in plaintext."},{type:"birth_date",kind:"dob",severity:"medium",hint:"A date of birth in plaintext."},{type:"address",kind:"address",severity:"medium",hint:"A street address in plaintext."},{type:"license_plate",kind:"plate",severity:"low",hint:"A vehicle licence plate in plaintext."}],Rn=/^(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק|עו"ד|ד"ר|פרופ'|מר|גברת|חשבון|ח-ן|[בהוכלמש]{0,2}אבחנ[הות]|תאריך לידה|נולד|נולדה|ד\.ל\.|[בהוכלמש]{0,2}גיל)\s*:?\s*/;function Pn(e,t,n,i){if(i==="address")return{start:t,end:n};let r=Rn.exec(e.slice(t,n));return r&&t+r[0].length<n?{start:t+r[0].length,end:n}:{start:t,end:n}}var Ln=new Set(["hex-secret-32","base64-secret"]),Ye=!1;function Qe(){if(Ye)return;Ye=!0;let e=Cn.map(({type:n,kind:i,severity:r,hint:s})=>{let o=new O([n]);return{kind:i,severity:r,hint:s,find:a=>o.detect(a).map(l=>Pn(a,l.startIndex,l.endIndex,i))}}),t=qe.rules.filter(n=>!Ln.has(n.id)).map(n=>({id:n.id,name:n.name,severity:n.severity,pattern:new RegExp(n.pattern)}));Y({text:e,header:n=>{let i=Z(n);return i?{type:i.type,label:i.labelHe||i.label}:null},secrets:t,table:n=>Je("",[n]).filter(i=>i.column).map(i=>({column:i.column,type:i.type,category:i.category,severity:i.severity,hits:i.hits,how:i.matchKind==="value"?"value":"header"}))})}Qe();Ue(process.argv.slice(2)).catch(()=>{process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"ask",permissionDecisionReason:"NoData could not check this file before it is read. Allow anyway?"}}))});
23
+ The user's screen is not private \u2014 someone may be beside them. Answer with totals, counts, groupings and trends. Do not print names, ID / policy / account numbers, addresses, phones, or amounts tied to a person \u2014 not in a table, not as an "example" \u2014 unless the user explicitly asks to see those values. For a clean, anonymised or shareable version use nodata_redact \u2014 never your own script: it verifies the copy and records a proof.`+(M()==="he"?" Answer the user in Hebrew.":"")}function kn(e){try{let t=ze(je(),".nodata");sn(t,{recursive:!0}),tn(ze(t,"gate.log"),JSON.stringify({at:new Date().toISOString(),...e})+`
24
+ `,{mode:384})}catch{}}async function Ze(e){let t=e.includes("--block"),n=e.includes("--post"),i="";for await(let a of process.stdin)i+=a;let s;try{s=JSON.parse(i)}catch{return}let r=s.tool_name??"";if(n){let a=_n(r,s.tool_input??{},s.cwd??process.cwd());a&&process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PostToolUse",additionalContext:a}}));return}let o=bn(r,s.tool_input??{},s.cwd??process.cwd(),t);o.decision!=="allow"&&(kn({tool:r,decision:o.decision}),process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:o.decision,permissionDecisionReason:o.reason}})))}var vn=[{type:"id_number",patterns:[/\b\d{9}\b/g,/ת\.?ז\.?\s*:?\s*(\d{9})/g,/זהות\s*:?\s*(\d{9})/g],confidence:.9,replacement:()=>"[\u05EA.\u05D6. \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"phone",patterns:[/\b0[2-9]\d[\s\-]?\d{7}\b/g,/\b05[0-9][\s\-]?\d{7}\b/g,/\+972[\s\-]?[2-9]\d[\s\-]?\d{7}\b/g],confidence:.95,replacement:()=>"[\u05D8\u05DC\u05E4\u05D5\u05DF \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"email",patterns:[/[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}/g],confidence:.99,replacement:e=>{let[,t]=e.split("@");return`[\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC: ***@${t}]`}},{type:"full_name",patterns:[/(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק)[:\s]+([א-ת][א-ת"'\-\s]{2,30}?)(?=[,\n\d]|ת\.ז)/g,/(?:עו"ד|ד"ר|פרופ'|מר|גברת)\s+([א-ת][א-ת"'\-\s]{2,25}?)(?=[,\n])/g],confidence:.75,replacement:()=>"[\u05E9\u05DD \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"bank_account",patterns:[/\b\d{2}[\-]\d{5,9}[\-]\d{2,3}\b/g,/(?:חשבון|ח-ן)\s*:?