@nodatachat/mcp 1.3.2 → 1.3.10

package/README.md

@@ -108,8 +108,9 @@ Any mode except agent mode, **no account needed**, entirely on your machine. Any
 | Say | Tool | What happens |
 |-----|------|--------------|
 | "scan this folder" | `nodata_scan_folder` | The **whole** result — counts by type, folder and file — plus a full content‑free HTML report in `~/.nodata/reports` (every finding, never a value). |
+| "what should I do with these?" | `nodata_plan` | A **recommended policy** per file after the scan: tier (Restricted / Confidential / Internal) and action (clean copy + lock, lock, clean copy, keep); credentials also get "rotate at the source". Nothing happens until you approve, and you can change any line first. Proposing is not accepting. |
 | "lock what it found" | `nodata_protect` | Seals the files with findings to this device's key as `<file>.ndc` — the same v3 seal and format as `nodata protect`, so `nodata open` opens it too. Local receipt with hashes. |
-| "clean copy of this file" | `nodata_redact` | A copy with every detected value replaced by `[CARD]`, `[ID]`, `[IBAN]`, `[PHONE]`, `[EMAIL]` (a personal‑data CSV column hidden whole) — the rest can be analysed. Same detectors as the scan. |
+| "clean copy of this file" | `nodata_redact` | A copy with every detected value replaced by `[CARD]`, `[ID]`, `[IBAN]`, `[PHONE]`, `[EMAIL]`; a personal‑data column (CSV or Excel) is replaced with one stable token per person (`[NAME-1]` …) and amounts stay whole. Excel stays Excel. Same detectors as the scan. |
 | "open this .ndc" | `nodata_open` | Opens it back next to itself, hash‑checked. |
 | "who can read what?" | `nodata_policy` | The policy board (admin): every agent and its exact reach. Change it with `nodata_grant` (preview → approve, a copy of the approval kept in `~/.nodata/approvals`) or `nodata_revoke` (immediate). |
 
@@ -140,6 +141,33 @@ The one-sentence version: **encrypt locally, send, revoke later, prove what happ
   green = guarded, yellow = gate off, red = terms not accepted. No segment = not guarded. A status
   line you already had keeps running beside it, and comes back on `uninstall-gate`.
 
+## This machine as a Capsule node
+
+`nodata_node` registers the machine as a node of your organisation's Capsule fleet, after you approve it once. It uses the same enrolment and signed heartbeat as the installed Capsule agent.
+
+- **Capsule = node:** one per machine.
+- **Agent = workload:** Claude Code, Cursor or a bot running on that node.
+- **Billing = decisions:** a node is not a billing unit.
+
+While an agent runs, a heartbeat every 5 minutes reports the host name, the agents' names, whether the read gate is on, and the accepted terms version. It never reports content, and the organisation can see and pause the node. The status line shows `node ✓ 2m` when NoData last verified it.
+
+## Run with your secrets — the agent never sees them
+
+`nodata_run` runs a command on your machine, such as tests, a migration or a deploy script, with the secrets of your NoData vault project. The secrets are passed as environment variables.
+
+- **Memory only.** The secrets are pulled into memory, through the same `/api/secrets/pull` the CLI uses, and every released value leaves a proof at NoData. No `.env` file is written.
+- **Blanked output.** The agent gets the exit code and the output, with every secret value blanked. That includes the base64, hex and URL-encoded forms, and any credential the scanner recognises.
+- **Every command needs your approval, as written.** Claude Code asks you in its own dialog. A client without one gets a preview and a single-use code bound to the exact command.
+
+Save the token once, in your terminal. Never paste it into the chat:
+
+```bash
+npx @nodatachat/mcp secrets-login --project acme-web   # token from Courier → 🔑 סודות → CLI token
+npx @nodatachat/mcp secrets-logout
+```
+
+**Honest limit:** a command that holds a secret can also leak it, for example by sending it out or printing it in an unknown form. Blanking protects the chat, not a hostile command, and that is why each command is approved as written.
+
 ## The read gate — a scan before the assistant reads
 
 The MCP tools keep values out of the model only when the model uses them; Claude Code can also

package/dist/gate.js

@@ -1,18 +1,18 @@
-/*! @nodatachat/mcp 1.3.2 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
-import{appendFileSync as Ye,copyFileSync as rn,existsSync as Qe,mkdirSync as et,readFileSync as tt,statSync as fe,writeFileSync as sn}from"node:fs";import{homedir as ue}from"node:os";import{basename as nt,extname as pe,isAbsolute as it,join as de,resolve as rt}from"node:path";var P=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];var ye=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],_e=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],be=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i;function S(t){if(!t)return null;let e=t.trim();if(be.test(e)||/^name$/i.test(e))return null;let n=e.replace(/[\s-]+/g,"_");for(let i of[..._e,...ye])if(i.pattern.test(e)||i.pattern.test(n))return{type:i.type,label:i.label};return null}function W(t){let e=String(t??"").replace(/\D/g,"");if(e.length===0||e.length>9)return!1;let n=e.padStart(9,"0"),i=0;for(let r=0;r<9;r++){let o=parseInt(n[r]??"0",10)*(r%2+1);o>9&&(o-=9),i+=o}return i%10===0&&parseInt(n,10)>0}function xe(t){let e=String(t??"").replace(/\D/g,"");if(e.length<12||e.length>19)return!1;let n=0,i=!1;for(let r=e.length-1;r>=0;r-=1){let o=parseInt(e[r]??"0",10);i&&(o*=2,o>9&&(o-=9)),n+=o,i=!i}return n%10===0}function ve(t){let e=String(t??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(e))return!1;let n=e.slice(4)+e.slice(0,4),i=0;for(let r of n){let o=r>="A"&&r<="Z"?String(r.charCodeAt(0)-55):r;for(let s of o)i=(i*10+Number(s))%97}return i===1}var L="(?<!\\d)(?<!\\d[.,])",R="(?!\\d)(?![.,]\\d)",K=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${L}\\d{9}${R}`,"g"),validate:W,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${L}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${R}`,"g"),validate:xe,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:ve,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${L}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${R}`,"g"),validate:t=>{let e=t.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(e)?!0:/^0[2-489]\d{7}$/.test(e)&&(/[- ]/.test(t)||t.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];function I(t,e){let n=[],i="",r=!1;for(let o=0;o<t.length;o++){let s=t[o];r?s==='"'&&t[o+1]==='"'?(i+='"',o++):s==='"'?r=!1:i+=s:s==='"'?r=!0:s===e?(n.push(i),i=""):i+=s}return n.push(i),n}import{inflateRawSync as Le}from"node:zlib";import{inflateSync as Se}from"node:zlib";var F=new Set([".pdf"]),X=8*1024*1024;function ke(t){let e=t.toString("latin1"),n=new Map,i=/(\d+)\s+(\d+)\s+obj\b/g,r;for(;(r=i.exec(e))!==null;){let o=Number(r[1]),s=i.lastIndex,a=e.indexOf("endobj",s);if(a<0)continue;let l=e.indexOf("stream",s),d,f=null;if(l>=0&&l<a){d=e.slice(s,l);let u=l+6;e[u]==="\r"&&(u+=1),e[u]===`
-`&&(u+=1);let c=e.indexOf("endstream",u);c>u&&(f=t.subarray(u,c))}else d=e.slice(s,a);n.set(o,{num:o,dict:d,stream:f})}return n}function we(t){let e=t.toString("latin1").replace(/\s/g,"");e.startsWith("<~")&&(e=e.slice(2));let n=e.indexOf("~>");n>=0&&(e=e.slice(0,n));let i=[],r=0,o=0;for(let s of e){if(s==="z"&&o===0){i.push(0,0,0,0);continue}let a=s.charCodeAt(0)-33;if(a<0||a>84)return null;r=r*85+a,o+=1,o===5&&(i.push(r>>>24&255,r>>>16&255,r>>>8&255,r&255),r=0,o=0)}if(o>0){for(let a=o;a<5;a+=1)r=r*85+84;let s=[r>>>24&255,r>>>16&255,r>>>8&255,r&255];for(let a=0;a<o-1;a+=1)i.push(s[a]??0)}return Buffer.from(i)}function Ee(t){let e=t.toString("latin1").replace(/\s/g,"").split(">")[0]??"",n=e.length%2?e+"0":e;return/^[0-9A-Fa-f]*$/.test(n)?Buffer.from(n,"hex"):null}function $e(t){let e=/\/Filter\s*(\[[^\]]*\]|\/\w+)/.exec(t);return!e||!e[1]?[]:[...e[1].matchAll(/\/(\w+)/g)].map(n=>n[1]??"")}function J(t){if(!t.stream)return null;let e=t.stream;for(let n of $e(t.dict)){let i=null;if(n==="FlateDecode")try{i=Se(e)}catch{return null}else if(n==="ASCII85Decode")i=we(e);else if(n==="ASCIIHexDecode")i=Ee(e);else return null;if(i===null)return null;e=i}return e.toString("latin1")}function Ie(t){let e=new Map,n=1,i=/begincodespacerange([\s\S]*?)endcodespacerange/.exec(t);if(i&&i[1]){let l=/<([0-9A-Fa-f]+)>/.exec(i[1]);l&&l[1]&&l[1].length>=4&&(n=2)}let r=l=>{let d="";for(let f=0;f+3<l.length+1;f+=4){let u=parseInt(l.slice(f,f+4),16);Number.isFinite(u)&&u>0&&(d+=String.fromCharCode(u))}return d},o=/beginbfchar([\s\S]*?)endbfchar/g,s;for(;(s=o.exec(t))!==null;){let l=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,d;for(;(d=l.exec(s[1]??""))!==null;)e.set(parseInt(d[1]??"0",16),r(d[2]??""))}let a=/beginbfrange([\s\S]*?)endbfrange/g;for(;(s=a.exec(t))!==null;){let l=s[1]??"",d=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,f;for(;(f=d.exec(l))!==null;){let u=parseInt(f[1]??"0",16),c=parseInt(f[2]??"0",16),p=parseInt((f[3]??"0").slice(0,4)||"0",16);if(!(c-u>65535))for(let m=u;m<=c;m+=1)e.set(m,String.fromCharCode(p+(m-u)))}}return{map:e,bytes:n}}function Ae(t){let e=new Map,n=new Map,i=[];for(let r of t.values()){let o=/\/Font\s*<<([\s\S]*?)>>/.exec(r.dict);o?.[1]&&i.push(o[1]);let s=/\/Font\s+(\d+)\s+\d+\s+R/.exec(r.dict);if(s){let a=t.get(Number(s[1]));a&&i.push(a.dict)}}for(let r of i){let o=/\/([^\s/<>[\]()]+)\s+(\d+)\s+\d+\s+R/g,s;for(;(s=o.exec(r))!==null;)n.set(s[1]??"",Number(s[2]))}for(let[r,o]of n){let s=t.get(o);if(!s)continue;let a=/\/ToUnicode\s+(\d+)\s+\d+\s+R/.exec(s.dict);if(!a)continue;let l=t.get(Number(a[1]));if(!l)continue;let d=J(l);d&&e.set(r,Ie(d))}return e}function q(t){let e=[];for(let n=0;n<t.length;n+=1){let i=t[n];if(i!=="\\"){e.push(i.charCodeAt(0)&255);continue}let r=t[n+1];if(r===void 0)break;if(r>="0"&&r<="7"){let s="",a=n+1;for(;a<t.length&&s.length<3&&t[a]>="0"&&t[a]<="7";)s+=t[a],a+=1;e.push(parseInt(s,8)&255),n=a-1;continue}let o={n:10,r:13,t:9,b:8,f:12};e.push(o[r]??r.charCodeAt(0)&255),n+=1}return e}function Y(t){if(t.length<2||t[0]!==254||t[1]!==255)return null;let e="";for(let n=2;n+1<t.length;n+=2)e+=String.fromCharCode((t[n]??0)<<8|(t[n+1]??0));return e}function G(t,e){let n=Y(t);if(n!==null)return n;if(!e)return t.map(r=>String.fromCharCode(r)).join("");let i="";if(e.bytes===2)for(let r=0;r+1<t.length;r+=2){let o=(t[r]??0)<<8|(t[r+1]??0);i+=e.map.get(o)??""}else for(let r of t)i+=e.map.get(r)??String.fromCharCode(r);return i}function Ce(t,e){let n="",i,r=/\/([^\s/<>[\]()]+)\s+[\d.]+\s+Tf|\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>|TJ|Tj|'|"/g,o,s="";for(;(o=r.exec(t))!==null;){let a=o[0];if(a.endsWith("Tf")){i=e.get(o[1]??"");continue}if(a==="TJ"||a==="Tj"||a==="'"||a==='"'){s&&(n+=s+`
-`,s="");continue}if(a.startsWith("("))s+=G(q(a.slice(1,-1)),i);else if(a.startsWith("<")){let l=a.slice(1,-1).replace(/\s+/g,""),d=[];for(let f=0;f+1<l.length;f+=2)d.push(parseInt(l.slice(f,f+2),16));s+=G(d,i)}}return s&&(n+=s+`
-`),n}function Te(t,e){let n=t.toString("latin1"),i=/\/Info\s+(\d+)\s+\d+\s+R/.exec(n),r=i?e.get(Number(i[1]))?.dict:void 0;if(!r)return"";let o=[],s=/\/(Author|Title|Subject|Keywords|Creator|Producer)\s*(\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>)/g,a;for(;(a=s.exec(r))!==null;){let l=a[2]??"";if(l.startsWith("(")){let d=q(l.slice(1,-1));o.push(Y(d)??d.map(f=>String.fromCharCode(f)).join(""))}else{let d=l.slice(1,-1).replace(/\s+/g,""),f="";if(d.toUpperCase().startsWith("FEFF"))for(let u=4;u+3<d.length+1;u+=4)f+=String.fromCharCode(parseInt(d.slice(u,u+4),16));else for(let u=0;u+1<d.length;u+=2)f+=String.fromCharCode(parseInt(d.slice(u,u+2),16));o.push(f)}}return o.join(`
-`)}function Q(t){if(!t.subarray(0,8).toString("latin1").startsWith("%PDF-")||t.toString("latin1",0,Math.min(t.length,4096)).includes("/Encrypt"))return null;let n=ke(t);if(n.size===0)return null;let i=Ae(n),r=[];r.push(Te(t,n));let o=0,s=0,a=!1;for(let l of n.values()){if(!l.stream||/\/Subtype|\/Type\s*\/(XObject|Font|Metadata)|\/FontFile/.test(l.dict))continue;let d=J(l);if(d===null||!/(TJ|Tj)\b/.test(d))continue;let f=Ce(d,i);if(f.trim().length!==0){if(s+=1,o+f.length>X){r.push(f.slice(0,Math.max(0,X-o))),a=!0;break}r.push(f),o+=f.length}}return s===0?null:{text:r.join(`
-`),truncated:a,streams:s}}var ee=new Set([".xlsx",".xlsm",".docx",".pptx"]),D=8*1024*1024,Re=101010256,Pe=33639248,Fe=67324752;function N(t){let e=Math.min(t.length,67584),n=-1;for(let s=t.length-22;s>=t.length-e&&s>=0;s-=1)if(t.readUInt32LE(s)===Re){n=s;break}if(n<0)return null;let i=t.readUInt16LE(n+10),r=t.readUInt32LE(n+16);if(r>=t.length)return null;let o=[];for(let s=0;s<i&&!(r+46>t.length||t.readUInt32LE(r)!==Pe);s+=1){let a=t.readUInt16LE(r+10),l=t.readUInt32LE(r+20),d=t.readUInt32LE(r+24),f=t.readUInt16LE(r+28),u=t.readUInt16LE(r+30),c=t.readUInt16LE(r+32),p=t.readUInt32LE(r+42),m=t.subarray(r+46,r+46+f).toString("utf8");o.push({name:m,method:a,compSize:l,uncompSize:d,localHeaderOffset:p}),r+=46+f+u+c}return o}function U(t,e){let n=e.localHeaderOffset;if(n+30>t.length||t.readUInt32LE(n)!==Fe)return null;let i=t.readUInt16LE(n+26),r=t.readUInt16LE(n+28),o=n+30+i+r,s=o+e.compSize;if(s>t.length)return null;let a=t.subarray(o,s);try{if(e.method===0)return Buffer.from(a);if(e.method===8)return Le(a)}catch{return null}return null}function De(t,e){return U(t,e)?.toString("utf8")??null}var Ne={"&amp;":"&","&lt;":"<","&gt;":">","&quot;":'"',"&apos;":"'"};function x(t){return t.replace(/&(amp|lt|gt|quot|apos);/g,e=>Ne[e]??e).replace(/&#(\d+);/g,(e,n)=>{let i=Number(n);return i>0&&i<1114112?String.fromCodePoint(i):""}).replace(/&#x([0-9a-fA-F]+);/g,(e,n)=>{let i=parseInt(n,16);return i>0&&i<1114112?String.fromCodePoint(i):""})}function Ue(t){return x(t.replace(/<[^>]*>/g,`
+/*! @nodatachat/mcp 1.3.10 | Copyright 2026 Capsule Ltd. | FSL-1.1-ALv2 | see LICENSE.md */
+import{appendFileSync as Dt,copyFileSync as hi,existsSync as Nt,mkdirSync as zt,readFileSync as Mt,statSync as Ce,writeFileSync as mi}from"node:fs";import{homedir as Re}from"node:os";import{basename as Ot,extname as Pe,isAbsolute as jt,join as Te,resolve as Bt}from"node:path";var b={text:[],header:[],secrets:[],table:null};function W(t){t.table&&(b.table=t.table);for(let e of t.text??[])b.text.some(n=>n.kind===e.kind)||b.text.push(e);t.header&&!b.header.includes(t.header)&&b.header.push(t.header);for(let e of t.secrets??[])b.secrets.some(n=>n.id===e.id)||b.secrets.push(e)}function V(){return b.text}function ce(){return b.header}function A(){return b.table}var le=[{id:"aws-access-key",name:"AWS Access Key",pattern:/(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)/,severity:"critical"},{id:"aws-secret-key",name:"AWS Secret Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/,severity:"critical"},{id:"gcp-api-key",name:"GCP API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"critical"},{id:"gcp-service-account",name:"GCP Service Account",pattern:/"type"\s*:\s*"service_account"/,severity:"critical"},{id:"github-token",name:"GitHub Token",pattern:/gh[pousr]_[0-9a-zA-Z]{36,}/,severity:"critical"},{id:"github-fine-grained",name:"GitHub Fine-Grained Token",pattern:/github_pat_[0-9a-zA-Z_]{22,}/,severity:"critical"},{id:"gitlab-token",name:"GitLab Token",pattern:/glpat-[0-9a-zA-Z_-]{20,}/,severity:"critical"},{id:"stripe-secret",name:"Stripe Secret Key",pattern:/sk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"stripe-restricted",name:"Stripe Restricted Key",pattern:/rk_live_[0-9a-zA-Z]{24,}/,severity:"critical"},{id:"slack-token",name:"Slack Token",pattern:/xox[baprs]-[0-9a-zA-Z-]{10,}/,severity:"high"},{id:"slack-webhook",name:"Slack Webhook",pattern:/hooks\.slack\.com\/services\/T[0-9A-Z]{8,}\/B[0-9A-Z]{8,}\/[0-9a-zA-Z]{24}/,severity:"high"},{id:"twilio-api-key",name:"Twilio API Key",pattern:/SK[0-9a-fA-F]{32}/,severity:"high"},{id:"sendgrid-api-key",name:"SendGrid API Key",pattern:/SG\.[0-9a-zA-Z_-]{22}\.[0-9a-zA-Z_-]{43}/,severity:"critical"},{id:"postgres-uri",name:"PostgreSQL Connection String",pattern:/postgres(?:ql)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"mongodb-uri",name:"MongoDB Connection String",pattern:/mongodb(?:\+srv)?:\/\/[^\s'"]{10,}/,severity:"critical"},{id:"redis-uri",name:"Redis Connection String",pattern:/redis(?:s)?:\/\/[^\s'"]{10,}/,severity:"high"},{id:"openai-key",name:"OpenAI API Key",pattern:/sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}/,severity:"critical"},{id:"anthropic-key",name:"Anthropic API Key",pattern:/sk-ant-[0-9a-zA-Z_-]{40,}/,severity:"critical"},{id:"firebase-key",name:"Firebase API Key",pattern:/AIza[0-9A-Za-z_-]{35}/,severity:"high"},{id:"supabase-key",name:"Supabase Service Key",pattern:/eyJ[0-9a-zA-Z_-]{100,}/,severity:"critical"},{id:"private-key",name:"Private Key",pattern:/-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,severity:"critical"},{id:"jwt-secret",name:"JWT/Generic Secret",pattern:/(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"password-in-code",name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{8,}['"]/,severity:"high"},{id:"bearer-token",name:"Bearer Token in Code",pattern:/['"]Bearer\s+[0-9a-zA-Z._-]{20,}['"]/,severity:"high"}];var Ke=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Salary / income"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication|prescription)$/i,type:"medical",label:"Medical"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Policy"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation"}],Ge=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם הלקוח|שם בן זוג|שם המבוטח|שם המוטב|שם הילד|שם הקטין)$/i,type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מס' זהות|teudat_zehut|tz|israeli_id|il_id)$/i,type:"id",label:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה)$/i,type:"id",label:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|אימייל|כתובת מייל)$/i,type:"email",label:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|טלפון נייד)$/i,type:"phone",label:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|רחוב|מס בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|מען)$/i,type:"address",label:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|ת לידה|תאריך הולדת|יום הולדת|גיל)$/i,type:"dob",label:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|מספר חשבון|מס חשבון|סניף|iban|iban_il)$/i,type:"financial",label:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|מספר אשראי|cvv|אשראי)$/i,type:"financial",label:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|מצב רפואי|חיסון|רגישות|אלרגיה|סוג דם)$/i,type:"medical",label:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מס פוליסה|פוליסה|מספר חבר|מספר ביטוח)$/i,type:"id",label:"\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4/\u05D7\u05D1\u05E8\u05D5\u05EA"},{pattern:/^(?:שם הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|תעודת לידה)$/i,type:"minor_data",label:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|השקפה פוליטית|מצב משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מס רכב|לוחית רישוי|מספר רישוי)$/i,type:"tracking",label:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}],Xe=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|enabled|active|public|version|metadata|config|settings|data|content|note|comment|label|color|icon)$/i,Je=/^שם[ _](?:ה)?(?:קובץ|מוצר|פריט|חברה|ארגון|עסק|פרויקט|גיליון|טבלה|שדה|קטגוריה|סניף|בנק|עיר|רחוב|ישוב|יישוב|מסמך|תוכנית|חבילה|קורס|מחלקה|אתר|דומיין|מותג|ספק|שירות|תפקיד)$|^(file|product|item|company|org|organization|project|sheet|table|field|category|branch|bank|city|street|document|plan|course|department|site|domain|brand|vendor|service|role)[ _-]?name$/i;function $(t){if(!t)return null;let e=t.trim();if(Xe.test(e)||/^name$/i.test(e))return null;let n=e.replace(/[\s-]+/g,"_");for(let i of[...Ge,...Ke])if(i.pattern.test(e)||i.pattern.test(n))return{type:i.type,label:i.label};if(Je.test(e))return null;if(/^שם[ _][\u0590-\u05FF"'׳ ]{2,20}$/.test(e))return{type:"name",label:"\u05E9\u05DD \u05D0\u05D3\u05DD"};if(/^(customer|client|employee|inspector|supervisor|contact|person|patient|user|owner|manager|agent|member|driver|tenant|student|parent|beneficiary|insured)_?