\s*(\d[\d\-]{8,15})/g],confidence:.88,replacement:()=>"[\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"medical",patterns:[/(?<![א-ת])[בהוכלמש]{0,2}(?:סוכרת|יתר לחץ דם|אסתמה|דיכאון|חרדה|סרטן|אי ספיקת לב|אפילפסיה)(?![א-ת])/g,/\b(?:Metformin|Lisinopril|Atorvastatin|Amlodipine|Sertraline|Fluoxetine|Omeprazole|Warfarin|Aspirin|Insulin)\b/gi,/\bHbA1c\s*:?\s*[\d.]+%?/g,/\bBMI\s*:?\s*[\d.]+/g,/(?<![א-ת])[בהוכלמש]{0,2}אבחנ[הות]\s*:?\s*[^,\n.]{2,40}/g],confidence:.85,replacement:()=>"[\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"financial_amount",patterns:[/[\d,]+(?:\.\d{2})?\s*(?:₪|ש"ח|NIS|שקל(?:ים)?)/g,/(?:₪|NIS)\s*[\d,]+(?:\.\d{2})?/g],confidence:.92,replacement:()=>"[\u05E1\u05DB\u05D5\u05DD \u05DB\u05E1\u05E4\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"birth_date",patterns:[/(?:תאריך לידה|נולד|נולדה|ד\.ל\.)\s*:?\s*\d{1,2}[\/\.\-]\d{1,2}[\/\.\-]\d{2,4}/g,/(?<![א-ת])[בהוכלמש]{0,2}גיל\s*:?\s*\d{1,3}\b/g],confidence:.88,replacement:()=>"[\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"address",patterns:[/רחוב\s+[א-ת][א-ת\s"'\-]{2,30}\s+\d{1,5}/g,/(?:רח'|רח\.)\s+[א-ת][א-ת\s"'\-]{2,30}\d{1,5}/g],confidence:.72,replacement:()=>"[\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"},{type:"license_plate",patterns:[/\b\d{2,3}[\-]\d{2,3}[\-]\d{2,3}\b/g],confidence:.8,replacement:()=>"[\u05DC\u05D5\u05D7\u05D9\u05EA \u05E8\u05D9\u05E9\u05D5\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"}];function xn(e){if(e.length!==9)return!1;let t=e.split("").map(Number),n=0;for(let i=0;i<9;i++){let s=t[i]*(i%2===0?1:2);s>9&&(s-=9),n+=s}return n%10===0}var j=class{constructor(t){this.enabledTypes=new Set(t)}detect(t){let n=[],i=new Set;for(let r of vn)if(this.enabledTypes.has(r.type))for(let o of r.patterns){let a=new RegExp(o.source,o.flags),l;for(;(l=a.exec(t))!==null;){let c=l[0],p=`${r.type}:${l.index}`;if(!i.has(p)){if(i.add(p),r.type==="id_number"){let d=c.replace(/\D/g,"");if(/^\d{9}$/.test(c)&&d.length===9&&!xn(d))continue}n.push({type:r.type,value:c,startIndex:l.index,endIndex:l.index+c.length,confidence:r.confidence,replacement:r.replacement(c,r.type)})}}}n.sort((r,o)=>r.startIndex-o.startIndex||o.confidence-r.confidence);let s=[];for(let r of n)s.some(a=>r.startIndex<a.endIndex&&r.endIndex>a.startIndex)||s.push(r);return s}};var Sn=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם_אדם|שם הלקוח|שם_הלקוח|שם בן זוג|שם בן_זוג|שם המבוטח|שם_המבוטח|שם המוטב|שם_המוטב|שם מבוטח|שם_מבוטח|שם מוטב|שם_מוטב|שם הילד|שם_הילד|שם הקטין|שם_הקטין|firstname_he|lastname_he|shem|shem_mishpacha|shem_prati)$/i,type:"name",label:"Person name (Hebrew)",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מספר_זהות|מס' זהות|מס_זהות|מס' ת"ז|teudat_zehut|tz|t_z|israeli_id|il_id)$/i,type:"id",label:"Israeli ID",labelHe:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|מס דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה|מס רישיון|דרכון_מספר)$/i,type:"id",label:"Passport / DL (Hebrew)",labelHe:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|דואר_אלקטרוני|אימייל|כתובת מייל|כתובת_מייל|כתובת דואר|כתובת_דואר)$/i,type:"email",label:"Email (Hebrew)",labelHe:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|מספר_טלפון|טלפון נייד|טלפון_נייד|מס נייד|מס_נייד|מס' טל)$/i,type:"phone",label:"Phone (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|כתובת_מגורים|רחוב|מס בית|מספר בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|כתובת_מלאה|מען)$/i,type:"address",label:"Address (Hebrew)",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|תאריך_לידה|ת לידה|תאריך הולדת|תאריך_הולדת|יום הולדת|יום_הולדת|גיל)$/i,type:"dob",label:"Date of birth (Hebrew)",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|חשבון_בנק|מספר