(full_?)?name$/i.test(n))return{type:"name",label:"Person name"};for(let i of ce()){let r=i(e);if(r)return{type:r.type,label:r.label}}return null}function de(t){let e=String(t??"").replace(/\D/g,"");if(e.length===0||e.length>9)return!1;let n=e.padStart(9,"0"),i=0;for(let r=0;r<9;r++){let s=parseInt(n[r]??"0",10)*(r%2+1);s>9&&(s-=9),i+=s}return i%10===0&&parseInt(n,10)>0}function qe(t){let e=String(t??"").replace(/\D/g,"");if(e.length<12||e.length>19)return!1;let n=0,i=!1;for(let r=e.length-1;r>=0;r-=1){let s=parseInt(e[r]??"0",10);i&&(s*=2,s>9&&(s-=9)),n+=s,i=!i}return n%10===0}function Ye(t){let e=String(t??"").replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(e))return!1;let n=e.slice(4)+e.slice(0,4),i=0;for(let r of n){let s=r>="A"&&r<="Z"?String(r.charCodeAt(0)-55):r;for(let a of s)i=(i*10+Number(a))%97}return i===1}var K="(?<!\\d)(?<!\\d[.,])",G="(?!\\d)(?![.,]\\d)",pe=[{subkind:"israeli_id",severity:"high",pattern:new RegExp(`${K}\\d{9}${G}`,"g"),validate:de,hint:"Israeli national ID (check digit verified) in plaintext. Encrypt the column or mask it at rest."},{subkind:"credit_card",severity:"critical",pattern:new RegExp(`${K}[2-6][ -]?(?:\\d[ -]?){11,17}\\d${G}`,"g"),validate:qe,hint:"Payment card number (Luhn verified) in plaintext. This is PCI scope."},{subkind:"iban",severity:"high",pattern:/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,4})?\b/g,validate:Ye,hint:"Bank account in IBAN form (mod-97 verified) in plaintext."},{subkind:"israeli_phone",severity:"medium",pattern:new RegExp(`${K}(?:\\+972[- ]?|0)(?:[57]\\d|[2-489])[- ]?\\d{3}[- ]?\\d{4}${G}`,"g"),validate:t=>{let e=t.replace(/\D/g,"").replace(/^972/,"0");return/^0[57]\d{8}$/.test(e)?!0:/^0[2-489]\d{7}$/.test(e)&&(/[- ]/.test(t)||t.startsWith("+972"))},hint:"Israeli phone number in plaintext."}];function R(t,e){let n=[],i="",r=!1;for(let s=0;s<t.length;s++){let a=t[s];r?a==='"'&&t[s+1]==='"'?(i+='"',s++):a==='"'?r=!1:i+=a:a==='"'?r=!0:a===e?(n.push(i),i=""):i+=a}return n.push(i),n}import{inflateRawSync as ct}from"node:zlib";import{inflateSync as Qe}from"node:zlib";var X=new Set([".pdf"]),ue=8*1024*1024;function et(t){let e=t.toString("latin1"),n=new Map,i=/(\d+)\s+(\d+)\s+obj\b/g,r;for(;(r=i.exec(e))!==null;){let s=Number(r[1]),a=i.lastIndex,o=e.indexOf("endobj",a);if(o<0)continue;let c=e.indexOf("stream",a),l,u=null;if(c>=0&&c<o){l=e.slice(a,c);let d=c+6;e[d]==="\r"&&(d+=1),e[d]===`
+`&&(d+=1);let f=e.indexOf("endstream",d);f>d&&(u=t.subarray(d,f))}else l=e.slice(a,o);n.set(s,{num:s,dict:l,stream:u})}return n}function tt(t){let e=t.toString("latin1").replace(/\s/g,"");e.startsWith("<~")&&(e=e.slice(2));let n=e.indexOf("~>");n>=0&&(e=e.slice(0,n));let i=[],r=0,s=0;for(let a of e){if(a==="z"&&s===0){i.push(0,0,0,0);continue}let o=a.charCodeAt(0)-33;if(o<0||o>84)return null;r=r*85+o,s+=1,s===5&&(i.push(r>>>24&255,r>>>16&255,r>>>8&255,r&255),r=0,s=0)}if(s>0){for(let o=s;o<5;o+=1)r=r*85+84;let a=[r>>>24&255,r>>>16&255,r>>>8&255,r&255];for(let o=0;o<s-1;o+=1)i.push(a[o]??0)}return Buffer.from(i)}function nt(t){let e=t.toString("latin1").replace(/\s/g,"").split(">")[0]??"",n=e.length%2?e+"0":e;return/^[0-9A-Fa-f]*$/.test(n)?Buffer.from(n,"hex"):null}function it(t){let e=/\/Filter\s*(\[[^\]]*\]|\/\w+)/.exec(t);return!e||!e[1]?[]:[...e[1].matchAll(/\/(\w+)/g)].map(n=>n[1]??"")}function he(t){if(!t.stream)return null;let e=t.stream;for(let n of it(t.dict)){let i=null;if(n==="FlateDecode")try{i=Qe(e)}catch{return null}else if(n==="ASCII85Decode")i=tt(e);else if(n==="ASCIIHexDecode")i=nt(e);else return null;if(i===null)return null;e=i}return e.toString("latin1")}function rt(t){let e=new Map,n=1,i=/begincodespacerange([\s\S]*?)endcodespacerange/.exec(t);if(i&&i[1]){let c=/<([0-9A-Fa-f]+)>/.exec(i[1]);c&&c[1]&&c[1].length>=4&&(n=2)}let r=c=>{let l="";for(let u=0;u+3<c.length+1;u+=4){let d=parseInt(c.slice(u,u+4),16);Number.isFinite(d)&&d>0&&(l+=String.fromCharCode(d))}return l},s=/beginbfchar([\s\S]*?)endbfchar/g,a;for(;(a=s.exec(t))!==null;){let c=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,l;for(;(l=c.exec(a[1]??""))!==null;)e.set(parseInt(l[1]??"0",16),r(l[2]??""))}let o=/beginbfrange([\s\S]*?)endbfrange/g;for(;(a=o.exec(t))!==null;){let c=a[1]??"",l=/<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]+)>\s*<([0-9A-Fa-f]*)>/g,u;for(;(u=l.exec(c))!==null;){let d=parseInt(u[1]??"0",16),f=parseInt(u[2]??"0",16),p=parseInt((u[3]??"0").slice(0,4)||"0",16);if(!(f-d>65535))for(let h=d;h<=f;h+=1)e.set(h,String.fromCharCode(p+(h-d)))}}return{map:e,bytes:n}}function st(t){let e=new Map,n=new Map,i=[];for(let r of t.values()){let s=/\/Font\s*<<([\s\S]*?)>>/.exec(r.dict);s?.[1]&&i.push(s[1]);let a=/\/Font\s+(\d+)\s+\d+\s+R/.exec(r.dict);if(a){let o=t.get(Number(a[1]));o&&i.push(o.dict)}}for(let r of i){let s=/\/([^\s/<>[\]()]+)\s+(\d+)\s+\d+\s+R/g,a;for(;(a=s.exec(r))!==null;)n.set(a[1]??"",Number(a[2]))}for(let[r,s]of n){let a=t.get(s);if(!a)continue;let o=/\/ToUnicode\s+(\d+)\s+\d+\s+R/.exec(a.dict);if(!o)continue;let c=t.get(Number(o[1]));if(!c)continue;let l=he(c);l&&e.set(r,rt(l))}return e}function me(t){let e=[];for(let n=0;n<t.length;n+=1){let i=t[n];if(i!=="\\"){e.push(i.charCodeAt(0)&255);continue}let r=t[n+1];if(r===void 0)break;if(r>="0"&&r<="7"){let a="",o=n+1;for(;o<t.length&&a.length<3&&t[o]>="0"&&t[o]<="7";)a+=t[o],o+=1;e.push(parseInt(a,8)&255),n=o-1;continue}let s={n:10,r:13,t:9,b:8,f:12};e.push(s[r]??r.charCodeAt(0)&255),n+=1}return e}function ge(t){if(t.length<2||t[0]!==254||t[1]!==255)return null;let e="";for(let n=2;n+1<t.length;n+=2)e+=String.fromCharCode((t[n]??0)<<8|(t[n+1]??0));return e}function fe(t,e){let n=ge(t);if(n!==null)return n;if(!e)return t.map(r=>String.fromCharCode(r)).join("");let i="";if(e.bytes===2)for(let r=0;r+1<t.length;r+=2){let s=(t[r]??0)<<8|(t[r+1]??0);i+=e.map.get(s)??""}else for(let r of t)i+=e.map.get(r)??String.fromCharCode(r);return i}function at(t,e){let n="",i,r=/\/([^\s/<>[\]()]+)\s+[\d.]+\s+Tf|\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>|TJ|Tj|'|"/g,s,a="";for(;(s=r.exec(t))!==null;){let o=s[0];if(o.endsWith("Tf")){i=e.get(s[1]??"");continue}if(o==="TJ"||o==="Tj"||o==="'"||o==='"'){a&&(n+=a+`
+`,a="");continue}if(o.startsWith("("))a+=fe(me(o.slice(1,-1)),i);else if(o.startsWith("<")){let c=o.slice(1,-1).replace(/\s+/g,""),l=[];for(let u=0;u+1<c.length;u+=2)l.push(parseInt(c.slice(u,u+2),16));a+=fe(l,i)}}return a&&(n+=a+`
+`),n}function ot(t,e){let n=t.toString("latin1"),i=/\/Info\s+(\d+)\s+\d+\s+R/.exec(n),r=i?e.get(Number(i[1]))?.dict:void 0;if(!r)return"";let s=[],a=/\/(Author|Title|Subject|Keywords|Creator|Producer)\s*(\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>)/g,o;for(;(o=a.exec(r))!==null;){let c=o[2]??"";if(c.startsWith("(")){let l=me(c.slice(1,-1));s.push(ge(l)??l.map(u=>String.fromCharCode(u)).join(""))}else{let l=c.slice(1,-1).replace(/\s+/g,""),u="";if(l.toUpperCase().startsWith("FEFF"))for(let d=4;d+3<l.length+1;d+=4)u+=String.fromCharCode(parseInt(l.slice(d,d+4),16));else for(let d=0;d+1<l.length;d+=2)u+=String.fromCharCode(parseInt(l.slice(d,d+2),16));s.push(u)}}return s.join(`
+`)}function ye(t){if(!t.subarray(0,8).toString("latin1").startsWith("%PDF-")||t.toString("latin1",0,Math.min(t.length,4096)).includes("/Encrypt"))return null;let n=et(t);if(n.size===0)return null;let i=st(n),r=[];r.push(ot(t,n));let s=0,a=0,o=!1;for(let c of n.values()){if(!c.stream||/\/Subtype|\/Type\s*\/(XObject|Font|Metadata)|\/FontFile/.test(c.dict))continue;let l=he(c);if(l===null||!/(TJ|Tj)\b/.test(l))continue;let u=at(l,i);if(u.trim().length!==0){if(a+=1,s+u.length>ue){r.push(u.slice(0,Math.max(0,ue-s))),o=!0;break}r.push(u),s+=u.length}}return a===0?null:{text:r.join(`
+`),truncated:o,streams:a}}var be=new Set([".xlsx",".xlsm",".docx",".pptx"]),J=8*1024*1024,lt=101010256,dt=33639248,pt=67324752;function q(t){let e=Math.min(t.length,67584),n=-1;for(let a=t.length-22;a>=t.length-e&&a>=0;a-=1)if(t.readUInt32LE(a)===lt){n=a;break}if(n<0)return null;let i=t.readUInt16LE(n+10),r=t.readUInt32LE(n+16);if(r>=t.length)return null;let s=[];for(let a=0;a<i&&!(r+46>t.length||t.readUInt32LE(r)!==dt);a+=1){let o=t.readUInt16LE(r+10),c=t.readUInt32LE(r+20),l=t.readUInt32LE(r+24),u=t.readUInt16LE(r+28),d=t.readUInt16LE(r+30),f=t.readUInt16LE(r+32),p=t.readUInt32LE(r+42),h=t.subarray(r+46,r+46+u).toString("utf8");s.push({name:h,method:o,compSize:c,uncompSize:l,localHeaderOffset:p}),r+=46+u+d+f}return s}function Y(t,e){let n=e.localHeaderOffset;if(n+30>t.length||t.readUInt32LE(n)!==pt)return null;let i=t.readUInt16LE(n+26),r=t.readUInt16LE(n+28),s=n+30+i+r,a=s+e.compSize;if(a>t.length)return null;let o=t.subarray(s,a);try{if(e.method===0)return Buffer.from(o);if(e.method===8)return ct(o)}catch{return null}return null}function ut(t,e){return Y(t,e)?.toString("utf8")??null}var ft={"&amp;":"&","&lt;":"<","&gt;":">","&quot;":'"',"&apos;":"'"};function x(t){return t.replace(/&(amp|lt|gt|quot|apos);/g,e=>ft[e]??e).replace(/&#(\d+);/g,(e,n)=>{let i=Number(n);return i>0&&i<1114112?String.fromCodePoint(i):""}).replace(/&#x([0-9a-fA-F]+);/g,(e,n)=>{let i=parseInt(n,16);return i>0&&i<1114112?String.fromCodePoint(i):""})}function ht(t){return x(t.replace(/<[^>]*>/g,`
 `)).replace(/\n{2,}/g,`
-`)}function je(t,e,n){let i=new RegExp(`<${e}\\b[^>]*\\b${n}="([^"]*)"`,"g"),r=[],o;for(;(o=i.exec(t))!==null;)o[1]&&r.push(x(o[1]));return r}function Oe(t,e){let n=[];for(let i of e)(i==="docProps/core.xml"||i==="docProps/app.xml")&&n.push(i);if(t===".xlsx"||t===".xlsm")for(let i of e)(i==="xl/sharedStrings.xml"||i==="xl/workbook.xml"||/^xl\/worksheets\/sheet\d+\.xml$/.test(i)||/^xl\/comments\d*\.xml$/.test(i))&&n.push(i);else if(t===".docx")for(let i of e)(i==="word/document.xml"||/^word\/(header|footer|footnotes|endnotes|comments)\d*\.xml$/.test(i))&&n.push(i);else if(t===".pptx")for(let i of e)/^ppt\/(slides|notesSlides)\/(slide|notesSlide)\d+\.xml$/.test(i)&&n.push(i);return n}function ze(t,e){let n=N(t);if(!n||n.length===0)return null;let i=new Map(n.map(d=>[d.name,d])),r=Oe(e,n.map(d=>d.name));if(r.length===0)return null;let o=[],s=[],a=0,l=!1;for(let d of r){if(a>=D){l=!0;break}let f=i.get(d);if(!f)continue;let u=De(t,f);if(u===null)continue;let c=Ue(u);if(d==="xl/workbook.xml"){let p=je(u,"sheet","name");p.length&&(c+=`
+`)}function mt(t,e,n){let i=new RegExp(`<${e}\\b[^>]*\\b${n}="([^"]*)"`,"g"),r=[],s;for(;(s=i.exec(t))!==null;)s[1]&&r.push(x(s[1]));return r}function gt(t,e){let n=[];for(let i of e)(i==="docProps/core.xml"||i==="docProps/app.xml")&&n.push(i);if(t===".xlsx"||t===".xlsm")for(let i of e)(i==="xl/sharedStrings.xml"||i==="xl/workbook.xml"||/^xl\/worksheets\/sheet\d+\.xml$/.test(i)||/^xl\/comments\d*\.xml$/.test(i))&&n.push(i);else if(t===".docx")for(let i of e)(i==="word/document.xml"||/^word\/(header|footer|footnotes|endnotes|comments)\d*\.xml$/.test(i))&&n.push(i);else if(t===".pptx")for(let i of e)/^ppt\/(slides|notesSlides)\/(slide|notesSlide)\d+\.xml$/.test(i)&&n.push(i);return n}function yt(t,e){let n=q(t);if(!n||n.length===0)return null;let i=new Map(n.map(l=>[l.name,l])),r=gt(e,n.map(l=>l.name));if(r.length===0)return null;let s=[],a=[],o=0,c=!1;for(let l of r){if(o>=J){c=!0;break}let u=i.get(l);if(!u)continue;let d=ut(t,u);if(d===null)continue;let f=ht(d);if(l==="xl/workbook.xml"){let p=mt(d,"sheet","name");p.length&&(f+=`
 `+p.join(`
-`))}a+c.length>D&&(c=c.slice(0,Math.max(0,D-a)),l=!0),c.trim().length!==0&&(o.push(c),s.push(d),a+=c.length)}return o.length===0?null:{text:o.join(`
-`),truncated:l,parts:s}}function j(t,e){if(ee.has(e))return ze(t,e);if(F.has(e)){let n=Q(t);return n?{text:n.text,truncated:n.truncated,parts:[`pdf:${n.streams}-streams`]}:null}return null}var Be=new Set([...ee,...F]);var At=64*1024*1024,Ct=32*1024;var te={israeli_id:"[ID]",credit_card:"[CARD]",iban:"[IBAN]",israeli_phone:"[PHONE]",email:"[EMAIL]"},Ze=/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g,Me=[...K].sort((t,e)=>+(e.subkind==="iban")-+(t.subkind==="iban"));function O(t,e,n=1){t[e]=(t[e]??0)+n}function b(t,e={}){let n=t;for(let i of Me)i.pattern.lastIndex=0,n=n.replace(i.pattern,r=>i.validate(r)?(O(e,i.subkind),te[i.subkind]??`[${i.subkind.toUpperCase()}]`):r);return n=n.replace(Ze,()=>(O(e,"email"),te.email)),{text:n,counts:e,columnsHidden:[]}}function ne(t,e){return t.includes(e)||t.includes('"')||t.includes(`
-`)?`"${t.replace(/"/g,'""')}"`:t}function Ve(t){let e=(t.match(/\t/g)??[]).length,n=(t.match(/;/g)??[]).length,i=(t.match(/,/g)??[]).length;return e>i&&e>=n?"	":n>i?";":","}function z(t,e){let n=t.split(/\r?\n/),i=e??Ve(n[0]??""),r=I(n[0]??"",i),o=r.map(l=>S(l)),s={},a=[r.map(l=>ne(l,i)).join(i)];for(let l of n.slice(1)){if(l===""){a.push(l);continue}let d=I(l,i).map((f,u)=>{let c=o[u];return c&&f.trim()!==""?(O(s,`column:${c.type}`),`[${c.type.toUpperCase()}]`):b(f,s).text});a.push(d.map(f=>ne(f,i)).join(i))}return{text:a.join(`
-`),counts:s,columnsHidden:r.filter((l,d)=>o[d])}}import{deflateRawSync as He}from"node:zlib";var We=/^xl\/(pivotCache|charts|externalLinks)\//,Ke=10;function Xe(t,e,n=1){t[e]=(t[e]??0)+n}function oe(t){return t.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function ae(t){let e=t.replace(/<rPh\b[\s\S]*?<\/rPh>/g,""),n="";for(let i of e.matchAll(/<t(?:\s[^>]*)?>([\s\S]*?)<\/t>/g))n+=i[1];return x(n)}function Ge(t){return t?[...t.matchAll(/<si\b[^>]*>([\s\S]*?)<\/si>|<si\b[^>]*\/>/g)].map(e=>ae(e[1]??"")):[]}var ie=/<c\b([^>]*?)(?:\/>|>([\s\S]*?)<\/c>)/g;function A(t,e){let n=new RegExp(`\\b${e}="([^"]*)"`).exec(t);return n?n[1]:null}function re(t,e){if(t.type==="s"){let i=/<v>([^<]*)<\/v>/.exec(t.inner);return i?e[Number(i[1])]??null:null}if(t.type==="inlineStr"){let i=/<is>([\s\S]*?)<\/is>/.exec(t.inner);return i?ae(i[1]):null}if(t.type==="b"||t.type==="e")return null;let n=/<v>([^<]*)<\/v>/.exec(t.inner);return n?x(n[1]):null}function se(t,e){return`<c${t.replace(/\s*\bt="[^"]*"/,"")} t="inlineStr"><is><t xml:space="preserve">${oe(e)}</t></is></c>`}var Je=(()=>{let t=new Uint32Array(256);for(let e=0;e<256;e+=1){let n=e;for(let i=0;i<8;i+=1)n=n&1?3988292384^n>>>1:n>>>1;t[e]=n>>>0}return t})();function qe(t){let e=4294967295;for(let n=0;n<t.length;n+=1)e=Je[(e^t[n])&255]^e>>>8;return(e^4294967295)>>>0}function ce(t){let e=[],n=[],i=0;for(let s of t){let a=Buffer.from(s.name,"utf8"),l=s.name.endsWith("/"),d=l?Buffer.alloc(0):He(s.data),f=l?0:8,u=l?0:qe(s.data),c=Buffer.alloc(30);c.writeUInt32LE(67324752,0),c.writeUInt16LE(20,4),c.writeUInt16LE(2048,6),c.writeUInt16LE(f,8),c.writeUInt32LE(u,14),c.writeUInt32LE(d.length,18),c.writeUInt32LE(s.data.length,22),c.writeUInt16LE(a.length,26),e.push(c,a,d);let p=Buffer.alloc(46);p.writeUInt32LE(33639248,0),p.writeUInt16LE(20,4),p.writeUInt16LE(20,6),p.writeUInt16LE(2048,8),p.writeUInt16LE(f,10),p.writeUInt32LE(u,16),p.writeUInt32LE(d.length,20),p.writeUInt32LE(s.data.length,24),p.writeUInt16LE(a.length,28),p.writeUInt32LE(i,42),n.push(p,a),i+=c.length+a.length+d.length}let r=Buffer.concat(n),o=Buffer.alloc(22);return o.writeUInt32LE(101010256,0),o.writeUInt16LE(t.length,8),o.writeUInt16LE(t.length,10),o.writeUInt32LE(r.length,12),o.writeUInt32LE(i,16),Buffer.concat([...e,r,o])}function B(t){let e=N(t);if(!e||e.length===0||e.some(c=>We.test(c.name)))return null;let n=new Map;for(let c of e){if(c.name.endsWith("/")){n.set(c.name,Buffer.alloc(0));continue}let p=U(t,c);if(!p)return null;n.set(c.name,p)}let i=[...n.keys()].filter(c=>/^xl\/worksheets\/sheet\d+\.xml$/.test(c));if(i.length===0)return null;let r=n.get("xl/sharedStrings.xml")?.toString("utf8")??null,o=Ge(r),s=new Set,a={},l=new Set;for(let c of i){let p=n.get(c).toString("utf8"),m=[];for(let h of p.matchAll(ie)){let g=A(h[1],"r"),y=g?/^([A-Z]+)(\d+)$/.exec(g):null;if(!y)return null;m.push({full:h[0],attrs:h[1],inner:h[2]??"",col:y[1],row:Number(y[2]),type:A(h[1],"t")??"n"})}let Z=[...new Set(m.map(h=>h.row))].sort((h,g)=>h-g).slice(0,Ke),k=-1,w=new Map;for(let h of Z){let g=new Map;for(let y of m.filter(_=>_.row===h)){let _=re(y,o),v=_?S(_):null;v&&(g.set(y.col,v.type),l.add(_.trim()))}if(g.size>0){k=h;for(let[y,_]of g)w.set(y,_);break}}let C=p.replace(ie,(h,g,y)=>{let _=A(g,"r"),[,v,ge]=/^([A-Z]+)(\d+)$/.exec(_),E={full:h,attrs:g,inner:y??"",col:v,row:Number(ge),type:A(g,"t")??"n"},$=re(E,o),M=()=>{if(E.type==="s"){let H=/<v>([^<]*)<\/v>/.exec(E.inner);H&&s.add(Number(H[1]))}return h};if($===null||$.trim()==="")return M();let T=w.get(v);if(T&&E.row>k)return Xe(a,`column:${T}`),se(g,`[${T.toUpperCase()}]`);let V=b($,a);return V.text===$?M():se(g,V.text)});n.set(c,Buffer.from(C,"utf8"))}if(r){let c=-1,p=r.replace(/<si\b[^>]*>[\s\S]*?<\/si>|<si\b[^>]*\/>/g,m=>(c+=1,s.has(c)?m:"<si><t></t></si>"));n.set("xl/sharedStrings.xml",Buffer.from(p,"utf8"))}for(let c of[...n.keys()].filter(p=>/^xl\/comments\d*\.xml$/.test(p))){let m=n.get(c).toString("utf8").replace(/(<t(?:\s[^>]*)?>)([\s\S]*?)(<\/t>)/g,(Z,k,w,C)=>{let h=b(x(w),a);return`${k}${oe(h.text)}${C}`});n.set(c,Buffer.from(m,"utf8"))}let d=n.get("docProps/core.xml");if(d){let c=d.toString("utf8").replace(/(<dc:creator>)[\s\S]*?(<\/dc:creator>)/,"$1$2").replace(/(<cp:lastModifiedBy>)[\s\S]*?(<\/cp:lastModifiedBy>)/,"$1$2");n.set("docProps/core.xml",Buffer.from(c,"utf8"))}let f=n.has("xl/calcChain.xml"),u=e.map(c=>c.name).filter(c=>!(f&&c==="xl/calcChain.xml"));if(f)for(let c of["[Content_Types].xml","xl/_rels/workbook.xml.rels"]){let p=n.get(c);p&&n.set(c,Buffer.from(p.toString("utf8").replace(/<(Override|Relationship)\b[^>]*calcChain[^>]*\/>/g,""),"utf8"))}return{bytes:ce(u.map(c=>({name:c,data:n.get(c)}))),counts:a,columnsHidden:[...l]}}function le(t){return/\.ndc$/i.test(t)||/\.clean\.[A-Za-z0-9]+$/.test(t)}var st=new Set([".csv",".tsv",".txt",".md",".json",".log",".xml",".sql",".yaml",".yml",".xlsx",".xlsm",".docx",".pptx",".pdf"]),ot=50*1024*1024,at=8,ct={israeli_id:"Israeli ID",credit_card:"card",iban:"IBAN",israeli_phone:"phone",email:"email",secret:"secret"};function he(t){let e=nt(t).toLowerCase();return st.has(pe(e))||e===".env"||e.startsWith(".env.")}function lt(t){let e=pe(t).toLowerCase(),n=tt(t),i,r;if(e===".csv"||e===".tsv")r=n.toString("utf8"),i=z(r,e===".tsv"?"	":void 0).counts;else if(e===".xlsx"||e===".xlsm"||e===".docx"||e===".pptx"||e===".pdf"){let s=e===".xlsx"||e===".xlsm"?B(n):null;r=j(n,e)?.text??"",i=s?s.counts:b(r).counts}else r=n.toString("utf8"),i=b(r).counts;let o=P.filter(s=>s.pattern.test(r)).length;return o&&(i.secret=(i.secret??0)+o),i}function dt(t){return Object.entries(t).sort((e,n)=>n[1]-e[1]).map(([e,n])=>`${n} ${e.startsWith("column:")?`${e.slice(7)} (column)`:ct[e]??e}`).join(", ")}function ft(t,e,n){let i=o=>it(o)?o:rt(n,o),r=o=>{try{return fe(o).isFile()}catch{return!1}};if(t==="Read"&&typeof e.file_path=="string")return[i(e.file_path)];if(t==="Grep"&&typeof e.path=="string"&&r(i(e.path)))return[i(e.path)];if(t==="Bash"&&typeof e.command=="string"){let o=e.command.match(/"[^"]*"|'[^']*'|[^\s|;&<>()]+/g)??[],s=[];for(let a of o){let l=i(a.replace(/^['"]|['"]$/g,"").replace(/^~(?=\/)/,ue()));if(he(l)&&r(l)&&!s.includes(l)&&s.push(l),s.length>=at)break}return s}return[]}function ut(t,e,n,i){let r=[];for(let s of ft(t,e,n)){if(!he(s)||le(s)||!Qe(s))continue;let a;try{if(fe(s).size>ot)a=`${s}: too large to check here (over 50 MB)`;else{let l=lt(s);if(Object.keys(l).length===0)continue;a=`${s}: ${dt(l)}`}}catch{a=`${s}: could not be checked`}r.push(a)}if(r.length===0)return{decision:"allow"};let o=`NoData scanned this on your machine before the assistant reads it:
+`))}o+f.length>J&&(f=f.slice(0,Math.max(0,J-o)),c=!0),f.trim().length!==0&&(s.push(f),a.push(l),o+=f.length)}return s.length===0?null:{text:s.join(`