חשבון|מספר_חשבון|מס חשבון|מס' חשבון|בנק|סניף|מס סניף|iban|iban_il)$/i,type:"financial",label:"Bank account (Hebrew)",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|כרטיס_אשראי|מספר אשראי|מס אשראי|מס' אשראי|cvv|אשראי|מס כרטיס|מס_כרטיס)$/i,type:"financial",label:"Credit card (Hebrew)",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר_ברוטו|שכר נטו|שכר_נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"Salary / income (Hebrew)",labelHe:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|בדיקה_רפואית|מצב רפואי|מצב_רפואי|חיסון|תוצאת בדיקה|תוצאת_בדיקה|רופא|רגישות|אלרגיה|סוג דם|סוג_דם)$/i,type:"medical",label:"Medical (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מספר_פוליסה|מס פוליסה|מס' פוליסה|פוליסה|מספר חבר|מספר_חבר|מס חבר|מספר ביטוח|מספר_ביטוח|policy_?number|policy_?no|policy_?id)$/i,type:"policy",label:"Insurance policy number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"},{pattern:/^(?:מספר סוכן|מספר_סוכן|מס סוכן|מס' סוכן|מס_סוכן|קוד סוכן|קוד_סוכן|מספר משווק|מספר_משווק|מספר יצרן|סוכן ביטוח|agent_?number|agent_?no|agent_?id|agent_?code|broker_?id|broker_?number)$/i,type:"agent_id",label:"Insurance agent / broker number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"},{pattern:/^(?:שם הילד|שם_הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|מספר_ילדים|תעודת לידה|ת לידה ילד)$/i,type:"minor_data",label:"Minor data (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|נטייה_מינית|השקפה פוליטית|השקפה_פוליטית|מצב משפחתי|מצב_משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"Sensitive personal (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מספר_רכב|מס רכב|מס' רכב|לוחית רישוי|לוחית_רישוי|מספר רישוי|מספר_רישוי)$/i,type:"tracking",label:"Vehicle ID (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}];function pe(e){let t=String(e??"").replace(/\D/g,"");if(t.length===0||t.length>9)return!1;let n=t.padStart(9,"0"),i=0;for(let s=0;s<9;s++){let r=parseInt(n[s]??"0",10)*(s%2+1);r>9&&(r-=9),i+=r}return i%10===0&&parseInt(n,10)>0}var B=/(?:\+972[\s-]?|0)(?:5[0-9]|[2-4]|[89])(?:[\s-]?\d){7}/g,U=/[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}/gi,W=/\bIL\d{2}\s?(?:\d{4}\s?){4}\d{3}\b/g;function Ke(e){let t=String(e??"").replace(/\D/g,"");if(t.length<13||t.length>19)return!1;let n=0,i=!1;for(let s=t.length-1;s>=0;s--){let r=t.charCodeAt(s)-48;if(r<0||r>9)return!1;i&&(r*=2,r>9&&(r-=9)),n+=r,i=!i}return n%10===0}function Ve(e){if(!e)return null;let t=e.trim();for(let n of Sn)if(n.pattern.test(t))return{type:n.type,label:n.label,labelHe:n.labelHe};return null}var wn=[{type:"biometric",tokens:["biometric","fingerprint","\u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"],phrases:["face id","\u05D8\u05D1\u05D9\u05E2\u05EA \u05D0\u05E6\u05D1\u05E2"]},{type:"medical",tokens:["diagnosis","medical","disease","medication","prescription","allergy","vaccine","\u05D0\u05D1\u05D7\u05D5\u05DF","\u05D0\u05D1\u05D7\u05E0\u05D4","\u05DE\u05D7\u05DC\u05D4","\u05EA\u05E8\u05D5\u05E4\u05D4","\u05DE\u05E8\u05E9\u05DD","\u05D7\u05D9\u05E1\u05D5\u05DF","\u05D0\u05DC\u05E8\u05D2\u05D9\u05D4"],phrases:["medical record","blood type","\u05DE\u05E6\u05D1 \u05E8\u05E4\u05D5\u05D0\u05D9","\u05E1\u05D5\u05D2 \u05D3\u05DD"]},{type:"sensitive_personal",tokens:["religion","ethnicity","nationality","\u05D3\u05EA","\u05DC\u05D0\u05D5\u05DD","\u05E2\u05D3\u05D4","\u05DE\u05D5\u05E6\u05D0"],phrases:["sexual orientation","marital status","\u05DE\u05E6\u05D1 \u05DE\u05E9\u05E4\u05D7\u05EA\u05D9","\u05E0\u05D8\u05D9\u05D9\u05D4 \u05DE\u05D9\u05E0\u05D9\u05EA"]},{type:"minor_data",tokens:["minor","\u05E7\u05D8\u05D9\u05DF"],phrases:["child name","\u05E9\u05DD \u05D4\u05D9\u05DC\u05D3","\u05E9\u05DD \u05D4\u05E7\u05D8\u05D9\u05DF"]},{type:"id",tokens:["ssn","passport","\u05D6\u05D4\u05D5\u05EA","\u05D3\u05E8\u05DB\u05D5\u05DF"],phrases:["national id","id number","identity number","social security","driver license","driving license","drivers license","passport number","tax id","\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA","\u05DE\u05E1\u05E4\u05E8 \u05D6\u05D4\u05D5\u05EA","\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"]},{type:"financial",tokens:["iban","swift","bic","salary","income","wage","\u05D0\u05E9\u05E8\u05D0\u05D9","\u05E9\u05DB\u05E8","\u05DE\u05E9\u05DB\u05D5\u05E8\u05EA","\u05D4\u05DB\u05E0\u05E1\u05D4"],phrases:["bank account","account number","credit card","card number","routing number","sort code","\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7","\u05DE\u05E1\u05E4\u05E8 \u05D7\u05E9\u05D1\u05D5\u05DF","\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"]},{type:"policy",tokens:["policy","\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"],phrases:["policy number","member number","\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"]},{type:"agent_id",tokens:["\u05DE\u05E9\u05D5\u05D5\u05E7"],phrases:["agent number","agent code","broker id","\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"]},{type:"dob",tokens:["dob","birthdate","birthday","\u05DC\u05D9\u05D3\u05D4","\u05D4\u05D5\u05DC\u05D3\u05EA","\u05D2\u05D9\u05DC"],phrases:["date of birth","birth date","\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"]},{type:"phone",tokens:["phone","tel","mobile","cell","fax","\u05D8\u05DC\u05E4\u05D5\u05DF","\u05E0\u05D9\u05D9\u05D3","\u05E4\u05DC\u05D0\u05E4\u05D5\u05DF","\u05E1\u05DC\u05D5\u05DC\u05E8\u05D9"],phrases:["phone number","mobile number","cell phone","\u05D8\u05DC\u05E4\u05D5\u05DF \u05E0\u05D9\u05D9\u05D3"]},{type:"email",tokens:["email","mail","\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC","\u05DE\u05D9\u05D9\u05DC","\u05D3\u05D5\u05D0\u05DC"],phrases:["email address","e mail","\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D9\u05D9\u05DC"]},{type:"address",tokens:["address","street","city","zipcode","zip","postcode","\u05DB\u05EA\u05D5\u05D1\u05EA","\u05E8\u05D7\u05D5\u05D1","\u05E2\u05D9\u05E8","\u05D9\u05E9\u05D5\u05D1","\u05D9\u05D9\u05E9\u05D5\u05D1","\u05DE\u05D9\u05E7\u05D5\u05D3","\u05DE\u05E2\u05DF"],phrases:["home address","postal code","street address","zip code","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D2\u05D5\u05E8\u05D9\u05DD"]},{type:"location",tokens:["gps","latitude","longitude","geolocation","\u05DE\u05D9\u05E7\u05D5\u05DD"],phrases:["gps coordinates"]},{type:"tracking",tokens:["plate","vehicle","\u05E8\u05DB\u05D1","\u05E8\u05D9\u05E9\u05D5\u05D9"],phrases:["license plate","vehicle number","plate number","\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"]},{type:"name",tokens:["name","\u05E9\u05DD"],phrases:["first name","last name","full name","family name","given name","surname","\u05E9\u05DD \u05E4\u05E8\u05D8\u05D9","\u05E9\u05DD \u05DE\u05E9\u05E4\u05D7\u05D4","\u05E9\u05DD \u05DE\u05DC\u05D0"]}];function Z(e){if(!e)return null;let t=e.trim().toLowerCase().replace(/["'`׳״]/g,"").replace(/[_\-.]+/g," ").replace(/\s+/g," ").trim();if(!t)return null;let n=new Set(t.match(/[\p{L}\p{N}]+/gu)??