+`),truncated:c,parts:a}}function Q(t,e){if(be.has(e))return yt(t,e);if(X.has(e)){let n=ye(t);return n?{text:n.text,truncated:n.truncated,parts:[`pdf:${n.streams}-streams`]}:null}return null}var bt=new Set([...be,...X]);import{deflateRawSync as xt}from"node:zlib";var _e={israeli_id:"[ID]",credit_card:"[CARD]",iban:"[IBAN]",israeli_phone:"[PHONE]",email:"[EMAIL]"},_t=/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g,vt=[...pe].sort((t,e)=>+(e.subkind==="iban")-+(t.subkind==="iban"));function P(t,e,n=1){t[e]=(t[e]??0)+n}function _(t,e={}){let n=t;for(let i of vt)i.pattern.lastIndex=0,n=n.replace(i.pattern,r=>i.validate(r)?(P(e,i.subkind),_e[i.subkind]??`[${i.subkind.toUpperCase()}]`):r);n=n.replace(_t,()=>(P(e,"email"),_e.email));for(let i of V()){let r=i.find(n).sort((s,a)=>a.start-s.start);for(let s of r)n=n.slice(0,s.start)+`[${i.kind.toUpperCase()}]`+n.slice(s.end),P(e,i.kind)}return{text:n,counts:e,columnsHidden:[]}}function ee(){let t=new Map,e={};return(n,i)=>{let r=`${n}\0${i.trim()}`,s=t.get(r);return s===void 0&&(s=e[n]=(e[n]??0)+1,t.set(r,s)),`[${n.toUpperCase()}-${s}]`}}var ke=/^\s*-?\d+(?:\.\d+)?\s*$/;function te(t){let e=new Set;for(let[n,i]of t){let r=i.filter(a=>ke.test(a));if(r.length<3)continue;r.filter(a=>_(a).text!==a).length/r.length<.5&&e.add(n)}return e}function ve(t,e){return t.includes(e)||t.includes('"')||t.includes(`
+`)?`"${t.replace(/"/g,'""')}"`:t}function kt(t){let e=(t.match(/\t/g)??[]).length,n=(t.match(/;/g)??[]).length,i=(t.match(/,/g)??[]).length;return e>i&&e>=n?"	":n>i?";":","}function ne(t,e){let n=t.split(/\r?\n/),i=e??kt(n[0]??""),r=R(n[0]??"",i),s=r.map(p=>$(p)),a={},o=ee(),c=n.slice(1).map(p=>p===""?null:R(p,i)),l=new Map;for(let p of c)p?.forEach((h,m)=>l.set(m,[...l.get(m)??[],h]));let u=te(l),d=A();if(d){let p=c.filter(h=>h!==null).slice(0,200);for(let h of d({name:"table",headers:r,rows:p})){let m=r.indexOf(h.column);m>=0&&!(h.how==="header"&&u.has(m))&&(s[m]={type:h.type,label:h.category})}}let f=[r.map(p=>ve(p,i)).join(i)];for(let p of c){if(p===null){f.push("");continue}let h=p.map((m,k)=>{let v=s[k];return v&&m.trim()!==""?(P(a,`column:${v.type}`),o(v.type,m)):u.has(k)&&ke.test(m)?m:_(m,a).text});f.push(h.map(m=>ve(m,i)).join(i))}return{text:f.join(`
+`),counts:a,columnsHidden:r.filter((p,h)=>s[h])}}var St=/^xl\/(pivotCache|charts|externalLinks)\//,Se=10;function wt(t,e,n=1){t[e]=(t[e]??0)+n}function we(t){return t.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function Ie(t){let e=t.replace(/<rPh\b[\s\S]*?<\/rPh>/g,""),n="";for(let i of e.matchAll(/<t(?:\s[^>]*)?>([\s\S]*?)<\/t>/g))n+=i[1];return x(n)}function It(t){return t?[...t.matchAll(/<si\b[^>]*>([\s\S]*?)<\/si>|<si\b[^>]*\/>/g)].map(e=>Ie(e[1]??"")):[]}var Ee=/<c\b([^>]*?)(?:\/>|>([\s\S]*?)<\/c>)/g;function F(t,e){let n=new RegExp(`\\b${e}="([^"]*)"`).exec(t);return n?n[1]:null}function S(t,e){if(t.type==="s"){let i=/<v>([^<]*)<\/v>/.exec(t.inner);return i?e[Number(i[1])]??null:null}if(t.type==="inlineStr"){let i=/<is>([\s\S]*?)<\/is>/.exec(t.inner);return i?Ie(i[1]):null}if(t.type==="b"||t.type==="e")return null;let n=/<v>([^<]*)<\/v>/.exec(t.inner);return n?x(n[1]):null}function Et(t){let e=[];for(let n of t.matchAll(Ee)){let i=F(n[1],"r"),r=i?/^([A-Z]+)(\d+)$/.exec(i):null;if(!r)return null;e.push({full:n[0],attrs:n[1],inner:n[2]??"",col:r[1],row:Number(r[2]),type:F(n[1],"t")??"n"})}return e}function At(t,e){let n=[...new Set(t.map(i=>i.row))].sort((i,r)=>i-r).slice(0,Se);for(let i of n){let r=new Map;for(let s of t.filter(a=>a.row===i)){let a=S(s,e),o=a?$(a):null;o&&r.set(s.col,{type:o.type,header:a.trim()})}if(r.size>0)return{row:i,cols:r}}return{row:-1,cols:new Map}}var $t=/^xl\/worksheets\/sheet\d+\.xml$/,Tt=200;function Ct(t){let e=t.trim();return/^[\d.,\-+/:%$₪€\s]+$/.test(e)||e.length>60}function Rt(t,e){let n=[...new Set(t.map(s=>s.row))].sort((s,a)=>s-a).slice(0,Se),i=-1,r=-1/0;for(let s of n){let a=t.filter(l=>l.row===s).map(l=>(S(l,e)??"").trim()).filter(Boolean);if(a.length<2)continue;let o=a.filter(l=>!Ct(l)).length,c=o*2-(a.length-o);c>r&&(r=c,i=s)}return i}function Pt(t,e,n){let i=At(e,n),r=A();if(!r)return i;let s=i.row>=0?i.row:Rt(e,n);if(s<0)return i;let a=e.filter(d=>d.row===s).map(d=>({col:d.col,text:(S(d,n)??"").trim()})).filter(d=>d.text),o=new Map(a.map((d,f)=>[d.col,f])),c=new Map;for(let d of e){if(d.row<=s)continue;let f=o.get(d.col);if(f!==void 0){if(!c.has(d.row)){if(c.size>=Tt)continue;c.set(d.row,a.map(()=>""))}c.get(d.row)[f]=S(d,n)??""}}let l=new Map(s===i.row?i.cols:[]),u=a.map(d=>d.text);for(let d of r({name:t,headers:u,rows:[...c.values()]})){let f=u.indexOf(d.column);f<0||l.set(a[f].col,{type:d.type,header:d.column,category:d.category,severity:d.severity,how:d.how})}return{row:s,cols:l}}function xe(t,e){return`<c${t.replace(/\s*\bt="[^"]*"/,"")} t="inlineStr"><is><t xml:space="preserve">${we(e)}</t></is></c>`}var Ft=(()=>{let t=new Uint32Array(256);for(let e=0;e<256;e+=1){let n=e;for(let i=0;i<8;i+=1)n=n&1?3988292384^n>>>1:n>>>1;t[e]=n>>>0}return t})();function Ht(t){let e=4294967295;for(let n=0;n<t.length;n+=1)e=Ft[(e^t[n])&255]^e>>>8;return(e^4294967295)>>>0}function Ae(t){let e=[],n=[],i=0;for(let a of t){let o=Buffer.from(a.name,"utf8"),c=a.name.endsWith("/"),l=c?Buffer.alloc(0):xt(a.data),u=c?0:8,d=c?0:Ht(a.data),f=Buffer.alloc(30);f.writeUInt32LE(67324752,0),f.writeUInt16LE(20,4),f.writeUInt16LE(2048,6),f.writeUInt16LE(u,8),f.writeUInt32LE(d,14),f.writeUInt32LE(l.length,18),f.writeUInt32LE(a.data.length,22),f.writeUInt16LE(o.length,26),e.push(f,o,l);let p=Buffer.alloc(46);p.writeUInt32LE(33639248,0),p.writeUInt16LE(20,4),p.writeUInt16LE(20,6),p.writeUInt16LE(2048,8),p.writeUInt16LE(u,10),p.writeUInt32LE(d,16),p.writeUInt32LE(l.length,20),p.writeUInt32LE(a.data.length,24),p.writeUInt16LE(o.length,28),p.writeUInt32LE(i,42),n.push(p,o),i+=f.length+o.length+l.length}let r=Buffer.concat(n),s=Buffer.alloc(22);return s.writeUInt32LE(101010256,0),s.writeUInt16LE(t.length,8),s.writeUInt16LE(t.length,10),s.writeUInt32LE(r.length,12),s.writeUInt32LE(i,16),Buffer.concat([...e,r,s])}function ie(t){let e=q(t);if(!e||e.length===0||e.some(p=>St.test(p.name)))return null;let n=new Map;for(let p of e){if(p.name.endsWith("/")){n.set(p.name,Buffer.alloc(0));continue}let h=Y(t,p);if(!h)return null;n.set(p.name,h)}let i=[...n.keys()].filter(p=>$t.test(p));if(i.length===0)return null;let r=n.get("xl/sharedStrings.xml")?.toString("utf8")??null,s=It(r),a=new Set,o={},c=new Set,l=ee();for(let p of i){let h=n.get(p).toString("utf8"),m=Et(h);if(!m)return null;let k=Pt(p.replace(/^xl\/worksheets\//,"").replace(/\.xml$/,""),m,s),v=k.row,w=new Map;for(let g of m){if(g.type!=="n"||g.row<=v)continue;let y=S(g,s);y!==null&&w.set(g.col,[...w.get(g.col)??[],y])}let T=te(w),C=new Map;for(let[g,{type:y,header:O,how:j}]of k.cols)j==="header"&&T.has(g)||(C.set(g,y),c.add(O));let We=h.replace(Ee,(g,y,O)=>{let j=F(y,"r"),[,B,Ve]=/^([A-Z]+)(\d+)$/.exec(j),I={full:g,attrs:y,inner:O??"",col:B,row:Number(Ve),type:F(y,"t")??"n"},E=S(I,s),U=()=>{if(I.type==="s"){let oe=/<v>([^<]*)<\/v>/.exec(I.inner);oe&&a.add(Number(oe[1]))}return g};if(E===null||E.trim()==="")return U();let Z=C.get(B);if(Z&&I.row>v)return wt(o,`column:${Z}`),xe(y,l(Z,E));if(I.type==="n"&&T.has(B))return U();let ae=_(E,o);return ae.text===E?U():xe(y,ae.text)});n.set(p,Buffer.from(We,"utf8"))}if(r){let p=-1,h=r.replace(/<si\b[^>]*>[\s\S]*?<\/si>|<si\b[^>]*\/>/g,m=>(p+=1,a.has(p)?m:"<si><t></t></si>"));n.set("xl/sharedStrings.xml",Buffer.from(h,"utf8"))}for(let p of[...n.keys()].filter(h=>/^xl\/comments\d*\.xml$/.test(h))){let m=n.get(p).toString("utf8").replace(/(<t(?:\s[^>]*)?>)([\s\S]*?)(<\/t>)/g,(k,v,w,T)=>{let C=_(x(w),o);return`${v}${we(C.text)}${T}`});n.set(p,Buffer.from(m,"utf8"))}let u=n.get("docProps/core.xml");if(u){let p=u.toString("utf8").replace(/(<dc:creator>)[\s\S]*?(<\/dc:creator>)/,"$1$2").replace(/(<cp:lastModifiedBy>)[\s\S]*?(<\/cp:lastModifiedBy>)/,"$1$2");n.set("docProps/core.xml",Buffer.from(p,"utf8"))}let d=n.has("xl/calcChain.xml"),f=e.map(p=>p.name).filter(p=>!(d&&p==="xl/calcChain.xml"));if(d)for(let p of["[Content_Types].xml","xl/_rels/workbook.xml.rels"]){let h=n.get(p);h&&n.set(p,Buffer.from(h.toString("utf8").replace(/<(Override|Relationship)\b[^>]*calcChain[^>]*\/>/g,""),"utf8"))}return{bytes:Ae(f.map(p=>({name:p,data:n.get(p)}))),counts:o,columnsHidden:[...c]}}var Wn=64*1024*1024,Vn=32*1024;function $e(t){return/\.ndc$/i.test(t)||/\.clean\.[A-Za-z0-9]+$/.test(t)}var Ut=new Set([".csv",".tsv",".txt",".md",".json",".log",".xml",".sql",".yaml",".yml",".xlsx",".xlsm",".docx",".pptx",".pdf"]),Zt=50*1024*1024,Wt=8,Vt={israeli_id:"Israeli ID",credit_card:"card",iban:"IBAN",israeli_phone:"phone",email:"email",secret:"secret"};function Fe(t){let e=Ot(t).toLowerCase();return Ut.has(Pe(e))||e===".env"||e.startsWith(".env.")}function Kt(t){let e=Pe(t).toLowerCase(),n=Mt(t),i,r;if(e===".csv"||e===".tsv")r=n.toString("utf8"),i=ne(r,e===".tsv"?"	":void 0).counts;else if(e===".xlsx"||e===".xlsm"||e===".docx"||e===".pptx"||e===".pdf"){let a=e===".xlsx"||e===".xlsm"?ie(n):null;r=Q(n,e)?.text??"",i=a?a.counts:_(r).counts}else r=n.toString("utf8"),i=_(r).counts;let s=le.filter(a=>a.pattern.test(r)).length;return s&&(i.secret=(i.secret??0)+s),i}function Gt(t){return Object.entries(t).sort((e,n)=>n[1]-e[1]).map(([e,n])=>`${n} ${e.startsWith("column:")?`${e.slice(7)} (column)`:Vt[e]??e}`).join(", ")}function Xt(t,e,n){let i=s=>jt(s)?s:Bt(n,s),r=s=>{try{return Ce(s).isFile()}catch{return!1}};if(t==="Read"&&typeof e.file_path=="string")return[i(e.file_path)];if(t==="Grep"&&typeof e.path=="string"&&r(i(e.path)))return[i(e.path)];if(t==="Bash"&&typeof e.command=="string"){let s=e.command.match(/"[^"]*"|'[^']*'|[^\s|;&<>()]+/g)??[],a=[];for(let o of s){let c=i(o.replace(/^['"]|['"]$/g,"").replace(/^~(?=\/)/,Re()));if(Fe(c)&&r(c)&&!a.includes(c)&&a.push(c),a.length>=Wt)break}return a}return[]}function re(t){return t.replace(/\\+/g,"/")}function Jt(t,e,n,i){let r=[];for(let a of Xt(t,e,n)){if(!Fe(a)||$e(a)||!Nt(a))continue;let o;try{if(Ce(a).size>Zt)o=`${re(a)}: too large to check here (over 50 MB)`;else{let c=Kt(a);if(Object.keys(c).length===0)continue;o=`${re(a)}: ${Gt(c)}`}}catch{o=`${re(a)}: could not be checked`}r.push(o)}if(r.length===0)return{decision:"allow"};let s=`NoData scanned this on your machine before the assistant reads it:
   ${r.join(`
   `)}
-Reading it puts these values in front of the AI. Safer: nodata_redact (a clean copy to work on) or nodata_protect (lock it).`+(i?"":" Allow this read anyway?");return{decision:i?"deny":"ask",reason:o}}function pt(t){try{let e=de(ue(),".nodata");et(e,{recursive:!0}),Ye(de(e,"gate.log"),JSON.stringify({at:new Date().toISOString(),...t})+`
-`,{mode:384})}catch{}}async function me(t){let e=t.includes("--block"),n="";for await(let s of process.stdin)n+=s;let i;try{i=JSON.parse(n)}catch{return}let r=i.tool_name??"",o=ut(r,i.tool_input??{},i.cwd??process.cwd(),e);o.decision!=="allow"&&(pt({tool:r,decision:o.decision}),process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:o.decision,permissionDecisionReason:o.reason}})))}me(process.argv.slice(2)).catch(()=>{process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"ask",permissionDecisionReason:"NoData could not check this file before it is read. Allow anyway?"}}))});
+Reading it puts these values in front of the AI. Safer: nodata_redact (a clean copy to work on) or nodata_protect (lock it).`+(i?"":" Allow this read anyway?");return{decision:i?"deny":"ask",reason:s}}function qt(t){try{let e=Te(Re(),".nodata");zt(e,{recursive:!0}),Dt(Te(e,"gate.log"),JSON.stringify({at:new Date().toISOString(),...t})+`
+`,{mode:384})}catch{}}async function He(t){let e=t.includes("--block"),n="";for await(let a of process.stdin)n+=a;let i;try{i=JSON.parse(n)}catch{return}let r=i.tool_name??"",s=Jt(r,i.tool_input??{},i.cwd??process.cwd(),e);s.decision!=="allow"&&(qt({tool:r,decision:s.decision}),process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:s.decision,permissionDecisionReason:s.reason}})))}var Yt=[{type:"id_number",patterns:[/\b\d{9}\b/g,/ת\.?ז\.?\s*:?\s*(\d{9})/g,/זהות\s*:?\s*(\d{9})/g],confidence:.9,replacement:()=>"[\u05EA.\u05D6. \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"phone",patterns:[/\b0[2-9]\d[\s\-]?\d{7}\b/g,/\b05[0-9][\s\-]?\d{7}\b/g,/\+972[\s\-]?[2-9]\d[\s\-]?\d{7}\b/g],confidence:.95,replacement:()=>"[\u05D8\u05DC\u05E4\u05D5\u05DF \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"email",patterns:[/[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}/g],confidence:.99,replacement:t=>{let[,e]=t.split("@");return`[\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC: ***@${e}]`}},{type:"full_name",patterns:[/(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק)[:\s]+([א-ת][א-ת"'\-\s]{2,30}?)(?=[,\n\d]|ת\.ז)/g,/(?:עו"ד|ד"ר|פרופ'|מר|גברת)\s+([א-ת][א-ת"'\-\s]{2,25}?)(?=[,\n])/g],confidence:.75,replacement:()=>"[\u05E9\u05DD \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"bank_account",patterns:[/\b\d{2}[\-]\d{5,9}[\-]\d{2,3}\b/g,/(?:חשבון|ח-ן)\s*:?\s*(\d[\d\-]{8,15})/g],confidence:.88,replacement:()=>"[\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"medical",patterns:[/(?<![א-ת])[בהוכלמש]{0,2}(?:סוכרת|יתר לחץ דם|אסתמה|דיכאון|חרדה|סרטן|אי ספיקת לב|אפילפסיה)(?![א-ת])/g,/\b(?:Metformin|Lisinopril|Atorvastatin|Amlodipine|Sertraline|Fluoxetine|Omeprazole|Warfarin|Aspirin|Insulin)\b/gi,/\bHbA1c\s*:?\s*[\d.]+%?/g,/\bBMI\s*:?\s*[\d.]+/g,/(?<![א-ת])[בהוכלמש]{0,2}אבחנ[הות]\s*:?\s*[^,\n.]{2,40}/g],confidence:.85,replacement:()=>"[\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"financial_amount",patterns:[/[\d,]+(?:\.\d{2})?\s*(?:₪|ש"ח|NIS|שקל(?:ים)?)/g,/(?:₪|NIS)\s*[\d,]+(?:\.\d{2})?/g],confidence:.92,replacement:()=>"[\u05E1\u05DB\u05D5\u05DD \u05DB\u05E1\u05E4\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"birth_date",patterns:[/(?:תאריך לידה|נולד|נולדה|ד\.ל\.)\s*:?\s*\d{1,2}[\/\.\-]\d{1,2}[\/\.\-]\d{2,4}/g,/(?<![א-ת])[בהוכלמש]{0,2}גיל\s*:?\s*\d{1,3}\b/g],confidence:.88,replacement:()=>"[\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4 \u05DE\u05D5\u05E1\u05EA\u05E8]"},{type:"address",patterns:[/רחוב\s+[א-ת][א-ת\s"'\-]{2,30}\s+\d{1,5}/g,/(?:רח'|רח\.)\s+[א-ת][א-ת\s"'\-]{2,30}\d{1,5}/g],confidence:.72,replacement:()=>"[\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"},{type:"license_plate",patterns:[/\b\d{2,3}[\-]\d{2,3}[\-]\d{2,3}\b/g],confidence:.8,replacement:()=>"[\u05DC\u05D5\u05D7\u05D9\u05EA \u05E8\u05D9\u05E9\u05D5\u05D9 \u05DE\u05D5\u05E1\u05EA\u05E8\u05EA]"}];function Qt(t){if(t.length!==9)return!1;let e=t.split("").map(Number),n=0;for(let i=0;i<9;i++){let r=e[i]*(i%2===0?1:2);r>9&&(r-=9),n+=r}return n%10===0}var H=class{constructor(e){this.enabledTypes=new Set(e)}detect(e){let n=[],i=new Set;for(let s of Yt)if(this.enabledTypes.has(s.type))for(let a of s.patterns){let o=new RegExp(a.source,a.flags),c;for(;(c=o.exec(e))!==null;){let l=c[0],u=`${s.type}:${c.index}`;if(!i.has(u)){if(i.add(u),s.type==="id_number"){let d=l.replace(/\D/g,"");if(/^\d{9}$/.test(l)&&d.length===9&&!Qt(d))continue}n.push({type:s.type,value:l,startIndex:c.index,endIndex:c.index+l.length,confidence:s.confidence,replacement:s.replacement(l,s.type)})}}}n.sort((s,a)=>s.startIndex-a.startIndex||a.confidence-s.confidence);let r=[];for(let s of n)r.some(o=>s.startIndex<o.endIndex&&s.endIndex>o.startIndex)||r.push(s);return r}};var en=[{pattern:/^(?:שם|שם_מלא|שם פרטי|שם_פרטי|שם משפחה|שם_משפחה|שם_אדם|שם הלקוח|שם_הלקוח|שם בן זוג|שם בן_זוג|שם המבוטח|שם_המבוטח|שם המוטב|שם_המוטב|שם מבוטח|שם_מבוטח|שם מוטב|שם_מוטב|שם הילד|שם_הילד|שם הקטין|שם_הקטין|firstname_he|lastname_he|shem|shem_mishpacha|shem_prati)$/i,type:"name",label:"Person name (Hebrew)",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(?:ת"ז|ת\.ז|ת ז|תז|תעודת זהות|תעודת_זהות|מספר זהות|מספר_זהות|מס' זהות|מס_זהות|מס' ת"ז|teudat_zehut|tz|t_z|israeli_id|il_id)$/i,type:"id",label:"Israeli ID",labelHe:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA"},{pattern:/^(?:דרכון|מספר דרכון|מס דרכון|רישיון נהיגה|רישיון_נהיגה|רשיון נהיגה|מס רישיון|דרכון_מספר)$/i,type:"id",label:"Passport / DL (Hebrew)",labelHe:"\u05D3\u05E8\u05DB\u05D5\u05DF/\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF"},{pattern:/^(?:מייל|דוא"ל|דוא_ל|דואר אלקטרוני|דואר_אלקטרוני|אימייל|כתובת מייל|כתובת_מייל|כתובת דואר|כתובת_דואר)$/i,type:"email",label:"Email (Hebrew)",labelHe:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9"},{pattern:/^(?:טלפון|טל'|נייד|פלאפון|סלולרי|מספר טלפון|מספר_טלפון|טלפון נייד|טלפון_נייד|מס נייד|מס_נייד|מס' טל)$/i,type:"phone",label:"Phone (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(?:כתובת|כתובת מגורים|כתובת_מגורים|רחוב|מס בית|מספר בית|עיר|ישוב|יישוב|מיקוד|כתובת מלאה|כתובת_מלאה|מען)$/i,type:"address",label:"Address (Hebrew)",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(?:תאריך לידה|תאריך_לידה|ת לידה|תאריך הולדת|תאריך_הולדת|יום הולדת|יום_הולדת|גיל)$/i,type:"dob",label:"Date of birth (Hebrew)",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(?:חשבון בנק|חשבון_בנק|מספר חשבון|מספר_חשבון|מס חשבון|מס' חשבון|בנק|סניף|מס סניף|iban|iban_il)$/i,type:"financial",label:"Bank account (Hebrew)",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(?:כרטיס אשראי|כרטיס_אשראי|מספר אשראי|מס אשראי|מס' אשראי|cvv|אשראי|מס כרטיס|מס_כרטיס)$/i,type:"financial",label:"Credit card (Hebrew)",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(?:שכר|משכורת|הכנסה|פרמיה|שכר ברוטו|שכר_ברוטו|שכר נטו|שכר_נטו|תגמול|בונוס|פיצוי)$/i,type:"financial",label:"Salary / income (Hebrew)",labelHe:"\u05E9\u05DB\u05E8/\u05D4\u05DB\u05E0\u05E1\u05D4"},{pattern:/^(?:אבחון|אבחנה|מחלה|תרופה|מרשם|בדיקה רפואית|בדיקה_רפואית|מצב רפואי|מצב_רפואי|חיסון|תוצאת בדיקה|תוצאת_בדיקה|רופא|רגישות|אלרגיה|סוג דם|סוג_דם)$/i,type:"medical",label:"Medical (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(?:מספר פוליסה|מספר_פוליסה|מס פוליסה|מס' פוליסה|פוליסה|מספר חבר|מספר_חבר|מס חבר|מספר ביטוח|מספר_ביטוח|policy_?number|policy_?no|policy_?id)$/i,type:"policy",label:"Insurance policy number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"},{pattern:/^(?:מספר סוכן|מספר_סוכן|מס סוכן|מס' סוכן|מס_סוכן|קוד סוכן|קוד_סוכן|מספר משווק|מספר_משווק|מספר יצרן|סוכן ביטוח|agent_?number|agent_?no|agent_?id|agent_?code|broker_?id|broker_?number)$/i,type:"agent_id",label:"Insurance agent / broker number (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"},{pattern:/^(?:שם הילד|שם_הילד|תעודת זהות של ילד|ילדים|קטין|מספר ילדים|מספר_ילדים|תעודת לידה|ת לידה ילד)$/i,type:"minor_data",label:"Minor data (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF"},{pattern:/^(?:דת|לאום|מין|נטייה מינית|נטייה_מינית|השקפה פוליטית|השקפה_פוליטית|מצב משפחתי|מצב_משפחתי|עדה|מוצא)$/i,type:"sensitive_personal",label:"Sensitive personal (Hebrew)",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(?:מספר רכב|מספר_רכב|מס רכב|מס' רכב|לוחית רישוי|לוחית_רישוי|מספר רישוי|מספר_רישוי)$/i,type:"tracking",label:"Vehicle ID (Hebrew)",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"}];function se(t){let e=String(t??"").replace(/\D/g,"");if(e.length===0||e.length>9)return!1;let n=e.padStart(9,"0"),i=0;for(let r=0;r<9;r++){let s=parseInt(n[r]??"0",10)*(r%2+1);s>9&&(s-=9),i+=s}return i%10===0&&parseInt(n,10)>0}var L=/(?:\+972[\s-]?|0)(?:5[0-9]|[2-4]|[89])(?:[\s-]?\d){7}/g,D=/[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}/gi,N=/\bIL\d{2}\s?