[]);for(let i of wn)if(i.phrases?.some(r=>t.includes(r))||i.tokens?.some(r=>n.has(r)))return{type:i.type,label:i.type,labelHe:K(i.type)};return null}function K(e){return{id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",name:"\u05E9\u05DD \u05D0\u05D3\u05DD",email:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9",phone:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",financial:"\u05E4\u05E8\u05D8\u05D9\u05DD \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9\u05D9\u05DD",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",minor_data:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF",sensitive_personal:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9",biometric:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9",auth:"\u05E1\u05D9\u05E1\u05DE\u05D0\u05D5\u05EA/\u05E1\u05D5\u05D3\u05D5\u05EA",tracking:"\u05DE\u05D6\u05D4\u05D9 \u05DE\u05E2\u05E7\u05D1",location:"\u05DE\u05D9\u05E7\u05D5\u05DD"}[e]??"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9"}function Ge(e){let t=0,n=0,i=0,s=0,r=0;for(let a of e)typeof a=="string"&&(pe(a)&&t++,B.lastIndex=0,B.test(a)&&n++,U.lastIndex=0,U.test(a)&&i++,W.lastIndex=0,W.test(a)&&s++,Ke(a)&&r++);let o=e.length||1;return t/o>=.3?{type:"id",label:"Israeli ID (sniffed)",matchedSample:t}:s/o>=.3?{type:"financial",label:"IBAN-IL (sniffed)",matchedSample:s}:n/o>=.3?{type:"phone",label:"IL phone (sniffed)",matchedSample:n}:i/o>=.3?{type:"email",label:"Email (sniffed)",matchedSample:i}:r/o>=.3?{type:"financial",label:"Credit card (sniffed)",matchedSample:r}:null}var Xe={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var An=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA \u05D0\u05D9\u05DE\u05D9\u05D9\u05DC"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05D6\u05D4\u05D4"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Financial data",labelHe:"\u05E0\u05EA\u05D5\u05DF \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(ip_?address)$/i,type:"tracking",label:"IP address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA IP"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D3\u05E8\u05DB\u05D5\u05DF"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license",labelHe:"\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"},{pattern:/^(iban|swift_?code|bic)$/i,type:"financial",label:"Banking code",labelHe:"\u05E7\u05D5\u05D3 \u05D1\u05E0\u05E7\u05D0\u05D9"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05E1"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Member ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D1\u05D9\u05D8\u05D5\u05D7/\u05D7\u05D1\u05E8"},{pattern:/^(blood_?type|allergy|allergies|prescription)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation",labelHe:"\u05DE\u05D9\u05E7\u05D5\u05DD \u05D2\u05D9\u05D0\u05D5\u05D2\u05E8\u05E4\u05D9"},{pattern:/^(mac_?address|device_?fingerprint|imei|serial_?number)$/i,type:"tracking",label:"Device identifier",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05DE\u05DB\u05E9\u05D9\u05E8"},{pattern:/^(ethnicity|race|religion|political_?affiliation|sexual_?orientation)$/i,type:"sensitive_personal",label:"Sensitive personal",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(minor|child_?name|child_?age|dependent)$/i,type:"minor_data",label:"Minor data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05E0\u05D9\u05DD"},{pattern:/^(signature|digital_?signature)$/i,type:"id",label:"Signature",labelHe:"\u05D7\u05EA\u05D9\u05DE\u05D4"},{pattern:/^(vehicle_?number|license_?plate|plate_?number)$/i,type:"tracking",label:"Vehicle ID",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05E8\u05DB\u05D1"}],$n=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|sort_?order|position|enabled|active|public|version|metadata|config|settings|options|data|content|body|raw|json|text|note|comment|label|color|icon|image|avatar|logo|thumbnail|preview|template|schema|format|mode|level|priority|severity|source|target|parent|child|owner|creator|modifier|assignee|project|workspace|organization|team|group|channel|thread|room|session|device|platform|browser|locale|timezone|currency|country|region|city|zip|postal|state|province|name|display_?name|user_?agent|password_?hash|secret|token|private_?key|auth_?token|constraint|index|sequence|trigger|function|procedure|database|namespace|migration|revision)$/i,Tn=/^(beacon_?registr|device_?config|hardware|sensor|firmware|telemetry|metric|analytic|log_?event|audit_?log|system_?config|cache|queue|job|migration|schema_?version|spatial_?ref)/i,Cn=/^(minor|major|uuid|rssi|tx_?power|beacon_?id|device_?type|firmware_?version|batch_?id|zone_?id)$/i;function Je(e,t){if($n.test(e)||/^name$/i.test(e)||t&&Tn.test(t)||Cn.test(e))return null;for(let i of An)if(i.pattern.test(e))return i.type;let n=Ve(e);return n?n.type:null}var ks=Xe.rules.map(e=>({id:e.id,name:e.name,pattern:new RegExp(e.pattern),severity:e.severity}));var vs=512*1024,xs=50*1024*1024;var Rn={id:"high",agent_id:"high",policy:"high",financial:"high",medical:"critical",sensitive_personal:"critical",minor_data:"critical",biometric:"critical",auth:"critical",name:"medium",email:"high",phone:"high",address:"high",dob:"high",location:"high",tracking:"low"};function Pn(e){return Rn[e]??"low"}function Ye(e,t){let n=[];for(let i of t){let s=i.rows.length;for(let r=0;r<i.headers.length;r++){let o=i.headers[r]??"",a=o?Je(o.trim().replace(/["'`׳״:]/g,"").replace(/\s+/g,"_"),i.name)??Z(o)?.type??null:null,l=[];for(let p of i.rows){let d=p[r];typeof d=="string"&&d.length>0&&l.push(d)}let c=l.length>0?Ge(l):null;c?n.push(qe(e,i.name,o,c.type,c.label,"value",c.matchedSample,s)):a&&n.push(qe(e,i.name,o,a,K(a),"header",0,s))}}return n}function qe(e,t,n,i,s,r,o,a){return{file:e,location:t,column:n,type:i,label:s,category:K(i),severity:Pn(i),matchKind:r,hits:o,sampleSize:a}}var Qe={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var Fn=[{type:"full_name",kind:"name",severity:"medium",hint:`A person's name in free text (after a role word such as \u05DC\u05E7\u05D5\u05D7 / \u05DE\u05E8 / \u05E2\u05D5"\u05D3).`},{type:"bank_account",kind:"bank_account",severity:"high",hint:"An Israeli bank account number (branch-account-check form) in plaintext."},{type:"medical",kind:"medical",severity:"high",hint:"Medical information (diagnosis, medication, lab value) in plaintext."},{type:"birth_date",kind:"dob",severity:"medium",hint:"A date of birth in plaintext."},{type:"address",kind:"address",severity:"medium",hint:"A street address in plaintext."},{type:"license_plate",kind:"plate",severity:"low",hint:"A vehicle licence plate in plaintext."}],Dn=/^(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק|עו"ד|ד"ר|פרופ'|מר|גברת|חשבון|ח-ן|[בהוכלמש]{0,2}אבחנ[הות]|תאריך לידה|נולד|נולדה|ד\.ל\.|[בהוכלמש]{0,2}גיל)\s*:?\s*/;function Hn(e,t,n,i){if(i==="address")return{start:t,end:n};let s=Dn.exec(e.slice(t,n));return s&&t+s[0].length<n?{start:t+s[0].length,end:n}:{start:t,end:n}}var Nn=new Set(["hex-secret-32","base64-secret"]),et=!1;function tt(){if(et)return;et=!0;let e=Fn.map(({type:n,kind:i,severity:s,hint:r})=>{let o=new j([n]);return{kind:i,severity:s,hint:r,find:a=>o.detect(a).map(l=>Hn(a,l.startIndex,l.endIndex,i))}}),t=Qe.rules.filter(n=>!Nn.has(n.id)).map(n=>({id:n.id,name:n.name,severity:n.severity,pattern:new RegExp(n.pattern)}));Q({text:e,header:n=>{let i=Z(n);return i?{type:i.type,label:i.labelHe||i.label}:null},secrets:t,table:n=>Ye("",[n]).filter(i=>i.column).map(i=>({column:i.column,type:i.type,category:i.category,severity:i.severity,hits:i.hits,how:i.matchKind==="value"?"value":"header"}))})}tt();Ze(process.argv.slice(2)).catch(()=>{process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"ask",permissionDecisionReason:"NoData could not check this file before it is read. Allow anyway?"}}))});