(?:\d{4}\s?){4}\d{3}\b/g;function Le(t){let e=String(t??"").replace(/\D/g,"");if(e.length<13||e.length>19)return!1;let n=0,i=!1;for(let r=e.length-1;r>=0;r--){let s=e.charCodeAt(r)-48;if(s<0||s>9)return!1;i&&(s*=2,s>9&&(s-=9)),n+=s,i=!i}return n%10===0}function De(t){if(!t)return null;let e=t.trim();for(let n of en)if(n.pattern.test(e))return{type:n.type,label:n.label,labelHe:n.labelHe};return null}var tn=[{type:"biometric",tokens:["biometric","fingerprint","\u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"],phrases:["face id","\u05D8\u05D1\u05D9\u05E2\u05EA \u05D0\u05E6\u05D1\u05E2"]},{type:"medical",tokens:["diagnosis","medical","disease","medication","prescription","allergy","vaccine","\u05D0\u05D1\u05D7\u05D5\u05DF","\u05D0\u05D1\u05D7\u05E0\u05D4","\u05DE\u05D7\u05DC\u05D4","\u05EA\u05E8\u05D5\u05E4\u05D4","\u05DE\u05E8\u05E9\u05DD","\u05D7\u05D9\u05E1\u05D5\u05DF","\u05D0\u05DC\u05E8\u05D2\u05D9\u05D4"],phrases:["medical record","blood type","\u05DE\u05E6\u05D1 \u05E8\u05E4\u05D5\u05D0\u05D9","\u05E1\u05D5\u05D2 \u05D3\u05DD"]},{type:"sensitive_personal",tokens:["religion","ethnicity","nationality","\u05D3\u05EA","\u05DC\u05D0\u05D5\u05DD","\u05E2\u05D3\u05D4","\u05DE\u05D5\u05E6\u05D0"],phrases:["sexual orientation","marital status","\u05DE\u05E6\u05D1 \u05DE\u05E9\u05E4\u05D7\u05EA\u05D9","\u05E0\u05D8\u05D9\u05D9\u05D4 \u05DE\u05D9\u05E0\u05D9\u05EA"]},{type:"minor_data",tokens:["minor","\u05E7\u05D8\u05D9\u05DF"],phrases:["child name","\u05E9\u05DD \u05D4\u05D9\u05DC\u05D3","\u05E9\u05DD \u05D4\u05E7\u05D8\u05D9\u05DF"]},{type:"id",tokens:["ssn","passport","\u05D6\u05D4\u05D5\u05EA","\u05D3\u05E8\u05DB\u05D5\u05DF"],phrases:["national id","id number","identity number","social security","driver license","driving license","drivers license","passport number","tax id","\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA","\u05DE\u05E1\u05E4\u05E8 \u05D6\u05D4\u05D5\u05EA","\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"]},{type:"financial",tokens:["iban","swift","bic","salary","income","wage","\u05D0\u05E9\u05E8\u05D0\u05D9","\u05E9\u05DB\u05E8","\u05DE\u05E9\u05DB\u05D5\u05E8\u05EA","\u05D4\u05DB\u05E0\u05E1\u05D4"],phrases:["bank account","account number","credit card","card number","routing number","sort code","\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7","\u05DE\u05E1\u05E4\u05E8 \u05D7\u05E9\u05D1\u05D5\u05DF","\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"]},{type:"policy",tokens:["policy","\u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"],phrases:["policy number","member number","\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4"]},{type:"agent_id",tokens:["\u05DE\u05E9\u05D5\u05D5\u05E7"],phrases:["agent number","agent code","broker id","\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF"]},{type:"dob",tokens:["dob","birthdate","birthday","\u05DC\u05D9\u05D3\u05D4","\u05D4\u05D5\u05DC\u05D3\u05EA","\u05D2\u05D9\u05DC"],phrases:["date of birth","birth date","\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"]},{type:"phone",tokens:["phone","tel","mobile","cell","fax","\u05D8\u05DC\u05E4\u05D5\u05DF","\u05E0\u05D9\u05D9\u05D3","\u05E4\u05DC\u05D0\u05E4\u05D5\u05DF","\u05E1\u05DC\u05D5\u05DC\u05E8\u05D9"],phrases:["phone number","mobile number","cell phone","\u05D8\u05DC\u05E4\u05D5\u05DF \u05E0\u05D9\u05D9\u05D3"]},{type:"email",tokens:["email","mail","\u05D0\u05D9\u05DE\u05D9\u05D9\u05DC","\u05DE\u05D9\u05D9\u05DC","\u05D3\u05D5\u05D0\u05DC"],phrases:["email address","e mail","\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D9\u05D9\u05DC"]},{type:"address",tokens:["address","street","city","zipcode","zip","postcode","\u05DB\u05EA\u05D5\u05D1\u05EA","\u05E8\u05D7\u05D5\u05D1","\u05E2\u05D9\u05E8","\u05D9\u05E9\u05D5\u05D1","\u05D9\u05D9\u05E9\u05D5\u05D1","\u05DE\u05D9\u05E7\u05D5\u05D3","\u05DE\u05E2\u05DF"],phrases:["home address","postal code","street address","zip code","\u05DB\u05EA\u05D5\u05D1\u05EA \u05DE\u05D2\u05D5\u05E8\u05D9\u05DD"]},{type:"location",tokens:["gps","latitude","longitude","geolocation","\u05DE\u05D9\u05E7\u05D5\u05DD"],phrases:["gps coordinates"]},{type:"tracking",tokens:["plate","vehicle","\u05E8\u05DB\u05D1","\u05E8\u05D9\u05E9\u05D5\u05D9"],phrases:["license plate","vehicle number","plate number","\u05DE\u05E1\u05E4\u05E8 \u05E8\u05DB\u05D1"]},{type:"name",tokens:["name","\u05E9\u05DD"],phrases:["first name","last name","full name","family name","given name","surname","\u05E9\u05DD \u05E4\u05E8\u05D8\u05D9","\u05E9\u05DD \u05DE\u05E9\u05E4\u05D7\u05D4","\u05E9\u05DD \u05DE\u05DC\u05D0"]}];function z(t){if(!t)return null;let e=t.trim().toLowerCase().replace(/["'`׳״]/g,"").replace(/[_\-.]+/g," ").replace(/\s+/g," ").trim();if(!e)return null;let n=new Set(e.match(/[\p{L}\p{N}]+/gu)??[]);for(let i of tn)if(i.phrases?.some(s=>e.includes(s))||i.tokens?.some(s=>n.has(s)))return{type:i.type,label:i.type,labelHe:M(i.type)};return null}function M(t){return{id:"\u05EA\u05E2\u05D5\u05D3\u05EA \u05D6\u05D4\u05D5\u05EA",agent_id:"\u05DE\u05E1\u05E4\u05E8 \u05E1\u05D5\u05DB\u05DF",policy:"\u05DE\u05E1\u05E4\u05E8 \u05E4\u05D5\u05DC\u05D9\u05E1\u05D4",name:"\u05E9\u05DD \u05D0\u05D3\u05DD",email:"\u05D3\u05D5\u05D0\u05E8 \u05D0\u05DC\u05E7\u05D8\u05E8\u05D5\u05E0\u05D9",phone:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF",address:"\u05DB\u05EA\u05D5\u05D1\u05EA",dob:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4",financial:"\u05E4\u05E8\u05D8\u05D9\u05DD \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9\u05D9\u05DD",medical:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9",minor_data:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05DF",sensitive_personal:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9",biometric:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9",auth:"\u05E1\u05D9\u05E1\u05DE\u05D0\u05D5\u05EA/\u05E1\u05D5\u05D3\u05D5\u05EA",tracking:"\u05DE\u05D6\u05D4\u05D9 \u05DE\u05E2\u05E7\u05D1",location:"\u05DE\u05D9\u05E7\u05D5\u05DD"}[t]??"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9"}function Ne(t){let e=0,n=0,i=0,r=0,s=0;for(let o of t)typeof o=="string"&&(se(o)&&e++,L.lastIndex=0,L.test(o)&&n++,D.lastIndex=0,D.test(o)&&i++,N.lastIndex=0,N.test(o)&&r++,Le(o)&&s++);let a=t.length||1;return e/a>=.3?{type:"id",label:"Israeli ID (sniffed)",matchedSample:e}:r/a>=.3?{type:"financial",label:"IBAN-IL (sniffed)",matchedSample:r}:n/a>=.3?{type:"phone",label:"IL phone (sniffed)",matchedSample:n}:i/a>=.3?{type:"email",label:"Email (sniffed)",matchedSample:i}:s/a>=.3?{type:"financial",label:"Credit card (sniffed)",matchedSample:s}:null}var ze={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var sn=[{pattern:/^(full_?name|first_?name|last_?name|spouse_?name|beneficiary_?name)$/i,type:"name",label:"Person name",labelHe:"\u05E9\u05DD \u05D0\u05D3\u05DD"},{pattern:/^(email|e_?mail|email_?address)$/i,type:"email",label:"Email address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA \u05D0\u05D9\u05DE\u05D9\u05D9\u05DC"},{pattern:/^(phone|mobile|telephone|phone_?number|cell_?phone)$/i,type:"phone",label:"Phone number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D8\u05DC\u05E4\u05D5\u05DF"},{pattern:/^(id_?number|identity|ssn|social_?security|national_?id|teudat_?zehut)$/i,type:"id",label:"ID number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05D6\u05D4\u05D4"},{pattern:/^(address|street_?address|home_?address)$/i,type:"address",label:"Address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA"},{pattern:/^(date_?of_?birth|dob|birth_?date|birthday)$/i,type:"dob",label:"Date of birth",labelHe:"\u05EA\u05D0\u05E8\u05D9\u05DA \u05DC\u05D9\u05D3\u05D4"},{pattern:/^(bank_?account|iban|account_?number|bank_?details|routing_?number)$/i,type:"financial",label:"Bank account",labelHe:"\u05D7\u05E9\u05D1\u05D5\u05DF \u05D1\u05E0\u05E7"},{pattern:/^(credit_?card|card_?number|cvv|cc_?number)$/i,type:"financial",label:"Credit card",labelHe:"\u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9"},{pattern:/^(salary|income|commission|premium|compensation)$/i,type:"financial",label:"Financial data",labelHe:"\u05E0\u05EA\u05D5\u05DF \u05E4\u05D9\u05E0\u05E0\u05E1\u05D9"},{pattern:/^(medical_?info|health_?conditions|diagnosis|medication)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(ip_?address)$/i,type:"tracking",label:"IP address",labelHe:"\u05DB\u05EA\u05D5\u05D1\u05EA IP"},{pattern:/^(passport|passport_?number|passport_?id)$/i,type:"id",label:"Passport number",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D3\u05E8\u05DB\u05D5\u05DF"},{pattern:/^(driver_?license|drivers_?license|dl_?number)$/i,type:"id",label:"Driver license",labelHe:"\u05E8\u05D9\u05E9\u05D9\u05D5\u05DF \u05E0\u05D4\u05D9\u05D2\u05D4"},{pattern:/^(iban|swift_?code|bic)$/i,type:"financial",label:"Banking code",labelHe:"\u05E7\u05D5\u05D3 \u05D1\u05E0\u05E7\u05D0\u05D9"},{pattern:/^(tax_?id|tin|vat_?number|ein)$/i,type:"financial",label:"Tax ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05DE\u05E1"},{pattern:/^(insurance_?number|policy_?number|member_?id)$/i,type:"id",label:"Insurance/Member ID",labelHe:"\u05DE\u05E1\u05E4\u05E8 \u05D1\u05D9\u05D8\u05D5\u05D7/\u05D7\u05D1\u05E8"},{pattern:/^(blood_?type|allergy|allergies|prescription)$/i,type:"medical",label:"Medical data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E8\u05E4\u05D5\u05D0\u05D9"},{pattern:/^(biometric|fingerprint|face_?id|retina)$/i,type:"biometric",label:"Biometric data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D1\u05D9\u05D5\u05DE\u05D8\u05E8\u05D9"},{pattern:/^(latitude|longitude|lat|lng|geo_?location|coordinates)$/i,type:"location",label:"Geolocation",labelHe:"\u05DE\u05D9\u05E7\u05D5\u05DD \u05D2\u05D9\u05D0\u05D5\u05D2\u05E8\u05E4\u05D9"},{pattern:/^(mac_?address|device_?fingerprint|imei|serial_?number)$/i,type:"tracking",label:"Device identifier",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05DE\u05DB\u05E9\u05D9\u05E8"},{pattern:/^(ethnicity|race|religion|political_?affiliation|sexual_?orientation)$/i,type:"sensitive_personal",label:"Sensitive personal",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05D0\u05D9\u05E9\u05D9 \u05E8\u05D2\u05D9\u05E9"},{pattern:/^(minor|child_?name|child_?age|dependent)$/i,type:"minor_data",label:"Minor data",labelHe:"\u05DE\u05D9\u05D3\u05E2 \u05E2\u05DC \u05E7\u05D8\u05D9\u05E0\u05D9\u05DD"},{pattern:/^(signature|digital_?signature)$/i,type:"id",label:"Signature",labelHe:"\u05D7\u05EA\u05D9\u05DE\u05D4"},{pattern:/^(vehicle_?number|license_?plate|plate_?number)$/i,type:"tracking",label:"Vehicle ID",labelHe:"\u05DE\u05D6\u05D4\u05D4 \u05E8\u05DB\u05D1"}],an=/^(id|uuid|created_?at|updated_?at|deleted_?at|status|type|category|description|title|slug|url|path|key|value|sort_?order|position|enabled|active|public|version|metadata|config|settings|options|data|content|body|raw|json|text|note|comment|label|color|icon|image|avatar|logo|thumbnail|preview|template|schema|format|mode|level|priority|severity|source|target|parent|child|owner|creator|modifier|assignee|project|workspace|organization|team|group|channel|thread|room|session|device|platform|browser|locale|timezone|currency|country|region|city|zip|postal|state|province|name|display_?name|user_?agent|password_?hash|secret|token|private_?key|auth_?token|constraint|index|sequence|trigger|function|procedure|database|namespace|migration|revision)$/i,on=/^(beacon_?registr|device_?config|hardware|sensor|firmware|telemetry|metric|analytic|log_?event|audit_?log|system_?config|cache|queue|job|migration|schema_?version|spatial_?ref)/i,cn=/^(minor|major|uuid|rssi|tx_?power|beacon_?id|device_?type|firmware_?version|batch_?id|zone_?id)$/i;function Me(t,e){if(an.test(t)||/^name$/i.test(t)||e&&on.test(e)||cn.test(t))return null;for(let i of sn)if(i.pattern.test(t))return i.type;let n=De(t);return n?n.type:null}var Ei=ze.rules.map(t=>({id:t.id,name:t.name,pattern:new RegExp(t.pattern),severity:t.severity}));var Ai=512*1024,$i=50*1024*1024;var ln={id:"high",agent_id:"high",policy:"high",financial:"high",medical:"critical",sensitive_personal:"critical",minor_data:"critical",biometric:"critical",auth:"critical",name:"medium",email:"high",phone:"high",address:"high",dob:"high",location:"high",tracking:"low"};function dn(t){return ln[t]??"low"}function je(t,e){let n=[];for(let i of e){let r=i.rows.length;for(let s=0;s<i.headers.length;s++){let a=i.headers[s]??"",o=a?Me(a.trim().replace(/["'`׳״:]/g,"").replace(/\s+/g,"_"),i.name)??z(a)?.type??null:null,c=[];for(let u of i.rows){let d=u[s];typeof d=="string"&&d.length>0&&c.push(d)}let l=c.length>0?Ne(c):null;l?n.push(Oe(t,i.name,a,l.type,l.label,"value",l.matchedSample,r)):o&&n.push(Oe(t,i.name,a,o,M(o),"header",0,r))}}return n}function Oe(t,e,n,i,r,s,a,o){return{file:t,location:e,column:n,type:i,label:r,category:M(i),severity:dn(i),matchKind:s,hits:a,sampleSize:o}}var Be={_comment:"CANONICAL secret ruleset \u2014 the SINGLE SOURCE OF TRUTH for hardcoded-secret detection, loaded by BOTH the web scanner (lib/soc/exposure-map.ts) and the installed Capsule agent (apps/desktop/src-tauri/src/scanner.rs, via include_str!). Patterns are written in the regex subset both JavaScript and the Rust `regex` crate accept (no lookaround, no backreferences). A connection string counts only WITH credentials (user:pass@). Edit here once and both engines stay aligned.",rules:[{id:"aws-access-key",subkind:"aws_access_key",name:"AWS Access Key",severity:"critical",pattern:"(?:^|[^A-Z0-9])AKIA[A-Z2-7]{16}(?:[^A-Z2-7]|$)",hint:"AWS access key id detected. Rotate via IAM and move to an environment variable."},{id:"aws-secret-key",subkind:"aws_secret_key",name:"AWS Secret Key",severity:"critical",pattern:`(?:aws_secret_access_key|aws_secret_key|secret_access_key)\\s*[=:]\\s*['"]?[A-Za-z0-9/+=]{40}['"]?`,hint:"AWS secret access key detected. Rotate immediately."},{id:"gcp-api-key",subkind:"gcp_api_key",name:"GCP API Key",severity:"critical",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Google API key detected. Restrict or rotate it in the Google Cloud console."},{id:"gcp-service-account",subkind:"gcp_service_account",name:"GCP Service Account",severity:"critical",pattern:'"type"\\s*:\\s*"service_account"',hint:"GCP service-account JSON detected. Move it out of the repo and rotate the key."},{id:"github-token",subkind:"github_token",name:"GitHub Token",severity:"critical",pattern:"gh[pousr]_[0-9a-zA-Z]{36,}",hint:"GitHub token detected. Revoke at https://github.com/settings/tokens."},{id:"github-fine-grained",subkind:"github_fine_grained_token",name:"GitHub Fine-Grained Token",severity:"critical",pattern:"github_pat_[0-9a-zA-Z_]{22,}",hint:"GitHub fine-grained token detected. Revoke it in GitHub settings."},{id:"gitlab-token",subkind:"gitlab_token",name:"GitLab Token",severity:"critical",pattern:"glpat-[0-9a-zA-Z_-]{20,}",hint:"GitLab token detected. Revoke it in GitLab access tokens."},{id:"stripe-secret",subkind:"stripe_key",name:"Stripe Secret Key",severity:"critical",pattern:"sk_live_[0-9a-zA-Z]{24,}",hint:"Stripe live secret key detected. Roll it in the Stripe dashboard."},{id:"stripe-restricted",subkind:"stripe_restricted_key",name:"Stripe Restricted Key",severity:"critical",pattern:"rk_live_[0-9a-zA-Z]{24,}",hint:"Stripe restricted key detected. Roll it in the Stripe dashboard."},{id:"slack-token",subkind:"slack_token",name:"Slack Token",severity:"high",pattern:"xox[baprs]-[0-9a-zA-Z-]{10,}",hint:"Slack token detected. Revoke it in the Slack app settings."},{id:"slack-webhook",subkind:"slack_webhook",name:"Slack Webhook",severity:"high",pattern:"hooks\\.slack\\.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[0-9a-zA-Z]{24}",hint:"Slack incoming-webhook URL detected. Regenerate it."},{id:"twilio-api-key",subkind:"twilio_api_key",name:"Twilio API Key",severity:"high",pattern:"SK[0-9a-fA-F]{32}",hint:"Twilio API key detected. Rotate it in the Twilio console."},{id:"sendgrid-api-key",subkind:"sendgrid_api_key",name:"SendGrid API Key",severity:"critical",pattern:"SG\\.[0-9a-zA-Z_-]{22}\\.[0-9a-zA-Z_-]{43}",hint:"SendGrid API key detected. Rotate it in the SendGrid console."},{id:"postgres-uri",subkind:"postgres_uri",name:"PostgreSQL Connection String",severity:"critical",pattern:`postgres(?:ql)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"PostgreSQL connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"mongodb-uri",subkind:"mongodb_uri",name:"MongoDB Connection String",severity:"critical",pattern:`mongodb(?:\\+srv)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"MongoDB connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"redis-uri",subkind:"redis_uri",name:"Redis Connection String",severity:"high",pattern:`redis(?:s)?://[^\\s'":/@]*:[^\\s'"@]+@[^\\s'"]+`,hint:"Redis connection string WITH credentials detected. Move it to a secret manager and rotate the password."},{id:"openai-key",subkind:"openai_key",name:"OpenAI API Key",severity:"critical",pattern:"sk-[0-9a-zA-Z]{20,}T3BlbkFJ[0-9a-zA-Z]{20,}",hint:"OpenAI API key detected. Rotate at https://platform.openai.com/api-keys."},{id:"anthropic-key",subkind:"anthropic_key",name:"Anthropic API Key",severity:"critical",pattern:"sk-ant-[0-9a-zA-Z_-]{40,}",hint:"Anthropic API key detected. Rotate at https://console.anthropic.com/."},{id:"firebase-key",subkind:"firebase_key",name:"Firebase API Key",severity:"high",pattern:"AIza[0-9A-Za-z_-]{35}",hint:"Firebase API key detected. Restrict it in the Firebase console."},{id:"supabase-key",subkind:"supabase_key",name:"Supabase Service Key",severity:"critical",pattern:"eyJ[0-9a-zA-Z_-]{100,}",hint:"Long JWT (possible Supabase service key) detected. Rotate it and keep it server-side only."},{id:"private-key",subkind:"private_key",name:"Private Key",severity:"critical",pattern:"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",hint:"Private key material in plaintext. Rotate immediately and move to a key manager (KMS/Vault).",skipPlaceholder:!0},{id:"jwt-secret",subkind:"jwt_secret",name:"JWT/Generic Secret",severity:"high",pattern:`(?:jwt_secret|JWT_SECRET|secret_key|SECRET_KEY|api_secret|API_SECRET)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded signing/API secret detected. Move it to an environment variable and rotate it."},{id:"password-in-code",subkind:"password_in_code",name:"Password in Code",severity:"high",pattern:`(?:password|passwd|pwd)\\s*[=:]\\s*['"][^'"]{8,}['"]`,hint:"Hardcoded password detected. Move it to a secret manager and rotate it."},{id:"bearer-token",subkind:"bearer_token",name:"Bearer Token in Code",severity:"high",pattern:`['"]Bearer\\s+[0-9a-zA-Z._-]{20,}['"]`,hint:"Hardcoded bearer token detected. Move it to a secret manager and rotate it."},{id:"hex-secret-32",subkind:"hex_secret",name:"Hardcoded 32+ Hex Secret",severity:"medium",pattern:`['"][0-9a-f]{32,}['"]`,hint:"Long hex string that looks like a secret/hash. Confirm it is not a live credential."},{id:"base64-secret",subkind:"base64_secret",name:"Hardcoded Base64 Secret (long)",severity:"medium",pattern:`['"][A-Za-z0-9+/]{64,}={0,2}['"]`,hint:"Long base64 blob that looks like an embedded secret. Confirm it is not a live credential."}]};var un=[{type:"full_name",kind:"name",severity:"medium",hint:`A person's name in free text (after a role word such as \u05DC\u05E7\u05D5\u05D7 / \u05DE\u05E8 / \u05E2\u05D5"\u05D3).`},{type:"bank_account",kind:"bank_account",severity:"high",hint:"An Israeli bank account number (branch-account-check form) in plaintext."},{type:"medical",kind:"medical",severity:"high",hint:"Medical information (diagnosis, medication, lab value) in plaintext."},{type:"birth_date",kind:"dob",severity:"medium",hint:"A date of birth in plaintext."},{type:"address",kind:"address",severity:"medium",hint:"A street address in plaintext."},{type:"license_plate",kind:"plate",severity:"low",hint:"A vehicle licence plate in plaintext."}],fn=/^(?:לקוח|מטופל|מועמד|שם|נהג|מבוטח|תובע|נתבע|שוכר|מחזיק|עו"ד|ד"ר|פרופ'|מר|גברת|חשבון|ח-ן|[בהוכלמש]{0,2}אבחנ[הות]|תאריך לידה|נולד|נולדה|ד\.ל\.|[בהוכלמש]{0,2}גיל)\s*:?\s*/;function hn(t,e,n,i){if(i==="address")return{start:e,end:n};let r=fn.exec(t.slice(e,n));return r&&e+r[0].length<n?{start:e+r[0].length,end:n}:{start:e,end:n}}var mn=new Set(["hex-secret-32","base64-secret"]),Ue=!1;function Ze(){if(Ue)return;Ue=!0;let t=un.map(({type:n,kind:i,severity:r,hint:s})=>{let a=new H([n]);return{kind:i,severity:r,hint:s,find:o=>a.detect(o).map(c=>hn(o,c.startIndex,c.endIndex,i))}}),e=Be.rules.filter(n=>!mn.has(n.id)).map(n=>({id:n.id,name:n.name,severity:n.severity,pattern:new RegExp(n.pattern)}));W({text:t,header:n=>{let i=z(n);return i?{type:i.type,label:i.labelHe||i.label}:null},secrets:e,table:n=>je("",[n]).filter(i=>i.column).map(i=>({column:i.column,type:i.type,category:i.category,severity:i.severity,hits:i.hits,how:i.matchKind==="value"?"value":"header"}))})}Ze();He(process.argv.slice(2)).catch(()=>{process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"ask",permissionDecisionReason:"NoData could not check this file before it is read. Allow anyway?"}}))});